npm - @stigmer/server-slim - Versions diffs - 3.37.1 → 3.38.0 - Mend

@stigmer/server-slim 3.37.1 → 3.38.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (553) hide show

package/main.js CHANGED Viewed

@@ -478,14 +478,14 @@ caused by: ${_Layerr.fullStack(cause)}`:err2.stack??""}static info(err2){assertE
 `&&line++;return line}function getColumn(input,offset){let column=1;for(let i6=offset;i6>0&&![`
 `,"\r"].includes(input[i6-1]);i6--)column++;return column}function getLocation(source,input,start,remainder){return{source,start:{offset:input.length-start.length,line:getLine2(input,input.length-start.length),column:getColumn(input,input.length-start.length)},end:{offset:input.length-remainder.length,line:getLine2(input,input.length-remainder.length),column:getColumn(input,input.length-remainder.length)}}}runtime2.getLocation=getLocation;function getRange(source,input,start,remainder){return{source,start:input.length-start.length,end:input.length-remainder.length}}runtime2.getRange=getRange;function getText(start,remainder){return start.slice(0,remainder.length>0?-remainder.length:void 0)}runtime2.getText=getText})(runtime||(runtime={}));var ParseError=class _ParseError extends Error{rawMessage;location;constructor(message6,location,name="parse error"){super(_ParseError.#formatMessage(message6,location)),this.name=name,this.rawMessage=message6,this.location=location}static#formatMessage(message6,location){return`${location.source!==void 0?String(location.source):"<input>"}:${location.start.line}:${location.start.column}: `+message6}},ParseSyntaxError=class _ParseSyntaxError extends ParseError{expected;found;constructor(expected,found,location,name="syntax error"){super(_ParseSyntaxError.#formatMessage(expected,found),location,name),this.expected=expected,this.found=found}static#formatMessage(expected,found){function encode2(s2){return"'"+s2.replace(/[\\\x07\b\f\n\r\t\v']/g,match=>{switch(match){case"\\":return"\\\\";case"\x07":return"\\x07";case"\b":return"\\b";case"\f":return"\\f";case`
 `:return"\\n";case"\r":return"\\r";case"	":return"\\t";case"\v":return"\\v";case"'":return"\\'";default:throw new Error("Unexpected string encoding replacement character. This should be an unreachable error.")}})+"'"}function describeExpected(expected2){let descriptions=[...new Set(expected2.map(e6=>e6.type==="literal"?encode2(e6.value):e6.value))];switch(descriptions.sort(),descriptions.length){case 1:return descriptions[0];case 2:return`${descriptions[0]} or ${descriptions[1]}`;default:return descriptions.slice(0,-1).join(", ")+", or "+descriptions[descriptions.length-1]}}function describeFound(found2){return found2.length===1?found2:"end of input"}return"found "+describeFound(found)+" but expecting "+describeExpected(expected)}},builder=new Builder,item2={type:"any",value:"any character"},item40={type:"class",value:"/^[\\t\\n\\f\\r ]/g"},item41={type:"other",value:"whitespace"},item47={type:"literal",value:"//"},item50={type:"class",value:"/^[^\\r\\n]/g"},item55={type:"class",value:"/^[\\r\\n]/g"},item56={type:"other",value:"new line"},item58={type:"other",value:"comment"},item75={type:"literal",value:"-"},item81={type:"other",value:"digit"},item83={type:"literal",value:"."},item93={type:"class",value:"/^[+\\-]/g"},item104={type:"other",value:"float literal"},item114={type:"literal",value:"0x"},item124={type:"class",value:"/^[uU]/g"},item127={type:"other",value:"unsigned integer literal"},item143={type:"other",value:"integer literal"},item153={type:"class",value:"/^[rR]/g"},item158={type:"literal",value:'"""'},item171={type:"literal",value:"'''"},item182={type:"literal",value:'"'},item194={type:"literal",value:"'"},item222={type:"literal",value:"\\"},item224={type:"class",value:"/^[xX]/g"},item233={type:"other",value:"byte value"},item239={type:"literal",value:"\\u"},item247={type:"literal",value:"\\U"},item259={type:"class",value:"/^[0-3]/g"},item265={type:"other",value:"escaped bytes"},item266={type:"other",value:"byte sequence"},item272={type:"class",value:"/^[abfnrtv]/g"},item278={type:"class",value:"/^[\"'`\\\\?]/g"},item279={type:"other",value:"escaped character"},item326={type:"other",value:"quoted character sequence"},item328={type:"other",value:"string literal"},item334={type:"class",value:"/^[bB]/g"},item338={type:"other",value:"bytes literal"},item345={type:"literal",value:"true"},item347={type:"literal",value:"false"},item349={type:"other",value:"boolean literal"},item355={type:"literal",value:"null"},item361={type:"other",value:"null literal"},item374={type:"class",value:"/^[_a-zA-Z]/g"},item379={type:"other",value:"identifier"},item381={type:"literal",value:"("},item386={type:"literal",value:","},item388={type:"literal",value:")"},item408={type:"other",value:"selector"},item413={type:"literal",value:"{"},item423={type:"literal",value:":"},item432={type:"literal",value:"}"},item451={type:"literal",value:"["},item456={type:"literal",value:"]"},item524={type:"literal",value:"!"},item540={type:"class",value:"/^[*\\/%]/g"},item577={type:"literal",value:"<="},item579={type:"literal",value:"<"},item581={type:"literal",value:">="},item583={type:"literal",value:">"},item585={type:"literal",value:"=="},item587={type:"literal",value:"!="},item591={type:"literal",value:"in"},item593={type:"other",value:"relational operator"},item601={type:"literal",value:"&&"},item607={type:"literal",value:"||"},item616={type:"literal",value:"?"},item624={type:"end",value:"end of input"};function parse(input,options={}){let parse$source=options.grammarSource,result=item1(input);if(result.success===!0)return result.value;let remainder=input,failedExpectations=[];for(let e6 of result.failedExpectations)e6.remainder.length<remainder.length&&(remainder=e6.remainder,failedExpectations=[]),e6.remainder.length===remainder.length&&failedExpectations.push(e6);throw new ParseSyntaxError(failedExpectations.map(e6=>e6.expectation),remainder.slice(0,1),runtime.getLocation(parse$source,input,remainder,remainder));function item103(offset,digits){return builder.newDoubleExpr(offset(),digits)}function item126(offset,digits){return builder.newUnsignedInt64Expr(offset(),digits)}function item142(offset,digits){return builder.newInt64Expr(offset(),digits)}function item235(value){return parseInt(value,16)}function item243(value){return parseInt(value,16)}function item251(value){return parseInt(value,16)}function item264(value){return parseInt(value,8)}function item273(value){switch(value){case"a":return"\x07";case"b":return"\b";case"f":return"\f";case"n":return`
-`;case"r":return"\r";case"t":return"	";case"v":return"\v"}throw new Error}function item327(offset,bytes){return builder.newStringExpr(offset(),bytes)}function item337(offset,bytes){return builder.newBytesExpr(offset(),bytes)}function item348(offset,keyword){return builder.newBoolExpr(offset(),keyword)}function item360(offset){return builder.newNullExpr(offset())}function item378(error2,id){return["true","false","null","in","as","break","const","continue","else","for","function","if","import","let","loop","package","namespace","return","var","void","while"].includes(id)&&error2("reserved identifier"),id}function item390(offset,identifier,args){return builder.newCallExpr(offset(),identifier,args)}function item407(error2,selector){return["true","false","null","in"].includes(selector)&&error2("reserved keyword"),selector}function item427(offset,key,value){return builder.newStructEntry(offset(),key,value)}function item434(offset,dot,name,entries){return builder.newStructExpr(offset(),entries,(dot!==null?dot:"")+name.join("."))}function item441(offset,name){return builder.newIdentExpr(offset(),name)}function item458(offset,elements){return builder.newListExpr(offset(),elements)}function item472(offset,key,value){return builder.newMapEntry(offset(),key,value)}function item481(offset,entries){return builder.newStructExpr(offset(),entries)}function item497(offset,field3){return prevExpr=>builder.newSelectExpr(offset(),prevExpr,field3)}function item506(offset,func,args){return prevExpr=>builder.newMemberCallExpr(offset(),prevExpr,func,args)}function item513(offset,index2){return prevExpr=>builder.newCallExpr(offset(),"_[_]",[prevExpr,index2])}function item516(primary,tail){return tail.length===0?primary:tail.reduce((expr,op2)=>op2(expr),primary)}function item529(offset,ops,expr){return ops.length%2===0?expr:expr.exprKind.case==="callExpr"&&expr.exprKind.value.function===`${ops[0]}_`?expr.exprKind.value.args[0]:builder.newCallExpr(offset(),`${ops[0]}_`,[expr])}function item541(o3){return`_${o3}_`}function item544(offset,operator,nextExpr){return prevExpr=>builder.newCallExpr(offset(),operator,[prevExpr,nextExpr])}function item546(unary,tail){return tail===null?unary:tail.reduce((expr,op2)=>op2(expr),unary)}function item557(o3){return`_${o3}_`}function item559(offset,operator,nextExpr){return prevExpr=>builder.newCallExpr(offset(),operator,[prevExpr,nextExpr])}function item561(multiplication,tail){return tail===null?multiplication:tail.reduce((expr,op2)=>op2(expr),multiplication)}function item588(operator){return`_${operator}_`}function item592(){return"@in"}function item595(offset,operator,nextExpr){return prevExpr=>builder.newCallExpr(offset(),operator,[prevExpr,nextExpr])}function item597(addition,tail){return tail===null?addition:tail.reduce((expr,op2)=>op2(expr),addition)}function item603(offset,relation){if(relation.length===1)return relation[0];let logicManager=LogicManager.newBalancingLogicManager(builder,"_&&_",relation[0]);for(let i6=1;i6<relation.length;i6+=1)logicManager.addTerm(offset(),relation[i6]);return logicManager.toExpr()}function item609(offset,and){if(and.length===1)return and[0];let logicManager=LogicManager.newBalancingLogicManager(builder,"_||_",and[0]);for(let i6=1;i6<and.length;i6+=1)logicManager.addTerm(offset(),and[i6]);return logicManager.toExpr()}function item621(t,f5){return[t,f5]}function item623(offset,or,tail){return tail===null?or:builder.newCallExpr(offset(),"_?_:_",[or,...tail])}function item1(text2){let result2=item4(text2);return result2.success===!0?result2.remainder.length===0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item624,remainder:result2.remainder}]}:result2}function item4(text2){let result2=item5(text2);return result2.success===!0?{success:!0,value:item623(()=>input.length-text2.length,result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item5(text2){let failedExpectations2=[],remainder2=text2,result0=item8(remainder2);if(failedExpectations2.push(...result0.failedExpectations),result0.success===!1)return{success:!1,remainder:result0.remainder,failedExpectations:failedExpectations2};remainder2=result0.remainder;let result1=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result1?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result1[0].length);let result2=item611(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result0.value,result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item8(text2){let result2=item10(text2);return result2.success===!0?{success:!0,value:item609(()=>input.length-text2.length,result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item10(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let r5=remainder2;if(values.length>0){let result3=item604(r5);if(failedExpectations2.push(...result3.failedExpectations),result3.success===!1)break;r5=result3.remainder}let result2=item12(r5);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return values.length<1?{success:!1,remainder:text2,failedExpectations:failedExpectations2}:{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item12(text2){let result2=item14(text2);return result2.success===!0?{success:!0,value:item603(()=>input.length-text2.length,result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item14(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let r5=remainder2;if(values.length>0){let result3=item598(r5);if(failedExpectations2.push(...result3.failedExpectations),result3.success===!1)break;r5=result3.remainder}let result2=item16(r5);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return values.length<1?{success:!1,remainder:text2,failedExpectations:failedExpectations2}:{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item16(text2){let result2=item17(text2);return result2.success===!0?{success:!0,value:item597(result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item17(text2){let failedExpectations2=[],remainder2=text2,result0=item20(remainder2);if(failedExpectations2.push(...result0.failedExpectations),result0.success===!1)return{success:!1,remainder:result0.remainder,failedExpectations:failedExpectations2};remainder2=result0.remainder;let result1=item563(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:[result0.value,result1.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item20(text2){let result2=item21(text2);return result2.success===!0?{success:!0,value:item561(result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item21(text2){let failedExpectations2=[],remainder2=text2,result0=item24(remainder2);if(failedExpectations2.push(...result0.failedExpectations),result0.success===!1)return{success:!1,remainder:result0.remainder,failedExpectations:failedExpectations2};remainder2=result0.remainder;let result1=item548(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:[result0.value,result1.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item24(text2){let result2=item25(text2);return result2.success===!0?{success:!0,value:item546(result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item25(text2){let failedExpectations2=[],remainder2=text2,result0=item28(remainder2);if(failedExpectations2.push(...result0.failedExpectations),result0.success===!1)return{success:!1,remainder:result0.remainder,failedExpectations:failedExpectations2};remainder2=result0.remainder;let result1=item531(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:[result0.value,result1.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item28(text2){let choices=[item30,item517],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item30(text2){let result2=item31(text2);return result2.success===!0?{success:!0,value:item516(result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item31(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item63(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=item484(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result1.value,result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item33(text2){let failedExpectations2=[],remainder2=text2,result0=item34(remainder2);if(failedExpectations2.push(...result0.failedExpectations),result0.success===!1)return{success:!1,remainder:result0.remainder,failedExpectations:failedExpectations2};remainder2=result0.remainder;let result1=item42(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=item59(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result0.value,result1.value,result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item34(text2){let result2=item36(text2);return result2.success===!0?result2:{success:!0,value:null,remainder:text2,failedExpectations:result2.failedExpectations}}function item36(text2){let result2=item37(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item41,remainder:result2.remainder}]}}function item37(text2){let matches2=text2.match(/^([\t\n\f\r ])+/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item40,remainder:text2}]}}function item42(text2){let result2=item44(text2);return result2.success===!0?result2:{success:!0,value:null,remainder:text2,failedExpectations:result2.failedExpectations}}function item44(text2){let result2=item45(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item58,remainder:result2.remainder}]}}function item45(text2){let failedExpectations2=[],remainder2=text2,result0=item46(remainder2);if(failedExpectations2.push(...result0.failedExpectations),result0.success===!1)return{success:!1,remainder:result0.remainder,failedExpectations:failedExpectations2};remainder2=result0.remainder;let result1=item48(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=item52(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result0.value,result1.value,result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item46(text2){return text2.startsWith("//")?{success:!0,value:"//",remainder:text2.slice(2),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item47,remainder:text2}]}}function item48(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item49(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item49(text2){return/^[^\r\n]/g.test(text2)?{success:!0,value:text2.slice(0,1),remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item50,remainder:text2}]}}function item52(text2){let result2=item53(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item56,remainder:result2.remainder}]}}function item53(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item54(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return values.length<1?{success:!1,remainder:text2,failedExpectations:failedExpectations2}:{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item54(text2){return/^[\r\n]/g.test(text2)?{success:!0,value:text2.slice(0,1),remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item55,remainder:text2}]}}function item59(text2){let result2=item36(text2);return result2.success===!0?result2:{success:!0,value:null,remainder:text2,failedExpectations:result2.failedExpectations}}function item63(text2){let choices=[item65,item362,item391,item435,item442,item447,item459],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item65(text2){let choices=[item67,item106,item129,item145,item330,item340,item351],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item67(text2){let result2=item68(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item104,remainder:result2.remainder}]}}function item68(text2){let result2=item70(text2);return result2.success===!0?{success:!0,value:item103(()=>input.length-text2.length,result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item70(text2){let matches2=text2.match(/^((-)?([0-9])*\.([0-9])+([eE]([+\-])?([0-9])+)?|(-)?([0-9])+[eE]([+\-])?([0-9])+)/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item75,remainder:text2},{expectation:item81,remainder:text2},{expectation:item83,remainder:text2}]}}function item106(text2){let result2=item107(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item127,remainder:result2.remainder}]}}function item107(text2){let result2=item108(text2);return result2.success===!0?{success:!0,value:item126(()=>input.length-text2.length,result2.value[0]),remainder:result2.remainder,failedExpectations:[]}:result2}function item108(text2){let failedExpectations2=[],remainder2=text2,result0=item110(remainder2);if(failedExpectations2.push(...result0.failedExpectations),result0.success===!1)return{success:!1,remainder:result0.remainder,failedExpectations:failedExpectations2};remainder2=result0.remainder;let result1=remainder2.match(/^[uU]/g);return failedExpectations2.push({expectation:item124,remainder:remainder2}),result1?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result1[0].length),{success:!0,value:[result0.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item110(text2){let matches2=text2.match(/^(0x([0-9abcdefABCDEF])+|([0-9])+)/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item114,remainder:text2},{expectation:item81,remainder:text2}]}}function item129(text2){let result2=item130(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item143,remainder:result2.remainder}]}}function item130(text2){let result2=item132(text2);return result2.success===!0?{success:!0,value:item142(()=>input.length-text2.length,result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item132(text2){let matches2=text2.match(/^(-)?(0x([0-9abcdefABCDEF])+|([0-9])+)/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item75,remainder:text2},{expectation:item114,remainder:text2},{expectation:item81,remainder:text2}]}}function item145(text2){let result2=item146(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item328,remainder:result2.remainder}]}}function item146(text2){let result2=item149(text2);return result2.success===!0?{success:!0,value:item327(()=>input.length-text2.length,result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item149(text2){let result2=item150(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item326,remainder:result2.remainder}]}}function item150(text2){let choices=[item151,item204],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item151(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^[rR]/g);if(failedExpectations2.push({expectation:item153,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item155(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item155(text2){let choices=[item156,item169,item180,item192],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item156(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^"""/g);if(failedExpectations2.push({expectation:item158,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item160(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^"""/g);return failedExpectations2.push({expectation:item158,remainder:remainder2}),result2?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result2[0].length),{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item160(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item161(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item161(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(?!""")/g);if(failedExpectations2.push(),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item165(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item165(text2){return text2.length>0?{success:!0,value:text2.slice(0,1),remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item2,remainder:text2}]}}function item169(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^'''/g);if(failedExpectations2.push({expectation:item171,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item173(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^'''/g);return failedExpectations2.push({expectation:item171,remainder:remainder2}),result2?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result2[0].length),{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item173(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item174(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item174(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(?!''')/g);if(failedExpectations2.push(),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item178(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item178(text2){return text2.length>0?{success:!0,value:text2.slice(0,1),remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item2,remainder:text2}]}}function item180(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^"/g);if(failedExpectations2.push({expectation:item182,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item184(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^"/g);return failedExpectations2.push({expectation:item182,remainder:remainder2}),result2?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result2[0].length),{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item184(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item185(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item185(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(?!("|([\r\n])+))/g);if(failedExpectations2.push(),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item190(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item190(text2){return text2.length>0?{success:!0,value:text2.slice(0,1),remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item2,remainder:text2}]}}function item192(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^'/g);if(failedExpectations2.push({expectation:item194,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item196(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^'/g);return failedExpectations2.push({expectation:item194,remainder:remainder2}),result2?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result2[0].length),{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item196(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item197(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item197(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(?!('|([\r\n])+))/g);if(failedExpectations2.push(),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item202(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item202(text2){return text2.length>0?{success:!0,value:text2.slice(0,1),remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item2,remainder:text2}]}}function item204(text2){let choices=[item205,item288,item300,item313],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item205(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^"""/g);if(failedExpectations2.push({expectation:item158,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item208(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^"""/g);return failedExpectations2.push({expectation:item158,remainder:remainder2}),result2?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result2[0].length),{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item208(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item209(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item209(text2){let choices=[item211,item280],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item211(text2){let result2=item212(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item279,remainder:result2.remainder}]}}function item212(text2){let choices=[item214,item267,item274],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item214(text2){let result2=item215(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item266,remainder:result2.remainder}]}}function item215(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item217(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return values.length<1?{success:!1,remainder:text2,failedExpectations:failedExpectations2}:{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item217(text2){let result2=item218(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item265,remainder:result2.remainder}]}}function item218(text2){let choices=[item219,item236,item244,item252],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item219(text2){let result2=item220(text2);return result2.success===!0?{success:!0,value:item235(result2.value[0]),remainder:result2.remainder,failedExpectations:[]}:result2}function item220(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\\/g);if(failedExpectations2.push({expectation:item222,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=remainder2.match(/^[xX]/g);if(failedExpectations2.push({expectation:item224,remainder:remainder2}),result1?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result1[0].length);let result2=item226(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item226(text2){let matches2=text2.match(/^([0-9abcdefABCDEF][0-9abcdefABCDEF]){0,1}/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item233,remainder:text2}]}}function item236(text2){let result2=item237(text2);return result2.success===!0?{success:!0,value:item243(result2.value[0]),remainder:result2.remainder,failedExpectations:[]}:result2}function item237(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\\u/g);if(failedExpectations2.push({expectation:item239,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item241(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:[result1.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item241(text2){let matches2=text2.match(/^([0-9abcdefABCDEF][0-9abcdefABCDEF]){0,2}/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item233,remainder:text2}]}}function item244(text2){let result2=item245(text2);return result2.success===!0?{success:!0,value:item251(result2.value[0]),remainder:result2.remainder,failedExpectations:[]}:result2}function item245(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\\U/g);if(failedExpectations2.push({expectation:item247,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item249(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:[result1.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item249(text2){let matches2=text2.match(/^([0-9abcdefABCDEF][0-9abcdefABCDEF]){0,4}/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item233,remainder:text2}]}}function item252(text2){let result2=item253(text2);return result2.success===!0?{success:!0,value:item264(result2.value[0]),remainder:result2.remainder,failedExpectations:[]}:result2}function item253(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\\/g);if(failedExpectations2.push({expectation:item222,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item256(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:[result1.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item256(text2){let matches2=text2.match(/^[0-3][0-7][0-7]/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item259,remainder:text2}]}}function item267(text2){let result2=item268(text2);return result2.success===!0?{success:!0,value:item273(result2.value[0]),remainder:result2.remainder,failedExpectations:[]}:result2}function item268(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\\/g);if(failedExpectations2.push({expectation:item222,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item271(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:[result1.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item271(text2){return/^[abfnrtv]/g.test(text2)?{success:!0,value:text2.slice(0,1),remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item272,remainder:text2}]}}function item274(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\\/g);if(failedExpectations2.push({expectation:item222,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item277(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item277(text2){return/^["'`\\?]/g.test(text2)?{success:!0,value:text2.slice(0,1),remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item278,remainder:text2}]}}function item280(text2){let matches2=text2.match(/^(?!""")[\s\S]/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item2,remainder:text2}]}}function item288(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^'''/g);if(failedExpectations2.push({expectation:item171,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item291(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^'''/g);return failedExpectations2.push({expectation:item171,remainder:remainder2}),result2?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result2[0].length),{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item291(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item292(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item292(text2){let choices=[item211,item293],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item293(text2){let matches2=text2.match(/^(?!''')[\s\S]/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item2,remainder:text2}]}}function item300(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^"/g);if(failedExpectations2.push({expectation:item182,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item303(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^"/g);return failedExpectations2.push({expectation:item182,remainder:remainder2}),result2?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result2[0].length),{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item303(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item304(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item304(text2){let choices=[item211,item305],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item305(text2){let matches2=text2.match(/^(?!("|([\r\n])+))[\s\S]/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item2,remainder:text2}]}}function item313(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^'/g);if(failedExpectations2.push({expectation:item194,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item316(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^'/g);return failedExpectations2.push({expectation:item194,remainder:remainder2}),result2?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result2[0].length),{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item316(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item317(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item317(text2){let choices=[item211,item318],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item318(text2){let matches2=text2.match(/^(?!('|([\r\n])+))[\s\S]/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item2,remainder:text2}]}}function item330(text2){let result2=item331(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item338,remainder:result2.remainder}]}}function item331(text2){let result2=item332(text2);return result2.success===!0?{success:!0,value:item337(()=>input.length-text2.length,result2.value[0]),remainder:result2.remainder,failedExpectations:[]}:result2}function item332(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^[bB]/g);if(failedExpectations2.push({expectation:item334,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item149(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:[result1.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item340(text2){let result2=item341(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item349,remainder:result2.remainder}]}}function item341(text2){let result2=item343(text2);return result2.success===!0?{success:!0,value:item348(()=>input.length-text2.length,result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item343(text2){let choices=[item344,item346],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item344(text2){return text2.startsWith("true")?{success:!0,value:"true",remainder:text2.slice(4),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item345,remainder:text2}]}}function item346(text2){return text2.startsWith("false")?{success:!0,value:"false",remainder:text2.slice(5),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item347,remainder:text2}]}}function item351(text2){let result2=item352(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item361,remainder:result2.remainder}]}}function item352(text2){let result2=item353(text2);return result2.success===!0?{success:!0,value:item360(()=>input.length-text2.length),remainder:result2.remainder,failedExpectations:[]}:result2}function item353(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^null/g);if(failedExpectations2.push({expectation:item355,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=remainder2.match(/^(?![_a-zA-Z0-9])/g);return failedExpectations2.push(),result1?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result1[0].length),{success:!0,value:[],remainder:remainder2,failedExpectations:failedExpectations2})}function item362(text2){let result2=item363(text2);return result2.success===!0?{success:!0,value:item390(()=>input.length-text2.length,result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item363(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(\.)?/g);if(failedExpectations2.push({expectation:item83,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result1?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result1[0].length);let result2=item368(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)return{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2};remainder2=result2.remainder;let result3=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result3?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result3[0].length);let result4=remainder2.match(/^\(/g);if(failedExpectations2.push({expectation:item381,remainder:remainder2}),result4?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result4[0].length);let result5=item384(remainder2);if(failedExpectations2.push(...result5.failedExpectations),result5.success===!1)return{success:!1,remainder:result5.remainder,failedExpectations:failedExpectations2};remainder2=result5.remainder;let result6=remainder2.match(/^\)/g);return failedExpectations2.push({expectation:item388,remainder:remainder2}),result6?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result6[0].length),{success:!0,value:[result2.value,result5.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item368(text2){let result2=item369(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item379,remainder:result2.remainder}]}}function item369(text2){let result2=item371(text2);return result2.success===!0?{success:!0,value:item378((message6,location=runtime.getLocation(parse$source,input,text2,result2.remainder),name)=>{throw new ParseError(message6,location,name)},result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item371(text2){let matches2=text2.match(/^[_a-zA-Z]([_a-zA-Z0-9])*/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item374,remainder:text2}]}}function item384(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let r5=remainder2;if(values.length>0){let result3=item385(r5);if(failedExpectations2.push(...result3.failedExpectations),result3.success===!1)break;r5=result3.remainder}let result2=item4(r5);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item385(text2){return text2.startsWith(",")?{success:!0,value:",",remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item386,remainder:text2}]}}function item391(text2){let result2=item392(text2);return result2.success===!0?{success:!0,value:item434(()=>input.length-text2.length,result2.value[0],result2.value[1],result2.value[2]),remainder:result2.remainder,failedExpectations:[]}:result2}function item392(text2){let failedExpectations2=[],remainder2=text2,result0=item394(remainder2);if(failedExpectations2.push(...result0.failedExpectations),result0.success===!1)return{success:!1,remainder:result0.remainder,failedExpectations:failedExpectations2};remainder2=result0.remainder;let result1=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result1?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result1[0].length);let result2=item397(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)return{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2};remainder2=result2.remainder;let result3=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result3?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result3[0].length);let result4=remainder2.match(/^\{/g);if(failedExpectations2.push({expectation:item413,remainder:remainder2}),result4?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result4[0].length);let result5=item416(remainder2);if(failedExpectations2.push(...result5.failedExpectations),result5.success===!1)return{success:!1,remainder:result5.remainder,failedExpectations:failedExpectations2};remainder2=result5.remainder;let result6=remainder2.match(/^(,)?/g);if(failedExpectations2.push({expectation:item386,remainder:remainder2}),result6?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result6[0].length);let result7=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result7?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result7[0].length);let result8=remainder2.match(/^\}/g);return failedExpectations2.push({expectation:item432,remainder:remainder2}),result8?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result8[0].length),{success:!0,value:[result0.value,result2.value,result5.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item394(text2){let result2=item395(text2);return result2.success===!0?result2:{success:!0,value:null,remainder:text2,failedExpectations:result2.failedExpectations}}function item395(text2){return text2.startsWith(".")?{success:!0,value:".",remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item83,remainder:text2}]}}function item397(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let r5=remainder2;if(values.length>0){let result3=item409(r5);if(failedExpectations2.push(...result3.failedExpectations),result3.success===!1)break;r5=result3.remainder}let result2=item399(r5);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return values.length<1?{success:!1,remainder:text2,failedExpectations:failedExpectations2}:{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item399(text2){let result2=item400(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item408,remainder:result2.remainder}]}}function item400(text2){let result2=item402(text2);return result2.success===!0?{success:!0,value:item407((message6,location=runtime.getLocation(parse$source,input,text2,result2.remainder),name)=>{throw new ParseError(message6,location,name)},result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item402(text2){let matches2=text2.match(/^[_a-zA-Z]([_a-zA-Z0-9])*/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item374,remainder:text2}]}}function item409(text2){let failedExpectations2=[],remainder2=text2,result0=item33(remainder2);if(failedExpectations2.push(...result0.failedExpectations),result0.success===!1)return{success:!1,remainder:result0.remainder,failedExpectations:failedExpectations2};remainder2=result0.remainder;let result1=item410(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=item33(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result0.value,result1.value,result0.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item410(text2){return text2.startsWith(".")?{success:!0,value:".",remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item83,remainder:text2}]}}function item416(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let r5=remainder2;if(values.length>0){let result3=item428(r5);if(failedExpectations2.push(...result3.failedExpectations),result3.success===!1)break;r5=result3.remainder}let result2=item417(r5);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item417(text2){let result2=item418(text2);return result2.success===!0?{success:!0,value:item427(()=>input.length-text2.length,result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item418(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item399(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?:/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2},{expectation:item423,remainder:remainder2}),result2?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result2[0].length);let result3=item4(remainder2);return failedExpectations2.push(...result3.failedExpectations),result3.success===!1?{success:!1,remainder:result3.remainder,failedExpectations:failedExpectations2}:(remainder2=result3.remainder,{success:!0,value:[result1.value,result3.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item428(text2){return text2.startsWith(",")?{success:!0,value:",",remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item386,remainder:text2}]}}function item435(text2){let result2=item436(text2);return result2.success===!0?{success:!0,value:item441(()=>input.length-text2.length,result2.value[0]),remainder:result2.remainder,failedExpectations:[]}:result2}function item436(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(\.)?/g);if(failedExpectations2.push({expectation:item83,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result1?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result1[0].length);let result2=item399(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item442(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\(/g);if(failedExpectations2.push({expectation:item381,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item4(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^\)/g);return failedExpectations2.push({expectation:item388,remainder:remainder2}),result2?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result2[0].length),{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item447(text2){let result2=item449(text2);return result2.success===!0?{success:!0,value:item458(()=>input.length-text2.length,result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item449(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\[/g);if(failedExpectations2.push({expectation:item451,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item384(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^(,)?/g);if(failedExpectations2.push({expectation:item386,remainder:remainder2}),result2?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result2[0].length);let result3=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result3?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result3[0].length);let result4=remainder2.match(/^\]/g);return failedExpectations2.push({expectation:item456,remainder:remainder2}),result4?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result4[0].length),{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item459(text2){let result2=item461(text2);return result2.success===!0?{success:!0,value:item481(()=>input.length-text2.length,result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item461(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\{/g);if(failedExpectations2.push({expectation:item413,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item465(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^(,)?(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?\}/g);return failedExpectations2.push({expectation:item386,remainder:remainder2},{expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2},{expectation:item432,remainder:remainder2}),result2?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result2[0].length),{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item465(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let r5=remainder2;if(values.length>0){let result3=item473(r5);if(failedExpectations2.push(...result3.failedExpectations),result3.success===!1)break;r5=result3.remainder}let result2=item466(r5);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item466(text2){let result2=item467(text2);return result2.success===!0?{success:!0,value:item472(()=>input.length-text2.length,result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item467(text2){let failedExpectations2=[],remainder2=text2,result0=item4(remainder2);if(failedExpectations2.push(...result0.failedExpectations),result0.success===!1)return{success:!1,remainder:result0.remainder,failedExpectations:failedExpectations2};remainder2=result0.remainder;let result1=remainder2.match(/^:/g);if(failedExpectations2.push({expectation:item423,remainder:remainder2}),result1?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result1[0].length);let result2=item4(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result0.value,result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item473(text2){return text2.startsWith(",")?{success:!0,value:",",remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item386,remainder:text2}]}}function item484(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item485(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item485(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item488(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item488(text2){let choices=[item489,item498,item507],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item489(text2){let result2=item490(text2);return result2.success===!0?{success:!0,value:item497(()=>input.length-text2.length,result2.value[0]),remainder:result2.remainder,failedExpectations:[]}:result2}function item490(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\./g);if(failedExpectations2.push({expectation:item83,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result1?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result1[0].length);let result2=item399(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)return{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2};remainder2=result2.remainder;let result3=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result3?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result3[0].length);let result4=remainder2.match(/^(?![(])/g);return failedExpectations2.push(),result4?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result4[0].length),{success:!0,value:[result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item498(text2){let result2=item499(text2);return result2.success===!0?{success:!0,value:item506(()=>input.length-text2.length,result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item499(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\./g);if(failedExpectations2.push({expectation:item83,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result1?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result1[0].length);let result2=item399(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)return{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2};remainder2=result2.remainder;let result3=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result3?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result3[0].length);let result4=remainder2.match(/^\(/g);if(failedExpectations2.push({expectation:item381,remainder:remainder2}),result4?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result4[0].length);let result5=item384(remainder2);if(failedExpectations2.push(...result5.failedExpectations),result5.success===!1)return{success:!1,remainder:result5.remainder,failedExpectations:failedExpectations2};remainder2=result5.remainder;let result6=remainder2.match(/^\)/g);return failedExpectations2.push({expectation:item388,remainder:remainder2}),result6?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result6[0].length),{success:!0,value:[result2.value,result5.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item507(text2){let result2=item508(text2);return result2.success===!0?{success:!0,value:item513(()=>input.length-text2.length,result2.value[0]),remainder:result2.remainder,failedExpectations:[]}:result2}function item508(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\[/g);if(failedExpectations2.push({expectation:item451,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item4(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^\]/g);return failedExpectations2.push({expectation:item456,remainder:remainder2}),result2?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result2[0].length),{success:!0,value:[result1.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item517(text2){let result2=item518(text2);return result2.success===!0?{success:!0,value:item529(()=>input.length-text2.length,result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item518(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item520(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=item30(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result1.value,result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item520(text2){let matches2=text2.match(/^((!)+|(-)+)/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item524,remainder:text2},{expectation:item75,remainder:text2}]}}function item531(text2){let result2=item533(text2);return result2.success===!0?result2:{success:!0,value:null,remainder:text2,failedExpectations:result2.failedExpectations}}function item533(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item534(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return values.length<1?{success:!1,remainder:text2,failedExpectations:failedExpectations2}:{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item534(text2){let result2=item535(text2);return result2.success===!0?{success:!0,value:item544(()=>input.length-text2.length,result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item535(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item537(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=item28(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result1.value,result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item537(text2){let result2=item539(text2);return result2.success===!0?{success:!0,value:item541(result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item539(text2){return/^[*\/%]/g.test(text2)?{success:!0,value:text2.slice(0,1),remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item540,remainder:text2}]}}function item548(text2){let result2=item550(text2);return result2.success===!0?result2:{success:!0,value:null,remainder:text2,failedExpectations:result2.failedExpectations}}function item550(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item551(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return values.length<1?{success:!1,remainder:text2,failedExpectations:failedExpectations2}:{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item551(text2){let result2=item552(text2);return result2.success===!0?{success:!0,value:item559(()=>input.length-text2.length,result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item552(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item554(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=item24(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result1.value,result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item554(text2){let result2=item556(text2);return result2.success===!0?{success:!0,value:item557(result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item556(text2){return/^[+\-]/g.test(text2)?{success:!0,value:text2.slice(0,1),remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item93,remainder:text2}]}}function item563(text2){let result2=item565(text2);return result2.success===!0?result2:{success:!0,value:null,remainder:text2,failedExpectations:result2.failedExpectations}}function item565(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item566(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return values.length<1?{success:!1,remainder:text2,failedExpectations:failedExpectations2}:{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item566(text2){let result2=item567(text2);return result2.success===!0?{success:!0,value:item595(()=>input.length-text2.length,result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item567(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item570(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=item20(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result1.value,result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item570(text2){let result2=item571(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item593,remainder:result2.remainder}]}}function item571(text2){let choices=[item572,item589],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item572(text2){let result2=item574(text2);return result2.success===!0?{success:!0,value:item588(result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item574(text2){let matches2=text2.match(/^(<=|<|>=|>|==|!=)/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item577,remainder:text2},{expectation:item579,remainder:text2},{expectation:item581,remainder:text2},{expectation:item583,remainder:text2},{expectation:item585,remainder:text2},{expectation:item587,remainder:text2}]}}function item589(text2){let result2=item590(text2);return result2.success===!0?{success:!0,value:item592(),remainder:result2.remainder,failedExpectations:[]}:result2}function item590(text2){return text2.startsWith("in")?{success:!0,value:"in",remainder:text2.slice(2),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item591,remainder:text2}]}}function item598(text2){let matches2=text2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?&&/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item41,remainder:text2},{expectation:item58,remainder:text2},{expectation:item601,remainder:text2}]}}function item604(text2){let matches2=text2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?\|\|/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item41,remainder:text2},{expectation:item58,remainder:text2},{expectation:item607,remainder:text2}]}}function item611(text2){let result2=item613(text2);return result2.success===!0?result2:{success:!0,value:null,remainder:text2,failedExpectations:result2.failedExpectations}}function item613(text2){let result2=item614(text2);return result2.success===!0?{success:!0,value:item621(result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item614(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\?/g);if(failedExpectations2.push({expectation:item616,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item8(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result2?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result2[0].length);let result3=remainder2.match(/^:/g);if(failedExpectations2.push({expectation:item423,remainder:remainder2}),result3?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result3[0].length);let result4=item4(remainder2);if(failedExpectations2.push(...result4.failedExpectations),result4.success===!1)return{success:!1,remainder:result4.remainder,failedExpectations:failedExpectations2};remainder2=result4.remainder;let result5=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);return failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result5?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result5[0].length),{success:!0,value:[result1.value,result4.value],remainder:remainder2,failedExpectations:failedExpectations2})}}function parse2(expr){return create2(ParsedExprSchema,{expr:parse(expr)})}var file_cel_expr_checked=fileDesc2("ChZjZWwvZXhwci9jaGVja2VkLnByb3RvEghjZWwuZXhwciLsAgoLQ2hlY2tlZEV4cHISPgoNcmVmZXJlbmNlX21hcBgCIAMoCzInLmNlbC5leHByLkNoZWNrZWRFeHByLlJlZmVyZW5jZU1hcEVudHJ5EjQKCHR5cGVfbWFwGAMgAygLMiIuY2VsLmV4cHIuQ2hlY2tlZEV4cHIuVHlwZU1hcEVudHJ5EikKC3NvdXJjZV9pbmZvGAUgASgLMhQuY2VsLmV4cHIuU291cmNlSW5mbxIUCgxleHByX3ZlcnNpb24YBiABKAkSHAoEZXhwchgEIAEoCzIOLmNlbC5leHByLkV4cHIaSAoRUmVmZXJlbmNlTWFwRW50cnkSCwoDa2V5GAEgASgDEiIKBXZhbHVlGAIgASgLMhMuY2VsLmV4cHIuUmVmZXJlbmNlOgI4ARo+CgxUeXBlTWFwRW50cnkSCwoDa2V5GAEgASgDEh0KBXZhbHVlGAIgASgLMg4uY2VsLmV4cHIuVHlwZToCOAEioggKBFR5cGUSJQoDZHluGAEgASgLMhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5SAASKgoEbnVsbBgCIAEoDjIaLmdvb2dsZS5wcm90b2J1Zi5OdWxsVmFsdWVIABIxCglwcmltaXRpdmUYAyABKA4yHC5jZWwuZXhwci5UeXBlLlByaW1pdGl2ZVR5cGVIABIvCgd3cmFwcGVyGAQgASgOMhwuY2VsLmV4cHIuVHlwZS5QcmltaXRpdmVUeXBlSAASMgoKd2VsbF9rbm93bhgFIAEoDjIcLmNlbC5leHByLlR5cGUuV2VsbEtub3duVHlwZUgAEiwKCWxpc3RfdHlwZRgGIAEoCzIXLmNlbC5leHByLlR5cGUuTGlzdFR5cGVIABIqCghtYXBfdHlwZRgHIAEoCzIWLmNlbC5leHByLlR5cGUuTWFwVHlwZUgAEi8KCGZ1bmN0aW9uGAggASgLMhsuY2VsLmV4cHIuVHlwZS5GdW5jdGlvblR5cGVIABIWCgxtZXNzYWdlX3R5cGUYCSABKAlIABIUCgp0eXBlX3BhcmFtGAogASgJSAASHgoEdHlwZRgLIAEoCzIOLmNlbC5leHByLlR5cGVIABInCgVlcnJvchgMIAEoCzIWLmdvb2dsZS5wcm90b2J1Zi5FbXB0eUgAEjQKDWFic3RyYWN0X3R5cGUYDiABKAsyGy5jZWwuZXhwci5UeXBlLkFic3RyYWN0VHlwZUgAGi0KCExpc3RUeXBlEiEKCWVsZW1fdHlwZRgBIAEoCzIOLmNlbC5leHByLlR5cGUaTwoHTWFwVHlwZRIgCghrZXlfdHlwZRgBIAEoCzIOLmNlbC5leHByLlR5cGUSIgoKdmFsdWVfdHlwZRgCIAEoCzIOLmNlbC5leHByLlR5cGUaVgoMRnVuY3Rpb25UeXBlEiMKC3Jlc3VsdF90eXBlGAEgASgLMg4uY2VsLmV4cHIuVHlwZRIhCglhcmdfdHlwZXMYAiADKAsyDi5jZWwuZXhwci5UeXBlGkUKDEFic3RyYWN0VHlwZRIMCgRuYW1lGAEgASgJEicKD3BhcmFtZXRlcl90eXBlcxgCIAMoCzIOLmNlbC5leHByLlR5cGUicwoNUHJpbWl0aXZlVHlwZRIeChpQUklNSVRJVkVfVFlQRV9VTlNQRUNJRklFRBAAEggKBEJPT0wQARIJCgVJTlQ2NBACEgoKBlVJTlQ2NBADEgoKBkRPVUJMRRAEEgoKBlNUUklORxAFEgkKBUJZVEVTEAYiVgoNV2VsbEtub3duVHlwZRIfChtXRUxMX0tOT1dOX1RZUEVfVU5TUEVDSUZJRUQQABIHCgNBTlkQARINCglUSU1FU1RBTVAQAhIMCghEVVJBVElPThADQgsKCXR5cGVfa2luZCLWAwoERGVjbBIMCgRuYW1lGAEgASgJEikKBWlkZW50GAIgASgLMhguY2VsLmV4cHIuRGVjbC5JZGVudERlY2xIABIvCghmdW5jdGlvbhgDIAEoCzIbLmNlbC5leHByLkRlY2wuRnVuY3Rpb25EZWNsSAAaWQoJSWRlbnREZWNsEhwKBHR5cGUYASABKAsyDi5jZWwuZXhwci5UeXBlEiEKBXZhbHVlGAIgASgLMhIuY2VsLmV4cHIuQ29uc3RhbnQSCwoDZG9jGAMgASgJGvsBCgxGdW5jdGlvbkRlY2wSNwoJb3ZlcmxvYWRzGAEgAygLMiQuY2VsLmV4cHIuRGVjbC5GdW5jdGlvbkRlY2wuT3ZlcmxvYWQSCwoDZG9jGAIgASgJGqQBCghPdmVybG9hZBITCgtvdmVybG9hZF9pZBgBIAEoCRIeCgZwYXJhbXMYAiADKAsyDi5jZWwuZXhwci5UeXBlEhMKC3R5cGVfcGFyYW1zGAMgAygJEiMKC3Jlc3VsdF90eXBlGAQgASgLMg4uY2VsLmV4cHIuVHlwZRIcChRpc19pbnN0YW5jZV9mdW5jdGlvbhgFIAEoCBILCgNkb2MYBiABKAlCCwoJZGVjbF9raW5kIlEKCVJlZmVyZW5jZRIMCgRuYW1lGAEgASgJEhMKC292ZXJsb2FkX2lkGAMgAygJEiEKBXZhbHVlGAQgASgLMhIuY2VsLmV4cHIuQ29uc3RhbnRCLAoMZGV2LmNlbC5leHByQglEZWNsUHJvdG9QAVoMY2VsLmRldi9leHBy+AEBYgZwcm90bzM",[file_cel_expr_syntax,file_google_protobuf_empty2,file_google_protobuf_struct2]),CheckedExprSchema=messageDesc3(file_cel_expr_checked,0);var Type_PrimitiveType;(function(Type_PrimitiveType2){Type_PrimitiveType2[Type_PrimitiveType2.PRIMITIVE_TYPE_UNSPECIFIED=0]="PRIMITIVE_TYPE_UNSPECIFIED",Type_PrimitiveType2[Type_PrimitiveType2.BOOL=1]="BOOL",Type_PrimitiveType2[Type_PrimitiveType2.INT64=2]="INT64",Type_PrimitiveType2[Type_PrimitiveType2.UINT64=3]="UINT64",Type_PrimitiveType2[Type_PrimitiveType2.DOUBLE=4]="DOUBLE",Type_PrimitiveType2[Type_PrimitiveType2.STRING=5]="STRING",Type_PrimitiveType2[Type_PrimitiveType2.BYTES=6]="BYTES"})(Type_PrimitiveType||(Type_PrimitiveType={}));var Type_WellKnownType;(function(Type_WellKnownType2){Type_WellKnownType2[Type_WellKnownType2.WELL_KNOWN_TYPE_UNSPECIFIED=0]="WELL_KNOWN_TYPE_UNSPECIFIED",Type_WellKnownType2[Type_WellKnownType2.ANY=1]="ANY",Type_WellKnownType2[Type_WellKnownType2.TIMESTAMP=2]="TIMESTAMP",Type_WellKnownType2[Type_WellKnownType2.DURATION=3]="DURATION"})(Type_WellKnownType||(Type_WellKnownType={}));function accessByIndex(obj,index2){if(!(typeof obj!="object"||obj===null)){if(isCelMap(obj))return obj.get(index2);if(isCelList(obj))return obj.get(Number(index2))}}function accessByName(obj,name){if(typeof obj!="object"||obj===null)return;if(isCelMap(obj))return obj.get(name);if(obj=unwrapAny(obj),!isReflectMessage2(obj))return;let field3=obj.desc.fields.find(f5=>f5.name===name);if(field3)switch(field3.fieldKind){case"enum":return BigInt(obj.get(field3));case"list":return celList(obj.get(field3));case"map":return celMap(obj.get(field3));case"scalar":return celFromScalar(field3.scalar,obj.get(field3));case"message":if(obj.isSet(field3))return reflectMsgToCel(obj.get(field3));if(isWrapperDesc2(field3.message))return null;switch(field3.message.typeName){case StructSchema.typeName:return EMPTY_MAP;case ListValueSchema.typeName:return EMPTY_LIST;case ValueSchema.typeName:return null}return reflect2(field3.message)}}function isSet(obj,name){if(typeof obj!="object"||obj===null)return!1;if(isCelMap(obj))return obj.has(name);if(obj=unwrapAny(obj),isReflectMessage2(obj)){let field3=obj.desc.fields.find(f5=>f5.name===name);return field3?obj.isSet(field3):void 0}return!1}function attrAccess(factory,vars,obj,accAttr){let val=accAttr.resolve(vars);return val===void 0?void 0:isCelError(val)?val:factory.newAccess(accAttr.id,val,accAttr.isOptional()).access(vars,obj)}function attrIsPresent(factory,vars,obj,accAttr){let val=accAttr.resolve(vars);return val===void 0?!1:isCelError(val)?val:factory.newAccess(accAttr.id,val,accAttr.isOptional()).isPresent(vars,obj)}function attrAccessIfPresent(factory,vars,obj,accAttr,presenceOnly){let val=accAttr.resolve(vars);return val===void 0?void 0:isCelError(val)?val:factory.newAccess(accAttr.id,val,accAttr.isOptional()).accessIfPresent(vars,obj,presenceOnly)}function applyAccesses(vars,obj,accesses){if(accesses.length===0)return obj;let cur=obj;for(let access of accesses){let result=access.access(vars,cur);if(result===void 0)return;if(isCelError(result))return result;cur=result}return cur}var AbsoluteAttr=class{id;nsNames;accesses_;registry;factory;constructor(id,nsNames,accesses_,registry,factory){if(this.id=id,this.nsNames=nsNames,this.accesses_=accesses_,this.registry=registry,this.factory=factory,nsNames.length===0)throw new Error("No names provided")}isOptional(){return!1}addAccess(access){this.accesses_.push(access)}candidateNames(){return this.nsNames}accesses(){return this.accesses_}access(vars,obj){return attrAccess(this.factory,vars,obj,this)}isPresent(vars,obj){return attrIsPresent(this.factory,vars,obj,this)}accessIfPresent(vars,obj,presenceOnly){return attrAccessIfPresent(this.factory,vars,obj,this,presenceOnly)}resolve(vars){for(let name of this.nsNames){let raw=vars.resolve(name);if(raw!==void 0)return isCelError(raw)?raw:applyAccesses(vars,raw,this.accesses_);let typ=this.findIdent(name);if(typ!==void 0&&this.accesses_.length===0)return typ}}findIdent(ident){let desc=this.registry.getMessage(ident);if(desc)return objectType(desc);if(ident.indexOf(".")>1){let lastDot=ident.lastIndexOf("."),enumName=ident.substring(0,lastDot),valueName=ident.substring(lastDot+1),descEnum=this.registry.getEnum(enumName);if(descEnum){let enumValue=descEnum.values.find(v=>v.name===valueName);if(enumValue)return BigInt(enumValue.number)}}switch(ident){case"int":return CelScalar.INT;case"uint":return CelScalar.UINT;case"double":return CelScalar.DOUBLE;case"bool":return CelScalar.BOOL;case"string":return CelScalar.STRING;case"bytes":return CelScalar.BYTES;case"list":return listType(CelScalar.DYN);case"map":return mapType(CelScalar.DYN,CelScalar.DYN);case"null_type":return CelScalar.NULL;case"type":return CelScalar.TYPE;default:return}}},ConditionalAttr=class{id;cond;t;f;factory;constructor(id,cond,t,f5,factory){this.id=id,this.cond=cond,this.t=t,this.f=f5,this.factory=factory}isOptional(){return!1}addAccess(access){this.t.addAccess(access),this.f.addAccess(access)}access(vars,obj){return attrAccess(this.factory,vars,obj,this)}isPresent(vars,obj){return attrIsPresent(this.factory,vars,obj,this)}accessIfPresent(vars,obj,presenceOnly){return attrAccessIfPresent(this.factory,vars,obj,this,presenceOnly)}resolve(vars){let cond=this.cond.eval(vars);switch(!0){case cond===!0:return this.t.resolve(vars);case cond===!1:return this.f.resolve(vars);case isCelError(cond):return cond}return celError(`found no matching overload for _?_:_ applied to '(${celType(cond).name})'`,this.id)}},MaybeAttr=class{id;attrs;factory;constructor(id,attrs,factory){this.id=id,this.attrs=attrs,this.factory=factory}isOptional(){return!1}addAccess(access){let augmentedNames=[],str2;access instanceof StringAccess&&(str2=access.name);for(let attr of this.attrs){if(str2!==void 0&&attr.accesses().length===0)for(let name of attr.candidateNames())augmentedNames.push(name+"."+str2);attr.addAccess(access)}if(augmentedNames.length>0){let newAttr=this.factory.createAbsolute(this.id,augmentedNames);this.attrs.unshift(newAttr)}}access(vars,obj){return attrAccess(this.factory,vars,obj,this)}isPresent(vars,obj){return attrIsPresent(this.factory,vars,obj,this)}accessIfPresent(vars,obj,presenceOnly){return attrAccessIfPresent(this.factory,vars,obj,this,presenceOnly)}resolve(vars){for(let attr of this.attrs){let val=attr.resolve(vars);if(val!==void 0)return val}}},RelativeAttr=class{id;operand;accesses_;factory;constructor(id,operand,accesses_,factory){this.id=id,this.operand=operand,this.accesses_=accesses_,this.factory=factory}isOptional(){return!1}addAccess(access){this.accesses_.push(access)}access(vars,obj){return attrAccess(this.factory,vars,obj,this)}isPresent(vars,obj){return attrIsPresent(this.factory,vars,obj,this)}accessIfPresent(vars,obj,presenceOnly){return attrAccessIfPresent(this.factory,vars,obj,this,presenceOnly)}resolve(vars){let v=this.operand.eval(vars);return isCelError(v)?v:applyAccesses(vars,v,this.accesses_)}},StringAccess=class{id;name;celVal;optional;constructor(id,name,celVal,optional){this.id=id,this.name=name,this.celVal=celVal,this.optional=optional}isOptional(){return this.optional}access(_vars,obj){let val=accessByName(obj,this.name);return val===void 0&&!this.optional?fieldNotFound(this.id,this.name):val}isPresent(_vars,obj){let set2=isSet(obj,this.name);return set2===void 0?fieldNotFound(this.id,this.name):set2}accessIfPresent(_vars,obj,presenceOnly){let val=accessByName(obj,this.name);return val===void 0&&!this.optional&&!presenceOnly?fieldNotFound(this.id,this.name):val}},BoolAccess=class{id;index;optional;constructor(id,index2,optional){this.id=id,this.index=index2,this.optional=optional}isOptional(){return this.optional}access(_vars,obj){if(obj===void 0)return obj;let raw=accessByIndex(obj,this.index);return raw===void 0&&!this.optional?fieldNotFound(this.id,this.index):raw}isPresent(_vars,obj){return accessByIndex(obj,this.index)===void 0&&!this.optional?fieldNotFound(this.id,this.index):!0}accessIfPresent(_vars,obj,_presenceOnly){let raw=accessByIndex(obj,this.index);return raw===void 0&&!this.optional?fieldNotFound(this.id,this.index):raw}},NumAccess=class{id;index;celVal;optional;constructor(id,index2,celVal,optional){this.id=id,this.index=index2,this.celVal=celVal,this.optional=optional}isOptional(){return this.optional}access(_vars,obj){if(obj===void 0)return obj;let raw=accessByIndex(obj,this.index);return raw===void 0&&!this.optional?indexOutOfBounds(this.id,this.index,-1):raw}isPresent(_vars,obj){return accessByIndex(obj,this.index)===void 0&&!this.optional?indexOutOfBounds(this.id,this.index,-1):!0}accessIfPresent(_vars,obj,_presenceOnly){let raw=accessByIndex(obj,this.index);return raw===void 0&&!this.optional?indexOutOfBounds(this.id,this.index,-1):raw}},IntAccess=class{id;index;celVal;optional;constructor(id,index2,celVal,optional){this.id=id,this.index=index2,this.celVal=celVal,this.optional=optional}access(_vars,obj){if(obj===void 0)return obj;let raw=accessByIndex(obj,this.index);return raw===void 0&&!this.optional?indexOutOfBounds(this.id,Number(this.index),-1):raw}isPresent(_vars,obj){return accessByIndex(obj,this.index)===void 0&&!this.optional?indexOutOfBounds(this.id,Number(this.index),-1):!0}accessIfPresent(_vars,obj,_presenceOnly){let raw=accessByIndex(obj,this.index);return raw===void 0&&!this.optional?indexOutOfBounds(this.id,Number(this.index),-1):raw}isOptional(){return this.optional}},ErrorAttr=class{id;error;opt;constructor(id,error2,opt){this.id=id,this.error=error2,this.opt=opt}addAccess(_access){}resolve(_vars){return this.error}isOptional(){return this.opt}access(_vars,_obj){return this.error}isPresent(_vars,_obj){return this.error}accessIfPresent(_vars,_obj,_presenceOnly){return this.error}},EvalAccess=class{id;key;factory;optional;constructor(id,key,factory,optional){this.id=id,this.key=key,this.factory=factory,this.optional=optional}access(vars,obj){if(obj===void 0)return obj;let key=this.key.eval(vars);return isCelError(key)?key:this.factory.newAccess(this.id,key,this.optional).access(vars,obj)}isPresent(vars,obj){if(obj===void 0)return!1;let key=this.key.eval(vars);return isCelError(key)?key:this.factory.newAccess(this.id,key,this.optional).isPresent(vars,obj)}accessIfPresent(vars,obj,presenceOnly){let key=this.key.eval(vars);return isCelError(key)?key:this.factory.newAccess(this.id,key,this.optional).accessIfPresent(vars,obj,presenceOnly)}isOptional(){return this.optional}},ConcreteAttributeFactory=class{registry;container;constructor(registry,container){this.registry=registry,this.container=container}createAbsolute(id,names){return new AbsoluteAttr(id,names,[],this.registry,this)}createConditional(id,cond,t,f5){return new ConditionalAttr(id,cond,t,f5,this)}createMaybe(id,name){return new MaybeAttr(id,[this.createAbsolute(id,this.container.resolveCandidateNames(name))],this)}createRelative(id,operand){return new RelativeAttr(id,operand,[],this)}newAccess(id,val,opt){switch(typeof val){case"boolean":return new BoolAccess(id,val,opt);case"number":return new NumAccess(id,val,val,opt);case"bigint":return new IntAccess(id,val,val,opt);case"string":return new StringAccess(id,val,val,opt);case"object":if(val instanceof EvalAttr)return new EvalAccess(id,val,this,opt);if(isCelUint(val))return new IntAccess(id,val.value,val,opt);break;default:break}return new ErrorAttr(id,celError("unsupported key type",id),opt)}};function fieldNotFound(id,name){return celError(`field not found: ${String(name)}`,id)}function indexOutOfBounds(id,index2,length){return celError(`index ${index2} out of bounds [0, ${length})`,id)}var ObjectActivation=class{data;constructor(data){this.data=data}resolve(name){let value=this.data[name];if(value!==void 0)return isCelError(value)?value:toCel(value)}},VarActivation=class{name;value;parent;constructor(name,value,parent){this.name=name,this.value=value,this.parent=parent}resolve(name){return name===this.name?this.value:this.parent.resolve(name)}},EMPTY_ACTIVATION={resolve(){}};function celObject(typeName,fields2){let desc=getMsgDesc(typeName),msg=reflect2(desc);for(let[k5,v]of fields2.entries()){let field3=desc.fields.find(f5=>f5.name===k5);if(field3===void 0)throw new Error(`Unknown field ${k5} for ${typeName}`);setMsgField(msg,field3,v)}return reflectMsgToCel(msg)}function setMsgField(msg,field3,v){switch(field3.fieldKind){case"list":if(!isCelList(v))throw unexpectedTypeError(field3,"list",v);let list12=reflectList(field3,void 0,!1);copyList(list12,v),msg.set(field3,list12);return;case"map":if(!isCelMap(v))throw unexpectedTypeError(field3,"map",v);let map5=reflectMap(field3,void 0,!1);copyMap(map5,v),msg.set(field3,map5);return;case"enum":msg.set(field3,enumFromCel(field3,v));return;case"message":let msgVal=msgFromCel(field3,v);msgVal!==null&&msg.set(field3,msgVal);return}msg.set(field3,scalarFromCel(field3,field3.scalar,v))}function copyList(list12,cList){let field3=list12.field();for(let v of cList)switch(field3.listKind){case"enum":list12.add(enumFromCel(field3,v));break;case"message":list12.add(msgFromCel(field3,v));break;case"scalar":list12.add(scalarFromCel(field3,field3.scalar,v));break}}function copyMap(map5,cMap){let field3=map5.field();for(let[k5,v]of cMap.entries()){let key=scalarFromCel(field3,field3.mapKey,k5);switch(field3.mapKind){case"enum":map5.set(key,enumFromCel(field3,v));break;case"scalar":map5.set(key,scalarFromCel(field3,field3.scalar,v));break;case"message":map5.set(key,msgFromCel(field3,v));break}}}function enumFromCel(field3,v){if(typeof v!="bigint")throw unexpectedTypeError(field3,"int",v);return intToInt32(v)}function msgFromCel(field3,v){switch(field3.message.typeName){case AnySchema.typeName:return isReflectMessage2(v,AnySchema)?v:reflect2(AnySchema,anyFromCel(v));case ValueSchema.typeName:return reflect2(ValueSchema,valueFromCel(v));case StructSchema.typeName:if(!isCelMap(v))throw unexpectedTypeError(field3,"map",v);return reflect2(StructSchema,structFromCel(v));case ListValueSchema.typeName:if(!isCelList(v))throw unexpectedTypeError(field3,"list",v);return reflect2(ListValueSchema,listValueFromCel(v))}if(v===null)return null;if(isWrapperDesc2(field3.message)){let msg=reflect2(field3.message,void 0,!1);return msg.set(field3.message.fields[0],scalarFromCel(field3.message.fields[0],field3.message.fields[0].scalar,v)),msg}if(!isReflectMessage2(v,field3.message))throw unexpectedTypeError(field3,field3.message.typeName,v);return v}function anyFromCel(v){switch(typeof v){case"string":return anyPack(StringValueSchema,create2(StringValueSchema,{value:v}));case"boolean":return anyPack(BoolValueSchema,create2(BoolValueSchema,{value:v}));case"bigint":return anyPack(Int64ValueSchema,create2(Int64ValueSchema,{value:v}));case"number":return anyPack(DoubleValueSchema,create2(DoubleValueSchema,{value:v}));default:switch(!0){case v instanceof Uint8Array:return anyPack(BytesValueSchema,create2(BytesValueSchema,{value:v}));case v==null:return anyPack(ValueSchema,create2(ValueSchema,{kind:{case:"nullValue",value:NullValue2.NULL_VALUE}}));case isCelList(v):return anyPack(ListValueSchema,listValueFromCel(v));case isCelMap(v):return anyPack(StructSchema,structFromCel(v));case isCelUint(v):return anyPack(UInt64ValueSchema,create2(UInt64ValueSchema,{value:v.value}));case isReflectMessage2(v):return anyPack(v.desc,v.message);default:throw new Error(`type cannot be converted ${AnySchema}`)}}}function valueFromCel(v){let value=create2(ValueSchema);switch(typeof v){case"string":value.kind={case:"stringValue",value:v};break;case"boolean":value.kind={case:"boolValue",value:v};break;case"bigint":v>BigInt(Number.MAX_SAFE_INTEGER)||v<BigInt(Number.MIN_SAFE_INTEGER)?value.kind={case:"stringValue",value:v.toString()}:value.kind={case:"numberValue",value:Number(v)};break;case"number":Number.isNaN(v)?value.kind={case:"stringValue",value:"NaN"}:v===Number.POSITIVE_INFINITY?value.kind={case:"stringValue",value:"Infinity"}:v===Number.NEGATIVE_INFINITY?value.kind={case:"stringValue",value:"-Infinity"}:value.kind={case:"numberValue",value:Number(v)};break;default:switch(!0){case v instanceof Uint8Array:value.kind={case:"stringValue",value:base64Encode(v)};break;case v==null:value.kind={case:"nullValue",value:NullValue2.NULL_VALUE};break;case isCelList(v):value.kind={case:"listValue",value:listValueFromCel(v)};break;case isCelMap(v):value.kind={case:"structValue",value:structFromCel(v)};break;case isCelUint(v):v.value>BigInt(Number.MAX_SAFE_INTEGER)?value.kind={case:"stringValue",value:v.value.toString()}:value.kind={case:"numberValue",value:Number(v.value)};break;case isReflectMessage2(v):return fromJson(ValueSchema,toJson(v.desc,v.message));default:throw new Error(`type cannot be converted ${ValueSchema}`)}}return value}function listValueFromCel(list12){let listValue=create2(ListValueSchema);for(let v of list12)listValue.values.push(valueFromCel(v));return listValue}function structFromCel(map5){let struct2=create2(StructSchema);for(let[k5,v]of map5.entries()){if(typeof k5!="string")throw new Error(`Invalid key type: ${typeof k5} for google.protobuf.Struct, expected string`);struct2.fields[k5]=valueFromCel(v)}return struct2}function scalarFromCel(field3,type2,v){switch(isCelUint(v)&&(v=v.value),type2){case ScalarType2.UINT32:case ScalarType2.FIXED32:if(typeof v!="bigint")throw unexpectedTypeError(field3,"int",v);return intToUint32(v);case ScalarType2.INT32:case ScalarType2.SINT32:case ScalarType2.SFIXED32:if(typeof v!="bigint")throw unexpectedTypeError(field3,"int",v);return intToInt32(v);case ScalarType2.UINT64:case ScalarType2.FIXED64:case ScalarType2.INT64:case ScalarType2.SINT64:case ScalarType2.SFIXED64:if(typeof v!="bigint")throw unexpectedTypeError(field3,"int",v);return v;case ScalarType2.FLOAT:if(typeof v!="number")throw unexpectedTypeError(field3,"double",v);return Math.fround(v);case ScalarType2.DOUBLE:if(typeof v!="number")throw unexpectedTypeError(field3,"double",v);return v;case ScalarType2.STRING:if(typeof v!="string")throw unexpectedTypeError(field3,"string",v);return v;case ScalarType2.BOOL:if(typeof v!="boolean")throw unexpectedTypeError(field3,"bool",v);return v;case ScalarType2.BYTES:if(!(v instanceof Uint8Array))throw unexpectedTypeError(field3,"bytes",v);return v}}function unexpectedTypeError(field3,expected,actValue){return new Error(`Expected ${expected} but got ${celType(actValue)} for ${field3.parent}.${field3.name}`)}function intToInt32(v){if(v<INT32_MIN2||v>INT32_MAX2)throw new Error("int32 out of range");return Number(v)}function intToUint32(v){if(v<0||v>UINT32_MAX2)throw new Error("uint32 out of range");return Number(v)}var Planner=class{functions;registry;namespace;factory;constructor(functions,registry,namespace=Namespace.ROOT){this.functions=functions,this.registry=registry,this.namespace=namespace,this.factory=new ConcreteAttributeFactory(this.registry,this.namespace)}plan(expr){let id=Number(expr.id);switch(expr.exprKind.case){case"identExpr":return new EvalAttr(this.factory.createMaybe(id,expr.exprKind.value.name),!1);case"constExpr":return new EvalConst(id,this.constVal(expr.exprKind.value));case"callExpr":return this.planCall(id,expr.exprKind.value);case"listExpr":return this.planCreateList(id,expr.exprKind.value);case"structExpr":return this.planCreateStruct(id,expr.exprKind.value);case"selectExpr":return this.planSelect(id,expr.exprKind.value);case"comprehensionExpr":return this.planComprehension(id,expr.exprKind.value);default:return new EvalErr(id,"invalid expression")}}planComprehension(id,value){if(value.accuInit===void 0||value.iterRange===void 0||value.loopCondition===void 0||value.loopStep===void 0||value.result===void 0)throw new Error("invalid comprehension");let accu=this.plan(value.accuInit),iterRange=this.plan(value.iterRange),cond=this.plan(value.loopCondition),step=this.plan(value.loopStep),result=this.plan(value.result);return new EvalFold(id,value.accuVar,value.iterVar,iterRange,accu,cond,step,result)}planSelect(id,expr){if(expr.operand===void 0)throw new Error("invalid select");let operand=this.plan(expr.operand),attr=this.relativeAttr(id,operand,!1),acc=this.factory.newAccess(id,expr.field,!1);if(acc instanceof ErrorAttr)throw new Error(`invalid select: ${acc.error.message}`);return expr.testOnly?new EvalHas(id,attr,acc,expr.field):(attr.addAccess(acc),attr)}planCreateObj(id,expr){let typeName=this.resolveType(expr.messageName);if(typeName===void 0)return new EvalErr(id,"unknown type: "+expr.messageName);let optionals,keys=[],values=[];for(let i6=0;i6<expr.entries.length;i6++){let entry=expr.entries[i6];switch(entry.optionalEntry&&(optionals===void 0&&(optionals=new Array(expr.entries.length).fill(!1)),optionals[i6]=!0),entry.keyKind.case){case"fieldKey":keys.push(entry.keyKind.value);break;case"mapKey":throw new Error("invalid entry");default:break}if(entry.value===void 0)throw new Error("invalid entry");values.push(this.plan(entry.value))}return new EvalObj(id,typeName,keys,values,optionals)}planCreateStruct(id,expr){if(expr.messageName!=="")return this.planCreateObj(id,expr);let optionals,keys=[],values=[];for(let i6=0;i6<expr.entries.length;i6++){let entry=expr.entries[i6];switch(entry.optionalEntry&&(optionals===void 0&&(optionals=new Array(expr.entries.length).fill(!1)),optionals[i6]=!0),entry.keyKind.case){case"fieldKey":throw new Error("unimplemented");case"mapKey":keys.push(this.plan(entry.keyKind.value));break;default:break}if(entry.value===void 0)return new EvalErr(id,"map entry missing value");values.push(this.plan(entry.value))}return new EvalMap(id,keys,values,optionals)}planCreateList(id,expr){if(expr.optionalIndices.length>0){let optionals2=new Array(expr.elements.length).fill(!1);for(let i6=0;i6<expr.optionalIndices.length;i6++){let index2=expr.optionalIndices[i6];if(index2<0||index2>=expr.elements.length)throw new Error("invalid optional index");optionals2[index2]=!0}}return new EvalList(id,expr.elements.map(arg=>this.plan(arg)),void 0)}planCall(id,call){if(call.target!==void 0){let qualName=toQualifiedName(call.target);if(qualName!==void 0){let funcName=qualName+"."+call.function;for(let candidate of this.namespace.resolveCandidateNames(funcName)){let func=this.functions.find(candidate);if(func!==void 0)return new EvalCall(id,candidate,"",void 0,func,call.args.map(arg=>this.plan(arg)))}}}let args=call.args.map(arg=>this.plan(arg));switch(call.target&&(args=[this.plan(call.target),...args]),call.function){case INDEX:return this.planCallIndex(call,args,!1);case OPT_INDEX:case OPT_SELECT:return this.planCallIndex(call,args,!0);case CONDITIONAL:return this.planCallConditional(id,call,args);case LOGICAL_AND:return new EvalAnd(id,args);case LOGICAL_OR:return new EvalOr(id,args);case NOT_STRICTLY_FALSE:case OLD_NOT_STRICTLY_FALSE:return new EvalNotStrictlyFalse(id,args[0]);default:return new EvalCall(id,call.function,"",call.target?args[0]:void 0,this.functions.find(call.function),call.target?args.slice(1):args)}}planCallConditional(id,_call,args){let cond=args[0],t=args[1],f5=args[2],tAttr=this.relativeAttr(t.id,t,!1),fAttr=this.relativeAttr(f5.id,f5,!1);return new EvalAttr(this.factory.createConditional(id,cond,tAttr,fAttr),!1)}planCallIndex(_call,args,opt){let op2=args[0],ind=args[1],attr=this.relativeAttr(op2.id,op2,!1),acc;return ind instanceof EvalConst?acc=this.factory.newAccess(op2.id,ind.value,opt):ind instanceof EvalAttr?acc=this.factory.newAccess(op2.id,ind,opt):acc=this.relativeAttr(op2.id,ind,opt),attr.addAccess(acc),attr}constVal(val){switch(val.constantKind.case){case"stringValue":return val.constantKind.value;case"bytesValue":return val.constantKind.value;case"doubleValue":return val.constantKind.value;case"boolValue":return val.constantKind.value;case"int64Value":return val.constantKind.value;case"uint64Value":return celUint(val.constantKind.value);case"nullValue":return null;case void 0:throw new Error("invalid constant");default:throw new Error(`unimplemented: ${val.constantKind.case}`)}}relativeAttr(id,e6,opt){return e6 instanceof EvalAttr?e6:new EvalAttr(this.factory.createRelative(id,e6),opt)}resolveType(name){for(let candidate of this.namespace.resolveCandidateNames(name))if(this.isKnownType(candidate))return candidate}isKnownType(name){switch(name){case"google.protobuf.Value":case"google.protobuf.Struct":case"google.protobuf.ListValue":case"google.protobuf.NullValue":case"google.protobuf.BoolValue":case"google.protobuf.UInt32Value":case"google.protobuf.UInt64Value":case"google.protobuf.Int32Value":case"google.protobuf.Int64Value":case"google.protobuf.FloatValue":case"google.protobuf.DoubleValue":case"google.protobuf.StringValue":case"google.protobuf.BytesValue":case"google.protobuf.Timestamp":case"google.protobuf.Duration":case"google.protobuf.Any":return!0;default:return this.registry.getMessage(name)!==void 0}}},EvalHas=class{id;attr;access;field;constructor(id,attr,access,field3){this.id=id,this.attr=attr,this.access=access,this.field=field3}eval(ctx){let raw=this.attr.resolve(ctx);return raw===void 0?!1:isCelError(raw)?raw:this.access.isPresent(ctx,raw)}},EvalErr=class{id;msg;constructor(id,msg){this.id=id,this.msg=msg}eval(_ctx){return celError(this.msg,this.id)}},EvalConst=class{id;value;constructor(id,value){this.id=id,this.value=value}eval(_ctx){return this.value}},EvalAttr=class{attr;opt;id;constructor(attr,opt){this.attr=attr,this.opt=opt,this.id=attr.id}access(vars,obj){return this.attr.access(vars,obj)}isPresent(vars,obj){return this.attr.isPresent(vars,obj)}accessIfPresent(vars,obj,presenceOnly){return this.attr.accessIfPresent(vars,obj,presenceOnly)}isOptional(){return this.opt}eval(ctx){let val=this.attr.resolve(ctx);return val===void 0?celError("unresolved attribute",this.id):(isCelError(val),val)}resolve(vars){return this.attr.resolve(vars)}addAccess(acc){this.attr.addAccess(acc)}},EvalCall=class{id;name;overload;target;func;args;constructor(id,name,overload,target,func,args){this.id=id,this.name=name,this.overload=overload,this.target=target,this.func=func,this.args=args}eval(ctx){if(this.func===void 0)return celError(`unbound function: ${this.name}`,this.id);let target=this.target?.eval(ctx);if(isCelError(target))return target;let vals=[];for(let arg of this.args){let val=arg.eval(ctx);if(isCelError(val))return val;vals.push(val)}let result=this.func.call(this.id,target,vals);return result!==void 0?result:celError(`found no matching overload for '${this.name}' applied to '${target!==void 0?`${celType(target)}.`:""}(${vals.map(x2=>celType(x2)).map(x2=>x2.name).join(", ")})'`,this.id)}},EvalObj=class{id;typeName;fields;values;optionals;constructor(id,typeName,fields2,values,optionals){this.id=id,this.typeName=typeName,this.fields=fields2,this.values=values,this.optionals=optionals}args(){return this.values}eval(ctx){let vals=coerceToValues(this.values.map(x2=>x2.eval(ctx)));if(isCelError(vals))return vals;let obj=new Map;for(let i6=0;i6<vals.length;i6++){if(obj.has(this.fields[i6]))return celError(`map key conflict: ${this.fields[i6]}`,this.id);obj.set(this.fields[i6],vals[i6])}try{return celObject(this.typeName,obj)}catch(ex){return ex instanceof Error&&(ex=ex.message),celError(`${ex}`,this.id)}}},EvalList=class{id;elems;constructor(id,elems,_){this.id=id,this.elems=elems}eval(ctx){if(this.elems.length===0)return EMPTY_LIST;let first=this.elems[0].eval(ctx);if(isCelError(first))return first;let elemVals=[first];for(let i6=1;i6<this.elems.length;i6++){let elemVal=this.elems[i6].eval(ctx);if(isCelError(elemVal))return elemVal;elemVals.push(elemVal)}return celList(elemVals)}args(){return this.elems}},EvalMap=class{id;keys;values;constructor(id,keys,values,_){this.id=id,this.keys=keys,this.values=values}args(){return this.keys.concat(this.values)}eval(ctx){if(this.keys.length===0)return EMPTY_MAP;let entries=new Map,firstKey=this.mapKeyOrError(this.keys[0].eval(ctx));if(isCelError(firstKey))return firstKey;let firstVal=this.values[0].eval(ctx);if(isCelError(firstVal))return firstVal;if(typeof firstKey=="number"&&!Number.isInteger(firstKey))return unsupportedKeyType(this.id);entries.set(firstKey,firstVal);for(let i6=1;i6<this.keys.length;i6++){let key=this.mapKeyOrError(this.keys[i6].eval(ctx));if(isCelError(key))return key;let val=this.values[i6].eval(ctx);if(isCelError(val))return val;if(entries.has(key))return celError(`map key conflict: ${key}`,this.id);if(typeof key=="number"&&!Number.isInteger(key))return unsupportedKeyType(this.id);entries.set(key,val)}return celMap(entries)}mapKeyOrError(key){switch(typeof key){case"boolean":case"bigint":case"string":return key;case"object":return isCelUint(key)?key:unsupportedKeyType(this.id);case"number":return Number.isInteger(key)?BigInt(key):unsupportedKeyType(this.id);default:return unsupportedKeyType(this.id)}}},EvalFold=class{id;accuVar;iterVar;iterRange;accu;cond;step;result;constructor(id,accuVar,iterVar,iterRange,accu,cond,step,result){this.id=id,this.accuVar=accuVar,this.iterVar=iterVar,this.iterRange=iterRange,this.accu=accu,this.cond=cond,this.step=step,this.result=result}eval(ctx){let accuInit=this.accu.eval(ctx);if(isCelError(accuInit))return accuInit;let accuCtx=new VarActivation(this.accuVar,accuInit,ctx),iterRange=this.iterRange.eval(ctx);if(isCelError(iterRange))return iterRange;let items=[];if(isCelMap(iterRange))items=Array.from(iterRange.keys());else if(isCelList(iterRange))items=Array.from(iterRange);else return celError(`type mismatch: iterable vs ${celType(iterRange)}`,this.id);for(let item of items){if(isCelError(item))return item;let iterCtx=new VarActivation(this.iterVar,item,accuCtx),cond=this.cond.eval(iterCtx);if(isCelError(cond))return cond;if(cond!==!0)break;accuCtx.value=this.step.eval(iterCtx)}return this.result.eval(accuCtx)}},EvalAnd=class{id;args;constructor(id,args){this.id=id,this.args=args}eval(ctx){let errors=[];for(let arg of this.args){let val=arg.eval(ctx);if(typeof val=="boolean"){if(!val)return!1;continue}isCelError(val)?errors.push(val):errors.push(celError(`type mismatch: expected bool, got ${celType(val)}`,this.id))}return errors.length>0?celErrorMerge(errors[0],...errors.slice(1)):!0}},EvalOr=class{id;args;constructor(id,args){this.id=id,this.args=args}eval(ctx){let errors=[];for(let arg of this.args){let val=arg.eval(ctx);if(typeof val=="boolean"){if(val)return!0;continue}isCelError(val)?errors.push(val):errors.push(celError(`type mismatch: expected bool, got ${celType(val)}`,this.id))}return errors.length>0?celErrorMerge(errors[0],...errors.slice(1)):!1}},EvalNotStrictlyFalse=class{id;arg;constructor(id,arg){this.id=id,this.arg=arg}eval(ctx){return this.arg.eval(ctx)!==!1}};function toQualifiedName(expr){switch(expr.exprKind.case){case"identExpr":return expr.exprKind.value.name;case"selectExpr":{if(expr.exprKind.value.testOnly||expr.exprKind.value.operand===void 0)return;let parent=toQualifiedName(expr.exprKind.value.operand);return parent===void 0?void 0:parent+"."+expr.exprKind.value.field}default:return}}function unsupportedKeyType(id){return celError("unsupported key type",id)}function coerceToValues(args){let errors=[];for(let i6=0;i6<args.length;i6++){let arg=args[i6];isCelError(arg)&&errors.push(arg)}return errors.length>0?celErrorMerge(errors[0],...errors.slice(1)):args}var cache=new WeakMap;function plan(env2,expr){let planner=cache.get(env2);planner===void 0&&(planner=new Planner(env2.funcs,env2.registry,env2.namespace),cache.set(env2,planner));let maybeExpr;isMessage2(expr,CheckedExprSchema)||isMessage2(expr,ParsedExprSchema)?maybeExpr=expr.expr:maybeExpr=expr;let plan2=planner.plan(maybeExpr??create2(ExprSchema)),withContext=withEvalContext({registry:env2.registry},{id:plan2.id,eval(ctx){try{let val=plan2.eval(ctx);return isCelError(val)?val:unwrapAny(val)}catch(ex){return celError(ex,plan2.id)}}});return ctx=>withContext.eval(ctx!==void 0?new ObjectActivation(ctx):EMPTY_ACTIVATION)}function isInf(sign4){return sign4??(sign4=0),sign4>=0&&this===Number.POSITIVE_INFINITY||sign4<=0&&this===Number.NEGATIVE_INFINITY}function isIp(version){return version==6?new Ipv6(this).address():version==4?new Ipv4(this).address():version===void 0||version==0?new Ipv4(this).address()||new Ipv6(this).address():!1}function isIpPrefix(version,strict=!1){if(version==6){let ip=new Ipv6(this);return ip.addressPrefix()&&(!strict||ip.isPrefixOnly())}if(version==4){let ip=new Ipv4(this);return ip.addressPrefix()&&(!strict||ip.isPrefixOnly())}return version===void 0||version==0?isIpPrefix.call(this,6,strict)||isIpPrefix.call(this,4,strict):!1}var Ipv4=class{constructor(str2){this.i=0,this.octets=[],this.prefixLen=0,this.str=str2,this.l=str2.length}getBits(){return this.octets.length!=4?0:(this.octets[0]<<24|this.octets[1]<<16|this.octets[2]<<8|this.octets[3])>>>0}isPrefixOnly(){let bits2=this.getBits(),mask=this.prefixLen==32?4294967295:~(4294967295>>>this.prefixLen)>>>0,masked=(bits2&mask)>>>0;return bits2==masked}address(){return this.addressPart()&&this.i==this.l}addressPrefix(){return this.addressPart()&&this.take("/")&&this.prefixLength()&&this.i==this.l}prefixLength(){let start=this.i;for(;this.digit();)if(this.i-start>2)return!1;let str2=this.str.substring(start,this.i);if(str2.length==0||str2.length>1&&str2[0]=="0")return!1;let value=parseInt(str2);return value>32?!1:(this.prefixLen=value,!0)}addressPart(){let start=this.i;return this.decOctet()&&this.take(".")&&this.decOctet()&&this.take(".")&&this.decOctet()&&this.take(".")&&this.decOctet()?!0:(this.i=start,!1)}decOctet(){let start=this.i;for(;this.digit();)if(this.i-start>3)return!1;let str2=this.str.substring(start,this.i);if(str2.length==0||str2.length>1&&str2[0]=="0")return!1;let value=parseInt(str2,10);return value>255?!1:(this.octets.push(value),!0)}digit(){let c5=this.str[this.i];return"0"<=c5&&c5<="9"?(this.i++,!0):!1}take(char){return this.str[this.i]==char?(this.i++,!0):!1}},Ipv6=class{constructor(str2){this.i=0,this.pieces=[],this.doubleColonAt=-1,this.doubleColonSeen=!1,this.dottedRaw="",this.zoneIdFound=!1,this.prefixLen=0,this.str=str2,this.l=str2.length}getBits(){let p16=this.pieces;if(this.dottedAddr!==void 0){let dotted32=this.dottedAddr.getBits();p16.push(dotted32>>>16),p16.push(dotted32&65535)}if(this.doubleColonSeen)for(;p16.length<8;)p16.splice(this.doubleColonAt,0,0);return p16.length!=8?[0,0,0,0]:[(p16[0]<<16|p16[1])>>>0,(p16[2]<<16|p16[3])>>>0,(p16[4]<<16|p16[5])>>>0,(p16[6]<<16|p16[7])>>>0]}isPrefixOnly(){for(let[i6,p32]of this.getBits().entries()){let len=this.prefixLen-32*i6,mask=len>=32?4294967295:len<0?0:~(4294967295>>>len)>>>0,masked=(p32&mask)>>>0;if(p32!==masked)return!1}return!0}address(){return this.addressPart()&&this.i==this.l}addressPrefix(){return this.addressPart()&&!this.zoneIdFound&&this.take("/")&&this.prefixLength()&&this.i==this.l}prefixLength(){let start=this.i;for(;this.digit();)if(this.i-start>3)return!1;let str2=this.str.substring(start,this.i);if(str2.length==0||str2.length>1&&str2[0]=="0")return!1;let value=parseInt(str2,10);return value>128?!1:(this.prefixLen=value,!0)}addressPart(){for(;this.i<this.l;){if((this.doubleColonSeen||this.pieces.length==6)&&this.dotted()){let dotted=new Ipv4(this.dottedRaw);return dotted.address()?(this.dottedAddr=dotted,!0):!1}let result=this.h16();if(result==="error")return!1;if(!result){if(this.take(":")){if(this.take(":")){if(this.doubleColonSeen||(this.doubleColonSeen=!0,this.doubleColonAt=this.pieces.length,this.take(":")))return!1}else if(this.i===1||this.i===this.str.length)return!1;continue}if(this.str[this.i]=="%"&&!this.zoneId())return!1;break}}return this.doubleColonSeen?this.pieces.length<8:this.pieces.length==8}zoneId(){let start=this.i;return this.take("%")&&this.l-this.i>0?(this.i=this.l,this.zoneIdFound=!0,!0):(this.i=start,this.zoneIdFound=!1,!1)}dotted(){let start=this.i;for(this.dottedRaw="";this.digit()||this.take("."););return this.i-start>=7?(this.dottedRaw=this.str.substring(start,this.i),!0):(this.i=start,!1)}h16(){let start=this.i;for(;this.hexdig(););let str2=this.str.substring(start,this.i);return str2.length==0?!1:str2.length>4?"error":(this.pieces.push(parseInt(str2,16)),!0)}hexdig(){let c5=this.str[this.i];return"0"<=c5&&c5<="9"||"a"<=c5&&c5<="f"||"A"<=c5&&c5<="F"||"0"<=c5&&c5<="9"?(this.i++,!0):!1}digit(){let c5=this.str[this.i];return"0"<=c5&&c5<="9"?(this.i++,!0):!1}take(char){return this.str[this.i]==char?(this.i++,!0):!1}};function isHostname(){if(this.length>253)return!1;let s2=this.endsWith(".")?this.substring(0,this.length-1):this,allDigits=!1;for(let part of s2.split(".")){allDigits=!0;let l3=part.length;if(l3==0||l3>63||part.startsWith("-")||part.endsWith("-"))return!1;for(let ch of part.split("")){if((ch<"a"||ch>"z")&&(ch<"A"||ch>"Z")&&(ch<"0"||ch>"9")&&ch!="-")return!1;allDigits=allDigits&&ch>="0"&&ch<="9"}}return!allDigits}function isHostAndPort(portRequired){if(this.length==0)return!1;let splitIdx=this.lastIndexOf(":");if(this[0]=="["){let end=this.lastIndexOf("]");switch(end+1){case this.length:return!portRequired&&isIp.call(this.substring(1,end),6);case splitIdx:return isIp.call(this.substring(1,end),6)&&isPort(this.substring(splitIdx+1));default:return!1}}if(splitIdx<0)return!portRequired&&(isHostname.call(this)||isIp.call(this,4));let host=this.substring(0,splitIdx),port=this.substring(splitIdx+1);return(isHostname.call(host)||isIp.call(host,4))&&isPort(port)}function isPort(str2){if(str2.length==0)return!1;for(let i6=0;i6<str2.length;i6++){let c5=str2[i6];if(!("0"<=c5&&c5<="9"))return!1}return str2.length>1&&str2[0]==="0"?!1:parseInt(str2)<=65535}function isEmail(){return/^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/.test(this)}function isUri(){return new Uri(this).uri()}function isUriRef(){return new Uri(this).uriReference()}var Uri=class{constructor(str2){this.i=0,this.pctEncodedFound=!1,this.str=str2,this.l=str2.length}uri(){let start=this.i;return this.scheme()&&this.take(":")&&this.hierPart()?this.take("?")&&!this.query()||this.take("#")&&!this.fragment()?!1:this.i!=this.l?(this.i=start,!1):!0:(this.i=start,!1)}hierPart(){let start=this.i;return this.take("/")&&this.take("/")&&this.authority()&&this.pathAbempty()?!0:(this.i=start,this.pathAbsolute()||this.pathRootless()||this.pathEmpty())}uriReference(){return this.uri()||this.relativeRef()}relativeRef(){let start=this.i;return this.relativePart()?this.take("?")&&!this.query()?(this.i=start,!1):this.take("#")&&!this.fragment()?(this.i=start,!1):this.i!=this.l?(this.i=start,!1):!0:!1}relativePart(){let start=this.i;return this.take("/")&&this.take("/")&&this.authority()&&this.pathAbempty()?!0:(this.i=start,this.pathAbsolute()||this.pathNoscheme()||this.pathEmpty())}scheme(){let start=this.i;if(this.alpha()){for(;this.alpha()||this.digit()||this.take("+")||this.take("-")||this.take("."););if(this.str[this.i]==":")return!0}return this.i=start,!1}authority(){let start=this.i;return this.userinfo()&&!this.take("@")?(this.i=start,!1):this.host()?this.take(":")&&!this.port()?(this.i=start,!1):this.isAuthorityEnd()?!0:(this.i=start,!1):(this.i=start,!1)}isAuthorityEnd(){return this.str[this.i]=="?"||this.str[this.i]=="#"||this.str[this.i]=="/"||this.i>=this.l}userinfo(){let start=this.i;for(;;)if(!(this.unreserved()||this.pctEncoded()||this.subDelims()||this.take(":")))return this.str[this.i]=="@"?!0:(this.i=start,!1)}host(){let start=this.i;if(this.pctEncodedFound=!1,this.str[this.i]=="["&&this.ipLiteral()||this.regName()){if(this.pctEncodedFound){let rawHost=this.str.substring(start,this.i);try{decodeURIComponent(rawHost)}catch{return!1}}return!0}return!1}port(){let start=this.i;for(;;)if(!this.digit())return this.isAuthorityEnd()?!0:(this.i=start,!1)}ipLiteral(){let start=this.i;if(this.take("[")){let j5=this.i;if(this.ipv6Address()&&this.take("]")||(this.i=j5,this.ipv6addrz()&&this.take("]"))||(this.i=j5,this.ipvFuture()&&this.take("]")))return!0}return this.i=start,!1}ipv6Address(){let start=this.i;for(;this.hexdig()||this.take(":"););return isIp.call(this.str.substring(start,this.i),6)?!0:(this.i=start,!1)}ipv6addrz(){let start=this.i;return this.ipv6Address()&&this.take("%")&&this.take("2")&&this.take("5")&&this.zoneId()?!0:(this.i=start,!1)}zoneId(){let start=this.i;for(;this.unreserved()||this.pctEncoded(););return this.i-start>0?!0:(this.i=start,!1)}ipvFuture(){let start=this.i;if(this.take("v")&&this.hexdig()){for(;this.hexdig(););if(this.take(".")){let j5=0;for(;this.unreserved()||this.subDelims()||this.take(":");)j5++;if(j5>=1)return!0}}return this.i=start,!1}regName(){let start=this.i;for(;;)if(!(this.unreserved()||this.pctEncoded()||this.subDelims()))return this.str[this.i]==":"||this.isAuthorityEnd()?!0:(this.i=start,!1)}isPathEnd(){return this.str[this.i]=="?"||this.str[this.i]=="#"||this.i>=this.l}pathAbempty(){let start=this.i;for(;this.take("/")&&this.segment(););return this.isPathEnd()?!0:(this.i=start,!1)}pathAbsolute(){let start=this.i;if(this.take("/")){if(this.segmentNz())for(;this.take("/")&&this.segment(););if(this.isPathEnd())return!0}return this.i=start,!1}pathNoscheme(){let start=this.i;if(this.segmentNzNc()){for(;this.take("/")&&this.segment(););if(this.isPathEnd())return!0}return this.i=start,!1}pathRootless(){let start=this.i;if(this.segmentNz()){for(;this.take("/")&&this.segment(););if(this.isPathEnd())return!0}return this.i=start,!1}pathEmpty(){return this.isPathEnd()}segment(){for(;this.pchar(););return!0}segmentNz(){let start=this.i;if(this.pchar()){for(;this.pchar(););return!0}return this.i=start,!1}segmentNzNc(){let start=this.i;for(;this.unreserved()||this.pctEncoded()||this.subDelims()||this.take("@"););return this.i-start>0?!0:(this.i=start,!1)}pchar(){return this.unreserved()||this.pctEncoded()||this.subDelims()||this.take(":")||this.take("@")}query(){let start=this.i;for(;;)if(!(this.pchar()||this.take("/")||this.take("?")))return this.str[this.i]=="#"||this.i==this.l?!0:(this.i=start,!1)}fragment(){let start=this.i;for(;;)if(!(this.pchar()||this.take("/")||this.take("?")))return this.i==this.l?!0:(this.i=start,!1)}pctEncoded(){let start=this.i;return this.take("%")&&this.hexdig()&&this.hexdig()?(this.pctEncodedFound=!0,!0):(this.i=start,!1)}unreserved(){return this.alpha()||this.digit()||this.take("-")||this.take("_")||this.take(".")||this.take("~")}subDelims(){return this.take("!")||this.take("$")||this.take("&")||this.take("'")||this.take("(")||this.take(")")||this.take("*")||this.take("+")||this.take(",")||this.take(";")||this.take("=")}alpha(){let c5=this.str[this.i];return"A"<=c5&&c5<="Z"||"a"<=c5&&c5<="z"?(this.i++,!0):!1}digit(){let c5=this.str[this.i];return"0"<=c5&&c5<="9"?(this.i++,!0):!1}hexdig(){let c5=this.str[this.i];return"0"<=c5&&c5<="9"||"a"<=c5&&c5<="f"||"A"<=c5&&c5<="F"||"0"<=c5&&c5<="9"?(this.i++,!0):!1}take(char){return this.str[this.i]==char?(this.i++,!0):!1}};function unique(){return Array.from(this.values()).every((a5,index2,arr)=>{if(isCelUint(a5)){for(let i6=0;i6<arr.length;i6++){if(i6==index2)continue;let b7=arr[i6];if(isCelUint(b7)&&b7.value===a5.value)return!1}return!0}if(a5 instanceof Uint8Array){for(let i6=0;i6<arr.length;i6++){if(i6==index2)continue;let b7=arr[i6];if(b7 instanceof Uint8Array&&scalarEquals(ScalarType2.BYTES,b7,a5))return!1}return!0}return arr.indexOf(a5)===index2})}function bytesContains(sub){if(sub.length===0)return!0;if(sub.length>this.length)return!1;for(let i6=0;i6<this.length-sub.length+1;i6++){let found=!0;for(let j5=0;j5<sub.length;j5++)if(this[i6+j5]!=sub[j5]){found=!1;break}if(found)return!0}return!1}function bytesStartsWith(sub){if(sub.length>this.length)return!1;for(let i6=0;i6<sub.length;i6++)if(sub[i6]!=this[i6])return!1;return!0}function bytesEndsWith(sub){if(sub.length>this.length||this.length<sub.length)return!1;for(let i6=0;i6<sub.length;i6++)if(sub[sub.length-i6-1]!=this[this.length-i6-1])return!1;return!0}var isNanFn=celMethod("isNan",CelScalar.DOUBLE,[],CelScalar.BOOL,function(){return Number.isNaN(this)}),isInfFn=[celMethod("isInf",CelScalar.DOUBLE,[],CelScalar.BOOL,isInf),celMethod("isInf",CelScalar.DOUBLE,[CelScalar.INT],CelScalar.BOOL,isInf)],isHostnameFn=celMethod("isHostname",CelScalar.STRING,[],CelScalar.BOOL,isHostname),isHostAndPortFn=celMethod("isHostAndPort",CelScalar.STRING,[CelScalar.BOOL],CelScalar.BOOL,isHostAndPort),isEmailFn=celMethod("isEmail",CelScalar.STRING,[],CelScalar.BOOL,isEmail),isIpFn=[celMethod("isIp",CelScalar.STRING,[],CelScalar.BOOL,isIp),celMethod("isIp",CelScalar.STRING,[CelScalar.INT],CelScalar.BOOL,isIp)],isIpPrefixFn=[celMethod("isIpPrefix",CelScalar.STRING,[],CelScalar.BOOL,isIpPrefix),celMethod("isIpPrefix",CelScalar.STRING,[CelScalar.INT],CelScalar.BOOL,isIpPrefix),celMethod("isIpPrefix",CelScalar.STRING,[CelScalar.BOOL],CelScalar.BOOL,function(strict){return isIpPrefix.call(this,void 0,strict)}),celMethod("isIpPrefix",CelScalar.STRING,[CelScalar.INT,CelScalar.BOOL],CelScalar.BOOL,isIpPrefix)],isUriFn=celMethod("isUri",CelScalar.STRING,[],CelScalar.BOOL,isUri),isUriRefFn=celMethod("isUriRef",CelScalar.STRING,[],CelScalar.BOOL,isUriRef),uniqueFn=[CelScalar.UINT,CelScalar.INT,CelScalar.STRING,CelScalar.BOOL,CelScalar.DOUBLE,CelScalar.BYTES].map(elem=>celMethod("unique",listType(elem),[],CelScalar.BOOL,unique)),getFieldFn=celFunc("getField",[CelScalar.DYN,CelScalar.STRING],CelScalar.DYN,(msg,name)=>{if(!isReflectMessage2(msg))throw new Error("getField can only be applied to messages");let field3=msg.fields.find(f5=>f5.name===name);if(field3===void 0)throw new Error(`field ${name} not found on ${msg.desc}`);switch(field3.fieldKind){case"list":case"map":return msg.get(field3);case"enum":return BigInt(msg.get(field3));case"scalar":return celFromScalar(field3.scalar,msg.get(field3));case"message":return msg.isSet(field3)?msg.get(field3):isWrapperDesc2(field3.message)?null:create2(field3.message)}}),containsFn=[celMethod("contains",CelScalar.BYTES,[CelScalar.BYTES],CelScalar.BOOL,bytesContains),celMethod("contains",CelScalar.STRING,[CelScalar.STRING],CelScalar.BOOL,String.prototype.includes)],endsWithFn=[celMethod("endsWith",CelScalar.BYTES,[CelScalar.BYTES],CelScalar.BOOL,bytesEndsWith),celMethod("endsWith",CelScalar.STRING,[CelScalar.STRING],CelScalar.BOOL,String.prototype.endsWith)],startsWithFn=[celMethod("startsWith",CelScalar.BYTES,[CelScalar.BYTES],CelScalar.BOOL,bytesStartsWith),celMethod("startsWith",CelScalar.STRING,[CelScalar.STRING],CelScalar.BOOL,String.prototype.startsWith)];function createCustomFuncions(regexMatcher){let funcs=[isNanFn,...isInfFn,isHostnameFn,isHostAndPortFn,isEmailFn,...isIpFn,...isIpPrefixFn,isUriFn,isUriRefFn,...uniqueFn,getFieldFn,...containsFn,...endsWithFn,...startsWithFn];return regexMatcher&&funcs.push(celMethod("matches",CelScalar.STRING,[CelScalar.STRING],CelScalar.BOOL,function(pattern){return regexMatcher(pattern,this)})),funcs}function charAt(index2){let i6=Number(index2);if(i6<0||i6>this.length)throw indexOutOfBounds2(i6,this.length);return this.charAt(i6)}function indexOf(substr,startN){if(startN===void 0)return BigInt(this.indexOf(substr));let start=Number(startN);if(start<0||start>=this.length)throw indexOutOfBounds2(start,this.length);return BigInt(this.indexOf(substr,start))}function lastIndexOf(substr,startN){if(startN===void 0)return BigInt(this.lastIndexOf(substr));let start=Number(startN);if(start<0||start>=this.length)throw indexOutOfBounds2(start,this.length);return BigInt(this.lastIndexOf(substr,start))}function lowerAscii(){let result="";for(let i6=0;i6<this.length;i6++){let code=this.charCodeAt(i6);code>=65&&code<=90?result+=String.fromCharCode(code+32):result+=this.charAt(i6)}return result}function upperAscii(){let result="";for(let i6=0;i6<this.length;i6++){let c5=this.charCodeAt(i6);c5>=97&&c5<=122?result+=String.fromCharCode(c5-32):result+=this.charAt(i6)}return result}function replace(substr,repl,num){let count=num===void 0?this.length:Number(num),result=this,offset=0,remaining=count,index2=result.indexOf(substr,offset);for(;remaining>0&&index2!==-1;)result=result.substring(0,index2)+repl+result.substring(index2+substr.length),offset=index2+repl.length,remaining--,index2=result.indexOf(substr,offset);return result}function split(sep2,num){let count=num===void 0?void 0:Number(num);return count===1?celList([this]):celList(this.split(sep2,count))}function substring(start,end){if(end===void 0){let i7=Number(start);if(i7<0||i7>this.length)throw indexOutOfBounds2(i7,this.length);return this.substring(i7)}let i6=Number(start),j5=Number(end);if(i6<0||i6>this.length)throw indexOutOfBounds2(i6,this.length);if(j5<0||j5>this.length)throw indexOutOfBounds2(j5,this.length);if(i6>j5)throw invalidArgument("substring","start > end");return this.substring(i6,j5)}var WHITE_SPACE=new Set([32,9,10,11,12,13,133,160,5760,8192,8193,8194,8195,8196,8197,8198,8199,8200,8201,8202,8232,8233,8239,8287,12288]);function trim(){let start=0,end=this.length-1;for(;start<this.length&&WHITE_SPACE.has(this.charCodeAt(start));)start++;for(;end>start&&WHITE_SPACE.has(this.charCodeAt(end));)end--;return this.substring(start,end+1)}function join(sep2=""){let result="";for(let i6=0;i6<this.size;i6++){let item=this.get(i6);if(typeof item!="string")throw invalidArgument("join","list contains non-string value");i6>0&&(result+=sep2),result+=item}return result}var QUOTE_MAP=new Map([[0,"\\0"],[7,"\\a"],[8,"\\b"],[9,"\\t"],[10,"\\n"],[11,"\\v"],[12,"\\f"],[13,"\\r"],[34,'\\"'],[92,"\\\\"]]);function quote(str2){let result='"';for(let i6=0;i6<str2.length;i6++){let c5=str2.charCodeAt(i6);result+=QUOTE_MAP.get(c5)??str2.charAt(i6)}return result+='"',result}function formatFloatString(val){switch(val){case"Infinity":case"-Infinity":case"NaN":return val;default:throw invalidArgument("format","invalid floating point value")}}function formatFloating(val,precision){switch(!0){case typeof val=="number":return!Number.isFinite(val)||precision===void 0?val.toString():new Intl.NumberFormat("en-US",{maximumFractionDigits:precision,minimumFractionDigits:precision,notation:"standard",roundingMode:"halfEven",useGrouping:!1}).format(val);case typeof val=="string":return formatFloatString(val);default:throw invalidArgument("format","fixed-point clause can only be used on doubles")}}function formatExponent(val,precision){switch(!0){case typeof val=="number":if(!Number.isFinite(val))return val.toString();let str2=val.toExponential(precision),plusIdx=str2.lastIndexOf("+");return plusIdx===str2.length-2&&(str2=`${str2.substring(0,plusIdx+1)}0${str2.substring(plusIdx+1)}`),str2;case typeof val=="string":return formatFloatString(val);default:throw invalidArgument("format","scientific clause can only be used on doubles")}}function formatBinary(val){switch(!0){case typeof val=="boolean":return val?"1":"0";case typeof val=="bigint":return val.toString(2);case isCelUint(val):return val.value.toString(2);default:throw invalidArgument("format","only integers and bools can be formatted as binary")}}function formatOctal(val){switch(!0){case typeof val=="bigint":return val.toString(8);case isCelUint(val):return val.value.toString(8);default:throw invalidArgument("format","invalid integer value")}}function formatDecimal(val){switch(!0){case typeof val=="bigint":return val.toString(10);case isCelUint(val):return val.value.toString(10);case(typeof val=="number"&&!Number.isFinite(val)):return val.toString();default:throw invalidArgument("format","invalid integer value")}}function formatHexBytes(val){let result="";for(let i6=0;i6<val.length;i6++)result+=val[i6].toString(16).padStart(2,"0");return result}function formatHex(val){switch(!0){case typeof val=="bigint":return val.toString(16);case isCelUint(val):return val.value.toString(16);case typeof val=="string":let encoder7=new TextEncoder;return formatHexBytes(encoder7.encode(val));case val instanceof Uint8Array:return formatHexBytes(val);default:throw invalidArgument("format","only integers, byte buffers, and strings can be formatted as hex")}}function formatHeX(val){let result=formatHex(val);return typeof result!="string"?result:result.toUpperCase()}function formatList(val){let result="[";for(let i6=0;i6<val.size;i6++)i6>0&&(result+=", "),result+=formatString(val.get(i6));return result+="]",result}function formatMap(val){let formatted=new Array(val.size),i6=0;for(let[key,value]of val)formatted[i6]=[formatString(key),formatString(value)],i6++;let result="{",delim="";for(let[key,value]of formatted.sort((a5,b7)=>a5[0].localeCompare(b7[0])))result+=delim+key+": "+value,delim=", ";return result+="}",result}function formatString(val){switch(typeof val){case"boolean":return val?"true":"false";case"bigint":return formatDecimal(val);case"number":return formatFloating(val,void 0);case"string":return val;case"object":switch(!0){case val===null:return"null";case isCelType(val):return val.name;case isCelUint(val):return val.value.toString();case isReflectMessage2(val,TimestampSchema):return toJson(TimestampSchema,val.message);case isReflectMessage2(val,DurationSchema):return toJson(DurationSchema,val.message);case val instanceof Uint8Array:return new TextDecoder().decode(val);case isCelList(val):return formatList(val);case isCelMap(val):return formatMap(val)}}throw invalidArgument("format","invalid string value")}function format(args){let result="",i6=0,j5=0;for(;i6<this.length;){if(this.charAt(i6)!=="%"){result+=this.charAt(i6),i6++;continue}if(i6+1>=this.length)throw invalidArgument("format","invalid format string");let c5=this.charAt(i6+1);if(i6+=2,c5==="%"){result+="%";continue}let precision=6;if(c5==="."){for(precision=0;i6<this.length&&this.charAt(i6)>="0"&&this.charAt(i6)<="9";)precision=precision*10+Number(this.charAt(i6)),i6++;if(i6>=this.length)throw invalidArgument("format","invalid format string");c5=this.charAt(i6),i6++}let val=args.get(j5++);if(val===void 0)throw invalidArgument("format","too few arguments for format string");result+=formatPlaceholder(c5,val,precision)}if(j5<args.size)throw invalidArgument("format","too many arguments for format string");return result}function formatPlaceholder(c5,val,precision){switch(c5){case"e":return formatExponent(val,precision);case"f":return formatFloating(val,precision);case"b":return formatBinary(val);case"d":return formatDecimal(val);case"s":return formatString(val);case"x":return formatHex(val);case"X":return formatHeX(val);case"o":return formatOctal(val);default:throw invalidArgument("format",`could not parse formatting clause: unrecognized formatting clause: ${c5}`)}}function invalidArgument(func,issue){return new Error(`invalid argument to function ${func}: ${issue}`)}function indexOutOfBounds2(index2,length){return new Error(`index ${index2} out of bounds [0, ${length})`)}var{STRING:STRING5,INT:INT5,DYN:DYN3}=CelScalar,LIST_DYN=listType(DYN3),LIST_STRING=listType(DYN3),strings_default=[celFunc("strings.quote",[STRING5],STRING5,quote),celMethod("charAt",STRING5,[INT5],STRING5,charAt),celMethod("indexOf",STRING5,[STRING5],INT5,indexOf),celMethod("indexOf",STRING5,[STRING5,INT5],INT5,indexOf),celMethod("lastIndexOf",STRING5,[STRING5],INT5,lastIndexOf),celMethod("lastIndexOf",STRING5,[STRING5,INT5],INT5,lastIndexOf),celMethod("lowerAscii",STRING5,[],STRING5,lowerAscii),celMethod("upperAscii",STRING5,[],STRING5,upperAscii),celMethod("replace",STRING5,[STRING5,STRING5],STRING5,replace),celMethod("replace",STRING5,[STRING5,STRING5,INT5],STRING5,replace),celMethod("split",STRING5,[STRING5],LIST_STRING,split),celMethod("split",STRING5,[STRING5,INT5],LIST_STRING,split),celMethod("substring",STRING5,[INT5],STRING5,substring),celMethod("substring",STRING5,[INT5,INT5],STRING5,substring),celMethod("trim",STRING5,[],STRING5,trim),celMethod("join",LIST_STRING,[],STRING5,join),celMethod("join",LIST_STRING,[STRING5],STRING5,join),celMethod("format",STRING5,[LIST_DYN],STRING5,format)];var CelManager=class{constructor(registry,regexMatcher){this.registry=registry,this.rulesCache=new Map,this.bindings={},this.env=celEnv({registry,funcs:[...strings_default,...createCustomFuncions(regexMatcher)]}),this.bindings.now=timestampNow()}updateCelNow(){this.bindings.now=timestampNow()}setEnv(key,value){if(value===void 0){delete this.bindings[key];return}this.bindings[key]=value}eval(compiled){if(compiled.kind=="compilation_error")throw compiled.error;let rule=compiled.rule,result=compiled.interpretable(this.bindings);if(typeof result=="string"||typeof result=="boolean"){if(typeof result=="boolean"?result:result.length==0)return;let message6=rule.message;return message6===""&&(message6=typeof result=="string"?result:`"${rule.expression}" returned false`),{message:message6,ruleId:rule.id}}throw isCelError(result)?new RuntimeError(result.message,{cause:result}):new RuntimeError(`expression ${rule.id} outputs ${typeof result}, wanted either bool or string`)}compileRule(ruleOrExpr){let rule=typeof ruleOrExpr=="string"?create2(RuleSchema,{id:ruleOrExpr,expression:ruleOrExpr}):ruleOrExpr;try{return{kind:"interpretable",interpretable:plan(this.env,parse2(rule.expression)),rule}}catch(cause){return{kind:"compilation_error",error:new CompilationError(`failed to compile ${rule.id}: ${String(cause)}`,{cause})}}}compileRules(descMessage){let compiled=this.rulesCache.get(descMessage.typeName);return compiled||(compiled=this.compileRulesUncached(descMessage),this.rulesCache.set(descMessage.typeName,compiled)),compiled}compileRulesUncached(descMessage){let standard=[],extensions=new Map;for(let field3 of descMessage.fields)if(hasOption(field3,predefined))for(let rule of getOption(field3,predefined).cel)standard.push({field:field3,rule,compiled:this.compileRule(rule)});for(let ext of registryGetExtensionsFor(this.registry,descMessage)){if(!hasOption(ext,predefined))continue;let list12=extensions.get(ext.number);list12||(list12=[],extensions.set(ext.number,list12));for(let rule of getOption(ext,predefined).cel)list12.push({ext,rule,compiled:this.compileRule(rule)})}return{standard,extensions}}};function registryGetExtensionsFor(registry,extendee){let result=[];for(let type2 of registry)type2.kind=="extension"&&type2.extendee.typeName==extendee.typeName&&result.push(type2);return result}var EvalCustomCel=class{constructor(celMan,forMapKey,thisScalarType){this.celMan=celMan,this.forMapKey=forMapKey,this.thisScalarType=thisScalarType,this.children=[]}add(compiled,rulePath){this.children.push({compiled,rulePath})}eval(val,cursor){this.celMan.setEnv("this",reflectToCel(val,this.thisScalarType)),this.celMan.setEnv("rules",void 0),this.celMan.setEnv("rule",void 0);for(let child of this.children){let vio=this.celMan.eval(child.compiled);vio&&cursor.violate(vio.message,vio.ruleId,child.rulePath,this.forMapKey)}}prune(){return this.children.length==0}},EvalExtendedRulesCel=class{constructor(celMan,rules,forMapKey){this.celMan=celMan,this.rules=rules,this.forMapKey=forMapKey,this.children=[],this.thisScalarType=getRuleScalarType(rules)}add(compiled,rulePath,ruleValue,ruleScalarType){this.children.push({compiled,rulePath,ruleCelValue:reflectToCel(ruleValue,ruleScalarType)})}eval(val,cursor){this.celMan.setEnv("rules",this.rules),this.celMan.setEnv("this",reflectToCel(val,this.thisScalarType));for(let child of this.children){this.celMan.setEnv("rule",child.ruleCelValue);let vio=this.celMan.eval(child.compiled);vio&&cursor.violate(vio.message,vio.ruleId,child.rulePath,this.forMapKey)}}prune(){return this.children.length==0}},EvalStandardRulesCel=class{constructor(celMan,rules,forMapKey){this.celMan=celMan,this.rules=rules,this.forMapKey=forMapKey,this.children=[],this.thisScalarType=getRuleScalarType(rules)}add(compiled,rulePath){this.children.push({compiled,rulePath})}eval(val,cursor){this.celMan.setEnv("this",reflectToCel(val,this.thisScalarType)),this.celMan.setEnv("rules",this.rules),this.celMan.setEnv("rule",void 0);for(let child of this.children){let vio=this.celMan.eval(child.compiled);vio&&cursor.violate(vio.message,vio.ruleId,child.rulePath,this.forMapKey)}}prune(){return this.children.length==0}};function reflectToCel(val,scalarType){return isReflectMessage2(val)?val:scalarType?celFromScalar(scalarType,val):val}var Planner2=class{constructor(celMan,legacyRequired){this.celMan=celMan,this.legacyRequired=legacyRequired,this.messageCache=new Map}plan(message6){let existing=this.messageCache.get(message6);if(existing)return existing;let messageRules=getOption(message6,message),e6=new EvalMany;this.messageCache.set(message6,e6);try{e6.add(this.fields(messageRules.oneof,message6.fields)),e6.add(this.messageCel(messageRules)),e6.add(this.messageOneofs(message6,messageRules.oneof)),e6.add(this.oneofs(message6.oneofs)),e6.prune()}catch(err2){throw this.messageCache.delete(message6),err2}return e6}oneofs(oneofs){return new EvalMany(...oneofs.filter(o3=>getOption(o3,oneof).required).map(o3=>new EvalOneofRequired(o3)))}messageOneofs(message6,oneofRules){return new EvalMany(...oneofRules.map(rule=>{if(rule.fields.length==0)throw new CompilationError(`at least one field must be specified in oneof rule for the ${message6}`);let seen=new Set;return new EvalMessageOneofRule(rule.fields.map(fieldName=>{if(seen.has(fieldName))throw new CompilationError(`duplicate ${fieldName} in oneof rule for the ${message6}`);seen.add(fieldName);let found=message6.fields.find(descField=>descField.name===fieldName);if(!found)throw new CompilationError(`field "${fieldName}" not found in ${message6}`);return found}),rule.required)}))}fields(oneofs,fields2){let evals=new EvalMany;for(let field3 of fields2){let fieldRules=getOption(field3,field),ignore=fieldRules.ignore;!isFieldSet(fieldRules,FieldRulesSchema.field.ignore)&&oneofs.some(oneof2=>oneof2.fields.includes(field3.name))&&(ignore=Ignore2.IF_ZERO_VALUE);let required=fieldRules.required&&ignore!==Ignore2.ALWAYS,legacyRequired=this.legacyRequired&&field3.presence==FeatureSet_FieldPresence2.LEGACY_REQUIRED,baseRulePath=buildPath(FieldRulesSchema);switch(field3.fieldKind){case"message":{evals.add(new EvalField(field3,required,legacyRequired,ignoreMessageField(field3,ignore),this.message(field3.message,fieldRules,baseRulePath,field3)));break}case"list":{evals.add(new EvalField(field3,required,legacyRequired,ignoreListOrMapField(field3,ignore),this.planList(field3,fieldRules,baseRulePath)));break}case"map":{evals.add(new EvalField(field3,required,legacyRequired,ignoreListOrMapField(field3,ignore),this.map(field3,fieldRules,baseRulePath)));break}case"enum":{evals.add(new EvalField(field3,required,legacyRequired,ignoreScalarOrEnumField(field3,ignore),this.enumeration(field3.enum,fieldRules,baseRulePath,field3)));break}case"scalar":{evals.add(new EvalField(field3,required,legacyRequired,ignoreScalarOrEnumField(field3,ignore),this.scalar(field3.scalar,fieldRules,baseRulePath,!1,field3)));break}}}return evals}planList(field3,fieldRules,baseRulePath){let evals=new EvalMany(this.fieldCel(fieldRules,baseRulePath,!1,void 0)),[rules,rulePath,rulePathItems]=getListRules(baseRulePath,fieldRules,field3);rules&&evals.add(this.rules(rules,rulePath,!1));let itemsRules=rules?.items;switch(field3.listKind){case"enum":{evals.add(new EvalListItems(ignoreEnumValue(field3.enum,itemsRules?.ignore),this.enumeration(field3.enum,itemsRules,rulePathItems,field3)));break}case"scalar":{evals.add(new EvalListItems(ignoreScalarValue(field3.scalar,itemsRules?.ignore),this.scalar(field3.scalar,itemsRules,rulePathItems,!1,field3)));break}case"message":{evals.add(new EvalListItems(ignoreMessageValue(itemsRules?.ignore),this.message(field3.message,itemsRules,rulePathItems,field3)));break}}return evals}map(field3,fieldRules,baseRulePath){let evals=new EvalMany(this.fieldCel(fieldRules,baseRulePath,!1,void 0)),[rules,rulePath,rulePathKeys,rulePathValues]=getMapRules(baseRulePath,fieldRules,field3);rules&&evals.add(this.rules(rules,rulePath,!1));let ignoreKey=ignoreScalarValue(field3.mapKey,rules?.keys?.ignore),evalKey=this.scalar(field3.mapKey,rules?.keys,rulePathKeys,!0,field3),valuesRules=rules?.values;switch(field3.mapKind){case"message":{evals.add(new EvalMapEntries(ignoreKey,evalKey,ignoreMessageValue(valuesRules?.ignore),this.message(field3.message,valuesRules,rulePathValues,field3)));break}case"enum":{evals.add(new EvalMapEntries(ignoreKey,evalKey,ignoreEnumValue(field3.enum,valuesRules?.ignore),this.enumeration(field3.enum,valuesRules,rulePathValues,field3)));break}case"scalar":{evals.add(new EvalMapEntries(ignoreKey,evalKey,ignoreScalarValue(field3.scalar,valuesRules?.ignore),this.scalar(field3.scalar,valuesRules,rulePathValues,!1,field3)));break}}return evals}enumeration(descEnum,fieldRules,baseRulePath,fieldContext){let evals=new EvalMany(this.fieldCel(fieldRules,baseRulePath,!1,ScalarType2.INT32)),[rules,rulePath]=getEnumRules(baseRulePath,fieldRules,fieldContext);return rules&&(evals.add(new EvalEnumDefinedOnly(descEnum,rulePath,rules)),evals.add(this.rules(rules,rulePath,!1))),evals}scalar(scalar,fieldRules,baseRulePath,forMapKey,fieldContext){let evals=new EvalMany(this.fieldCel(fieldRules,baseRulePath,forMapKey,scalar)),[rules,rulePath]=getScalarRules(scalar,baseRulePath,fieldRules,fieldContext);return rules&&evals.add(this.rules(rules,rulePath,forMapKey)),evals}message(descMessage,fieldRules,baseRulePath,fieldContext){let evals=new EvalMany(this.fieldCel(fieldRules,baseRulePath,!1,void 0));evals.add(this.plan(descMessage));let[rules,rulePath]=getMessageRules(descMessage,baseRulePath,fieldRules,fieldContext);return rules&&(isMessage2(rules,AnyRulesSchema)&&evals.add(new EvalAnyRules(rulePath,rules)),evals.add(this.rules(rules,rulePath,!1))),evals}rules(rules,rulePath,forMapKey){let ruleDesc=getRuleDescriptor(rules.$typeName),prepared=this.celMan.compileRules(ruleDesc),evalStandard=new EvalStandardRulesCel(this.celMan,rules,forMapKey);for(let plan2 of prepared.standard)isFieldSet(rules,plan2.field)&&evalStandard.add(plan2.compiled,rulePath.clone().field(plan2.field).toPath());let evalExtended=new EvalExtendedRulesCel(this.celMan,rules,forMapKey);if(rules.$unknown)for(let uf of rules.$unknown){let plans=prepared.extensions.get(uf.no);if(!plans)throw new CompilationError(`Unknown extension for ${rules.$typeName} with number ${uf.no}. If this is a predefined rule, register the extension with a registry in createValidator().`);for(let plan2 of plans)evalExtended.add(plan2.compiled,rulePath.clone().extension(plan2.ext).toPath(),getExtension(rules,plan2.ext),plan2.ext.fieldKind=="scalar"?plan2.ext.scalar:void 0)}return new EvalMany(evalStandard,evalExtended)}messageCel(messageRules){let e6=new EvalCustomCel(this.celMan,!1,void 0);for(let rule of[...messageRules.celExpression,...messageRules.cel])e6.add(this.celMan.compileRule(rule),[]);return e6}fieldCel(fieldRules,baseRulePath,forMapKey,scalarType){if(!fieldRules)return EvalNoop.get();let e6=new EvalCustomCel(this.celMan,forMapKey,scalarType);for(let[field3,rules]of[[FieldRulesSchema.field.cel,fieldRules.cel],[FieldRulesSchema.field.celExpression,fieldRules.celExpression]])for(let[index2,rule]of rules.entries()){let rulePath=baseRulePath.clone().field(field3).list(index2).toPath();e6.add(this.celMan.compileRule(rule),rulePath)}return e6}};function createValidator(opt){let registry=opt?.registry?createMutableRegistry(opt.registry,file_buf_validate_validate2):createMutableRegistry(file_buf_validate_validate2),failFast=opt?.failFast??!1,celMan=new CelManager(registry,opt?.regexMatch),planner=new Planner2(celMan,opt?.legacyRequired??!1);return{validate(schema2,message6){try{validateUnsafe(registry,celMan,planner,schema2,message6,failFast)}catch(e6){return e6 instanceof ValidationError?{kind:"invalid",message:message6,error:e6,violations:e6.violations}:e6 instanceof CompilationError||e6 instanceof RuntimeError?{kind:"error",message:message6,error:e6}:{kind:"error",message:message6,error:new RuntimeError("unexpected error: "+e6,{cause:e6})}}return{kind:"valid",message:message6}}}}function validateUnsafe(registry,celMan,planner,schema2,message6,failFast){let messageTypeName=message6.$typeName;if(!isMessage2(message6,schema2))throw new RuntimeError(`Cannot validate message ${messageTypeName} with schema ${schema2.typeName}`);if(!registry.get(schema2.typeName)){registry.add(schema2);for(let type2 of usedTypes(schema2))registry.add(type2)}let plan2=planner.plan(schema2),msg=reflect2(schema2,message6),cursor=Cursor.create(schema2,failFast);celMan.updateCelNow(),plan2.eval(msg,cursor),cursor.throwIfViolated()}var sharedValidator;function validator(){return sharedValidator===void 0&&(sharedValidator=createValidator()),sharedValidator}function newValidateProtoStep(){return{name:"ValidateProto",execute(ctx){let result=validator().validate(ctx.schema,ctx.input);if(result.kind!=="valid")throw result.kind==="invalid"?new ConnectError(result.error.message,Code.InvalidArgument):new ConnectError(`validation could not run: ${result.error.message}`,Code.Internal)}}}function newValidateVisibilityStep(){return{name:"ValidateVisibility",execute(ctx){let metadata=metadataOf(ctx.input);metadata!==void 0&&rejectUnsupportedVisibility(ctx.apiResourceKind,metadata.visibility)}}}function newValidateVisibilityUpdateStep(){return{name:"ValidateVisibilityUpdate",execute(ctx){rejectUnsupportedVisibility(ctx.apiResourceKind,ctx.input.visibility)}}}function rejectDefaultInstanceVisibilityUpdate(){throw failedPreconditionError("Default instances do not have their own visibility - access always follows the parent blueprint. Change the blueprint's visibility instead.")}function rejectUnsupportedVisibility(kind,visibility){let supported,levels;try{supported=supportsVisibility(kind,visibility),levels=supportedVisibilityLevels(kind)}catch(error2){throw internalError(error2,"failed to resolve visibility config from kind")}if(!supported)throw invalidArgumentError(`${apiResourceKindName(kind)} resources cannot be set to ${ApiResourceVisibility[visibility]}. Supported visibility levels: ${levels}.`)}var file_ai_stigmer_search_v1_io=fileDesc("Ch1haS9zdGlnbWVyL3NlYXJjaC92MS9pby5wcm90bxIUYWkuc3RpZ21lci5zZWFyY2gudjEikQIKDVNlYXJjaFJlcXVlc3QSXQoFa2luZHMYASADKA4yPy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kLkFwaVJlc291cmNlS2luZEINukgKkgEHIgWCAQIQARIXCgVxdWVyeRgCIAEoCUIIukgFcgMY9AMSKgoDb3JnGAMgASgJQh26SBpyGBg/MhReJHxeW2Etel1bYS16MC05LV0qJBIuCgRwYWdlGAUgASgLMiAuYWkuc3RpZ21lci5jb21tb25zLnJwYy5QYWdlSW5mb0oECAQQBUoECAYQB1IOZXhjbHVkZV9wdWJsaWNSEGNyb3NzX29yZ19wdWJsaWMi9AEKDlNlYXJjaFJlc3BvbnNlEjMKB2VudHJpZXMYASADKAsyIi5haS5zdGlnbWVyLnNlYXJjaC52MS5TZWFyY2hSZXN1bHQSTgoOY291bnRzX2J5X2tpbmQYAiADKAsyNi5haS5zdGlnbWVyLnNlYXJjaC52MS5TZWFyY2hSZXNwb25zZS5Db3VudHNCeUtpbmRFbnRyeRITCgt0b3RhbF9jb3VudBgDIAEoBRITCgt0b3RhbF9wYWdlcxgEIAEoBRozChFDb3VudHNCeUtpbmRFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAU6AjgBIpkDCgxTZWFyY2hSZXN1bHQSTQoEa2luZBgBIAEoDjI/LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5hcGlyZXNvdXJjZWtpbmQuQXBpUmVzb3VyY2VLaW5kEgoKAmlkGAIgASgJEgwKBG5hbWUYAyABKAkSDAoEc2x1ZxgEIAEoCRIWCg5xdWFsaWZpZWRfc2x1ZxgFIAEoCRILCgNvcmcYBiABKAkSEwoLZGVzY3JpcHRpb24YByABKAkSSQoKdmlzaWJpbGl0eRgIIAEoDjI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVZpc2liaWxpdHkSDAoEdGFncxgJIAMoCRIuCgpjcmVhdGVkX2F0GAogASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIuCgp1cGRhdGVkX2F0GAsgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBINCgVzY29yZRgMIAEoAhIQCghpY29uX3VybBgNIAEoCWIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_kind,file_ai_stigmer_commons_apiresource_enum,file_ai_stigmer_commons_rpc_pagination,file_buf_validate_validate,file_google_protobuf_timestamp]),SearchRequestSchema=messageDesc2(file_ai_stigmer_search_v1_io,0),SearchResponseSchema=messageDesc2(file_ai_stigmer_search_v1_io,1),SearchResultSchema=messageDesc2(file_ai_stigmer_search_v1_io,2);function buildSearchResult(params){let metadata=params.metadata;if(metadata!==void 0)return create2(SearchResultSchema,{kind:params.kind,id:metadata.id,name:metadata.name,slug:metadata.slug,org:metadata.org,qualifiedSlug:buildQualifiedSlug(metadata.org,metadata.slug),description:params.summary,visibility:metadata.visibility,tags:metadata.tags,score:params.score,iconUrl:params.iconUrl??"",createdAt:params.createdAt??create2(TimestampSchema),updatedAt:params.updatedAt??create2(TimestampSchema)})}function buildQualifiedSlug(org,slug){return org===""?slug:`${org}/${slug}`}var agentSearchExtractor={kind:ApiResourceKind.agent,schema:AgentSchema,getSearchSummary(resource){return agentSearchSummary(resource)},toSearchResult(resource,score){let agent=resource;return buildSearchResult({kind:ApiResourceKind.agent,metadata:agent.metadata,summary:agentSearchSummary(agent),score,createdAt:agent.status?.audit?.specAudit?.createdAt,updatedAt:agent.status?.audit?.specAudit?.updatedAt,iconUrl:agent.spec?.iconUrl??""})},getSearchIndexEntry(resource){let agent=resource,metadata=agent.metadata;if(metadata!==void 0)return{name:metadata.name,description:agentSearchSummary(agent),tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(agent.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};function agentSearchSummary(agent){let spec=agent.spec;return spec===void 0?"":spec.description!==""?spec.description:spec.instructions}function isValidClassification(c5){return c5.unknown.length===0&&c5.resourceTemplates.length===0}function classify(caps,requested){let tools=new Set(caps.tools.map(tool=>tool.name)),templates=new Set(caps.resourceTemplates.map(tmpl=>tmpl.name)),unknown=[],resourceTemplates=[];for(let name of requested)if(!tools.has(name)){if(templates.has(name)){resourceTemplates.push(name);continue}unknown.push(name)}return{unknown,resourceTemplates}}function toolNames(caps){return caps.tools.map(tool=>tool.name)}function quoteJoin(names){return names.map(n3=>`'${n3}'`).join(", ")}var API_VERSION="agentic.stigmer.ai/v1",KIND="AgentInstance",SLUG_SUFFIX="-default",DESCRIPTION="Default instance (auto-created, no custom configuration)";function defaultInstanceSlug(agentSlug){return`${agentSlug}${SLUG_SUFFIX}`}function buildDefaultInstanceRequest(agent){return create2(AgentInstanceSchema,{apiVersion:API_VERSION,kind:KIND,metadata:{name:defaultInstanceSlug(agent.slug),org:agent.org,labels:{[DEFAULT_INSTANCE_LABEL]:RESERVED_LABEL_TRUE,[SYSTEM_MANAGED_LABEL]:RESERVED_LABEL_TRUE}},spec:{agentId:agent.id,description:DESCRIPTION}})}var DEFAULT_INSTANCE_ID_KEY="default_instance_id";function newValidateEnabledToolsStep(store){return{name:"ValidateEnabledTools",async execute(ctx){let agent=ctx.newState;for(let usage of agent.spec?.mcpServerUsages??[]){if(usage.enabledTools.length===0)continue;let ref=usage.mcpServerRef,slug=ref?.slug??"";if(slug==="")continue;let org=ref?.org??"";org===""&&(org=agent.metadata?.org??"");let mcpServer;try{mcpServer=await findResourceBySlug(store,ApiResourceKind.mcp_server,McpServerSchema,slug,org)}catch(error2){throw new Error(`failed to look up MCP server '${slug}' (org: ${org}) for enabled_tools validation: ${error2 instanceof Error?error2.message:String(error2)}`)}if(mcpServer===void 0)continue;let caps=mcpServer.status?.discoveredCapabilities;if(caps===void 0)continue;let classification=classify(caps,usage.enabledTools);if(!isValidClassification(classification))throw invalidEnabledToolsError(slug,org,classification,caps)}}}}function invalidEnabledToolsError(slug,org,c5,caps){let problems=[];return c5.unknown.length>0&&problems.push(`enabled_tools names tool(s) the server does not expose: ${quoteJoin(c5.unknown)}`),c5.resourceTemplates.length>0&&problems.push(`enabled_tools names resource template(s): ${quoteJoin(c5.resourceTemplates)} \u2014 resource templates are read-only data endpoints, not callable tools, and must not appear in enabled_tools`),invalidArgumentError(`MCP server '${slug}' (org: ${org}): ${problems.join("; ")}. Discovered tools: ${quoteJoin(toolNames(caps))}. If the server's toolset changed, run 'stigmer connect' on it to refresh discovered capabilities.`)}function newMergeMcpServerEnvSpecsStep(store,logger2){return{name:"MergeMcpServerEnvSpecs",async execute(ctx){let agent=ctx.newState,usages=agent.spec?.mcpServerUsages??[];if(usages.length===0)return;let mcpEnvVars={};for(let usage of usages){let ref=usage.mcpServerRef,slug=ref?.slug??"";if(slug==="")continue;let org=ref?.org??"";if(org===""&&(org=agent.metadata?.org??""),org==="")continue;let mcpServer;try{mcpServer=await findResourceBySlug(store,ApiResourceKind.mcp_server,McpServerSchema,slug,org)}catch(error2){logger2.warn("Failed to look up MCP server for env merge",{mcpServerSlug:slug,org,error:error2 instanceof Error?error2.message:String(error2)});continue}if(mcpServer===void 0){logger2.warn("MCP server not found \u2014 skipping env merge for this server",{mcpServerSlug:slug,org});continue}let serverEnv=mcpServer.spec?.env??{};for(let[varName,decl]of Object.entries(serverEnv))varName in mcpEnvVars||(mcpEnvVars[varName]=create2(EnvVarDeclarationSchema,{description:decl.description,isSecret:decl.isSecret,optional:decl.optional}))}if(Object.keys(mcpEnvVars).length===0)return;let spec=agent.spec;if(spec===void 0)return;let existingEnv=spec.env,merged={...mcpEnvVars};for(let[k5,v]of Object.entries(existingEnv))merged[k5]=v;spec.env=merged;let mergedCount=Object.keys(merged).length-Object.keys(existingEnv).length;mergedCount>0&&logger2.info("Merged MCP server env declarations into agent env",{injectedCount:mergedCount,totalCount:Object.keys(merged).length,agent:agent.metadata?.slug??""})}}}function newCreateDefaultInstanceStep(applierProvider,logger2){return{name:"CreateDefaultInstance",async execute(ctx){let metadata=ctx.newState.metadata;if(metadata===void 0)throw internalError(new Error("agent metadata is nil after persist"),"agent metadata is nil after persist");logger2.info("Creating default instance for agent",{agentId:metadata.id,slug:metadata.slug,org:metadata.org});let instanceRequest=buildDefaultInstanceRequest(metadata),applied;try{applied=await applierProvider().applyAsCaller(instanceRequest,ctx.callerIdentity)}catch(error2){throw error2 instanceof ConnectError?goWrappedStatusError("failed to apply default instance",error2):new Error(`failed to apply default instance: ${error2 instanceof Error?error2.message:String(error2)}`)}logger2.info("Successfully applied default instance for agent",{instanceId:applied.metadata?.id??"",agentId:metadata.id}),ctx.set(DEFAULT_INSTANCE_ID_KEY,applied.metadata?.id??"")}}}function newUpdateAgentStatusWithDefaultInstanceStep(store,logger2,authorizationLifecycle){return{name:"UpdateAgentStatusWithDefaultInstance",async execute(ctx){let agent=ctx.newState,agentId=agent.metadata?.id??"",defaultInstanceId=ctx.get(DEFAULT_INSTANCE_ID_KEY);if(typeof defaultInstanceId!="string"||defaultInstanceId==="")throw internalError(new Error("no default instance id in context (CreateDefaultInstance must run first)"),"no default instance id in context (CreateDefaultInstance must run first)");agent.status===void 0&&(agent.status=create2(AgentStatusSchema,{})),agent.status.defaultInstanceId=defaultInstanceId;try{await store.saveResource(ctx.apiResourceKind,agentId,ctx.schema,agent)}catch(error2){throw logger2.error("Failed to persist agent with default_instance_id",{agentId,error:error2 instanceof Error?error2.message:String(error2)}),new Error(`failed to persist agent with default instance: ${error2 instanceof Error?error2.message:String(error2)}`)}await notifyDefaultInstanceLinked(authorizationLifecycle,{instanceKind:ApiResourceKind.agent_instance,instanceId:defaultInstanceId,blueprintKind:ApiResourceKind.agent,blueprintId:agentId}),ctx.setNewState(agent),logger2.info("Successfully updated agent status with default_instance_id",{defaultInstanceId,agentId})}}}function newCascadeDeleteInstancesStep(store,logger2){return{name:"CascadeDeleteInstances",async execute(ctx){let agent=ctx.get(EXISTING_RESOURCE_KEY);if(agent===void 0)throw internalError(new Error("agent not found in context (LoadExistingForDelete must run first)"),"agent not found in context (LoadExistingForDelete must run first)");let agentId=agent.metadata?.id??"",rows;try{rows=await store.listResources(ApiResourceKind.agent_instance)}catch(error2){throw internalError(error2,"failed to list agent instances for cascade delete")}let deleted=0;for(let data of rows){let instance;try{instance=fromBinary2(AgentInstanceSchema,data)}catch{continue}if((instance.spec?.agentId??"")!==agentId)continue;let instanceId=instance.metadata?.id??"";try{await store.deleteResource(ApiResourceKind.agent_instance,instanceId)}catch(error2){throw internalError(error2,`failed to cascade-delete instance ${instanceId} of agent ${agentId}`)}try{await store.deleteSearchIndex(ApiResourceKind.agent_instance,instanceId)}catch(error2){logger2.warn("CascadeDeleteInstances: failed to remove search index entry (best-effort)",{instanceId,error:error2 instanceof Error?error2.message:String(error2)})}deleted++}deleted>0&&logger2.info("Cascade-deleted instances of agent",{count:deleted,agentId})}}}function newCascadeDeleteSharesStep(store,logger2){return{name:"CascadeDeleteShares",async execute(ctx){let agent=ctx.get(EXISTING_RESOURCE_KEY);if(agent===void 0)throw internalError(new Error("agent not found in context (LoadExistingForDelete must run first)"),"agent not found in context (LoadExistingForDelete must run first)");let agentOrg=agent.metadata?.org??"",agentSlug=agent.metadata?.slug??"",rows;try{rows=await store.listResources(ApiResourceKind.agent_share)}catch(error2){throw internalError(error2,"failed to list agent shares for cascade delete")}let deleted=0;for(let data of rows){let share;try{share=fromBinary2(AgentShareSchema,data)}catch{continue}let ref=share.spec?.agentRef;if((ref?.org??"")!==agentOrg||(ref?.slug??"")!==agentSlug||(share.metadata?.org??"")!==agentOrg)continue;let shareId=share.metadata?.id??"";try{await store.deleteResource(ApiResourceKind.agent_share,shareId)}catch(error2){throw internalError(error2,`failed to cascade-delete share ${shareId} of agent ${agentOrg}/${agentSlug}`)}deleted++}deleted>0&&logger2.info("Cascade-deleted shares of agent",{count:deleted,agent:`${agentOrg}/${agentSlug}`})}}}function registerAgentServices(router,deps){router.service(AgentCommandController,{apply:(agent,ctx)=>apply(deps,agent,ctx),create:(agent,ctx)=>createAgent(deps,agent,ctx),update:(agent,ctx)=>update(deps,agent,ctx),updateVisibility:(input,ctx)=>updateVisibility(deps,input,ctx),delete:(id,ctx)=>deleteAgent(deps,id,ctx)}),router.service(AgentQueryController,{get:(id,ctx)=>get(deps,id,ctx),getByReference:(ref,ctx)=>getByReference(deps,ref,ctx)})}function kindOf(ctx){return ctx.values.get(apiResourceKindKey)}async function createAgent(deps,agent,ctx){let reqCtx=new RequestContext(AgentSchema,agent,callerIdentityOf(ctx),kindOf(ctx));return await newPipeline("agent-create",deps.logger).addStep(newAuthorizeStep(AgentCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newValidateEnabledToolsStep(deps.store)).addStep(newMergeMcpServerEnvSpecsStep(deps.store,deps.logger)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newCreateDefaultInstanceStep(deps.agentInstanceApplier,deps.logger)).addStep(newUpdateAgentStatusWithDefaultInstanceStep(deps.store,deps.logger,deps.authorizationLifecycle)).addStep(newIndexSearchStep(deps.store,agentSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update(deps,agent,ctx){let reqCtx=new RequestContext(AgentSchema,agent,callerIdentityOf(ctx),kindOf(ctx));return await newPipeline("agent-update",deps.logger).addStep(newAuthorizeStep(AgentCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newGuardPluginManagedStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newValidateEnabledToolsStep(deps.store)).addStep(newMergeMcpServerEnvSpecsStep(deps.store,deps.logger)).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,agentSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply(deps,agent,ctx){let reqCtx=new RequestContext(AgentSchema,agent,callerIdentityOf(ctx),kindOf(ctx));await newPipeline("agent-apply",deps.logger).addStep(newAuthorizeStep(AgentCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createAgent(deps,agent,ctx):update(deps,withResolvedApplyId(AgentSchema,agent,reqCtx),ctx)}async function deleteAgent(deps,agentId,ctx){let reqCtx=new RequestContext(AgentCommandController.method.delete.input,agentId,callerIdentityOf(ctx),kindOf(ctx));await newPipeline("agent-delete",deps.logger).addStep(newAuthorizeStep(AgentCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,AgentSchema)).addStep(newGuardPluginManagedStep(deps.store)).addStep(newCascadeDeleteInstancesStep(deps.store,deps.logger)).addStep(newCascadeDeleteSharesStep(deps.store,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted agent not found in context"),"deleted agent not found in context");return deleted}var UPDATE_VISIBILITY_AGENT_KEY="updateVisibilityAgent";async function updateVisibility(deps,input,ctx){let reqCtx=new RequestContext(AgentCommandController.method.updateVisibility.input,input,callerIdentityOf(ctx),kindOf(ctx));return await newPipeline("agent-update-visibility",deps.logger).addStep(newAuthorizeStep(AgentCommandController.method.updateVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadAgentForVisibilityUpdateStep(deps.store)).addStep(newGuardPluginManagedStep(deps.store,{existingKey:UPDATE_VISIBILITY_AGENT_KEY})).addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_AGENT_KEY)).addStep(newValidateVisibilityUpdateStep()).addStep(newGuardReferenceFloorOnEscalationStep(deps.store,UPDATE_VISIBILITY_AGENT_KEY,[row=>collectSpecReferences(AgentSchema,row)])).addStep(newSetAgentVisibilityStep()).addStep(newPersistAgentForVisibilityUpdateStep(deps.store)).addStep(newUpdateVisibilityTuplesStep(deps.authorizationLifecycle,UPDATE_VISIBILITY_AGENT_KEY)).addStep(newIndexAgentAfterVisibilityUpdateStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(UPDATE_VISIBILITY_AGENT_KEY)}function newLoadAgentForVisibilityUpdateStep(store){return{name:"LoadAgentForVisibilityUpdate",async execute(ctx){let input=ctx.input,agent;try{agent=await store.getResource(ApiResourceKind.agent,input.resourceId,AgentSchema)}catch{throw notFoundError("agent",input.resourceId)}ctx.set(UPDATE_VISIBILITY_AGENT_KEY,agent)}}}function newSetAgentVisibilityStep(){return{name:"SetAgentVisibility",execute(ctx){let agent=ctx.get(UPDATE_VISIBILITY_AGENT_KEY);agent.metadata!==void 0&&(agent.metadata.visibility=ctx.input.visibility),setAuditFieldsForUpdate(AgentSchema,agent,"status_audit",ctx.callerIdentity)}}}function newPersistAgentForVisibilityUpdateStep(store){return{name:"PersistAgentForVisibilityUpdate",async execute(ctx){let agent=ctx.get(UPDATE_VISIBILITY_AGENT_KEY);try{await store.saveResource(ApiResourceKind.agent,agent.metadata?.id??"",AgentSchema,agent)}catch(error2){throw internalError(error2,"failed to save agent")}}}}function newIndexAgentAfterVisibilityUpdateStep(store,logger2){return{name:"IndexAgentAfterVisibilityUpdate",async execute(ctx){let agent=ctx.get(UPDATE_VISIBILITY_AGENT_KEY),entry=agentSearchExtractor.getSearchIndexEntry(agent);if(entry===void 0){logger2.warn("IndexAgentAfterVisibilityUpdate: extractor returned nil, skipping",{id:agent.metadata?.id??""});return}try{await store.upsertSearchIndex(ApiResourceKind.agent,agent.metadata?.id??"",entry)}catch(error2){logger2.warn("IndexAgentAfterVisibilityUpdate: failed (best-effort)",{id:agent.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}}}async function get(deps,id,ctx){let reqCtx=new RequestContext(AgentQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf(ctx));return await newPipeline("agent-get",deps.logger).addStep(newAuthorizeStep(AgentQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,AgentSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByReference(deps,ref,ctx){let reqCtx=new RequestContext(AgentQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf(ctx));return await newPipeline("agent-get-by-reference",deps.logger).addStep(newAuthorizeStep(AgentQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,AgentSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(AgentQueryController.method.get))).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var ROUTING_GLOBAL="global",ROUTING_SESSION="session",DEFAULT_EXECUTION_TARGET_LOCAL="local",DEFAULT_EXECUTION_TARGET_CLOUD="cloud",AgentExecutionTemporalConfig=class{stigmerQueue;runnerQueue;activityRouting;defaultExecutionTarget;constructor(stigmerQueue,runnerQueue,activityRouting,defaultExecutionTarget){this.stigmerQueue=stigmerQueue,this.runnerQueue=runnerQueue,this.activityRouting=activityRouting,this.defaultExecutionTarget=defaultExecutionTarget}resolveExecutionTarget(target){return target!==ExecutionTarget.UNSPECIFIED?target:this.defaultExecutionTarget===DEFAULT_EXECUTION_TARGET_CLOUD?ExecutionTarget.CLOUD:ExecutionTarget.LOCAL}};function newConfigFromEnv(){return new AgentExecutionTemporalConfig(valueOrDefault(process.env.TEMPORAL_AGENT_EXECUTION_STIGMER_TASK_QUEUE,"agent_execution_stigmer"),valueOrDefault(process.env.TEMPORAL_AGENT_EXECUTION_RUNNER_TASK_QUEUE,"stigmer_runner"),valueOrDefault(process.env.STIGMER_ACTIVITY_ROUTING,ROUTING_GLOBAL),valueOrDefault(process.env.STIGMER_DEFAULT_EXECUTION_TARGET,DEFAULT_EXECUTION_TARGET_LOCAL))}function valueOrDefault(value,fallback3){return value===void 0||value===""?fallback3:value}var file_ai_stigmer_agentic_agentexecution_v1_io=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvaW8ucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MSIpChBBZ2VudEV4ZWN1dGlvbklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiIgoJU2Vzc2lvbklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiiQEKEkFnZW50RXhlY3V0aW9uTGlzdBITCgt0b3RhbF9wYWdlcxgBIAEoBRJFCgdlbnRyaWVzGAIgAygLMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RXhlY3V0aW9uEhcKD25leHRfcGFnZV90b2tlbhgDIAEoCSKsAQoaTGlzdEFnZW50RXhlY3V0aW9uc1JlcXVlc3QSGgoJcGFnZV9zaXplGAEgASgFQge6SAQaAigAEhIKCnBhZ2VfdG9rZW4YAiABKAkSQwoFcGhhc2UYAyABKA4yNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRXhlY3V0aW9uUGhhc2USDAoEdGFncxgEIAMoCRILCgNvcmcYBSABKAkicAojTGlzdEFnZW50RXhlY3V0aW9uc0J5U2Vzc2lvblJlcXVlc3QSGgoKc2Vzc2lvbl9pZBgBIAEoCUIGukgDyAEBEhUKCXBhZ2Vfc2l6ZRgCIAEoBUICGAESFgoKcGFnZV90b2tlbhgDIAEoCUICGAEilAEKH0FnZW50RXhlY3V0aW9uVXBkYXRlU3RhdHVzSW5wdXQSHQoMZXhlY3V0aW9uX2lkGAEgASgJQge6SARyAhABElIKBnN0YXR1cxgCIAEoCzI6LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvblN0YXR1c0IGukgDyAEBInsKFFVwZGF0ZVN0YXR1c1Jlc3BvbnNlEkwKBnNpZ25hbBgBIAEoDjI8LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5FeGVjdXRpb25Db250cm9sU2lnbmFsEhUKDXNpZ25hbF9yZWFzb24YAiABKAkivAEKE1N1Ym1pdEFwcHJvdmFsSW5wdXQSIwoSYWdlbnRfZXhlY3V0aW9uX2lkGAEgASgJQge6SARyAhABEh0KDHRvb2xfY2FsbF9pZBgCIAEoCUIHukgEcgIQARJQCgZhY3Rpb24YAyABKA4yNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQXBwcm92YWxBY3Rpb25CCrpIB4IBBBABIAASDwoHY29tbWVudBgEIAEoCSJkChRBcHByb3ZhbERlY2lzaW9uTGlzdBJMCglkZWNpc2lvbnMYASADKAsyOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuU3VibWl0QXBwcm92YWxJbnB1dCL0AgoXU3VibWl0RmlsZURlY2lzaW9uSW5wdXQSIwoSYWdlbnRfZXhlY3V0aW9uX2lkGAEgASgJQge6SARyAhABEh4KDWNoYW5nZV9zZXRfaWQYAiABKAlCB7pIBHICEAESUgoFc2NvcGUYAyABKA4yNy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZURlY2lzaW9uU2NvcGVCCrpIB4IBBBABIAASFgoOZmlsZV9jaGFuZ2VfaWQYBCABKAkSVAoGYWN0aW9uGAUgASgOMjguYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVEZWNpc2lvbkFjdGlvbkIKukgHggEEEAEgABIgCg9leHBlY3RlZF9kaWdlc3QYBiABKAlCB7pIBHICEAESDgoGcmVhc29uGAcgASgJEiAKGGFja25vd2xlZGdlX3VucmV2aWV3YWJsZRgIIAEoCCJAChlDYW5jZWxBZ2VudEV4ZWN1dGlvbklucHV0EhMKAmlkGAEgASgJQge6SARyAhABEg4KBnJlYXNvbhgCIAEoCSJDChxUZXJtaW5hdGVBZ2VudEV4ZWN1dGlvbklucHV0EhMKAmlkGAEgASgJQge6SARyAhABEg4KBnJlYXNvbhgCIAEoCSIxChpSZWNvdmVyQWdlbnRFeGVjdXRpb25JbnB1dBITCgJpZBgBIAEoCUIHukgEcgIQASI/ChhQYXVzZUFnZW50RXhlY3V0aW9uSW5wdXQSEwoCaWQYASABKAlCB7pIBHICEAESDgoGcmVhc29uGAIgASgJIjAKGVJlc3VtZUFnZW50RXhlY3V0aW9uSW5wdXQSEwoCaWQYASABKAlCB7pIBHICEAEiqgIKF1VwbG9hZEF0dGFjaG1lbnRSZXF1ZXN0Et8BCghmaWxlbmFtZRgBIAEoCULMAbpIyAG6AcABCiJ1cGxvYWRfYXR0YWNobWVudC5maWxlbmFtZS5ub19wYXRoEk5maWxlbmFtZSBtdXN0IGJlIGEgYmFyZSBmaWxlbmFtZSB3aXRob3V0IHBhdGggc2VwYXJhdG9ycyBvciB0cmF2ZXJzYWwgc2VnbWVudHMaSiF0aGlzLmNvbnRhaW5zKCcvJykgJiYgIXRoaXMuY29udGFpbnMoJ1xcJykgJiYgdGhpcyAhPSAnLicgJiYgdGhpcyAhPSAnLi4ncgIQARIXCgdjb250ZW50GAIgASgMQga6SAPIAQESFAoMY29udGVudF90eXBlGAMgASgJIi8KGFVwbG9hZEF0dGFjaG1lbnRSZXNwb25zZRITCgtzdG9yYWdlX2tleRgBIAEoCSJzCh1HZXRBcnRpZmFjdERvd25sb2FkVXJsUmVxdWVzdBIdCgxleGVjdXRpb25faWQYASABKAlCB7pIBHICEAESHAoLc3RvcmFnZV9rZXkYAiABKAlCB7pIBHICEAESFQoNYXNfYXR0YWNobWVudBgDIAEoCCJKCh5HZXRBcnRpZmFjdERvd25sb2FkVXJsUmVzcG9uc2USFAoMZG93bmxvYWRfdXJsGAEgASgJEhIKCmV4cGlyZXNfYXQYAiABKAkifwoZR2V0QXJ0aWZhY3RDb250ZW50UmVxdWVzdBIdCgxleGVjdXRpb25faWQYASABKAlCB7pIBHICEAESHAoLc3RvcmFnZV9rZXkYAiABKAlCB7pIBHICEAESEQoJbWF4X2J5dGVzGAMgASgDEhIKCmVudHJ5X3BhdGgYBCABKAkicAoaR2V0QXJ0aWZhY3RDb250ZW50UmVzcG9uc2USDwoHY29udGVudBgBIAEoDBIUCgxjb250ZW50X3R5cGUYAiABKAkSGAoQdG90YWxfc2l6ZV9ieXRlcxgDIAEoAxIRCgl0cnVuY2F0ZWQYBCABKAgiPQocR2V0RXhlY3V0aW9uVXNhZ2VSZXBvcnRJbnB1dBIdCgxleGVjdXRpb25faWQYASABKAlCB7pIBHICEAEiuQEKHUdldEV4ZWN1dGlvblVzYWdlUmVwb3J0T3V0cHV0Ek0KCWFnZ3JlZ2F0ZRgBIAEoCzI6LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Vc2FnZVJlcG9ydEFnZ3JlZ2F0ZRJJCg9tb2RlbF9icmVha2Rvd24YAiADKAsyMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuTW9kZWxVc2FnZSI5ChpHZXRTZXNzaW9uVXNhZ2VSZXBvcnRJbnB1dBIbCgpzZXNzaW9uX2lkGAEgASgJQge6SARyAhABIoQDChtHZXRTZXNzaW9uVXNhZ2VSZXBvcnRPdXRwdXQSEgoKc2Vzc2lvbl9pZBgBIAEoCRIXCg9leGVjdXRpb25fY291bnQYAiABKAUSTwoLdG90YWxfdXNhZ2UYAyABKAsyOi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVXNhZ2VSZXBvcnRBZ2dyZWdhdGUSTwoKZXhlY3V0aW9ucxgEIAMoCzI7LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5FeGVjdXRpb25Vc2FnZVN1bW1hcnkSSQoPbW9kZWxfYnJlYWtkb3duGAUgAygLMjAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLk1vZGVsVXNhZ2USGgoSZmlyc3RfZXhlY3V0aW9uX2F0GAYgASgJEhkKEWxhc3RfZXhlY3V0aW9uX2F0GAcgASgJEhQKDGlzX2VzdGltYXRlZBgIIAEoCCKZAQoYR2V0QWdlbnRVc2FnZVJlcG9ydElucHV0EhkKCGFnZW50X2lkGAEgASgJQge6SARyAhABEhEKCWZyb21fZGF0ZRgCIAEoCRIPCgd0b19kYXRlGAMgASgJEhEKCXBhZ2Vfc2l6ZRgEIAEoBRISCgpwYWdlX3Rva2VuGAUgASgJEhcKBm9yZ19pZBgGIAEoCUIHukgEcgIQASKZAwoZR2V0QWdlbnRVc2FnZVJlcG9ydE91dHB1dBIQCghhZ2VudF9pZBgBIAEoCRISCgphZ2VudF9uYW1lGAIgASgJEk8KC3RvdGFsX3VzYWdlGAMgASgLMjouYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlVzYWdlUmVwb3J0QWdncmVnYXRlEkkKD21vZGVsX2JyZWFrZG93bhgEIAMoCzIwLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Nb2RlbFVzYWdlEksKCHNlc3Npb25zGAUgAygLMjkuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNlc3Npb25Vc2FnZVN1bW1hcnkSFgoOdG90YWxfc2Vzc2lvbnMYBiABKAUSGAoQdG90YWxfZXhlY3V0aW9ucxgHIAEoBRIiChp0b3RhbF9iaWxsYWJsZV9jb3N0X21pY3JvcxgIIAEoAxIXCg9uZXh0X3BhZ2VfdG9rZW4YCSABKAkiZwoWR2V0T3JnVXNhZ2VSZXBvcnRJbnB1dBIXCgZvcmdfaWQYASABKAlCB7pIBHICEAESGgoJZnJvbV9kYXRlGAIgASgJQge6SARyAhABEhgKB3RvX2RhdGUYAyABKAlCB7pIBHICEAEi1QMKF0dldE9yZ1VzYWdlUmVwb3J0T3V0cHV0Eg4KBm9yZ19pZBgBIAEoCRIUCgx0b3RhbF9hZ2VudHMYAiABKAUSFgoOdG90YWxfc2Vzc2lvbnMYAyABKAUSGAoQdG90YWxfZXhlY3V0aW9ucxgEIAEoBRIiChp0b3RhbF9iaWxsYWJsZV9jb3N0X21pY3JvcxgFIAEoAxJJCg9tb2RlbF9icmVha2Rvd24YBiADKAsyMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuTW9kZWxVc2FnZRJTChJ0b3BfYWdlbnRzX2J5X2Nvc3QYByADKAsyNy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQWdlbnRVc2FnZVN1bW1hcnkSSQoLZGFpbHlfY29zdHMYCCADKAsyNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRGFpbHlDb3N0RW50cnkSUwoRaGFybmVzc19icmVha2Rvd24YCSADKAsyOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuSGFybmVzc0Nvc3RTdW1tYXJ5Is4CChVFeGVjdXRpb25Vc2FnZVN1bW1hcnkSFAoMZXhlY3V0aW9uX2lkGAEgASgJEhIKCnN0YXJ0ZWRfYXQYAiABKAkSFAoMY29tcGxldGVkX2F0GAMgASgJEhQKDGlucHV0X3Rva2VucxgEIAEoAxIVCg1vdXRwdXRfdG9rZW5zGAUgASgDEh8KF2NhY2hlX3JlYWRfaW5wdXRfdG9rZW5zGAYgASgDEhwKFGJpbGxhYmxlX2Nvc3RfbWljcm9zGAcgASgDEhUKDXByaW1hcnlfbW9kZWwYCCABKAkSFwoPc3ViX2FnZW50X2NvdW50GAkgASgFEkMKBXBoYXNlGAogASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkV4ZWN1dGlvblBoYXNlEhQKDGlzX2VzdGltYXRlZBgLIAEoCCKtAQoTU2Vzc2lvblVzYWdlU3VtbWFyeRISCgpzZXNzaW9uX2lkGAEgASgJEhcKD2V4ZWN1dGlvbl9jb3VudBgCIAEoBRIUCgx0b3RhbF90b2tlbnMYAyABKAMSHAoUYmlsbGFibGVfY29zdF9taWNyb3MYBCABKAMSGgoSZmlyc3RfZXhlY3V0aW9uX2F0GAUgASgJEhkKEWxhc3RfZXhlY3V0aW9uX2F0GAYgASgJIoYBChFBZ2VudFVzYWdlU3VtbWFyeRIQCghhZ2VudF9pZBgBIAEoCRISCgphZ2VudF9uYW1lGAIgASgJEhcKD2V4ZWN1dGlvbl9jb3VudBgDIAEoBRIUCgx0b3RhbF90b2tlbnMYBCABKAMSHAoUYmlsbGFibGVfY29zdF9taWNyb3MYBSABKAMiawoORGFpbHlDb3N0RW50cnkSDAoEZGF0ZRgBIAEoCRIXCg9leGVjdXRpb25fY291bnQYAiABKAUSFAoMdG90YWxfdG9rZW5zGAMgASgDEhwKFGJpbGxhYmxlX2Nvc3RfbWljcm9zGAQgASgDInAKEkhhcm5lc3NDb3N0U3VtbWFyeRIPCgdoYXJuZXNzGAEgASgJEhwKFGJpbGxhYmxlX2Nvc3RfbWljcm9zGAIgASgDEhIKCmNhbGxfY291bnQYAyABKAUSFwoPZXhlY3V0aW9uX2NvdW50GAQgASgFIpMBCh9HZXRBZ2VudEV4ZWN1dGlvblN1bW1hcnlSZXF1ZXN0EhQKA29yZxgBIAEoCUIHukgEcgIQARJaCgt0aW1lX3dpbmRvdxgCIAEoDjJFLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvblN1bW1hcnlUaW1lV2luZG93IsoCChVBZ2VudEV4ZWN1dGlvblN1bW1hcnkSFAoMYWN0aXZlX2NvdW50GAEgASgFEmIKDHBoYXNlX2NvdW50cxgCIAMoCzJMLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvblN1bW1hcnkuUGhhc2VDb3VudHNFbnRyeRIvCgxhdmdfZHVyYXRpb24YAyABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb24SUgoSdG9wX2ZhaWxpbmdfYWdlbnRzGAQgAygLMjYuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RmFpbHVyZVJhbmsaMgoQUGhhc2VDb3VudHNFbnRyeRILCgNrZXkYASABKAUSDQoFdmFsdWUYAiABKAU6AjgBIlEKEEFnZW50RmFpbHVyZVJhbmsSEgoKYWdlbnRfc2x1ZxgBIAEoCRISCgphZ2VudF9uYW1lGAIgASgJEhUKDWZhaWx1cmVfY291bnQYAyABKAUqnQIKH0FnZW50RXhlY3V0aW9uU3VtbWFyeVRpbWVXaW5kb3cSMwovQUdFTlRfRVhFQ1VUSU9OX1NVTU1BUllfVElNRV9XSU5ET1dfVU5TUEVDSUZJRUQQABIwCixBR0VOVF9FWEVDVVRJT05fU1VNTUFSWV9USU1FX1dJTkRPV19MQVNUXzI0SBABEi8KK0FHRU5UX0VYRUNVVElPTl9TVU1NQVJZX1RJTUVfV0lORE9XX0xBU1RfN0QQAhIwCixBR0VOVF9FWEVDVVRJT05fU1VNTUFSWV9USU1FX1dJTkRPV19MQVNUXzMwRBADEjAKLEFHRU5UX0VYRUNVVElPTl9TVU1NQVJZX1RJTUVfV0lORE9XX0FMTF9USU1FEARiBnByb3RvMw",[file_ai_stigmer_agentic_agentexecution_v1_api,file_ai_stigmer_agentic_agentexecution_v1_enum,file_ai_stigmer_agentic_agentexecution_v1_usage,file_buf_validate_validate,file_google_protobuf_duration]);var AgentExecutionListSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,2);var AgentExecutionUpdateStatusInputSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,5),UpdateStatusResponseSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,6),SubmitApprovalInputSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,7);var SubmitFileDecisionInputSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,9);var UploadAttachmentResponseSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,16);var GetArtifactDownloadUrlResponseSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,18);var GetArtifactContentResponseSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,20);var GetExecutionUsageReportOutputSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,22);var GetSessionUsageReportOutputSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,24);var GetAgentUsageReportOutputSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,26);var GetOrgUsageReportOutputSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,28),ExecutionUsageSummarySchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,29),SessionUsageSummarySchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,30),AgentUsageSummarySchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,31),DailyCostEntrySchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,32);var AgentExecutionSummarySchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,35),AgentFailureRankSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,36),AgentExecutionSummaryTimeWindow;(function(AgentExecutionSummaryTimeWindow2){AgentExecutionSummaryTimeWindow2[AgentExecutionSummaryTimeWindow2.UNSPECIFIED=0]="UNSPECIFIED",AgentExecutionSummaryTimeWindow2[AgentExecutionSummaryTimeWindow2.LAST_24H=1]="LAST_24H",AgentExecutionSummaryTimeWindow2[AgentExecutionSummaryTimeWindow2.LAST_7D=2]="LAST_7D",AgentExecutionSummaryTimeWindow2[AgentExecutionSummaryTimeWindow2.LAST_30D=3]="LAST_30D",AgentExecutionSummaryTimeWindow2[AgentExecutionSummaryTimeWindow2.ALL_TIME=4]="ALL_TIME"})(AgentExecutionSummaryTimeWindow||(AgentExecutionSummaryTimeWindow={}));var file_ai_stigmer_agentic_agentexecution_v1_command=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvY29tbWFuZC5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxMtMRCh9BZ2VudEV4ZWN1dGlvbkNvbW1hbmRDb250cm9sbGVyEnoKBmNyZWF0ZRI0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvbho0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvbiIE0LgYARKzAQoGdXBkYXRlEjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RXhlY3V0aW9uGjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RXhlY3V0aW9uIj3CuBg5CAIQKSILbWV0YWRhdGEuaWQqJnVuYXV0aG9yaXplZCB0byB1cGRhdGUgYWdlbnQgZXhlY3V0aW9uEtgBCgx1cGRhdGVTdGF0dXMSRS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQWdlbnRFeGVjdXRpb25VcGRhdGVTdGF0dXNJbnB1dBo6LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5VcGRhdGVTdGF0dXNSZXNwb25zZSJFwrgYQQgCECkiDGV4ZWN1dGlvbl9pZCotdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBhZ2VudCBleGVjdXRpb24gc3RhdHVzEqYBCgZkZWxldGUSLS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VJZBo0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvbiI3wrgYMwgCECkiBXZhbHVlKiZ1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIGFnZW50IGV4ZWN1dGlvbhLUAQoOc3VibWl0QXBwcm92YWwSOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuU3VibWl0QXBwcm92YWxJbnB1dBo0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvbiJRwrgYTQgCECkiEmFnZW50X2V4ZWN1dGlvbl9pZCozdW5hdXRob3JpemVkIHRvIHN1Ym1pdCBhcHByb3ZhbCBmb3IgYWdlbnQgZXhlY3V0aW9uEuEBChJzdWJtaXRGaWxlRGVjaXNpb24SPS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuU3VibWl0RmlsZURlY2lzaW9uSW5wdXQaNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQWdlbnRFeGVjdXRpb24iVsK4GFIIAhApIhJhZ2VudF9leGVjdXRpb25faWQqOHVuYXV0aG9yaXplZCB0byBzdWJtaXQgZmlsZSBkZWNpc2lvbiBmb3IgYWdlbnQgZXhlY3V0aW9uErUBCgZjYW5jZWwSPy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ2FuY2VsQWdlbnRFeGVjdXRpb25JbnB1dBo0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvbiI0wrgYMAgCECkiAmlkKiZ1bmF1dGhvcml6ZWQgdG8gY2FuY2VsIGFnZW50IGV4ZWN1dGlvbhK+AQoJdGVybWluYXRlEkIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRlcm1pbmF0ZUFnZW50RXhlY3V0aW9uSW5wdXQaNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQWdlbnRFeGVjdXRpb24iN8K4GDMIAhApIgJpZCopdW5hdXRob3JpemVkIHRvIHRlcm1pbmF0ZSBhZ2VudCBleGVjdXRpb24SuAEKB3JlY292ZXISQC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuUmVjb3ZlckFnZW50RXhlY3V0aW9uSW5wdXQaNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQWdlbnRFeGVjdXRpb24iNcK4GDEIAhApIgJpZCondW5hdXRob3JpemVkIHRvIHJlY292ZXIgYWdlbnQgZXhlY3V0aW9uErIBCgVwYXVzZRI+LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5QYXVzZUFnZW50RXhlY3V0aW9uSW5wdXQaNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQWdlbnRFeGVjdXRpb24iM8K4GC8IAhApIgJpZColdW5hdXRob3JpemVkIHRvIHBhdXNlIGFnZW50IGV4ZWN1dGlvbhK1AQoGcmVzdW1lEj8uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlJlc3VtZUFnZW50RXhlY3V0aW9uSW5wdXQaNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQWdlbnRFeGVjdXRpb24iNMK4GDAIAhApIgJpZComdW5hdXRob3JpemVkIHRvIHJlc3VtZSBhZ2VudCBleGVjdXRpb24SlwEKEHVwbG9hZEF0dGFjaG1lbnQSPS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVXBsb2FkQXR0YWNobWVudFJlcXVlc3QaPi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVXBsb2FkQXR0YWNobWVudFJlc3BvbnNlIgTQuBgBGgSg/yspYgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_api,file_ai_stigmer_agentic_agentexecution_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentExecutionCommandController=serviceDesc(file_ai_stigmer_agentic_agentexecution_v1_command,0);var file_ai_stigmer_agentic_agentexecution_v1_query=fileDesc("CjBhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvcXVlcnkucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MTKvEQodQWdlbnRFeGVjdXRpb25RdWVyeUNvbnRyb2xsZXISqQEKA2dldBI2LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvbklkGjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RXhlY3V0aW9uIjTCuBgwCAEQKSIFdmFsdWUqI3VuYXV0aG9yaXplZCB0byBnZXQgYWdlbnQgZXhlY3V0aW9uEogBCgRsaXN0EkAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkxpc3RBZ2VudEV4ZWN1dGlvbnNSZXF1ZXN0GjguYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RXhlY3V0aW9uTGlzdCIE0LgYARKaAQoNbGlzdEJ5U2Vzc2lvbhJJLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5MaXN0QWdlbnRFeGVjdXRpb25zQnlTZXNzaW9uUmVxdWVzdBo4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvbkxpc3QiBNC4GAESugEKCXN1YnNjcmliZRI2LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvbklkGjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RXhlY3V0aW9uIj3CuBg5CAEQKSIFdmFsdWUqLHVuYXV0aG9yaXplZCB0byBzdWJzY3JpYmUgdG8gYWdlbnQgZXhlY3V0aW9uMAES8wEKFmdldEFydGlmYWN0RG93bmxvYWRVcmwSQy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuR2V0QXJ0aWZhY3REb3dubG9hZFVybFJlcXVlc3QaRC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuR2V0QXJ0aWZhY3REb3dubG9hZFVybFJlc3BvbnNlIk7CuBhKCAEQKSIMZXhlY3V0aW9uX2lkKjZ1bmF1dGhvcml6ZWQgdG8gZG93bmxvYWQgYXJ0aWZhY3QgZnJvbSBhZ2VudCBleGVjdXRpb24S6wEKEmdldEFydGlmYWN0Q29udGVudBI/LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5HZXRBcnRpZmFjdENvbnRlbnRSZXF1ZXN0GkAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkdldEFydGlmYWN0Q29udGVudFJlc3BvbnNlIlLCuBhOCAEQKSIMZXhlY3V0aW9uX2lkKjp1bmF1dGhvcml6ZWQgdG8gcmVhZCBhcnRpZmFjdCBjb250ZW50IGZyb20gYWdlbnQgZXhlY3V0aW9uEucBChdnZXRFeGVjdXRpb25Vc2FnZVJlcG9ydBJCLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5HZXRFeGVjdXRpb25Vc2FnZVJlcG9ydElucHV0GkMuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkdldEV4ZWN1dGlvblVzYWdlUmVwb3J0T3V0cHV0IkPCuBg/CAEQKSIMZXhlY3V0aW9uX2lkKit1bmF1dGhvcml6ZWQgdG8gdmlldyBleGVjdXRpb24gdXNhZ2UgcmVwb3J0Et0BChVnZXRTZXNzaW9uVXNhZ2VSZXBvcnQSQC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuR2V0U2Vzc2lvblVzYWdlUmVwb3J0SW5wdXQaQS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuR2V0U2Vzc2lvblVzYWdlUmVwb3J0T3V0cHV0Ij/CuBg7CAEQKiIKc2Vzc2lvbl9pZCopdW5hdXRob3JpemVkIHRvIHZpZXcgc2Vzc2lvbiB1c2FnZSByZXBvcnQS0QEKE2dldEFnZW50VXNhZ2VSZXBvcnQSPi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuR2V0QWdlbnRVc2FnZVJlcG9ydElucHV0Gj8uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkdldEFnZW50VXNhZ2VSZXBvcnRPdXRwdXQiOcK4GDUIARAeIgZvcmdfaWQqJ3VuYXV0aG9yaXplZCB0byB2aWV3IGFnZW50IHVzYWdlIHJlcG9ydBLSAQoRZ2V0T3JnVXNhZ2VSZXBvcnQSPC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuR2V0T3JnVXNhZ2VSZXBvcnRJbnB1dBo9LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5HZXRPcmdVc2FnZVJlcG9ydE91dHB1dCJAwrgYPAgBEB4iBm9yZ19pZCoudW5hdXRob3JpemVkIHRvIHZpZXcgb3JnYW5pemF0aW9uIHVzYWdlIHJlcG9ydBKfAQoTZ2V0RXhlY3V0aW9uU3VtbWFyeRJFLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5HZXRBZ2VudEV4ZWN1dGlvblN1bW1hcnlSZXF1ZXN0GjsuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RXhlY3V0aW9uU3VtbWFyeSIE0LgYARoEoP8rKWIGcHJvdG8z",[file_ai_stigmer_agentic_agentexecution_v1_api,file_ai_stigmer_agentic_agentexecution_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentExecutionQueryController=serviceDesc(file_ai_stigmer_agentic_agentexecution_v1_query,0);var GATE_SLOT_NAMES=["agent-execution-create:pre-side-effect-gate","agent-execution-recover:pre-side-effect-gate","agent-execution-submit-approval:gate","session-create:pre-side-effect-gate","org-create:post-persist","sandbox-acquisition:gate","identity-account-provision:post-persist","iam-policy-create:pre-side-effect-gate","org-create:pre-side-effect-gate"],DECLARED_GATE_SLOTS=new Set(GATE_SLOT_NAMES);function stepsForSlot(gateSteps,slot){return gateSteps.get(slot)??[]}var WORKFLOW_EXECUTION_ID_LABEL="stigmer.ai/workflow-execution-id",WORKFLOW_TASK_LABEL="stigmer.ai/workflow-task";function newRecordRunnerLineageLabelsStep(provider){return{name:"RecordRunnerLineageLabels",execute(ctx){let vouch=provider.vouchRunnerLineageLabels;if(vouch===void 0)return;let labels=metadataOf(ctx.newState)?.labels??{},workflowExecutionId=labels[WORKFLOW_EXECUTION_ID_LABEL]??"",taskName=labels[WORKFLOW_TASK_LABEL]??"";workflowExecutionId===""&&taskName===""||vouch.call(provider,ctx.callerIdentity,workflowExecutionId)&&(workflowExecutionId!==""&&recordServerStampedReservedLabels(ctx,WORKFLOW_EXECUTION_ID_LABEL),taskName!==""&&recordServerStampedReservedLabels(ctx,WORKFLOW_TASK_LABEL))}}}var import_node_path2=__toESM(require("node:path"),1);var import_module=require("module"),require2=(0,import_module.createRequire)("/"),_a,Worker,isMarkedAsUntransferable;try{_a=require2("worker_threads"),Worker=_a.Worker,isMarkedAsUntransferable=_a.isMarkedAsUntransferable}catch{}var u8=Uint8Array,u16=Uint16Array,i32=Int32Array,fleb=new u8([0,0,0,0,0,0,0,0,1,1,1,1,2,2,2,2,3,3,3,3,4,4,4,4,5,5,5,5,0,0,0,0]),fdeb=new u8([0,0,0,0,1,1,2,2,3,3,4,4,5,5,6,6,7,7,8,8,9,9,10,10,11,11,12,12,13,13,0,0]),clim=new u8([16,17,18,0,8,7,9,6,10,5,11,4,12,3,13,2,14,1,15]),freb=function(eb,start){for(var b7=new u16(31),i6=0;i6<31;++i6)b7[i6]=start+=1<<eb[i6-1];for(var r5=new i32(b7[30]),i6=1;i6<30;++i6)for(var j5=b7[i6];j5<b7[i6+1];++j5)r5[j5]=j5-b7[i6]<<5|i6;return{b:b7,r:r5}},_a=freb(fleb,2),fl=_a.b,revfl=_a.r;fl[28]=258,revfl[258]=28;var _b=freb(fdeb,0),fd=_b.b,revfd=_b.r,rev=new u16(32768);for(i=0;i<32768;++i)x=(i&43690)>>1|(i&21845)<<1,x=(x&52428)>>2|(x&13107)<<2,x=(x&61680)>>4|(x&3855)<<4,rev[i]=((x&65280)>>8|(x&255)<<8)>>1;var x,i,hMap=(function(cd,mb,r5){for(var s2=cd.length,i6=0,l3=new u16(mb);i6<s2;++i6)cd[i6]&&++l3[cd[i6]-1];var le=new u16(mb);for(i6=1;i6<mb;++i6)le[i6]=le[i6-1]+l3[i6-1]<<1;var co;if(r5){co=new u16(1<<mb);var rvb=15-mb;for(i6=0;i6<s2;++i6)if(cd[i6])for(var sv=i6<<4|cd[i6],r_1=mb-cd[i6],v=le[cd[i6]-1]++<<r_1,m3=v|(1<<r_1)-1;v<=m3;++v)co[rev[v]>>rvb]=sv}else for(co=new u16(s2),i6=0;i6<s2;++i6)cd[i6]&&(co[i6]=rev[le[cd[i6]-1]++]>>15-cd[i6]);return co}),flt=new u8(288);for(i=0;i<144;++i)flt[i]=8;var i;for(i=144;i<256;++i)flt[i]=9;var i;for(i=256;i<280;++i)flt[i]=7;var i;for(i=280;i<288;++i)flt[i]=8;var i,fdt=new u8(32);for(i=0;i<32;++i)fdt[i]=5;var i,flm=hMap(flt,9,0),flrm=hMap(flt,9,1),fdm=hMap(fdt,5,0),fdrm=hMap(fdt,5,1),max=function(a5){for(var m3=a5[0],i6=1;i6<a5.length;++i6)a5[i6]>m3&&(m3=a5[i6]);return m3},bits=function(d5,p3,m3){var o3=p3/8|0;return(d5[o3]|d5[o3+1]<<8)>>(p3&7)&m3},bits16=function(d5,p3){var o3=p3/8|0;return(d5[o3]|d5[o3+1]<<8|d5[o3+2]<<16)>>(p3&7)},shft=function(p3){return(p3+7)/8|0},slc=function(v,s2,e6){return(s2==null||s2<0)&&(s2=0),(e6==null||e6>v.length)&&(e6=v.length),new u8(v.subarray(s2,e6))};var ec=["unexpected EOF","invalid block type","invalid length/literal","invalid distance","stream finished","no stream handler",,"no callback","invalid UTF-8 data","extra field too long","date not in range 1980-2099","filename too long","stream finishing","invalid zip data"],err=function(ind,msg,nt){var e6=new Error(msg||ec[ind]);if(e6.code=ind,Error.captureStackTrace&&Error.captureStackTrace(e6,err),!nt)throw e6;return e6},inflt=function(dat,st,buf2,dict){var sl=dat.length,dl=dict?dict.length:0;if(!sl||st.f&&!st.l)return buf2||new u8(0);var noBuf=!buf2,resize=noBuf||st.i!=2,noSt=st.i;noBuf&&(buf2=new u8(sl*3));var cbuf=function(l4){var bl=buf2.length;if(l4>bl){var nbuf=new u8(Math.max(bl*2,l4));nbuf.set(buf2),buf2=nbuf}},final=st.f||0,pos=st.p||0,bt=st.b||0,lm=st.l,dm=st.d,lbt=st.m,dbt=st.n,tbts=sl*8;do{if(!lm){final=bits(dat,pos,1);var type2=bits(dat,pos+1,3);if(pos+=3,type2)if(type2==1)lm=flrm,dm=fdrm,lbt=9,dbt=5;else if(type2==2){var hLit=bits(dat,pos,31)+257,hcLen=bits(dat,pos+10,15)+4,tl=hLit+bits(dat,pos+5,31)+1;pos+=14;for(var ldt=new u8(tl),clt=new u8(19),i6=0;i6<hcLen;++i6)clt[clim[i6]]=bits(dat,pos+i6*3,7);pos+=hcLen*3;for(var clb=max(clt),clbmsk=(1<<clb)-1,clm=hMap(clt,clb,1),i6=0;i6<tl;){var r5=clm[bits(dat,pos,clbmsk)];pos+=r5&15;var s2=r5>>4;if(s2<16)ldt[i6++]=s2;else{var c5=0,n3=0;for(s2==16?(n3=3+bits(dat,pos,3),pos+=2,c5=ldt[i6-1]):s2==17?(n3=3+bits(dat,pos,7),pos+=3):s2==18&&(n3=11+bits(dat,pos,127),pos+=7);n3--;)ldt[i6++]=c5}}var lt=ldt.subarray(0,hLit),dt=ldt.subarray(hLit);lbt=max(lt),dbt=max(dt),lm=hMap(lt,lbt,1),dm=hMap(dt,dbt,1)}else err(1);else{var s2=shft(pos)+4,l3=dat[s2-4]|dat[s2-3]<<8,t=s2+l3;if(t>sl){noSt&&err(0);break}resize&&cbuf(bt+l3),buf2.set(dat.subarray(s2,t),bt),st.b=bt+=l3,st.p=pos=t*8,st.f=final;continue}if(pos>tbts){noSt&&err(0);break}}resize&&cbuf(bt+131072);for(var lms=(1<<lbt)-1,dms=(1<<dbt)-1,lpos=pos;;lpos=pos){var c5=lm[bits16(dat,pos)&lms],sym=c5>>4;if(pos+=c5&15,pos>tbts){noSt&&err(0);break}if(c5||err(2),sym<256)buf2[bt++]=sym;else if(sym==256){lpos=pos,lm=null;break}else{var add2=sym-254;if(sym>264){var i6=sym-257,b7=fleb[i6];add2=bits(dat,pos,(1<<b7)-1)+fl[i6],pos+=b7}var d5=dm[bits16(dat,pos)&dms],dsym=d5>>4;d5||err(3),pos+=d5&15;var dt=fd[dsym];if(dsym>3){var b7=fdeb[dsym];dt+=bits16(dat,pos)&(1<<b7)-1,pos+=b7}if(pos>tbts){noSt&&err(0);break}resize&&cbuf(bt+131072);var end=bt+add2;if(bt<dt){var shift=dl-dt,dend=Math.min(dt,end);for(shift+bt<0&&err(3);bt<dend;++bt)buf2[bt]=dict[shift+bt]}for(;bt<end;++bt)buf2[bt]=buf2[bt-dt]}}st.l=lm,st.p=lpos,st.b=bt,st.f=final,lm&&(final=1,st.m=lbt,st.d=dm,st.n=dbt)}while(!final);return bt!=buf2.length&&noBuf?slc(buf2,0,bt):buf2.subarray(0,bt)},wbits=function(d5,p3,v){v<<=p3&7;var o3=p3/8|0;d5[o3]|=v,d5[o3+1]|=v>>8},wbits16=function(d5,p3,v){v<<=p3&7;var o3=p3/8|0;d5[o3]|=v,d5[o3+1]|=v>>8,d5[o3+2]|=v>>16},hTree=function(d5,mb){for(var t=[],i6=0;i6<d5.length;++i6)d5[i6]&&t.push({s:i6,f:d5[i6]});var s2=t.length,t22=t.slice();if(!s2)return{t:et,l:0};if(s2==1){var v=new u8(t[0].s+1);return v[t[0].s]=1,{t:v,l:1}}t.sort(function(a5,b7){return a5.f-b7.f}),t.push({s:-1,f:25001});var l3=t[0],r5=t[1],i0=0,i1=1,i22=2;for(t[0]={s:-1,f:l3.f+r5.f,l:l3,r:r5};i1!=s2-1;)l3=t[t[i0].f<t[i22].f?i0++:i22++],r5=t[i0!=i1&&t[i0].f<t[i22].f?i0++:i22++],t[i1++]={s:-1,f:l3.f+r5.f,l:l3,r:r5};for(var maxSym=t22[0].s,i6=1;i6<s2;++i6)t22[i6].s>maxSym&&(maxSym=t22[i6].s);var tr=new u16(maxSym+1),mbt=ln(t[i1-1],tr,0);if(mbt>mb){var i6=0,dt=0,lft=mbt-mb,cst=1<<lft;for(t22.sort(function(a5,b7){return tr[b7.s]-tr[a5.s]||a5.f-b7.f});i6<s2;++i6){var i2_1=t22[i6].s;if(tr[i2_1]>mb)dt+=cst-(1<<mbt-tr[i2_1]),tr[i2_1]=mb;else break}for(dt>>=lft;dt>0;){var i2_2=t22[i6].s;tr[i2_2]<mb?dt-=1<<mb-tr[i2_2]++-1:++i6}for(;i6>=0&&dt;--i6){var i2_3=t22[i6].s;tr[i2_3]==mb&&(--tr[i2_3],++dt)}mbt=mb}return{t:new u8(tr),l:mbt}},ln=function(n3,l3,d5){return n3.s==-1?Math.max(ln(n3.l,l3,d5+1),ln(n3.r,l3,d5+1)):l3[n3.s]=d5},lc=function(c5){for(var s2=c5.length;s2&&!c5[--s2];);for(var cl=new u16(++s2),cli=0,cln=c5[0],cls=1,w=function(v){cl[cli++]=v},i6=1;i6<=s2;++i6)if(c5[i6]==cln&&i6!=s2)++cls;else{if(!cln&&cls>2){for(;cls>138;cls-=138)w(32754);cls>2&&(w(cls>10?cls-11<<5|28690:cls-3<<5|12305),cls=0)}else if(cls>3){for(w(cln),--cls;cls>6;cls-=6)w(8304);cls>2&&(w(cls-3<<5|8208),cls=0)}for(;cls--;)w(cln);cls=1,cln=c5[i6]}return{c:cl.subarray(0,cli),n:s2}},clen=function(cf,cl){for(var l3=0,i6=0;i6<cl.length;++i6)l3+=cf[i6]*cl[i6];return l3},wfblk=function(out,pos,dat){var s2=dat.length,o3=shft(pos+2);out[o3]=s2&255,out[o3+1]=s2>>8,out[o3+2]=out[o3]^255,out[o3+3]=out[o3+1]^255;for(var i6=0;i6<s2;++i6)out[o3+i6+4]=dat[i6];return(o3+4+s2)*8},wblk=function(dat,out,final,syms,lf,df,eb,li,bs,bl,p3){wbits(out,p3++,final),++lf[256];for(var _a3=hTree(lf,15),dlt=_a3.t,mlb=_a3.l,_b2=hTree(df,15),ddt=_b2.t,mdb=_b2.l,_c5=lc(dlt),lclt=_c5.c,nlc=_c5.n,_d=lc(ddt),lcdt=_d.c,ndc=_d.n,lcfreq=new u16(19),i6=0;i6<lclt.length;++i6)++lcfreq[lclt[i6]&31];for(var i6=0;i6<lcdt.length;++i6)++lcfreq[lcdt[i6]&31];for(var _e5=hTree(lcfreq,7),lct=_e5.t,mlcb=_e5.l,nlcc=19;nlcc>4&&!lct[clim[nlcc-1]];--nlcc);var flen=bl+5<<3,ftlen=clen(lf,flt)+clen(df,fdt)+eb,dtlen=clen(lf,dlt)+clen(df,ddt)+eb+14+3*nlcc+clen(lcfreq,lct)+2*lcfreq[16]+3*lcfreq[17]+7*lcfreq[18];if(bs>=0&&flen<=ftlen&&flen<=dtlen)return wfblk(out,p3,dat.subarray(bs,bs+bl));var lm,ll,dm,dl;if(wbits(out,p3,1+(dtlen<ftlen)),p3+=2,dtlen<ftlen){lm=hMap(dlt,mlb,0),ll=dlt,dm=hMap(ddt,mdb,0),dl=ddt;var llm=hMap(lct,mlcb,0);wbits(out,p3,nlc-257),wbits(out,p3+5,ndc-1),wbits(out,p3+10,nlcc-4),p3+=14;for(var i6=0;i6<nlcc;++i6)wbits(out,p3+3*i6,lct[clim[i6]]);p3+=3*nlcc;for(var lcts=[lclt,lcdt],it=0;it<2;++it)for(var clct=lcts[it],i6=0;i6<clct.length;++i6){var len=clct[i6]&31;wbits(out,p3,llm[len]),p3+=lct[len],len>15&&(wbits(out,p3,clct[i6]>>5&127),p3+=clct[i6]>>12)}}else lm=flm,ll=flt,dm=fdm,dl=fdt;for(var i6=0;i6<li;++i6){var sym=syms[i6];if(sym>255){var len=sym>>18&31;wbits16(out,p3,lm[len+257]),p3+=ll[len+257],len>7&&(wbits(out,p3,sym>>23&31),p3+=fleb[len]);var dst=sym&31;wbits16(out,p3,dm[dst]),p3+=dl[dst],dst>3&&(wbits16(out,p3,sym>>5&8191),p3+=fdeb[dst])}else wbits16(out,p3,lm[sym]),p3+=ll[sym]}return wbits16(out,p3,lm[256]),p3+ll[256]},deo=new i32([65540,131080,131088,131104,262176,1048704,1048832,2114560,2117632]),et=new u8(0),dflt=function(dat,lvl,plvl,pre,post,st){var s2=st.z||dat.length,o3=new u8(pre+s2+5*(1+Math.ceil(s2/7e3))+post),w=o3.subarray(pre,o3.length-post),lst=st.l,pos=(st.r||0)&7;if(lvl){pos&&(w[0]=st.r>>3);for(var opt=deo[lvl-1],n3=opt>>13,c5=opt&8191,msk_1=(1<<plvl)-1,prev=st.p||new u16(32768),head=st.h||new u16(msk_1+1),bs1_1=Math.ceil(plvl/3),bs2_1=2*bs1_1,hsh=function(i7){return(dat[i7]^dat[i7+1]<<bs1_1^dat[i7+2]<<bs2_1)&msk_1},syms=new i32(25e3),lf=new u16(288),df=new u16(32),lc_1=0,eb=0,i6=st.i||0,li=0,wi=st.w||0,bs=0;i6+2<s2;++i6){var hv=hsh(i6),imod=i6&32767,pimod=head[hv];if(prev[imod]=pimod,head[hv]=imod,wi<=i6){var rem=s2-i6;if((lc_1>7e3||li>24576)&&(rem>423||!lst)){pos=wblk(dat,w,0,syms,lf,df,eb,li,bs,i6-bs,pos),li=lc_1=eb=0,bs=i6;for(var j5=0;j5<286;++j5)lf[j5]=0;for(var j5=0;j5<30;++j5)df[j5]=0}var l3=2,d5=0,ch_1=c5,dif=imod-pimod&32767;if(rem>2&&hv==hsh(i6-dif))for(var maxn=Math.min(n3,rem)-1,maxd=Math.min(32767,i6),ml=Math.min(258,rem);dif<=maxd&&--ch_1&&imod!=pimod;){if(dat[i6+l3]==dat[i6+l3-dif]){for(var nl=0;nl<ml&&dat[i6+nl]==dat[i6+nl-dif];++nl);if(nl>l3){if(l3=nl,d5=dif,nl>maxn)break;for(var mmd=Math.min(dif,nl-2),md=0,j5=0;j5<mmd;++j5){var ti=i6-dif+j5&32767,pti=prev[ti],cd=ti-pti&32767;cd>md&&(md=cd,pimod=ti)}}}imod=pimod,pimod=prev[imod],dif+=imod-pimod&32767}if(d5){syms[li++]=268435456|revfl[l3]<<18|revfd[d5];var lin=revfl[l3]&31,din=revfd[d5]&31;eb+=fleb[lin]+fdeb[din],++lf[257+lin],++df[din],wi=i6+l3,++lc_1}else syms[li++]=dat[i6],++lf[dat[i6]]}}for(i6=Math.max(i6,wi);i6<s2;++i6)syms[li++]=dat[i6],++lf[dat[i6]];pos=wblk(dat,w,lst,syms,lf,df,eb,li,bs,i6-bs,pos),lst||(st.r=pos&7|w[pos/8|0]<<3,pos-=7,st.h=head,st.p=prev,st.i=i6,st.w=wi)}else{for(var i6=st.w||0;i6<s2+lst;i6+=65535){var e6=i6+65535;e6>=s2&&(w[pos/8|0]=lst,e6=s2),pos=wfblk(w,pos+1,dat.subarray(i6,e6))}st.i=s2}return slc(o3,0,pre+shft(pos)+post)},crct=(function(){for(var t=new Int32Array(256),i6=0;i6<256;++i6){for(var c5=i6,k5=9;--k5;)c5=(c5&1&&-306674912)^c5>>>1;t[i6]=c5}return t})(),crc=function(){var c5=-1;return{p:function(d5){for(var cr=c5,i6=0;i6<d5.length;++i6)cr=crct[cr&255^d5[i6]]^cr>>>8;c5=cr},d:function(){return~c5}}};var dopt=function(dat,opt,pre,post,st){if(!st&&(st={l:1},opt.dictionary)){var dict=opt.dictionary.subarray(-32768),newDat=new u8(dict.length+dat.length);newDat.set(dict),newDat.set(dat,dict.length),dat=newDat,st.w=dict.length}return dflt(dat,opt.level==null?6:opt.level,opt.mem==null?st.l?Math.ceil(Math.max(8,Math.min(13,Math.log(dat.length)))*1.5):20:12+opt.mem,pre,post,st)},mrg=function(a5,b7){var o3={};for(var k5 in a5)o3[k5]=a5[k5];for(var k5 in b7)o3[k5]=b7[k5];return o3};var b2=function(d5,b7){return d5[b7]|d5[b7+1]<<8},b4=function(d5,b7){return(d5[b7]|d5[b7+1]<<8|d5[b7+2]<<16|d5[b7+3]<<24)>>>0},b8=function(d5,b7){return b4(d5,b7)+b4(d5,b7+4)*4294967296},wbytes=function(d5,b7,v){for(;v;++b7)d5[b7]=v,v>>>=8};function deflateSync(data,opts){return dopt(data,opts||{},0,0)}function inflateSync(data,opts){return inflt(data,{i:2},opts&&opts.out,opts&&opts.dictionary)}var fltn=function(d5,p3,t,o3){for(var k5 in d5){var val=d5[k5],n3=p3+k5,op2=o3;Array.isArray(val)&&(op2=mrg(o3,val[1]),val=val[0]),ArrayBuffer.isView(val)?t[n3]=[val,op2]:(t[n3+="/"]=[new u8(0),op2],fltn(val,n3,t,o3))}},te=typeof TextEncoder<"u"&&new TextEncoder,td=typeof TextDecoder<"u"&&new TextDecoder,tds=0;try{td.decode(et,{stream:!0}),tds=1}catch{}var dutf8=function(d5){for(var r5="",i6=0;;){var c5=d5[i6++],eb=(c5>127)+(c5>223)+(c5>239);if(i6+eb>d5.length)return{s:r5,r:slc(d5,i6-1)};eb?eb==3?(c5=((c5&15)<<18|(d5[i6++]&63)<<12|(d5[i6++]&63)<<6|d5[i6++]&63)-65536,r5+=String.fromCharCode(55296|c5>>10,56320|c5&1023)):eb&1?r5+=String.fromCharCode((c5&31)<<6|d5[i6++]&63):r5+=String.fromCharCode((c5&15)<<12|(d5[i6++]&63)<<6|d5[i6++]&63):r5+=String.fromCharCode(c5)}};function strToU8(str2,latin1){if(latin1){for(var ar_1=new u8(str2.length),i6=0;i6<str2.length;++i6)ar_1[i6]=str2.charCodeAt(i6);return ar_1}if(te)return te.encode(str2);for(var l3=str2.length,ar=new u8(str2.length+(str2.length>>1)),ai=0,w=function(v){ar[ai++]=v},i6=0;i6<l3;++i6){if(ai+5>ar.length){var n3=new u8(ai+8+(l3-i6<<1));n3.set(ar),ar=n3}var c5=str2.charCodeAt(i6);c5<128||latin1?w(c5):c5<2048?(w(192|c5>>6),w(128|c5&63)):c5>55295&&c5<57344?(c5=65536+(c5&1047552)|str2.charCodeAt(++i6)&1023,w(240|c5>>18),w(128|c5>>12&63),w(128|c5>>6&63),w(128|c5&63)):(w(224|c5>>12),w(128|c5>>6&63),w(128|c5&63))}return slc(ar,0,ai)}function strFromU8(dat,latin1){if(latin1){for(var r5="",i6=0;i6<dat.length;i6+=16384)r5+=String.fromCharCode.apply(null,dat.subarray(i6,i6+16384));return r5}else{if(td)return td.decode(dat);var _a3=dutf8(dat),s2=_a3.s,r5=_a3.r;return r5.length&&err(8),s2}}var slzh=function(d5,b7){return b7+30+b2(d5,b7+26)+b2(d5,b7+28)},zh=function(d5,b7,z){var fnl=b2(d5,b7+28),efl=b2(d5,b7+30),fn=strFromU8(d5.subarray(b7+46,b7+46+fnl),!(b2(d5,b7+8)&2048)),es=b7+46+fnl,_a3=z64hs(d5,es,efl,z,b4(d5,b7+20),b4(d5,b7+24),b4(d5,b7+42)),sc=_a3[0],su=_a3[1],off=_a3[2];return[b2(d5,b7+10),sc,su,fn,es+efl+b2(d5,b7+32),off]},z64hs=function(d5,b7,l3,z,sc,su,off){var nsc=sc==4294967295,nsu=su==4294967295,noff=off==4294967295,e6=b7+l3,nf=nsc+nsu+noff;if(z&&nf){for(;b7+4<e6;b7+=4+b2(d5,b7+2))if(b2(d5,b7)==1)return[nsc?b8(d5,b7+4+8*nsu):sc,nsu?b8(d5,b7+4):su,noff?b8(d5,b7+4+8*(nsu+nsc)):off,1];z<2&&err(13)}return[sc,su,off,0]},exfl=function(ex){var le=0;if(ex)for(var k5 in ex){var l3=ex[k5].length;l3>65535&&err(9),le+=l3+4}return le},wzh=function(d5,b7,f5,fn,u,c5,ce,co){var fl2=fn.length,ex=f5.extra,col=co&&co.length,exl=exfl(ex);wbytes(d5,b7,ce!=null?33639248:67324752),b7+=4,ce!=null&&(d5[b7++]=20,d5[b7++]=f5.os),d5[b7]=20,b7+=2,d5[b7++]=f5.flag<<1|(c5<0&&8),d5[b7++]=u&&8,d5[b7++]=f5.compression&255,d5[b7++]=f5.compression>>8;var dt=new Date(f5.mtime==null?Date.now():f5.mtime),y=dt.getFullYear()-1980;if((y<0||y>119)&&err(10),wbytes(d5,b7,y<<25|dt.getMonth()+1<<21|dt.getDate()<<16|dt.getHours()<<11|dt.getMinutes()<<5|dt.getSeconds()>>1),b7+=4,c5!=-1&&(wbytes(d5,b7,f5.crc),wbytes(d5,b7+4,c5<0?-c5-2:c5),wbytes(d5,b7+8,f5.size)),wbytes(d5,b7+12,fl2),wbytes(d5,b7+14,exl),b7+=16,ce!=null&&(wbytes(d5,b7,col),wbytes(d5,b7+6,f5.attrs),wbytes(d5,b7+10,ce),b7+=14),d5.set(fn,b7),b7+=fl2,exl)for(var k5 in ex){var exf=ex[k5],l3=exf.length;wbytes(d5,b7,+k5),wbytes(d5,b7+2,l3),d5.set(exf,b7+4),b7+=4+l3}return col&&(d5.set(co,b7),b7+=col),b7},wzf=function(o3,b7,c5,d5,e6){wbytes(o3,b7,101010256),wbytes(o3,b7+8,c5),wbytes(o3,b7+10,c5),wbytes(o3,b7+12,d5),wbytes(o3,b7+16,e6)};function zipSync(data,opts){opts||(opts={});var r5={},files=[];fltn(data,"",r5,opts);var o3=0,tot=0;for(var fn in r5){var _a3=r5[fn],file=_a3[0],p3=_a3[1],compression=p3.level==0?0:8,f5=strToU8(fn),s2=f5.length,com=p3.comment,m3=com&&strToU8(com),ms=m3&&m3.length,exl=exfl(p3.extra);s2>65535&&err(11);var d5=compression?deflateSync(file,p3):file,l3=d5.length,c5=crc();c5.p(file),files.push(mrg(p3,{size:file.length,crc:c5.d(),c:d5,f:f5,m:m3,u:s2!=fn.length||m3&&com.length!=ms,o:o3,compression})),o3+=30+s2+exl+l3,tot+=76+2*(s2+exl)+(ms||0)+l3}for(var out=new u8(tot+22),oe=o3,cdl=tot-o3,i6=0;i6<files.length;++i6){var f5=files[i6];wzh(out,f5.o,f5,f5.f,f5.u,f5.c.length);var badd=30+f5.f.length+exfl(f5.extra);out.set(f5.c,f5.o+badd),wzh(out,o3,f5,f5.f,f5.u,f5.c.length,f5.o,f5.m),o3+=16+badd+(f5.m?f5.m.length:0)}return wzf(out,o3,files.length,cdl,oe),out}function unzipSync(data,opts){for(var files={},e6=data.length-22;b4(data,e6)!=101010256;--e6)(!e6||data.length-e6>65558)&&err(13);var c5=b2(data,e6+8);if(!c5)return{};var o3=b4(data,e6+16),z=b4(data,e6-20)==117853008;if(z){var ze=b4(data,e6-12);z=b4(data,ze)==101075792,z&&(c5=b4(data,ze+32),o3=b4(data,ze+48))}for(var fltr=opts&&opts.filter,i6=0;i6<c5;++i6){var _a3=zh(data,o3,z),c_2=_a3[0],sc=_a3[1],su=_a3[2],fn=_a3[3],no=_a3[4],off=_a3[5],b7=slzh(data,off);o3=no,(!fltr||fltr({name:fn,size:sc,originalSize:su,compression:c_2}))&&(c_2?c_2==8?files[fn]=inflateSync(data.subarray(b7,b7+sc),{out:new u8(su)}):err(14,"unknown compression type "+c_2):files[fn]=slc(data,b7,b7+sc))}return files}var import_node_crypto4=require("node:crypto");function sha256HexBytes(b7){return(0,import_node_crypto4.createHash)("sha256").update(b7).digest("hex")}var CAS_BLOB_KEY_PATTERN=/^artifacts\/[^/]+\/filereview\/cas\/blobs\/([0-9a-f]{64})$/,CAS_BLOB_CONTENT_MISMATCH_REASON="artifact content failed integrity verification: the stored bytes do not match the content address in the storage key";function casBlobContentMismatch(storageKey,content){let m3=CAS_BLOB_KEY_PATTERN.exec(storageKey);return m3===null||sha256HexBytes(content)===m3[1]?"":CAS_BLOB_CONTENT_MISMATCH_REASON}var DEFAULT_MAX_ARTIFACT_CONTENT_BYTES=512*1024,DEFAULT_ARTIFACT_URL_EXPIRATION_MS=10080*60*1e3,KNOWN_CONTENT_TYPES=new Map([[".yaml","text/yaml"],[".yml","text/yaml"],[".json","application/json"],[".md","text/markdown"],[".txt","text/plain"],[".csv","text/csv"],[".xml","application/xml"],[".html","text/html"],[".zip","application/zip"],[".tar","application/x-tar"],[".gz","application/gzip"],[".py","text/x-python"],[".go","text/x-go"],[".js","text/javascript"],[".ts","text/typescript"],[".sh","text/x-shellscript"],[".toml","application/toml"]]),OS_MIME_FALLBACK=new Map([[".avif","image/avif"],[".css","text/css; charset=utf-8"],[".gif","image/gif"],[".htm","text/html; charset=utf-8"],[".html","text/html; charset=utf-8"],[".jpeg","image/jpeg"],[".jpg","image/jpeg"],[".js","text/javascript; charset=utf-8"],[".json","application/json"],[".mjs","text/javascript; charset=utf-8"],[".pdf","application/pdf"],[".png","image/png"],[".svg","image/svg+xml"],[".wasm","application/wasm"],[".webp","image/webp"],[".xml","text/xml; charset=utf-8"]]);async function uploadAttachment(deps,req){if(req.filename==="")throw invalidArgumentError("filename is required");if(validateAttachmentFilename(req.filename),req.content.length===0)throw invalidArgumentError("content is required");let uploadId=ulid(),contentType=req.contentType;contentType===""&&(contentType=osMimeTypeByExtension(req.filename));let storageKey=`attachments/${uploadId}/${req.filename}`;deps.logger.info("Uploading attachment to artifact storage",{storageKey,filename:req.filename,contentType,sizeBytes:req.content.length});try{await deps.artifactStorage.upload(storageKey,req.content,contentType)}catch(error2){throw internalError(error2,"failed to upload attachment")}return deps.logger.info("Successfully uploaded attachment to storage",{storageKey,filename:req.filename,sizeBytes:req.content.length}),create2(UploadAttachmentResponseSchema,{storageKey})}function validateAttachmentFilename(name){if(name.includes("/")||name.includes("\\"))throw invalidArgumentError(`filename ${JSON.stringify(name)} must not contain path separators; send a bare filename such as "report.pdf"`);if(name.includes("\0"))throw invalidArgumentError("filename must not contain NUL bytes");if(name==="."||name==="..")throw invalidArgumentError(`filename ${JSON.stringify(name)} must be a bare filename, not a traversal segment`)}async function getArtifactContent(deps,req,identity2){if(req.executionId==="")throw invalidArgumentError("execution_id is required");if(req.storageKey==="")throw invalidArgumentError("storage_key is required");await authorizeDirect(AgentExecutionQueryController.method.getArtifactContent,deps.authorizer,identity2,req);let storageKey=import_node_path2.default.posix.normalize(req.storageKey),expectedPrefix=`artifacts/${req.executionId}/`;if(!storageKey.startsWith(expectedPrefix))throw deps.logger.warn("Storage key does not belong to execution - potential path traversal attempt",{executionId:req.executionId,storageKey:req.storageKey,expectedPrefix}),invalidArgumentError("storage_key does not belong to this execution");try{await deps.store.getResource(ApiResourceKind.agent_execution,req.executionId,AgentExecutionSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?new ConnectError(`execution not found: ${req.executionId}`,Code.NotFound):internalError(error2,"failed to load agent execution")}let maxBytes=Number(req.maxBytes);maxBytes<=0&&(maxBytes=DEFAULT_MAX_ARTIFACT_CONTENT_BYTES);let data;try{data=await deps.artifactStorage.download(storageKey)}catch(error2){throw internalError(error2,"failed to read artifact content")}if(req.entryPath===""&&data.length<=maxBytes){let reason=casBlobContentMismatch(storageKey,data);if(reason!=="")throw deps.logger.error("CAS blob failed content-address integrity check",{executionId:req.executionId,storageKey:req.storageKey}),new ConnectError(reason,Code.DataLoss)}if(req.entryPath!==""){let entryData=extractZipEntry(data,req.entryPath);if(entryData===void 0)throw deps.logger.warn("Failed to extract entry from ZIP artifact",{executionId:req.executionId,storageKey:req.storageKey,entryPath:req.entryPath}),new ConnectError(`entry ${JSON.stringify(req.entryPath)} not found in archive`,Code.NotFound);data=entryData}let totalSize=data.length,truncated=!1;totalSize>maxBytes&&(data=data.slice(0,maxBytes),truncated=!0);let contentKey=req.entryPath!==""?req.entryPath:storageKey,contentType=detectContentType(contentKey);return deps.logger.info("Successfully read artifact content",{executionId:req.executionId,storageKey:req.storageKey,entryPath:req.entryPath,totalSizeBytes:totalSize,returnedBytes:data.length,truncated,contentType}),create2(GetArtifactContentResponseSchema,{content:data,contentType,totalSizeBytes:BigInt(totalSize),truncated})}function extractZipEntry(zipData,entryPath){try{return unzipSync(zipData,{filter:file=>file.name===entryPath})[entryPath]}catch{return}}function detectContentType(storageKey){let ext=fileExtension(storageKey);return ext===""?"application/octet-stream":KNOWN_CONTENT_TYPES.get(ext)??OS_MIME_FALLBACK.get(ext)??"application/octet-stream"}function osMimeTypeByExtension(filename){let ext=fileExtension(filename);return ext===""?"application/octet-stream":OS_MIME_FALLBACK.get(ext)??"application/octet-stream"}function fileExtension(name){let dot=name.lastIndexOf("."),slash=Math.max(name.lastIndexOf("/"),name.lastIndexOf("\\"));return dot<=slash||dot===-1?"":name.slice(dot).toLowerCase()}async function getArtifactDownloadUrl(deps,req,identity2){if(req.executionId==="")throw invalidArgumentError("execution_id is required");if(req.storageKey==="")throw invalidArgumentError("storage_key is required");await authorizeDirect(AgentExecutionQueryController.method.getArtifactDownloadUrl,deps.authorizer,identity2,req);let execution;try{execution=await deps.store.getResource(ApiResourceKind.agent_execution,req.executionId,AgentExecutionSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?new ConnectError(`execution not found: ${req.executionId}`,Code.NotFound):internalError(error2,"failed to load agent execution")}let storageKey=import_node_path2.default.posix.normalize(req.storageKey),expectedPrefix=`artifacts/${req.executionId}/`;if(!storageKey.startsWith(expectedPrefix)&&!isSpecAttachmentKey(execution,storageKey))throw deps.logger.warn("Storage key does not belong to execution - potential path traversal attempt",{executionId:req.executionId,storageKey:req.storageKey,expectedPrefix}),invalidArgumentError("storage_key does not belong to this execution");let expiresInMs=DEFAULT_ARTIFACT_URL_EXPIRATION_MS,expiresAt=new Date(Date.now()+expiresInMs),downloadFilename=req.asAttachment?storageKey.split("/").pop()??"":"",downloadUrl;try{downloadUrl=await deps.artifactStorage.getSignedUrl(storageKey,expiresInMs,downloadFilename)}catch(error2){throw internalError(error2,"failed to generate download URL")}return deps.logger.info("Successfully generated presigned download URL for artifact",{executionId:req.executionId,storageKey:req.storageKey,expiresAt:expiresAt.toISOString()}),create2(GetArtifactDownloadUrlResponseSchema,{downloadUrl,expiresAt:expiresAt.toISOString().replace(/\.\d{3}Z$/,"Z")})}function isSpecAttachmentKey(execution,storageKey){return(execution.spec?.attachments??[]).some(attachment=>attachment.storageKey===storageKey)}var ENGINE_UNAVAILABLE_MESSAGE="The execution engine is temporarily unavailable. Please try again shortly.";function runAgentDeniedMessage(agentId){return`unauthorized to run agent '${agentId}'`}function runAgentInstanceDeniedMessage(agentInstanceId){return`unauthorized to run agent instance '${agentInstanceId}'`}function addExecutionToSessionDeniedMessage(sessionId){return`unauthorized to add an execution to session '${sessionId}'`}var EngineDispatchError=class extends Error{constructor(message6){super(message6),this.name="EngineDispatchError"}},EngineWorkflowNotFoundError=class extends Error{constructor(executionId){super(`workflow not found for execution ${executionId}`),this.name="EngineWorkflowNotFoundError"}},ENGINE_DISCONNECTED=Object.freeze({connected:!1});function newEnsureEngineAvailableStep(engineState){return{name:"EnsureEngineAvailable",execute(_ctx){if(!engineState().connected)throw unavailableError(ENGINE_UNAVAILABLE_MESSAGE)}}}async function notifyStatusObservers(deps,execution,oldPhase,newPhase){if(oldPhase!==newPhase)for(let observer of deps.statusObservers)try{await observer({execution,oldPhase,newPhase})}catch(error2){deps.logger.warn("status observer failed (extension bug, ignored)",{executionId:execution.metadata?.id??"",oldPhase,newPhase,error:error2 instanceof Error?error2.message:String(error2)})}}async function applyResponseDecorators(decorators,logger2,execution,response){let decorated=response;for(let decorator of decorators){let candidate=clone(UpdateStatusResponseSchema,decorated);try{await decorator(execution,candidate),decorated=candidate}catch(error2){logger2.warn("response decorator failed (extension bug, ignored)",{executionId:execution.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}return decorated}var DEFAULT_INSTANCE_ID_KEY2="default_instance_id",CREATED_SESSION_ID_KEY="created_session_id",AUTO_CREATED_SESSION_SUBJECT="Auto-created session";function newCreateDefaultInstanceIfNeededStep(deps){return{name:"CreateDefaultInstanceIfNeeded",async execute(ctx){let execution=ctx.newState,sessionId=execution.spec?.sessionId??"",agentId=execution.spec?.agentId??"";if(sessionId!==""){deps.logger.debug("Session ID already provided, skipping default instance check",{sessionId});return}let specInstanceId=execution.spec?.sessionSpec?.agentInstanceId??"";if(specInstanceId!==""){deps.logger.debug("session_spec carries an explicit agent instance, skipping default instance check",{agentInstanceId:specInstanceId});return}if(agentId===""){deps.logger.debug("No agent named, the built-in assistant runs; skipping default instance check");return}let agent;try{agent=await deps.agentLoader().get(agentId)}catch(error2){throw error2 instanceof ConnectError?rethrownStatusError(error2):error2}let defaultInstanceId=agent.status?.defaultInstanceId??"";if(defaultInstanceId!==""){deps.logger.debug("Agent already has default instance",{defaultInstanceId,agentId}),ctx.set(DEFAULT_INSTANCE_ID_KEY2,defaultInstanceId);return}deps.logger.info("Agent missing default instance, creating one",{agentId});let metadata=agent.metadata;if(metadata===void 0)throw internalError(new Error(`agent ${agentId} has no metadata`),"internal server error");let createdId;try{createdId=(await deps.agentInstanceCreator().createAsCaller(buildDefaultInstanceRequest(metadata),ctx.callerIdentity)).metadata?.id??""}catch(error2){throw error2 instanceof ConnectError?goWrappedStatusError("failed to create default instance",error2):new Error(`failed to create default instance: ${error2 instanceof Error?error2.message:String(error2)}`)}let status=agent.status??=create2(AgentStatusSchema);status.defaultInstanceId=createdId;try{await deps.store.saveResource(ApiResourceKind.agent,agentId,AgentSchema,agent)}catch(error2){throw new Error(`failed to update agent with default instance: ${error2 instanceof Error?error2.message:String(error2)}`)}await notifyDefaultInstanceLinked(deps.authorizationLifecycle,{instanceKind:ApiResourceKind.agent_instance,instanceId:createdId,blueprintKind:ApiResourceKind.agent,blueprintId:agentId}),ctx.set(DEFAULT_INSTANCE_ID_KEY2,createdId),deps.logger.info("Successfully ensured default instance exists",{instanceId:createdId,agentId})}}}function buildAutoCreateSessionSpec(callerSpec,defaultInstanceId){let spec=callerSpec!==void 0?clone(SessionSpecSchema,callerSpec):create2(SessionSpecSchema);return spec.agentInstanceId===""&&(spec.agentInstanceId=defaultInstanceId),spec.subject===""&&(spec.subject=AUTO_CREATED_SESSION_SUBJECT),spec}function newCreateSessionIfNeededStep(deps){return{name:"CreateSessionIfNeeded",async execute(ctx){let execution=ctx.newState,sessionId=execution.spec?.sessionId??"",agentId=execution.spec?.agentId??"";if(sessionId!==""){deps.logger.debug("Session ID already provided, skipping auto-creation",{sessionId});return}let callerSpec=execution.spec?.sessionSpec;deps.logger.info("Session ID not provided, auto-creating session",{agentId,hasSessionSpec:callerSpec!==void 0});let defaultInstanceId="";if((callerSpec?.agentInstanceId??"")===""&&agentId!==""){let resolved=ctx.get(DEFAULT_INSTANCE_ID_KEY2);if(typeof resolved!="string"||resolved==="")throw deps.logger.error("DEFAULT_INSTANCE_ID not found in context",{agentId}),internalError(new Error("default instance ID not found in context"),"internal server error");defaultInstanceId=resolved}let orgId=execution.metadata?.org??"";orgId===""&&(orgId=ctx.input.metadata?.org??"");let sessionRequest=create2(SessionSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"Session",metadata:{name:`session-${Date.now()}`,org:orgId},spec:buildAutoCreateSessionSpec(callerSpec,defaultInstanceId)}),createdSession;try{createdSession=await deps.sessionCreator().createAsCaller(sessionRequest,ctx.callerIdentity)}catch(error2){throw error2 instanceof ConnectError?goWrappedStatusError("failed to create session",error2):new Error(`failed to create session: ${error2 instanceof Error?error2.message:String(error2)}`)}sessionId=createdSession.metadata?.id??"",deps.logger.info("Successfully auto-created session",{sessionId,agentId}),execution.spec??=create2(AgentExecutionSpecSchema),execution.spec.sessionId=sessionId,execution.spec.sessionSpec=void 0,ctx.set(CREATED_SESSION_ID_KEY,sessionId)}}}function newComposeDeclaredPreferencesStep(store,logger2){return{name:"ComposeDeclaredPreferences",async execute(ctx){let execution=ctx.newState;execution.spec??=create2(AgentExecutionSpecSchema),execution.spec.declaredPreferences=create2(DeclaredPreferencesSchema);let orgId=execution.metadata?.org??"";if(orgId===""&&(orgId=ctx.input.metadata?.org??""),orgId===""){logger2.debug("No org on execution metadata, composing no declared preferences");return}let org;try{org=await store.getResource(ApiResourceKind.organization,orgId,OrganizationSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError){logger2.debug("Org not found in store, composing no declared preferences",{orgId});return}logger2.error("Failed to load org for declared preferences - degrading to none (best-effort contract)",{orgId,error:error2 instanceof Error?error2.message:String(error2)});return}execution.spec.declaredPreferences.orgContext=org.spec?.preferences?.standingContext??""}}}function newComposeRecalledMemoriesStep(store,logger2){return{name:"ComposeRecalledMemories",async execute(ctx){let execution=ctx.newState;execution.spec??=create2(AgentExecutionSpecSchema),execution.spec.recalledMemories=create2(RecalledMemoriesSchema);let orgId=execution.metadata?.org??"";if(orgId===""&&(orgId=ctx.input.metadata?.org??""),orgId===""){logger2.debug("No org on execution metadata, composing no recalled memories");return}let org;try{org=await store.getResource(ApiResourceKind.organization,orgId,OrganizationSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError){logger2.debug("Org not found in store, composing no recalled memories",{orgId});return}logger2.error("Failed to load org for recalled memories - degrading to disabled (best-effort contract)",{orgId,error:error2 instanceof Error?error2.message:String(error2)});return}if(!(org.spec?.preferences?.memoryEnabled??!1))return;let facts;try{facts=await loadConfirmedFacts(store,orgId)}catch(error2){logger2.error("Failed to load memories for recall - degrading to disabled (best-effort contract)",{orgId,error:error2 instanceof Error?error2.message:String(error2)});return}execution.spec.recalledMemories.enabled=!0,execution.spec.recalledMemories.facts=facts,logger2.debug("Composed recalled memories snapshot",{orgId,factCount:facts.length})}}}async function loadConfirmedFacts(store,orgId){let rows=await store.listResources(ApiResourceKind.memory),memories=[];for(let data of rows){let memory;try{memory=fromBinary2(MemorySchema,data)}catch{continue}(memory.metadata?.org??"")===orgId&&(memory.spec?.subjectIdentityAccountId??"")===""&&memory.status?.lifecycleState===MemoryLifecycleState.lifecycle_state_confirmed&&memories.push(memory)}return memories.sort((a5,b7)=>{let ta=a5.status?.audit?.specAudit?.createdAt,tb=b7.status?.audit?.specAudit?.createdAt;return ta===void 0||tb===void 0?ta===tb?0:ta===void 0?-1:1:ta.seconds!==tb.seconds?ta.seconds<tb.seconds?-1:1:ta.nanos-tb.nanos}),memories.map(memory=>create2(RecalledMemoryFactSchema,{memoryId:memory.metadata?.id??"",content:memory.spec?.content??""}))}function newSetInitialPhaseStep(){return{name:"SetInitialPhase",execute(ctx){let execution=ctx.newState;execution.status??=create2(AgentExecutionStatusSchema),execution.status.phase=ExecutionPhase.EXECUTION_PENDING}}}function newProcessAttachmentsStep(logger2){return{name:"ProcessAttachments",execute(ctx){let attachments=ctx.newState.spec?.attachments??[];if(attachments.length!==0){for(let attachment of attachments)if(attachment.storageKey==="")throw logger2.error("Attachment missing storage_key - all attachments must be pre-uploaded via uploadAttachment RPC",{filename:attachment.filename}),invalidArgumentError(`attachment '${attachment.filename}' missing storage_key: all attachments must be pre-uploaded via uploadAttachment RPC`);logger2.info("All attachments validated successfully",{attachmentCount:attachments.length})}}}}function newStartWorkflowStep(deps){return{name:"StartWorkflow",async execute(ctx){let execution=ctx.newState,executionId=execution.metadata?.id??"",engine=deps.engineState();if(!engine.connected)throw unavailableError(ENGINE_UNAVAILABLE_MESSAGE);let callbackToken=execution.spec?.callbackToken??new Uint8Array;if(callbackToken.length>0){let tokenBase64=Buffer.from(callbackToken).toString("base64");deps.logger.info("\u{1F4DD} Callback token present - workflow will complete external activity on finish",{executionId,tokenPreview:tokenBase64.length>20?`${tokenBase64.slice(0,20)}...`:tokenBase64,tokenLength:callbackToken.length})}try{await engine.engine.startInvokeWorkflow({executionId,sessionId:execution.spec?.sessionId??"",agentId:execution.spec?.agentId??"",callbackToken,autoApproveAll:execution.spec?.autoApproveAll??!1,parentWorkflowId:execution.spec?.parentWorkflowId??"",activityTaskQueueOverride:execution.spec?.activityTaskQueue??""})}catch(error2){if(error2 instanceof EngineDispatchError)throw deps.logger.warn("Activity dispatch failed",{executionId,error:error2.message}),failedPreconditionError(error2.message);deps.logger.error("Failed to start Temporal workflow - marking execution as FAILED",{executionId,error:error2 instanceof Error?error2.message:String(error2)}),execution.status??=create2(AgentExecutionStatusSchema);let oldPhase=execution.status.phase;execution.status.phase=ExecutionPhase.EXECUTION_FAILED,execution.status.error=`Failed to start Temporal workflow: ${error2 instanceof Error?error2.message:String(error2)}`;try{await deps.store.saveResource(ctx.apiResourceKind,executionId,AgentExecutionSchema,execution)}catch(updateError){throw internalError(updateError,"failed to start workflow and failed to update status")}throw await notifyStatusObservers(deps,execution,oldPhase,ExecutionPhase.EXECUTION_FAILED),internalError(error2,"failed to start workflow")}deps.logger.info("Temporal workflow started successfully",{executionId})}}}var WORKFLOW_ROUTING_GLOBAL="global",WORKFLOW_ROUTING_EXECUTION="execution",WORKFLOW_DEFAULT_EXECUTION_TARGET_LOCAL="local",WORKFLOW_DEFAULT_EXECUTION_TARGET_CLOUD="cloud",WorkflowExecutionTemporalConfig=class{stigmerQueue;runnerQueue;workflowActivityRouting;defaultExecutionTarget;constructor(stigmerQueue,runnerQueue,workflowActivityRouting,defaultExecutionTarget){this.stigmerQueue=stigmerQueue,this.runnerQueue=runnerQueue,this.workflowActivityRouting=workflowActivityRouting,this.defaultExecutionTarget=defaultExecutionTarget}resolveWorkflowExecutionTarget(target){return target!==ExecutionTarget.UNSPECIFIED?target:this.defaultExecutionTarget===WORKFLOW_DEFAULT_EXECUTION_TARGET_CLOUD?ExecutionTarget.CLOUD:ExecutionTarget.LOCAL}};function newWorkflowExecutionConfigFromEnv(){return new WorkflowExecutionTemporalConfig(valueOrDefault2(process.env.TEMPORAL_WORKFLOW_EXECUTION_STIGMER_TASK_QUEUE,"workflow_execution_stigmer"),valueOrDefault2(process.env.TEMPORAL_WORKFLOW_EXECUTION_RUNNER_TASK_QUEUE,"stigmer_runner"),valueOrDefault2(process.env.STIGMER_WORKFLOW_ACTIVITY_ROUTING,WORKFLOW_ROUTING_GLOBAL),valueOrDefault2(process.env.STIGMER_WORKFLOW_DEFAULT_EXECUTION_TARGET,WORKFLOW_DEFAULT_EXECUTION_TARGET_LOCAL))}function valueOrDefault2(value,fallback3){return value===void 0||value===""?fallback3:value}var SESSION_TASK_QUEUE_PREFIX="session:";function formatSessionTaskQueue(sessionId){return SESSION_TASK_QUEUE_PREFIX+sessionId}async function resolveActivityTaskQueue(store,sessionId,config2,activityTaskQueueOverride,logger2){if(activityTaskQueueOverride!==""){let harness2=Harness.NATIVE;if(sessionId!=="")try{harness2=(await store.getResource(ApiResourceKind.session,sessionId,SessionSchema)).spec?.harness??Harness.UNSPECIFIED}catch{}return logger2.info("Dispatch using activity_task_queue override (sandbox affinity)",{session_id:sessionId,task_queue:activityTaskQueueOverride,override_source:"parent_workflow_sandbox"}),{taskQueue:activityTaskQueueOverride,harness:harness2,executionTarget:ExecutionTarget.LOCAL}}let harness=Harness.NATIVE,executionTarget=ExecutionTarget.UNSPECIFIED;if(sessionId!=="")try{let session=await store.getResource(ApiResourceKind.session,sessionId,SessionSchema);harness=session.spec?.harness??Harness.UNSPECIFIED,executionTarget=session.spec?.executionTarget??ExecutionTarget.UNSPECIFIED}catch(error2){if(!(error2 instanceof ResourceNotFoundError))throw new Error(`failed to load session for dispatch: ${error2 instanceof Error?error2.message:String(error2)}`);logger2.warn("Session not found during dispatch, using defaults",{session_id:sessionId})}let resolvedTarget=config2.resolveExecutionTarget(executionTarget),taskQueue=resolveTaskQueue(sessionId,config2);return logger2.info("Dispatch resolved activity task queue",{session_id:sessionId,task_queue:taskQueue,routing_mode:config2.activityRouting,execution_target:ExecutionTarget[resolvedTarget]}),{taskQueue,harness,executionTarget:resolvedTarget}}function resolveTaskQueue(sessionId,config2){return config2.activityRouting===ROUTING_SESSION&&sessionId!==""?formatSessionTaskQueue(sessionId):config2.runnerQueue}var ENGINE_UNAVAILABLE_MESSAGE2="The execution engine is temporarily unavailable. Please try again shortly.";function runWorkflowDeniedMessage(workflowId){return`unauthorized to run workflow '${workflowId}'`}function runWorkflowInstanceDeniedMessage(workflowInstanceId){return`unauthorized to run workflow instance '${workflowInstanceId}'`}var TEMPORAL_UNAVAILABLE_MESSAGE="Temporal is not available",TEMPORAL_UNAVAILABLE_CREATOR_MESSAGE="Temporal is not available (workflow creator not set)",WORKFLOW_CREATOR_UNAVAILABLE_MESSAGE="workflow creator is not available",INVOKE_WORKFLOW_EXECUTION_WORKFLOW_NAME="stigmer/workflow-execution/invoke";function orchestratorWorkflowId(executionId){return`${INVOKE_WORKFLOW_EXECUTION_WORKFLOW_NAME}/${executionId}`}function childWorkflowId(executionId){return`workflow-exec-${executionId}`}var PAUSE_SIGNAL_NAME="pause",RESUME_SIGNAL_NAME="resume",RELAY_SIGNAL_CHANNEL_NAME="relaySignal",HUMAN_INPUT_SIGNAL_PREFIX="human_input_",DEFAULT_EVENT_PAGE_SIZE=100,MAX_EVENT_PAGE_SIZE=500,DEFAULT_PENDING_APPROVALS_PAGE_SIZE=20,MAX_PENDING_APPROVALS_PAGE_SIZE=100,EVENT_POLL_INTERVAL_MS=500;var MEMO_RUNNER_TASK_QUEUE="runnerTaskQueue";var UPDATE_WORKFLOW_EXECUTION_STATUS_ACTIVITY_NAME="UpdateWorkflowExecutionStatus",WFEXEC_QUEUE_PREFIX="wfexec:";function formatWfExecTaskQueue(executionId){return`${WFEXEC_QUEUE_PREFIX}${executionId}`}function resolveWorkflowTaskQueue(executionId,executionTarget,config2,logger2){let resolved=config2.resolveWorkflowExecutionTarget(executionTarget);if(config2.workflowActivityRouting===WORKFLOW_ROUTING_EXECUTION){let taskQueue=formatWfExecTaskQueue(executionId);return logger2.info("Workflow dispatch resolved per-execution queue",{execution_id:executionId,task_queue:taskQueue,routing_mode:config2.workflowActivityRouting,execution_target:resolved}),{taskQueue,executionTarget:resolved}}return logger2.info("Workflow dispatch resolved global queue",{execution_id:executionId,task_queue:config2.runnerQueue,routing_mode:config2.workflowActivityRouting,execution_target:resolved}),{taskQueue:config2.runnerQueue,executionTarget:resolved}}var import_node_crypto6=require("node:crypto");var import_node_crypto5=require("node:crypto"),import_node_fs2=__toESM(require("node:fs"),1),import_node_os2=__toESM(require("node:os"),1),import_node_path3=__toESM(require("node:path"),1),KEY_SIZE=32,KEY_FILE_DIR=".stigmer",KEY_FILE_PERMISSIONS=384,KEY_DIR_PERMISSIONS=448,RAW_32_BYTE_KEY={fromEnv(envVar,decoded){if(decoded.length!==KEY_SIZE)throw new Error(`${envVar} must be exactly 32 bytes (256 bits) when decoded, got ${decoded.length} bytes`);return decoded},fromFile(content){return content.length===KEY_SIZE?content:void 0},generate(){return(0,import_node_crypto5.randomBytes)(KEY_SIZE)},toFile(key){return key}};function getOrCreateNamedKey(envVar,fileName,options={}){return getOrCreateKey(RAW_32_BYTE_KEY,envVar,fileName,options)}function getOrCreateKey(codec,envVar,fileName,options={}){let envValue=(options.env??process.env)[envVar];if(envValue!==void 0&&envValue!=="")return codec.fromEnv(envVar,decodeEnvBase64(envVar,envValue));let keyPath=namedKeyFilePath(fileName,options),content=readKeyFile(keyPath),fromFile=content===void 0?void 0:codec.fromFile(content);if(fromFile!==void 0)return fromFile;let key=codec.generate();try{saveKeyToFile(keyPath,codec.toFile(key))}catch(error2){process.stderr.write(`Warning: could not save key to ${keyPath}: ${error2 instanceof Error?error2.message:String(error2)}
+`;case"r":return"\r";case"t":return"	";case"v":return"\v"}throw new Error}function item327(offset,bytes){return builder.newStringExpr(offset(),bytes)}function item337(offset,bytes){return builder.newBytesExpr(offset(),bytes)}function item348(offset,keyword){return builder.newBoolExpr(offset(),keyword)}function item360(offset){return builder.newNullExpr(offset())}function item378(error2,id){return["true","false","null","in","as","break","const","continue","else","for","function","if","import","let","loop","package","namespace","return","var","void","while"].includes(id)&&error2("reserved identifier"),id}function item390(offset,identifier,args){return builder.newCallExpr(offset(),identifier,args)}function item407(error2,selector){return["true","false","null","in"].includes(selector)&&error2("reserved keyword"),selector}function item427(offset,key,value){return builder.newStructEntry(offset(),key,value)}function item434(offset,dot,name,entries){return builder.newStructExpr(offset(),entries,(dot!==null?dot:"")+name.join("."))}function item441(offset,name){return builder.newIdentExpr(offset(),name)}function item458(offset,elements){return builder.newListExpr(offset(),elements)}function item472(offset,key,value){return builder.newMapEntry(offset(),key,value)}function item481(offset,entries){return builder.newStructExpr(offset(),entries)}function item497(offset,field3){return prevExpr=>builder.newSelectExpr(offset(),prevExpr,field3)}function item506(offset,func,args){return prevExpr=>builder.newMemberCallExpr(offset(),prevExpr,func,args)}function item513(offset,index2){return prevExpr=>builder.newCallExpr(offset(),"_[_]",[prevExpr,index2])}function item516(primary,tail){return tail.length===0?primary:tail.reduce((expr,op2)=>op2(expr),primary)}function item529(offset,ops,expr){return ops.length%2===0?expr:expr.exprKind.case==="callExpr"&&expr.exprKind.value.function===`${ops[0]}_`?expr.exprKind.value.args[0]:builder.newCallExpr(offset(),`${ops[0]}_`,[expr])}function item541(o3){return`_${o3}_`}function item544(offset,operator,nextExpr){return prevExpr=>builder.newCallExpr(offset(),operator,[prevExpr,nextExpr])}function item546(unary,tail){return tail===null?unary:tail.reduce((expr,op2)=>op2(expr),unary)}function item557(o3){return`_${o3}_`}function item559(offset,operator,nextExpr){return prevExpr=>builder.newCallExpr(offset(),operator,[prevExpr,nextExpr])}function item561(multiplication,tail){return tail===null?multiplication:tail.reduce((expr,op2)=>op2(expr),multiplication)}function item588(operator){return`_${operator}_`}function item592(){return"@in"}function item595(offset,operator,nextExpr){return prevExpr=>builder.newCallExpr(offset(),operator,[prevExpr,nextExpr])}function item597(addition,tail){return tail===null?addition:tail.reduce((expr,op2)=>op2(expr),addition)}function item603(offset,relation){if(relation.length===1)return relation[0];let logicManager=LogicManager.newBalancingLogicManager(builder,"_&&_",relation[0]);for(let i6=1;i6<relation.length;i6+=1)logicManager.addTerm(offset(),relation[i6]);return logicManager.toExpr()}function item609(offset,and){if(and.length===1)return and[0];let logicManager=LogicManager.newBalancingLogicManager(builder,"_||_",and[0]);for(let i6=1;i6<and.length;i6+=1)logicManager.addTerm(offset(),and[i6]);return logicManager.toExpr()}function item621(t,f5){return[t,f5]}function item623(offset,or,tail){return tail===null?or:builder.newCallExpr(offset(),"_?_:_",[or,...tail])}function item1(text2){let result2=item4(text2);return result2.success===!0?result2.remainder.length===0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item624,remainder:result2.remainder}]}:result2}function item4(text2){let result2=item5(text2);return result2.success===!0?{success:!0,value:item623(()=>input.length-text2.length,result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item5(text2){let failedExpectations2=[],remainder2=text2,result0=item8(remainder2);if(failedExpectations2.push(...result0.failedExpectations),result0.success===!1)return{success:!1,remainder:result0.remainder,failedExpectations:failedExpectations2};remainder2=result0.remainder;let result1=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result1?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result1[0].length);let result2=item611(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result0.value,result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item8(text2){let result2=item10(text2);return result2.success===!0?{success:!0,value:item609(()=>input.length-text2.length,result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item10(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let r5=remainder2;if(values.length>0){let result3=item604(r5);if(failedExpectations2.push(...result3.failedExpectations),result3.success===!1)break;r5=result3.remainder}let result2=item12(r5);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return values.length<1?{success:!1,remainder:text2,failedExpectations:failedExpectations2}:{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item12(text2){let result2=item14(text2);return result2.success===!0?{success:!0,value:item603(()=>input.length-text2.length,result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item14(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let r5=remainder2;if(values.length>0){let result3=item598(r5);if(failedExpectations2.push(...result3.failedExpectations),result3.success===!1)break;r5=result3.remainder}let result2=item16(r5);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return values.length<1?{success:!1,remainder:text2,failedExpectations:failedExpectations2}:{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item16(text2){let result2=item17(text2);return result2.success===!0?{success:!0,value:item597(result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item17(text2){let failedExpectations2=[],remainder2=text2,result0=item20(remainder2);if(failedExpectations2.push(...result0.failedExpectations),result0.success===!1)return{success:!1,remainder:result0.remainder,failedExpectations:failedExpectations2};remainder2=result0.remainder;let result1=item563(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:[result0.value,result1.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item20(text2){let result2=item21(text2);return result2.success===!0?{success:!0,value:item561(result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item21(text2){let failedExpectations2=[],remainder2=text2,result0=item24(remainder2);if(failedExpectations2.push(...result0.failedExpectations),result0.success===!1)return{success:!1,remainder:result0.remainder,failedExpectations:failedExpectations2};remainder2=result0.remainder;let result1=item548(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:[result0.value,result1.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item24(text2){let result2=item25(text2);return result2.success===!0?{success:!0,value:item546(result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item25(text2){let failedExpectations2=[],remainder2=text2,result0=item28(remainder2);if(failedExpectations2.push(...result0.failedExpectations),result0.success===!1)return{success:!1,remainder:result0.remainder,failedExpectations:failedExpectations2};remainder2=result0.remainder;let result1=item531(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:[result0.value,result1.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item28(text2){let choices=[item30,item517],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item30(text2){let result2=item31(text2);return result2.success===!0?{success:!0,value:item516(result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item31(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item63(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=item484(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result1.value,result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item33(text2){let failedExpectations2=[],remainder2=text2,result0=item34(remainder2);if(failedExpectations2.push(...result0.failedExpectations),result0.success===!1)return{success:!1,remainder:result0.remainder,failedExpectations:failedExpectations2};remainder2=result0.remainder;let result1=item42(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=item59(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result0.value,result1.value,result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item34(text2){let result2=item36(text2);return result2.success===!0?result2:{success:!0,value:null,remainder:text2,failedExpectations:result2.failedExpectations}}function item36(text2){let result2=item37(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item41,remainder:result2.remainder}]}}function item37(text2){let matches2=text2.match(/^([\t\n\f\r ])+/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item40,remainder:text2}]}}function item42(text2){let result2=item44(text2);return result2.success===!0?result2:{success:!0,value:null,remainder:text2,failedExpectations:result2.failedExpectations}}function item44(text2){let result2=item45(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item58,remainder:result2.remainder}]}}function item45(text2){let failedExpectations2=[],remainder2=text2,result0=item46(remainder2);if(failedExpectations2.push(...result0.failedExpectations),result0.success===!1)return{success:!1,remainder:result0.remainder,failedExpectations:failedExpectations2};remainder2=result0.remainder;let result1=item48(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=item52(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result0.value,result1.value,result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item46(text2){return text2.startsWith("//")?{success:!0,value:"//",remainder:text2.slice(2),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item47,remainder:text2}]}}function item48(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item49(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item49(text2){return/^[^\r\n]/g.test(text2)?{success:!0,value:text2.slice(0,1),remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item50,remainder:text2}]}}function item52(text2){let result2=item53(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item56,remainder:result2.remainder}]}}function item53(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item54(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return values.length<1?{success:!1,remainder:text2,failedExpectations:failedExpectations2}:{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item54(text2){return/^[\r\n]/g.test(text2)?{success:!0,value:text2.slice(0,1),remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item55,remainder:text2}]}}function item59(text2){let result2=item36(text2);return result2.success===!0?result2:{success:!0,value:null,remainder:text2,failedExpectations:result2.failedExpectations}}function item63(text2){let choices=[item65,item362,item391,item435,item442,item447,item459],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item65(text2){let choices=[item67,item106,item129,item145,item330,item340,item351],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item67(text2){let result2=item68(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item104,remainder:result2.remainder}]}}function item68(text2){let result2=item70(text2);return result2.success===!0?{success:!0,value:item103(()=>input.length-text2.length,result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item70(text2){let matches2=text2.match(/^((-)?([0-9])*\.([0-9])+([eE]([+\-])?([0-9])+)?|(-)?([0-9])+[eE]([+\-])?([0-9])+)/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item75,remainder:text2},{expectation:item81,remainder:text2},{expectation:item83,remainder:text2}]}}function item106(text2){let result2=item107(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item127,remainder:result2.remainder}]}}function item107(text2){let result2=item108(text2);return result2.success===!0?{success:!0,value:item126(()=>input.length-text2.length,result2.value[0]),remainder:result2.remainder,failedExpectations:[]}:result2}function item108(text2){let failedExpectations2=[],remainder2=text2,result0=item110(remainder2);if(failedExpectations2.push(...result0.failedExpectations),result0.success===!1)return{success:!1,remainder:result0.remainder,failedExpectations:failedExpectations2};remainder2=result0.remainder;let result1=remainder2.match(/^[uU]/g);return failedExpectations2.push({expectation:item124,remainder:remainder2}),result1?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result1[0].length),{success:!0,value:[result0.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item110(text2){let matches2=text2.match(/^(0x([0-9abcdefABCDEF])+|([0-9])+)/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item114,remainder:text2},{expectation:item81,remainder:text2}]}}function item129(text2){let result2=item130(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item143,remainder:result2.remainder}]}}function item130(text2){let result2=item132(text2);return result2.success===!0?{success:!0,value:item142(()=>input.length-text2.length,result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item132(text2){let matches2=text2.match(/^(-)?(0x([0-9abcdefABCDEF])+|([0-9])+)/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item75,remainder:text2},{expectation:item114,remainder:text2},{expectation:item81,remainder:text2}]}}function item145(text2){let result2=item146(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item328,remainder:result2.remainder}]}}function item146(text2){let result2=item149(text2);return result2.success===!0?{success:!0,value:item327(()=>input.length-text2.length,result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item149(text2){let result2=item150(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item326,remainder:result2.remainder}]}}function item150(text2){let choices=[item151,item204],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item151(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^[rR]/g);if(failedExpectations2.push({expectation:item153,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item155(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item155(text2){let choices=[item156,item169,item180,item192],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item156(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^"""/g);if(failedExpectations2.push({expectation:item158,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item160(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^"""/g);return failedExpectations2.push({expectation:item158,remainder:remainder2}),result2?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result2[0].length),{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item160(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item161(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item161(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(?!""")/g);if(failedExpectations2.push(),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item165(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item165(text2){return text2.length>0?{success:!0,value:text2.slice(0,1),remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item2,remainder:text2}]}}function item169(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^'''/g);if(failedExpectations2.push({expectation:item171,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item173(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^'''/g);return failedExpectations2.push({expectation:item171,remainder:remainder2}),result2?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result2[0].length),{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item173(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item174(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item174(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(?!''')/g);if(failedExpectations2.push(),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item178(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item178(text2){return text2.length>0?{success:!0,value:text2.slice(0,1),remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item2,remainder:text2}]}}function item180(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^"/g);if(failedExpectations2.push({expectation:item182,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item184(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^"/g);return failedExpectations2.push({expectation:item182,remainder:remainder2}),result2?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result2[0].length),{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item184(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item185(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item185(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(?!("|([\r\n])+))/g);if(failedExpectations2.push(),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item190(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item190(text2){return text2.length>0?{success:!0,value:text2.slice(0,1),remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item2,remainder:text2}]}}function item192(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^'/g);if(failedExpectations2.push({expectation:item194,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item196(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^'/g);return failedExpectations2.push({expectation:item194,remainder:remainder2}),result2?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result2[0].length),{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item196(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item197(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item197(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(?!('|([\r\n])+))/g);if(failedExpectations2.push(),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item202(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item202(text2){return text2.length>0?{success:!0,value:text2.slice(0,1),remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item2,remainder:text2}]}}function item204(text2){let choices=[item205,item288,item300,item313],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item205(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^"""/g);if(failedExpectations2.push({expectation:item158,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item208(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^"""/g);return failedExpectations2.push({expectation:item158,remainder:remainder2}),result2?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result2[0].length),{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item208(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item209(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item209(text2){let choices=[item211,item280],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item211(text2){let result2=item212(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item279,remainder:result2.remainder}]}}function item212(text2){let choices=[item214,item267,item274],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item214(text2){let result2=item215(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item266,remainder:result2.remainder}]}}function item215(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item217(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return values.length<1?{success:!1,remainder:text2,failedExpectations:failedExpectations2}:{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item217(text2){let result2=item218(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item265,remainder:result2.remainder}]}}function item218(text2){let choices=[item219,item236,item244,item252],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item219(text2){let result2=item220(text2);return result2.success===!0?{success:!0,value:item235(result2.value[0]),remainder:result2.remainder,failedExpectations:[]}:result2}function item220(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\\/g);if(failedExpectations2.push({expectation:item222,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=remainder2.match(/^[xX]/g);if(failedExpectations2.push({expectation:item224,remainder:remainder2}),result1?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result1[0].length);let result2=item226(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item226(text2){let matches2=text2.match(/^([0-9abcdefABCDEF][0-9abcdefABCDEF]){0,1}/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item233,remainder:text2}]}}function item236(text2){let result2=item237(text2);return result2.success===!0?{success:!0,value:item243(result2.value[0]),remainder:result2.remainder,failedExpectations:[]}:result2}function item237(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\\u/g);if(failedExpectations2.push({expectation:item239,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item241(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:[result1.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item241(text2){let matches2=text2.match(/^([0-9abcdefABCDEF][0-9abcdefABCDEF]){0,2}/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item233,remainder:text2}]}}function item244(text2){let result2=item245(text2);return result2.success===!0?{success:!0,value:item251(result2.value[0]),remainder:result2.remainder,failedExpectations:[]}:result2}function item245(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\\U/g);if(failedExpectations2.push({expectation:item247,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item249(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:[result1.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item249(text2){let matches2=text2.match(/^([0-9abcdefABCDEF][0-9abcdefABCDEF]){0,4}/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item233,remainder:text2}]}}function item252(text2){let result2=item253(text2);return result2.success===!0?{success:!0,value:item264(result2.value[0]),remainder:result2.remainder,failedExpectations:[]}:result2}function item253(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\\/g);if(failedExpectations2.push({expectation:item222,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item256(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:[result1.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item256(text2){let matches2=text2.match(/^[0-3][0-7][0-7]/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item259,remainder:text2}]}}function item267(text2){let result2=item268(text2);return result2.success===!0?{success:!0,value:item273(result2.value[0]),remainder:result2.remainder,failedExpectations:[]}:result2}function item268(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\\/g);if(failedExpectations2.push({expectation:item222,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item271(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:[result1.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item271(text2){return/^[abfnrtv]/g.test(text2)?{success:!0,value:text2.slice(0,1),remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item272,remainder:text2}]}}function item274(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\\/g);if(failedExpectations2.push({expectation:item222,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item277(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item277(text2){return/^["'`\\?]/g.test(text2)?{success:!0,value:text2.slice(0,1),remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item278,remainder:text2}]}}function item280(text2){let matches2=text2.match(/^(?!""")[\s\S]/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item2,remainder:text2}]}}function item288(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^'''/g);if(failedExpectations2.push({expectation:item171,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item291(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^'''/g);return failedExpectations2.push({expectation:item171,remainder:remainder2}),result2?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result2[0].length),{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item291(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item292(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item292(text2){let choices=[item211,item293],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item293(text2){let matches2=text2.match(/^(?!''')[\s\S]/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item2,remainder:text2}]}}function item300(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^"/g);if(failedExpectations2.push({expectation:item182,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item303(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^"/g);return failedExpectations2.push({expectation:item182,remainder:remainder2}),result2?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result2[0].length),{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item303(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item304(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item304(text2){let choices=[item211,item305],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item305(text2){let matches2=text2.match(/^(?!("|([\r\n])+))[\s\S]/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item2,remainder:text2}]}}function item313(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^'/g);if(failedExpectations2.push({expectation:item194,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item316(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^'/g);return failedExpectations2.push({expectation:item194,remainder:remainder2}),result2?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result2[0].length),{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item316(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item317(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item317(text2){let choices=[item211,item318],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item318(text2){let matches2=text2.match(/^(?!('|([\r\n])+))[\s\S]/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item2,remainder:text2}]}}function item330(text2){let result2=item331(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item338,remainder:result2.remainder}]}}function item331(text2){let result2=item332(text2);return result2.success===!0?{success:!0,value:item337(()=>input.length-text2.length,result2.value[0]),remainder:result2.remainder,failedExpectations:[]}:result2}function item332(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^[bB]/g);if(failedExpectations2.push({expectation:item334,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item149(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:[result1.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item340(text2){let result2=item341(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item349,remainder:result2.remainder}]}}function item341(text2){let result2=item343(text2);return result2.success===!0?{success:!0,value:item348(()=>input.length-text2.length,result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item343(text2){let choices=[item344,item346],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item344(text2){return text2.startsWith("true")?{success:!0,value:"true",remainder:text2.slice(4),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item345,remainder:text2}]}}function item346(text2){return text2.startsWith("false")?{success:!0,value:"false",remainder:text2.slice(5),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item347,remainder:text2}]}}function item351(text2){let result2=item352(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item361,remainder:result2.remainder}]}}function item352(text2){let result2=item353(text2);return result2.success===!0?{success:!0,value:item360(()=>input.length-text2.length),remainder:result2.remainder,failedExpectations:[]}:result2}function item353(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^null/g);if(failedExpectations2.push({expectation:item355,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=remainder2.match(/^(?![_a-zA-Z0-9])/g);return failedExpectations2.push(),result1?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result1[0].length),{success:!0,value:[],remainder:remainder2,failedExpectations:failedExpectations2})}function item362(text2){let result2=item363(text2);return result2.success===!0?{success:!0,value:item390(()=>input.length-text2.length,result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item363(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(\.)?/g);if(failedExpectations2.push({expectation:item83,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result1?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result1[0].length);let result2=item368(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)return{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2};remainder2=result2.remainder;let result3=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result3?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result3[0].length);let result4=remainder2.match(/^\(/g);if(failedExpectations2.push({expectation:item381,remainder:remainder2}),result4?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result4[0].length);let result5=item384(remainder2);if(failedExpectations2.push(...result5.failedExpectations),result5.success===!1)return{success:!1,remainder:result5.remainder,failedExpectations:failedExpectations2};remainder2=result5.remainder;let result6=remainder2.match(/^\)/g);return failedExpectations2.push({expectation:item388,remainder:remainder2}),result6?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result6[0].length),{success:!0,value:[result2.value,result5.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item368(text2){let result2=item369(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item379,remainder:result2.remainder}]}}function item369(text2){let result2=item371(text2);return result2.success===!0?{success:!0,value:item378((message6,location=runtime.getLocation(parse$source,input,text2,result2.remainder),name)=>{throw new ParseError(message6,location,name)},result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item371(text2){let matches2=text2.match(/^[_a-zA-Z]([_a-zA-Z0-9])*/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item374,remainder:text2}]}}function item384(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let r5=remainder2;if(values.length>0){let result3=item385(r5);if(failedExpectations2.push(...result3.failedExpectations),result3.success===!1)break;r5=result3.remainder}let result2=item4(r5);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item385(text2){return text2.startsWith(",")?{success:!0,value:",",remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item386,remainder:text2}]}}function item391(text2){let result2=item392(text2);return result2.success===!0?{success:!0,value:item434(()=>input.length-text2.length,result2.value[0],result2.value[1],result2.value[2]),remainder:result2.remainder,failedExpectations:[]}:result2}function item392(text2){let failedExpectations2=[],remainder2=text2,result0=item394(remainder2);if(failedExpectations2.push(...result0.failedExpectations),result0.success===!1)return{success:!1,remainder:result0.remainder,failedExpectations:failedExpectations2};remainder2=result0.remainder;let result1=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result1?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result1[0].length);let result2=item397(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)return{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2};remainder2=result2.remainder;let result3=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result3?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result3[0].length);let result4=remainder2.match(/^\{/g);if(failedExpectations2.push({expectation:item413,remainder:remainder2}),result4?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result4[0].length);let result5=item416(remainder2);if(failedExpectations2.push(...result5.failedExpectations),result5.success===!1)return{success:!1,remainder:result5.remainder,failedExpectations:failedExpectations2};remainder2=result5.remainder;let result6=remainder2.match(/^(,)?/g);if(failedExpectations2.push({expectation:item386,remainder:remainder2}),result6?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result6[0].length);let result7=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result7?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result7[0].length);let result8=remainder2.match(/^\}/g);return failedExpectations2.push({expectation:item432,remainder:remainder2}),result8?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result8[0].length),{success:!0,value:[result0.value,result2.value,result5.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item394(text2){let result2=item395(text2);return result2.success===!0?result2:{success:!0,value:null,remainder:text2,failedExpectations:result2.failedExpectations}}function item395(text2){return text2.startsWith(".")?{success:!0,value:".",remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item83,remainder:text2}]}}function item397(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let r5=remainder2;if(values.length>0){let result3=item409(r5);if(failedExpectations2.push(...result3.failedExpectations),result3.success===!1)break;r5=result3.remainder}let result2=item399(r5);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return values.length<1?{success:!1,remainder:text2,failedExpectations:failedExpectations2}:{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item399(text2){let result2=item400(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item408,remainder:result2.remainder}]}}function item400(text2){let result2=item402(text2);return result2.success===!0?{success:!0,value:item407((message6,location=runtime.getLocation(parse$source,input,text2,result2.remainder),name)=>{throw new ParseError(message6,location,name)},result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item402(text2){let matches2=text2.match(/^[_a-zA-Z]([_a-zA-Z0-9])*/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item374,remainder:text2}]}}function item409(text2){let failedExpectations2=[],remainder2=text2,result0=item33(remainder2);if(failedExpectations2.push(...result0.failedExpectations),result0.success===!1)return{success:!1,remainder:result0.remainder,failedExpectations:failedExpectations2};remainder2=result0.remainder;let result1=item410(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=item33(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result0.value,result1.value,result0.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item410(text2){return text2.startsWith(".")?{success:!0,value:".",remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item83,remainder:text2}]}}function item416(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let r5=remainder2;if(values.length>0){let result3=item428(r5);if(failedExpectations2.push(...result3.failedExpectations),result3.success===!1)break;r5=result3.remainder}let result2=item417(r5);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item417(text2){let result2=item418(text2);return result2.success===!0?{success:!0,value:item427(()=>input.length-text2.length,result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item418(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item399(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?:/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2},{expectation:item423,remainder:remainder2}),result2?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result2[0].length);let result3=item4(remainder2);return failedExpectations2.push(...result3.failedExpectations),result3.success===!1?{success:!1,remainder:result3.remainder,failedExpectations:failedExpectations2}:(remainder2=result3.remainder,{success:!0,value:[result1.value,result3.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item428(text2){return text2.startsWith(",")?{success:!0,value:",",remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item386,remainder:text2}]}}function item435(text2){let result2=item436(text2);return result2.success===!0?{success:!0,value:item441(()=>input.length-text2.length,result2.value[0]),remainder:result2.remainder,failedExpectations:[]}:result2}function item436(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(\.)?/g);if(failedExpectations2.push({expectation:item83,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result1?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result1[0].length);let result2=item399(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item442(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\(/g);if(failedExpectations2.push({expectation:item381,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item4(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^\)/g);return failedExpectations2.push({expectation:item388,remainder:remainder2}),result2?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result2[0].length),{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item447(text2){let result2=item449(text2);return result2.success===!0?{success:!0,value:item458(()=>input.length-text2.length,result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item449(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\[/g);if(failedExpectations2.push({expectation:item451,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item384(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^(,)?/g);if(failedExpectations2.push({expectation:item386,remainder:remainder2}),result2?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result2[0].length);let result3=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result3?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result3[0].length);let result4=remainder2.match(/^\]/g);return failedExpectations2.push({expectation:item456,remainder:remainder2}),result4?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result4[0].length),{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item459(text2){let result2=item461(text2);return result2.success===!0?{success:!0,value:item481(()=>input.length-text2.length,result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item461(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\{/g);if(failedExpectations2.push({expectation:item413,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item465(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^(,)?(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?\}/g);return failedExpectations2.push({expectation:item386,remainder:remainder2},{expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2},{expectation:item432,remainder:remainder2}),result2?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result2[0].length),{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item465(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let r5=remainder2;if(values.length>0){let result3=item473(r5);if(failedExpectations2.push(...result3.failedExpectations),result3.success===!1)break;r5=result3.remainder}let result2=item466(r5);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item466(text2){let result2=item467(text2);return result2.success===!0?{success:!0,value:item472(()=>input.length-text2.length,result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item467(text2){let failedExpectations2=[],remainder2=text2,result0=item4(remainder2);if(failedExpectations2.push(...result0.failedExpectations),result0.success===!1)return{success:!1,remainder:result0.remainder,failedExpectations:failedExpectations2};remainder2=result0.remainder;let result1=remainder2.match(/^:/g);if(failedExpectations2.push({expectation:item423,remainder:remainder2}),result1?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result1[0].length);let result2=item4(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result0.value,result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item473(text2){return text2.startsWith(",")?{success:!0,value:",",remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item386,remainder:text2}]}}function item484(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item485(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item485(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item488(remainder2);return failedExpectations2.push(...result1.failedExpectations),result1.success===!1?{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2}:(remainder2=result1.remainder,{success:!0,value:result1.value,remainder:remainder2,failedExpectations:failedExpectations2})}function item488(text2){let choices=[item489,item498,item507],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item489(text2){let result2=item490(text2);return result2.success===!0?{success:!0,value:item497(()=>input.length-text2.length,result2.value[0]),remainder:result2.remainder,failedExpectations:[]}:result2}function item490(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\./g);if(failedExpectations2.push({expectation:item83,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result1?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result1[0].length);let result2=item399(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)return{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2};remainder2=result2.remainder;let result3=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result3?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result3[0].length);let result4=remainder2.match(/^(?![(])/g);return failedExpectations2.push(),result4?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result4[0].length),{success:!0,value:[result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item498(text2){let result2=item499(text2);return result2.success===!0?{success:!0,value:item506(()=>input.length-text2.length,result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item499(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\./g);if(failedExpectations2.push({expectation:item83,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result1?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result1[0].length);let result2=item399(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)return{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2};remainder2=result2.remainder;let result3=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result3?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result3[0].length);let result4=remainder2.match(/^\(/g);if(failedExpectations2.push({expectation:item381,remainder:remainder2}),result4?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result4[0].length);let result5=item384(remainder2);if(failedExpectations2.push(...result5.failedExpectations),result5.success===!1)return{success:!1,remainder:result5.remainder,failedExpectations:failedExpectations2};remainder2=result5.remainder;let result6=remainder2.match(/^\)/g);return failedExpectations2.push({expectation:item388,remainder:remainder2}),result6?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result6[0].length),{success:!0,value:[result2.value,result5.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item507(text2){let result2=item508(text2);return result2.success===!0?{success:!0,value:item513(()=>input.length-text2.length,result2.value[0]),remainder:result2.remainder,failedExpectations:[]}:result2}function item508(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\[/g);if(failedExpectations2.push({expectation:item451,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item4(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^\]/g);return failedExpectations2.push({expectation:item456,remainder:remainder2}),result2?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result2[0].length),{success:!0,value:[result1.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item517(text2){let result2=item518(text2);return result2.success===!0?{success:!0,value:item529(()=>input.length-text2.length,result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item518(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item520(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=item30(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result1.value,result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item520(text2){let matches2=text2.match(/^((!)+|(-)+)/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item524,remainder:text2},{expectation:item75,remainder:text2}]}}function item531(text2){let result2=item533(text2);return result2.success===!0?result2:{success:!0,value:null,remainder:text2,failedExpectations:result2.failedExpectations}}function item533(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item534(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return values.length<1?{success:!1,remainder:text2,failedExpectations:failedExpectations2}:{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item534(text2){let result2=item535(text2);return result2.success===!0?{success:!0,value:item544(()=>input.length-text2.length,result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item535(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item537(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=item28(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result1.value,result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item537(text2){let result2=item539(text2);return result2.success===!0?{success:!0,value:item541(result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item539(text2){return/^[*\/%]/g.test(text2)?{success:!0,value:text2.slice(0,1),remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item540,remainder:text2}]}}function item548(text2){let result2=item550(text2);return result2.success===!0?result2:{success:!0,value:null,remainder:text2,failedExpectations:result2.failedExpectations}}function item550(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item551(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return values.length<1?{success:!1,remainder:text2,failedExpectations:failedExpectations2}:{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item551(text2){let result2=item552(text2);return result2.success===!0?{success:!0,value:item559(()=>input.length-text2.length,result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item552(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item554(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=item24(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result1.value,result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item554(text2){let result2=item556(text2);return result2.success===!0?{success:!0,value:item557(result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item556(text2){return/^[+\-]/g.test(text2)?{success:!0,value:text2.slice(0,1),remainder:text2.slice(1),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item93,remainder:text2}]}}function item563(text2){let result2=item565(text2);return result2.success===!0?result2:{success:!0,value:null,remainder:text2,failedExpectations:result2.failedExpectations}}function item565(text2){let values=[],failedExpectations2=[],remainder2=text2;for(;;){let result2=item566(remainder2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!1)break;remainder2=result2.remainder,values.push(result2.value)}return values.length<1?{success:!1,remainder:text2,failedExpectations:failedExpectations2}:{success:!0,value:values,remainder:remainder2,failedExpectations:failedExpectations2}}function item566(text2){let result2=item567(text2);return result2.success===!0?{success:!0,value:item595(()=>input.length-text2.length,result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item567(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item570(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=item20(remainder2);return failedExpectations2.push(...result2.failedExpectations),result2.success===!1?{success:!1,remainder:result2.remainder,failedExpectations:failedExpectations2}:(remainder2=result2.remainder,{success:!0,value:[result1.value,result2.value],remainder:remainder2,failedExpectations:failedExpectations2})}function item570(text2){let result2=item571(text2);return result2.success===!0?result2:{success:!1,remainder:result2.remainder,failedExpectations:[{expectation:item593,remainder:result2.remainder}]}}function item571(text2){let choices=[item572,item589],failedExpectations2=[];for(let func=choices.shift();func!==void 0;func=choices.shift()){let result2=func(text2);if(failedExpectations2.push(...result2.failedExpectations),result2.success===!0)return{success:!0,value:result2.value,remainder:result2.remainder,failedExpectations:failedExpectations2}}return{success:!1,remainder:text2,failedExpectations:failedExpectations2}}function item572(text2){let result2=item574(text2);return result2.success===!0?{success:!0,value:item588(result2.value),remainder:result2.remainder,failedExpectations:[]}:result2}function item574(text2){let matches2=text2.match(/^(<=|<|>=|>|==|!=)/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item577,remainder:text2},{expectation:item579,remainder:text2},{expectation:item581,remainder:text2},{expectation:item583,remainder:text2},{expectation:item585,remainder:text2},{expectation:item587,remainder:text2}]}}function item589(text2){let result2=item590(text2);return result2.success===!0?{success:!0,value:item592(),remainder:result2.remainder,failedExpectations:[]}:result2}function item590(text2){return text2.startsWith("in")?{success:!0,value:"in",remainder:text2.slice(2),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item591,remainder:text2}]}}function item598(text2){let matches2=text2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?&&/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item41,remainder:text2},{expectation:item58,remainder:text2},{expectation:item601,remainder:text2}]}}function item604(text2){let matches2=text2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?\|\|/g);return matches2?.length===1?{success:!0,value:matches2[0],remainder:text2.slice(matches2[0].length),failedExpectations:[]}:{success:!1,remainder:text2,failedExpectations:[{expectation:item41,remainder:text2},{expectation:item58,remainder:text2},{expectation:item607,remainder:text2}]}}function item611(text2){let result2=item613(text2);return result2.success===!0?result2:{success:!0,value:null,remainder:text2,failedExpectations:result2.failedExpectations}}function item613(text2){let result2=item614(text2);return result2.success===!0?{success:!0,value:item621(result2.value[0],result2.value[1]),remainder:result2.remainder,failedExpectations:[]}:result2}function item614(text2){let failedExpectations2=[],remainder2=text2,result0=remainder2.match(/^\?/g);if(failedExpectations2.push({expectation:item616,remainder:remainder2}),result0?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result0[0].length);let result1=item8(remainder2);if(failedExpectations2.push(...result1.failedExpectations),result1.success===!1)return{success:!1,remainder:result1.remainder,failedExpectations:failedExpectations2};remainder2=result1.remainder;let result2=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);if(failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result2?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result2[0].length);let result3=remainder2.match(/^:/g);if(failedExpectations2.push({expectation:item423,remainder:remainder2}),result3?.length!==1)return{success:!1,remainder:remainder2,failedExpectations:failedExpectations2};remainder2=remainder2.slice(result3[0].length);let result4=item4(remainder2);if(failedExpectations2.push(...result4.failedExpectations),result4.success===!1)return{success:!1,remainder:result4.remainder,failedExpectations:failedExpectations2};remainder2=result4.remainder;let result5=remainder2.match(/^(([\t\n\f\r ])+)?(\/\/([^\r\n])*([\r\n])+)?(([\t\n\f\r ])+)?/g);return failedExpectations2.push({expectation:item41,remainder:remainder2},{expectation:item58,remainder:remainder2}),result5?.length!==1?{success:!1,remainder:remainder2,failedExpectations:failedExpectations2}:(remainder2=remainder2.slice(result5[0].length),{success:!0,value:[result1.value,result4.value],remainder:remainder2,failedExpectations:failedExpectations2})}}function parse2(expr){return create2(ParsedExprSchema,{expr:parse(expr)})}var file_cel_expr_checked=fileDesc2("ChZjZWwvZXhwci9jaGVja2VkLnByb3RvEghjZWwuZXhwciLsAgoLQ2hlY2tlZEV4cHISPgoNcmVmZXJlbmNlX21hcBgCIAMoCzInLmNlbC5leHByLkNoZWNrZWRFeHByLlJlZmVyZW5jZU1hcEVudHJ5EjQKCHR5cGVfbWFwGAMgAygLMiIuY2VsLmV4cHIuQ2hlY2tlZEV4cHIuVHlwZU1hcEVudHJ5EikKC3NvdXJjZV9pbmZvGAUgASgLMhQuY2VsLmV4cHIuU291cmNlSW5mbxIUCgxleHByX3ZlcnNpb24YBiABKAkSHAoEZXhwchgEIAEoCzIOLmNlbC5leHByLkV4cHIaSAoRUmVmZXJlbmNlTWFwRW50cnkSCwoDa2V5GAEgASgDEiIKBXZhbHVlGAIgASgLMhMuY2VsLmV4cHIuUmVmZXJlbmNlOgI4ARo+CgxUeXBlTWFwRW50cnkSCwoDa2V5GAEgASgDEh0KBXZhbHVlGAIgASgLMg4uY2VsLmV4cHIuVHlwZToCOAEioggKBFR5cGUSJQoDZHluGAEgASgLMhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5SAASKgoEbnVsbBgCIAEoDjIaLmdvb2dsZS5wcm90b2J1Zi5OdWxsVmFsdWVIABIxCglwcmltaXRpdmUYAyABKA4yHC5jZWwuZXhwci5UeXBlLlByaW1pdGl2ZVR5cGVIABIvCgd3cmFwcGVyGAQgASgOMhwuY2VsLmV4cHIuVHlwZS5QcmltaXRpdmVUeXBlSAASMgoKd2VsbF9rbm93bhgFIAEoDjIcLmNlbC5leHByLlR5cGUuV2VsbEtub3duVHlwZUgAEiwKCWxpc3RfdHlwZRgGIAEoCzIXLmNlbC5leHByLlR5cGUuTGlzdFR5cGVIABIqCghtYXBfdHlwZRgHIAEoCzIWLmNlbC5leHByLlR5cGUuTWFwVHlwZUgAEi8KCGZ1bmN0aW9uGAggASgLMhsuY2VsLmV4cHIuVHlwZS5GdW5jdGlvblR5cGVIABIWCgxtZXNzYWdlX3R5cGUYCSABKAlIABIUCgp0eXBlX3BhcmFtGAogASgJSAASHgoEdHlwZRgLIAEoCzIOLmNlbC5leHByLlR5cGVIABInCgVlcnJvchgMIAEoCzIWLmdvb2dsZS5wcm90b2J1Zi5FbXB0eUgAEjQKDWFic3RyYWN0X3R5cGUYDiABKAsyGy5jZWwuZXhwci5UeXBlLkFic3RyYWN0VHlwZUgAGi0KCExpc3RUeXBlEiEKCWVsZW1fdHlwZRgBIAEoCzIOLmNlbC5leHByLlR5cGUaTwoHTWFwVHlwZRIgCghrZXlfdHlwZRgBIAEoCzIOLmNlbC5leHByLlR5cGUSIgoKdmFsdWVfdHlwZRgCIAEoCzIOLmNlbC5leHByLlR5cGUaVgoMRnVuY3Rpb25UeXBlEiMKC3Jlc3VsdF90eXBlGAEgASgLMg4uY2VsLmV4cHIuVHlwZRIhCglhcmdfdHlwZXMYAiADKAsyDi5jZWwuZXhwci5UeXBlGkUKDEFic3RyYWN0VHlwZRIMCgRuYW1lGAEgASgJEicKD3BhcmFtZXRlcl90eXBlcxgCIAMoCzIOLmNlbC5leHByLlR5cGUicwoNUHJpbWl0aXZlVHlwZRIeChpQUklNSVRJVkVfVFlQRV9VTlNQRUNJRklFRBAAEggKBEJPT0wQARIJCgVJTlQ2NBACEgoKBlVJTlQ2NBADEgoKBkRPVUJMRRAEEgoKBlNUUklORxAFEgkKBUJZVEVTEAYiVgoNV2VsbEtub3duVHlwZRIfChtXRUxMX0tOT1dOX1RZUEVfVU5TUEVDSUZJRUQQABIHCgNBTlkQARINCglUSU1FU1RBTVAQAhIMCghEVVJBVElPThADQgsKCXR5cGVfa2luZCLWAwoERGVjbBIMCgRuYW1lGAEgASgJEikKBWlkZW50GAIgASgLMhguY2VsLmV4cHIuRGVjbC5JZGVudERlY2xIABIvCghmdW5jdGlvbhgDIAEoCzIbLmNlbC5leHByLkRlY2wuRnVuY3Rpb25EZWNsSAAaWQoJSWRlbnREZWNsEhwKBHR5cGUYASABKAsyDi5jZWwuZXhwci5UeXBlEiEKBXZhbHVlGAIgASgLMhIuY2VsLmV4cHIuQ29uc3RhbnQSCwoDZG9jGAMgASgJGvsBCgxGdW5jdGlvbkRlY2wSNwoJb3ZlcmxvYWRzGAEgAygLMiQuY2VsLmV4cHIuRGVjbC5GdW5jdGlvbkRlY2wuT3ZlcmxvYWQSCwoDZG9jGAIgASgJGqQBCghPdmVybG9hZBITCgtvdmVybG9hZF9pZBgBIAEoCRIeCgZwYXJhbXMYAiADKAsyDi5jZWwuZXhwci5UeXBlEhMKC3R5cGVfcGFyYW1zGAMgAygJEiMKC3Jlc3VsdF90eXBlGAQgASgLMg4uY2VsLmV4cHIuVHlwZRIcChRpc19pbnN0YW5jZV9mdW5jdGlvbhgFIAEoCBILCgNkb2MYBiABKAlCCwoJZGVjbF9raW5kIlEKCVJlZmVyZW5jZRIMCgRuYW1lGAEgASgJEhMKC292ZXJsb2FkX2lkGAMgAygJEiEKBXZhbHVlGAQgASgLMhIuY2VsLmV4cHIuQ29uc3RhbnRCLAoMZGV2LmNlbC5leHByQglEZWNsUHJvdG9QAVoMY2VsLmRldi9leHBy+AEBYgZwcm90bzM",[file_cel_expr_syntax,file_google_protobuf_empty2,file_google_protobuf_struct2]),CheckedExprSchema=messageDesc3(file_cel_expr_checked,0);var Type_PrimitiveType;(function(Type_PrimitiveType2){Type_PrimitiveType2[Type_PrimitiveType2.PRIMITIVE_TYPE_UNSPECIFIED=0]="PRIMITIVE_TYPE_UNSPECIFIED",Type_PrimitiveType2[Type_PrimitiveType2.BOOL=1]="BOOL",Type_PrimitiveType2[Type_PrimitiveType2.INT64=2]="INT64",Type_PrimitiveType2[Type_PrimitiveType2.UINT64=3]="UINT64",Type_PrimitiveType2[Type_PrimitiveType2.DOUBLE=4]="DOUBLE",Type_PrimitiveType2[Type_PrimitiveType2.STRING=5]="STRING",Type_PrimitiveType2[Type_PrimitiveType2.BYTES=6]="BYTES"})(Type_PrimitiveType||(Type_PrimitiveType={}));var Type_WellKnownType;(function(Type_WellKnownType2){Type_WellKnownType2[Type_WellKnownType2.WELL_KNOWN_TYPE_UNSPECIFIED=0]="WELL_KNOWN_TYPE_UNSPECIFIED",Type_WellKnownType2[Type_WellKnownType2.ANY=1]="ANY",Type_WellKnownType2[Type_WellKnownType2.TIMESTAMP=2]="TIMESTAMP",Type_WellKnownType2[Type_WellKnownType2.DURATION=3]="DURATION"})(Type_WellKnownType||(Type_WellKnownType={}));function accessByIndex(obj,index2){if(!(typeof obj!="object"||obj===null)){if(isCelMap(obj))return obj.get(index2);if(isCelList(obj))return obj.get(Number(index2))}}function accessByName(obj,name){if(typeof obj!="object"||obj===null)return;if(isCelMap(obj))return obj.get(name);if(obj=unwrapAny(obj),!isReflectMessage2(obj))return;let field3=obj.desc.fields.find(f5=>f5.name===name);if(field3)switch(field3.fieldKind){case"enum":return BigInt(obj.get(field3));case"list":return celList(obj.get(field3));case"map":return celMap(obj.get(field3));case"scalar":return celFromScalar(field3.scalar,obj.get(field3));case"message":if(obj.isSet(field3))return reflectMsgToCel(obj.get(field3));if(isWrapperDesc2(field3.message))return null;switch(field3.message.typeName){case StructSchema.typeName:return EMPTY_MAP;case ListValueSchema.typeName:return EMPTY_LIST;case ValueSchema.typeName:return null}return reflect2(field3.message)}}function isSet(obj,name){if(typeof obj!="object"||obj===null)return!1;if(isCelMap(obj))return obj.has(name);if(obj=unwrapAny(obj),isReflectMessage2(obj)){let field3=obj.desc.fields.find(f5=>f5.name===name);return field3?obj.isSet(field3):void 0}return!1}function attrAccess(factory,vars,obj,accAttr){let val=accAttr.resolve(vars);return val===void 0?void 0:isCelError(val)?val:factory.newAccess(accAttr.id,val,accAttr.isOptional()).access(vars,obj)}function attrIsPresent(factory,vars,obj,accAttr){let val=accAttr.resolve(vars);return val===void 0?!1:isCelError(val)?val:factory.newAccess(accAttr.id,val,accAttr.isOptional()).isPresent(vars,obj)}function attrAccessIfPresent(factory,vars,obj,accAttr,presenceOnly){let val=accAttr.resolve(vars);return val===void 0?void 0:isCelError(val)?val:factory.newAccess(accAttr.id,val,accAttr.isOptional()).accessIfPresent(vars,obj,presenceOnly)}function applyAccesses(vars,obj,accesses){if(accesses.length===0)return obj;let cur=obj;for(let access of accesses){let result=access.access(vars,cur);if(result===void 0)return;if(isCelError(result))return result;cur=result}return cur}var AbsoluteAttr=class{id;nsNames;accesses_;registry;factory;constructor(id,nsNames,accesses_,registry,factory){if(this.id=id,this.nsNames=nsNames,this.accesses_=accesses_,this.registry=registry,this.factory=factory,nsNames.length===0)throw new Error("No names provided")}isOptional(){return!1}addAccess(access){this.accesses_.push(access)}candidateNames(){return this.nsNames}accesses(){return this.accesses_}access(vars,obj){return attrAccess(this.factory,vars,obj,this)}isPresent(vars,obj){return attrIsPresent(this.factory,vars,obj,this)}accessIfPresent(vars,obj,presenceOnly){return attrAccessIfPresent(this.factory,vars,obj,this,presenceOnly)}resolve(vars){for(let name of this.nsNames){let raw=vars.resolve(name);if(raw!==void 0)return isCelError(raw)?raw:applyAccesses(vars,raw,this.accesses_);let typ=this.findIdent(name);if(typ!==void 0&&this.accesses_.length===0)return typ}}findIdent(ident){let desc=this.registry.getMessage(ident);if(desc)return objectType(desc);if(ident.indexOf(".")>1){let lastDot=ident.lastIndexOf("."),enumName=ident.substring(0,lastDot),valueName=ident.substring(lastDot+1),descEnum=this.registry.getEnum(enumName);if(descEnum){let enumValue=descEnum.values.find(v=>v.name===valueName);if(enumValue)return BigInt(enumValue.number)}}switch(ident){case"int":return CelScalar.INT;case"uint":return CelScalar.UINT;case"double":return CelScalar.DOUBLE;case"bool":return CelScalar.BOOL;case"string":return CelScalar.STRING;case"bytes":return CelScalar.BYTES;case"list":return listType(CelScalar.DYN);case"map":return mapType(CelScalar.DYN,CelScalar.DYN);case"null_type":return CelScalar.NULL;case"type":return CelScalar.TYPE;default:return}}},ConditionalAttr=class{id;cond;t;f;factory;constructor(id,cond,t,f5,factory){this.id=id,this.cond=cond,this.t=t,this.f=f5,this.factory=factory}isOptional(){return!1}addAccess(access){this.t.addAccess(access),this.f.addAccess(access)}access(vars,obj){return attrAccess(this.factory,vars,obj,this)}isPresent(vars,obj){return attrIsPresent(this.factory,vars,obj,this)}accessIfPresent(vars,obj,presenceOnly){return attrAccessIfPresent(this.factory,vars,obj,this,presenceOnly)}resolve(vars){let cond=this.cond.eval(vars);switch(!0){case cond===!0:return this.t.resolve(vars);case cond===!1:return this.f.resolve(vars);case isCelError(cond):return cond}return celError(`found no matching overload for _?_:_ applied to '(${celType(cond).name})'`,this.id)}},MaybeAttr=class{id;attrs;factory;constructor(id,attrs,factory){this.id=id,this.attrs=attrs,this.factory=factory}isOptional(){return!1}addAccess(access){let augmentedNames=[],str2;access instanceof StringAccess&&(str2=access.name);for(let attr of this.attrs){if(str2!==void 0&&attr.accesses().length===0)for(let name of attr.candidateNames())augmentedNames.push(name+"."+str2);attr.addAccess(access)}if(augmentedNames.length>0){let newAttr=this.factory.createAbsolute(this.id,augmentedNames);this.attrs.unshift(newAttr)}}access(vars,obj){return attrAccess(this.factory,vars,obj,this)}isPresent(vars,obj){return attrIsPresent(this.factory,vars,obj,this)}accessIfPresent(vars,obj,presenceOnly){return attrAccessIfPresent(this.factory,vars,obj,this,presenceOnly)}resolve(vars){for(let attr of this.attrs){let val=attr.resolve(vars);if(val!==void 0)return val}}},RelativeAttr=class{id;operand;accesses_;factory;constructor(id,operand,accesses_,factory){this.id=id,this.operand=operand,this.accesses_=accesses_,this.factory=factory}isOptional(){return!1}addAccess(access){this.accesses_.push(access)}access(vars,obj){return attrAccess(this.factory,vars,obj,this)}isPresent(vars,obj){return attrIsPresent(this.factory,vars,obj,this)}accessIfPresent(vars,obj,presenceOnly){return attrAccessIfPresent(this.factory,vars,obj,this,presenceOnly)}resolve(vars){let v=this.operand.eval(vars);return isCelError(v)?v:applyAccesses(vars,v,this.accesses_)}},StringAccess=class{id;name;celVal;optional;constructor(id,name,celVal,optional){this.id=id,this.name=name,this.celVal=celVal,this.optional=optional}isOptional(){return this.optional}access(_vars,obj){let val=accessByName(obj,this.name);return val===void 0&&!this.optional?fieldNotFound(this.id,this.name):val}isPresent(_vars,obj){let set2=isSet(obj,this.name);return set2===void 0?fieldNotFound(this.id,this.name):set2}accessIfPresent(_vars,obj,presenceOnly){let val=accessByName(obj,this.name);return val===void 0&&!this.optional&&!presenceOnly?fieldNotFound(this.id,this.name):val}},BoolAccess=class{id;index;optional;constructor(id,index2,optional){this.id=id,this.index=index2,this.optional=optional}isOptional(){return this.optional}access(_vars,obj){if(obj===void 0)return obj;let raw=accessByIndex(obj,this.index);return raw===void 0&&!this.optional?fieldNotFound(this.id,this.index):raw}isPresent(_vars,obj){return accessByIndex(obj,this.index)===void 0&&!this.optional?fieldNotFound(this.id,this.index):!0}accessIfPresent(_vars,obj,_presenceOnly){let raw=accessByIndex(obj,this.index);return raw===void 0&&!this.optional?fieldNotFound(this.id,this.index):raw}},NumAccess=class{id;index;celVal;optional;constructor(id,index2,celVal,optional){this.id=id,this.index=index2,this.celVal=celVal,this.optional=optional}isOptional(){return this.optional}access(_vars,obj){if(obj===void 0)return obj;let raw=accessByIndex(obj,this.index);return raw===void 0&&!this.optional?indexOutOfBounds(this.id,this.index,-1):raw}isPresent(_vars,obj){return accessByIndex(obj,this.index)===void 0&&!this.optional?indexOutOfBounds(this.id,this.index,-1):!0}accessIfPresent(_vars,obj,_presenceOnly){let raw=accessByIndex(obj,this.index);return raw===void 0&&!this.optional?indexOutOfBounds(this.id,this.index,-1):raw}},IntAccess=class{id;index;celVal;optional;constructor(id,index2,celVal,optional){this.id=id,this.index=index2,this.celVal=celVal,this.optional=optional}access(_vars,obj){if(obj===void 0)return obj;let raw=accessByIndex(obj,this.index);return raw===void 0&&!this.optional?indexOutOfBounds(this.id,Number(this.index),-1):raw}isPresent(_vars,obj){return accessByIndex(obj,this.index)===void 0&&!this.optional?indexOutOfBounds(this.id,Number(this.index),-1):!0}accessIfPresent(_vars,obj,_presenceOnly){let raw=accessByIndex(obj,this.index);return raw===void 0&&!this.optional?indexOutOfBounds(this.id,Number(this.index),-1):raw}isOptional(){return this.optional}},ErrorAttr=class{id;error;opt;constructor(id,error2,opt){this.id=id,this.error=error2,this.opt=opt}addAccess(_access){}resolve(_vars){return this.error}isOptional(){return this.opt}access(_vars,_obj){return this.error}isPresent(_vars,_obj){return this.error}accessIfPresent(_vars,_obj,_presenceOnly){return this.error}},EvalAccess=class{id;key;factory;optional;constructor(id,key,factory,optional){this.id=id,this.key=key,this.factory=factory,this.optional=optional}access(vars,obj){if(obj===void 0)return obj;let key=this.key.eval(vars);return isCelError(key)?key:this.factory.newAccess(this.id,key,this.optional).access(vars,obj)}isPresent(vars,obj){if(obj===void 0)return!1;let key=this.key.eval(vars);return isCelError(key)?key:this.factory.newAccess(this.id,key,this.optional).isPresent(vars,obj)}accessIfPresent(vars,obj,presenceOnly){let key=this.key.eval(vars);return isCelError(key)?key:this.factory.newAccess(this.id,key,this.optional).accessIfPresent(vars,obj,presenceOnly)}isOptional(){return this.optional}},ConcreteAttributeFactory=class{registry;container;constructor(registry,container){this.registry=registry,this.container=container}createAbsolute(id,names){return new AbsoluteAttr(id,names,[],this.registry,this)}createConditional(id,cond,t,f5){return new ConditionalAttr(id,cond,t,f5,this)}createMaybe(id,name){return new MaybeAttr(id,[this.createAbsolute(id,this.container.resolveCandidateNames(name))],this)}createRelative(id,operand){return new RelativeAttr(id,operand,[],this)}newAccess(id,val,opt){switch(typeof val){case"boolean":return new BoolAccess(id,val,opt);case"number":return new NumAccess(id,val,val,opt);case"bigint":return new IntAccess(id,val,val,opt);case"string":return new StringAccess(id,val,val,opt);case"object":if(val instanceof EvalAttr)return new EvalAccess(id,val,this,opt);if(isCelUint(val))return new IntAccess(id,val.value,val,opt);break;default:break}return new ErrorAttr(id,celError("unsupported key type",id),opt)}};function fieldNotFound(id,name){return celError(`field not found: ${String(name)}`,id)}function indexOutOfBounds(id,index2,length){return celError(`index ${index2} out of bounds [0, ${length})`,id)}var ObjectActivation=class{data;constructor(data){this.data=data}resolve(name){let value=this.data[name];if(value!==void 0)return isCelError(value)?value:toCel(value)}},VarActivation=class{name;value;parent;constructor(name,value,parent){this.name=name,this.value=value,this.parent=parent}resolve(name){return name===this.name?this.value:this.parent.resolve(name)}},EMPTY_ACTIVATION={resolve(){}};function celObject(typeName,fields2){let desc=getMsgDesc(typeName),msg=reflect2(desc);for(let[k5,v]of fields2.entries()){let field3=desc.fields.find(f5=>f5.name===k5);if(field3===void 0)throw new Error(`Unknown field ${k5} for ${typeName}`);setMsgField(msg,field3,v)}return reflectMsgToCel(msg)}function setMsgField(msg,field3,v){switch(field3.fieldKind){case"list":if(!isCelList(v))throw unexpectedTypeError(field3,"list",v);let list12=reflectList(field3,void 0,!1);copyList(list12,v),msg.set(field3,list12);return;case"map":if(!isCelMap(v))throw unexpectedTypeError(field3,"map",v);let map5=reflectMap(field3,void 0,!1);copyMap(map5,v),msg.set(field3,map5);return;case"enum":msg.set(field3,enumFromCel(field3,v));return;case"message":let msgVal=msgFromCel(field3,v);msgVal!==null&&msg.set(field3,msgVal);return}msg.set(field3,scalarFromCel(field3,field3.scalar,v))}function copyList(list12,cList){let field3=list12.field();for(let v of cList)switch(field3.listKind){case"enum":list12.add(enumFromCel(field3,v));break;case"message":list12.add(msgFromCel(field3,v));break;case"scalar":list12.add(scalarFromCel(field3,field3.scalar,v));break}}function copyMap(map5,cMap){let field3=map5.field();for(let[k5,v]of cMap.entries()){let key=scalarFromCel(field3,field3.mapKey,k5);switch(field3.mapKind){case"enum":map5.set(key,enumFromCel(field3,v));break;case"scalar":map5.set(key,scalarFromCel(field3,field3.scalar,v));break;case"message":map5.set(key,msgFromCel(field3,v));break}}}function enumFromCel(field3,v){if(typeof v!="bigint")throw unexpectedTypeError(field3,"int",v);return intToInt32(v)}function msgFromCel(field3,v){switch(field3.message.typeName){case AnySchema.typeName:return isReflectMessage2(v,AnySchema)?v:reflect2(AnySchema,anyFromCel(v));case ValueSchema.typeName:return reflect2(ValueSchema,valueFromCel(v));case StructSchema.typeName:if(!isCelMap(v))throw unexpectedTypeError(field3,"map",v);return reflect2(StructSchema,structFromCel(v));case ListValueSchema.typeName:if(!isCelList(v))throw unexpectedTypeError(field3,"list",v);return reflect2(ListValueSchema,listValueFromCel(v))}if(v===null)return null;if(isWrapperDesc2(field3.message)){let msg=reflect2(field3.message,void 0,!1);return msg.set(field3.message.fields[0],scalarFromCel(field3.message.fields[0],field3.message.fields[0].scalar,v)),msg}if(!isReflectMessage2(v,field3.message))throw unexpectedTypeError(field3,field3.message.typeName,v);return v}function anyFromCel(v){switch(typeof v){case"string":return anyPack(StringValueSchema,create2(StringValueSchema,{value:v}));case"boolean":return anyPack(BoolValueSchema,create2(BoolValueSchema,{value:v}));case"bigint":return anyPack(Int64ValueSchema,create2(Int64ValueSchema,{value:v}));case"number":return anyPack(DoubleValueSchema,create2(DoubleValueSchema,{value:v}));default:switch(!0){case v instanceof Uint8Array:return anyPack(BytesValueSchema,create2(BytesValueSchema,{value:v}));case v==null:return anyPack(ValueSchema,create2(ValueSchema,{kind:{case:"nullValue",value:NullValue2.NULL_VALUE}}));case isCelList(v):return anyPack(ListValueSchema,listValueFromCel(v));case isCelMap(v):return anyPack(StructSchema,structFromCel(v));case isCelUint(v):return anyPack(UInt64ValueSchema,create2(UInt64ValueSchema,{value:v.value}));case isReflectMessage2(v):return anyPack(v.desc,v.message);default:throw new Error(`type cannot be converted ${AnySchema}`)}}}function valueFromCel(v){let value=create2(ValueSchema);switch(typeof v){case"string":value.kind={case:"stringValue",value:v};break;case"boolean":value.kind={case:"boolValue",value:v};break;case"bigint":v>BigInt(Number.MAX_SAFE_INTEGER)||v<BigInt(Number.MIN_SAFE_INTEGER)?value.kind={case:"stringValue",value:v.toString()}:value.kind={case:"numberValue",value:Number(v)};break;case"number":Number.isNaN(v)?value.kind={case:"stringValue",value:"NaN"}:v===Number.POSITIVE_INFINITY?value.kind={case:"stringValue",value:"Infinity"}:v===Number.NEGATIVE_INFINITY?value.kind={case:"stringValue",value:"-Infinity"}:value.kind={case:"numberValue",value:Number(v)};break;default:switch(!0){case v instanceof Uint8Array:value.kind={case:"stringValue",value:base64Encode(v)};break;case v==null:value.kind={case:"nullValue",value:NullValue2.NULL_VALUE};break;case isCelList(v):value.kind={case:"listValue",value:listValueFromCel(v)};break;case isCelMap(v):value.kind={case:"structValue",value:structFromCel(v)};break;case isCelUint(v):v.value>BigInt(Number.MAX_SAFE_INTEGER)?value.kind={case:"stringValue",value:v.value.toString()}:value.kind={case:"numberValue",value:Number(v.value)};break;case isReflectMessage2(v):return fromJson(ValueSchema,toJson(v.desc,v.message));default:throw new Error(`type cannot be converted ${ValueSchema}`)}}return value}function listValueFromCel(list12){let listValue=create2(ListValueSchema);for(let v of list12)listValue.values.push(valueFromCel(v));return listValue}function structFromCel(map5){let struct2=create2(StructSchema);for(let[k5,v]of map5.entries()){if(typeof k5!="string")throw new Error(`Invalid key type: ${typeof k5} for google.protobuf.Struct, expected string`);struct2.fields[k5]=valueFromCel(v)}return struct2}function scalarFromCel(field3,type2,v){switch(isCelUint(v)&&(v=v.value),type2){case ScalarType2.UINT32:case ScalarType2.FIXED32:if(typeof v!="bigint")throw unexpectedTypeError(field3,"int",v);return intToUint32(v);case ScalarType2.INT32:case ScalarType2.SINT32:case ScalarType2.SFIXED32:if(typeof v!="bigint")throw unexpectedTypeError(field3,"int",v);return intToInt32(v);case ScalarType2.UINT64:case ScalarType2.FIXED64:case ScalarType2.INT64:case ScalarType2.SINT64:case ScalarType2.SFIXED64:if(typeof v!="bigint")throw unexpectedTypeError(field3,"int",v);return v;case ScalarType2.FLOAT:if(typeof v!="number")throw unexpectedTypeError(field3,"double",v);return Math.fround(v);case ScalarType2.DOUBLE:if(typeof v!="number")throw unexpectedTypeError(field3,"double",v);return v;case ScalarType2.STRING:if(typeof v!="string")throw unexpectedTypeError(field3,"string",v);return v;case ScalarType2.BOOL:if(typeof v!="boolean")throw unexpectedTypeError(field3,"bool",v);return v;case ScalarType2.BYTES:if(!(v instanceof Uint8Array))throw unexpectedTypeError(field3,"bytes",v);return v}}function unexpectedTypeError(field3,expected,actValue){return new Error(`Expected ${expected} but got ${celType(actValue)} for ${field3.parent}.${field3.name}`)}function intToInt32(v){if(v<INT32_MIN2||v>INT32_MAX2)throw new Error("int32 out of range");return Number(v)}function intToUint32(v){if(v<0||v>UINT32_MAX2)throw new Error("uint32 out of range");return Number(v)}var Planner=class{functions;registry;namespace;factory;constructor(functions,registry,namespace=Namespace.ROOT){this.functions=functions,this.registry=registry,this.namespace=namespace,this.factory=new ConcreteAttributeFactory(this.registry,this.namespace)}plan(expr){let id=Number(expr.id);switch(expr.exprKind.case){case"identExpr":return new EvalAttr(this.factory.createMaybe(id,expr.exprKind.value.name),!1);case"constExpr":return new EvalConst(id,this.constVal(expr.exprKind.value));case"callExpr":return this.planCall(id,expr.exprKind.value);case"listExpr":return this.planCreateList(id,expr.exprKind.value);case"structExpr":return this.planCreateStruct(id,expr.exprKind.value);case"selectExpr":return this.planSelect(id,expr.exprKind.value);case"comprehensionExpr":return this.planComprehension(id,expr.exprKind.value);default:return new EvalErr(id,"invalid expression")}}planComprehension(id,value){if(value.accuInit===void 0||value.iterRange===void 0||value.loopCondition===void 0||value.loopStep===void 0||value.result===void 0)throw new Error("invalid comprehension");let accu=this.plan(value.accuInit),iterRange=this.plan(value.iterRange),cond=this.plan(value.loopCondition),step=this.plan(value.loopStep),result=this.plan(value.result);return new EvalFold(id,value.accuVar,value.iterVar,iterRange,accu,cond,step,result)}planSelect(id,expr){if(expr.operand===void 0)throw new Error("invalid select");let operand=this.plan(expr.operand),attr=this.relativeAttr(id,operand,!1),acc=this.factory.newAccess(id,expr.field,!1);if(acc instanceof ErrorAttr)throw new Error(`invalid select: ${acc.error.message}`);return expr.testOnly?new EvalHas(id,attr,acc,expr.field):(attr.addAccess(acc),attr)}planCreateObj(id,expr){let typeName=this.resolveType(expr.messageName);if(typeName===void 0)return new EvalErr(id,"unknown type: "+expr.messageName);let optionals,keys=[],values=[];for(let i6=0;i6<expr.entries.length;i6++){let entry=expr.entries[i6];switch(entry.optionalEntry&&(optionals===void 0&&(optionals=new Array(expr.entries.length).fill(!1)),optionals[i6]=!0),entry.keyKind.case){case"fieldKey":keys.push(entry.keyKind.value);break;case"mapKey":throw new Error("invalid entry");default:break}if(entry.value===void 0)throw new Error("invalid entry");values.push(this.plan(entry.value))}return new EvalObj(id,typeName,keys,values,optionals)}planCreateStruct(id,expr){if(expr.messageName!=="")return this.planCreateObj(id,expr);let optionals,keys=[],values=[];for(let i6=0;i6<expr.entries.length;i6++){let entry=expr.entries[i6];switch(entry.optionalEntry&&(optionals===void 0&&(optionals=new Array(expr.entries.length).fill(!1)),optionals[i6]=!0),entry.keyKind.case){case"fieldKey":throw new Error("unimplemented");case"mapKey":keys.push(this.plan(entry.keyKind.value));break;default:break}if(entry.value===void 0)return new EvalErr(id,"map entry missing value");values.push(this.plan(entry.value))}return new EvalMap(id,keys,values,optionals)}planCreateList(id,expr){if(expr.optionalIndices.length>0){let optionals2=new Array(expr.elements.length).fill(!1);for(let i6=0;i6<expr.optionalIndices.length;i6++){let index2=expr.optionalIndices[i6];if(index2<0||index2>=expr.elements.length)throw new Error("invalid optional index");optionals2[index2]=!0}}return new EvalList(id,expr.elements.map(arg=>this.plan(arg)),void 0)}planCall(id,call){if(call.target!==void 0){let qualName=toQualifiedName(call.target);if(qualName!==void 0){let funcName=qualName+"."+call.function;for(let candidate of this.namespace.resolveCandidateNames(funcName)){let func=this.functions.find(candidate);if(func!==void 0)return new EvalCall(id,candidate,"",void 0,func,call.args.map(arg=>this.plan(arg)))}}}let args=call.args.map(arg=>this.plan(arg));switch(call.target&&(args=[this.plan(call.target),...args]),call.function){case INDEX:return this.planCallIndex(call,args,!1);case OPT_INDEX:case OPT_SELECT:return this.planCallIndex(call,args,!0);case CONDITIONAL:return this.planCallConditional(id,call,args);case LOGICAL_AND:return new EvalAnd(id,args);case LOGICAL_OR:return new EvalOr(id,args);case NOT_STRICTLY_FALSE:case OLD_NOT_STRICTLY_FALSE:return new EvalNotStrictlyFalse(id,args[0]);default:return new EvalCall(id,call.function,"",call.target?args[0]:void 0,this.functions.find(call.function),call.target?args.slice(1):args)}}planCallConditional(id,_call,args){let cond=args[0],t=args[1],f5=args[2],tAttr=this.relativeAttr(t.id,t,!1),fAttr=this.relativeAttr(f5.id,f5,!1);return new EvalAttr(this.factory.createConditional(id,cond,tAttr,fAttr),!1)}planCallIndex(_call,args,opt){let op2=args[0],ind=args[1],attr=this.relativeAttr(op2.id,op2,!1),acc;return ind instanceof EvalConst?acc=this.factory.newAccess(op2.id,ind.value,opt):ind instanceof EvalAttr?acc=this.factory.newAccess(op2.id,ind,opt):acc=this.relativeAttr(op2.id,ind,opt),attr.addAccess(acc),attr}constVal(val){switch(val.constantKind.case){case"stringValue":return val.constantKind.value;case"bytesValue":return val.constantKind.value;case"doubleValue":return val.constantKind.value;case"boolValue":return val.constantKind.value;case"int64Value":return val.constantKind.value;case"uint64Value":return celUint(val.constantKind.value);case"nullValue":return null;case void 0:throw new Error("invalid constant");default:throw new Error(`unimplemented: ${val.constantKind.case}`)}}relativeAttr(id,e6,opt){return e6 instanceof EvalAttr?e6:new EvalAttr(this.factory.createRelative(id,e6),opt)}resolveType(name){for(let candidate of this.namespace.resolveCandidateNames(name))if(this.isKnownType(candidate))return candidate}isKnownType(name){switch(name){case"google.protobuf.Value":case"google.protobuf.Struct":case"google.protobuf.ListValue":case"google.protobuf.NullValue":case"google.protobuf.BoolValue":case"google.protobuf.UInt32Value":case"google.protobuf.UInt64Value":case"google.protobuf.Int32Value":case"google.protobuf.Int64Value":case"google.protobuf.FloatValue":case"google.protobuf.DoubleValue":case"google.protobuf.StringValue":case"google.protobuf.BytesValue":case"google.protobuf.Timestamp":case"google.protobuf.Duration":case"google.protobuf.Any":return!0;default:return this.registry.getMessage(name)!==void 0}}},EvalHas=class{id;attr;access;field;constructor(id,attr,access,field3){this.id=id,this.attr=attr,this.access=access,this.field=field3}eval(ctx){let raw=this.attr.resolve(ctx);return raw===void 0?!1:isCelError(raw)?raw:this.access.isPresent(ctx,raw)}},EvalErr=class{id;msg;constructor(id,msg){this.id=id,this.msg=msg}eval(_ctx){return celError(this.msg,this.id)}},EvalConst=class{id;value;constructor(id,value){this.id=id,this.value=value}eval(_ctx){return this.value}},EvalAttr=class{attr;opt;id;constructor(attr,opt){this.attr=attr,this.opt=opt,this.id=attr.id}access(vars,obj){return this.attr.access(vars,obj)}isPresent(vars,obj){return this.attr.isPresent(vars,obj)}accessIfPresent(vars,obj,presenceOnly){return this.attr.accessIfPresent(vars,obj,presenceOnly)}isOptional(){return this.opt}eval(ctx){let val=this.attr.resolve(ctx);return val===void 0?celError("unresolved attribute",this.id):(isCelError(val),val)}resolve(vars){return this.attr.resolve(vars)}addAccess(acc){this.attr.addAccess(acc)}},EvalCall=class{id;name;overload;target;func;args;constructor(id,name,overload,target,func,args){this.id=id,this.name=name,this.overload=overload,this.target=target,this.func=func,this.args=args}eval(ctx){if(this.func===void 0)return celError(`unbound function: ${this.name}`,this.id);let target=this.target?.eval(ctx);if(isCelError(target))return target;let vals=[];for(let arg of this.args){let val=arg.eval(ctx);if(isCelError(val))return val;vals.push(val)}let result=this.func.call(this.id,target,vals);return result!==void 0?result:celError(`found no matching overload for '${this.name}' applied to '${target!==void 0?`${celType(target)}.`:""}(${vals.map(x2=>celType(x2)).map(x2=>x2.name).join(", ")})'`,this.id)}},EvalObj=class{id;typeName;fields;values;optionals;constructor(id,typeName,fields2,values,optionals){this.id=id,this.typeName=typeName,this.fields=fields2,this.values=values,this.optionals=optionals}args(){return this.values}eval(ctx){let vals=coerceToValues(this.values.map(x2=>x2.eval(ctx)));if(isCelError(vals))return vals;let obj=new Map;for(let i6=0;i6<vals.length;i6++){if(obj.has(this.fields[i6]))return celError(`map key conflict: ${this.fields[i6]}`,this.id);obj.set(this.fields[i6],vals[i6])}try{return celObject(this.typeName,obj)}catch(ex){return ex instanceof Error&&(ex=ex.message),celError(`${ex}`,this.id)}}},EvalList=class{id;elems;constructor(id,elems,_){this.id=id,this.elems=elems}eval(ctx){if(this.elems.length===0)return EMPTY_LIST;let first=this.elems[0].eval(ctx);if(isCelError(first))return first;let elemVals=[first];for(let i6=1;i6<this.elems.length;i6++){let elemVal=this.elems[i6].eval(ctx);if(isCelError(elemVal))return elemVal;elemVals.push(elemVal)}return celList(elemVals)}args(){return this.elems}},EvalMap=class{id;keys;values;constructor(id,keys,values,_){this.id=id,this.keys=keys,this.values=values}args(){return this.keys.concat(this.values)}eval(ctx){if(this.keys.length===0)return EMPTY_MAP;let entries=new Map,firstKey=this.mapKeyOrError(this.keys[0].eval(ctx));if(isCelError(firstKey))return firstKey;let firstVal=this.values[0].eval(ctx);if(isCelError(firstVal))return firstVal;if(typeof firstKey=="number"&&!Number.isInteger(firstKey))return unsupportedKeyType(this.id);entries.set(firstKey,firstVal);for(let i6=1;i6<this.keys.length;i6++){let key=this.mapKeyOrError(this.keys[i6].eval(ctx));if(isCelError(key))return key;let val=this.values[i6].eval(ctx);if(isCelError(val))return val;if(entries.has(key))return celError(`map key conflict: ${key}`,this.id);if(typeof key=="number"&&!Number.isInteger(key))return unsupportedKeyType(this.id);entries.set(key,val)}return celMap(entries)}mapKeyOrError(key){switch(typeof key){case"boolean":case"bigint":case"string":return key;case"object":return isCelUint(key)?key:unsupportedKeyType(this.id);case"number":return Number.isInteger(key)?BigInt(key):unsupportedKeyType(this.id);default:return unsupportedKeyType(this.id)}}},EvalFold=class{id;accuVar;iterVar;iterRange;accu;cond;step;result;constructor(id,accuVar,iterVar,iterRange,accu,cond,step,result){this.id=id,this.accuVar=accuVar,this.iterVar=iterVar,this.iterRange=iterRange,this.accu=accu,this.cond=cond,this.step=step,this.result=result}eval(ctx){let accuInit=this.accu.eval(ctx);if(isCelError(accuInit))return accuInit;let accuCtx=new VarActivation(this.accuVar,accuInit,ctx),iterRange=this.iterRange.eval(ctx);if(isCelError(iterRange))return iterRange;let items=[];if(isCelMap(iterRange))items=Array.from(iterRange.keys());else if(isCelList(iterRange))items=Array.from(iterRange);else return celError(`type mismatch: iterable vs ${celType(iterRange)}`,this.id);for(let item of items){if(isCelError(item))return item;let iterCtx=new VarActivation(this.iterVar,item,accuCtx),cond=this.cond.eval(iterCtx);if(isCelError(cond))return cond;if(cond!==!0)break;accuCtx.value=this.step.eval(iterCtx)}return this.result.eval(accuCtx)}},EvalAnd=class{id;args;constructor(id,args){this.id=id,this.args=args}eval(ctx){let errors=[];for(let arg of this.args){let val=arg.eval(ctx);if(typeof val=="boolean"){if(!val)return!1;continue}isCelError(val)?errors.push(val):errors.push(celError(`type mismatch: expected bool, got ${celType(val)}`,this.id))}return errors.length>0?celErrorMerge(errors[0],...errors.slice(1)):!0}},EvalOr=class{id;args;constructor(id,args){this.id=id,this.args=args}eval(ctx){let errors=[];for(let arg of this.args){let val=arg.eval(ctx);if(typeof val=="boolean"){if(val)return!0;continue}isCelError(val)?errors.push(val):errors.push(celError(`type mismatch: expected bool, got ${celType(val)}`,this.id))}return errors.length>0?celErrorMerge(errors[0],...errors.slice(1)):!1}},EvalNotStrictlyFalse=class{id;arg;constructor(id,arg){this.id=id,this.arg=arg}eval(ctx){return this.arg.eval(ctx)!==!1}};function toQualifiedName(expr){switch(expr.exprKind.case){case"identExpr":return expr.exprKind.value.name;case"selectExpr":{if(expr.exprKind.value.testOnly||expr.exprKind.value.operand===void 0)return;let parent=toQualifiedName(expr.exprKind.value.operand);return parent===void 0?void 0:parent+"."+expr.exprKind.value.field}default:return}}function unsupportedKeyType(id){return celError("unsupported key type",id)}function coerceToValues(args){let errors=[];for(let i6=0;i6<args.length;i6++){let arg=args[i6];isCelError(arg)&&errors.push(arg)}return errors.length>0?celErrorMerge(errors[0],...errors.slice(1)):args}var cache=new WeakMap;function plan(env2,expr){let planner=cache.get(env2);planner===void 0&&(planner=new Planner(env2.funcs,env2.registry,env2.namespace),cache.set(env2,planner));let maybeExpr;isMessage2(expr,CheckedExprSchema)||isMessage2(expr,ParsedExprSchema)?maybeExpr=expr.expr:maybeExpr=expr;let plan2=planner.plan(maybeExpr??create2(ExprSchema)),withContext=withEvalContext({registry:env2.registry},{id:plan2.id,eval(ctx){try{let val=plan2.eval(ctx);return isCelError(val)?val:unwrapAny(val)}catch(ex){return celError(ex,plan2.id)}}});return ctx=>withContext.eval(ctx!==void 0?new ObjectActivation(ctx):EMPTY_ACTIVATION)}function isInf(sign4){return sign4??(sign4=0),sign4>=0&&this===Number.POSITIVE_INFINITY||sign4<=0&&this===Number.NEGATIVE_INFINITY}function isIp(version){return version==6?new Ipv6(this).address():version==4?new Ipv4(this).address():version===void 0||version==0?new Ipv4(this).address()||new Ipv6(this).address():!1}function isIpPrefix(version,strict=!1){if(version==6){let ip=new Ipv6(this);return ip.addressPrefix()&&(!strict||ip.isPrefixOnly())}if(version==4){let ip=new Ipv4(this);return ip.addressPrefix()&&(!strict||ip.isPrefixOnly())}return version===void 0||version==0?isIpPrefix.call(this,6,strict)||isIpPrefix.call(this,4,strict):!1}var Ipv4=class{constructor(str2){this.i=0,this.octets=[],this.prefixLen=0,this.str=str2,this.l=str2.length}getBits(){return this.octets.length!=4?0:(this.octets[0]<<24|this.octets[1]<<16|this.octets[2]<<8|this.octets[3])>>>0}isPrefixOnly(){let bits2=this.getBits(),mask=this.prefixLen==32?4294967295:~(4294967295>>>this.prefixLen)>>>0,masked=(bits2&mask)>>>0;return bits2==masked}address(){return this.addressPart()&&this.i==this.l}addressPrefix(){return this.addressPart()&&this.take("/")&&this.prefixLength()&&this.i==this.l}prefixLength(){let start=this.i;for(;this.digit();)if(this.i-start>2)return!1;let str2=this.str.substring(start,this.i);if(str2.length==0||str2.length>1&&str2[0]=="0")return!1;let value=parseInt(str2);return value>32?!1:(this.prefixLen=value,!0)}addressPart(){let start=this.i;return this.decOctet()&&this.take(".")&&this.decOctet()&&this.take(".")&&this.decOctet()&&this.take(".")&&this.decOctet()?!0:(this.i=start,!1)}decOctet(){let start=this.i;for(;this.digit();)if(this.i-start>3)return!1;let str2=this.str.substring(start,this.i);if(str2.length==0||str2.length>1&&str2[0]=="0")return!1;let value=parseInt(str2,10);return value>255?!1:(this.octets.push(value),!0)}digit(){let c5=this.str[this.i];return"0"<=c5&&c5<="9"?(this.i++,!0):!1}take(char){return this.str[this.i]==char?(this.i++,!0):!1}},Ipv6=class{constructor(str2){this.i=0,this.pieces=[],this.doubleColonAt=-1,this.doubleColonSeen=!1,this.dottedRaw="",this.zoneIdFound=!1,this.prefixLen=0,this.str=str2,this.l=str2.length}getBits(){let p16=this.pieces;if(this.dottedAddr!==void 0){let dotted32=this.dottedAddr.getBits();p16.push(dotted32>>>16),p16.push(dotted32&65535)}if(this.doubleColonSeen)for(;p16.length<8;)p16.splice(this.doubleColonAt,0,0);return p16.length!=8?[0,0,0,0]:[(p16[0]<<16|p16[1])>>>0,(p16[2]<<16|p16[3])>>>0,(p16[4]<<16|p16[5])>>>0,(p16[6]<<16|p16[7])>>>0]}isPrefixOnly(){for(let[i6,p32]of this.getBits().entries()){let len=this.prefixLen-32*i6,mask=len>=32?4294967295:len<0?0:~(4294967295>>>len)>>>0,masked=(p32&mask)>>>0;if(p32!==masked)return!1}return!0}address(){return this.addressPart()&&this.i==this.l}addressPrefix(){return this.addressPart()&&!this.zoneIdFound&&this.take("/")&&this.prefixLength()&&this.i==this.l}prefixLength(){let start=this.i;for(;this.digit();)if(this.i-start>3)return!1;let str2=this.str.substring(start,this.i);if(str2.length==0||str2.length>1&&str2[0]=="0")return!1;let value=parseInt(str2,10);return value>128?!1:(this.prefixLen=value,!0)}addressPart(){for(;this.i<this.l;){if((this.doubleColonSeen||this.pieces.length==6)&&this.dotted()){let dotted=new Ipv4(this.dottedRaw);return dotted.address()?(this.dottedAddr=dotted,!0):!1}let result=this.h16();if(result==="error")return!1;if(!result){if(this.take(":")){if(this.take(":")){if(this.doubleColonSeen||(this.doubleColonSeen=!0,this.doubleColonAt=this.pieces.length,this.take(":")))return!1}else if(this.i===1||this.i===this.str.length)return!1;continue}if(this.str[this.i]=="%"&&!this.zoneId())return!1;break}}return this.doubleColonSeen?this.pieces.length<8:this.pieces.length==8}zoneId(){let start=this.i;return this.take("%")&&this.l-this.i>0?(this.i=this.l,this.zoneIdFound=!0,!0):(this.i=start,this.zoneIdFound=!1,!1)}dotted(){let start=this.i;for(this.dottedRaw="";this.digit()||this.take("."););return this.i-start>=7?(this.dottedRaw=this.str.substring(start,this.i),!0):(this.i=start,!1)}h16(){let start=this.i;for(;this.hexdig(););let str2=this.str.substring(start,this.i);return str2.length==0?!1:str2.length>4?"error":(this.pieces.push(parseInt(str2,16)),!0)}hexdig(){let c5=this.str[this.i];return"0"<=c5&&c5<="9"||"a"<=c5&&c5<="f"||"A"<=c5&&c5<="F"||"0"<=c5&&c5<="9"?(this.i++,!0):!1}digit(){let c5=this.str[this.i];return"0"<=c5&&c5<="9"?(this.i++,!0):!1}take(char){return this.str[this.i]==char?(this.i++,!0):!1}};function isHostname(){if(this.length>253)return!1;let s2=this.endsWith(".")?this.substring(0,this.length-1):this,allDigits=!1;for(let part of s2.split(".")){allDigits=!0;let l3=part.length;if(l3==0||l3>63||part.startsWith("-")||part.endsWith("-"))return!1;for(let ch of part.split("")){if((ch<"a"||ch>"z")&&(ch<"A"||ch>"Z")&&(ch<"0"||ch>"9")&&ch!="-")return!1;allDigits=allDigits&&ch>="0"&&ch<="9"}}return!allDigits}function isHostAndPort(portRequired){if(this.length==0)return!1;let splitIdx=this.lastIndexOf(":");if(this[0]=="["){let end=this.lastIndexOf("]");switch(end+1){case this.length:return!portRequired&&isIp.call(this.substring(1,end),6);case splitIdx:return isIp.call(this.substring(1,end),6)&&isPort(this.substring(splitIdx+1));default:return!1}}if(splitIdx<0)return!portRequired&&(isHostname.call(this)||isIp.call(this,4));let host=this.substring(0,splitIdx),port=this.substring(splitIdx+1);return(isHostname.call(host)||isIp.call(host,4))&&isPort(port)}function isPort(str2){if(str2.length==0)return!1;for(let i6=0;i6<str2.length;i6++){let c5=str2[i6];if(!("0"<=c5&&c5<="9"))return!1}return str2.length>1&&str2[0]==="0"?!1:parseInt(str2)<=65535}function isEmail(){return/^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/.test(this)}function isUri(){return new Uri(this).uri()}function isUriRef(){return new Uri(this).uriReference()}var Uri=class{constructor(str2){this.i=0,this.pctEncodedFound=!1,this.str=str2,this.l=str2.length}uri(){let start=this.i;return this.scheme()&&this.take(":")&&this.hierPart()?this.take("?")&&!this.query()||this.take("#")&&!this.fragment()?!1:this.i!=this.l?(this.i=start,!1):!0:(this.i=start,!1)}hierPart(){let start=this.i;return this.take("/")&&this.take("/")&&this.authority()&&this.pathAbempty()?!0:(this.i=start,this.pathAbsolute()||this.pathRootless()||this.pathEmpty())}uriReference(){return this.uri()||this.relativeRef()}relativeRef(){let start=this.i;return this.relativePart()?this.take("?")&&!this.query()?(this.i=start,!1):this.take("#")&&!this.fragment()?(this.i=start,!1):this.i!=this.l?(this.i=start,!1):!0:!1}relativePart(){let start=this.i;return this.take("/")&&this.take("/")&&this.authority()&&this.pathAbempty()?!0:(this.i=start,this.pathAbsolute()||this.pathNoscheme()||this.pathEmpty())}scheme(){let start=this.i;if(this.alpha()){for(;this.alpha()||this.digit()||this.take("+")||this.take("-")||this.take("."););if(this.str[this.i]==":")return!0}return this.i=start,!1}authority(){let start=this.i;return this.userinfo()&&!this.take("@")?(this.i=start,!1):this.host()?this.take(":")&&!this.port()?(this.i=start,!1):this.isAuthorityEnd()?!0:(this.i=start,!1):(this.i=start,!1)}isAuthorityEnd(){return this.str[this.i]=="?"||this.str[this.i]=="#"||this.str[this.i]=="/"||this.i>=this.l}userinfo(){let start=this.i;for(;;)if(!(this.unreserved()||this.pctEncoded()||this.subDelims()||this.take(":")))return this.str[this.i]=="@"?!0:(this.i=start,!1)}host(){let start=this.i;if(this.pctEncodedFound=!1,this.str[this.i]=="["&&this.ipLiteral()||this.regName()){if(this.pctEncodedFound){let rawHost=this.str.substring(start,this.i);try{decodeURIComponent(rawHost)}catch{return!1}}return!0}return!1}port(){let start=this.i;for(;;)if(!this.digit())return this.isAuthorityEnd()?!0:(this.i=start,!1)}ipLiteral(){let start=this.i;if(this.take("[")){let j5=this.i;if(this.ipv6Address()&&this.take("]")||(this.i=j5,this.ipv6addrz()&&this.take("]"))||(this.i=j5,this.ipvFuture()&&this.take("]")))return!0}return this.i=start,!1}ipv6Address(){let start=this.i;for(;this.hexdig()||this.take(":"););return isIp.call(this.str.substring(start,this.i),6)?!0:(this.i=start,!1)}ipv6addrz(){let start=this.i;return this.ipv6Address()&&this.take("%")&&this.take("2")&&this.take("5")&&this.zoneId()?!0:(this.i=start,!1)}zoneId(){let start=this.i;for(;this.unreserved()||this.pctEncoded(););return this.i-start>0?!0:(this.i=start,!1)}ipvFuture(){let start=this.i;if(this.take("v")&&this.hexdig()){for(;this.hexdig(););if(this.take(".")){let j5=0;for(;this.unreserved()||this.subDelims()||this.take(":");)j5++;if(j5>=1)return!0}}return this.i=start,!1}regName(){let start=this.i;for(;;)if(!(this.unreserved()||this.pctEncoded()||this.subDelims()))return this.str[this.i]==":"||this.isAuthorityEnd()?!0:(this.i=start,!1)}isPathEnd(){return this.str[this.i]=="?"||this.str[this.i]=="#"||this.i>=this.l}pathAbempty(){let start=this.i;for(;this.take("/")&&this.segment(););return this.isPathEnd()?!0:(this.i=start,!1)}pathAbsolute(){let start=this.i;if(this.take("/")){if(this.segmentNz())for(;this.take("/")&&this.segment(););if(this.isPathEnd())return!0}return this.i=start,!1}pathNoscheme(){let start=this.i;if(this.segmentNzNc()){for(;this.take("/")&&this.segment(););if(this.isPathEnd())return!0}return this.i=start,!1}pathRootless(){let start=this.i;if(this.segmentNz()){for(;this.take("/")&&this.segment(););if(this.isPathEnd())return!0}return this.i=start,!1}pathEmpty(){return this.isPathEnd()}segment(){for(;this.pchar(););return!0}segmentNz(){let start=this.i;if(this.pchar()){for(;this.pchar(););return!0}return this.i=start,!1}segmentNzNc(){let start=this.i;for(;this.unreserved()||this.pctEncoded()||this.subDelims()||this.take("@"););return this.i-start>0?!0:(this.i=start,!1)}pchar(){return this.unreserved()||this.pctEncoded()||this.subDelims()||this.take(":")||this.take("@")}query(){let start=this.i;for(;;)if(!(this.pchar()||this.take("/")||this.take("?")))return this.str[this.i]=="#"||this.i==this.l?!0:(this.i=start,!1)}fragment(){let start=this.i;for(;;)if(!(this.pchar()||this.take("/")||this.take("?")))return this.i==this.l?!0:(this.i=start,!1)}pctEncoded(){let start=this.i;return this.take("%")&&this.hexdig()&&this.hexdig()?(this.pctEncodedFound=!0,!0):(this.i=start,!1)}unreserved(){return this.alpha()||this.digit()||this.take("-")||this.take("_")||this.take(".")||this.take("~")}subDelims(){return this.take("!")||this.take("$")||this.take("&")||this.take("'")||this.take("(")||this.take(")")||this.take("*")||this.take("+")||this.take(",")||this.take(";")||this.take("=")}alpha(){let c5=this.str[this.i];return"A"<=c5&&c5<="Z"||"a"<=c5&&c5<="z"?(this.i++,!0):!1}digit(){let c5=this.str[this.i];return"0"<=c5&&c5<="9"?(this.i++,!0):!1}hexdig(){let c5=this.str[this.i];return"0"<=c5&&c5<="9"||"a"<=c5&&c5<="f"||"A"<=c5&&c5<="F"||"0"<=c5&&c5<="9"?(this.i++,!0):!1}take(char){return this.str[this.i]==char?(this.i++,!0):!1}};function unique(){return Array.from(this.values()).every((a5,index2,arr)=>{if(isCelUint(a5)){for(let i6=0;i6<arr.length;i6++){if(i6==index2)continue;let b7=arr[i6];if(isCelUint(b7)&&b7.value===a5.value)return!1}return!0}if(a5 instanceof Uint8Array){for(let i6=0;i6<arr.length;i6++){if(i6==index2)continue;let b7=arr[i6];if(b7 instanceof Uint8Array&&scalarEquals(ScalarType2.BYTES,b7,a5))return!1}return!0}return arr.indexOf(a5)===index2})}function bytesContains(sub){if(sub.length===0)return!0;if(sub.length>this.length)return!1;for(let i6=0;i6<this.length-sub.length+1;i6++){let found=!0;for(let j5=0;j5<sub.length;j5++)if(this[i6+j5]!=sub[j5]){found=!1;break}if(found)return!0}return!1}function bytesStartsWith(sub){if(sub.length>this.length)return!1;for(let i6=0;i6<sub.length;i6++)if(sub[i6]!=this[i6])return!1;return!0}function bytesEndsWith(sub){if(sub.length>this.length||this.length<sub.length)return!1;for(let i6=0;i6<sub.length;i6++)if(sub[sub.length-i6-1]!=this[this.length-i6-1])return!1;return!0}var isNanFn=celMethod("isNan",CelScalar.DOUBLE,[],CelScalar.BOOL,function(){return Number.isNaN(this)}),isInfFn=[celMethod("isInf",CelScalar.DOUBLE,[],CelScalar.BOOL,isInf),celMethod("isInf",CelScalar.DOUBLE,[CelScalar.INT],CelScalar.BOOL,isInf)],isHostnameFn=celMethod("isHostname",CelScalar.STRING,[],CelScalar.BOOL,isHostname),isHostAndPortFn=celMethod("isHostAndPort",CelScalar.STRING,[CelScalar.BOOL],CelScalar.BOOL,isHostAndPort),isEmailFn=celMethod("isEmail",CelScalar.STRING,[],CelScalar.BOOL,isEmail),isIpFn=[celMethod("isIp",CelScalar.STRING,[],CelScalar.BOOL,isIp),celMethod("isIp",CelScalar.STRING,[CelScalar.INT],CelScalar.BOOL,isIp)],isIpPrefixFn=[celMethod("isIpPrefix",CelScalar.STRING,[],CelScalar.BOOL,isIpPrefix),celMethod("isIpPrefix",CelScalar.STRING,[CelScalar.INT],CelScalar.BOOL,isIpPrefix),celMethod("isIpPrefix",CelScalar.STRING,[CelScalar.BOOL],CelScalar.BOOL,function(strict){return isIpPrefix.call(this,void 0,strict)}),celMethod("isIpPrefix",CelScalar.STRING,[CelScalar.INT,CelScalar.BOOL],CelScalar.BOOL,isIpPrefix)],isUriFn=celMethod("isUri",CelScalar.STRING,[],CelScalar.BOOL,isUri),isUriRefFn=celMethod("isUriRef",CelScalar.STRING,[],CelScalar.BOOL,isUriRef),uniqueFn=[CelScalar.UINT,CelScalar.INT,CelScalar.STRING,CelScalar.BOOL,CelScalar.DOUBLE,CelScalar.BYTES].map(elem=>celMethod("unique",listType(elem),[],CelScalar.BOOL,unique)),getFieldFn=celFunc("getField",[CelScalar.DYN,CelScalar.STRING],CelScalar.DYN,(msg,name)=>{if(!isReflectMessage2(msg))throw new Error("getField can only be applied to messages");let field3=msg.fields.find(f5=>f5.name===name);if(field3===void 0)throw new Error(`field ${name} not found on ${msg.desc}`);switch(field3.fieldKind){case"list":case"map":return msg.get(field3);case"enum":return BigInt(msg.get(field3));case"scalar":return celFromScalar(field3.scalar,msg.get(field3));case"message":return msg.isSet(field3)?msg.get(field3):isWrapperDesc2(field3.message)?null:create2(field3.message)}}),containsFn=[celMethod("contains",CelScalar.BYTES,[CelScalar.BYTES],CelScalar.BOOL,bytesContains),celMethod("contains",CelScalar.STRING,[CelScalar.STRING],CelScalar.BOOL,String.prototype.includes)],endsWithFn=[celMethod("endsWith",CelScalar.BYTES,[CelScalar.BYTES],CelScalar.BOOL,bytesEndsWith),celMethod("endsWith",CelScalar.STRING,[CelScalar.STRING],CelScalar.BOOL,String.prototype.endsWith)],startsWithFn=[celMethod("startsWith",CelScalar.BYTES,[CelScalar.BYTES],CelScalar.BOOL,bytesStartsWith),celMethod("startsWith",CelScalar.STRING,[CelScalar.STRING],CelScalar.BOOL,String.prototype.startsWith)];function createCustomFuncions(regexMatcher){let funcs=[isNanFn,...isInfFn,isHostnameFn,isHostAndPortFn,isEmailFn,...isIpFn,...isIpPrefixFn,isUriFn,isUriRefFn,...uniqueFn,getFieldFn,...containsFn,...endsWithFn,...startsWithFn];return regexMatcher&&funcs.push(celMethod("matches",CelScalar.STRING,[CelScalar.STRING],CelScalar.BOOL,function(pattern){return regexMatcher(pattern,this)})),funcs}function charAt(index2){let i6=Number(index2);if(i6<0||i6>this.length)throw indexOutOfBounds2(i6,this.length);return this.charAt(i6)}function indexOf(substr,startN){if(startN===void 0)return BigInt(this.indexOf(substr));let start=Number(startN);if(start<0||start>=this.length)throw indexOutOfBounds2(start,this.length);return BigInt(this.indexOf(substr,start))}function lastIndexOf(substr,startN){if(startN===void 0)return BigInt(this.lastIndexOf(substr));let start=Number(startN);if(start<0||start>=this.length)throw indexOutOfBounds2(start,this.length);return BigInt(this.lastIndexOf(substr,start))}function lowerAscii(){let result="";for(let i6=0;i6<this.length;i6++){let code=this.charCodeAt(i6);code>=65&&code<=90?result+=String.fromCharCode(code+32):result+=this.charAt(i6)}return result}function upperAscii(){let result="";for(let i6=0;i6<this.length;i6++){let c5=this.charCodeAt(i6);c5>=97&&c5<=122?result+=String.fromCharCode(c5-32):result+=this.charAt(i6)}return result}function replace(substr,repl,num){let count=num===void 0?this.length:Number(num),result=this,offset=0,remaining=count,index2=result.indexOf(substr,offset);for(;remaining>0&&index2!==-1;)result=result.substring(0,index2)+repl+result.substring(index2+substr.length),offset=index2+repl.length,remaining--,index2=result.indexOf(substr,offset);return result}function split(sep2,num){let count=num===void 0?void 0:Number(num);return count===1?celList([this]):celList(this.split(sep2,count))}function substring(start,end){if(end===void 0){let i7=Number(start);if(i7<0||i7>this.length)throw indexOutOfBounds2(i7,this.length);return this.substring(i7)}let i6=Number(start),j5=Number(end);if(i6<0||i6>this.length)throw indexOutOfBounds2(i6,this.length);if(j5<0||j5>this.length)throw indexOutOfBounds2(j5,this.length);if(i6>j5)throw invalidArgument("substring","start > end");return this.substring(i6,j5)}var WHITE_SPACE=new Set([32,9,10,11,12,13,133,160,5760,8192,8193,8194,8195,8196,8197,8198,8199,8200,8201,8202,8232,8233,8239,8287,12288]);function trim(){let start=0,end=this.length-1;for(;start<this.length&&WHITE_SPACE.has(this.charCodeAt(start));)start++;for(;end>start&&WHITE_SPACE.has(this.charCodeAt(end));)end--;return this.substring(start,end+1)}function join(sep2=""){let result="";for(let i6=0;i6<this.size;i6++){let item=this.get(i6);if(typeof item!="string")throw invalidArgument("join","list contains non-string value");i6>0&&(result+=sep2),result+=item}return result}var QUOTE_MAP=new Map([[0,"\\0"],[7,"\\a"],[8,"\\b"],[9,"\\t"],[10,"\\n"],[11,"\\v"],[12,"\\f"],[13,"\\r"],[34,'\\"'],[92,"\\\\"]]);function quote(str2){let result='"';for(let i6=0;i6<str2.length;i6++){let c5=str2.charCodeAt(i6);result+=QUOTE_MAP.get(c5)??str2.charAt(i6)}return result+='"',result}function formatFloatString(val){switch(val){case"Infinity":case"-Infinity":case"NaN":return val;default:throw invalidArgument("format","invalid floating point value")}}function formatFloating(val,precision){switch(!0){case typeof val=="number":return!Number.isFinite(val)||precision===void 0?val.toString():new Intl.NumberFormat("en-US",{maximumFractionDigits:precision,minimumFractionDigits:precision,notation:"standard",roundingMode:"halfEven",useGrouping:!1}).format(val);case typeof val=="string":return formatFloatString(val);default:throw invalidArgument("format","fixed-point clause can only be used on doubles")}}function formatExponent(val,precision){switch(!0){case typeof val=="number":if(!Number.isFinite(val))return val.toString();let str2=val.toExponential(precision),plusIdx=str2.lastIndexOf("+");return plusIdx===str2.length-2&&(str2=`${str2.substring(0,plusIdx+1)}0${str2.substring(plusIdx+1)}`),str2;case typeof val=="string":return formatFloatString(val);default:throw invalidArgument("format","scientific clause can only be used on doubles")}}function formatBinary(val){switch(!0){case typeof val=="boolean":return val?"1":"0";case typeof val=="bigint":return val.toString(2);case isCelUint(val):return val.value.toString(2);default:throw invalidArgument("format","only integers and bools can be formatted as binary")}}function formatOctal(val){switch(!0){case typeof val=="bigint":return val.toString(8);case isCelUint(val):return val.value.toString(8);default:throw invalidArgument("format","invalid integer value")}}function formatDecimal(val){switch(!0){case typeof val=="bigint":return val.toString(10);case isCelUint(val):return val.value.toString(10);case(typeof val=="number"&&!Number.isFinite(val)):return val.toString();default:throw invalidArgument("format","invalid integer value")}}function formatHexBytes(val){let result="";for(let i6=0;i6<val.length;i6++)result+=val[i6].toString(16).padStart(2,"0");return result}function formatHex(val){switch(!0){case typeof val=="bigint":return val.toString(16);case isCelUint(val):return val.value.toString(16);case typeof val=="string":let encoder7=new TextEncoder;return formatHexBytes(encoder7.encode(val));case val instanceof Uint8Array:return formatHexBytes(val);default:throw invalidArgument("format","only integers, byte buffers, and strings can be formatted as hex")}}function formatHeX(val){let result=formatHex(val);return typeof result!="string"?result:result.toUpperCase()}function formatList(val){let result="[";for(let i6=0;i6<val.size;i6++)i6>0&&(result+=", "),result+=formatString(val.get(i6));return result+="]",result}function formatMap(val){let formatted=new Array(val.size),i6=0;for(let[key,value]of val)formatted[i6]=[formatString(key),formatString(value)],i6++;let result="{",delim="";for(let[key,value]of formatted.sort((a5,b7)=>a5[0].localeCompare(b7[0])))result+=delim+key+": "+value,delim=", ";return result+="}",result}function formatString(val){switch(typeof val){case"boolean":return val?"true":"false";case"bigint":return formatDecimal(val);case"number":return formatFloating(val,void 0);case"string":return val;case"object":switch(!0){case val===null:return"null";case isCelType(val):return val.name;case isCelUint(val):return val.value.toString();case isReflectMessage2(val,TimestampSchema):return toJson(TimestampSchema,val.message);case isReflectMessage2(val,DurationSchema):return toJson(DurationSchema,val.message);case val instanceof Uint8Array:return new TextDecoder().decode(val);case isCelList(val):return formatList(val);case isCelMap(val):return formatMap(val)}}throw invalidArgument("format","invalid string value")}function format(args){let result="",i6=0,j5=0;for(;i6<this.length;){if(this.charAt(i6)!=="%"){result+=this.charAt(i6),i6++;continue}if(i6+1>=this.length)throw invalidArgument("format","invalid format string");let c5=this.charAt(i6+1);if(i6+=2,c5==="%"){result+="%";continue}let precision=6;if(c5==="."){for(precision=0;i6<this.length&&this.charAt(i6)>="0"&&this.charAt(i6)<="9";)precision=precision*10+Number(this.charAt(i6)),i6++;if(i6>=this.length)throw invalidArgument("format","invalid format string");c5=this.charAt(i6),i6++}let val=args.get(j5++);if(val===void 0)throw invalidArgument("format","too few arguments for format string");result+=formatPlaceholder(c5,val,precision)}if(j5<args.size)throw invalidArgument("format","too many arguments for format string");return result}function formatPlaceholder(c5,val,precision){switch(c5){case"e":return formatExponent(val,precision);case"f":return formatFloating(val,precision);case"b":return formatBinary(val);case"d":return formatDecimal(val);case"s":return formatString(val);case"x":return formatHex(val);case"X":return formatHeX(val);case"o":return formatOctal(val);default:throw invalidArgument("format",`could not parse formatting clause: unrecognized formatting clause: ${c5}`)}}function invalidArgument(func,issue){return new Error(`invalid argument to function ${func}: ${issue}`)}function indexOutOfBounds2(index2,length){return new Error(`index ${index2} out of bounds [0, ${length})`)}var{STRING:STRING5,INT:INT5,DYN:DYN3}=CelScalar,LIST_DYN=listType(DYN3),LIST_STRING=listType(DYN3),strings_default=[celFunc("strings.quote",[STRING5],STRING5,quote),celMethod("charAt",STRING5,[INT5],STRING5,charAt),celMethod("indexOf",STRING5,[STRING5],INT5,indexOf),celMethod("indexOf",STRING5,[STRING5,INT5],INT5,indexOf),celMethod("lastIndexOf",STRING5,[STRING5],INT5,lastIndexOf),celMethod("lastIndexOf",STRING5,[STRING5,INT5],INT5,lastIndexOf),celMethod("lowerAscii",STRING5,[],STRING5,lowerAscii),celMethod("upperAscii",STRING5,[],STRING5,upperAscii),celMethod("replace",STRING5,[STRING5,STRING5],STRING5,replace),celMethod("replace",STRING5,[STRING5,STRING5,INT5],STRING5,replace),celMethod("split",STRING5,[STRING5],LIST_STRING,split),celMethod("split",STRING5,[STRING5,INT5],LIST_STRING,split),celMethod("substring",STRING5,[INT5],STRING5,substring),celMethod("substring",STRING5,[INT5,INT5],STRING5,substring),celMethod("trim",STRING5,[],STRING5,trim),celMethod("join",LIST_STRING,[],STRING5,join),celMethod("join",LIST_STRING,[STRING5],STRING5,join),celMethod("format",STRING5,[LIST_DYN],STRING5,format)];var CelManager=class{constructor(registry,regexMatcher){this.registry=registry,this.rulesCache=new Map,this.bindings={},this.env=celEnv({registry,funcs:[...strings_default,...createCustomFuncions(regexMatcher)]}),this.bindings.now=timestampNow()}updateCelNow(){this.bindings.now=timestampNow()}setEnv(key,value){if(value===void 0){delete this.bindings[key];return}this.bindings[key]=value}eval(compiled){if(compiled.kind=="compilation_error")throw compiled.error;let rule=compiled.rule,result=compiled.interpretable(this.bindings);if(typeof result=="string"||typeof result=="boolean"){if(typeof result=="boolean"?result:result.length==0)return;let message6=rule.message;return message6===""&&(message6=typeof result=="string"?result:`"${rule.expression}" returned false`),{message:message6,ruleId:rule.id}}throw isCelError(result)?new RuntimeError(result.message,{cause:result}):new RuntimeError(`expression ${rule.id} outputs ${typeof result}, wanted either bool or string`)}compileRule(ruleOrExpr){let rule=typeof ruleOrExpr=="string"?create2(RuleSchema,{id:ruleOrExpr,expression:ruleOrExpr}):ruleOrExpr;try{return{kind:"interpretable",interpretable:plan(this.env,parse2(rule.expression)),rule}}catch(cause){return{kind:"compilation_error",error:new CompilationError(`failed to compile ${rule.id}: ${String(cause)}`,{cause})}}}compileRules(descMessage){let compiled=this.rulesCache.get(descMessage.typeName);return compiled||(compiled=this.compileRulesUncached(descMessage),this.rulesCache.set(descMessage.typeName,compiled)),compiled}compileRulesUncached(descMessage){let standard=[],extensions=new Map;for(let field3 of descMessage.fields)if(hasOption(field3,predefined))for(let rule of getOption(field3,predefined).cel)standard.push({field:field3,rule,compiled:this.compileRule(rule)});for(let ext of registryGetExtensionsFor(this.registry,descMessage)){if(!hasOption(ext,predefined))continue;let list12=extensions.get(ext.number);list12||(list12=[],extensions.set(ext.number,list12));for(let rule of getOption(ext,predefined).cel)list12.push({ext,rule,compiled:this.compileRule(rule)})}return{standard,extensions}}};function registryGetExtensionsFor(registry,extendee){let result=[];for(let type2 of registry)type2.kind=="extension"&&type2.extendee.typeName==extendee.typeName&&result.push(type2);return result}var EvalCustomCel=class{constructor(celMan,forMapKey,thisScalarType){this.celMan=celMan,this.forMapKey=forMapKey,this.thisScalarType=thisScalarType,this.children=[]}add(compiled,rulePath){this.children.push({compiled,rulePath})}eval(val,cursor){this.celMan.setEnv("this",reflectToCel(val,this.thisScalarType)),this.celMan.setEnv("rules",void 0),this.celMan.setEnv("rule",void 0);for(let child of this.children){let vio=this.celMan.eval(child.compiled);vio&&cursor.violate(vio.message,vio.ruleId,child.rulePath,this.forMapKey)}}prune(){return this.children.length==0}},EvalExtendedRulesCel=class{constructor(celMan,rules,forMapKey){this.celMan=celMan,this.rules=rules,this.forMapKey=forMapKey,this.children=[],this.thisScalarType=getRuleScalarType(rules)}add(compiled,rulePath,ruleValue,ruleScalarType){this.children.push({compiled,rulePath,ruleCelValue:reflectToCel(ruleValue,ruleScalarType)})}eval(val,cursor){this.celMan.setEnv("rules",this.rules),this.celMan.setEnv("this",reflectToCel(val,this.thisScalarType));for(let child of this.children){this.celMan.setEnv("rule",child.ruleCelValue);let vio=this.celMan.eval(child.compiled);vio&&cursor.violate(vio.message,vio.ruleId,child.rulePath,this.forMapKey)}}prune(){return this.children.length==0}},EvalStandardRulesCel=class{constructor(celMan,rules,forMapKey){this.celMan=celMan,this.rules=rules,this.forMapKey=forMapKey,this.children=[],this.thisScalarType=getRuleScalarType(rules)}add(compiled,rulePath){this.children.push({compiled,rulePath})}eval(val,cursor){this.celMan.setEnv("this",reflectToCel(val,this.thisScalarType)),this.celMan.setEnv("rules",this.rules),this.celMan.setEnv("rule",void 0);for(let child of this.children){let vio=this.celMan.eval(child.compiled);vio&&cursor.violate(vio.message,vio.ruleId,child.rulePath,this.forMapKey)}}prune(){return this.children.length==0}};function reflectToCel(val,scalarType){return isReflectMessage2(val)?val:scalarType?celFromScalar(scalarType,val):val}var Planner2=class{constructor(celMan,legacyRequired){this.celMan=celMan,this.legacyRequired=legacyRequired,this.messageCache=new Map}plan(message6){let existing=this.messageCache.get(message6);if(existing)return existing;let messageRules=getOption(message6,message),e6=new EvalMany;this.messageCache.set(message6,e6);try{e6.add(this.fields(messageRules.oneof,message6.fields)),e6.add(this.messageCel(messageRules)),e6.add(this.messageOneofs(message6,messageRules.oneof)),e6.add(this.oneofs(message6.oneofs)),e6.prune()}catch(err2){throw this.messageCache.delete(message6),err2}return e6}oneofs(oneofs){return new EvalMany(...oneofs.filter(o3=>getOption(o3,oneof).required).map(o3=>new EvalOneofRequired(o3)))}messageOneofs(message6,oneofRules){return new EvalMany(...oneofRules.map(rule=>{if(rule.fields.length==0)throw new CompilationError(`at least one field must be specified in oneof rule for the ${message6}`);let seen=new Set;return new EvalMessageOneofRule(rule.fields.map(fieldName=>{if(seen.has(fieldName))throw new CompilationError(`duplicate ${fieldName} in oneof rule for the ${message6}`);seen.add(fieldName);let found=message6.fields.find(descField=>descField.name===fieldName);if(!found)throw new CompilationError(`field "${fieldName}" not found in ${message6}`);return found}),rule.required)}))}fields(oneofs,fields2){let evals=new EvalMany;for(let field3 of fields2){let fieldRules=getOption(field3,field),ignore=fieldRules.ignore;!isFieldSet(fieldRules,FieldRulesSchema.field.ignore)&&oneofs.some(oneof2=>oneof2.fields.includes(field3.name))&&(ignore=Ignore2.IF_ZERO_VALUE);let required=fieldRules.required&&ignore!==Ignore2.ALWAYS,legacyRequired=this.legacyRequired&&field3.presence==FeatureSet_FieldPresence2.LEGACY_REQUIRED,baseRulePath=buildPath(FieldRulesSchema);switch(field3.fieldKind){case"message":{evals.add(new EvalField(field3,required,legacyRequired,ignoreMessageField(field3,ignore),this.message(field3.message,fieldRules,baseRulePath,field3)));break}case"list":{evals.add(new EvalField(field3,required,legacyRequired,ignoreListOrMapField(field3,ignore),this.planList(field3,fieldRules,baseRulePath)));break}case"map":{evals.add(new EvalField(field3,required,legacyRequired,ignoreListOrMapField(field3,ignore),this.map(field3,fieldRules,baseRulePath)));break}case"enum":{evals.add(new EvalField(field3,required,legacyRequired,ignoreScalarOrEnumField(field3,ignore),this.enumeration(field3.enum,fieldRules,baseRulePath,field3)));break}case"scalar":{evals.add(new EvalField(field3,required,legacyRequired,ignoreScalarOrEnumField(field3,ignore),this.scalar(field3.scalar,fieldRules,baseRulePath,!1,field3)));break}}}return evals}planList(field3,fieldRules,baseRulePath){let evals=new EvalMany(this.fieldCel(fieldRules,baseRulePath,!1,void 0)),[rules,rulePath,rulePathItems]=getListRules(baseRulePath,fieldRules,field3);rules&&evals.add(this.rules(rules,rulePath,!1));let itemsRules=rules?.items;switch(field3.listKind){case"enum":{evals.add(new EvalListItems(ignoreEnumValue(field3.enum,itemsRules?.ignore),this.enumeration(field3.enum,itemsRules,rulePathItems,field3)));break}case"scalar":{evals.add(new EvalListItems(ignoreScalarValue(field3.scalar,itemsRules?.ignore),this.scalar(field3.scalar,itemsRules,rulePathItems,!1,field3)));break}case"message":{evals.add(new EvalListItems(ignoreMessageValue(itemsRules?.ignore),this.message(field3.message,itemsRules,rulePathItems,field3)));break}}return evals}map(field3,fieldRules,baseRulePath){let evals=new EvalMany(this.fieldCel(fieldRules,baseRulePath,!1,void 0)),[rules,rulePath,rulePathKeys,rulePathValues]=getMapRules(baseRulePath,fieldRules,field3);rules&&evals.add(this.rules(rules,rulePath,!1));let ignoreKey=ignoreScalarValue(field3.mapKey,rules?.keys?.ignore),evalKey=this.scalar(field3.mapKey,rules?.keys,rulePathKeys,!0,field3),valuesRules=rules?.values;switch(field3.mapKind){case"message":{evals.add(new EvalMapEntries(ignoreKey,evalKey,ignoreMessageValue(valuesRules?.ignore),this.message(field3.message,valuesRules,rulePathValues,field3)));break}case"enum":{evals.add(new EvalMapEntries(ignoreKey,evalKey,ignoreEnumValue(field3.enum,valuesRules?.ignore),this.enumeration(field3.enum,valuesRules,rulePathValues,field3)));break}case"scalar":{evals.add(new EvalMapEntries(ignoreKey,evalKey,ignoreScalarValue(field3.scalar,valuesRules?.ignore),this.scalar(field3.scalar,valuesRules,rulePathValues,!1,field3)));break}}return evals}enumeration(descEnum,fieldRules,baseRulePath,fieldContext){let evals=new EvalMany(this.fieldCel(fieldRules,baseRulePath,!1,ScalarType2.INT32)),[rules,rulePath]=getEnumRules(baseRulePath,fieldRules,fieldContext);return rules&&(evals.add(new EvalEnumDefinedOnly(descEnum,rulePath,rules)),evals.add(this.rules(rules,rulePath,!1))),evals}scalar(scalar,fieldRules,baseRulePath,forMapKey,fieldContext){let evals=new EvalMany(this.fieldCel(fieldRules,baseRulePath,forMapKey,scalar)),[rules,rulePath]=getScalarRules(scalar,baseRulePath,fieldRules,fieldContext);return rules&&evals.add(this.rules(rules,rulePath,forMapKey)),evals}message(descMessage,fieldRules,baseRulePath,fieldContext){let evals=new EvalMany(this.fieldCel(fieldRules,baseRulePath,!1,void 0));evals.add(this.plan(descMessage));let[rules,rulePath]=getMessageRules(descMessage,baseRulePath,fieldRules,fieldContext);return rules&&(isMessage2(rules,AnyRulesSchema)&&evals.add(new EvalAnyRules(rulePath,rules)),evals.add(this.rules(rules,rulePath,!1))),evals}rules(rules,rulePath,forMapKey){let ruleDesc=getRuleDescriptor(rules.$typeName),prepared=this.celMan.compileRules(ruleDesc),evalStandard=new EvalStandardRulesCel(this.celMan,rules,forMapKey);for(let plan2 of prepared.standard)isFieldSet(rules,plan2.field)&&evalStandard.add(plan2.compiled,rulePath.clone().field(plan2.field).toPath());let evalExtended=new EvalExtendedRulesCel(this.celMan,rules,forMapKey);if(rules.$unknown)for(let uf of rules.$unknown){let plans=prepared.extensions.get(uf.no);if(!plans)throw new CompilationError(`Unknown extension for ${rules.$typeName} with number ${uf.no}. If this is a predefined rule, register the extension with a registry in createValidator().`);for(let plan2 of plans)evalExtended.add(plan2.compiled,rulePath.clone().extension(plan2.ext).toPath(),getExtension(rules,plan2.ext),plan2.ext.fieldKind=="scalar"?plan2.ext.scalar:void 0)}return new EvalMany(evalStandard,evalExtended)}messageCel(messageRules){let e6=new EvalCustomCel(this.celMan,!1,void 0);for(let rule of[...messageRules.celExpression,...messageRules.cel])e6.add(this.celMan.compileRule(rule),[]);return e6}fieldCel(fieldRules,baseRulePath,forMapKey,scalarType){if(!fieldRules)return EvalNoop.get();let e6=new EvalCustomCel(this.celMan,forMapKey,scalarType);for(let[field3,rules]of[[FieldRulesSchema.field.cel,fieldRules.cel],[FieldRulesSchema.field.celExpression,fieldRules.celExpression]])for(let[index2,rule]of rules.entries()){let rulePath=baseRulePath.clone().field(field3).list(index2).toPath();e6.add(this.celMan.compileRule(rule),rulePath)}return e6}};function createValidator(opt){let registry=opt?.registry?createMutableRegistry(opt.registry,file_buf_validate_validate2):createMutableRegistry(file_buf_validate_validate2),failFast=opt?.failFast??!1,celMan=new CelManager(registry,opt?.regexMatch),planner=new Planner2(celMan,opt?.legacyRequired??!1);return{validate(schema2,message6){try{validateUnsafe(registry,celMan,planner,schema2,message6,failFast)}catch(e6){return e6 instanceof ValidationError?{kind:"invalid",message:message6,error:e6,violations:e6.violations}:e6 instanceof CompilationError||e6 instanceof RuntimeError?{kind:"error",message:message6,error:e6}:{kind:"error",message:message6,error:new RuntimeError("unexpected error: "+e6,{cause:e6})}}return{kind:"valid",message:message6}}}}function validateUnsafe(registry,celMan,planner,schema2,message6,failFast){let messageTypeName=message6.$typeName;if(!isMessage2(message6,schema2))throw new RuntimeError(`Cannot validate message ${messageTypeName} with schema ${schema2.typeName}`);if(!registry.get(schema2.typeName)){registry.add(schema2);for(let type2 of usedTypes(schema2))registry.add(type2)}let plan2=planner.plan(schema2),msg=reflect2(schema2,message6),cursor=Cursor.create(schema2,failFast);celMan.updateCelNow(),plan2.eval(msg,cursor),cursor.throwIfViolated()}var sharedValidator;function validator(){return sharedValidator===void 0&&(sharedValidator=createValidator()),sharedValidator}function newValidateProtoStep(){return{name:"ValidateProto",execute(ctx){let result=validator().validate(ctx.schema,ctx.input);if(result.kind!=="valid")throw result.kind==="invalid"?new ConnectError(result.error.message,Code.InvalidArgument):new ConnectError(`validation could not run: ${result.error.message}`,Code.Internal)}}}function newValidateVisibilityStep(){return{name:"ValidateVisibility",execute(ctx){let metadata=metadataOf(ctx.input);metadata!==void 0&&rejectUnsupportedVisibility(ctx.apiResourceKind,metadata.visibility)}}}function newValidateVisibilityUpdateStep(){return{name:"ValidateVisibilityUpdate",execute(ctx){rejectUnsupportedVisibility(ctx.apiResourceKind,ctx.input.visibility)}}}function rejectDefaultInstanceVisibilityUpdate(){throw failedPreconditionError("Default instances do not have their own visibility - access always follows the parent blueprint. Change the blueprint's visibility instead.")}function rejectUnsupportedVisibility(kind,visibility){let supported,levels;try{supported=supportsVisibility(kind,visibility),levels=supportedVisibilityLevels(kind)}catch(error2){throw internalError(error2,"failed to resolve visibility config from kind")}if(!supported)throw invalidArgumentError(`${apiResourceKindName(kind)} resources cannot be set to ${ApiResourceVisibility[visibility]}. Supported visibility levels: ${levels}.`)}var file_ai_stigmer_search_v1_io=fileDesc("Ch1haS9zdGlnbWVyL3NlYXJjaC92MS9pby5wcm90bxIUYWkuc3RpZ21lci5zZWFyY2gudjEikQIKDVNlYXJjaFJlcXVlc3QSXQoFa2luZHMYASADKA4yPy5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuYXBpcmVzb3VyY2VraW5kLkFwaVJlc291cmNlS2luZEINukgKkgEHIgWCAQIQARIXCgVxdWVyeRgCIAEoCUIIukgFcgMY9AMSKgoDb3JnGAMgASgJQh26SBpyGBg/MhReJHxeW2Etel1bYS16MC05LV0qJBIuCgRwYWdlGAUgASgLMiAuYWkuc3RpZ21lci5jb21tb25zLnJwYy5QYWdlSW5mb0oECAQQBUoECAYQB1IOZXhjbHVkZV9wdWJsaWNSEGNyb3NzX29yZ19wdWJsaWMi9AEKDlNlYXJjaFJlc3BvbnNlEjMKB2VudHJpZXMYASADKAsyIi5haS5zdGlnbWVyLnNlYXJjaC52MS5TZWFyY2hSZXN1bHQSTgoOY291bnRzX2J5X2tpbmQYAiADKAsyNi5haS5zdGlnbWVyLnNlYXJjaC52MS5TZWFyY2hSZXNwb25zZS5Db3VudHNCeUtpbmRFbnRyeRITCgt0b3RhbF9jb3VudBgDIAEoBRITCgt0b3RhbF9wYWdlcxgEIAEoBRozChFDb3VudHNCeUtpbmRFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAU6AjgBIpkDCgxTZWFyY2hSZXN1bHQSTQoEa2luZBgBIAEoDjI/LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5hcGlyZXNvdXJjZWtpbmQuQXBpUmVzb3VyY2VLaW5kEgoKAmlkGAIgASgJEgwKBG5hbWUYAyABKAkSDAoEc2x1ZxgEIAEoCRIWCg5xdWFsaWZpZWRfc2x1ZxgFIAEoCRILCgNvcmcYBiABKAkSEwoLZGVzY3JpcHRpb24YByABKAkSSQoKdmlzaWJpbGl0eRgIIAEoDjI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVZpc2liaWxpdHkSDAoEdGFncxgJIAMoCRIuCgpjcmVhdGVkX2F0GAogASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIuCgp1cGRhdGVkX2F0GAsgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBINCgVzY29yZRgMIAEoAhIQCghpY29uX3VybBgNIAEoCWIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_kind,file_ai_stigmer_commons_apiresource_enum,file_ai_stigmer_commons_rpc_pagination,file_buf_validate_validate,file_google_protobuf_timestamp]),SearchRequestSchema=messageDesc2(file_ai_stigmer_search_v1_io,0),SearchResponseSchema=messageDesc2(file_ai_stigmer_search_v1_io,1),SearchResultSchema=messageDesc2(file_ai_stigmer_search_v1_io,2);function buildSearchResult(params){let metadata=params.metadata;if(metadata!==void 0)return create2(SearchResultSchema,{kind:params.kind,id:metadata.id,name:metadata.name,slug:metadata.slug,org:metadata.org,qualifiedSlug:buildQualifiedSlug(metadata.org,metadata.slug),description:params.summary,visibility:metadata.visibility,tags:metadata.tags,score:params.score,iconUrl:params.iconUrl??"",createdAt:params.createdAt??create2(TimestampSchema),updatedAt:params.updatedAt??create2(TimestampSchema)})}function buildQualifiedSlug(org,slug){return org===""?slug:`${org}/${slug}`}var agentSearchExtractor={kind:ApiResourceKind.agent,schema:AgentSchema,getSearchSummary(resource){return agentSearchSummary(resource)},toSearchResult(resource,score){let agent=resource;return buildSearchResult({kind:ApiResourceKind.agent,metadata:agent.metadata,summary:agentSearchSummary(agent),score,createdAt:agent.status?.audit?.specAudit?.createdAt,updatedAt:agent.status?.audit?.specAudit?.updatedAt,iconUrl:agent.spec?.iconUrl??""})},getSearchIndexEntry(resource){let agent=resource,metadata=agent.metadata;if(metadata!==void 0)return{name:metadata.name,description:agentSearchSummary(agent),tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(agent.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};function agentSearchSummary(agent){let spec=agent.spec;return spec===void 0?"":spec.description!==""?spec.description:spec.instructions}function isValidClassification(c5){return c5.unknown.length===0&&c5.resourceTemplates.length===0}function classify(caps,requested){let tools=new Set(caps.tools.map(tool=>tool.name)),templates=new Set(caps.resourceTemplates.map(tmpl=>tmpl.name)),unknown=[],resourceTemplates=[];for(let name of requested)if(!tools.has(name)){if(templates.has(name)){resourceTemplates.push(name);continue}unknown.push(name)}return{unknown,resourceTemplates}}function toolNames(caps){return caps.tools.map(tool=>tool.name)}function quoteJoin(names){return names.map(n3=>`'${n3}'`).join(", ")}var API_VERSION="agentic.stigmer.ai/v1",KIND="AgentInstance",SLUG_SUFFIX="-default",DESCRIPTION="Default instance (auto-created, no custom configuration)";function defaultInstanceSlug(agentSlug){return`${agentSlug}${SLUG_SUFFIX}`}function buildDefaultInstanceRequest(agent){return create2(AgentInstanceSchema,{apiVersion:API_VERSION,kind:KIND,metadata:{name:defaultInstanceSlug(agent.slug),org:agent.org,labels:{[DEFAULT_INSTANCE_LABEL]:RESERVED_LABEL_TRUE,[SYSTEM_MANAGED_LABEL]:RESERVED_LABEL_TRUE}},spec:{agentId:agent.id,description:DESCRIPTION}})}var DEFAULT_INSTANCE_ID_KEY="default_instance_id";function newValidateEnabledToolsStep(store){return{name:"ValidateEnabledTools",async execute(ctx){let agent=ctx.newState;for(let usage of agent.spec?.mcpServerUsages??[]){if(usage.enabledTools.length===0)continue;let ref=usage.mcpServerRef,slug=ref?.slug??"";if(slug==="")continue;let org=ref?.org??"";org===""&&(org=agent.metadata?.org??"");let mcpServer;try{mcpServer=await findResourceBySlug(store,ApiResourceKind.mcp_server,McpServerSchema,slug,org)}catch(error2){throw new Error(`failed to look up MCP server '${slug}' (org: ${org}) for enabled_tools validation: ${error2 instanceof Error?error2.message:String(error2)}`)}if(mcpServer===void 0)continue;let caps=mcpServer.status?.discoveredCapabilities;if(caps===void 0)continue;let classification=classify(caps,usage.enabledTools);if(!isValidClassification(classification))throw invalidEnabledToolsError(slug,org,classification,caps)}}}}function invalidEnabledToolsError(slug,org,c5,caps){let problems=[];return c5.unknown.length>0&&problems.push(`enabled_tools names tool(s) the server does not expose: ${quoteJoin(c5.unknown)}`),c5.resourceTemplates.length>0&&problems.push(`enabled_tools names resource template(s): ${quoteJoin(c5.resourceTemplates)} \u2014 resource templates are read-only data endpoints, not callable tools, and must not appear in enabled_tools`),invalidArgumentError(`MCP server '${slug}' (org: ${org}): ${problems.join("; ")}. Discovered tools: ${quoteJoin(toolNames(caps))}. If the server's toolset changed, run 'stigmer connect' on it to refresh discovered capabilities.`)}function newMergeMcpServerEnvSpecsStep(store,logger2){return{name:"MergeMcpServerEnvSpecs",async execute(ctx){let agent=ctx.newState,usages=agent.spec?.mcpServerUsages??[];if(usages.length===0)return;let mcpEnvVars={};for(let usage of usages){let ref=usage.mcpServerRef,slug=ref?.slug??"";if(slug==="")continue;let org=ref?.org??"";if(org===""&&(org=agent.metadata?.org??""),org==="")continue;let mcpServer;try{mcpServer=await findResourceBySlug(store,ApiResourceKind.mcp_server,McpServerSchema,slug,org)}catch(error2){logger2.warn("Failed to look up MCP server for env merge",{mcpServerSlug:slug,org,error:error2 instanceof Error?error2.message:String(error2)});continue}if(mcpServer===void 0){logger2.warn("MCP server not found \u2014 skipping env merge for this server",{mcpServerSlug:slug,org});continue}let serverEnv=mcpServer.spec?.env??{};for(let[varName,decl]of Object.entries(serverEnv))varName in mcpEnvVars||(mcpEnvVars[varName]=create2(EnvVarDeclarationSchema,{description:decl.description,isSecret:decl.isSecret,optional:decl.optional}))}if(Object.keys(mcpEnvVars).length===0)return;let spec=agent.spec;if(spec===void 0)return;let existingEnv=spec.env,merged={...mcpEnvVars};for(let[k5,v]of Object.entries(existingEnv))merged[k5]=v;spec.env=merged;let mergedCount=Object.keys(merged).length-Object.keys(existingEnv).length;mergedCount>0&&logger2.info("Merged MCP server env declarations into agent env",{injectedCount:mergedCount,totalCount:Object.keys(merged).length,agent:agent.metadata?.slug??""})}}}function newCreateDefaultInstanceStep(applierProvider,logger2){return{name:"CreateDefaultInstance",async execute(ctx){let metadata=ctx.newState.metadata;if(metadata===void 0)throw internalError(new Error("agent metadata is nil after persist"),"agent metadata is nil after persist");logger2.info("Creating default instance for agent",{agentId:metadata.id,slug:metadata.slug,org:metadata.org});let instanceRequest=buildDefaultInstanceRequest(metadata),applied;try{applied=await applierProvider().applyAsCaller(instanceRequest,ctx.callerIdentity)}catch(error2){throw error2 instanceof ConnectError?goWrappedStatusError("failed to apply default instance",error2):new Error(`failed to apply default instance: ${error2 instanceof Error?error2.message:String(error2)}`)}logger2.info("Successfully applied default instance for agent",{instanceId:applied.metadata?.id??"",agentId:metadata.id}),ctx.set(DEFAULT_INSTANCE_ID_KEY,applied.metadata?.id??"")}}}function newUpdateAgentStatusWithDefaultInstanceStep(store,logger2,authorizationLifecycle){return{name:"UpdateAgentStatusWithDefaultInstance",async execute(ctx){let agent=ctx.newState,agentId=agent.metadata?.id??"",defaultInstanceId=ctx.get(DEFAULT_INSTANCE_ID_KEY);if(typeof defaultInstanceId!="string"||defaultInstanceId==="")throw internalError(new Error("no default instance id in context (CreateDefaultInstance must run first)"),"no default instance id in context (CreateDefaultInstance must run first)");agent.status===void 0&&(agent.status=create2(AgentStatusSchema,{})),agent.status.defaultInstanceId=defaultInstanceId;try{await store.saveResource(ctx.apiResourceKind,agentId,ctx.schema,agent)}catch(error2){throw logger2.error("Failed to persist agent with default_instance_id",{agentId,error:error2 instanceof Error?error2.message:String(error2)}),new Error(`failed to persist agent with default instance: ${error2 instanceof Error?error2.message:String(error2)}`)}await notifyDefaultInstanceLinked(authorizationLifecycle,{instanceKind:ApiResourceKind.agent_instance,instanceId:defaultInstanceId,blueprintKind:ApiResourceKind.agent,blueprintId:agentId}),ctx.setNewState(agent),logger2.info("Successfully updated agent status with default_instance_id",{defaultInstanceId,agentId})}}}function newCascadeDeleteInstancesStep(store,logger2){return{name:"CascadeDeleteInstances",async execute(ctx){let agent=ctx.get(EXISTING_RESOURCE_KEY);if(agent===void 0)throw internalError(new Error("agent not found in context (LoadExistingForDelete must run first)"),"agent not found in context (LoadExistingForDelete must run first)");let agentId=agent.metadata?.id??"",rows;try{rows=await store.listResources(ApiResourceKind.agent_instance)}catch(error2){throw internalError(error2,"failed to list agent instances for cascade delete")}let deleted=0;for(let data of rows){let instance;try{instance=fromBinary2(AgentInstanceSchema,data)}catch{continue}if((instance.spec?.agentId??"")!==agentId)continue;let instanceId=instance.metadata?.id??"";try{await store.deleteResource(ApiResourceKind.agent_instance,instanceId)}catch(error2){throw internalError(error2,`failed to cascade-delete instance ${instanceId} of agent ${agentId}`)}try{await store.deleteSearchIndex(ApiResourceKind.agent_instance,instanceId)}catch(error2){logger2.warn("CascadeDeleteInstances: failed to remove search index entry (best-effort)",{instanceId,error:error2 instanceof Error?error2.message:String(error2)})}deleted++}deleted>0&&logger2.info("Cascade-deleted instances of agent",{count:deleted,agentId})}}}function newCascadeDeleteSharesStep(store,logger2){return{name:"CascadeDeleteShares",async execute(ctx){let agent=ctx.get(EXISTING_RESOURCE_KEY);if(agent===void 0)throw internalError(new Error("agent not found in context (LoadExistingForDelete must run first)"),"agent not found in context (LoadExistingForDelete must run first)");let agentOrg=agent.metadata?.org??"",agentSlug=agent.metadata?.slug??"",rows;try{rows=await store.listResources(ApiResourceKind.agent_share)}catch(error2){throw internalError(error2,"failed to list agent shares for cascade delete")}let deleted=0;for(let data of rows){let share;try{share=fromBinary2(AgentShareSchema,data)}catch{continue}let ref=share.spec?.agentRef;if((ref?.org??"")!==agentOrg||(ref?.slug??"")!==agentSlug||(share.metadata?.org??"")!==agentOrg)continue;let shareId=share.metadata?.id??"";try{await store.deleteResource(ApiResourceKind.agent_share,shareId)}catch(error2){throw internalError(error2,`failed to cascade-delete share ${shareId} of agent ${agentOrg}/${agentSlug}`)}deleted++}deleted>0&&logger2.info("Cascade-deleted shares of agent",{count:deleted,agent:`${agentOrg}/${agentSlug}`})}}}function registerAgentServices(router,deps){router.service(AgentCommandController,{apply:(agent,ctx)=>apply(deps,agent,ctx),create:(agent,ctx)=>createAgent(deps,agent,ctx),update:(agent,ctx)=>update(deps,agent,ctx),updateVisibility:(input,ctx)=>updateVisibility(deps,input,ctx),delete:(id,ctx)=>deleteAgent(deps,id,ctx)}),router.service(AgentQueryController,{get:(id,ctx)=>get(deps,id,ctx),getByReference:(ref,ctx)=>getByReference(deps,ref,ctx)})}function kindOf(ctx){return ctx.values.get(apiResourceKindKey)}async function createAgent(deps,agent,ctx){let reqCtx=new RequestContext(AgentSchema,agent,callerIdentityOf(ctx),kindOf(ctx));return await newPipeline("agent-create",deps.logger).addStep(newAuthorizeStep(AgentCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newValidateEnabledToolsStep(deps.store)).addStep(newMergeMcpServerEnvSpecsStep(deps.store,deps.logger)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newCreateDefaultInstanceStep(deps.agentInstanceApplier,deps.logger)).addStep(newUpdateAgentStatusWithDefaultInstanceStep(deps.store,deps.logger,deps.authorizationLifecycle)).addStep(newIndexSearchStep(deps.store,agentSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update(deps,agent,ctx){let reqCtx=new RequestContext(AgentSchema,agent,callerIdentityOf(ctx),kindOf(ctx));return await newPipeline("agent-update",deps.logger).addStep(newAuthorizeStep(AgentCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newGuardPluginManagedStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newValidateEnabledToolsStep(deps.store)).addStep(newMergeMcpServerEnvSpecsStep(deps.store,deps.logger)).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,agentSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply(deps,agent,ctx){let reqCtx=new RequestContext(AgentSchema,agent,callerIdentityOf(ctx),kindOf(ctx));await newPipeline("agent-apply",deps.logger).addStep(newAuthorizeStep(AgentCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createAgent(deps,agent,ctx):update(deps,withResolvedApplyId(AgentSchema,agent,reqCtx),ctx)}async function deleteAgent(deps,agentId,ctx){let reqCtx=new RequestContext(AgentCommandController.method.delete.input,agentId,callerIdentityOf(ctx),kindOf(ctx));await newPipeline("agent-delete",deps.logger).addStep(newAuthorizeStep(AgentCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,AgentSchema)).addStep(newGuardPluginManagedStep(deps.store)).addStep(newCascadeDeleteInstancesStep(deps.store,deps.logger)).addStep(newCascadeDeleteSharesStep(deps.store,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted agent not found in context"),"deleted agent not found in context");return deleted}var UPDATE_VISIBILITY_AGENT_KEY="updateVisibilityAgent";async function updateVisibility(deps,input,ctx){let reqCtx=new RequestContext(AgentCommandController.method.updateVisibility.input,input,callerIdentityOf(ctx),kindOf(ctx));return await newPipeline("agent-update-visibility",deps.logger).addStep(newAuthorizeStep(AgentCommandController.method.updateVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadAgentForVisibilityUpdateStep(deps.store)).addStep(newGuardPluginManagedStep(deps.store,{existingKey:UPDATE_VISIBILITY_AGENT_KEY})).addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_AGENT_KEY)).addStep(newValidateVisibilityUpdateStep()).addStep(newGuardReferenceFloorOnEscalationStep(deps.store,UPDATE_VISIBILITY_AGENT_KEY,[row=>collectSpecReferences(AgentSchema,row)])).addStep(newSetAgentVisibilityStep()).addStep(newPersistAgentForVisibilityUpdateStep(deps.store)).addStep(newUpdateVisibilityTuplesStep(deps.authorizationLifecycle,UPDATE_VISIBILITY_AGENT_KEY)).addStep(newIndexAgentAfterVisibilityUpdateStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(UPDATE_VISIBILITY_AGENT_KEY)}function newLoadAgentForVisibilityUpdateStep(store){return{name:"LoadAgentForVisibilityUpdate",async execute(ctx){let input=ctx.input,agent;try{agent=await store.getResource(ApiResourceKind.agent,input.resourceId,AgentSchema)}catch{throw notFoundError("agent",input.resourceId)}ctx.set(UPDATE_VISIBILITY_AGENT_KEY,agent)}}}function newSetAgentVisibilityStep(){return{name:"SetAgentVisibility",execute(ctx){let agent=ctx.get(UPDATE_VISIBILITY_AGENT_KEY);agent.metadata!==void 0&&(agent.metadata.visibility=ctx.input.visibility),setAuditFieldsForUpdate(AgentSchema,agent,"status_audit",ctx.callerIdentity)}}}function newPersistAgentForVisibilityUpdateStep(store){return{name:"PersistAgentForVisibilityUpdate",async execute(ctx){let agent=ctx.get(UPDATE_VISIBILITY_AGENT_KEY);try{await store.saveResource(ApiResourceKind.agent,agent.metadata?.id??"",AgentSchema,agent)}catch(error2){throw internalError(error2,"failed to save agent")}}}}function newIndexAgentAfterVisibilityUpdateStep(store,logger2){return{name:"IndexAgentAfterVisibilityUpdate",async execute(ctx){let agent=ctx.get(UPDATE_VISIBILITY_AGENT_KEY),entry=agentSearchExtractor.getSearchIndexEntry(agent);if(entry===void 0){logger2.warn("IndexAgentAfterVisibilityUpdate: extractor returned nil, skipping",{id:agent.metadata?.id??""});return}try{await store.upsertSearchIndex(ApiResourceKind.agent,agent.metadata?.id??"",entry)}catch(error2){logger2.warn("IndexAgentAfterVisibilityUpdate: failed (best-effort)",{id:agent.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}}}async function get(deps,id,ctx){let reqCtx=new RequestContext(AgentQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf(ctx));return await newPipeline("agent-get",deps.logger).addStep(newAuthorizeStep(AgentQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,AgentSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByReference(deps,ref,ctx){let reqCtx=new RequestContext(AgentQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf(ctx));return await newPipeline("agent-get-by-reference",deps.logger).addStep(newAuthorizeStep(AgentQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,AgentSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(AgentQueryController.method.get))).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var ROUTING_GLOBAL="global",ROUTING_SESSION="session",DEFAULT_EXECUTION_TARGET_LOCAL="local",DEFAULT_EXECUTION_TARGET_CLOUD="cloud",AgentExecutionTemporalConfig=class{stigmerQueue;runnerQueue;activityRouting;defaultExecutionTarget;constructor(stigmerQueue,runnerQueue,activityRouting,defaultExecutionTarget){this.stigmerQueue=stigmerQueue,this.runnerQueue=runnerQueue,this.activityRouting=activityRouting,this.defaultExecutionTarget=defaultExecutionTarget}resolveExecutionTarget(target){return target!==ExecutionTarget.UNSPECIFIED?target:this.defaultExecutionTarget===DEFAULT_EXECUTION_TARGET_CLOUD?ExecutionTarget.CLOUD:ExecutionTarget.LOCAL}};function newConfigFromEnv(){return new AgentExecutionTemporalConfig(valueOrDefault(process.env.TEMPORAL_AGENT_EXECUTION_STIGMER_TASK_QUEUE,"agent_execution_stigmer"),valueOrDefault(process.env.TEMPORAL_AGENT_EXECUTION_RUNNER_TASK_QUEUE,"stigmer_runner"),valueOrDefault(process.env.STIGMER_ACTIVITY_ROUTING,ROUTING_GLOBAL),valueOrDefault(process.env.STIGMER_DEFAULT_EXECUTION_TARGET,DEFAULT_EXECUTION_TARGET_LOCAL))}function valueOrDefault(value,fallback3){return value===void 0||value===""?fallback3:value}var file_ai_stigmer_agentic_agentexecution_v1_io=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvaW8ucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MSIpChBBZ2VudEV4ZWN1dGlvbklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiIgoJU2Vzc2lvbklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiiQEKEkFnZW50RXhlY3V0aW9uTGlzdBITCgt0b3RhbF9wYWdlcxgBIAEoBRJFCgdlbnRyaWVzGAIgAygLMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RXhlY3V0aW9uEhcKD25leHRfcGFnZV90b2tlbhgDIAEoCSKsAQoaTGlzdEFnZW50RXhlY3V0aW9uc1JlcXVlc3QSGgoJcGFnZV9zaXplGAEgASgFQge6SAQaAigAEhIKCnBhZ2VfdG9rZW4YAiABKAkSQwoFcGhhc2UYAyABKA4yNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRXhlY3V0aW9uUGhhc2USDAoEdGFncxgEIAMoCRILCgNvcmcYBSABKAkicAojTGlzdEFnZW50RXhlY3V0aW9uc0J5U2Vzc2lvblJlcXVlc3QSGgoKc2Vzc2lvbl9pZBgBIAEoCUIGukgDyAEBEhUKCXBhZ2Vfc2l6ZRgCIAEoBUICGAESFgoKcGFnZV90b2tlbhgDIAEoCUICGAEilAEKH0FnZW50RXhlY3V0aW9uVXBkYXRlU3RhdHVzSW5wdXQSHQoMZXhlY3V0aW9uX2lkGAEgASgJQge6SARyAhABElIKBnN0YXR1cxgCIAEoCzI6LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvblN0YXR1c0IGukgDyAEBInsKFFVwZGF0ZVN0YXR1c1Jlc3BvbnNlEkwKBnNpZ25hbBgBIAEoDjI8LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5FeGVjdXRpb25Db250cm9sU2lnbmFsEhUKDXNpZ25hbF9yZWFzb24YAiABKAkivAEKE1N1Ym1pdEFwcHJvdmFsSW5wdXQSIwoSYWdlbnRfZXhlY3V0aW9uX2lkGAEgASgJQge6SARyAhABEh0KDHRvb2xfY2FsbF9pZBgCIAEoCUIHukgEcgIQARJQCgZhY3Rpb24YAyABKA4yNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQXBwcm92YWxBY3Rpb25CCrpIB4IBBBABIAASDwoHY29tbWVudBgEIAEoCSJkChRBcHByb3ZhbERlY2lzaW9uTGlzdBJMCglkZWNpc2lvbnMYASADKAsyOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuU3VibWl0QXBwcm92YWxJbnB1dCL0AgoXU3VibWl0RmlsZURlY2lzaW9uSW5wdXQSIwoSYWdlbnRfZXhlY3V0aW9uX2lkGAEgASgJQge6SARyAhABEh4KDWNoYW5nZV9zZXRfaWQYAiABKAlCB7pIBHICEAESUgoFc2NvcGUYAyABKA4yNy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRmlsZURlY2lzaW9uU2NvcGVCCrpIB4IBBBABIAASFgoOZmlsZV9jaGFuZ2VfaWQYBCABKAkSVAoGYWN0aW9uGAUgASgOMjguYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkZpbGVEZWNpc2lvbkFjdGlvbkIKukgHggEEEAEgABIgCg9leHBlY3RlZF9kaWdlc3QYBiABKAlCB7pIBHICEAESDgoGcmVhc29uGAcgASgJEiAKGGFja25vd2xlZGdlX3VucmV2aWV3YWJsZRgIIAEoCCJAChlDYW5jZWxBZ2VudEV4ZWN1dGlvbklucHV0EhMKAmlkGAEgASgJQge6SARyAhABEg4KBnJlYXNvbhgCIAEoCSJDChxUZXJtaW5hdGVBZ2VudEV4ZWN1dGlvbklucHV0EhMKAmlkGAEgASgJQge6SARyAhABEg4KBnJlYXNvbhgCIAEoCSIxChpSZWNvdmVyQWdlbnRFeGVjdXRpb25JbnB1dBITCgJpZBgBIAEoCUIHukgEcgIQASI/ChhQYXVzZUFnZW50RXhlY3V0aW9uSW5wdXQSEwoCaWQYASABKAlCB7pIBHICEAESDgoGcmVhc29uGAIgASgJIjAKGVJlc3VtZUFnZW50RXhlY3V0aW9uSW5wdXQSEwoCaWQYASABKAlCB7pIBHICEAEiqgIKF1VwbG9hZEF0dGFjaG1lbnRSZXF1ZXN0Et8BCghmaWxlbmFtZRgBIAEoCULMAbpIyAG6AcABCiJ1cGxvYWRfYXR0YWNobWVudC5maWxlbmFtZS5ub19wYXRoEk5maWxlbmFtZSBtdXN0IGJlIGEgYmFyZSBmaWxlbmFtZSB3aXRob3V0IHBhdGggc2VwYXJhdG9ycyBvciB0cmF2ZXJzYWwgc2VnbWVudHMaSiF0aGlzLmNvbnRhaW5zKCcvJykgJiYgIXRoaXMuY29udGFpbnMoJ1xcJykgJiYgdGhpcyAhPSAnLicgJiYgdGhpcyAhPSAnLi4ncgIQARIXCgdjb250ZW50GAIgASgMQga6SAPIAQESFAoMY29udGVudF90eXBlGAMgASgJIi8KGFVwbG9hZEF0dGFjaG1lbnRSZXNwb25zZRITCgtzdG9yYWdlX2tleRgBIAEoCSJzCh1HZXRBcnRpZmFjdERvd25sb2FkVXJsUmVxdWVzdBIdCgxleGVjdXRpb25faWQYASABKAlCB7pIBHICEAESHAoLc3RvcmFnZV9rZXkYAiABKAlCB7pIBHICEAESFQoNYXNfYXR0YWNobWVudBgDIAEoCCJKCh5HZXRBcnRpZmFjdERvd25sb2FkVXJsUmVzcG9uc2USFAoMZG93bmxvYWRfdXJsGAEgASgJEhIKCmV4cGlyZXNfYXQYAiABKAkifwoZR2V0QXJ0aWZhY3RDb250ZW50UmVxdWVzdBIdCgxleGVjdXRpb25faWQYASABKAlCB7pIBHICEAESHAoLc3RvcmFnZV9rZXkYAiABKAlCB7pIBHICEAESEQoJbWF4X2J5dGVzGAMgASgDEhIKCmVudHJ5X3BhdGgYBCABKAkicAoaR2V0QXJ0aWZhY3RDb250ZW50UmVzcG9uc2USDwoHY29udGVudBgBIAEoDBIUCgxjb250ZW50X3R5cGUYAiABKAkSGAoQdG90YWxfc2l6ZV9ieXRlcxgDIAEoAxIRCgl0cnVuY2F0ZWQYBCABKAgiPQocR2V0RXhlY3V0aW9uVXNhZ2VSZXBvcnRJbnB1dBIdCgxleGVjdXRpb25faWQYASABKAlCB7pIBHICEAEiuQEKHUdldEV4ZWN1dGlvblVzYWdlUmVwb3J0T3V0cHV0Ek0KCWFnZ3JlZ2F0ZRgBIAEoCzI6LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Vc2FnZVJlcG9ydEFnZ3JlZ2F0ZRJJCg9tb2RlbF9icmVha2Rvd24YAiADKAsyMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuTW9kZWxVc2FnZSI5ChpHZXRTZXNzaW9uVXNhZ2VSZXBvcnRJbnB1dBIbCgpzZXNzaW9uX2lkGAEgASgJQge6SARyAhABIoQDChtHZXRTZXNzaW9uVXNhZ2VSZXBvcnRPdXRwdXQSEgoKc2Vzc2lvbl9pZBgBIAEoCRIXCg9leGVjdXRpb25fY291bnQYAiABKAUSTwoLdG90YWxfdXNhZ2UYAyABKAsyOi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVXNhZ2VSZXBvcnRBZ2dyZWdhdGUSTwoKZXhlY3V0aW9ucxgEIAMoCzI7LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5FeGVjdXRpb25Vc2FnZVN1bW1hcnkSSQoPbW9kZWxfYnJlYWtkb3duGAUgAygLMjAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLk1vZGVsVXNhZ2USGgoSZmlyc3RfZXhlY3V0aW9uX2F0GAYgASgJEhkKEWxhc3RfZXhlY3V0aW9uX2F0GAcgASgJEhQKDGlzX2VzdGltYXRlZBgIIAEoCCKZAQoYR2V0QWdlbnRVc2FnZVJlcG9ydElucHV0EhkKCGFnZW50X2lkGAEgASgJQge6SARyAhABEhEKCWZyb21fZGF0ZRgCIAEoCRIPCgd0b19kYXRlGAMgASgJEhEKCXBhZ2Vfc2l6ZRgEIAEoBRISCgpwYWdlX3Rva2VuGAUgASgJEhcKBm9yZ19pZBgGIAEoCUIHukgEcgIQASKZAwoZR2V0QWdlbnRVc2FnZVJlcG9ydE91dHB1dBIQCghhZ2VudF9pZBgBIAEoCRISCgphZ2VudF9uYW1lGAIgASgJEk8KC3RvdGFsX3VzYWdlGAMgASgLMjouYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlVzYWdlUmVwb3J0QWdncmVnYXRlEkkKD21vZGVsX2JyZWFrZG93bhgEIAMoCzIwLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5Nb2RlbFVzYWdlEksKCHNlc3Npb25zGAUgAygLMjkuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlNlc3Npb25Vc2FnZVN1bW1hcnkSFgoOdG90YWxfc2Vzc2lvbnMYBiABKAUSGAoQdG90YWxfZXhlY3V0aW9ucxgHIAEoBRIiChp0b3RhbF9iaWxsYWJsZV9jb3N0X21pY3JvcxgIIAEoAxIXCg9uZXh0X3BhZ2VfdG9rZW4YCSABKAkiZwoWR2V0T3JnVXNhZ2VSZXBvcnRJbnB1dBIXCgZvcmdfaWQYASABKAlCB7pIBHICEAESGgoJZnJvbV9kYXRlGAIgASgJQge6SARyAhABEhgKB3RvX2RhdGUYAyABKAlCB7pIBHICEAEi1QMKF0dldE9yZ1VzYWdlUmVwb3J0T3V0cHV0Eg4KBm9yZ19pZBgBIAEoCRIUCgx0b3RhbF9hZ2VudHMYAiABKAUSFgoOdG90YWxfc2Vzc2lvbnMYAyABKAUSGAoQdG90YWxfZXhlY3V0aW9ucxgEIAEoBRIiChp0b3RhbF9iaWxsYWJsZV9jb3N0X21pY3JvcxgFIAEoAxJJCg9tb2RlbF9icmVha2Rvd24YBiADKAsyMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuTW9kZWxVc2FnZRJTChJ0b3BfYWdlbnRzX2J5X2Nvc3QYByADKAsyNy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQWdlbnRVc2FnZVN1bW1hcnkSSQoLZGFpbHlfY29zdHMYCCADKAsyNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuRGFpbHlDb3N0RW50cnkSUwoRaGFybmVzc19icmVha2Rvd24YCSADKAsyOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuSGFybmVzc0Nvc3RTdW1tYXJ5Is4CChVFeGVjdXRpb25Vc2FnZVN1bW1hcnkSFAoMZXhlY3V0aW9uX2lkGAEgASgJEhIKCnN0YXJ0ZWRfYXQYAiABKAkSFAoMY29tcGxldGVkX2F0GAMgASgJEhQKDGlucHV0X3Rva2VucxgEIAEoAxIVCg1vdXRwdXRfdG9rZW5zGAUgASgDEh8KF2NhY2hlX3JlYWRfaW5wdXRfdG9rZW5zGAYgASgDEhwKFGJpbGxhYmxlX2Nvc3RfbWljcm9zGAcgASgDEhUKDXByaW1hcnlfbW9kZWwYCCABKAkSFwoPc3ViX2FnZW50X2NvdW50GAkgASgFEkMKBXBoYXNlGAogASgOMjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkV4ZWN1dGlvblBoYXNlEhQKDGlzX2VzdGltYXRlZBgLIAEoCCKtAQoTU2Vzc2lvblVzYWdlU3VtbWFyeRISCgpzZXNzaW9uX2lkGAEgASgJEhcKD2V4ZWN1dGlvbl9jb3VudBgCIAEoBRIUCgx0b3RhbF90b2tlbnMYAyABKAMSHAoUYmlsbGFibGVfY29zdF9taWNyb3MYBCABKAMSGgoSZmlyc3RfZXhlY3V0aW9uX2F0GAUgASgJEhkKEWxhc3RfZXhlY3V0aW9uX2F0GAYgASgJIoYBChFBZ2VudFVzYWdlU3VtbWFyeRIQCghhZ2VudF9pZBgBIAEoCRISCgphZ2VudF9uYW1lGAIgASgJEhcKD2V4ZWN1dGlvbl9jb3VudBgDIAEoBRIUCgx0b3RhbF90b2tlbnMYBCABKAMSHAoUYmlsbGFibGVfY29zdF9taWNyb3MYBSABKAMiawoORGFpbHlDb3N0RW50cnkSDAoEZGF0ZRgBIAEoCRIXCg9leGVjdXRpb25fY291bnQYAiABKAUSFAoMdG90YWxfdG9rZW5zGAMgASgDEhwKFGJpbGxhYmxlX2Nvc3RfbWljcm9zGAQgASgDInAKEkhhcm5lc3NDb3N0U3VtbWFyeRIPCgdoYXJuZXNzGAEgASgJEhwKFGJpbGxhYmxlX2Nvc3RfbWljcm9zGAIgASgDEhIKCmNhbGxfY291bnQYAyABKAUSFwoPZXhlY3V0aW9uX2NvdW50GAQgASgFIpMBCh9HZXRBZ2VudEV4ZWN1dGlvblN1bW1hcnlSZXF1ZXN0EhQKA29yZxgBIAEoCUIHukgEcgIQARJaCgt0aW1lX3dpbmRvdxgCIAEoDjJFLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvblN1bW1hcnlUaW1lV2luZG93IsoCChVBZ2VudEV4ZWN1dGlvblN1bW1hcnkSFAoMYWN0aXZlX2NvdW50GAEgASgFEmIKDHBoYXNlX2NvdW50cxgCIAMoCzJMLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvblN1bW1hcnkuUGhhc2VDb3VudHNFbnRyeRIvCgxhdmdfZHVyYXRpb24YAyABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb24SUgoSdG9wX2ZhaWxpbmdfYWdlbnRzGAQgAygLMjYuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RmFpbHVyZVJhbmsaMgoQUGhhc2VDb3VudHNFbnRyeRILCgNrZXkYASABKAUSDQoFdmFsdWUYAiABKAU6AjgBIlEKEEFnZW50RmFpbHVyZVJhbmsSEgoKYWdlbnRfc2x1ZxgBIAEoCRISCgphZ2VudF9uYW1lGAIgASgJEhUKDWZhaWx1cmVfY291bnQYAyABKAUqnQIKH0FnZW50RXhlY3V0aW9uU3VtbWFyeVRpbWVXaW5kb3cSMwovQUdFTlRfRVhFQ1VUSU9OX1NVTU1BUllfVElNRV9XSU5ET1dfVU5TUEVDSUZJRUQQABIwCixBR0VOVF9FWEVDVVRJT05fU1VNTUFSWV9USU1FX1dJTkRPV19MQVNUXzI0SBABEi8KK0FHRU5UX0VYRUNVVElPTl9TVU1NQVJZX1RJTUVfV0lORE9XX0xBU1RfN0QQAhIwCixBR0VOVF9FWEVDVVRJT05fU1VNTUFSWV9USU1FX1dJTkRPV19MQVNUXzMwRBADEjAKLEFHRU5UX0VYRUNVVElPTl9TVU1NQVJZX1RJTUVfV0lORE9XX0FMTF9USU1FEARiBnByb3RvMw",[file_ai_stigmer_agentic_agentexecution_v1_api,file_ai_stigmer_agentic_agentexecution_v1_enum,file_ai_stigmer_agentic_agentexecution_v1_usage,file_buf_validate_validate,file_google_protobuf_duration]);var AgentExecutionListSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,2);var AgentExecutionUpdateStatusInputSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,5),UpdateStatusResponseSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,6),SubmitApprovalInputSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,7);var SubmitFileDecisionInputSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,9);var UploadAttachmentResponseSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,16);var GetArtifactDownloadUrlResponseSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,18);var GetArtifactContentResponseSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,20);var GetExecutionUsageReportOutputSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,22);var GetSessionUsageReportOutputSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,24);var GetAgentUsageReportOutputSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,26);var GetOrgUsageReportOutputSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,28),ExecutionUsageSummarySchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,29),SessionUsageSummarySchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,30),AgentUsageSummarySchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,31),DailyCostEntrySchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,32);var AgentExecutionSummarySchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,35),AgentFailureRankSchema=messageDesc2(file_ai_stigmer_agentic_agentexecution_v1_io,36),AgentExecutionSummaryTimeWindow;(function(AgentExecutionSummaryTimeWindow2){AgentExecutionSummaryTimeWindow2[AgentExecutionSummaryTimeWindow2.UNSPECIFIED=0]="UNSPECIFIED",AgentExecutionSummaryTimeWindow2[AgentExecutionSummaryTimeWindow2.LAST_24H=1]="LAST_24H",AgentExecutionSummaryTimeWindow2[AgentExecutionSummaryTimeWindow2.LAST_7D=2]="LAST_7D",AgentExecutionSummaryTimeWindow2[AgentExecutionSummaryTimeWindow2.LAST_30D=3]="LAST_30D",AgentExecutionSummaryTimeWindow2[AgentExecutionSummaryTimeWindow2.ALL_TIME=4]="ALL_TIME"})(AgentExecutionSummaryTimeWindow||(AgentExecutionSummaryTimeWindow={}));var file_ai_stigmer_agentic_agentexecution_v1_command=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvY29tbWFuZC5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxMtMRCh9BZ2VudEV4ZWN1dGlvbkNvbW1hbmRDb250cm9sbGVyEnoKBmNyZWF0ZRI0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvbho0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvbiIE0LgYARKzAQoGdXBkYXRlEjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RXhlY3V0aW9uGjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RXhlY3V0aW9uIj3CuBg5CAIQKSILbWV0YWRhdGEuaWQqJnVuYXV0aG9yaXplZCB0byB1cGRhdGUgYWdlbnQgZXhlY3V0aW9uEtgBCgx1cGRhdGVTdGF0dXMSRS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQWdlbnRFeGVjdXRpb25VcGRhdGVTdGF0dXNJbnB1dBo6LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5VcGRhdGVTdGF0dXNSZXNwb25zZSJFwrgYQQgCECkiDGV4ZWN1dGlvbl9pZCotdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBhZ2VudCBleGVjdXRpb24gc3RhdHVzEqYBCgZkZWxldGUSLS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VJZBo0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvbiI3wrgYMwgCECkiBXZhbHVlKiZ1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIGFnZW50IGV4ZWN1dGlvbhLUAQoOc3VibWl0QXBwcm92YWwSOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuU3VibWl0QXBwcm92YWxJbnB1dBo0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvbiJRwrgYTQgCECkiEmFnZW50X2V4ZWN1dGlvbl9pZCozdW5hdXRob3JpemVkIHRvIHN1Ym1pdCBhcHByb3ZhbCBmb3IgYWdlbnQgZXhlY3V0aW9uEuEBChJzdWJtaXRGaWxlRGVjaXNpb24SPS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuU3VibWl0RmlsZURlY2lzaW9uSW5wdXQaNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQWdlbnRFeGVjdXRpb24iVsK4GFIIAhApIhJhZ2VudF9leGVjdXRpb25faWQqOHVuYXV0aG9yaXplZCB0byBzdWJtaXQgZmlsZSBkZWNpc2lvbiBmb3IgYWdlbnQgZXhlY3V0aW9uErUBCgZjYW5jZWwSPy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQ2FuY2VsQWdlbnRFeGVjdXRpb25JbnB1dBo0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvbiI0wrgYMAgCECkiAmlkKiZ1bmF1dGhvcml6ZWQgdG8gY2FuY2VsIGFnZW50IGV4ZWN1dGlvbhK+AQoJdGVybWluYXRlEkIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlRlcm1pbmF0ZUFnZW50RXhlY3V0aW9uSW5wdXQaNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQWdlbnRFeGVjdXRpb24iN8K4GDMIAhApIgJpZCopdW5hdXRob3JpemVkIHRvIHRlcm1pbmF0ZSBhZ2VudCBleGVjdXRpb24SuAEKB3JlY292ZXISQC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuUmVjb3ZlckFnZW50RXhlY3V0aW9uSW5wdXQaNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQWdlbnRFeGVjdXRpb24iNcK4GDEIAhApIgJpZCondW5hdXRob3JpemVkIHRvIHJlY292ZXIgYWdlbnQgZXhlY3V0aW9uErIBCgVwYXVzZRI+LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5QYXVzZUFnZW50RXhlY3V0aW9uSW5wdXQaNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQWdlbnRFeGVjdXRpb24iM8K4GC8IAhApIgJpZColdW5hdXRob3JpemVkIHRvIHBhdXNlIGFnZW50IGV4ZWN1dGlvbhK1AQoGcmVzdW1lEj8uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLlJlc3VtZUFnZW50RXhlY3V0aW9uSW5wdXQaNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuQWdlbnRFeGVjdXRpb24iNMK4GDAIAhApIgJpZComdW5hdXRob3JpemVkIHRvIHJlc3VtZSBhZ2VudCBleGVjdXRpb24SlwEKEHVwbG9hZEF0dGFjaG1lbnQSPS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVXBsb2FkQXR0YWNobWVudFJlcXVlc3QaPi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuVXBsb2FkQXR0YWNobWVudFJlc3BvbnNlIgTQuBgBGgSg/yspYgZwcm90bzM",[file_ai_stigmer_agentic_agentexecution_v1_api,file_ai_stigmer_agentic_agentexecution_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentExecutionCommandController=serviceDesc(file_ai_stigmer_agentic_agentexecution_v1_command,0);var file_ai_stigmer_agentic_agentexecution_v1_query=fileDesc("CjBhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRleGVjdXRpb24vdjEvcXVlcnkucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MTKvEQodQWdlbnRFeGVjdXRpb25RdWVyeUNvbnRyb2xsZXISqQEKA2dldBI2LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvbklkGjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RXhlY3V0aW9uIjTCuBgwCAEQKSIFdmFsdWUqI3VuYXV0aG9yaXplZCB0byBnZXQgYWdlbnQgZXhlY3V0aW9uEogBCgRsaXN0EkAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkxpc3RBZ2VudEV4ZWN1dGlvbnNSZXF1ZXN0GjguYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RXhlY3V0aW9uTGlzdCIE0LgYARKaAQoNbGlzdEJ5U2Vzc2lvbhJJLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5MaXN0QWdlbnRFeGVjdXRpb25zQnlTZXNzaW9uUmVxdWVzdBo4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvbkxpc3QiBNC4GAESugEKCXN1YnNjcmliZRI2LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5BZ2VudEV4ZWN1dGlvbklkGjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RXhlY3V0aW9uIj3CuBg5CAEQKSIFdmFsdWUqLHVuYXV0aG9yaXplZCB0byBzdWJzY3JpYmUgdG8gYWdlbnQgZXhlY3V0aW9uMAES8wEKFmdldEFydGlmYWN0RG93bmxvYWRVcmwSQy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuR2V0QXJ0aWZhY3REb3dubG9hZFVybFJlcXVlc3QaRC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuR2V0QXJ0aWZhY3REb3dubG9hZFVybFJlc3BvbnNlIk7CuBhKCAEQKSIMZXhlY3V0aW9uX2lkKjZ1bmF1dGhvcml6ZWQgdG8gZG93bmxvYWQgYXJ0aWZhY3QgZnJvbSBhZ2VudCBleGVjdXRpb24S6wEKEmdldEFydGlmYWN0Q29udGVudBI/LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5HZXRBcnRpZmFjdENvbnRlbnRSZXF1ZXN0GkAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkdldEFydGlmYWN0Q29udGVudFJlc3BvbnNlIlLCuBhOCAEQKSIMZXhlY3V0aW9uX2lkKjp1bmF1dGhvcml6ZWQgdG8gcmVhZCBhcnRpZmFjdCBjb250ZW50IGZyb20gYWdlbnQgZXhlY3V0aW9uEucBChdnZXRFeGVjdXRpb25Vc2FnZVJlcG9ydBJCLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5HZXRFeGVjdXRpb25Vc2FnZVJlcG9ydElucHV0GkMuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkdldEV4ZWN1dGlvblVzYWdlUmVwb3J0T3V0cHV0IkPCuBg/CAEQKSIMZXhlY3V0aW9uX2lkKit1bmF1dGhvcml6ZWQgdG8gdmlldyBleGVjdXRpb24gdXNhZ2UgcmVwb3J0Et0BChVnZXRTZXNzaW9uVXNhZ2VSZXBvcnQSQC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuR2V0U2Vzc2lvblVzYWdlUmVwb3J0SW5wdXQaQS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuR2V0U2Vzc2lvblVzYWdlUmVwb3J0T3V0cHV0Ij/CuBg7CAEQKiIKc2Vzc2lvbl9pZCopdW5hdXRob3JpemVkIHRvIHZpZXcgc2Vzc2lvbiB1c2FnZSByZXBvcnQS0QEKE2dldEFnZW50VXNhZ2VSZXBvcnQSPi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuR2V0QWdlbnRVc2FnZVJlcG9ydElucHV0Gj8uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkdldEFnZW50VXNhZ2VSZXBvcnRPdXRwdXQiOcK4GDUIARAeIgZvcmdfaWQqJ3VuYXV0aG9yaXplZCB0byB2aWV3IGFnZW50IHVzYWdlIHJlcG9ydBLSAQoRZ2V0T3JnVXNhZ2VSZXBvcnQSPC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRleGVjdXRpb24udjEuR2V0T3JnVXNhZ2VSZXBvcnRJbnB1dBo9LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5HZXRPcmdVc2FnZVJlcG9ydE91dHB1dCJAwrgYPAgBEB4iBm9yZ19pZCoudW5hdXRob3JpemVkIHRvIHZpZXcgb3JnYW5pemF0aW9uIHVzYWdlIHJlcG9ydBKfAQoTZ2V0RXhlY3V0aW9uU3VtbWFyeRJFLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5HZXRBZ2VudEV4ZWN1dGlvblN1bW1hcnlSZXF1ZXN0GjsuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50ZXhlY3V0aW9uLnYxLkFnZW50RXhlY3V0aW9uU3VtbWFyeSIE0LgYARoEoP8rKWIGcHJvdG8z",[file_ai_stigmer_agentic_agentexecution_v1_api,file_ai_stigmer_agentic_agentexecution_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentExecutionQueryController=serviceDesc(file_ai_stigmer_agentic_agentexecution_v1_query,0);var GATE_SLOT_NAMES=["agent-execution-create:pre-side-effect-gate","agent-execution-recover:pre-side-effect-gate","agent-execution-submit-approval:gate","session-create:pre-side-effect-gate","org-create:post-persist","sandbox-acquisition:gate","identity-account-provision:post-persist","iam-policy-create:pre-side-effect-gate","org-create:pre-side-effect-gate","org-delete:pre-delete"],DECLARED_GATE_SLOTS=new Set(GATE_SLOT_NAMES);function stepsForSlot(gateSteps,slot){return gateSteps.get(slot)??[]}var WORKFLOW_EXECUTION_ID_LABEL="stigmer.ai/workflow-execution-id",WORKFLOW_TASK_LABEL="stigmer.ai/workflow-task";function newRecordRunnerLineageLabelsStep(provider){return{name:"RecordRunnerLineageLabels",execute(ctx){let vouch=provider.vouchRunnerLineageLabels;if(vouch===void 0)return;let labels=metadataOf(ctx.newState)?.labels??{},workflowExecutionId=labels[WORKFLOW_EXECUTION_ID_LABEL]??"",taskName=labels[WORKFLOW_TASK_LABEL]??"";workflowExecutionId===""&&taskName===""||vouch.call(provider,ctx.callerIdentity,workflowExecutionId)&&(workflowExecutionId!==""&&recordServerStampedReservedLabels(ctx,WORKFLOW_EXECUTION_ID_LABEL),taskName!==""&&recordServerStampedReservedLabels(ctx,WORKFLOW_TASK_LABEL))}}}var import_node_path2=__toESM(require("node:path"),1);var import_module=require("module"),require2=(0,import_module.createRequire)("/"),_a,Worker,isMarkedAsUntransferable;try{_a=require2("worker_threads"),Worker=_a.Worker,isMarkedAsUntransferable=_a.isMarkedAsUntransferable}catch{}var u8=Uint8Array,u16=Uint16Array,i32=Int32Array,fleb=new u8([0,0,0,0,0,0,0,0,1,1,1,1,2,2,2,2,3,3,3,3,4,4,4,4,5,5,5,5,0,0,0,0]),fdeb=new u8([0,0,0,0,1,1,2,2,3,3,4,4,5,5,6,6,7,7,8,8,9,9,10,10,11,11,12,12,13,13,0,0]),clim=new u8([16,17,18,0,8,7,9,6,10,5,11,4,12,3,13,2,14,1,15]),freb=function(eb,start){for(var b7=new u16(31),i6=0;i6<31;++i6)b7[i6]=start+=1<<eb[i6-1];for(var r5=new i32(b7[30]),i6=1;i6<30;++i6)for(var j5=b7[i6];j5<b7[i6+1];++j5)r5[j5]=j5-b7[i6]<<5|i6;return{b:b7,r:r5}},_a=freb(fleb,2),fl=_a.b,revfl=_a.r;fl[28]=258,revfl[258]=28;var _b=freb(fdeb,0),fd=_b.b,revfd=_b.r,rev=new u16(32768);for(i=0;i<32768;++i)x=(i&43690)>>1|(i&21845)<<1,x=(x&52428)>>2|(x&13107)<<2,x=(x&61680)>>4|(x&3855)<<4,rev[i]=((x&65280)>>8|(x&255)<<8)>>1;var x,i,hMap=(function(cd,mb,r5){for(var s2=cd.length,i6=0,l3=new u16(mb);i6<s2;++i6)cd[i6]&&++l3[cd[i6]-1];var le=new u16(mb);for(i6=1;i6<mb;++i6)le[i6]=le[i6-1]+l3[i6-1]<<1;var co;if(r5){co=new u16(1<<mb);var rvb=15-mb;for(i6=0;i6<s2;++i6)if(cd[i6])for(var sv=i6<<4|cd[i6],r_1=mb-cd[i6],v=le[cd[i6]-1]++<<r_1,m3=v|(1<<r_1)-1;v<=m3;++v)co[rev[v]>>rvb]=sv}else for(co=new u16(s2),i6=0;i6<s2;++i6)cd[i6]&&(co[i6]=rev[le[cd[i6]-1]++]>>15-cd[i6]);return co}),flt=new u8(288);for(i=0;i<144;++i)flt[i]=8;var i;for(i=144;i<256;++i)flt[i]=9;var i;for(i=256;i<280;++i)flt[i]=7;var i;for(i=280;i<288;++i)flt[i]=8;var i,fdt=new u8(32);for(i=0;i<32;++i)fdt[i]=5;var i,flm=hMap(flt,9,0),flrm=hMap(flt,9,1),fdm=hMap(fdt,5,0),fdrm=hMap(fdt,5,1),max=function(a5){for(var m3=a5[0],i6=1;i6<a5.length;++i6)a5[i6]>m3&&(m3=a5[i6]);return m3},bits=function(d5,p3,m3){var o3=p3/8|0;return(d5[o3]|d5[o3+1]<<8)>>(p3&7)&m3},bits16=function(d5,p3){var o3=p3/8|0;return(d5[o3]|d5[o3+1]<<8|d5[o3+2]<<16)>>(p3&7)},shft=function(p3){return(p3+7)/8|0},slc=function(v,s2,e6){return(s2==null||s2<0)&&(s2=0),(e6==null||e6>v.length)&&(e6=v.length),new u8(v.subarray(s2,e6))};var ec=["unexpected EOF","invalid block type","invalid length/literal","invalid distance","stream finished","no stream handler",,"no callback","invalid UTF-8 data","extra field too long","date not in range 1980-2099","filename too long","stream finishing","invalid zip data"],err=function(ind,msg,nt){var e6=new Error(msg||ec[ind]);if(e6.code=ind,Error.captureStackTrace&&Error.captureStackTrace(e6,err),!nt)throw e6;return e6},inflt=function(dat,st,buf2,dict){var sl=dat.length,dl=dict?dict.length:0;if(!sl||st.f&&!st.l)return buf2||new u8(0);var noBuf=!buf2,resize=noBuf||st.i!=2,noSt=st.i;noBuf&&(buf2=new u8(sl*3));var cbuf=function(l4){var bl=buf2.length;if(l4>bl){var nbuf=new u8(Math.max(bl*2,l4));nbuf.set(buf2),buf2=nbuf}},final=st.f||0,pos=st.p||0,bt=st.b||0,lm=st.l,dm=st.d,lbt=st.m,dbt=st.n,tbts=sl*8;do{if(!lm){final=bits(dat,pos,1);var type2=bits(dat,pos+1,3);if(pos+=3,type2)if(type2==1)lm=flrm,dm=fdrm,lbt=9,dbt=5;else if(type2==2){var hLit=bits(dat,pos,31)+257,hcLen=bits(dat,pos+10,15)+4,tl=hLit+bits(dat,pos+5,31)+1;pos+=14;for(var ldt=new u8(tl),clt=new u8(19),i6=0;i6<hcLen;++i6)clt[clim[i6]]=bits(dat,pos+i6*3,7);pos+=hcLen*3;for(var clb=max(clt),clbmsk=(1<<clb)-1,clm=hMap(clt,clb,1),i6=0;i6<tl;){var r5=clm[bits(dat,pos,clbmsk)];pos+=r5&15;var s2=r5>>4;if(s2<16)ldt[i6++]=s2;else{var c5=0,n3=0;for(s2==16?(n3=3+bits(dat,pos,3),pos+=2,c5=ldt[i6-1]):s2==17?(n3=3+bits(dat,pos,7),pos+=3):s2==18&&(n3=11+bits(dat,pos,127),pos+=7);n3--;)ldt[i6++]=c5}}var lt=ldt.subarray(0,hLit),dt=ldt.subarray(hLit);lbt=max(lt),dbt=max(dt),lm=hMap(lt,lbt,1),dm=hMap(dt,dbt,1)}else err(1);else{var s2=shft(pos)+4,l3=dat[s2-4]|dat[s2-3]<<8,t=s2+l3;if(t>sl){noSt&&err(0);break}resize&&cbuf(bt+l3),buf2.set(dat.subarray(s2,t),bt),st.b=bt+=l3,st.p=pos=t*8,st.f=final;continue}if(pos>tbts){noSt&&err(0);break}}resize&&cbuf(bt+131072);for(var lms=(1<<lbt)-1,dms=(1<<dbt)-1,lpos=pos;;lpos=pos){var c5=lm[bits16(dat,pos)&lms],sym=c5>>4;if(pos+=c5&15,pos>tbts){noSt&&err(0);break}if(c5||err(2),sym<256)buf2[bt++]=sym;else if(sym==256){lpos=pos,lm=null;break}else{var add2=sym-254;if(sym>264){var i6=sym-257,b7=fleb[i6];add2=bits(dat,pos,(1<<b7)-1)+fl[i6],pos+=b7}var d5=dm[bits16(dat,pos)&dms],dsym=d5>>4;d5||err(3),pos+=d5&15;var dt=fd[dsym];if(dsym>3){var b7=fdeb[dsym];dt+=bits16(dat,pos)&(1<<b7)-1,pos+=b7}if(pos>tbts){noSt&&err(0);break}resize&&cbuf(bt+131072);var end=bt+add2;if(bt<dt){var shift=dl-dt,dend=Math.min(dt,end);for(shift+bt<0&&err(3);bt<dend;++bt)buf2[bt]=dict[shift+bt]}for(;bt<end;++bt)buf2[bt]=buf2[bt-dt]}}st.l=lm,st.p=lpos,st.b=bt,st.f=final,lm&&(final=1,st.m=lbt,st.d=dm,st.n=dbt)}while(!final);return bt!=buf2.length&&noBuf?slc(buf2,0,bt):buf2.subarray(0,bt)},wbits=function(d5,p3,v){v<<=p3&7;var o3=p3/8|0;d5[o3]|=v,d5[o3+1]|=v>>8},wbits16=function(d5,p3,v){v<<=p3&7;var o3=p3/8|0;d5[o3]|=v,d5[o3+1]|=v>>8,d5[o3+2]|=v>>16},hTree=function(d5,mb){for(var t=[],i6=0;i6<d5.length;++i6)d5[i6]&&t.push({s:i6,f:d5[i6]});var s2=t.length,t22=t.slice();if(!s2)return{t:et,l:0};if(s2==1){var v=new u8(t[0].s+1);return v[t[0].s]=1,{t:v,l:1}}t.sort(function(a5,b7){return a5.f-b7.f}),t.push({s:-1,f:25001});var l3=t[0],r5=t[1],i0=0,i1=1,i22=2;for(t[0]={s:-1,f:l3.f+r5.f,l:l3,r:r5};i1!=s2-1;)l3=t[t[i0].f<t[i22].f?i0++:i22++],r5=t[i0!=i1&&t[i0].f<t[i22].f?i0++:i22++],t[i1++]={s:-1,f:l3.f+r5.f,l:l3,r:r5};for(var maxSym=t22[0].s,i6=1;i6<s2;++i6)t22[i6].s>maxSym&&(maxSym=t22[i6].s);var tr=new u16(maxSym+1),mbt=ln(t[i1-1],tr,0);if(mbt>mb){var i6=0,dt=0,lft=mbt-mb,cst=1<<lft;for(t22.sort(function(a5,b7){return tr[b7.s]-tr[a5.s]||a5.f-b7.f});i6<s2;++i6){var i2_1=t22[i6].s;if(tr[i2_1]>mb)dt+=cst-(1<<mbt-tr[i2_1]),tr[i2_1]=mb;else break}for(dt>>=lft;dt>0;){var i2_2=t22[i6].s;tr[i2_2]<mb?dt-=1<<mb-tr[i2_2]++-1:++i6}for(;i6>=0&&dt;--i6){var i2_3=t22[i6].s;tr[i2_3]==mb&&(--tr[i2_3],++dt)}mbt=mb}return{t:new u8(tr),l:mbt}},ln=function(n3,l3,d5){return n3.s==-1?Math.max(ln(n3.l,l3,d5+1),ln(n3.r,l3,d5+1)):l3[n3.s]=d5},lc=function(c5){for(var s2=c5.length;s2&&!c5[--s2];);for(var cl=new u16(++s2),cli=0,cln=c5[0],cls=1,w=function(v){cl[cli++]=v},i6=1;i6<=s2;++i6)if(c5[i6]==cln&&i6!=s2)++cls;else{if(!cln&&cls>2){for(;cls>138;cls-=138)w(32754);cls>2&&(w(cls>10?cls-11<<5|28690:cls-3<<5|12305),cls=0)}else if(cls>3){for(w(cln),--cls;cls>6;cls-=6)w(8304);cls>2&&(w(cls-3<<5|8208),cls=0)}for(;cls--;)w(cln);cls=1,cln=c5[i6]}return{c:cl.subarray(0,cli),n:s2}},clen=function(cf,cl){for(var l3=0,i6=0;i6<cl.length;++i6)l3+=cf[i6]*cl[i6];return l3},wfblk=function(out,pos,dat){var s2=dat.length,o3=shft(pos+2);out[o3]=s2&255,out[o3+1]=s2>>8,out[o3+2]=out[o3]^255,out[o3+3]=out[o3+1]^255;for(var i6=0;i6<s2;++i6)out[o3+i6+4]=dat[i6];return(o3+4+s2)*8},wblk=function(dat,out,final,syms,lf,df,eb,li,bs,bl,p3){wbits(out,p3++,final),++lf[256];for(var _a3=hTree(lf,15),dlt=_a3.t,mlb=_a3.l,_b2=hTree(df,15),ddt=_b2.t,mdb=_b2.l,_c5=lc(dlt),lclt=_c5.c,nlc=_c5.n,_d=lc(ddt),lcdt=_d.c,ndc=_d.n,lcfreq=new u16(19),i6=0;i6<lclt.length;++i6)++lcfreq[lclt[i6]&31];for(var i6=0;i6<lcdt.length;++i6)++lcfreq[lcdt[i6]&31];for(var _e5=hTree(lcfreq,7),lct=_e5.t,mlcb=_e5.l,nlcc=19;nlcc>4&&!lct[clim[nlcc-1]];--nlcc);var flen=bl+5<<3,ftlen=clen(lf,flt)+clen(df,fdt)+eb,dtlen=clen(lf,dlt)+clen(df,ddt)+eb+14+3*nlcc+clen(lcfreq,lct)+2*lcfreq[16]+3*lcfreq[17]+7*lcfreq[18];if(bs>=0&&flen<=ftlen&&flen<=dtlen)return wfblk(out,p3,dat.subarray(bs,bs+bl));var lm,ll,dm,dl;if(wbits(out,p3,1+(dtlen<ftlen)),p3+=2,dtlen<ftlen){lm=hMap(dlt,mlb,0),ll=dlt,dm=hMap(ddt,mdb,0),dl=ddt;var llm=hMap(lct,mlcb,0);wbits(out,p3,nlc-257),wbits(out,p3+5,ndc-1),wbits(out,p3+10,nlcc-4),p3+=14;for(var i6=0;i6<nlcc;++i6)wbits(out,p3+3*i6,lct[clim[i6]]);p3+=3*nlcc;for(var lcts=[lclt,lcdt],it=0;it<2;++it)for(var clct=lcts[it],i6=0;i6<clct.length;++i6){var len=clct[i6]&31;wbits(out,p3,llm[len]),p3+=lct[len],len>15&&(wbits(out,p3,clct[i6]>>5&127),p3+=clct[i6]>>12)}}else lm=flm,ll=flt,dm=fdm,dl=fdt;for(var i6=0;i6<li;++i6){var sym=syms[i6];if(sym>255){var len=sym>>18&31;wbits16(out,p3,lm[len+257]),p3+=ll[len+257],len>7&&(wbits(out,p3,sym>>23&31),p3+=fleb[len]);var dst=sym&31;wbits16(out,p3,dm[dst]),p3+=dl[dst],dst>3&&(wbits16(out,p3,sym>>5&8191),p3+=fdeb[dst])}else wbits16(out,p3,lm[sym]),p3+=ll[sym]}return wbits16(out,p3,lm[256]),p3+ll[256]},deo=new i32([65540,131080,131088,131104,262176,1048704,1048832,2114560,2117632]),et=new u8(0),dflt=function(dat,lvl,plvl,pre,post,st){var s2=st.z||dat.length,o3=new u8(pre+s2+5*(1+Math.ceil(s2/7e3))+post),w=o3.subarray(pre,o3.length-post),lst=st.l,pos=(st.r||0)&7;if(lvl){pos&&(w[0]=st.r>>3);for(var opt=deo[lvl-1],n3=opt>>13,c5=opt&8191,msk_1=(1<<plvl)-1,prev=st.p||new u16(32768),head=st.h||new u16(msk_1+1),bs1_1=Math.ceil(plvl/3),bs2_1=2*bs1_1,hsh=function(i7){return(dat[i7]^dat[i7+1]<<bs1_1^dat[i7+2]<<bs2_1)&msk_1},syms=new i32(25e3),lf=new u16(288),df=new u16(32),lc_1=0,eb=0,i6=st.i||0,li=0,wi=st.w||0,bs=0;i6+2<s2;++i6){var hv=hsh(i6),imod=i6&32767,pimod=head[hv];if(prev[imod]=pimod,head[hv]=imod,wi<=i6){var rem=s2-i6;if((lc_1>7e3||li>24576)&&(rem>423||!lst)){pos=wblk(dat,w,0,syms,lf,df,eb,li,bs,i6-bs,pos),li=lc_1=eb=0,bs=i6;for(var j5=0;j5<286;++j5)lf[j5]=0;for(var j5=0;j5<30;++j5)df[j5]=0}var l3=2,d5=0,ch_1=c5,dif=imod-pimod&32767;if(rem>2&&hv==hsh(i6-dif))for(var maxn=Math.min(n3,rem)-1,maxd=Math.min(32767,i6),ml=Math.min(258,rem);dif<=maxd&&--ch_1&&imod!=pimod;){if(dat[i6+l3]==dat[i6+l3-dif]){for(var nl=0;nl<ml&&dat[i6+nl]==dat[i6+nl-dif];++nl);if(nl>l3){if(l3=nl,d5=dif,nl>maxn)break;for(var mmd=Math.min(dif,nl-2),md=0,j5=0;j5<mmd;++j5){var ti=i6-dif+j5&32767,pti=prev[ti],cd=ti-pti&32767;cd>md&&(md=cd,pimod=ti)}}}imod=pimod,pimod=prev[imod],dif+=imod-pimod&32767}if(d5){syms[li++]=268435456|revfl[l3]<<18|revfd[d5];var lin=revfl[l3]&31,din=revfd[d5]&31;eb+=fleb[lin]+fdeb[din],++lf[257+lin],++df[din],wi=i6+l3,++lc_1}else syms[li++]=dat[i6],++lf[dat[i6]]}}for(i6=Math.max(i6,wi);i6<s2;++i6)syms[li++]=dat[i6],++lf[dat[i6]];pos=wblk(dat,w,lst,syms,lf,df,eb,li,bs,i6-bs,pos),lst||(st.r=pos&7|w[pos/8|0]<<3,pos-=7,st.h=head,st.p=prev,st.i=i6,st.w=wi)}else{for(var i6=st.w||0;i6<s2+lst;i6+=65535){var e6=i6+65535;e6>=s2&&(w[pos/8|0]=lst,e6=s2),pos=wfblk(w,pos+1,dat.subarray(i6,e6))}st.i=s2}return slc(o3,0,pre+shft(pos)+post)},crct=(function(){for(var t=new Int32Array(256),i6=0;i6<256;++i6){for(var c5=i6,k5=9;--k5;)c5=(c5&1&&-306674912)^c5>>>1;t[i6]=c5}return t})(),crc=function(){var c5=-1;return{p:function(d5){for(var cr=c5,i6=0;i6<d5.length;++i6)cr=crct[cr&255^d5[i6]]^cr>>>8;c5=cr},d:function(){return~c5}}};var dopt=function(dat,opt,pre,post,st){if(!st&&(st={l:1},opt.dictionary)){var dict=opt.dictionary.subarray(-32768),newDat=new u8(dict.length+dat.length);newDat.set(dict),newDat.set(dat,dict.length),dat=newDat,st.w=dict.length}return dflt(dat,opt.level==null?6:opt.level,opt.mem==null?st.l?Math.ceil(Math.max(8,Math.min(13,Math.log(dat.length)))*1.5):20:12+opt.mem,pre,post,st)},mrg=function(a5,b7){var o3={};for(var k5 in a5)o3[k5]=a5[k5];for(var k5 in b7)o3[k5]=b7[k5];return o3};var b2=function(d5,b7){return d5[b7]|d5[b7+1]<<8},b4=function(d5,b7){return(d5[b7]|d5[b7+1]<<8|d5[b7+2]<<16|d5[b7+3]<<24)>>>0},b8=function(d5,b7){return b4(d5,b7)+b4(d5,b7+4)*4294967296},wbytes=function(d5,b7,v){for(;v;++b7)d5[b7]=v,v>>>=8};function deflateSync(data,opts){return dopt(data,opts||{},0,0)}function inflateSync(data,opts){return inflt(data,{i:2},opts&&opts.out,opts&&opts.dictionary)}var fltn=function(d5,p3,t,o3){for(var k5 in d5){var val=d5[k5],n3=p3+k5,op2=o3;Array.isArray(val)&&(op2=mrg(o3,val[1]),val=val[0]),ArrayBuffer.isView(val)?t[n3]=[val,op2]:(t[n3+="/"]=[new u8(0),op2],fltn(val,n3,t,o3))}},te=typeof TextEncoder<"u"&&new TextEncoder,td=typeof TextDecoder<"u"&&new TextDecoder,tds=0;try{td.decode(et,{stream:!0}),tds=1}catch{}var dutf8=function(d5){for(var r5="",i6=0;;){var c5=d5[i6++],eb=(c5>127)+(c5>223)+(c5>239);if(i6+eb>d5.length)return{s:r5,r:slc(d5,i6-1)};eb?eb==3?(c5=((c5&15)<<18|(d5[i6++]&63)<<12|(d5[i6++]&63)<<6|d5[i6++]&63)-65536,r5+=String.fromCharCode(55296|c5>>10,56320|c5&1023)):eb&1?r5+=String.fromCharCode((c5&31)<<6|d5[i6++]&63):r5+=String.fromCharCode((c5&15)<<12|(d5[i6++]&63)<<6|d5[i6++]&63):r5+=String.fromCharCode(c5)}};function strToU8(str2,latin1){if(latin1){for(var ar_1=new u8(str2.length),i6=0;i6<str2.length;++i6)ar_1[i6]=str2.charCodeAt(i6);return ar_1}if(te)return te.encode(str2);for(var l3=str2.length,ar=new u8(str2.length+(str2.length>>1)),ai=0,w=function(v){ar[ai++]=v},i6=0;i6<l3;++i6){if(ai+5>ar.length){var n3=new u8(ai+8+(l3-i6<<1));n3.set(ar),ar=n3}var c5=str2.charCodeAt(i6);c5<128||latin1?w(c5):c5<2048?(w(192|c5>>6),w(128|c5&63)):c5>55295&&c5<57344?(c5=65536+(c5&1047552)|str2.charCodeAt(++i6)&1023,w(240|c5>>18),w(128|c5>>12&63),w(128|c5>>6&63),w(128|c5&63)):(w(224|c5>>12),w(128|c5>>6&63),w(128|c5&63))}return slc(ar,0,ai)}function strFromU8(dat,latin1){if(latin1){for(var r5="",i6=0;i6<dat.length;i6+=16384)r5+=String.fromCharCode.apply(null,dat.subarray(i6,i6+16384));return r5}else{if(td)return td.decode(dat);var _a3=dutf8(dat),s2=_a3.s,r5=_a3.r;return r5.length&&err(8),s2}}var slzh=function(d5,b7){return b7+30+b2(d5,b7+26)+b2(d5,b7+28)},zh=function(d5,b7,z){var fnl=b2(d5,b7+28),efl=b2(d5,b7+30),fn=strFromU8(d5.subarray(b7+46,b7+46+fnl),!(b2(d5,b7+8)&2048)),es=b7+46+fnl,_a3=z64hs(d5,es,efl,z,b4(d5,b7+20),b4(d5,b7+24),b4(d5,b7+42)),sc=_a3[0],su=_a3[1],off=_a3[2];return[b2(d5,b7+10),sc,su,fn,es+efl+b2(d5,b7+32),off]},z64hs=function(d5,b7,l3,z,sc,su,off){var nsc=sc==4294967295,nsu=su==4294967295,noff=off==4294967295,e6=b7+l3,nf=nsc+nsu+noff;if(z&&nf){for(;b7+4<e6;b7+=4+b2(d5,b7+2))if(b2(d5,b7)==1)return[nsc?b8(d5,b7+4+8*nsu):sc,nsu?b8(d5,b7+4):su,noff?b8(d5,b7+4+8*(nsu+nsc)):off,1];z<2&&err(13)}return[sc,su,off,0]},exfl=function(ex){var le=0;if(ex)for(var k5 in ex){var l3=ex[k5].length;l3>65535&&err(9),le+=l3+4}return le},wzh=function(d5,b7,f5,fn,u,c5,ce,co){var fl2=fn.length,ex=f5.extra,col=co&&co.length,exl=exfl(ex);wbytes(d5,b7,ce!=null?33639248:67324752),b7+=4,ce!=null&&(d5[b7++]=20,d5[b7++]=f5.os),d5[b7]=20,b7+=2,d5[b7++]=f5.flag<<1|(c5<0&&8),d5[b7++]=u&&8,d5[b7++]=f5.compression&255,d5[b7++]=f5.compression>>8;var dt=new Date(f5.mtime==null?Date.now():f5.mtime),y=dt.getFullYear()-1980;if((y<0||y>119)&&err(10),wbytes(d5,b7,y<<25|dt.getMonth()+1<<21|dt.getDate()<<16|dt.getHours()<<11|dt.getMinutes()<<5|dt.getSeconds()>>1),b7+=4,c5!=-1&&(wbytes(d5,b7,f5.crc),wbytes(d5,b7+4,c5<0?-c5-2:c5),wbytes(d5,b7+8,f5.size)),wbytes(d5,b7+12,fl2),wbytes(d5,b7+14,exl),b7+=16,ce!=null&&(wbytes(d5,b7,col),wbytes(d5,b7+6,f5.attrs),wbytes(d5,b7+10,ce),b7+=14),d5.set(fn,b7),b7+=fl2,exl)for(var k5 in ex){var exf=ex[k5],l3=exf.length;wbytes(d5,b7,+k5),wbytes(d5,b7+2,l3),d5.set(exf,b7+4),b7+=4+l3}return col&&(d5.set(co,b7),b7+=col),b7},wzf=function(o3,b7,c5,d5,e6){wbytes(o3,b7,101010256),wbytes(o3,b7+8,c5),wbytes(o3,b7+10,c5),wbytes(o3,b7+12,d5),wbytes(o3,b7+16,e6)};function zipSync(data,opts){opts||(opts={});var r5={},files=[];fltn(data,"",r5,opts);var o3=0,tot=0;for(var fn in r5){var _a3=r5[fn],file=_a3[0],p3=_a3[1],compression=p3.level==0?0:8,f5=strToU8(fn),s2=f5.length,com=p3.comment,m3=com&&strToU8(com),ms=m3&&m3.length,exl=exfl(p3.extra);s2>65535&&err(11);var d5=compression?deflateSync(file,p3):file,l3=d5.length,c5=crc();c5.p(file),files.push(mrg(p3,{size:file.length,crc:c5.d(),c:d5,f:f5,m:m3,u:s2!=fn.length||m3&&com.length!=ms,o:o3,compression})),o3+=30+s2+exl+l3,tot+=76+2*(s2+exl)+(ms||0)+l3}for(var out=new u8(tot+22),oe=o3,cdl=tot-o3,i6=0;i6<files.length;++i6){var f5=files[i6];wzh(out,f5.o,f5,f5.f,f5.u,f5.c.length);var badd=30+f5.f.length+exfl(f5.extra);out.set(f5.c,f5.o+badd),wzh(out,o3,f5,f5.f,f5.u,f5.c.length,f5.o,f5.m),o3+=16+badd+(f5.m?f5.m.length:0)}return wzf(out,o3,files.length,cdl,oe),out}function unzipSync(data,opts){for(var files={},e6=data.length-22;b4(data,e6)!=101010256;--e6)(!e6||data.length-e6>65558)&&err(13);var c5=b2(data,e6+8);if(!c5)return{};var o3=b4(data,e6+16),z=b4(data,e6-20)==117853008;if(z){var ze=b4(data,e6-12);z=b4(data,ze)==101075792,z&&(c5=b4(data,ze+32),o3=b4(data,ze+48))}for(var fltr=opts&&opts.filter,i6=0;i6<c5;++i6){var _a3=zh(data,o3,z),c_2=_a3[0],sc=_a3[1],su=_a3[2],fn=_a3[3],no=_a3[4],off=_a3[5],b7=slzh(data,off);o3=no,(!fltr||fltr({name:fn,size:sc,originalSize:su,compression:c_2}))&&(c_2?c_2==8?files[fn]=inflateSync(data.subarray(b7,b7+sc),{out:new u8(su)}):err(14,"unknown compression type "+c_2):files[fn]=slc(data,b7,b7+sc))}return files}var import_node_crypto4=require("node:crypto");function sha256HexBytes(b7){return(0,import_node_crypto4.createHash)("sha256").update(b7).digest("hex")}var CAS_BLOB_KEY_PATTERN=/^artifacts\/[^/]+\/filereview\/cas\/blobs\/([0-9a-f]{64})$/,CAS_BLOB_CONTENT_MISMATCH_REASON="artifact content failed integrity verification: the stored bytes do not match the content address in the storage key";function casBlobContentMismatch(storageKey,content){let m3=CAS_BLOB_KEY_PATTERN.exec(storageKey);return m3===null||sha256HexBytes(content)===m3[1]?"":CAS_BLOB_CONTENT_MISMATCH_REASON}var DEFAULT_MAX_ARTIFACT_CONTENT_BYTES=512*1024,DEFAULT_ARTIFACT_URL_EXPIRATION_MS=10080*60*1e3,KNOWN_CONTENT_TYPES=new Map([[".yaml","text/yaml"],[".yml","text/yaml"],[".json","application/json"],[".md","text/markdown"],[".txt","text/plain"],[".csv","text/csv"],[".xml","application/xml"],[".html","text/html"],[".zip","application/zip"],[".tar","application/x-tar"],[".gz","application/gzip"],[".py","text/x-python"],[".go","text/x-go"],[".js","text/javascript"],[".ts","text/typescript"],[".sh","text/x-shellscript"],[".toml","application/toml"]]),OS_MIME_FALLBACK=new Map([[".avif","image/avif"],[".css","text/css; charset=utf-8"],[".gif","image/gif"],[".htm","text/html; charset=utf-8"],[".html","text/html; charset=utf-8"],[".jpeg","image/jpeg"],[".jpg","image/jpeg"],[".js","text/javascript; charset=utf-8"],[".json","application/json"],[".mjs","text/javascript; charset=utf-8"],[".pdf","application/pdf"],[".png","image/png"],[".svg","image/svg+xml"],[".wasm","application/wasm"],[".webp","image/webp"],[".xml","text/xml; charset=utf-8"]]);async function uploadAttachment(deps,req){if(req.filename==="")throw invalidArgumentError("filename is required");if(validateAttachmentFilename(req.filename),req.content.length===0)throw invalidArgumentError("content is required");let uploadId=ulid(),contentType=req.contentType;contentType===""&&(contentType=osMimeTypeByExtension(req.filename));let storageKey=`attachments/${uploadId}/${req.filename}`;deps.logger.info("Uploading attachment to artifact storage",{storageKey,filename:req.filename,contentType,sizeBytes:req.content.length});try{await deps.artifactStorage.upload(storageKey,req.content,contentType)}catch(error2){throw internalError(error2,"failed to upload attachment")}return deps.logger.info("Successfully uploaded attachment to storage",{storageKey,filename:req.filename,sizeBytes:req.content.length}),create2(UploadAttachmentResponseSchema,{storageKey})}function validateAttachmentFilename(name){if(name.includes("/")||name.includes("\\"))throw invalidArgumentError(`filename ${JSON.stringify(name)} must not contain path separators; send a bare filename such as "report.pdf"`);if(name.includes("\0"))throw invalidArgumentError("filename must not contain NUL bytes");if(name==="."||name==="..")throw invalidArgumentError(`filename ${JSON.stringify(name)} must be a bare filename, not a traversal segment`)}async function getArtifactContent(deps,req,identity2){if(req.executionId==="")throw invalidArgumentError("execution_id is required");if(req.storageKey==="")throw invalidArgumentError("storage_key is required");await authorizeDirect(AgentExecutionQueryController.method.getArtifactContent,deps.authorizer,identity2,req);let storageKey=import_node_path2.default.posix.normalize(req.storageKey),expectedPrefix=`artifacts/${req.executionId}/`;if(!storageKey.startsWith(expectedPrefix))throw deps.logger.warn("Storage key does not belong to execution - potential path traversal attempt",{executionId:req.executionId,storageKey:req.storageKey,expectedPrefix}),invalidArgumentError("storage_key does not belong to this execution");try{await deps.store.getResource(ApiResourceKind.agent_execution,req.executionId,AgentExecutionSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?new ConnectError(`execution not found: ${req.executionId}`,Code.NotFound):internalError(error2,"failed to load agent execution")}let maxBytes=Number(req.maxBytes);maxBytes<=0&&(maxBytes=DEFAULT_MAX_ARTIFACT_CONTENT_BYTES);let data;try{data=await deps.artifactStorage.download(storageKey)}catch(error2){throw internalError(error2,"failed to read artifact content")}if(req.entryPath===""&&data.length<=maxBytes){let reason=casBlobContentMismatch(storageKey,data);if(reason!=="")throw deps.logger.error("CAS blob failed content-address integrity check",{executionId:req.executionId,storageKey:req.storageKey}),new ConnectError(reason,Code.DataLoss)}if(req.entryPath!==""){let entryData=extractZipEntry(data,req.entryPath);if(entryData===void 0)throw deps.logger.warn("Failed to extract entry from ZIP artifact",{executionId:req.executionId,storageKey:req.storageKey,entryPath:req.entryPath}),new ConnectError(`entry ${JSON.stringify(req.entryPath)} not found in archive`,Code.NotFound);data=entryData}let totalSize=data.length,truncated=!1;totalSize>maxBytes&&(data=data.slice(0,maxBytes),truncated=!0);let contentKey=req.entryPath!==""?req.entryPath:storageKey,contentType=detectContentType(contentKey);return deps.logger.info("Successfully read artifact content",{executionId:req.executionId,storageKey:req.storageKey,entryPath:req.entryPath,totalSizeBytes:totalSize,returnedBytes:data.length,truncated,contentType}),create2(GetArtifactContentResponseSchema,{content:data,contentType,totalSizeBytes:BigInt(totalSize),truncated})}function extractZipEntry(zipData,entryPath){try{return unzipSync(zipData,{filter:file=>file.name===entryPath})[entryPath]}catch{return}}function detectContentType(storageKey){let ext=fileExtension(storageKey);return ext===""?"application/octet-stream":KNOWN_CONTENT_TYPES.get(ext)??OS_MIME_FALLBACK.get(ext)??"application/octet-stream"}function osMimeTypeByExtension(filename){let ext=fileExtension(filename);return ext===""?"application/octet-stream":OS_MIME_FALLBACK.get(ext)??"application/octet-stream"}function fileExtension(name){let dot=name.lastIndexOf("."),slash=Math.max(name.lastIndexOf("/"),name.lastIndexOf("\\"));return dot<=slash||dot===-1?"":name.slice(dot).toLowerCase()}async function getArtifactDownloadUrl(deps,req,identity2){if(req.executionId==="")throw invalidArgumentError("execution_id is required");if(req.storageKey==="")throw invalidArgumentError("storage_key is required");await authorizeDirect(AgentExecutionQueryController.method.getArtifactDownloadUrl,deps.authorizer,identity2,req);let execution;try{execution=await deps.store.getResource(ApiResourceKind.agent_execution,req.executionId,AgentExecutionSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?new ConnectError(`execution not found: ${req.executionId}`,Code.NotFound):internalError(error2,"failed to load agent execution")}let storageKey=import_node_path2.default.posix.normalize(req.storageKey),expectedPrefix=`artifacts/${req.executionId}/`;if(!storageKey.startsWith(expectedPrefix)&&!isSpecAttachmentKey(execution,storageKey))throw deps.logger.warn("Storage key does not belong to execution - potential path traversal attempt",{executionId:req.executionId,storageKey:req.storageKey,expectedPrefix}),invalidArgumentError("storage_key does not belong to this execution");let expiresInMs=DEFAULT_ARTIFACT_URL_EXPIRATION_MS,expiresAt=new Date(Date.now()+expiresInMs),downloadFilename=req.asAttachment?storageKey.split("/").pop()??"":"",downloadUrl;try{downloadUrl=await deps.artifactStorage.getSignedUrl(storageKey,expiresInMs,downloadFilename)}catch(error2){throw internalError(error2,"failed to generate download URL")}return deps.logger.info("Successfully generated presigned download URL for artifact",{executionId:req.executionId,storageKey:req.storageKey,expiresAt:expiresAt.toISOString()}),create2(GetArtifactDownloadUrlResponseSchema,{downloadUrl,expiresAt:expiresAt.toISOString().replace(/\.\d{3}Z$/,"Z")})}function isSpecAttachmentKey(execution,storageKey){return(execution.spec?.attachments??[]).some(attachment=>attachment.storageKey===storageKey)}var ENGINE_UNAVAILABLE_MESSAGE="The execution engine is temporarily unavailable. Please try again shortly.";function runAgentDeniedMessage(agentId){return`unauthorized to run agent '${agentId}'`}function runAgentInstanceDeniedMessage(agentInstanceId){return`unauthorized to run agent instance '${agentInstanceId}'`}function addExecutionToSessionDeniedMessage(sessionId){return`unauthorized to add an execution to session '${sessionId}'`}var EngineDispatchError=class extends Error{constructor(message6){super(message6),this.name="EngineDispatchError"}},EngineWorkflowNotFoundError=class extends Error{constructor(executionId){super(`workflow not found for execution ${executionId}`),this.name="EngineWorkflowNotFoundError"}},ENGINE_DISCONNECTED=Object.freeze({connected:!1});function newEnsureEngineAvailableStep(engineState){return{name:"EnsureEngineAvailable",execute(_ctx){if(!engineState().connected)throw unavailableError(ENGINE_UNAVAILABLE_MESSAGE)}}}async function notifyStatusObservers(deps,execution,oldPhase,newPhase){if(oldPhase!==newPhase)for(let observer of deps.statusObservers)try{await observer({execution,oldPhase,newPhase})}catch(error2){deps.logger.warn("status observer failed (extension bug, ignored)",{executionId:execution.metadata?.id??"",oldPhase,newPhase,error:error2 instanceof Error?error2.message:String(error2)})}}async function applyResponseDecorators(decorators,logger2,execution,response){let decorated=response;for(let decorator of decorators){let candidate=clone(UpdateStatusResponseSchema,decorated);try{await decorator(execution,candidate),decorated=candidate}catch(error2){logger2.warn("response decorator failed (extension bug, ignored)",{executionId:execution.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}return decorated}var DEFAULT_INSTANCE_ID_KEY2="default_instance_id",CREATED_SESSION_ID_KEY="created_session_id",AUTO_CREATED_SESSION_SUBJECT="Auto-created session";function newCreateDefaultInstanceIfNeededStep(deps){return{name:"CreateDefaultInstanceIfNeeded",async execute(ctx){let execution=ctx.newState,sessionId=execution.spec?.sessionId??"",agentId=execution.spec?.agentId??"";if(sessionId!==""){deps.logger.debug("Session ID already provided, skipping default instance check",{sessionId});return}let specInstanceId=execution.spec?.sessionSpec?.agentInstanceId??"";if(specInstanceId!==""){deps.logger.debug("session_spec carries an explicit agent instance, skipping default instance check",{agentInstanceId:specInstanceId});return}if(agentId===""){deps.logger.debug("No agent named, the built-in assistant runs; skipping default instance check");return}let agent;try{agent=await deps.agentLoader().get(agentId)}catch(error2){throw error2 instanceof ConnectError?rethrownStatusError(error2):error2}let defaultInstanceId=agent.status?.defaultInstanceId??"";if(defaultInstanceId!==""){deps.logger.debug("Agent already has default instance",{defaultInstanceId,agentId}),ctx.set(DEFAULT_INSTANCE_ID_KEY2,defaultInstanceId);return}deps.logger.info("Agent missing default instance, creating one",{agentId});let metadata=agent.metadata;if(metadata===void 0)throw internalError(new Error(`agent ${agentId} has no metadata`),"internal server error");let createdId;try{createdId=(await deps.agentInstanceCreator().createAsCaller(buildDefaultInstanceRequest(metadata),ctx.callerIdentity)).metadata?.id??""}catch(error2){throw error2 instanceof ConnectError?goWrappedStatusError("failed to create default instance",error2):new Error(`failed to create default instance: ${error2 instanceof Error?error2.message:String(error2)}`)}let status=agent.status??=create2(AgentStatusSchema);status.defaultInstanceId=createdId;try{await deps.store.saveResource(ApiResourceKind.agent,agentId,AgentSchema,agent)}catch(error2){throw new Error(`failed to update agent with default instance: ${error2 instanceof Error?error2.message:String(error2)}`)}await notifyDefaultInstanceLinked(deps.authorizationLifecycle,{instanceKind:ApiResourceKind.agent_instance,instanceId:createdId,blueprintKind:ApiResourceKind.agent,blueprintId:agentId}),ctx.set(DEFAULT_INSTANCE_ID_KEY2,createdId),deps.logger.info("Successfully ensured default instance exists",{instanceId:createdId,agentId})}}}function buildAutoCreateSessionSpec(callerSpec,defaultInstanceId){let spec=callerSpec!==void 0?clone(SessionSpecSchema,callerSpec):create2(SessionSpecSchema);return spec.agentInstanceId===""&&(spec.agentInstanceId=defaultInstanceId),spec.subject===""&&(spec.subject=AUTO_CREATED_SESSION_SUBJECT),spec}function newCreateSessionIfNeededStep(deps){return{name:"CreateSessionIfNeeded",async execute(ctx){let execution=ctx.newState,sessionId=execution.spec?.sessionId??"",agentId=execution.spec?.agentId??"";if(sessionId!==""){deps.logger.debug("Session ID already provided, skipping auto-creation",{sessionId});return}let callerSpec=execution.spec?.sessionSpec;deps.logger.info("Session ID not provided, auto-creating session",{agentId,hasSessionSpec:callerSpec!==void 0});let defaultInstanceId="";if((callerSpec?.agentInstanceId??"")===""&&agentId!==""){let resolved=ctx.get(DEFAULT_INSTANCE_ID_KEY2);if(typeof resolved!="string"||resolved==="")throw deps.logger.error("DEFAULT_INSTANCE_ID not found in context",{agentId}),internalError(new Error("default instance ID not found in context"),"internal server error");defaultInstanceId=resolved}let orgId=execution.metadata?.org??"";orgId===""&&(orgId=ctx.input.metadata?.org??"");let sessionRequest=create2(SessionSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"Session",metadata:{name:`session-${Date.now()}`,org:orgId},spec:buildAutoCreateSessionSpec(callerSpec,defaultInstanceId)}),createdSession;try{createdSession=await deps.sessionCreator().createAsCaller(sessionRequest,ctx.callerIdentity)}catch(error2){throw error2 instanceof ConnectError?goWrappedStatusError("failed to create session",error2):new Error(`failed to create session: ${error2 instanceof Error?error2.message:String(error2)}`)}sessionId=createdSession.metadata?.id??"",deps.logger.info("Successfully auto-created session",{sessionId,agentId}),execution.spec??=create2(AgentExecutionSpecSchema),execution.spec.sessionId=sessionId,execution.spec.sessionSpec=void 0,ctx.set(CREATED_SESSION_ID_KEY,sessionId)}}}function newComposeDeclaredPreferencesStep(store,logger2){return{name:"ComposeDeclaredPreferences",async execute(ctx){let execution=ctx.newState;execution.spec??=create2(AgentExecutionSpecSchema),execution.spec.declaredPreferences=create2(DeclaredPreferencesSchema);let orgId=execution.metadata?.org??"";if(orgId===""&&(orgId=ctx.input.metadata?.org??""),orgId===""){logger2.debug("No org on execution metadata, composing no declared preferences");return}let org;try{org=await store.getResource(ApiResourceKind.organization,orgId,OrganizationSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError){logger2.debug("Org not found in store, composing no declared preferences",{orgId});return}logger2.error("Failed to load org for declared preferences - degrading to none (best-effort contract)",{orgId,error:error2 instanceof Error?error2.message:String(error2)});return}execution.spec.declaredPreferences.orgContext=org.spec?.preferences?.standingContext??""}}}function newComposeRecalledMemoriesStep(store,logger2){return{name:"ComposeRecalledMemories",async execute(ctx){let execution=ctx.newState;execution.spec??=create2(AgentExecutionSpecSchema),execution.spec.recalledMemories=create2(RecalledMemoriesSchema);let orgId=execution.metadata?.org??"";if(orgId===""&&(orgId=ctx.input.metadata?.org??""),orgId===""){logger2.debug("No org on execution metadata, composing no recalled memories");return}let org;try{org=await store.getResource(ApiResourceKind.organization,orgId,OrganizationSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError){logger2.debug("Org not found in store, composing no recalled memories",{orgId});return}logger2.error("Failed to load org for recalled memories - degrading to disabled (best-effort contract)",{orgId,error:error2 instanceof Error?error2.message:String(error2)});return}if(!(org.spec?.preferences?.memoryEnabled??!1))return;let facts;try{facts=await loadConfirmedFacts(store,orgId)}catch(error2){logger2.error("Failed to load memories for recall - degrading to disabled (best-effort contract)",{orgId,error:error2 instanceof Error?error2.message:String(error2)});return}execution.spec.recalledMemories.enabled=!0,execution.spec.recalledMemories.facts=facts,logger2.debug("Composed recalled memories snapshot",{orgId,factCount:facts.length})}}}async function loadConfirmedFacts(store,orgId){let rows=await store.listResources(ApiResourceKind.memory),memories=[];for(let data of rows){let memory;try{memory=fromBinary2(MemorySchema,data)}catch{continue}(memory.metadata?.org??"")===orgId&&(memory.spec?.subjectIdentityAccountId??"")===""&&memory.status?.lifecycleState===MemoryLifecycleState.lifecycle_state_confirmed&&memories.push(memory)}return memories.sort((a5,b7)=>{let ta=a5.status?.audit?.specAudit?.createdAt,tb=b7.status?.audit?.specAudit?.createdAt;return ta===void 0||tb===void 0?ta===tb?0:ta===void 0?-1:1:ta.seconds!==tb.seconds?ta.seconds<tb.seconds?-1:1:ta.nanos-tb.nanos}),memories.map(memory=>create2(RecalledMemoryFactSchema,{memoryId:memory.metadata?.id??"",content:memory.spec?.content??""}))}function newSetInitialPhaseStep(){return{name:"SetInitialPhase",execute(ctx){let execution=ctx.newState;execution.status??=create2(AgentExecutionStatusSchema),execution.status.phase=ExecutionPhase.EXECUTION_PENDING}}}function newProcessAttachmentsStep(logger2){return{name:"ProcessAttachments",execute(ctx){let attachments=ctx.newState.spec?.attachments??[];if(attachments.length!==0){for(let attachment of attachments)if(attachment.storageKey==="")throw logger2.error("Attachment missing storage_key - all attachments must be pre-uploaded via uploadAttachment RPC",{filename:attachment.filename}),invalidArgumentError(`attachment '${attachment.filename}' missing storage_key: all attachments must be pre-uploaded via uploadAttachment RPC`);logger2.info("All attachments validated successfully",{attachmentCount:attachments.length})}}}}function newStartWorkflowStep(deps){return{name:"StartWorkflow",async execute(ctx){let execution=ctx.newState,executionId=execution.metadata?.id??"",engine=deps.engineState();if(!engine.connected)throw unavailableError(ENGINE_UNAVAILABLE_MESSAGE);let callbackToken=execution.spec?.callbackToken??new Uint8Array;if(callbackToken.length>0){let tokenBase64=Buffer.from(callbackToken).toString("base64");deps.logger.info("\u{1F4DD} Callback token present - workflow will complete external activity on finish",{executionId,tokenPreview:tokenBase64.length>20?`${tokenBase64.slice(0,20)}...`:tokenBase64,tokenLength:callbackToken.length})}try{await engine.engine.startInvokeWorkflow({executionId,sessionId:execution.spec?.sessionId??"",agentId:execution.spec?.agentId??"",callbackToken,autoApproveAll:execution.spec?.autoApproveAll??!1,parentWorkflowId:execution.spec?.parentWorkflowId??"",activityTaskQueueOverride:execution.spec?.activityTaskQueue??""})}catch(error2){if(error2 instanceof EngineDispatchError)throw deps.logger.warn("Activity dispatch failed",{executionId,error:error2.message}),failedPreconditionError(error2.message);deps.logger.error("Failed to start Temporal workflow - marking execution as FAILED",{executionId,error:error2 instanceof Error?error2.message:String(error2)}),execution.status??=create2(AgentExecutionStatusSchema);let oldPhase=execution.status.phase;execution.status.phase=ExecutionPhase.EXECUTION_FAILED,execution.status.error=`Failed to start Temporal workflow: ${error2 instanceof Error?error2.message:String(error2)}`;try{await deps.store.saveResource(ctx.apiResourceKind,executionId,AgentExecutionSchema,execution)}catch(updateError){throw internalError(updateError,"failed to start workflow and failed to update status")}throw await notifyStatusObservers(deps,execution,oldPhase,ExecutionPhase.EXECUTION_FAILED),internalError(error2,"failed to start workflow")}deps.logger.info("Temporal workflow started successfully",{executionId})}}}var WORKFLOW_ROUTING_GLOBAL="global",WORKFLOW_ROUTING_EXECUTION="execution",WORKFLOW_DEFAULT_EXECUTION_TARGET_LOCAL="local",WORKFLOW_DEFAULT_EXECUTION_TARGET_CLOUD="cloud",WorkflowExecutionTemporalConfig=class{stigmerQueue;runnerQueue;workflowActivityRouting;defaultExecutionTarget;constructor(stigmerQueue,runnerQueue,workflowActivityRouting,defaultExecutionTarget){this.stigmerQueue=stigmerQueue,this.runnerQueue=runnerQueue,this.workflowActivityRouting=workflowActivityRouting,this.defaultExecutionTarget=defaultExecutionTarget}resolveWorkflowExecutionTarget(target){return target!==ExecutionTarget.UNSPECIFIED?target:this.defaultExecutionTarget===WORKFLOW_DEFAULT_EXECUTION_TARGET_CLOUD?ExecutionTarget.CLOUD:ExecutionTarget.LOCAL}};function newWorkflowExecutionConfigFromEnv(){return new WorkflowExecutionTemporalConfig(valueOrDefault2(process.env.TEMPORAL_WORKFLOW_EXECUTION_STIGMER_TASK_QUEUE,"workflow_execution_stigmer"),valueOrDefault2(process.env.TEMPORAL_WORKFLOW_EXECUTION_RUNNER_TASK_QUEUE,"stigmer_runner"),valueOrDefault2(process.env.STIGMER_WORKFLOW_ACTIVITY_ROUTING,WORKFLOW_ROUTING_GLOBAL),valueOrDefault2(process.env.STIGMER_WORKFLOW_DEFAULT_EXECUTION_TARGET,WORKFLOW_DEFAULT_EXECUTION_TARGET_LOCAL))}function valueOrDefault2(value,fallback3){return value===void 0||value===""?fallback3:value}var SESSION_TASK_QUEUE_PREFIX="session:";function formatSessionTaskQueue(sessionId){return SESSION_TASK_QUEUE_PREFIX+sessionId}async function resolveActivityTaskQueue(store,sessionId,config2,activityTaskQueueOverride,logger2){if(activityTaskQueueOverride!==""){let harness2=Harness.NATIVE;if(sessionId!=="")try{harness2=(await store.getResource(ApiResourceKind.session,sessionId,SessionSchema)).spec?.harness??Harness.UNSPECIFIED}catch{}return logger2.info("Dispatch using activity_task_queue override (sandbox affinity)",{session_id:sessionId,task_queue:activityTaskQueueOverride,override_source:"parent_workflow_sandbox"}),{taskQueue:activityTaskQueueOverride,harness:harness2,executionTarget:ExecutionTarget.LOCAL}}let harness=Harness.NATIVE,executionTarget=ExecutionTarget.UNSPECIFIED;if(sessionId!=="")try{let session=await store.getResource(ApiResourceKind.session,sessionId,SessionSchema);harness=session.spec?.harness??Harness.UNSPECIFIED,executionTarget=session.spec?.executionTarget??ExecutionTarget.UNSPECIFIED}catch(error2){if(!(error2 instanceof ResourceNotFoundError))throw new Error(`failed to load session for dispatch: ${error2 instanceof Error?error2.message:String(error2)}`);logger2.warn("Session not found during dispatch, using defaults",{session_id:sessionId})}let resolvedTarget=config2.resolveExecutionTarget(executionTarget),taskQueue=resolveTaskQueue(sessionId,config2);return logger2.info("Dispatch resolved activity task queue",{session_id:sessionId,task_queue:taskQueue,routing_mode:config2.activityRouting,execution_target:ExecutionTarget[resolvedTarget]}),{taskQueue,harness,executionTarget:resolvedTarget}}function resolveTaskQueue(sessionId,config2){return config2.activityRouting===ROUTING_SESSION&&sessionId!==""?formatSessionTaskQueue(sessionId):config2.runnerQueue}var ENGINE_UNAVAILABLE_MESSAGE2="The execution engine is temporarily unavailable. Please try again shortly.";function runWorkflowDeniedMessage(workflowId){return`unauthorized to run workflow '${workflowId}'`}function runWorkflowInstanceDeniedMessage(workflowInstanceId){return`unauthorized to run workflow instance '${workflowInstanceId}'`}var TEMPORAL_UNAVAILABLE_MESSAGE="Temporal is not available",TEMPORAL_UNAVAILABLE_CREATOR_MESSAGE="Temporal is not available (workflow creator not set)",WORKFLOW_CREATOR_UNAVAILABLE_MESSAGE="workflow creator is not available",INVOKE_WORKFLOW_EXECUTION_WORKFLOW_NAME="stigmer/workflow-execution/invoke";function orchestratorWorkflowId(executionId){return`${INVOKE_WORKFLOW_EXECUTION_WORKFLOW_NAME}/${executionId}`}function childWorkflowId(executionId){return`workflow-exec-${executionId}`}var PAUSE_SIGNAL_NAME="pause",RESUME_SIGNAL_NAME="resume",RELAY_SIGNAL_CHANNEL_NAME="relaySignal",HUMAN_INPUT_SIGNAL_PREFIX="human_input_",DEFAULT_EVENT_PAGE_SIZE=100,MAX_EVENT_PAGE_SIZE=500,DEFAULT_PENDING_APPROVALS_PAGE_SIZE=20,MAX_PENDING_APPROVALS_PAGE_SIZE=100,EVENT_POLL_INTERVAL_MS=500;var MEMO_RUNNER_TASK_QUEUE="runnerTaskQueue";var UPDATE_WORKFLOW_EXECUTION_STATUS_ACTIVITY_NAME="UpdateWorkflowExecutionStatus",WFEXEC_QUEUE_PREFIX="wfexec:";function formatWfExecTaskQueue(executionId){return`${WFEXEC_QUEUE_PREFIX}${executionId}`}function resolveWorkflowTaskQueue(executionId,executionTarget,config2,logger2){let resolved=config2.resolveWorkflowExecutionTarget(executionTarget);if(config2.workflowActivityRouting===WORKFLOW_ROUTING_EXECUTION){let taskQueue=formatWfExecTaskQueue(executionId);return logger2.info("Workflow dispatch resolved per-execution queue",{execution_id:executionId,task_queue:taskQueue,routing_mode:config2.workflowActivityRouting,execution_target:resolved}),{taskQueue,executionTarget:resolved}}return logger2.info("Workflow dispatch resolved global queue",{execution_id:executionId,task_queue:config2.runnerQueue,routing_mode:config2.workflowActivityRouting,execution_target:resolved}),{taskQueue:config2.runnerQueue,executionTarget:resolved}}var import_node_crypto6=require("node:crypto");var import_node_crypto5=require("node:crypto"),import_node_fs2=__toESM(require("node:fs"),1),import_node_os2=__toESM(require("node:os"),1),import_node_path3=__toESM(require("node:path"),1),KEY_SIZE=32,KEY_FILE_DIR=".stigmer",KEY_FILE_PERMISSIONS=384,KEY_DIR_PERMISSIONS=448,RAW_32_BYTE_KEY={fromEnv(envVar,decoded){if(decoded.length!==KEY_SIZE)throw new Error(`${envVar} must be exactly 32 bytes (256 bits) when decoded, got ${decoded.length} bytes`);return decoded},fromFile(content){return content.length===KEY_SIZE?content:void 0},generate(){return(0,import_node_crypto5.randomBytes)(KEY_SIZE)},toFile(key){return key}};function getOrCreateNamedKey(envVar,fileName,options={}){return getOrCreateKey(RAW_32_BYTE_KEY,envVar,fileName,options)}function getOrCreateKey(codec,envVar,fileName,options={}){let envValue=(options.env??process.env)[envVar];if(envValue!==void 0&&envValue!=="")return codec.fromEnv(envVar,decodeEnvBase64(envVar,envValue));let keyPath=namedKeyFilePath(fileName,options),content=readKeyFile(keyPath),fromFile=content===void 0?void 0:codec.fromFile(content);if(fromFile!==void 0)return fromFile;let key=codec.generate();try{saveKeyToFile(keyPath,codec.toFile(key))}catch(error2){process.stderr.write(`Warning: could not save key to ${keyPath}: ${error2 instanceof Error?error2.message:String(error2)}
 `)}return key}function decodeEnvBase64(envVar,value){let decoded=Buffer.from(value,"base64");if(decoded.toString("base64")!==value)throw new Error(`invalid Base64 encoding in ${envVar}`);return decoded}function namedKeyFilePath(fileName,options={}){let home=options.homeDir??import_node_os2.default.homedir();return import_node_path3.default.join(home,KEY_FILE_DIR,fileName)}function readKeyFile(keyPath){let stat4;try{stat4=import_node_fs2.default.statSync(keyPath)}catch{return}if(!(process.platform!=="win32"&&(stat4.mode&511)!==KEY_FILE_PERMISSIONS))try{return import_node_fs2.default.readFileSync(keyPath)}catch{return}}function saveKeyToFile(keyPath,content){import_node_fs2.default.mkdirSync(import_node_path3.default.dirname(keyPath),{recursive:!0,mode:KEY_DIR_PERMISSIONS}),import_node_fs2.default.writeFileSync(keyPath,content,{mode:KEY_FILE_PERMISSIONS})}var TOKEN_TYPE_EXECUTION_SCOPED="execution_scoped",RUNNER_TOKEN_KEY_ENV_VAR="STIGMER_RUNNER_TOKEN_KEY",RUNNER_TOKEN_KEY_FILE_NAME="runner-token.key",DEFAULT_TTL_SECONDS=3600,InvalidTokenError=class extends Error{constructor(){super("invalid runner token"),this.name="InvalidTokenError"}},MintingDisabledError=class extends Error{constructor(){super("runner token minting is disabled - no signing key configured"),this.name="MintingDisabledError"}},JWT_HEADER=Buffer.from('{"alg":"HS256","typ":"JWT"}').toString("base64url"),RunnerAuthService=class _RunnerAuthService{key;constructor(key){this.key=key}static create(key){return key===void 0||key.length===0?new _RunnerAuthService(void 0):new _RunnerAuthService(key)}static fromEnv(options={}){let key=getOrCreateNamedKey(RUNNER_TOKEN_KEY_ENV_VAR,RUNNER_TOKEN_KEY_FILE_NAME,options);return _RunnerAuthService.create(key)}isEnabled(){return this.key!==void 0}mint(executionId,ttlSeconds=0){let ttl=ttlSeconds>0?ttlSeconds:DEFAULT_TTL_SECONDS,nowSeconds=Math.floor(Date.now()/1e3);return{token:this.signClaims(executionId,{iat:nowSeconds,exp:nowSeconds+ttl}),ttlSeconds:ttl}}mintRunCredential(executionId){return this.signClaims(executionId,{iat:Math.floor(Date.now()/1e3)})}signClaims(executionId,clock){if(this.key===void 0)throw new MintingDisabledError;if(executionId==="")throw new Error("execution id is required to mint a runner token");let claims={token_type:TOKEN_TYPE_EXECUTION_SCOPED,execution_id:executionId,...clock},signingInput=JWT_HEADER+"."+Buffer.from(JSON.stringify(claims)).toString("base64url");return signingInput+"."+this.sign(signingInput)}verify(token){if(this.key===void 0)throw new InvalidTokenError;let parts=token.split(".");if(parts.length!==3)throw new InvalidTokenError;if(parts[0]!==JWT_HEADER)throw new InvalidTokenError;let signingInput=parts[0]+"."+parts[1],expected=Buffer.from(this.sign(signingInput)),provided=Buffer.from(parts[2]);if(expected.length!==provided.length||!(0,import_node_crypto6.timingSafeEqual)(expected,provided))throw new InvalidTokenError;let claims;try{claims=JSON.parse(Buffer.from(parts[1],"base64url").toString("utf8"))}catch{throw new InvalidTokenError}if(claims.token_type!==TOKEN_TYPE_EXECUTION_SCOPED||typeof claims.execution_id!="string"||claims.execution_id==="")throw new InvalidTokenError;if(claims.exp!==void 0&&(typeof claims.exp!="number"||Math.floor(Date.now()/1e3)>=claims.exp))throw new InvalidTokenError;return claims.execution_id}sign(signingInput){if(this.key===void 0)throw new InvalidTokenError;return(0,import_node_crypto6.createHmac)("sha256",this.key).update(signingInput).digest("base64url")}};function peekTokenType(token){let type2=decodePayload(token)?.token_type;return typeof type2=="string"&&type2!==""?type2:void 0}function isClockedToken(verifiedToken){return typeof decodePayload(verifiedToken)?.exp=="number"}function decodePayload(token){let segments=token.split(".");if(segments.length===3)try{let decoded=JSON.parse(Buffer.from(segments[1]??"","base64url").toString("utf8"));return typeof decoded=="object"&&decoded!==null?decoded:void 0}catch{return}}var SANDBOX_TOKEN_TTL_SECONDS=14400;function newSandboxLane(provisioner,credentials){return provisioner===void 0?{enabled:!1}:{enabled:!0,provisioner,credentials}}function mintSandboxToken(lane,request,logger2){let mintSandboxCredential=lane.credentials.mintSandboxCredential?.bind(lane.credentials);return mintSandboxCredential!==void 0?mintSandboxCredential(request):lane.credentials.isEnabled(TOKEN_TYPE_EXECUTION_SCOPED)?lane.credentials.mint(TOKEN_TYPE_EXECUTION_SCOPED,request.executionId,SANDBOX_TOKEN_TTL_SECONDS).token:(logger2.warn("Sandbox launching without a runner token (credential lane disabled) \u2014 ExecutionContext reads will be redacted",{executionId:request.executionId}),"")}var SANDBOX_PROVISIONING_FAILED_PREFIX="Sandbox provisioning failed: ";function newEnsureSessionSandboxStep(deps){return{name:"EnsureSessionSandbox",async execute(ctx){await ensureSessionSandboxForExecution(deps,ctx.newState,ctx.callerIdentity)}}}async function ensureSessionSandboxForExecution(deps,execution,caller){if(!deps.lane.enabled)return;let lane=deps.lane,executionId=execution.metadata?.id??"",sessionId=execution.spec?.sessionId??"";if(!(sessionId===""||(execution.spec?.activityTaskQueue??"")!==""))try{let dispatch=await resolveActivityTaskQueue(deps.store,sessionId,deps.temporalConfig,"",deps.logger);if(dispatch.executionTarget!==ExecutionTarget.CLOUD)return;if(dispatch.taskQueue!==formatSessionTaskQueue(sessionId)){deps.logger.warn("Sandbox provisioning skipped: session routing is not per-session",{executionId,sessionId,taskQueue:dispatch.taskQueue});return}await lane.provisioner.ensureSessionSandbox(sessionId,{taskQueue:dispatch.taskQueue,stigmerToken:mintSandboxToken(lane,{scope:"session",sessionId,executionId,org:execution.metadata?.org??"",callerIdentityId:caller.identityId},deps.logger),callerClass:caller.callerClass})}catch(error2){deps.logger.error("Session sandbox provisioning failed - execution will time out unless a runner polls its queue",{executionId,sessionId,error:error2 instanceof Error?error2.message:String(error2)}),await stampProvisioningFailure(deps.store,deps.logger,executionId,error2)}}async function stampProvisioningFailure(store,logger2,executionId,cause){let message6=SANDBOX_PROVISIONING_FAILED_PREFIX+(cause instanceof Error?cause.message:String(cause));try{await store.updateResource(ApiResourceKind.agent_execution,executionId,AgentExecutionSchema,execution=>{execution.status??=create2(AgentExecutionStatusSchema),execution.status.error===""&&(execution.status.error=message6)})}catch(error2){logger2.error("Failed to pre-stamp sandbox provisioning failure",{executionId,error:error2 instanceof Error?error2.message:String(error2)})}}function newEnsureWorkflowSandboxStep(deps){return{name:"EnsureWorkflowSandbox",async execute(ctx){await ensureWorkflowSandboxForExecution(deps,ctx.newState,ctx.callerIdentity)}}}async function ensureWorkflowSandboxForExecution(deps,execution,caller){if(!deps.lane.enabled)return;let lane=deps.lane,executionId=execution.metadata?.id??"";if(executionId===""||deps.temporalConfig.workflowActivityRouting!==WORKFLOW_ROUTING_EXECUTION)return;let dispatch=resolveWorkflowTaskQueue(executionId,execution.spec?.executionTarget??ExecutionTarget.UNSPECIFIED,deps.temporalConfig,deps.logger);if(dispatch.executionTarget===ExecutionTarget.CLOUD)try{await lane.provisioner.ensureWorkflowSandbox(executionId,{taskQueue:dispatch.taskQueue,stigmerToken:mintSandboxToken(lane,{scope:"workflow",sessionId:"",executionId,org:execution.metadata?.org??"",callerIdentityId:caller.identityId},deps.logger),callerClass:caller.callerClass})}catch(error2){throw deps.logger.error("Workflow sandbox provisioning failed - refusing the request",{executionId,error:error2 instanceof Error?error2.message:String(error2)}),unavailableError("failed to provision workflow sandbox")}}var TERMINAL_WORKFLOW_PHASES=new Set([ExecutionPhase2.EXECUTION_COMPLETED,ExecutionPhase2.EXECUTION_FAILED,ExecutionPhase2.EXECUTION_CANCELLED,ExecutionPhase2.EXECUTION_TERMINATED]);function newWorkflowSandboxTerminalObserver(lane,logger2){return(executionId,previousPhase,currentPhase)=>{!lane.enabled||previousPhase===currentPhase||!TERMINAL_WORKFLOW_PHASES.has(currentPhase)||lane.provisioner.deprovisionWorkflowSandbox(executionId).then(()=>{logger2.info("Workflow sandbox deprovisioned on terminal phase",{executionId,phase:ExecutionPhase2[currentPhase]})},error2=>{logger2.error("Workflow sandbox deprovision failed - sandbox may be leaked",{executionId,error:error2 instanceof Error?error2.message:String(error2)})})}}async function deprovisionSessionSandboxBestEffort(lane,logger2,sessionId){if(!(!lane.enabled||sessionId===""))try{await lane.provisioner.deprovisionSessionSandbox(sessionId)}catch(error2){logger2.error("Session sandbox deprovision failed - sandbox may be leaked",{sessionId,error:error2 instanceof Error?error2.message:String(error2)})}}var file_ai_stigmer_agentic_environment_v1_io=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvZW52aXJvbm1lbnQvdjEvaW8ucHJvdG8SIWFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MSImCg1FbnZpcm9ubWVudElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiVAobRW52aXJvbm1lbnRTZWNyZXRWYWx1ZUlucHV0Eh8KDmVudmlyb25tZW50X2lkGAEgASgJQge6SARyAhABEhQKA2tleRgCIAEoCUIHukgEcgIQASLrAQoXTGlzdEVudmlyb25tZW50c1JlcXVlc3QSFAoDb3JnGAEgASgJQge6SARyAhABElYKBmxhYmVscxgCIAMoCzJGLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5MaXN0RW52aXJvbm1lbnRzUmVxdWVzdC5MYWJlbHNFbnRyeRIzCglwYWdlX2luZm8YAyABKAsyIC5haS5zdGlnbWVyLmNvbW1vbnMucnBjLlBhZ2VJbmZvGi0KC0xhYmVsc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEiZQoPRW52aXJvbm1lbnRMaXN0EhMKC3RvdGFsX2NvdW50GAEgASgFEj0KBWl0ZW1zGAIgAygLMi4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50IpMCCiFVcGRhdGVFbnZpcm9ubWVudFZhcmlhYmxlc1JlcXVlc3QSHwoOZW52aXJvbm1lbnRfaWQYASABKAlCB7pIBHICEAESZgoJdmFyaWFibGVzGAIgAygLMlMuYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLlVwZGF0ZUVudmlyb25tZW50VmFyaWFibGVzUmVxdWVzdC5WYXJpYWJsZXNFbnRyeRplCg5WYXJpYWJsZXNFbnRyeRILCgNrZXkYASABKAkSQgoFdmFsdWUYAiABKAsyMy5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnRWYWx1ZToCOAEiXAohUmVtb3ZlRW52aXJvbm1lbnRWYXJpYWJsZXNSZXF1ZXN0Eh8KDmVudmlyb25tZW50X2lkGAEgASgJQge6SARyAhABEhYKBGtleXMYAiADKAlCCLpIBZIBAggBYgZwcm90bzM",[file_ai_stigmer_agentic_environment_v1_api,file_ai_stigmer_agentic_environment_v1_spec,file_ai_stigmer_commons_rpc_pagination,file_buf_validate_validate]);var EnvironmentSecretValueInputSchema=messageDesc2(file_ai_stigmer_agentic_environment_v1_io,1),ListEnvironmentsRequestSchema=messageDesc2(file_ai_stigmer_agentic_environment_v1_io,2),EnvironmentListSchema=messageDesc2(file_ai_stigmer_agentic_environment_v1_io,3),UpdateEnvironmentVariablesRequestSchema=messageDesc2(file_ai_stigmer_agentic_environment_v1_io,4);function mergeEnvironmentLayers(environments,runtimeEnv){let merged=new Map;for(let env2 of environments)if(env2!==void 0)for(let[key,ev]of Object.entries(env2.spec?.data??{}))ev.value!==""&&merged.set(key,create2(ExecutionValueSchema,{value:ev.value,isSecret:ev.isSecret}));for(let[key,ev]of Object.entries(runtimeEnv))ev!==void 0&&merged.set(key,ev);return merged}function filterByDeclaredKeys(merged,declarations){if(Object.keys(declarations).length===0)return{filtered:merged,excludedKeys:[]};let filtered=new Map,excludedKeys=[];for(let[key,val]of merged)Object.hasOwn(declarations,key)?filtered.set(key,val):excludedKeys.push(key);return excludedKeys.sort(),{filtered,excludedKeys}}function validateRequiredKeys(filtered,declarations){let missingRequired=[];for(let[key,decl]of Object.entries(declarations))decl.optional||filtered.has(key)||missingRequired.push(key);return missingRequired.sort(),missingRequired}var import_node_crypto7=require("node:crypto");var InvalidCiphertextError=class extends Error{constructor(detail){super(`invalid ciphertext format: ${detail}`),this.name="InvalidCiphertextError"}},DecryptionFailedError=class extends InvalidCiphertextError{constructor(cause){super("wrong key or tampered data"),this.message="decryption failed - wrong key or tampered data",this.name="DecryptionFailedError",this.cause=cause}},EncryptionUnavailableError=class extends Error{constructor(message6){super(message6),this.name="EncryptionUnavailableError"}},EncryptionDisabledError=class extends EncryptionUnavailableError{constructor(){super("encryption is not enabled - no key configured"),this.name="EncryptionDisabledError"}};var GCM_NONCE_SIZE=12,GCM_TAG_SIZE=16,ENCRYPTED_PREFIX="enc:v1:",V1_VERSION="v1",StaticKeySecretCodec=class{version=V1_VERSION;key;constructor(key){if(key===void 0||key.length===0){this.key=void 0;return}if(key.length!==KEY_SIZE)throw new Error(`encryption key must be exactly 32 bytes (256 bits): got ${key.length} bytes`);this.key=key}isEnabled(){return this.key!==void 0}async encrypt(plaintext,_scope){if(this.key===void 0)return plaintext;let nonce=(0,import_node_crypto7.randomBytes)(GCM_NONCE_SIZE),cipher=(0,import_node_crypto7.createCipheriv)("aes-256-gcm",this.key,nonce),ciphertext=Buffer.concat([cipher.update(plaintext,"utf8"),cipher.final()]),tag2=cipher.getAuthTag(),sealed=Buffer.concat([nonce,ciphertext,tag2]);return ENCRYPTED_PREFIX+sealed.toString("base64")}async decrypt(encrypted){if(this.key===void 0)throw new EncryptionDisabledError;let base64Data=encrypted.slice(ENCRYPTED_PREFIX.length),sealed=Buffer.from(base64Data,"base64");if(sealed.toString("base64")!==base64Data)throw new InvalidCiphertextError("invalid base64 encoding");if(sealed.length<GCM_NONCE_SIZE+GCM_TAG_SIZE)throw new InvalidCiphertextError("ciphertext too short");let nonce=sealed.subarray(0,GCM_NONCE_SIZE),ciphertext=sealed.subarray(GCM_NONCE_SIZE,sealed.length-GCM_TAG_SIZE),tag2=sealed.subarray(sealed.length-GCM_TAG_SIZE),decipher=(0,import_node_crypto7.createDecipheriv)("aes-256-gcm",this.key,nonce);decipher.setAuthTag(tag2);try{return Buffer.concat([decipher.update(ciphertext),decipher.final()]).toString("utf8")}catch(error2){throw new DecryptionFailedError(error2)}}};var PLATFORM_TENANT="platform",ORG_TENANT_PREFIX="org-",ORG_SLUG=/^[a-z][a-z0-9-]*[a-z0-9]$/,KIND2=/^[a-z][a-z0-9]*$/,EncryptionScope=class _EncryptionScope{tenantSegment;kind;id;keyName;constructor(tenantSegment,kind,id,keyName){this.tenantSegment=tenantSegment,this.kind=kind,this.id=id,this.keyName=keyName}static forOrganization(orgSlug){return new _EncryptionScope(orgSegment(orgSlug),void 0,void 0,void 0)}static forOrganizationResource(orgSlug,kind,id){return validateLocation(kind,id),new _EncryptionScope(orgSegment(orgSlug),kind,id,void 0)}static forPlatformResource(kind,id){return validateLocation(kind,id),new _EncryptionScope(PLATFORM_TENANT,kind,id,void 0)}withKeyName(keyName){if(this.kind===void 0)throw new Error(`encryption scope keyName requires a located scope (kind + id) - keyName '${keyName}' names a secret inside a resource`);if(keyName==="")throw new Error("encryption scope keyName must not be empty");return new _EncryptionScope(this.tenantSegment,this.kind,this.id,keyName)}isLocated(){return this.kind!==void 0}kekKeyName(){return this.tenantSegment}};function orgSegment(orgSlug){if(!ORG_SLUG.test(orgSlug))throw new Error(`encryption scope requires a valid org slug (pattern ${ORG_SLUG.source}), got: '${orgSlug}'`);return ORG_TENANT_PREFIX+orgSlug}function validateLocation(kind,id){if(!KIND2.test(kind))throw new Error(`encryption scope kind must be a lowercase server-side constant (pattern ${KIND2.source}), got: '${kind}'`);if(id.trim()==="")throw new Error("encryption scope id must not be blank")}var ENCRYPTION_KEY_ENV_VAR="STIGMER_ENCRYPTION_KEY",ENCRYPTION_KEY_FILE_NAME="encryption.key",ENCRYPTION_WRITE_VERSION_ENV_VAR="STIGMER_ENCRYPTION_WRITE_VERSION",DEFAULT_WRITE_VERSION=V1_VERSION,REDACTED_MARKER="***REDACTED***",VERSIONED_PREFIX=/^enc:v(\d+):/,VERSION_TOKEN=/^v(\d+)$/;function isCiphertextShaped(value){return VERSIONED_PREFIX.test(value)}function versionTokenOf(value){let match=VERSIONED_PREFIX.exec(value);return match===null?void 0:`v${match[1]}`}var SecretService=class _SecretService{codecs;writeCodec;writeVersionNumber;constructor(codecs,writeCodec,writeVersionNumber){this.codecs=codecs,this.writeCodec=writeCodec,this.writeVersionNumber=writeVersionNumber}static create(key){return _SecretService.withCodecs({codecs:new Map([[V1_VERSION,new StaticKeySecretCodec(key)]]),writeVersion:V1_VERSION})}static fromEnv(options={}){let key=getOrCreateNamedKey(ENCRYPTION_KEY_ENV_VAR,ENCRYPTION_KEY_FILE_NAME,options);return _SecretService.create(key)}static withCodecs(options){for(let[token,codec]of options.codecs){if(!VERSION_TOKEN.test(token))throw new Error(`secret codec registered under '${token}' \u2014 version tokens must match v<digits> (the enc:v<N>: dispatch shape)`);if(codec.version!==token)throw new Error(`secret codec registered under '${token}' declares version '${codec.version}' \u2014 the registry key must equal the codec's own version`)}let writeCodec=options.codecs.get(options.writeVersion);if(writeCodec===void 0){let registered=[...options.codecs.keys()].sort().join(", ");throw new Error(`${ENCRYPTION_WRITE_VERSION_ENV_VAR} is '${options.writeVersion}' but this deployment has no codec for it (registered: ${registered}). Refusing to start rather than silently writing a different version.`)}let writeVersionNumber=Number(VERSION_TOKEN.exec(options.writeVersion)?.[1]);return new _SecretService(new Map(options.codecs),writeCodec,writeVersionNumber)}isEnabled(){return this.writeCodec.isEnabled?.()??!0}isEncrypted(value){return isCiphertextShaped(value)}versionOf(value){let match=VERSIONED_PREFIX.exec(value);return match===null?void 0:Number(match[1])}async encrypt(plaintext,scope){return this.isEncrypted(plaintext)?plaintext:this.writeCodec.encrypt(plaintext,scope)}async encryptAll(plaintexts,scope){return this.encryptAllWith(this.writeCodec,plaintexts,scope)}async encryptAllAtMostV2(plaintexts,scope){let codec=this.writeVersionNumber<=2?this.writeCodec:this.codecFor("v2");return this.encryptAllWith(codec,plaintexts,scope)}async decrypt(encrypted){let token=versionTokenOf(encrypted);return token===void 0?encrypted:this.codecFor(token).decrypt(encrypted)}async decryptAll(encrypted){let byVersion=new Map;for(let[key,value]of encrypted){let token=versionTokenOf(value);if(token===void 0)continue;let group4=byVersion.get(token);group4===void 0&&(group4=new Map,byVersion.set(token,group4)),group4.set(key,value)}let decrypted=new Map;for(let[token,group4]of byVersion){let codec=this.codecFor(token),groupResult=codec.decryptAll!==void 0?await codec.decryptAll(group4):await loopDecryptAll(codec,group4);for(let[key,value]of groupResult)decrypted.set(key,value)}let result=new Map;for(let[key,value]of encrypted)result.set(key,decrypted.get(key)??value);return result}async delete(storedValue){let token=versionTokenOf(storedValue);token!==void 0&&await this.codecFor(token).delete?.(storedValue)}async reencrypt(storedValue,scope){if(storedValue==="")return storedValue;if(storedValue===REDACTED_MARKER)throw new InvalidCiphertextError("stored value is the literal redaction marker \u2014 corruption from a marker-persist bug, not a secret; refusing to seal it");let version=this.versionOf(storedValue),plaintext;if(version!==void 0){if(version>=this.writeVersionNumber)return storedValue;plaintext=await this.decrypt(storedValue)}else plaintext=storedValue;let reencrypted=await this.writeCodec.encrypt(plaintext,scope);if(await this.decrypt(reencrypted)!==plaintext)throw new InvalidCiphertextError(`re-encryption round-trip verification failed for a ${version!==void 0?`v${version}`:"plaintext"} value: the freshly written ${this.writeCodec.version} ciphertext did not decrypt back to the original plaintext \u2014 nothing was persisted; this is a codec bug, stop the migration`);return reencrypted}async encryptAllWith(codec,plaintexts,scope){let toEncrypt=new Map;for(let[key,value]of plaintexts)this.isEncrypted(value)||toEncrypt.set(key,value);let encrypted=toEncrypt.size===0?new Map:codec.encryptAll!==void 0?await codec.encryptAll(toEncrypt,scope):await loopEncryptAll(codec,toEncrypt,scope),result=new Map;for(let[key,value]of plaintexts)result.set(key,encrypted.get(key)??value);return result}codecFor(token){let codec=this.codecs.get(token);if(codec===void 0){let registered=[...this.codecs.keys()].sort().join(", ");throw new EncryptionUnavailableError(`unsupported encrypted-value version '${token}' - this deployment decrypts only [${registered}]. The value was written by a format this deployment has no codec for; fix the deployment before reading it.`)}return codec}};async function loopEncryptAll(codec,plaintexts,scope){let result=new Map;for(let[key,value]of plaintexts)result.set(key,await codec.encrypt(value,scope));return result}async function loopDecryptAll(codec,encrypted){let result=new Map;for(let[key,value]of encrypted)result.set(key,await codec.decrypt(value));return result}var PERSONAL_LABEL_KEY="stigmer.ai/personal",PERSONAL_LABEL_VALUE="true",MANAGED_LABEL_KEY="stigmer.ai/managed",MANAGED_LABEL_VALUE="true";function markerRejectionMessage(key){return`variable '${key}': cannot use the redaction marker as a secret value`}function forgedCiphertextMessage(key){return`variable '${key}' must be plaintext \u2014 values carrying the 'enc:' encryption prefix are not accepted from clients`}function personalEnvironmentExistsMessage(existingId){return`a personal environment already exists for this organization: ${existingId}`}var PERSONAL_SHARE_RESTRICTION="personal environments cannot be shared with the organization - create a dedicated environment with only the credentials the agent needs",MANAGED_SHARE_RESTRICTION="OAuth-managed environments cannot be shared with the organization - OAuth tokens are per-user credentials";async function resolveDeclaredFromPersonalEnvironment(reader,logger2,org,declarations){let listResponse;try{listResponse=await reader.list({org,labels:{[PERSONAL_LABEL_KEY]:PERSONAL_LABEL_VALUE}})}catch(error2){throw internalError(error2,"failed to list personal environments")}if(listResponse.totalCount===0||listResponse.items.length===0)return{kind:"no-personal-environment"};let personalEnv=listResponse.items[0],personalEnvId=personalEnv?.metadata?.id??"",stored=personalEnv?.spec?.data??{},values={},missing=[];for(let[key,decl]of Object.entries(declarations)){if(!Object.hasOwn(stored,key)){decl.optional||missing.push(key);continue}let secretValue;try{secretValue=await reader.getSecretValue({environmentId:personalEnvId,key})}catch(error2){logger2.warn("Failed to get secret value from personal environment",{key,personal_env_id:personalEnvId,error:error2 instanceof Error?error2.message:String(error2)}),decl.optional||missing.push(key);continue}if(secretValue.value===""){decl.optional||missing.push(key);continue}values[key]=create2(ExecutionValueSchema,{value:secretValue.value,isSecret:decl.isSecret})}return{kind:"resolved",values,missing}}function truncateBody(body){return body.length<=256?body:`${body.slice(0,256)}...`}var TOKEN_AUTH_METHOD_BASIC="client_secret_basic",TOKEN_AUTH_METHOD_POST="client_secret_post",TOKEN_REQUEST_TIMEOUT_MS=15e3;async function exchangeCode(tokenEndpoint,code,redirectUri,codeVerifier,clientId,clientSecret,tokenAuthMethod,fetchImpl){let params=new URLSearchParams({grant_type:"authorization_code",code,redirect_uri:redirectUri,code_verifier:codeVerifier,client_id:clientId});return doTokenRequest(tokenEndpoint,params,clientId,clientSecret,tokenAuthMethod,fetchImpl)}async function refreshToken(tokenEndpoint,currentRefreshToken,clientId,clientSecret,tokenAuthMethod,fetchImpl){let params=new URLSearchParams({grant_type:"refresh_token",refresh_token:currentRefreshToken,client_id:clientId});return doTokenRequest(tokenEndpoint,params,clientId,clientSecret,tokenAuthMethod,fetchImpl)}async function doTokenRequest(tokenEndpoint,params,clientId,clientSecret,tokenAuthMethod,fetchImpl){let usePostSecret=clientSecret!==""&&tokenAuthMethod===TOKEN_AUTH_METHOD_POST;usePostSecret&&params.set("client_secret",clientSecret);let headers2={"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"};clientSecret!==""&&!usePostSecret&&(headers2.Authorization=`Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}`);let response;try{response=await fetchImpl(tokenEndpoint,{method:"POST",headers:headers2,body:params.toString(),signal:AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)})}catch(error2){throw new Error(`token request to ${tokenEndpoint} failed: ${error2 instanceof Error?error2.message:String(error2)}`)}let body=await response.text();if(response.status!==200)throw new Error(`token endpoint ${tokenEndpoint} returned HTTP ${response.status}: ${truncateBody(body)}`);let raw;try{raw=JSON.parse(body)}catch(error2){throw new Error(`failed to parse token response: ${error2 instanceof Error?error2.message:String(error2)}`)}let tokenResponse={accessToken:raw.access_token??"",tokenType:raw.token_type??"",expiresIn:raw.expires_in??0,refreshToken:raw.refresh_token??"",scope:raw.scope??""};if(raw.authed_user!==void 0&&((raw.authed_user.access_token??"")!==""&&(tokenResponse.accessToken=raw.authed_user.access_token),(raw.authed_user.token_type??"")!==""&&(tokenResponse.tokenType=raw.authed_user.token_type),(raw.authed_user.scope??"")!==""&&(tokenResponse.scope=raw.authed_user.scope)),tokenResponse.accessToken==="")throw new Error(`token response from ${tokenEndpoint} is missing access_token`);return tokenResponse}var REFRESH_EXPIRY_BUFFER_SECONDS=60;async function refreshTokenIfExpired(grant,currentRefreshToken,clientSecret,tokenAuthMethod,logger2,fetchImpl){if(grant.accessTokenExpiresAt===0||Math.floor(Date.now()/1e3)<grant.accessTokenExpiresAt-REFRESH_EXPIRY_BUFFER_SECONDS)return notRefreshed();if(currentRefreshToken==="")throw new Error(`access token for resource '${grant.resourceId}' has expired and no refresh token is available. Please re-authenticate via OAuth Connect`);logger2.info("Access token expired, refreshing via refresh_token grant",{resourceId:grant.resourceId,resourceKind:grant.resourceKind,expiredAt:grant.accessTokenExpiresAt,tokenEndpoint:grant.tokenEndpoint});let tokenResponse;try{tokenResponse=await refreshToken(grant.tokenEndpoint,currentRefreshToken,grant.clientId,clientSecret,tokenAuthMethod,fetchImpl)}catch(error2){throw new Error(`token refresh failed for resource '${grant.resourceId}': ${error2 instanceof Error?error2.message:String(error2)}. Please re-authenticate via OAuth Connect`)}let newExpiresAt=0;tokenResponse.expiresIn>0&&(newExpiresAt=Math.floor(Date.now()/1e3)+tokenResponse.expiresIn);let newRefreshToken=tokenResponse.refreshToken!==""?tokenResponse.refreshToken:currentRefreshToken;return logger2.info("Token refresh successful",{resourceId:grant.resourceId,resourceKind:grant.resourceKind,newExpiresAt,refreshTokenRotated:tokenResponse.refreshToken!==""}),{refreshed:!0,newAccessToken:tokenResponse.accessToken,newRefreshToken,newExpiresAt}}function notRefreshed(){return{refreshed:!1,newAccessToken:"",newRefreshToken:"",newExpiresAt:0}}var file_ai_stigmer_agentic_workflow_v1_tasks_common=fileDesc("CjFhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3cvdjEvdGFza3MvY29tbW9uLnByb3RvEiRhaS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3cudjEudGFza3MqfgoVT25JbnZhbGlkT3V0cHV0UG9saWN5EiEKHU9OX0lOVkFMSURfUE9MSUNZX1VOU1BFQ0lGSUVEEAASEwoPT05fSU5WQUxJRF9GQUlMEAESFAoQT05fSU5WQUxJRF9SRVRSWRACEhcKE09OX0lOVkFMSURfRkFMTEJBQ0sQA2IGcHJvdG8z"),OnInvalidOutputPolicy;(function(OnInvalidOutputPolicy2){OnInvalidOutputPolicy2[OnInvalidOutputPolicy2.ON_INVALID_POLICY_UNSPECIFIED=0]="ON_INVALID_POLICY_UNSPECIFIED",OnInvalidOutputPolicy2[OnInvalidOutputPolicy2.ON_INVALID_FAIL=1]="ON_INVALID_FAIL",OnInvalidOutputPolicy2[OnInvalidOutputPolicy2.ON_INVALID_RETRY=2]="ON_INVALID_RETRY",OnInvalidOutputPolicy2[OnInvalidOutputPolicy2.ON_INVALID_FALLBACK=3]="ON_INVALID_FALLBACK"})(OnInvalidOutputPolicy||(OnInvalidOutputPolicy={}));var OnInvalidOutputPolicySchema=enumDesc(file_ai_stigmer_agentic_workflow_v1_tasks_common,0);var file_ai_stigmer_agentic_workflow_v1_tasks_agent_call=fileDesc("CjVhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3cvdjEvdGFza3MvYWdlbnRfY2FsbC5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLnRhc2tzIsIFChNBZ2VudENhbGxUYXNrQ29uZmlnEhsKBWFnZW50GAEgASgJQgy6SAnIAQFyBBABGH8SHwoHbWVzc2FnZRgCIAEoCUIOukgHyAEBcgIQAdiFLAESTwoDZW52GAMgAygLMkIuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLnRhc2tzLkFnZW50Q2FsbFRhc2tDb25maWcuRW52RW50cnkSQwoKcnVuX2NvbmZpZxgEIAEoCzIvLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGV4ZWN1dGlvbi52MS5SdW5Db25maWcSTQoGb3V0cHV0GAUgASgLMj0uYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLnRhc2tzLkFnZW50Q2FsbE91dHB1dENvbnRyYWN0EjcKB2hhcm5lc3MYBiABKA4yJi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5IYXJuZXNzEkgKEXdvcmtzcGFjZV9lbnRyaWVzGAcgAygLMi0uYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuV29ya3NwYWNlRW50cnkSyAEKEGVudmlyb25tZW50X3JlZnMYCCADKAsyNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2VCeLpIcZIBbiJsugFpChVlbnZpcm9ubWVudF9yZWZzLmtpbmQSP2Vudmlyb25tZW50X3JlZnMgbXVzdCByZWZlcmVuY2UgcmVzb3VyY2VzIHdpdGgga2luZD1lbnZpcm9ubWVudBoPdGhpcy5raW5kID09IDUz4IUsNRoqCghFbnZFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBOg7qiywKYWdlbnRfY2FsbCLVAQoXQWdlbnRDYWxsT3V0cHV0Q29udHJhY3QSLwoGc2NoZW1hGAEgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdEIGukgDyAEBEk8KCm9uX2ludmFsaWQYAiABKA4yOy5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3cudjEudGFza3MuT25JbnZhbGlkT3V0cHV0UG9saWN5EiEKC21heF9yZXRyaWVzGAMgASgFQgy6SAnYAQEaBBgFKAESFQoNZmFsbGJhY2tfdGFzaxgEIAEoCWIGcHJvdG8z",[file_ai_stigmer_agentic_agentexecution_v1_invocation,file_ai_stigmer_agentic_session_v1_enum,file_ai_stigmer_agentic_session_v1_workspace,file_ai_stigmer_agentic_workflow_v1_tasks_common,file_ai_stigmer_commons_apiresource_field_options,file_ai_stigmer_commons_apiresource_io,file_buf_validate_validate,file_google_protobuf_struct]),AgentCallTaskConfigSchema=messageDesc2(file_ai_stigmer_agentic_workflow_v1_tasks_agent_call,0);var file_ai_stigmer_agentic_workflow_v1_tasks_call_activity=fileDesc("CjhhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3cvdjEvdGFza3MvY2FsbF9hY3Rpdml0eS5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLnRhc2tzInEKFkNhbGxBY3Rpdml0eVRhc2tDb25maWcSHAoIYWN0aXZpdHkYASABKAlCCrpIB8gBAXICEAESJgoFaW5wdXQYAiABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0OhHqiywNYWN0aXZpdHlfY2FsbGIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_field_options,file_buf_validate_validate,file_google_protobuf_struct]),CallActivityTaskConfigSchema=messageDesc2(file_ai_stigmer_agentic_workflow_v1_tasks_call_activity,0);var file_ai_stigmer_agentic_workflow_v1_tasks_emit_event=fileDesc("CjVhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3cvdjEvdGFza3MvZW1pdF9ldmVudC5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLnRhc2tzIoABCg1FbWl0RXZlbnRTcGVjEhsKBHR5cGUYASABKAlCDbpICsgBAXIFEAEY/wESFAoGc291cmNlGAIgASgJQgTYhSwBEiUKBGRhdGEYAyABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0EhUKB3N1YmplY3QYBCABKAlCBNiFLAEivQEKE0VtaXRFdmVudFRhc2tDb25maWcSSgoFZXZlbnQYASABKAsyMy5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3cudjEudGFza3MuRW1pdEV2ZW50U3BlY0IGukgDyAEBEkoKCGRlbGl2ZXJ5GAIgAygLMjguYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLnRhc2tzLkVtaXREZWxpdmVyeVRhcmdldDoO6ossCmVtaXRfZXZlbnQitwEKEkVtaXREZWxpdmVyeVRhcmdldBJICgd3ZWJob29rGAEgASgLMjUuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLnRhc2tzLldlYmhvb2tEZWxpdmVyeUgAEkYKBnNpZ25hbBgCIAEoCzI0LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvdy52MS50YXNrcy5TaWduYWxEZWxpdmVyeUgAQg8KBnRhcmdldBIFukgCCAEiswEKD1dlYmhvb2tEZWxpdmVyeRIbCgN1cmwYASABKAlCDrpIB8gBAXICEAHYhSwBElMKB2hlYWRlcnMYAiADKAsyQi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3cudjEudGFza3MuV2ViaG9va0RlbGl2ZXJ5LkhlYWRlcnNFbnRyeRouCgxIZWFkZXJzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASJbCg5TaWduYWxEZWxpdmVyeRIkCgxleGVjdXRpb25faWQYASABKAlCDrpIB8gBAXICEAHYhSwBEiMKC3NpZ25hbF9uYW1lGAIgASgJQg66SAfIAQFyAhAB2IUsAWIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_field_options,file_buf_validate_validate,file_google_protobuf_struct]);var EmitEventTaskConfigSchema=messageDesc2(file_ai_stigmer_agentic_workflow_v1_tasks_emit_event,1);var file_ai_stigmer_agentic_workflow_v1_tasks_eval=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3cvdjEvdGFza3MvZXZhbC5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLnRhc2tzIlwKDUV2YWxDcml0ZXJpb24SGgoEbmFtZRgBIAEoCUIMukgJyAEBcgQQARh/Eh8KC2Rlc2NyaXB0aW9uGAIgASgJQgq6SAfIAQFyAhABEg4KBndlaWdodBgDIAEoASLIAwoORXZhbFRhc2tDb25maWcSGwoFbW9kZWwYASABKAlCDLpICcgBAXIEEAEYfxIfCgdzdWJqZWN0GAIgASgJQg66SAfIAQFyAhAB2IUsARIaCgZydWJyaWMYAyABKAlCCrpIB8gBAXICEAESSwoMc2NvcmluZ19tb2RlGAQgASgOMjUuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLnRhc2tzLkV2YWxTY29yaW5nTW9kZRIqCgl0aHJlc2hvbGQYBSABKAFCF7pIFBISGQAAAAAAAPA/KQAAAAAAAAAAEkUKB29uX2ZhaWwYBiABKA4yNC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3cudjEudGFza3MuRXZhbEZhaWxQb2xpY3kSFQoNZmFsbGJhY2tfdGFzaxgHIAEoCRIbCg1zeXN0ZW1fcHJvbXB0GAggASgJQgTYhSwBEkUKCGNyaXRlcmlhGAkgAygLMjMuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLnRhc2tzLkV2YWxDcml0ZXJpb24SFwoPbWF4X2Nvc3RfbWljcm9zGAogASgDOgjqiywEZXZhbCpxCg5FdmFsRmFpbFBvbGljeRIgChxFVkFMX0ZBSUxfUE9MSUNZX1VOU1BFQ0lGSUVEEAASEwoPRVZBTF9GQUlMX1JBSVNFEAESFAoQRVZBTF9GQUlMX0JSQU5DSBACEhIKDkVWQUxfRkFJTF9XQVJOEAMqeQoPRXZhbFNjb3JpbmdNb2RlEiEKHUVWQUxfU0NPUklOR19NT0RFX1VOU1BFQ0lGSUVEEAASEgoORVZBTF9QQVNTX0ZBSUwQARIWChJFVkFMX05VTUVSSUNfU0NPUkUQAhIXChNFVkFMX01VTFRJX0NSSVRFUklBEANiBnByb3RvMw",[file_ai_stigmer_commons_apiresource_field_options,file_buf_validate_validate]);var EvalTaskConfigSchema=messageDesc2(file_ai_stigmer_agentic_workflow_v1_tasks_eval,1),EvalFailPolicy;(function(EvalFailPolicy2){EvalFailPolicy2[EvalFailPolicy2.EVAL_FAIL_POLICY_UNSPECIFIED=0]="EVAL_FAIL_POLICY_UNSPECIFIED",EvalFailPolicy2[EvalFailPolicy2.EVAL_FAIL_RAISE=1]="EVAL_FAIL_RAISE",EvalFailPolicy2[EvalFailPolicy2.EVAL_FAIL_BRANCH=2]="EVAL_FAIL_BRANCH",EvalFailPolicy2[EvalFailPolicy2.EVAL_FAIL_WARN=3]="EVAL_FAIL_WARN"})(EvalFailPolicy||(EvalFailPolicy={}));var EvalFailPolicySchema=enumDesc(file_ai_stigmer_agentic_workflow_v1_tasks_eval,0),EvalScoringMode;(function(EvalScoringMode2){EvalScoringMode2[EvalScoringMode2.EVAL_SCORING_MODE_UNSPECIFIED=0]="EVAL_SCORING_MODE_UNSPECIFIED",EvalScoringMode2[EvalScoringMode2.EVAL_PASS_FAIL=1]="EVAL_PASS_FAIL",EvalScoringMode2[EvalScoringMode2.EVAL_NUMERIC_SCORE=2]="EVAL_NUMERIC_SCORE",EvalScoringMode2[EvalScoringMode2.EVAL_MULTI_CRITERIA=3]="EVAL_MULTI_CRITERIA"})(EvalScoringMode||(EvalScoringMode={}));var EvalScoringModeSchema=enumDesc(file_ai_stigmer_agentic_workflow_v1_tasks_eval,1);var file_ai_stigmer_agentic_workflow_v1_tasks_for=fileDesc("Ci5haS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3cvdjEvdGFza3MvZm9yLnByb3RvEiRhaS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3cudjEudGFza3MiogIKDUZvclRhc2tDb25maWcSGAoEZWFjaBgBIAEoCUIKukgHyAEBcgIQARIaCgJpbhgCIAEoCUIOukgHyAEBcgIQAdiFLAESQgoCZG8YAyADKAsyLC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3cudjEuV29ya2Zsb3dUYXNrQgi6SAWSAQIIARIgCg9tYXhfcGFyYWxsZWxpc20YBCABKAVCB7pIBBoCKAASGwoKYmF0Y2hfc2l6ZRgFIAEoBUIHukgEGgIoABJKCghvbl9lcnJvchgGIAEoDjI4LmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvdy52MS50YXNrcy5Gb3JFYWNoRXJyb3JQb2xpY3k6DOqLLAhmb3JfZWFjaCp9ChJGb3JFYWNoRXJyb3JQb2xpY3kSJQohRk9SX0VBQ0hfRVJST1JfUE9MSUNZX1VOU1BFQ0lGSUVEEAASFgoSRk9SX0VBQ0hfRkFJTF9GQVNUEAESFQoRRk9SX0VBQ0hfQ09OVElOVUUQAhIRCg1GT1JfRUFDSF9TS0lQEANiBnByb3RvMw",[file_ai_stigmer_agentic_workflow_v1_spec,file_ai_stigmer_commons_apiresource_field_options,file_buf_validate_validate]),ForTaskConfigSchema=messageDesc2(file_ai_stigmer_agentic_workflow_v1_tasks_for,0),ForEachErrorPolicy;(function(ForEachErrorPolicy2){ForEachErrorPolicy2[ForEachErrorPolicy2.FOR_EACH_ERROR_POLICY_UNSPECIFIED=0]="FOR_EACH_ERROR_POLICY_UNSPECIFIED",ForEachErrorPolicy2[ForEachErrorPolicy2.FOR_EACH_FAIL_FAST=1]="FOR_EACH_FAIL_FAST",ForEachErrorPolicy2[ForEachErrorPolicy2.FOR_EACH_CONTINUE=2]="FOR_EACH_CONTINUE",ForEachErrorPolicy2[ForEachErrorPolicy2.FOR_EACH_SKIP=3]="FOR_EACH_SKIP"})(ForEachErrorPolicy||(ForEachErrorPolicy={}));var file_ai_stigmer_agentic_workflow_v1_tasks_fork=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3cvdjEvdGFza3MvZm9yay5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLnRhc2tzInkKDkZvcmtUYXNrQ29uZmlnEkwKCGJyYW5jaGVzGAEgAygLMjAuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLnRhc2tzLkZvcmtCcmFuY2hCCLpIBZIBAggCEg8KB2NvbXBldGUYAiABKAg6COqLLARmb3JrImoKCkZvcmtCcmFuY2gSGAoEbmFtZRgBIAEoCUIKukgHyAEBcgIQARJCCgJkbxgCIAMoCzIsLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvdy52MS5Xb3JrZmxvd1Rhc2tCCLpIBZIBAggBYgZwcm90bzM",[file_ai_stigmer_agentic_workflow_v1_spec,file_ai_stigmer_commons_apiresource_field_options,file_buf_validate_validate]),ForkTaskConfigSchema=messageDesc2(file_ai_stigmer_agentic_workflow_v1_tasks_fork,0);var file_ai_stigmer_agentic_workflow_v1_tasks_grpc_call=fileDesc("CjRhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3cvdjEvdGFza3MvZ3JwY19jYWxsLnByb3RvEiRhaS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3cudjEudGFza3MihgEKEkdycGNDYWxsVGFza0NvbmZpZxIbCgdzZXJ2aWNlGAEgASgJQgq6SAfIAQFyAhABEhoKBm1ldGhvZBgCIAEoCUIKukgHyAEBcgIQARIoCgdyZXF1ZXN0GAMgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdDoN6ossCWdycGNfY2FsbGIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_field_options,file_buf_validate_validate,file_google_protobuf_struct]),GrpcCallTaskConfigSchema=messageDesc2(file_ai_stigmer_agentic_workflow_v1_tasks_grpc_call,0);var file_ai_stigmer_agentic_workflow_v1_tasks_http_call=fileDesc("CjRhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3cvdjEvdGFza3MvaHR0cF9jYWxsLnByb3RvEiRhaS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3cudjEudGFza3MigQMKEkh0dHBDYWxsVGFza0NvbmZpZxI3CgZtZXRob2QYASABKAlCJ7pIJMgBAXIfUgNHRVRSBFBPU1RSA1BVVFIGREVMRVRFUgVQQVRDSBJMCghlbmRwb2ludBgCIAEoCzIyLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvdy52MS50YXNrcy5IdHRwRW5kcG9pbnRCBrpIA8gBARJWCgdoZWFkZXJzGAMgAygLMkUuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLnRhc2tzLkh0dHBDYWxsVGFza0NvbmZpZy5IZWFkZXJzRW50cnkSJQoEYm9keRgEIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSJgoPdGltZW91dF9zZWNvbmRzGAUgASgFQg26SArYAQEaBRisAigBGi4KDEhlYWRlcnNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBOg3qiywJaHR0cF9jYWxsIisKDEh0dHBFbmRwb2ludBIbCgN1cmkYASABKAlCDrpIB8gBAXICEAHYhSwBYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_field_options,file_buf_validate_validate,file_google_protobuf_struct]),HttpCallTaskConfigSchema=messageDesc2(file_ai_stigmer_agentic_workflow_v1_tasks_http_call,0);var file_ai_stigmer_agentic_workflow_v1_tasks_human_input=fileDesc("CjZhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3cvdjEvdGFza3MvaHVtYW5faW5wdXQucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvdy52MS50YXNrcyJMChFIdW1hbklucHV0T3V0Y29tZRIaCgRuYW1lGAEgASgJQgy6SAnIAQFyBBABGD8SDQoFbGFiZWwYAiABKAkSDAoEdGhlbhgDIAEoCSKnAwoUSHVtYW5JbnB1dFRhc2tDb25maWcSHgoGcHJvbXB0GAEgASgJQg66SAfIAQFyAhAB2IUsARIsCgtmb3JtX3NjaGVtYRgCIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3QSSQoIb3V0Y29tZXMYAyADKAsyNy5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3cudjEudGFza3MuSHVtYW5JbnB1dE91dGNvbWUSEQoJYXBwcm92ZXJzGAQgAygJEh0KB3RpbWVvdXQYBSABKAVCDLpICRoHGICangEoABJRCgpvbl90aW1lb3V0GAYgASgOMj0uYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLnRhc2tzLkh1bWFuSW5wdXRUaW1lb3V0UG9saWN5Eh0KFW5vdGlmaWNhdGlvbl9jaGFubmVscxgHIAMoCRInCgdwYXlsb2FkGAggASgLMhYuZ29vZ2xlLnByb3RvYnVmLlZhbHVlEhgKB3VpX2hpbnQYCSABKAlCB7pIBHICGD86D+qLLAtodW1hbl9pbnB1dCrEAQoXSHVtYW5JbnB1dFRpbWVvdXRQb2xpY3kSKgomSFVNQU5fSU5QVVRfVElNRU9VVF9QT0xJQ1lfVU5TUEVDSUZJRUQQABIcChhIVU1BTl9JTlBVVF9USU1FT1VUX0ZBSUwQARIfChtIVU1BTl9JTlBVVF9USU1FT1VUX0FQUFJPVkUQAhIcChhIVU1BTl9JTlBVVF9USU1FT1VUX0RFTlkQAxIgChxIVU1BTl9JTlBVVF9USU1FT1VUX0VTQ0FMQVRFEARiBnByb3RvMw",[file_ai_stigmer_commons_apiresource_field_options,file_buf_validate_validate,file_google_protobuf_struct]);var HumanInputTaskConfigSchema=messageDesc2(file_ai_stigmer_agentic_workflow_v1_tasks_human_input,1),HumanInputTimeoutPolicy;(function(HumanInputTimeoutPolicy2){HumanInputTimeoutPolicy2[HumanInputTimeoutPolicy2.HUMAN_INPUT_TIMEOUT_POLICY_UNSPECIFIED=0]="HUMAN_INPUT_TIMEOUT_POLICY_UNSPECIFIED",HumanInputTimeoutPolicy2[HumanInputTimeoutPolicy2.HUMAN_INPUT_TIMEOUT_FAIL=1]="HUMAN_INPUT_TIMEOUT_FAIL",HumanInputTimeoutPolicy2[HumanInputTimeoutPolicy2.HUMAN_INPUT_TIMEOUT_APPROVE=2]="HUMAN_INPUT_TIMEOUT_APPROVE",HumanInputTimeoutPolicy2[HumanInputTimeoutPolicy2.HUMAN_INPUT_TIMEOUT_DENY=3]="HUMAN_INPUT_TIMEOUT_DENY",HumanInputTimeoutPolicy2[HumanInputTimeoutPolicy2.HUMAN_INPUT_TIMEOUT_ESCALATE=4]="HUMAN_INPUT_TIMEOUT_ESCALATE"})(HumanInputTimeoutPolicy||(HumanInputTimeoutPolicy={}));var HumanInputTimeoutPolicySchema=enumDesc(file_ai_stigmer_agentic_workflow_v1_tasks_human_input,0);var file_ai_stigmer_agentic_workflow_v1_tasks_listen=fileDesc("CjFhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3cvdjEvdGFza3MvbGlzdGVuLnByb3RvEiRhaS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3cudjEudGFza3MiYgoQTGlzdGVuVGFza0NvbmZpZxJCCgJ0bxgBIAEoCzIuLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvdy52MS50YXNrcy5MaXN0ZW5Ub0IGukgDyAEBOgrqiywGbGlzdGVuInkKCExpc3RlblRvEiAKBG1vZGUYASABKAlCErpID8gBAXIKUgNvbmVSA2FsbBJLCgdzaWduYWxzGAIgAygLMjAuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLnRhc2tzLlNpZ25hbFNwZWNCCLpIBZIBAggBIlMKClNpZ25hbFNwZWMSFgoCaWQYASABKAlCCrpIB8gBAXICEAESLQoEdHlwZRgCIAEoCUIfukgcyAEBchdSBnNpZ25hbFIFcXVlcnlSBnVwZGF0ZWIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_field_options,file_buf_validate_validate]),ListenTaskConfigSchema=messageDesc2(file_ai_stigmer_agentic_workflow_v1_tasks_listen,0);var file_ai_stigmer_agentic_workflow_v1_tasks_llm_call=fileDesc("CjNhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3cvdjEvdGFza3MvbGxtX2NhbGwucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvdy52MS50YXNrcyLRAwoRTGxtQ2FsbFRhc2tDb25maWcSGwoFbW9kZWwYASABKAlCDLpICcgBAXIEEAEYfxIbCg1zeXN0ZW1fcHJvbXB0GAIgASgJQgTYhSwBEh4KBnByb21wdBgDIAEoCUIOukgHyAEBcgIQAdiFLAESMAoPcmVzcG9uc2Vfc2NoZW1hGAQgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdBIkCgt0ZW1wZXJhdHVyZRgFIAEoAkIPukgMCgodAAAAQC0AAAAAEh4KCm1heF90b2tlbnMYBiABKAVCCrpIB9gBARoCKAESHgoHdGltZW91dBgHIAEoBUINukgK2AEBGgUY2AQoARJPCgpvbl9pbnZhbGlkGAggASgOMjsuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLnRhc2tzLk9uSW52YWxpZE91dHB1dFBvbGljeRIhCgttYXhfcmV0cmllcxgJIAEoBUIMukgJ2AEBGgQYBSgBEhUKDWZhbGxiYWNrX3Rhc2sYCiABKAkSFwoPbWF4X2Nvc3RfbWljcm9zGAsgASgDEhgKEG1heF90b3RhbF90b2tlbnMYDCABKAM6DOqLLAhsbG1fY2FsbGIGcHJvdG8z",[file_ai_stigmer_agentic_workflow_v1_tasks_common,file_ai_stigmer_commons_apiresource_field_options,file_buf_validate_validate,file_google_protobuf_struct]),LlmCallTaskConfigSchema=messageDesc2(file_ai_stigmer_agentic_workflow_v1_tasks_llm_call,0);var file_ai_stigmer_agentic_workflow_v1_tasks_notification=fileDesc("CjdhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3cvdjEvdGFza3Mvbm90aWZpY2F0aW9uLnByb3RvEiRhaS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3cudjEudGFza3MivQIKFk5vdGlmaWNhdGlvblRhc2tDb25maWcSHQoHY2hhbm5lbBgBIAEoCUIMukgJyAEBcgQQARg/EhwKCnJlY2lwaWVudHMYAiADKAlCCLpIBZIBAggBEhUKB3N1YmplY3QYAyABKAlCBNiFLAESHAoEYm9keRgEIAEoCUIOukgHyAEBcgIQAdiFLAESEAoIdGVtcGxhdGUYBSABKAkSXAoIbWV0YWRhdGEYBiADKAsySi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3cudjEudGFza3MuTm90aWZpY2F0aW9uVGFza0NvbmZpZy5NZXRhZGF0YUVudHJ5Gi8KDU1ldGFkYXRhRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4AToQ6ossDG5vdGlmaWNhdGlvbmIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_field_options,file_buf_validate_validate]),NotificationTaskConfigSchema=messageDesc2(file_ai_stigmer_agentic_workflow_v1_tasks_notification,0);var file_ai_stigmer_agentic_workflow_v1_tasks_raise=fileDesc("CjBhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3cvdjEvdGFza3MvcmFpc2UucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvdy52MS50YXNrcyJYCg9SYWlzZVRhc2tDb25maWcSHQoFZXJyb3IYASABKAlCDrpIB8gBAXICEAHYhSwBEhUKB21lc3NhZ2UYAiABKAlCBNiFLAE6D+qLLAtyYWlzZV9lcnJvcmIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_field_options,file_buf_validate_validate]),RaiseTaskConfigSchema=messageDesc2(file_ai_stigmer_agentic_workflow_v1_tasks_raise,0);var file_ai_stigmer_agentic_workflow_v1_tasks_run=fileDesc("Ci5haS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3cvdjEvdGFza3MvcnVuLnByb3RvEiRhaS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3cudjEudGFza3MiZwoNUnVuVGFza0NvbmZpZxIcCgh3b3JrZmxvdxgBIAEoCUIKukgHyAEBcgIQARImCgVpbnB1dBgCIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3Q6EOqLLAxydW5fd29ya2Zsb3diBnByb3RvMw",[file_ai_stigmer_commons_apiresource_field_options,file_buf_validate_validate,file_google_protobuf_struct]),RunTaskConfigSchema=messageDesc2(file_ai_stigmer_agentic_workflow_v1_tasks_run,0);var file_ai_stigmer_agentic_workflow_v1_tasks_set=fileDesc("Ci5haS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3cvdjEvdGFza3Mvc2V0LnByb3RvEiRhaS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3cudjEudGFza3MirgEKDVNldFRhc2tDb25maWcSXQoJdmFyaWFibGVzGAEgAygLMkIuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLnRhc2tzLlNldFRhc2tDb25maWcuVmFyaWFibGVzRW50cnlCBrpIA8gBARowCg5WYXJpYWJsZXNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBOgzqiywIc2V0X3ZhcnNiBnByb3RvMw",[file_ai_stigmer_commons_apiresource_field_options,file_buf_validate_validate]),SetTaskConfigSchema=messageDesc2(file_ai_stigmer_agentic_workflow_v1_tasks_set,0);var file_ai_stigmer_agentic_workflow_v1_tasks_switch=fileDesc("CjFhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3cvdjEvdGFza3Mvc3dpdGNoLnByb3RvEiRhaS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3cudjEudGFza3MibgoQU3dpdGNoVGFza0NvbmZpZxJJCgVjYXNlcxgBIAMoCzIwLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvdy52MS50YXNrcy5Td2l0Y2hDYXNlQgi6SAWSAQIIAToP6ossC3N3aXRjaF9jYXNlIk4KClN3aXRjaENhc2USGAoEbmFtZRgBIAEoCUIKukgHyAEBcgIQARIMCgR3aGVuGAIgASgJEhgKBHRoZW4YAyABKAlCCrpIB8gBAXICEAFiBnByb3RvMw",[file_ai_stigmer_commons_apiresource_field_options,file_buf_validate_validate]),SwitchTaskConfigSchema=messageDesc2(file_ai_stigmer_agentic_workflow_v1_tasks_switch,0);var file_ai_stigmer_agentic_workflow_v1_tasks_transform=fileDesc("CjRhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3cvdjEvdGFza3MvdHJhbnNmb3JtLnByb3RvEiRhaS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3cudjEudGFza3MirwEKE1RyYW5zZm9ybVRhc2tDb25maWcSVAoGZW5naW5lGAEgASgOMjUuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLnRhc2tzLlRyYW5zZm9ybUVuZ2luZUINukgKyAEBggEEEAEgABIeCgpleHByZXNzaW9uGAIgASgJQgq6SAfIAQFyAhABEhMKBWlucHV0GAMgASgJQgTYhSwBOg3qiywJdHJhbnNmb3JtKokBCg9UcmFuc2Zvcm1FbmdpbmUSIAocVFJBTlNGT1JNX0VOR0lORV9VTlNQRUNJRklFRBAAEhcKE1RSQU5TRk9STV9FTkdJTkVfSlEQARIcChhUUkFOU0ZPUk1fRU5HSU5FX0pTT05BVEEQAhIdChlUUkFOU0ZPUk1fRU5HSU5FX1RFTVBMQVRFEANiBnByb3RvMw",[file_ai_stigmer_commons_apiresource_field_options,file_buf_validate_validate]),TransformTaskConfigSchema=messageDesc2(file_ai_stigmer_agentic_workflow_v1_tasks_transform,0),TransformEngine;(function(TransformEngine2){TransformEngine2[TransformEngine2.UNSPECIFIED=0]="UNSPECIFIED",TransformEngine2[TransformEngine2.JQ=1]="JQ",TransformEngine2[TransformEngine2.JSONATA=2]="JSONATA",TransformEngine2[TransformEngine2.TEMPLATE=3]="TEMPLATE"})(TransformEngine||(TransformEngine={}));var TransformEngineSchema=enumDesc(file_ai_stigmer_agentic_workflow_v1_tasks_transform,0);var file_ai_stigmer_agentic_workflow_v1_tasks_try=fileDesc("Ci5haS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3cvdjEvdGFza3MvdHJ5LnByb3RvEiRhaS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3cudjEudGFza3MipAEKDVRyeVRhc2tDb25maWcSQwoDdHJ5GAEgAygLMiwuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLldvcmtmbG93VGFza0IIukgFkgECCAESPwoFY2F0Y2gYAiABKAsyMC5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3cudjEudGFza3MuQ2F0Y2hCbG9jazoN6ossCXRyeV9jYXRjaCJwCgpDYXRjaEJsb2NrEgoKAmFzGAEgASgJEkIKAmRvGAIgAygLMiwuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLldvcmtmbG93VGFza0IIukgFkgECCAESEgoKY29tcGVuc2F0ZRgDIAEoCGIGcHJvdG8z",[file_ai_stigmer_agentic_workflow_v1_spec,file_ai_stigmer_commons_apiresource_field_options,file_buf_validate_validate]),TryTaskConfigSchema=messageDesc2(file_ai_stigmer_agentic_workflow_v1_tasks_try,0);var file_ai_stigmer_agentic_workflow_v1_tasks_validate=fileDesc("CjNhaS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3cvdjEvdGFza3MvdmFsaWRhdGUucHJvdG8SJGFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvdy52MS50YXNrcyJnCg5WYWxpZGF0aW9uUnVsZRIaCgRuYW1lGAEgASgJQgy6SAnIAQFyBBABGH8SIgoKZXhwcmVzc2lvbhgCIAEoCUIOukgHyAEBcgIQAdiFLAESFQoHbWVzc2FnZRgDIAEoCUIE2IUsASKTAgoSVmFsaWRhdGVUYXNrQ29uZmlnEh0KBWlucHV0GAEgASgJQg66SAfIAQFyAhAB2IUsARInCgZzY2hlbWEYAiABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0EkMKBXJ1bGVzGAMgAygLMjQuYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLnRhc2tzLlZhbGlkYXRpb25SdWxlEksKB29uX2ZhaWwYBCABKA4yOi5haS5zdGlnbWVyLmFnZW50aWMud29ya2Zsb3cudjEudGFza3MuVmFsaWRhdGlvbkZhaWxQb2xpY3kSFQoNZmFsbGJhY2tfdGFzaxgFIAEoCToM6ossCHZhbGlkYXRlKo8BChRWYWxpZGF0aW9uRmFpbFBvbGljeRImCiJWQUxJREFUSU9OX0ZBSUxfUE9MSUNZX1VOU1BFQ0lGSUVEEAASGQoVVkFMSURBVElPTl9GQUlMX1JBSVNFEAESGgoWVkFMSURBVElPTl9GQUlMX0JSQU5DSBACEhgKFFZBTElEQVRJT05fRkFJTF9XQVJOEANiBnByb3RvMw",[file_ai_stigmer_commons_apiresource_field_options,file_buf_validate_validate,file_google_protobuf_struct]);var ValidateTaskConfigSchema=messageDesc2(file_ai_stigmer_agentic_workflow_v1_tasks_validate,1),ValidationFailPolicy;(function(ValidationFailPolicy2){ValidationFailPolicy2[ValidationFailPolicy2.VALIDATION_FAIL_POLICY_UNSPECIFIED=0]="VALIDATION_FAIL_POLICY_UNSPECIFIED",ValidationFailPolicy2[ValidationFailPolicy2.VALIDATION_FAIL_RAISE=1]="VALIDATION_FAIL_RAISE",ValidationFailPolicy2[ValidationFailPolicy2.VALIDATION_FAIL_BRANCH=2]="VALIDATION_FAIL_BRANCH",ValidationFailPolicy2[ValidationFailPolicy2.VALIDATION_FAIL_WARN=3]="VALIDATION_FAIL_WARN"})(ValidationFailPolicy||(ValidationFailPolicy={}));var ValidationFailPolicySchema=enumDesc(file_ai_stigmer_agentic_workflow_v1_tasks_validate,0);var file_ai_stigmer_agentic_workflow_v1_tasks_wait=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvd29ya2Zsb3cvdjEvdGFza3Mvd2FpdC5wcm90bxIkYWkuc3RpZ21lci5hZ2VudGljLndvcmtmbG93LnYxLnRhc2tzIpECCghEdXJhdGlvbhIMCgRkYXlzGAEgASgNEg0KBWhvdXJzGAIgASgNEg8KB21pbnV0ZXMYAyABKA0SDwoHc2Vjb25kcxgEIAEoDRIUCgxtaWxsaXNlY29uZHMYBSABKA06rwG6SKsBGqgBChFkdXJhdGlvbi5ub25femVybxIsYXQgbGVhc3Qgb25lIGR1cmF0aW9uIGZpZWxkIG11c3QgYmUgbm9uLXplcm8aZXRoaXMuZGF5cyA+IDB1IHx8IHRoaXMuaG91cnMgPiAwdSB8fCB0aGlzLm1pbnV0ZXMgPiAwdSB8fCB0aGlzLnNlY29uZHMgPiAwdSB8fCB0aGlzLm1pbGxpc2Vjb25kcyA+IDB1IpgBCg5XYWl0VGFza0NvbmZpZxJCCghkdXJhdGlvbhgBIAEoCzIuLmFpLnN0aWdtZXIuYWdlbnRpYy53b3JrZmxvdy52MS50YXNrcy5EdXJhdGlvbkgAEisKBXVudGlsGAIgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcEgAOgjqiywEd2FpdEILCgl3YWl0X3R5cGViBnByb3RvMw",[file_ai_stigmer_commons_apiresource_field_options,file_buf_validate_validate,file_google_protobuf_timestamp]);var WaitTaskConfigSchema=messageDesc2(file_ai_stigmer_agentic_workflow_v1_tasks_wait,1);var TASK_CONFIG_SCHEMAS={[WorkflowTaskKind.set_vars]:SetTaskConfigSchema,[WorkflowTaskKind.http_call]:HttpCallTaskConfigSchema,[WorkflowTaskKind.grpc_call]:GrpcCallTaskConfigSchema,[WorkflowTaskKind.switch_case]:SwitchTaskConfigSchema,[WorkflowTaskKind.for_each]:ForTaskConfigSchema,[WorkflowTaskKind.fork]:ForkTaskConfigSchema,[WorkflowTaskKind.try_catch]:TryTaskConfigSchema,[WorkflowTaskKind.listen]:ListenTaskConfigSchema,[WorkflowTaskKind.wait]:WaitTaskConfigSchema,[WorkflowTaskKind.activity_call]:CallActivityTaskConfigSchema,[WorkflowTaskKind.raise_error]:RaiseTaskConfigSchema,[WorkflowTaskKind.run_workflow]:RunTaskConfigSchema,[WorkflowTaskKind.agent_call]:AgentCallTaskConfigSchema,[WorkflowTaskKind.llm_call]:LlmCallTaskConfigSchema,[WorkflowTaskKind.transform]:TransformTaskConfigSchema,[WorkflowTaskKind.human_input]:HumanInputTaskConfigSchema,[WorkflowTaskKind.validate]:ValidateTaskConfigSchema,[WorkflowTaskKind.emit_event]:EmitEventTaskConfigSchema,[WorkflowTaskKind.notification]:NotificationTaskConfigSchema,[WorkflowTaskKind.eval]:EvalTaskConfigSchema};function taskConfigSchemaFor(kind){return TASK_CONFIG_SCHEMAS[kind]}function unmarshalTaskConfig(kind,config2){if(config2===void 0)throw new Error("task_config cannot be nil");let schema2=TASK_CONFIG_SCHEMAS[kind];if(schema2===void 0)throw new Error(`unsupported task kind: ${WorkflowTaskKind[kind]??kind}`);let json2=structuredClone(config2);normalizeEnumShorthands(kind,json2);try{return fromJson(schema2,json2)}catch(error2){throw new Error(`failed to unmarshal JSON to proto: ${error2 instanceof Error?error2.message:String(error2)}`)}}function tryUnmarshalTaskConfig(kind,config2){try{return unmarshalTaskConfig(kind,config2)}catch{return}}function normalizeEnumShorthands(kind,json2){if(kind!==WorkflowTaskKind.agent_call)return;let harness=json2.harness;if(typeof harness=="string")switch(harness.toLowerCase()){case"native":json2.harness="HARNESS_NATIVE";break;case"cursor":json2.harness="HARNESS_CURSOR";break}let runConfig=json2.run_config;if(isJsonObject(runConfig)){let serviceTier=runConfig.service_tier;if(typeof serviceTier=="string")switch(serviceTier.toLowerCase()){case"standard":runConfig.service_tier="SERVICE_TIER_STANDARD";break;case"fast":runConfig.service_tier="SERVICE_TIER_FAST";break}let thinkingMode=runConfig.thinking_mode;if(typeof thinkingMode=="string")switch(thinkingMode.toLowerCase()){case"disabled":runConfig.thinking_mode="THINKING_MODE_DISABLED";break;case"enabled":runConfig.thinking_mode="THINKING_MODE_ENABLED";break}}let refs=json2.environment_refs;if(Array.isArray(refs))for(let ref of refs)isJsonObject(ref)&&!("kind"in ref)&&(ref.kind="environment")}function isJsonObject(value){return typeof value=="object"&&value!==null&&!Array.isArray(value)}var SCHEDULE_ID_LABEL_KEY="stigmer.ai/schedule-id",WORKFLOW_EXECUTION_ID_LABEL_KEY="stigmer.ai/workflow-execution-id",WORKFLOW_TASK_LABEL_KEY="stigmer.ai/workflow-task",WORKSPACE_PROVISIONING_KEYS=["GITHUB_TOKEN"];function newCreateExecutionContextStep(deps){return{name:"CreateExecutionContext",async execute(ctx){let execution=ctx.newState,resolved=ctx.get(DEFAULT_INSTANCE_ID_KEY2);if(await buildAndPersistExecutionContext(deps,execution,typeof resolved=="string"?resolved:""),Object.keys(execution.spec?.runtimeEnv??{}).length>0){deps.logger.debug("Clearing runtime_env from execution (consumed into ExecutionContext)",{executionId:execution.metadata?.id??"",clearedEntries:Object.keys(execution.spec?.runtimeEnv??{}).length});let spec=execution.spec??=create2(AgentExecutionSpecSchema);spec.runtimeEnv={}}}}}async function buildAndPersistExecutionContext(deps,execution,preResolvedInstanceId){let executionId=execution.metadata?.id??"",executionOrg=execution.metadata?.org??"",target;try{target=await resolveTarget(deps,execution,preResolvedInstanceId)}catch(error2){chainError("resolve agent instance",error2)}let{agentInstanceId}=target,session=target.session,instance,agentResource,agentId="";if(agentInstanceId!==""){try{instance=await deps.agentInstanceLoader().get(agentInstanceId)}catch(error2){if(error2 instanceof ConnectError)throw goWrappedStatusError(`load agent instance ${agentInstanceId}`,error2);chainError(`load agent instance ${agentInstanceId}`,error2)}agentId=instance.spec?.agentId??"";try{agentResource=await deps.agentLoader().get(agentId)}catch(error2){if(error2 instanceof ConnectError)throw goWrappedStatusError(`load agent ${agentId}`,error2);chainError(`load agent ${agentId}`,error2)}}let sessionId=execution.spec?.sessionId??"";if(session===void 0&&sessionId!=="")try{session=await deps.sessionLoader().get(sessionId)}catch(error2){deps.logger.warn("Failed to load session for environment resolution (non-fatal)",{executionId,error:error2 instanceof Error?error2.message:String(error2)})}let sessionMcpServers=await loadSessionMcpServers(deps,session,executionOrg),environments=await resolveEnvironments(deps,instance?.spec?.environmentRefs??[]),scheduleEnvironments=await resolveScheduleEnvironments(deps,execution);scheduleEnvironments.length>0&&(environments=[...scheduleEnvironments,...environments]);let workflowEnvironments=await resolveWorkflowTaskEnvironments(deps,execution);workflowEnvironments.length>0&&(environments=[...workflowEnvironments,...environments]);let platformClientEnvironments=await resolvePlatformClientEnvironments(deps,execution);platformClientEnvironments.length>0&&(environments=[...platformClientEnvironments,...environments]);let merged=mergeEnvironmentLayers(environments,execution.spec?.runtimeEnv??{}),declarations=unionDeclarations(agentResource?.spec?.env??{},sessionMcpServers),filterResult=filterByDeclaredKeys(merged,declarations),filtered=filterResult.filtered;filterResult.excludedKeys.length>0&&deps.logger.warn("Filtered env vars not declared by the agent or the session's servers",{executionId,agentId,excludedKeys:filterResult.excludedKeys}),session!==void 0&&(filtered=injectWorkspaceProvisioningKeys(deps.logger,filtered,merged,session,executionId),filtered=await injectFromPersonalEnvironment(deps,filtered,session,executionOrg,executionId));let mergedMcpUsages=mergeAgentAndSessionMcpUsages(agentResource,session);try{filtered=await injectMcpOAuthFromManagedEnvironment(deps,filtered,mergedMcpUsages,executionOrg,executionId)}catch(error2){throw failedPreconditionError(error2 instanceof Error?error2.message:String(error2))}filtered=await injectSessionServerDeclaredFromPersonalEnvironment(deps,filtered,sessionMcpServers,executionOrg,executionId);let missingRequired=validateRequiredKeys(filtered,declarations);missingRequired.length>0&&deps.logger.warn("Required env vars missing after environment merge \u2014 execution may fail",{executionId,agentId,missingRequired}),deps.logger.info("Merged environment layers for execution context",{executionId,mergedCount:merged.size,filteredCount:filtered.size,environmentRefsCount:instance?.spec?.environmentRefs.length??0,builtInAssistant:agentInstanceId===""});let ec2=create2(ExecutionContextSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"ExecutionContext",metadata:{name:`exec-ctx-${executionId}`,org:executionOrg},spec:{executionId,data:Object.fromEntries(filtered)}}),created;try{created=await deps.executionContextCreator().create(ec2)}catch(error2){if(error2 instanceof ConnectError)throw goWrappedStatusError(`create execution context for ${executionId}`,error2);chainError(`create execution context for ${executionId}`,error2)}deps.logger.info("Successfully created execution context",{executionContextId:created.metadata?.id??"",executionId,dataEntries:filtered.size})}function chainError(prefix,error2){throw error2 instanceof ConnectError?new ConnectError(`${prefix}: ${error2.rawMessage}`,error2.code):new Error(`${prefix}: ${error2 instanceof Error?error2.message:String(error2)}`)}async function resolveTarget(deps,execution,preResolvedInstanceId){if(preResolvedInstanceId!=="")return{agentInstanceId:preResolvedInstanceId,session:void 0};let sessionId=execution.spec?.sessionId??"";if(sessionId==="")throw new Error("neither a pre-resolved instance id nor session_id on execution");let session;try{session=await deps.sessionLoader().get(sessionId)}catch(error2){throw error2 instanceof ConnectError?goWrappedStatusError(`load session ${sessionId}`,error2):new Error(`load session ${sessionId}: ${error2 instanceof Error?error2.message:String(error2)}`)}return{agentInstanceId:session.spec?.agentInstanceId??"",session}}async function loadSessionMcpServers(deps,session,executionOrg){let servers=[];for(let usage of session?.spec?.mcpServerUsages??[]){let slug=usage.mcpServerRef?.slug??"",org=usage.mcpServerRef?.org||executionOrg;if(slug===""||org==="")continue;let server;try{server=await findResourceBySlug(deps.store,ApiResourceKind.mcp_server,McpServerSchema,slug,org)}catch{continue}server!==void 0&&servers.push(server)}return servers}function unionDeclarations(agentEnv,sessionMcpServers){let union={};for(let server of sessionMcpServers)Object.assign(union,server.spec?.env??{});return Object.assign(union,agentEnv),union}async function injectSessionServerDeclaredFromPersonalEnvironment(deps,filtered,sessionMcpServers,executionOrg,executionId){let wanted={};for(let server of sessionMcpServers){let oauthKey=server.spec?.auth?.targetEnvVar??"";for(let[key,decl]of Object.entries(server.spec?.env??{}))key===oauthKey||filtered.has(key)||(wanted[key]=decl)}if(Object.keys(wanted).length===0||executionOrg==="")return filtered;let resolution;try{resolution=await resolveDeclaredFromPersonalEnvironment(deps.environmentReader(),deps.logger,executionOrg,wanted)}catch(error2){return deps.logger.warn("Failed to resolve session servers' variables from the personal environment (non-fatal)",{executionId,error:error2 instanceof Error?error2.message:String(error2)}),filtered}if(resolution.kind==="no-personal-environment")return deps.logger.debug("No personal environment \u2014 session servers' declared variables stay unresolved",{executionId,keys:Object.keys(wanted).sort()}),filtered;resolution.missing.length>0&&deps.logger.warn("Session servers declare required variables the personal environment does not hold",{executionId,missing:[...resolution.missing].sort()});let entries=Object.entries(resolution.values);if(entries.length===0)return filtered;let out=new Map(filtered);for(let[key,value]of entries)out.set(key,value);return deps.logger.info("Injected session servers' declared variables from the caller's personal environment",{executionId,keys:entries.map(([key])=>key).sort()}),out}async function resolveEnvironments(deps,refs){if(refs.length===0)return[];let environments=[];for(let ref of refs)try{environments.push(await deps.environmentResolution.resolveByReference(ref))}catch(error2){if(error2 instanceof ConnectError)throw goWrappedStatusError(`resolve environment ref (org=${ref.org}, slug=${ref.slug})`,error2);chainError(`resolve environment ref (org=${ref.org}, slug=${ref.slug})`,error2)}return environments}async function resolveScheduleEnvironments(deps,execution){let scheduleId=execution.metadata?.labels[SCHEDULE_ID_LABEL_KEY]??"";if(scheduleId==="")return[];let schedule;try{schedule=await deps.store.getResource(ApiResourceKind.schedule,scheduleId,ScheduleSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return deps.logger.warn("Schedule-labeled execution's schedule row is gone \u2014 running without schedule environments",{scheduleId,executionId:execution.metadata?.id??""}),[];throw new Error(`load schedule ${scheduleId} for environment resolution: ${error2 instanceof Error?error2.message:String(error2)}`)}let target=schedule.spec?.target,refs=target?.case==="agent"?target.value.environmentRefs??[]:[];if(refs.length===0)return[];let resolved=refs.map(ref=>ref.org===""?create2(ApiResourceReferenceSchema,{kind:ref.kind,org:schedule.metadata?.org??"",slug:ref.slug}):ref);try{return await resolveEnvironments(deps,resolved)}catch(error2){chainError(`resolve schedule ${scheduleId} environment_refs`,error2)}}async function resolvePlatformClientEnvironments(deps,execution){let platformClientId=execution.status?.audit?.specAudit?.createdBy?.platformClientId??"";if(platformClientId==="")return[];let executionId=execution.metadata?.id??"",client;try{client=await deps.platformClients.findById(platformClientId)}catch(error2){throw new Error(`load platform client ${platformClientId} for environment resolution: ${error2 instanceof Error?error2.message:String(error2)}`)}if(client===void 0)return deps.logger.warn("Minting platform client is gone \u2014 running without its environments",{platformClientId,executionId}),[];let clientOrg=client.metadata?.org??"",executionOrg=execution.metadata?.org??"";if(clientOrg!==executionOrg)return deps.logger.warn("Minting platform client belongs to another organization \u2014 its environments are not delivered",{platformClientId,clientOrg,executionOrg,executionId}),[];let refs=client.spec?.environmentRefs??[];if(refs.length===0)return[];let resolved=refs.map(ref=>ref.org===""?create2(ApiResourceReferenceSchema,{kind:ref.kind,org:clientOrg,slug:ref.slug}):ref);try{return await resolveEnvironments(deps,resolved)}catch(error2){chainError(`resolve platform client ${platformClientId} environment_refs`,error2)}}async function resolveWorkflowTaskEnvironments(deps,execution){let labels=execution.metadata?.labels??{},workflowExecutionId=labels[WORKFLOW_EXECUTION_ID_LABEL_KEY]??"",taskName=labels[WORKFLOW_TASK_LABEL_KEY]??"";if(workflowExecutionId===""||taskName==="")return[];let executionId=execution.metadata?.id??"",workflowExecution;try{workflowExecution=await deps.store.getResource(ApiResourceKind.workflow_execution,workflowExecutionId,WorkflowExecutionSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return deps.logger.warn("Workflow-labeled execution's workflow execution row is gone \u2014 running without workflow environments",{workflowExecutionId,executionId}),[];throw new Error(`load workflow execution ${workflowExecutionId} for environment resolution: ${error2 instanceof Error?error2.message:String(error2)}`)}let workflowId=workflowExecution.spec?.workflowId??"";if(workflowId===""){let instanceId=workflowExecution.spec?.workflowInstanceId??"";if(instanceId==="")return[];try{workflowId=(await deps.store.getResource(ApiResourceKind.workflow_instance,instanceId,WorkflowInstanceSchema)).spec?.workflowId??""}catch(error2){if(error2 instanceof ResourceNotFoundError)return deps.logger.warn("Workflow-labeled execution's instance row is gone \u2014 running without workflow environments",{workflowInstanceId:instanceId,executionId}),[];throw new Error(`load workflow instance ${instanceId} for environment resolution: ${error2 instanceof Error?error2.message:String(error2)}`)}}if(workflowId==="")return[];let workflow;try{workflow=await deps.store.getResource(ApiResourceKind.workflow,workflowId,WorkflowSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return deps.logger.warn("Workflow-labeled execution's workflow row is gone \u2014 running without workflow environments",{workflowId,executionId}),[];throw new Error(`load workflow ${workflowId} for environment resolution: ${error2 instanceof Error?error2.message:String(error2)}`)}let refs=agentCallTaskEnvironmentRefs(deps.logger,workflow,taskName);if(refs.length===0)return[];let resolved=refs.map(ref=>ref.org===""?create2(ApiResourceReferenceSchema,{kind:ref.kind,org:workflow.metadata?.org??"",slug:ref.slug}):ref);try{return await resolveEnvironments(deps,resolved)}catch(error2){chainError(`resolve workflow ${workflowId} task "${taskName}" environment_refs`,error2)}}function agentCallTaskEnvironmentRefs(logger2,workflow,taskName){for(let task of workflow.spec?.tasks??[]){if(task.name!==taskName||task.kind!==WorkflowTaskKind.agent_call)continue;let msg;try{msg=unmarshalTaskConfig(task.kind,task.taskConfig)}catch(error2){return logger2.warn("agent_call task config no longer parses \u2014 running without workflow environments",{taskName,error:error2 instanceof Error?error2.message:String(error2)}),[]}return msg.environmentRefs}return[]}function injectWorkspaceProvisioningKeys(logger2,filtered,merged,session,executionId){if(!(session.spec?.workspaceEntries??[]).some(entry=>entry.source?.source.case==="gitRepo"))return filtered;let out=filtered,injected=!1;for(let key of WORKSPACE_PROVISIONING_KEYS){if(out.has(key))continue;let val=merged.get(key);val!==void 0&&(injected||(out=new Map(out),injected=!0),out.set(key,val),logger2.info("Re-injected workspace-provisioning key after env_spec filter (session has git_repo entries)",{executionId,key}))}return out}async function injectFromPersonalEnvironment(deps,filtered,session,executionOrg,executionId){if(!(session.spec?.workspaceEntries??[]).some(entry=>entry.source?.source.case==="gitRepo"))return filtered;let missing=WORKSPACE_PROVISIONING_KEYS.filter(key=>!filtered.has(key));if(missing.length===0)return filtered;let listResponse;try{listResponse=await deps.environmentReader().list(create2(ListEnvironmentsRequestSchema,{org:executionOrg,labels:{[PERSONAL_LABEL_KEY]:PERSONAL_LABEL_VALUE}}))}catch(error2){return deps.logger.warn("Failed to list personal environments for provisioning key injection (non-fatal)",{executionId,error:error2 instanceof Error?error2.message:String(error2)}),filtered}if(listResponse.totalCount===0||listResponse.items.length===0)return deps.logger.debug("No personal environment found \u2014 skipping provisioning key injection from personal env",{executionId,org:executionOrg}),filtered;let personalEnv=listResponse.items[0],personalEnvId=personalEnv.metadata?.id??"",out=filtered,injected=!1;for(let key of missing){if(!Object.hasOwn(personalEnv.spec?.data??{},key))continue;let secretValue;try{secretValue=await deps.environmentReader().getSecretValue(create2(EnvironmentSecretValueInputSchema,{environmentId:personalEnvId,key}))}catch(error2){deps.logger.warn("Failed to retrieve secret from personal environment (non-fatal)",{executionId,key,personalEnvId,error:error2 instanceof Error?error2.message:String(error2)});continue}secretValue.value!==""&&(injected||(out=new Map(out),injected=!0),out.set(key,create2(ExecutionValueSchema,{value:secretValue.value,isSecret:!0})),deps.logger.info("Injected workspace-provisioning key from caller's personal environment",{executionId,key,personalEnvId}))}return out}function mergeAgentAndSessionMcpUsages(agentResource,session){let merged=new Map;for(let usage of session?.spec?.mcpServerUsages??[]){let slug=usage.mcpServerRef?.slug??"";slug!==""&&merged.set(slug,usage)}for(let usage of agentResource?.spec?.mcpServerUsages??[]){let slug=usage.mcpServerRef?.slug??"";slug!==""&&merged.set(slug,usage)}return[...merged.values()]}async function injectMcpOAuthFromManagedEnvironment(deps,filtered,mcpServerUsages,executionOrg,executionId){if(mcpServerUsages.length===0)return filtered;let out=filtered,injected=!1;for(let usage of mcpServerUsages){let ref=usage.mcpServerRef,slug=ref?.slug??"";if(slug==="")continue;let serverOrg=ref?.org??"";if(serverOrg===""&&(serverOrg=executionOrg),serverOrg==="")continue;let mcpServer;try{mcpServer=await findResourceBySlug(deps.store,ApiResourceKind.mcp_server,McpServerSchema,slug,serverOrg)}catch{continue}if(mcpServer===void 0||mcpServer.spec?.auth===void 0)continue;let mcpServerId=mcpServer.metadata?.id??"",grant=await deps.store.oauthGrants.find("",mcpServerId,serverOrg).catch(()=>{});if(grant===void 0)continue;let oauthKey=grant.accessTokenEnvVar;if(oauthKey===""||out.has(oauthKey))continue;let managedEnvId=grant.environmentId;if(managedEnvId===""){deps.logger.warn("OAuth grant has no managed environment ID \u2014 skipping token injection",{mcpServerId,executionId});continue}let refreshResult;try{refreshResult=await inlineRefreshIfExpired(deps,grant,managedEnvId)}catch(error2){throw new Error(`OAuth token refresh failed for MCP server '${mcpServerId}': ${error2 instanceof Error?error2.message:String(error2)}`)}if(refreshResult!==void 0&&refreshResult.refreshed)try{await deps.store.oauthGrants.upsert({...grant,accessTokenExpiresAt:refreshResult.newExpiresAt})}catch(error2){deps.logger.warn("Failed to update OAuth grant after inline refresh (non-fatal)",{mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}let tokenValue;try{tokenValue=await deps.managedEnvService.readSecretValue(managedEnvId,oauthKey)}catch(error2){deps.logger.warn("Failed to read OAuth token from managed environment (non-fatal)",{mcpServerId,oauthKey,managedEnvId,executionId,error:error2 instanceof Error?error2.message:String(error2)});continue}if(tokenValue===""){deps.logger.warn("Failed to read OAuth token from managed environment (non-fatal)",{mcpServerId,oauthKey,managedEnvId,executionId});continue}injected||(out=new Map(out),injected=!0),out.set(oauthKey,create2(ExecutionValueSchema,{value:tokenValue,isSecret:!0})),deps.logger.info("Injected OAuth token from managed environment",{executionId,mcpServerId,oauthKey,managedEnvId})}return out}async function inlineRefreshIfExpired(deps,grant,managedEnvId){let currentRefreshToken;try{currentRefreshToken=await deps.managedEnvService.readSecretValue(managedEnvId,grant.refreshTokenEnvVar)}catch{return}if(currentRefreshToken==="")return;let result=await refreshTokenIfExpired(grant,currentRefreshToken,"","",deps.logger,deps.fetchImpl??fetch);if(!result.refreshed)return result;let tokenVariables={[grant.accessTokenEnvVar]:create2(EnvironmentValueSchema,{value:result.newAccessToken,isSecret:!0})};result.newRefreshToken!==currentRefreshToken&&(tokenVariables[grant.refreshTokenEnvVar]=create2(EnvironmentValueSchema,{value:result.newRefreshToken,isSecret:!0}));try{await deps.managedEnvService.updateSecrets(managedEnvId,tokenVariables)}catch(error2){throw new Error(`failed to write refreshed tokens to managed environment: ${error2 instanceof Error?error2.message:String(error2)}`)}return result}function settleInterruptedToolCalls(status,completedAt){if(status===void 0)return 0;let settled=settleInMessages(status.messages,completedAt);for(let sa of status.subAgentExecutions)settled+=settleInMessages(sa.messages,completedAt);return settled}function settleInMessages(messages,completedAt){let settled=0;for(let m3 of messages)for(let tc of m3.toolCalls)switch(tc.status){case ToolCallStatus.TOOL_CALL_PENDING:case ToolCallStatus.TOOL_CALL_RUNNING:case ToolCallStatus.TOOL_CALL_WAITING_APPROVAL:{tc.status=ToolCallStatus.TOOL_CALL_INTERRUPTED,tc.completedAt===""&&(tc.completedAt=completedAt),tc.streamingSource=ToolCallStreamingSource.UNSPECIFIED,settled++;break}default:break}return settled}var REASON_KEY="reason",ALREADY_IN_TARGET_STATE_KEY="alreadyInTargetState",TEMPORAL_UNAVAILABLE_MESSAGE2="Temporal is not available";function newLoadExecutionByIdStep(deps){return{name:"LoadExecutionById",async execute(ctx){let executionId=ctx.newState.id;if(executionId==="")throw invalidArgumentError("execution id is required");let execution;try{execution=await deps.store.getResource(ApiResourceKind.agent_execution,executionId,AgentExecutionSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("agent_execution",executionId):internalError(error2,"failed to load agent execution")}ctx.set(LOADED_EXECUTION_KEY,execution)}}}function loadedExecution(ctx){return ctx.get(LOADED_EXECUTION_KEY)}function phaseName(phase){return enumToJson(ExecutionPhaseSchema,phase)}function newValidatePhaseStep(config2){return{name:config2.name,execute(ctx){let execution=loadedExecution(ctx),phase=execution.status?.phase??ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED;if(phase===config2.targetPhase){config2.logger.debug("Execution already in target state, returning success (idempotent)",{executionId:execution.metadata?.id??""}),ctx.set(ALREADY_IN_TARGET_STATE_KEY,!0);return}if(!config2.allowed.includes(phase))throw failedPreconditionError(config2.refusal(phase))}}}function newEngineLifecycleStep(config2){return{name:config2.name,async execute(ctx){if(ctx.get(ALREADY_IN_TARGET_STATE_KEY)===!0)return;let engine=config2.deps.engineState();if(!engine.connected)throw failedPreconditionError(TEMPORAL_UNAVAILABLE_MESSAGE2);let executionId=loadedExecution(ctx).metadata?.id??"";try{await config2.invoke(engine,executionId,ctx)}catch(error2){if(error2 instanceof EngineWorkflowNotFoundError){config2.deps.logger.warn("Temporal workflow not found, may have already completed",{executionId});return}throw internalError(error2,config2.failureMessage)}}}}function applyLifecyclePhaseTransition(execution,targetPhase,setError,clearError,reason){execution.status??=create2(AgentExecutionStatusSchema);let status=execution.status;if(status.phase=targetPhase,targetPhase===ExecutionPhase.EXECUTION_CANCELLED||targetPhase===ExecutionPhase.EXECUTION_TERMINATED){let now=new Date().toISOString().replace(/\.\d{3}Z$/,"Z");status.completedAt=now,cancelInProgressSubAgents(status.subAgentExecutions,now),settleInterruptedToolCalls(status,now),status.pendingApprovals=[]}targetPhase===ExecutionPhase.EXECUTION_IN_PROGRESS&&(status.completedAt=""),setError&&(status.error=reason!==""?`Terminated: ${reason}`:"Terminated by user"),clearError&&(status.error="")}function cancelInProgressSubAgents(subAgents,completedAt){for(let sa of subAgents)sa!==void 0&&(sa.status===SubAgentStatus.SUB_AGENT_IN_PROGRESS||sa.status===SubAgentStatus.SUB_AGENT_PENDING)&&(sa.status=SubAgentStatus.SUB_AGENT_CANCELLED,sa.completedAt===""&&(sa.completedAt=completedAt))}function newUpdateExecutionPhaseAndPersistStep(deps,targetPhase,setError,clearError){return{name:"UpdateExecutionPhaseAndPersist",async execute(ctx){if(ctx.get(ALREADY_IN_TARGET_STATE_KEY)===!0)return;let executionId=loadedExecution(ctx).metadata?.id??"",reasonValue=ctx.get(REASON_KEY),reason=typeof reasonValue=="string"?reasonValue:"",updated,oldPhase=ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED;try{updated=await deps.store.updateResource(ApiResourceKind.agent_execution,executionId,AgentExecutionSchema,loaded=>{oldPhase=loaded.status?.phase??ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED,applyLifecyclePhaseTransition(loaded,targetPhase,setError,clearError,reason)})}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("agent_execution",executionId):internalError(error2,"failed to persist execution")}await notifyStatusObservers(deps,updated,oldPhase,targetPhase),ctx.set(LOADED_EXECUTION_KEY,updated)}}}function newLifecycleBroadcastStep(deps){return{name:"LifecycleBroadcast",execute(ctx){ctx.get(ALREADY_IN_TARGET_STATE_KEY)!==!0&&deps.broker.broadcast(loadedExecution(ctx))}}}async function runLifecyclePipeline(deps,pipelineName,schema2,input,method,identity2,steps){let reqCtx=new RequestContext(schema2,input,identity2,ApiResourceKind.agent_execution),builder2=newPipeline(pipelineName,deps.logger);builder2.addStep(newAuthorizeStep(method,deps.authorizer));for(let step of steps)builder2.addStep(step);await builder2.build().execute(reqCtx);let execution=reqCtx.get(LOADED_EXECUTION_KEY);if(execution===void 0)throw internalError(new Error(`execution not found in context after ${pipelineName}`),`execution not found in context after ${pipelineName.replace("agentexecution-","")} pipeline`);return execution}async function cancelExecution(deps,input,identity2){return deps.logger.info("Cancel agent execution request",{executionId:input.id,reason:input.reason}),runLifecyclePipeline(deps,"agentexecution-cancel",AgentExecutionCommandController.method.cancel.input,input,AgentExecutionCommandController.method.cancel,identity2,[newLoadExecutionByIdStep(deps),newValidatePhaseStep({name:"ValidateCancellable",targetPhase:ExecutionPhase.EXECUTION_CANCELLED,allowed:[ExecutionPhase.EXECUTION_PENDING,ExecutionPhase.EXECUTION_IN_PROGRESS],refusal:phase=>`cannot cancel execution in phase ${phaseName(phase)}; only PENDING or IN_PROGRESS can be cancelled`,logger:deps.logger}),newEngineLifecycleStep({name:"CancelTemporalWorkflow",deps,invoke:(engine,executionId)=>engine.engine.cancelWorkflow(executionId),failureMessage:"failed to cancel Temporal workflow"}),newUpdateExecutionPhaseAndPersistStep(deps,ExecutionPhase.EXECUTION_CANCELLED,!1,!1),newLifecycleBroadcastStep(deps)])}async function terminateExecution(deps,input,identity2){return deps.logger.info("Terminate agent execution request",{executionId:input.id,reason:input.reason}),runLifecyclePipeline(deps,"agentexecution-terminate",AgentExecutionCommandController.method.terminate.input,input,AgentExecutionCommandController.method.terminate,identity2,[newLoadExecutionByIdStep(deps),newValidatePhaseStep({name:"ValidateTerminable",targetPhase:ExecutionPhase.EXECUTION_TERMINATED,allowed:[ExecutionPhase.EXECUTION_PENDING,ExecutionPhase.EXECUTION_IN_PROGRESS],refusal:phase=>`cannot terminate execution in phase ${phaseName(phase)}; only PENDING or IN_PROGRESS can be terminated`,logger:deps.logger}),newEngineLifecycleStep({name:"TerminateTemporalWorkflow",deps,invoke:async(engine,executionId,ctx)=>{let reason=ctx.newState.reason||"Terminated by user";await engine.engine.terminateWorkflow(executionId,reason),ctx.set(REASON_KEY,reason)},failureMessage:"failed to terminate Temporal workflow"}),newUpdateExecutionPhaseAndPersistStep(deps,ExecutionPhase.EXECUTION_TERMINATED,!0,!1),newLifecycleBroadcastStep(deps)])}async function pauseExecution(deps,input,identity2){return deps.logger.info("Pause agent execution request",{executionId:input.id,reason:input.reason}),runLifecyclePipeline(deps,"agentexecution-pause",AgentExecutionCommandController.method.pause.input,input,AgentExecutionCommandController.method.pause,identity2,[newLoadExecutionByIdStep(deps),newValidatePhaseStep({name:"ValidatePausable",targetPhase:ExecutionPhase.EXECUTION_PAUSED,allowed:[ExecutionPhase.EXECUTION_PENDING,ExecutionPhase.EXECUTION_IN_PROGRESS],refusal:phase=>`cannot pause execution in phase ${phaseName(phase)}; only PENDING or IN_PROGRESS can be paused`,logger:deps.logger}),newEngineLifecycleStep({name:"SignalPauseToTemporal",deps,invoke:async(engine,executionId,ctx)=>{let reason=ctx.newState.reason||"Paused by user";await engine.engine.signalPause(executionId,reason),ctx.set(REASON_KEY,reason)},failureMessage:"failed to send pause signal to Temporal workflow"}),newUpdateExecutionPhaseAndPersistStep(deps,ExecutionPhase.EXECUTION_PAUSED,!1,!1),newLifecycleBroadcastStep(deps)])}async function resumeExecution(deps,input,identity2){return deps.logger.info("Resume agent execution request",{executionId:input.id}),runLifecyclePipeline(deps,"agentexecution-resume",AgentExecutionCommandController.method.resume.input,input,AgentExecutionCommandController.method.resume,identity2,[newLoadExecutionByIdStep(deps),newValidatePhaseStep({name:"ValidateResumable",targetPhase:ExecutionPhase.EXECUTION_IN_PROGRESS,allowed:[ExecutionPhase.EXECUTION_PAUSED],refusal:phase=>`cannot resume execution in phase ${phaseName(phase)}; only PAUSED executions can be resumed`,logger:deps.logger}),newEngineLifecycleStep({name:"SignalResumeToTemporal",deps,invoke:(engine,executionId)=>engine.engine.signalResume(executionId),failureMessage:"failed to send resume signal to Temporal workflow"}),newUpdateExecutionPhaseAndPersistStep(deps,ExecutionPhase.EXECUTION_IN_PROGRESS,!1,!1),newLifecycleBroadcastStep(deps)])}async function recoverExecution(deps,input,identity2){return deps.logger.info("Recover agent execution request",{executionId:input.id}),runLifecyclePipeline(deps,"agentexecution-recover",AgentExecutionCommandController.method.recover.input,input,AgentExecutionCommandController.method.recover,identity2,[newLoadExecutionByIdStep(deps),newValidatePhaseStep({name:"ValidateRecoverable",targetPhase:ExecutionPhase.EXECUTION_IN_PROGRESS,allowed:[ExecutionPhase.EXECUTION_FAILED],refusal:phase=>`cannot recover execution in phase ${phaseName(phase)}; only FAILED executions can be recovered`,logger:deps.logger}),newEngineLifecycleStep({name:"TerminateExistingWorkflow",deps,invoke:(engine,executionId)=>engine.engine.terminateWorkflow(executionId,"Recovery: terminating before fresh workflow start"),failureMessage:"failed to terminate previous workflow during recovery"}),...stepsForSlot(deps.gateSteps,"agent-execution-recover:pre-side-effect-gate"),newRecreateExecutionContextStep(deps),newStartFreshWorkflowStep(deps),{name:"EnsureSessionSandbox",async execute(ctx){ctx.get(ALREADY_IN_TARGET_STATE_KEY)!==!0&&await ensureSessionSandboxForExecution({store:deps.store,logger:deps.logger,lane:deps.sandboxLane,temporalConfig:deps.temporalConfig},loadedExecution(ctx),ctx.callerIdentity)}},newUpdateExecutionPhaseAndPersistStep(deps,ExecutionPhase.EXECUTION_IN_PROGRESS,!1,!0),newLifecycleBroadcastStep(deps)])}function newRecreateExecutionContextStep(deps){return{name:"RecreateExecutionContext",async execute(ctx){if(ctx.get(ALREADY_IN_TARGET_STATE_KEY)===!0)return;let execution=loadedExecution(ctx),executionId=execution.metadata?.id??"";await deleteStaleExecutionContext(deps,executionId);try{await buildAndPersistExecutionContext(deps.executionContextBuilder,execution,"")}catch(error2){throw error2 instanceof ConnectError?new ConnectError(`recreate execution context for recovered execution ${executionId}: ${error2.rawMessage}`,error2.code):new Error(`recreate execution context for recovered execution ${executionId}: ${error2 instanceof Error?error2.message:String(error2)}`)}}}}async function deleteStaleExecutionContext(deps,executionId){let existing;try{existing=await deps.store.findByField(ApiResourceKind.execution_context,"spec.executionId",executionId,ExecutionContextSchema)}catch{return}let ecId=existing.metadata?.id??"";if(ecId!==""){deps.logger.info("Deleting stale ExecutionContext before recreation",{executionContextId:ecId,executionId});try{await deps.store.deleteResource(ApiResourceKind.execution_context,ecId)}catch(error2){deps.logger.warn("Failed to delete stale ExecutionContext (proceeding anyway)",{executionContextId:ecId,error:error2 instanceof Error?error2.message:String(error2)})}}}function newStartFreshWorkflowStep(deps){return{name:"StartFreshWorkflow",async execute(ctx){if(ctx.get(ALREADY_IN_TARGET_STATE_KEY)===!0)return;let engine=deps.engineState();if(!engine.connected)throw failedPreconditionError("Temporal is not available (workflow creator not set)");let execution=loadedExecution(ctx),executionId=execution.metadata?.id??"";try{await engine.engine.startInvokeWorkflow({executionId,sessionId:execution.spec?.sessionId??"",agentId:execution.spec?.agentId??"",callbackToken:new Uint8Array,autoApproveAll:execution.spec?.autoApproveAll??!1,parentWorkflowId:"",activityTaskQueueOverride:""})}catch(error2){throw error2 instanceof EngineDispatchError?failedPreconditionError(error2.message):internalError(error2,"failed to start fresh Temporal workflow for recovered execution")}deps.logger.info("Started fresh Temporal workflow for recovered execution",{executionId})}}}function agentExecutionRunTarget(execution){let spec=execution.spec,sessionId=spec?.sessionId??"";if(sessionId!=="")return{...RUN_GATE_CHECKS.session,resourceId:sessionId,deniedMessage:addExecutionToSessionDeniedMessage(sessionId)};let agentInstanceId=spec?.sessionSpec?.agentInstanceId??"";if(agentInstanceId!=="")return{...RUN_GATE_CHECKS.agentInstance,resourceId:agentInstanceId,deniedMessage:runAgentInstanceDeniedMessage(agentInstanceId)};let agentId=spec?.agentId??"";if(agentId!=="")return{...RUN_GATE_CHECKS.agent,resourceId:agentId,deniedMessage:runAgentDeniedMessage(agentId)}}var agentExecutionSearchExtractor={kind:ApiResourceKind.agent_execution,schema:AgentExecutionSchema,getSearchSummary(resource){return resource.metadata?.name??""},toSearchResult(resource,score){let execution=resource;return buildSearchResult({kind:ApiResourceKind.agent_execution,metadata:execution.metadata,summary:"",score,createdAt:execution.status?.audit?.specAudit?.createdAt,updatedAt:execution.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let execution=resource,metadata=execution.metadata;if(metadata!==void 0)return{name:metadata.name,description:"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(execution.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};function computePendingApprovals(messages,subAgentExecutions){let result=[];for(let msg of messages)for(let tc of msg.toolCalls){let pa=projectToolCall(tc,!1,"","");pa!==void 0&&result.push(pa)}for(let sa of subAgentExecutions)if(!isTerminalSubAgent(sa.status))for(let msg of sa.messages)for(let tc of msg.toolCalls){let pa=projectToolCall(tc,!0,sa.name,sa.subject);pa!==void 0&&result.push(pa)}return result}function isTerminalExecution(phase){switch(phase){case ExecutionPhase.EXECUTION_COMPLETED:case ExecutionPhase.EXECUTION_FAILED:case ExecutionPhase.EXECUTION_CANCELLED:case ExecutionPhase.EXECUTION_TERMINATED:return!0;default:return!1}}function isTerminalSubAgent(status){switch(status){case SubAgentStatus.SUB_AGENT_COMPLETED:case SubAgentStatus.SUB_AGENT_FAILED:case SubAgentStatus.SUB_AGENT_CANCELLED:return!0;default:return!1}}function projectToolCall(tc,fromSubAgent,subAgentName,subAgentSubject){if(tc.status===ToolCallStatus.TOOL_CALL_WAITING_APPROVAL&&tc.requiresApproval&&tc.approvalAction===ApprovalAction.UNSPECIFIED)return create2(PendingApprovalSchema,{toolCallId:tc.id,toolName:tc.name,message:tc.approvalMessage,argsPreview:tc.argsPreview,requestedAt:tc.approvalRequestedAt,fromSubAgent,subAgentName,subAgentSubject,mcpServerSlug:tc.mcpServerSlug,toolKind:tc.toolKind,approvalPolicySource:tc.approvalPolicySource})}function computePendingApprovalsFromEvents(stream){if(stream===void 0)return[];let resolved=new Set;for(let ev of stream.events)isResolvingEvent(ev.eventType)&&resolved.add(ev.approvalRequestId);let result=[];for(let ev of stream.events)ev.eventType===ApprovalEventType.REQUESTED&&(resolved.has(ev.approvalRequestId)||ev.payload.case==="requested"&&result.push(pendingApprovalFromRequest(ev.payload.value)));return result}function isResolvingEvent(t){switch(t){case ApprovalEventType.APPROVED:case ApprovalEventType.REJECTED:case ApprovalEventType.SKIPPED:case ApprovalEventType.RETRACTED:return!0;default:return!1}}function pendingApprovalFromRequest(req){return create2(PendingApprovalSchema,{toolCallId:req.toolCallId,toolName:req.toolName,message:req.message,argsPreview:req.argsPreview,requestedAt:req.requestedAt,fromSubAgent:req.fromSubAgent,subAgentName:req.subAgentName,subAgentSubject:req.subAgentSubject,mcpServerSlug:req.mcpServerSlug,toolKind:req.toolKind,approvalPolicySource:req.approvalPolicySource})}var ACTOR_SYSTEM="system",ACTOR_USER="user";function emitApprovalEvents(messages,subAgentExecutions){let stream=create2(ApprovalEventStreamSchema);for(let msg of messages)for(let tc of msg.toolCalls)appendToolCallEvents(stream,tc,!1,"","");for(let sa of subAgentExecutions)if(!isTerminalSubAgent(sa.status))for(let msg of sa.messages)for(let tc of msg.toolCalls)appendToolCallEvents(stream,tc,!0,sa.name,sa.subject);return stream}function appendToolCallEvents(stream,tc,fromSubAgent,subAgentName,subAgentSubject){if(!isGatedToolCall(tc))return;stream.events.push(buildRequestedEvent(tc,fromSubAgent,subAgentName,subAgentSubject));let decided=buildDecisionEvent(tc,"","");decided!==void 0&&stream.events.push(decided)}function isGatedToolCall(tc){return tc.status===ToolCallStatus.TOOL_CALL_WAITING_APPROVAL&&tc.requiresApproval}function buildRequestedEvent(tc,fromSubAgent,subAgentName,subAgentSubject){let requestId=tc.id;return create2(ApprovalEventSchema,{eventId:eventId(requestId,ApprovalEventType.REQUESTED),approvalRequestId:requestId,eventType:ApprovalEventType.REQUESTED,timestamp:tc.approvalRequestedAt,actor:ACTOR_SYSTEM,payload:{case:"requested",value:{approvalRequestId:requestId,toolCallId:tc.id,requestedAt:tc.approvalRequestedAt,toolName:tc.name,message:tc.approvalMessage,argsPreview:tc.argsPreview,fromSubAgent,subAgentName,subAgentSubject,mcpServerSlug:tc.mcpServerSlug,toolKind:tc.toolKind,approvalPolicySource:tc.approvalPolicySource}}})}function buildDecisionEvent(tc,decidedBy,comment){let action=tc.approvalAction;if(action===ApprovalAction.UNSPECIFIED)return;let requestId=tc.id,eventType=decisionEventType(action);return create2(ApprovalEventSchema,{eventId:eventId(requestId,eventType),approvalRequestId:requestId,eventType,timestamp:tc.approvalDecidedAt,actor:ACTOR_USER,payload:{case:"decided",value:{approvalRequestId:requestId,action,decidedAt:tc.approvalDecidedAt,decidedBy,comment}}})}function buildRetractionEvent(requestId,reason){return create2(ApprovalEventSchema,{eventId:eventId(requestId,ApprovalEventType.RETRACTED),approvalRequestId:requestId,eventType:ApprovalEventType.RETRACTED,actor:ACTOR_SYSTEM,payload:{case:"retracted",value:{approvalRequestId:requestId,reason}}})}function decisionEventType(action){switch(action){case ApprovalAction.APPROVE:case ApprovalAction.APPROVE_ALL:return ApprovalEventType.APPROVED;case ApprovalAction.SKIP:return ApprovalEventType.SKIPPED;case ApprovalAction.REJECT:return ApprovalEventType.REJECTED;default:return ApprovalEventType.UNSPECIFIED}}function eventId(requestId,eventType){return`${requestId}:${enumToJson(ApprovalEventTypeSchema,eventType)}`}function ensureApprovalRequests(status,executionId){if(status===void 0)return;let stream=status.approvalEventStream;if(stream===void 0||stream.events.length===0){let seeded=emitApprovalEvents(status.messages,status.subAgentExecutions);seeded.executionId=executionId,status.approvalEventStream=seeded;return}let seen=eventIdSet(stream);appendRequestedIfAbsent(stream,seen,status.messages,!1,"","");for(let sa of status.subAgentExecutions)isTerminalSubAgent(sa.status)||appendRequestedIfAbsent(stream,seen,sa.messages,!0,sa.name,sa.subject);reconcileRetractions(status,stream,seen)}function reconcileRetractions(status,stream,seen){if(isTerminalExecution(status.phase))return;let gated=gatedToolCallIds(status),resolved=resolvedRequestIds(stream),original=[...stream.events];for(let ev of original){if(ev.eventType!==ApprovalEventType.REQUESTED)continue;let reqId=ev.approvalRequestId;if(gated.has(reqId)||resolved.has(reqId))continue;let event=buildRetractionEvent(reqId,retractionReason(status,reqId));seen.has(event.eventId)||(stream.events.push(event),seen.add(event.eventId))}}function gatedToolCallIds(status){let pending=computePendingApprovals(status.messages,status.subAgentExecutions);return new Set(pending.map(pa=>pa.toolCallId))}function resolvedRequestIds(stream){let resolved=new Set;for(let ev of stream.events)isResolvingEvent(ev.eventType)&&resolved.add(ev.approvalRequestId);return resolved}function retractionReason(status,requestId){for(let sa of status.subAgentExecutions)for(let msg of sa.messages)for(let tc of msg.toolCalls)if(tc.id===requestId)return isTerminalSubAgent(sa.status)?ApprovalRetractionReason.SUB_AGENT_TERMINAL:ApprovalRetractionReason.SUPERSEDED;return ApprovalRetractionReason.SUPERSEDED}function appendRequestedIfAbsent(stream,seen,messages,fromSubAgent,subAgentName,subAgentSubject){for(let msg of messages)for(let tc of msg.toolCalls){if(!isGatedToolCall(tc))continue;let event=buildRequestedEvent(tc,fromSubAgent,subAgentName,subAgentSubject);seen.has(event.eventId)||(stream.events.push(event),seen.add(event.eventId))}}function recordDecisionEvent(status,tc,decidedBy,comment){if(status===void 0)return;let event=buildDecisionEvent(tc,decidedBy,comment);if(event===void 0)return;let stream=status.approvalEventStream;stream===void 0&&(stream=create2(ApprovalEventStreamSchema),status.approvalEventStream=stream),!stream.events.some(ev=>ev.eventId===event.eventId)&&stream.events.push(event)}function eventIdSet(stream){return new Set(stream.events.map(ev=>ev.eventId))}var TOOL_NAME_TO_CATEGORY=new Map([["write","write"],["write_file","write"],["create_file","write"],["overwrite_file","write"],["Write","write"],["edit","write"],["edit_file","write"],["str_replace_editor","write"],["StrReplace","write"],["EditNotebook","write"],["delete","delete"],["delete_file","delete"],["remove_file","delete"],["Delete","delete"],["shell","shell"],["bash","shell"],["execute","shell"],["execute_command","shell"],["run_command","shell"],["terminal","shell"],["Shell","shell"]]);function toolApprovalCategory(name){return TOOL_NAME_TO_CATEGORY.get(name)}function deriveLeaseScope(tc){let slug=tc.mcpServerSlug;if(slug!=="")return{category:"",server:slug};let category=toolApprovalCategory(tc.name);if(category!==void 0)return{category,server:""}}function sameLeaseScope(a5,b7){return a5.category===b7.category&&a5.server===b7.server}var pendingApprovalDivergence=0;function projectPendingApprovals(phase,messages,subAgentExecutions,stream,logger2){if(isTerminalExecution(phase))return[];let fromEvents=computePendingApprovalsFromEvents(stream),fromScan=computePendingApprovals(messages,subAgentExecutions),diff=diffPendingApprovals(fromScan,fromEvents);return diff!==""&&(pendingApprovalDivergence+=1,logger2.warn("pending_approvals event-stream source of truth diverged from the message-scan cross-check",{signal:"hitl_pending_approvals_projection_divergence",scanCount:fromScan.length,eventsCount:fromEvents.length,divergenceTotal:pendingApprovalDivergence,diff})),fromEvents}function diffPendingApprovals(scan2,events){let scanById=indexByToolCallId(scan2),eventsById=indexByToolCallId(events);if(scanById.size!==scan2.length||eventsById.size!==events.length)return"duplicate tool_call_id within a projection set";let diffs=[];for(let[id,pa]of scanById){let other=eventsById.get(id);if(other===void 0){diffs.push(`only-in-scan:${id}`);continue}equals(PendingApprovalSchema,pa,other)||diffs.push(`field-mismatch:${id}`)}for(let id of eventsById.keys())scanById.has(id)||diffs.push(`only-in-events:${id}`);return diffs.sort(),diffs.join(",")}function indexByToolCallId(list12){let m3=new Map;for(let pa of list12)m3.set(pa.toolCallId,pa);return m3}function countAwaitingReview(changeSets){let n3=0;for(let cs of changeSets)cs.status===FileChangeSetStatus.AWAITING_REVIEW&&n3++;return n3}function unresolvedGateCount(status){return status.pendingApprovals.length+countAwaitingReview(status.fileChangeSets)}function gateResolved(status){return unresolvedGateCount(status)===0}var IS_IDEMPOTENT_REQUEST_KEY="isIdempotentRequest",TARGET_RESOURCE_KEY2="targetResource";async function submitApproval(deps,input,identity2){let reqCtx=new RequestContext(AgentExecutionCommandController.method.submitApproval.input,input,identity2,ApiResourceKind.agent_execution),builder2=newPipeline("agent-execution-submit-approval",deps.logger).addStep(newAuthorizeStep(AgentExecutionCommandController.method.submitApproval,deps.authorizer)).addStep(newValidateProtoStep()).addStep({name:"LoadExisting",async execute(ctx){let executionId=ctx.input.agentExecutionId;if(executionId==="")throw invalidArgumentError("agent_execution_id is required");let execution;try{execution=await deps.store.getResource(ApiResourceKind.agent_execution,executionId,AgentExecutionSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("agent_execution",executionId):internalError(error2,"failed to load agent execution")}ctx.set(TARGET_RESOURCE_KEY2,execution)}}).addStep({name:"ValidateApproval",execute(ctx){let execution=ctx.get(TARGET_RESOURCE_KEY2),executionId=execution.metadata?.id??"",requestedToolCallId=ctx.input.toolCallId,requestedAction=ctx.input.action,currentPhase=execution.status?.phase??ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED;if(currentPhase!==ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL&&currentPhase!==ExecutionPhase.EXECUTION_IN_PROGRESS)throw failedPreconditionError(`execution ${executionId} is in phase ${protoName(ExecutionPhaseSchema,currentPhase)}, approval requires EXECUTION_WAITING_FOR_APPROVAL or EXECUTION_IN_PROGRESS`);let tc=findToolCallInExecution(execution,requestedToolCallId);if(tc===void 0)throw invalidArgumentError(`tool_call_id ${requestedToolCallId} not found in messages for execution ${executionId}`);let existingAction=tc.approvalAction;if(existingAction!==ApprovalAction.UNSPECIFIED){if(existingAction===requestedAction){deps.logger.info("IDEMPOTENT: ToolCall already has matching approval action",{executionId,toolCallId:requestedToolCallId,action:protoName(ApprovalActionSchema,requestedAction)}),ctx.set(IS_IDEMPOTENT_REQUEST_KEY,!0);return}throw failedPreconditionError(`tool call ${requestedToolCallId} already has approval action ${protoName(ApprovalActionSchema,existingAction)}, cannot change to ${protoName(ApprovalActionSchema,requestedAction)}`)}if(tc.status!==ToolCallStatus.TOOL_CALL_WAITING_APPROVAL)throw failedPreconditionError(`tool call ${requestedToolCallId} has status ${protoName(ToolCallStatusSchema,tc.status)}, expected TOOL_CALL_WAITING_APPROVAL`)}});for(let step of stepsForSlot(deps.gateSteps,"agent-execution-submit-approval:gate"))builder2.addStep(step);return await builder2.addStep({name:"RecordApprovalDecision",async execute(ctx){if(ctx.get(IS_IDEMPOTENT_REQUEST_KEY)===!0){deps.logger.debug("Skipping approval decision recording for idempotent request");return}let executionId=ctx.input.agentExecutionId,toolCallId=ctx.input.toolCallId,action=ctx.input.action,comment=ctx.input.comment,now=new Date().toISOString().replace(/\.\d{3}Z$/,"Z"),decidedBy="",updated;try{updated=await deps.store.updateResource(ApiResourceKind.agent_execution,executionId,AgentExecutionSchema,execution=>{let tc=findToolCallInExecution(execution,toolCallId);if(tc===void 0)throw new Error(`tool call ${toolCallId} no longer exists in execution ${executionId}`);if(tc.approvalAction!==ApprovalAction.UNSPECIFIED)throw new Error(`tool call ${toolCallId} already has approval action ${protoName(ApprovalActionSchema,tc.approvalAction)} (concurrent approval won the race)`);if(execution.status===void 0&&(execution.status=create2(AgentExecutionStatusSchema)),ensureApprovalRequests(execution.status,executionId),tc.approvalAction=action,tc.approvalDecidedAt=now,tc.approvedBy=decidedBy,recordDecisionEvent(execution.status,tc,decidedBy,comment),action===ApprovalAction.APPROVE_ALL)for(let bulkTc of bulkApproveCoPendingToolCalls(execution,toolCallId,now,decidedBy))recordDecisionEvent(execution.status,bulkTc,decidedBy,"");execution.status.pendingApprovals=projectPendingApprovals(execution.status.phase,execution.status.messages,execution.status.subAgentExecutions,execution.status.approvalEventStream,deps.logger)})}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("agent_execution",executionId):internalError(error2,"failed to persist approval decision")}deps.logger.info("Recorded approval decision on ToolCall, recomputed pending_approvals",{executionId,toolCallId,action:protoName(ApprovalActionSchema,action),pendingApprovalsRemaining:updated.status?.pendingApprovals.length??0}),deps.broker.broadcast(updated),ctx.set(TARGET_RESOURCE_KEY2,updated)}}).addStep({name:"SignalWorkflow",async execute(ctx){if(ctx.get(IS_IDEMPOTENT_REQUEST_KEY)===!0){deps.logger.debug("Skipping workflow signal for idempotent request");return}let engine=deps.engineState();if(!engine.connected){deps.logger.warn("Workflow creator not available - skipping Temporal signal");return}let execution=ctx.get(TARGET_RESOURCE_KEY2),executionId=execution.metadata?.id??"",pendingRemaining=execution.status?.pendingApprovals.length??0,awaitingReview=countAwaitingReview(execution.status?.fileChangeSets??[]);if(!(pendingRemaining===0&&awaitingReview===0)){deps.logger.info("Approval recorded, HITL gate not yet resolved \u2014 waiting",{executionId,toolCallId:ctx.input.toolCallId,pendingApprovalsRemaining:pendingRemaining,changeSetsAwaitingReview:awaitingReview});return}try{await engine.engine.signalApprovalGateResolved(executionId)}catch(error2){throw error2 instanceof EngineWorkflowNotFoundError?(deps.logger.warn("Workflow not found - reconciling stale execution status to FAILED",{executionId}),await reconcileStaleExecution(deps,execution),failedPreconditionError(`workflow not running for execution ${executionId} - the backing workflow has terminated unexpectedly and the execution has been marked as failed`)):unavailableError(`failed to signal workflow: ${error2 instanceof Error?error2.message:String(error2)}`)}deps.logger.info("Successfully sent approvalGateResolved signal to workflow",{executionId})}}).addStep({name:"BuildResponse",execute(ctx){let execution=ctx.get(TARGET_RESOURCE_KEY2),tc=findToolCallInExecution(execution,ctx.input.toolCallId);deps.logger.info("AUDIT: Approval decision submitted",{executionId:execution.metadata?.id??"",org:execution.metadata?.org??"",toolCallId:ctx.input.toolCallId,toolName:tc?.name??"unknown",action:protoName(ApprovalActionSchema,ctx.input.action),comment:ctx.input.comment})}}).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY2)}async function reconcileStaleExecution(deps,execution){let executionId=execution.metadata?.id??"",reconciled=create2(AgentExecutionSchema,{apiVersion:execution.apiVersion,kind:execution.kind,metadata:execution.metadata,spec:execution.spec,status:{phase:ExecutionPhase.EXECUTION_FAILED,error:"Workflow backing this execution is no longer running. Execution has been marked as failed.",messages:execution.status?.messages??[],audit:execution.status?.audit,approvalEventStream:execution.status?.approvalEventStream}});reconciled.status?.messages.push(create2(AgentMessageSchema,{type:MessageType.MESSAGE_SYSTEM,content:"The workflow backing this execution is no longer running. This can happen due to infrastructure issues or manual termination. The execution has been marked as failed."})),settleInterruptedToolCalls(reconciled.status,new Date().toISOString().replace(/\.\d{3}Z$/,"Z"));try{await deps.store.saveResource(ApiResourceKind.agent_execution,executionId,AgentExecutionSchema,reconciled)}catch(error2){deps.logger.error("Failed to reconcile stale execution status - execution will remain in WAITING_FOR_APPROVAL until next attempt",{executionId,error:error2 instanceof Error?error2.message:String(error2)});return}deps.logger.info("RECONCILIATION: Updated stale execution status to FAILED",{executionId}),await notifyStatusObservers(deps,reconciled,execution.status?.phase??ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED,ExecutionPhase.EXECUTION_FAILED)}function bulkApproveCoPendingToolCalls(execution,clickedToolCallId,decidedAt,decidedBy){let clicked=findToolCallInExecution(execution,clickedToolCallId);if(clicked===void 0)return[];let clickedScope=deriveLeaseScope(clicked);if(clickedScope===void 0)return[];let approved=[],approveIfWaitingInScope=tc=>{if(tc.id===clickedToolCallId||tc.status!==ToolCallStatus.TOOL_CALL_WAITING_APPROVAL||tc.approvalAction!==ApprovalAction.UNSPECIFIED)return;let scope=deriveLeaseScope(tc);scope===void 0||!sameLeaseScope(scope,clickedScope)||(tc.approvalAction=ApprovalAction.APPROVE,tc.approvalDecidedAt=decidedAt,tc.approvedBy=decidedBy,approved.push(tc))};for(let msg of execution.status?.messages??[])for(let tc of msg.toolCalls)approveIfWaitingInScope(tc);for(let sa of execution.status?.subAgentExecutions??[])for(let msg of sa.messages)for(let tc of msg.toolCalls)approveIfWaitingInScope(tc);return approved}function findToolCallInExecution(execution,toolCallId){for(let msg of execution.status?.messages??[])for(let tc of msg.toolCalls)if(tc.id===toolCallId)return tc;for(let sa of execution.status?.subAgentExecutions??[])for(let msg of sa.messages)for(let tc of msg.toolCalls)if(tc.id===toolCallId)return tc}function protoName(schema2,value){return enumToJson(schema2,value)}var ACTOR_USER2="user",ACTOR_POLICY="policy";function eventId2(changeSetId,scopeId,eventType){return`${changeSetId}:${scopeId}:${enumToJson(FileReviewEventTypeSchema,eventType)}`}function decisionScopeId(d5){return d5.scope===FileDecisionScope.FILE?d5.fileChangeId:d5.changeSetId}function buildFileDecision(changeSetId,fileChangeId,scope,action,expectedDigest,reviewerId,decidedAt,reason,acknowledgeUnreviewable){let decision=create2(FileDecisionSchema,{changeSetId,fileChangeId,scope,action,expectedDigest,reviewerId,decidedAt,reason,acknowledgeUnreviewable,origin:FileDecisionOrigin.USER});return decision.id=`${changeSetId}:${decisionScopeId(decision)}`,decision}function recordFileDecisionEvent(status,executionId,decision){recordFileDecisionEventWithActor(status,executionId,decision,ACTOR_USER2)}function recordFileDecisionEventWithActor(status,executionId,decision,actor){if(status===void 0||decision===void 0)return;let stream=status.fileReviewEventStream;stream===void 0&&(stream=create2(FileReviewEventStreamSchema,{executionId}),status.fileReviewEventStream=stream);let event=create2(FileReviewEventSchema,{eventId:eventId2(decision.changeSetId,decisionScopeId(decision),FileReviewEventType.FILE_DECIDED),changeSetId:decision.changeSetId,eventType:FileReviewEventType.FILE_DECIDED,timestamp:decision.decidedAt,actor,payload:{case:"fileDecided",value:decision}});hasEvent(stream,event.eventId)||stream.events.push(event)}function appendRunnerEvents(status,executionId,requestStatus){if(status===void 0||requestStatus===void 0)return;let incoming=requestStatus.fileReviewEventStream?.events??[];if(incoming.length===0)return;let stream=status.fileReviewEventStream;stream===void 0&&(stream=create2(FileReviewEventStreamSchema,{executionId}),status.fileReviewEventStream=stream);for(let ev of incoming)ev.eventType!==FileReviewEventType.FILE_DECIDED&&(ev.eventId===""||ev.changeSetId===""||hasEvent(stream,ev.eventId)||stream.events.push(ev))}function hasEvent(stream,id){return stream.events.some(ev=>ev.eventId===id)}function findChangeSet(changeSets,changeSetId){return changeSets.find(cs=>cs.id===changeSetId)}function findChange(cs,fileChangeId){return cs.changes.find(c5=>c5.id===fileChangeId)}function targetDigest(cs,scope,fileChangeId){return scope===FileDecisionScope.FILE?findChange(cs,fileChangeId)?.fileDigest??"":cs.aggregateDigest}function approveBlockedReason(cs,scope,fileChangeId,acknowledged){if(cs===void 0)return"change set is not reviewable";if(scope===FileDecisionScope.FILE){let c5=findChange(cs,fileChangeId);return c5===void 0?`file change ${fileChangeId} is not reviewable`:c5.diffComplete||acknowledged&&isBinaryChange(c5)?"":`file change ${fileChangeId} cannot be approved: its diff is not fully reviewable (incomplete or binary); reject it to discard, or wait for a complete capture`}return cs.diffCompleteness===DiffCompleteness.COMPLETE||acknowledged&&everyIncompleteChangeIsBinary(cs)?"":`change set ${cs.id} cannot be approved: at least one file's diff is not fully reviewable (incomplete or binary); reject the affected files or the whole set, or wait for a complete capture`}function isBinaryChange(c5){return(c5.before?.isBinary??!1)||(c5.after?.isBinary??!1)}function everyIncompleteChangeIsBinary(cs){let sawIncomplete=!1;for(let c5 of cs.changes)if(!c5.diffComplete&&(sawIncomplete=!0,!isBinaryChange(c5)))return!1;return sawIncomplete}function projectFileChangeSets(phase,stream){if(isTerminalExecution2(phase))return[];if(stream===void 0||stream.events.length===0)return[];let order=[],byId=new Map;for(let ev of stream.events){let csId=ev.changeSetId;if(csId==="")continue;let cs=byId.get(csId);cs===void 0&&(cs=create2(FileChangeSetSchema,{id:csId}),byId.set(csId,cs),order.push(csId)),applyEvent(cs,ev)}return order.map(id=>byId.get(id))}function applyEvent(cs,ev){switch(ev.eventType){case FileReviewEventType.BASELINE_CAPTURED:{if(ev.payload.case==="baselineCaptured"){let b7=ev.payload.value;cs.turnId=b7.turnId,cs.harnessId=b7.harnessId,cs.baselineSnapshot=b7.baselineSnapshot}cs.status=FileChangeSetStatus.CAPTURING;break}case FileReviewEventType.CANDIDATE_CAPTURED:{if(ev.payload.case==="candidateCaptured"){let c5=ev.payload.value;cs.candidateSnapshot=c5.candidateSnapshot,cs.changes=c5.changes,cs.aggregateDigest=c5.aggregateDigest,cs.diffCompleteness=c5.diffCompleteness}cs.status=deriveStatusAfterCandidate(cs);break}case FileReviewEventType.FILE_DECIDED:{ev.payload.case==="fileDecided"&&cs.decisions.push(ev.payload.value),cs.status=deriveStatusAfterCandidate(cs);break}case FileReviewEventType.RECONCILED:{ev.payload.case==="reconciled"&&(cs.approvedSnapshot=ev.payload.value.approvedSnapshot),cs.status=FileChangeSetStatus.RECONCILED;break}case FileReviewEventType.FAILED:{cs.status=FileChangeSetStatus.FAILED;break}default:break}}function deriveStatusAfterCandidate(cs){switch(cs.status){case FileChangeSetStatus.RECONCILED:case FileChangeSetStatus.FAILED:return cs.status;default:break}return isFullyDecided(cs)?FileChangeSetStatus.DECIDED:FileChangeSetStatus.AWAITING_REVIEW}function isFullyDecided(cs){if(cs.changes.length===0)return!1;let decidedFiles=new Set;for(let d5 of cs.decisions){if(d5.scope===FileDecisionScope.CHANGE_SET)return!0;d5.scope===FileDecisionScope.FILE&&decidedFiles.add(d5.fileChangeId)}return cs.changes.every(c5=>decidedFiles.has(c5.id))}function isTerminalExecution2(phase){switch(phase){case ExecutionPhase.EXECUTION_COMPLETED:case ExecutionPhase.EXECUTION_FAILED:case ExecutionPhase.EXECUTION_CANCELLED:case ExecutionPhase.EXECUTION_TERMINATED:return!0;default:return!1}}var FILE_DECISION_IDEMPOTENT_KEY="isIdempotentFileDecision",TARGET_RESOURCE_KEY3="targetResource";async function submitFileDecision(deps,input,identity2){let reqCtx=new RequestContext(AgentExecutionCommandController.method.submitFileDecision.input,input,identity2,ApiResourceKind.agent_execution);return await newPipeline("agent-execution-submit-file-decision",deps.logger).addStep(newAuthorizeStep(AgentExecutionCommandController.method.submitFileDecision,deps.authorizer)).addStep(newValidateProtoStep()).addStep({name:"LoadExisting",async execute(ctx){let executionId=ctx.input.agentExecutionId;if(executionId==="")throw invalidArgumentError("agent_execution_id is required");let execution;try{execution=await deps.store.getResource(ApiResourceKind.agent_execution,executionId,AgentExecutionSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("agent_execution",executionId):internalError(error2,"failed to load agent execution")}ctx.set(TARGET_RESOURCE_KEY3,execution)}}).addStep({name:"ValidateDecision",execute(ctx){let execution=ctx.get(TARGET_RESOURCE_KEY3);validateFileDecisionTarget(execution,ctx.input),streamHasFileDecision(execution.status?.fileReviewEventStream,ctx.input)&&(deps.logger.info("IDEMPOTENT: file decision already recorded",{executionId:execution.metadata?.id??"",changeSetId:ctx.input.changeSetId,fileChangeId:ctx.input.fileChangeId}),ctx.set(FILE_DECISION_IDEMPOTENT_KEY,!0))}}).addStep({name:"RecordFileDecision",async execute(ctx){if(ctx.get(FILE_DECISION_IDEMPOTENT_KEY)===!0)return;let executionId=ctx.input.agentExecutionId,now=new Date().toISOString().replace(/\.\d{3}Z$/,"Z"),reviewerId="",updated;try{updated=await deps.store.updateResource(ApiResourceKind.agent_execution,executionId,AgentExecutionSchema,execution=>{validateFileDecisionTarget(execution,ctx.input),execution.status===void 0&&(execution.status=create2(AgentExecutionStatusSchema));let decision=buildFileDecision(ctx.input.changeSetId,ctx.input.fileChangeId,ctx.input.scope,ctx.input.action,ctx.input.expectedDigest,reviewerId,now,ctx.input.reason,ctx.input.acknowledgeUnreviewable);recordFileDecisionEvent(execution.status,executionId,decision),execution.status.fileChangeSets=projectFileChangeSets(execution.status.phase,execution.status.fileReviewEventStream)})}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("agent_execution",executionId):error2 instanceof ConnectError?error2:internalError(error2,"failed to persist file decision")}deps.broker.broadcast(updated),ctx.set(TARGET_RESOURCE_KEY3,updated)}}).addStep({name:"SignalWorkflow",async execute(ctx){if(ctx.get(FILE_DECISION_IDEMPOTENT_KEY)===!0){deps.logger.debug("Skipping workflow signal for idempotent file decision");return}let engine=deps.engineState();if(!engine.connected){deps.logger.warn("Workflow creator not available - skipping Temporal signal");return}let execution=ctx.get(TARGET_RESOURCE_KEY3),executionId=execution.metadata?.id??"",status=execution.status;if(status===void 0||!gateResolved(status)){deps.logger.info("File decision recorded, HITL gate not yet resolved \u2014 waiting",{executionId,changeSetId:ctx.input.changeSetId,pendingApprovalsRemaining:status?.pendingApprovals.length??0,changeSetsAwaitingReview:countAwaitingReview(status?.fileChangeSets??[])});return}deps.logger.info("HITL gate resolved by file decision \u2014 sending approvalGateResolved signal",{executionId,changeSetId:ctx.input.changeSetId});try{await engine.engine.signalApprovalGateResolved(executionId)}catch(error2){throw error2 instanceof EngineWorkflowNotFoundError?(deps.logger.warn("Workflow not found - reconciling stale execution status to FAILED",{executionId}),await reconcileStaleFileReviewExecution(deps,execution),failedPreconditionError(`workflow not running for execution ${executionId} - the backing workflow has terminated unexpectedly and the execution has been marked as failed`)):unavailableError(`failed to signal workflow: ${error2 instanceof Error?error2.message:String(error2)}`)}deps.logger.info("Successfully sent approvalGateResolved signal to workflow",{executionId})}}).addStep({name:"BuildResponse",execute(ctx){let execution=ctx.get(TARGET_RESOURCE_KEY3);deps.logger.info("AUDIT: File decision submitted",{executionId:execution.metadata?.id??"",org:execution.metadata?.org??"",changeSetId:ctx.input.changeSetId,fileChangeId:ctx.input.fileChangeId,scope:enumToJson(FileDecisionScopeSchema,ctx.input.scope),action:enumToJson(FileDecisionActionSchema,ctx.input.action)})}}).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY3)}function validateFileDecisionTarget(execution,input){let executionId=execution.metadata?.id??"",phase=execution.status?.phase??ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED,changeSets=projectFileChangeSets(phase,execution.status?.fileReviewEventStream);if(changeSets.length===0)throw failedPreconditionError(`execution ${executionId} has no actionable file change sets (phase ${enumToJson(ExecutionPhaseSchema,phase)})`);let cs=findChangeSet(changeSets,input.changeSetId);if(cs===void 0)throw failedPreconditionError(`change set ${input.changeSetId} not found for execution ${executionId}`);if(input.scope===FileDecisionScope.FILE){if(input.fileChangeId==="")throw invalidArgumentError("file_change_id is required for FILE scope");if(findChange(cs,input.fileChangeId)===void 0)throw failedPreconditionError(`file change ${input.fileChangeId} not found in change set ${input.changeSetId}`)}if(input.action===FileDecisionAction.APPROVE){let reason=approveBlockedReason(cs,input.scope,input.fileChangeId,input.acknowledgeUnreviewable);if(reason!=="")throw failedPreconditionError(reason)}let target=targetDigest(cs,input.scope,input.fileChangeId);if(input.expectedDigest!==target)throw invalidArgumentError(`expected_digest mismatch for change set ${input.changeSetId}: the captured content changed since it was reviewed`)}function streamHasFileDecision(stream,input){let scopeId=input.changeSetId;input.scope===FileDecisionScope.FILE&&(scopeId=input.fileChangeId);let id=eventId2(input.changeSetId,scopeId,FileReviewEventType.FILE_DECIDED);return(stream?.events??[]).some(ev=>ev.eventId===id)}async function reconcileStaleFileReviewExecution(deps,execution){let executionId=execution.metadata?.id??"",reconciled=create2(AgentExecutionSchema,{apiVersion:execution.apiVersion,kind:execution.kind,metadata:execution.metadata,spec:execution.spec,status:{phase:ExecutionPhase.EXECUTION_FAILED,error:"Workflow backing this execution is no longer running. Execution has been marked as failed.",messages:execution.status?.messages??[],audit:execution.status?.audit,approvalEventStream:execution.status?.approvalEventStream,fileReviewEventStream:execution.status?.fileReviewEventStream}});reconciled.status?.messages.push(create2(AgentMessageSchema,{type:MessageType.MESSAGE_SYSTEM,content:"The workflow backing this execution is no longer running. This can happen due to infrastructure issues or manual termination. The execution has been marked as failed."})),settleInterruptedToolCalls(reconciled.status,new Date().toISOString().replace(/\.\d{3}Z$/,"Z"));try{await deps.store.saveResource(ApiResourceKind.agent_execution,executionId,AgentExecutionSchema,reconciled)}catch(error2){deps.logger.error("Failed to reconcile stale execution status - execution will remain in WAITING_FOR_APPROVAL until next attempt",{executionId,error:error2 instanceof Error?error2.message:String(error2)});return}deps.logger.info("RECONCILIATION: Updated stale file-review execution status to FAILED",{executionId}),await notifyStatusObservers(deps,reconciled,execution.status?.phase??ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED,ExecutionPhase.EXECUTION_FAILED)}function isTerminalExecutionPhase(phase){switch(phase){case ExecutionPhase.EXECUTION_COMPLETED:case ExecutionPhase.EXECUTION_FAILED:case ExecutionPhase.EXECUTION_CANCELLED:case ExecutionPhase.EXECUTION_TERMINATED:return!0;default:return!1}}function isTranscriptTerminalPhase(phase){return phase===ExecutionPhase.EXECUTION_COMPLETED||phase===ExecutionPhase.EXECUTION_FAILED||phase===ExecutionPhase.EXECUTION_CANCELLED}async function*subscribeExecution(deps,executionId,context2){if(executionId.value==="")throw invalidArgumentError("execution id is required");await authorizeDirect(AgentExecutionQueryController.method.subscribe,deps.authorizer,callerIdentityOf(context2),executionId);let id=executionId.value;deps.logger.info("Starting execution subscription",{executionId:id});let subscription=deps.broker.subscribe(id);try{let snapshot;try{snapshot=await deps.store.getResource(ApiResourceKind.agent_execution,id,AgentExecutionSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("AgentExecution",id):internalError(error2,"failed to load agent execution")}yield snapshot,deps.logger.debug("Sent initial execution state, streaming live updates",{executionId:id});let lastSent=snapshot,abort=new Promise(resolve=>{context2.signal.addEventListener("abort",()=>resolve(),{once:!0})});for(;!context2.signal.aborted;){if(subscription.closed){deps.logger.warn("Updates channel closed unexpectedly",{executionId:id});return}if(subscription.queue.length===0){await Promise.race([abort,new Promise(resolve=>subscription.notify=resolve)]),subscription.notify=void 0;continue}let updated=subscription.queue.shift();if(updated===void 0||equals(AgentExecutionSchema,updated,lastSent))continue;yield updated,lastSent=updated;let phase=updated.status?.phase??ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED;if(isTranscriptTerminalPhase(phase)){deps.logger.info("Execution reached terminal state, ending subscription",{executionId:id,phase:ExecutionPhase[phase]});return}}deps.logger.info("Subscription cancelled by client",{executionId:id})}finally{deps.broker.unsubscribe(id,subscription)}}function preserveApprovalFields(incomingMessages,incomingSubAgents,existingMessages,existingSubAgents){let index2=buildApprovalIndex(existingMessages,existingSubAgents);if(index2.size!==0){applyApprovalFields(incomingMessages,index2);for(let sa of incomingSubAgents)applyApprovalFields(sa.messages,index2)}}function buildApprovalIndex(messages,subAgentExecutions){let index2=new Map;collectFromMessages(messages,index2);for(let sa of subAgentExecutions)collectFromMessages(sa.messages,index2);return index2}function collectFromMessages(messages,index2){for(let msg of messages)for(let tc of msg.toolCalls)tc.approvalAction!==ApprovalAction.UNSPECIFIED&&index2.set(tc.id,{action:tc.approvalAction,decidedAt:tc.approvalDecidedAt,approvedBy:tc.approvedBy})}function applyApprovalFields(messages,index2){for(let msg of messages)for(let tc of msg.toolCalls){let snap=index2.get(tc.id);snap!==void 0&&tc.approvalAction===ApprovalAction.UNSPECIFIED&&(tc.approvalAction=snap.action,tc.approvalDecidedAt=snap.decidedAt,tc.approvedBy=snap.approvedBy)}}var AUTO_KEEP_REASON="Kept automatically: every change in this turn was produced by a command the user approved";function autoKeepApprovedCommandSets(status,executionId,autoApproveAll,logger2){let stream=status.fileReviewEventStream;if(stream===void 0||stream.events.length===0)return 0;let changeSets=projectFileChangeSets(status.phase,stream);if(changeSets.length===0)return 0;let kept=0;for(let ev of stream.events){if(ev.eventType!==FileReviewEventType.CANDIDATE_CAPTURED)continue;let provenance=ev.payload.case==="candidateCaptured"?ev.payload.value.commandProvenance:void 0;if(provenance===void 0)continue;let cs=findChangeSet(changeSets,ev.changeSetId);if(cs===void 0||cs.status!==FileChangeSetStatus.AWAITING_REVIEW||cs.decisions.length>0)continue;let blockedReason2=approveBlockedReason(cs,FileDecisionScope.CHANGE_SET,"",!1);if(blockedReason2!==""){logger2.info("Auto-keep skipped: set not fully reviewable \u2014 manual review",{executionId,changeSetId:cs.id,blockedReason:blockedReason2});continue}if(!verifyCommandConsent(status,provenance,autoApproveAll)){logger2.warn("Auto-keep skipped: claimed consent did not verify against server-authored approvals \u2014 manual review",{executionId,changeSetId:cs.id,consentToolCallIds:provenance.consentToolCallIds});continue}let decision=buildPolicyAutoKeepDecision(cs);recordFileDecisionEventWithActor(status,executionId,decision,ACTOR_POLICY),kept++,logger2.info("Auto-kept change set: every change produced by an approved command (DD-28)",{executionId,changeSetId:cs.id,consentToolCallIds:provenance.consentToolCallIds,authorizedByAutoApproveAll:provenance.authorizedByAutoApproveAll})}return kept}function buildPolicyAutoKeepDecision(cs){let decision=create2(FileDecisionSchema,{changeSetId:cs.id,scope:FileDecisionScope.CHANGE_SET,action:FileDecisionAction.APPROVE,expectedDigest:cs.aggregateDigest,decidedAt:new Date().toISOString().replace(/\.\d{3}Z$/,"Z"),reason:AUTO_KEEP_REASON,origin:FileDecisionOrigin.POLICY_APPROVED_COMMAND});return decision.id=`${cs.id}:${decisionScopeId(decision)}`,decision}function verifyCommandConsent(status,provenance,autoApproveAll){if(provenance.authorizedByAutoApproveAll&&!autoApproveAll)return!1;let ids=provenance.consentToolCallIds;if(ids.length===0&&!provenance.authorizedByAutoApproveAll)return!1;for(let id of ids){let tc=findToolCall(status,id);if(tc===void 0)return!1;switch(tc.approvalAction){case ApprovalAction.APPROVE:case ApprovalAction.APPROVE_ALL:break;default:return!1}}return!0}function findToolCall(status,id){for(let msg of status.messages)for(let tc of msg.toolCalls)if(tc.id===id)return tc;for(let sa of status.subAgentExecutions)for(let msg of sa.messages)for(let tc of msg.toolCalls)if(tc.id===id)return tc}function reconcileFileChangeProgress(sets,progress){if(progress!==void 0&&hasCapturingSet(sets,progress.changeSetId))return progress}function hasCapturingSet(sets,changeSetId){return changeSetId===""?!1:sets.some(cs=>cs.id===changeSetId&&cs.status===FileChangeSetStatus.CAPTURING)}var PAUSE_STOP_ROW="Execution paused by user. Use resume to continue.",CANCEL_STOP_ROW="Execution was cancelled.";function stopRowForPhase(phase){switch(phase){case ExecutionPhase.EXECUTION_PAUSED:return PAUSE_STOP_ROW;case ExecutionPhase.EXECUTION_CANCELLED:return CANCEL_STOP_ROW;default:return}}function sameRow(a5,b7){return a5.type===b7.type&&a5.content===b7.content}function endsWithRows(transcript,tail){if(tail.length>transcript.length)return!1;let offset=transcript.length-tail.length;return tail.every((row,i6)=>sameRow(transcript[offset+i6],row))}function isPlatformMarkerWrite(existing,incoming){return existing.length===0||incoming.length===0||!incoming.every(row=>row.type===MessageType.MESSAGE_SYSTEM)?!1:!(incoming.length>=existing.length&&existing.every((row,i6)=>sameRow(row,incoming[i6])))}function appendPlatformMarker(existing,marker){return endsWithRows(existing,marker)?[...existing]:[...existing,...marker]}function heldStopRow(phase,transcript){let copy=stopRowForPhase(phase),last=transcript[transcript.length-1];if(!(copy===void 0||last===void 0||last.type!==MessageType.MESSAGE_SYSTEM||last.content!==copy))return last}var EXECUTION_KEY="execution",OLD_PHASE_KEY="o4OldPhase";async function updateStatus(deps,input,identity2){let reqCtx=new RequestContext(AgentExecutionCommandController.method.updateStatus.input,input,identity2,ApiResourceKind.agent_execution);return await newPipeline("agentexecution-update-status",deps.logger).addStep(newAuthorizeStep(AgentExecutionCommandController.method.updateStatus,deps.authorizer)).addStep({name:"ValidateUpdateStatusInput",execute(ctx){if(ctx.input.executionId==="")throw invalidArgumentError("execution_id is required");if(ctx.input.status===void 0)throw invalidArgumentError("status is required")}}).addStep({name:"MergeAndPersistExecution",async execute(ctx){let updated,oldPhase=ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED;try{updated=await deps.store.updateResource(ApiResourceKind.agent_execution,ctx.input.executionId,AgentExecutionSchema,execution=>{oldPhase=execution.status?.phase??ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED,applyUpdateStatusMerge(execution,ctx.input,deps.logger)})}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("AgentExecution",ctx.input.executionId):internalError(error2,"failed to update execution status")}ctx.set(EXECUTION_KEY,updated),ctx.set(OLD_PHASE_KEY,oldPhase)}}).addStep({name:"NotifyStatusObservers",async execute(ctx){let execution=ctx.get(EXECUTION_KEY);execution!==void 0&&await notifyStatusObservers(deps,execution,ctx.get(OLD_PHASE_KEY),execution.status?.phase??ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED)}}).addStep({name:"BroadcastToStreams",execute(ctx){let execution=ctx.get(EXECUTION_KEY);if(execution===void 0)throw internalError(new Error("execution not found in context"),"execution not found in context");deps.broker.broadcast(execution)}}).build().execute(reqCtx),applyResponseDecorators(deps.responseDecorators,deps.logger,reqCtx.get(EXECUTION_KEY),create2(UpdateStatusResponseSchema,{signal:ExecutionControlSignal.UNSPECIFIED}))}function nonTerminalTranscriptRegression(phase,existing,incoming){if(isTranscriptTerminalPhase(phase))return{reject:!1,reason:""};if(incoming.length<existing.length)return{reject:!0,reason:"would shrink the message transcript"};let incomingToolCallIds=new Set;for(let m3 of incoming)for(let tc of m3.toolCalls)tc.id!==""&&incomingToolCallIds.add(tc.id);for(let m3 of existing)for(let tc of m3.toolCalls)if(tc.id!==""&&!incomingToolCallIds.has(tc.id))return{reject:!0,reason:"would drop a previously-committed tool call"};return{reject:!1,reason:""}}function mergeTranscript(existingPhase,existing,incoming,executionId,logger2){let held=heldStopRow(existingPhase,existing),base=held===void 0?existing:existing.slice(0,-1),next;if(isPlatformMarkerWrite(base,incoming))next=appendPlatformMarker(base,incoming);else{let{reject:reject2,reason}=nonTerminalTranscriptRegression(existingPhase,base,incoming);if(reject2){logger2.warn("Rejected status update that would drop committed transcript history for a non-terminal execution; keeping existing messages",{executionId,existingMessages:existing.length,incomingMessages:incoming.length,reason});return}next=incoming}return held!==void 0&&!endsWithRows(next,[held])&&(next=[...next,held]),next}function applyUpdateStatusMerge(execution,input,logger2){execution.status===void 0&&(execution.status=create2(AgentExecutionStatusSchema));let status=execution.status,requestStatus=input.status;if(requestStatus===void 0)return;let existingMessages=status.messages,existingSubAgents=status.subAgentExecutions,existingPhase=status.phase;if(requestStatus.messages.length>0){let merged=mergeTranscript(existingPhase,existingMessages,requestStatus.messages,input.executionId,logger2);merged!==void 0&&(status.messages=merged)}if(requestStatus.subAgentExecutions.length>0&&(status.subAgentExecutions=requestStatus.subAgentExecutions),Object.keys(requestStatus.todos).length>0&&(status.todos=requestStatus.todos),requestStatus.artifacts.length>0&&(status.artifacts=requestStatus.artifacts),requestStatus.workspaceWriteBacks.length>0&&(status.workspaceWriteBacks=requestStatus.workspaceWriteBacks),preserveApprovalFields(status.messages,status.subAgentExecutions,existingMessages,existingSubAgents),requestStatus.phase!==ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED&&(isTerminalExecutionPhase(existingPhase)&&requestStatus.phase!==existingPhase?logger2.warn("Ignored phase change on a terminal execution; terminal phases are final (Recover is the sanctioned un-terminalizer)",{executionId:input.executionId,storedPhase:ExecutionPhase[existingPhase],ignoredPhase:ExecutionPhase[requestStatus.phase]}):status.phase=requestStatus.phase),requestStatus.error!==""&&(status.error=requestStatus.error),requestStatus.startedAt!==""&&(status.startedAt=requestStatus.startedAt),requestStatus.completedAt!==""&&(status.completedAt=requestStatus.completedAt),(status.phase===ExecutionPhase.EXECUTION_IN_PROGRESS||status.phase===ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL||status.phase===ExecutionPhase.EXECUTION_PENDING)&&(status.completedAt=""),isTerminalExecutionPhase(status.phase)){let settledAt=status.completedAt;settledAt===""&&(settledAt=new Date().toISOString().replace(/\.\d{3}Z$/,"Z"));let settled=settleInterruptedToolCalls(status,settledAt);settled>0&&logger2.info("Settled in-flight tool calls to TOOL_CALL_INTERRUPTED on terminal execution",{executionId:input.executionId,phase:ExecutionPhase[status.phase],settledToolCalls:settled})}ensureApprovalRequests(status,input.executionId),status.pendingApprovals=projectPendingApprovals(status.phase,status.messages,status.subAgentExecutions,status.approvalEventStream,logger2),appendRunnerEvents(status,input.executionId,requestStatus),autoKeepApprovedCommandSets(status,input.executionId,execution.spec?.autoApproveAll??!1,logger2),status.fileChangeSets=projectFileChangeSets(status.phase,status.fileReviewEventStream),requestStatus.fileChangeProgress!==void 0&&(status.fileChangeProgress=requestStatus.fileChangeProgress),status.fileChangeProgress=reconcileFileChangeProgress(status.fileChangeSets,status.fileChangeProgress),requestStatus.streamingUsage!==void 0&&(status.streamingUsage=requestStatus.streamingUsage),requestStatus.recalledMemoriesReport!==void 0&&(status.recalledMemoriesReport=requestStatus.recalledMemoriesReport),requestStatus.contextInfo!==void 0&&(status.contextInfo=requestStatus.contextInfo),requestStatus.setupProgress!==void 0&&(status.setupProgress=requestStatus.setupProgress),status.phase!==ExecutionPhase.EXECUTION_PENDING&&(status.setupProgress=void 0),requestStatus.structuredOutput!==void 0&&(status.structuredOutput=requestStatus.structuredOutput),logger2.debug("Merged status fields",{executionId:input.executionId,phase:ExecutionPhase[status.phase],messagesCount:status.messages.length,pendingApprovalsCount:status.pendingApprovals.length})}var DocumentModelCatalog=class _DocumentModelCatalog{registryDocument;indexes;constructor(registryDocument,indexes){this.registryDocument=registryDocument,this.indexes=indexes}static tryBuild(document2){let indexes=buildIndexes(document2);if(indexes!==void 0)return new _DocumentModelCatalog(document2,indexes)}document(){return this.registryDocument}isValidModel(harness,model){return this.indexes.modelsByHarness.get(harness)?.has(model)??!1}hasHarness(harness){return(this.indexes.modelsByHarness.get(harness)?.size??0)>0}hasAnyModels(){return this.indexes.modelsByHarness.size>0}isValidModelOnAnyHarness(model){for(let models of this.indexes.modelsByHarness.values())if(models.has(model))return!0;return!1}canonicalModelsAcrossHarnesses(){let seen=new Set;for(let models of this.indexes.sortedModelsByHarness.values())for(let name of models)seen.add(name);return[...seen].sort()}canonicalModels(harness){return this.indexes.sortedModelsByHarness.get(harness)??[]}hasPricingVariant(model,variant){let byHarness=this.indexes.modelsByVariant.get(variant);if(byHarness===void 0)return!1;for(let refs of byHarness.values())if(refs.has(model))return!0;return!1}hasPricingVariantForHarness(harness,model,variant){return this.indexes.modelsByVariant.get(variant)?.get(harness)?.has(model)??!1}canonicalModelsWithVariant(variant){return this.indexes.sortedModelsByVariant.get(variant)??[]}canonicalModelsWithVariantForHarness(harness,variant){return this.indexes.sortedModelsByVariantHarness.get(variant)?.get(harness)??[]}hasCapabilityForHarness(harness,model,capability){return this.indexes.modelsByCapability.get(capability)?.get(harness)?.has(model)??!1}canonicalModelsWithCapabilityForHarness(harness,capability){return this.indexes.sortedModelsByCapabilityHarness.get(capability)?.get(harness)??[]}};function buildIndexes(document2){let parsed;try{parsed=JSON.parse(document2)}catch{return}if(!Array.isArray(parsed.models))return;let modelsByHarness=new Map,sortedModelsByHarness=new Map,modelsByVariant=new Map,canonicalByVariantSet=new Map,sortedModelsByVariantHarness=new Map,modelsByCapability=new Map,sortedModelsByCapabilityHarness=new Map;for(let raw of parsed.models){if(raw===null||typeof raw!="object")continue;let id=typeof raw.id=="string"?raw.id:"",harness=typeof raw.harness=="string"?raw.harness:"";if(id===""||harness==="")continue;let apiModelId=typeof raw.apiModelId=="string"?raw.apiModelId:"";if(mapSet(modelsByHarness,harness).add(id),mapList(sortedModelsByHarness,harness).push(id),apiModelId!==""&&mapSet(modelsByHarness,harness).add(apiModelId),raw.pricingVariants!==null&&typeof raw.pricingVariants=="object")for(let variant of Object.keys(raw.pricingVariants)){let byHarness=mapMap(modelsByVariant,variant);mapSet(byHarness,harness).add(id),apiModelId!==""&&mapSet(byHarness,harness).add(apiModelId),mapSet(canonicalByVariantSet,variant).add(id),mapList(mapMapList(sortedModelsByVariantHarness,variant),harness).push(id)}if(raw.capabilities!==null&&typeof raw.capabilities=="object")for(let[capability,value]of Object.entries(raw.capabilities)){if(value!==!0)continue;let byHarness=mapMap(modelsByCapability,capability);mapSet(byHarness,harness).add(id),apiModelId!==""&&mapSet(byHarness,harness).add(apiModelId),mapList(mapMapList(sortedModelsByCapabilityHarness,capability),harness).push(id)}}if(modelsByHarness.size===0)return;for(let ids of sortedModelsByHarness.values())ids.sort();let sortedModelsByVariant=new Map;for(let[variant,idSet]of canonicalByVariantSet)sortedModelsByVariant.set(variant,[...idSet].sort());for(let byHarness of sortedModelsByVariantHarness.values())for(let ids of byHarness.values())ids.sort();for(let byHarness of sortedModelsByCapabilityHarness.values())for(let ids of byHarness.values())ids.sort();return{modelsByHarness,sortedModelsByHarness,modelsByVariant,sortedModelsByVariant,sortedModelsByVariantHarness,modelsByCapability,sortedModelsByCapabilityHarness}}function mapSet(m3,key){let v=m3.get(key);return v===void 0&&(v=new Set,m3.set(key,v)),v}function mapList(m3,key){let v=m3.get(key);return v===void 0&&(v=[],m3.set(key,v)),v}function mapMap(m3,key){let v=m3.get(key);return v===void 0&&(v=new Map,m3.set(key,v)),v}function mapMapList(m3,key){let v=m3.get(key);return v===void 0&&(v=new Map,m3.set(key,v)),v}var MODEL_REGISTRY_REFRESH_INTERVAL_MS=3600*1e3,MODEL_REGISTRY_FETCH_TIMEOUT_MS=3e4,MODEL_REGISTRY_MAX_BYTES=8*1024*1024,MODEL_REGISTRY_UPSTREAM_PATH="/api/v1/public/model-registry",FAST_VARIANT_KEY="fast",THINKING_CAPABILITY_KEY="thinking",ModelRegistryStore=class{currentCatalog;refreshTimer;failureLogged=!1;options;constructor(options){let catalog=DocumentModelCatalog.tryBuild(options.bundledDocument);if(catalog===void 0)throw new Error("bundled model-registry snapshot is invalid or indexes no models");this.currentCatalog=catalog,this.options=options}document(){return this.currentCatalog.document()}isValidModel(harness,model){return this.currentCatalog.isValidModel(harness,model)}hasHarness(harness){return this.currentCatalog.hasHarness(harness)}hasAnyModels(){return this.currentCatalog.hasAnyModels()}isValidModelOnAnyHarness(model){return this.currentCatalog.isValidModelOnAnyHarness(model)}canonicalModelsAcrossHarnesses(){return this.currentCatalog.canonicalModelsAcrossHarnesses()}canonicalModels(harness){return this.currentCatalog.canonicalModels(harness)}hasPricingVariant(model,variant){return this.currentCatalog.hasPricingVariant(model,variant)}hasPricingVariantForHarness(harness,model,variant){return this.currentCatalog.hasPricingVariantForHarness(harness,model,variant)}canonicalModelsWithVariant(variant){return this.currentCatalog.canonicalModelsWithVariant(variant)}canonicalModelsWithVariantForHarness(harness,variant){return this.currentCatalog.canonicalModelsWithVariantForHarness(harness,variant)}hasCapabilityForHarness(harness,model,capability){return this.currentCatalog.hasCapabilityForHarness(harness,model,capability)}canonicalModelsWithCapabilityForHarness(harness,capability){return this.currentCatalog.canonicalModelsWithCapabilityForHarness(harness,capability)}startRefresh(){!this.options.refreshEnabled||this.refreshTimer!==void 0||(this.refreshOnce(),this.refreshTimer=setInterval(()=>{this.refreshOnce()},MODEL_REGISTRY_REFRESH_INTERVAL_MS),this.refreshTimer.unref())}stopRefresh(){this.refreshTimer!==void 0&&(clearInterval(this.refreshTimer),this.refreshTimer=void 0)}async refreshOnce(){let url=this.options.upstreamOrigin+MODEL_REGISTRY_UPSTREAM_PATH,fetchImpl=this.options.fetchImpl??fetch;try{let response=await fetchImpl(url,{signal:AbortSignal.timeout(MODEL_REGISTRY_FETCH_TIMEOUT_MS)});if(!response.ok)throw new Error(`upstream answered ${response.status}`);let body=await response.text();if(Buffer.byteLength(body)>MODEL_REGISTRY_MAX_BYTES)throw new Error("upstream document exceeds the size cap");let catalog=DocumentModelCatalog.tryBuild(body);if(catalog===void 0)throw new Error("upstream document failed the sanity gate (no indexable models)");this.currentCatalog=catalog,this.failureLogged=!1}catch(error2){let fields2={url,error:error2 instanceof Error?error2.message:String(error2)};this.failureLogged?this.options.logger.debug("model-registry refresh failed; serving current document",fields2):(this.options.logger.warn("model-registry refresh failed; serving current document",fields2),this.failureLogged=!0)}}};function newValidateServiceTierStep(registry){return{name:"ValidateServiceTier",execute(ctx){let config2=ctx.newState.spec?.executionConfig;if(config2?.serviceTier!==ServiceTier.FAST)return;let modelName=(config2.modelName??"").trim();if(modelName==="")throw invalidArgumentError(`service_tier 'fast' requires execution_config.model_name: the fast tier is a per-model price, and Auto (no pinned model) has no tier dimension. Pin a model that supports it${fastCapableSuffix(registry)}.`);if(!registry.hasPricingVariant(modelName,FAST_VARIANT_KEY))throw invalidArgumentError(`service_tier 'fast' is not available for model '${modelName}': the model registry prices no fast variant for it${fastCapableSuffix(registry)}.`)}}}function fastCapableSuffix(registry){let capable=registry.canonicalModelsWithVariant(FAST_VARIANT_KEY);return capable.length===0?"":`; models with a fast tier: ${capable.join(", ")}`}var HARNESS_NAME_CURSOR="cursor",HARNESS_NAME_NATIVE="native",MAX_MODEL_SUGGESTIONS=3,MAX_MODEL_EDIT_DISTANCE=5;function harnessName(h5){return h5===Harness.CURSOR?HARNESS_NAME_CURSOR:HARNESS_NAME_NATIVE}function unknownModelPinRefusal(store,fieldPath,harness,model){if(model=model.trim(),model===""||!store.hasAnyModels())return"";let candidates;if(harness===""){if(store.isValidModelOnAnyHarness(model))return"";candidates=store.canonicalModelsAcrossHarnesses()}else{if(!store.hasHarness(harness)||store.isValidModel(harness,model))return"";candidates=store.canonicalModels(harness)}let scope=harness===""?"any harness":`${harness} harness`,msg=`${fieldPath}: model '${model}' is not in the model registry (${scope})`,suggestions=suggestSimilarModels(model,candidates);if(suggestions.length>0){let quoted=suggestions.map(s2=>`'${s2}'`);msg+=`; did you mean ${quoted.join(", ")}?`}return msg}function suggestSimilarModels(target,candidates){let targetLower=target.toLowerCase(),matches2=[];for(let name of candidates){let d5=suggestionEditDistance(targetLower,name.toLowerCase());d5<=MAX_MODEL_EDIT_DISTANCE&&matches2.push({name,dist:d5})}return matches2.sort((a5,b7)=>a5.dist!==b7.dist?a5.dist-b7.dist:a5.name<b7.name?-1:a5.name>b7.name?1:0),matches2.slice(0,MAX_MODEL_SUGGESTIONS).map(m3=>m3.name)}function suggestionEditDistance(a5,b7){if(a5===b7)return 0;if(a5.length===0)return b7.length;if(b7.length===0)return a5.length;let prev=new Array(b7.length+1),curr=new Array(b7.length+1);for(let j5=0;j5<=b7.length;j5++)prev[j5]=j5;for(let i6=1;i6<=a5.length;i6++){curr[0]=i6;for(let j5=1;j5<=b7.length;j5++){let cost=a5.charCodeAt(i6-1)===b7.charCodeAt(j5-1)?0:1;curr[j5]=Math.min(prev[j5]+1,curr[j5-1]+1,prev[j5-1]+cost)}[prev,curr]=[curr,prev]}return prev[b7.length]}function newValidateThinkingModeStep(registry){return{name:"ValidateThinkingMode",execute(ctx){let config2=ctx.newState.spec?.executionConfig;if(config2?.thinkingMode!==ThinkingMode.ENABLED)return;let modelName=(config2.modelName??"").trim();if(modelName==="")throw invalidArgumentError(`thinking_mode 'enabled' requires execution_config.model_name: thinking is a per-model capability, and Auto (no pinned model) has no variant dimensions. Pin a model that supports it${thinkingCapableSuffix(registry)}.`);if(!registry.hasCapabilityForHarness(HARNESS_NAME_CURSOR,modelName,THINKING_CAPABILITY_KEY))throw invalidArgumentError(`thinking_mode 'enabled' is not available for model '${modelName}': the model registry declares no thinking capability for it on the cursor harness${thinkingCapableSuffix(registry)}.`)}}}function thinkingCapableSuffix(registry){let capable=registry.canonicalModelsWithCapabilityForHarness(HARNESS_NAME_CURSOR,THINKING_CAPABILITY_KEY);return capable.length===0?"":`; models with a thinking mode: ${capable.join(", ")}`}var import_node_crypto8=require("node:crypto");var LIST_PAGE_MAX_SIZE=100;function examineBudgetOf(size){return Math.min(500,Math.max(100,size*5))}async function readListPage(params){let{request}=params;if(request.pageSize<0)throw invalidArgumentError("page_size must not be negative");let after=request.pageToken===""?void 0:decodeListPageToken(request.pageToken,params.fingerprint).cursor;if(request.pageSize===0){let rows=await queryOrFail(params,after,void 0);return{entries:await admit(params,rows).then(a5=>a5.map(e6=>e6.row)),nextPageToken:""}}let size=Math.min(request.pageSize,LIST_PAGE_MAX_SIZE),budget=examineBudgetOf(size),kept=[],examined=0;for(;;){let batchSize=Math.min(size,budget-examined),read3=await queryOrFail(params,after,batchSize+1),more=read3.length>batchSize,rows=more?read3.slice(0,batchSize):read3;examined+=rows.length,kept.push(...await admit(params,rows));let last=rows[rows.length-1];if(last!==void 0&&(after=last.cursor),kept.length>=size){let page=kept.slice(0,size),exhausted=!more&&kept.length===size;return{entries:page.map(e6=>e6.row),nextPageToken:exhausted?"":encodeListPageToken(page[page.length-1].cursor,params.fingerprint)}}if(!more)return{entries:kept.map(e6=>e6.row),nextPageToken:""};if(examined>=budget)return{entries:kept.map(e6=>e6.row),nextPageToken:encodeListPageToken(after,params.fingerprint)}}}async function queryOrFail(params,after,limit){try{return await params.store.queryResources(params.declaration,{...params.query,...after===void 0?{}:{after},...limit===void 0?{}:{limit}})}catch(error2){throw internalError(error2,params.failure)}}async function admit(params,rows){let decoded=[];for(let row of rows){let value=params.decode(row.data);value!==void 0&&(params.keep===void 0||params.keep(value))&&decoded.push({row:value,cursor:row.cursor})}if(decoded.length===0)return[];let allowed=new Set(await params.scope(decoded.map(d5=>d5.row)));return decoded.filter(d5=>allowed.has(d5.row))}var TOKEN_VERSION=1;function fingerprintHash(fingerprint){return(0,import_node_crypto8.createHash)("sha256").update(fingerprint).digest("base64url").slice(0,16)}function encodeListPageToken(cursor,fingerprint,position){let body={v:TOKEN_VERSION,c:cursor.createdAt,i:cursor.id,f:fingerprintHash(fingerprint),...position===void 0?{}:{p:position}};return Buffer.from(JSON.stringify(body)).toString("base64url")}function decodeListPageToken(token,fingerprint){let body;try{let bytes=Buffer.from(token,"base64url");if(bytes.toString("base64url")!==token)throw new Error("not canonical base64url");body=JSON.parse(bytes.toString("utf8"))}catch{throw invalidArgumentError("invalid page_token")}if(typeof body!="object"||body===null||body.v!==TOKEN_VERSION||typeof body.c!="string"||typeof body.i!="string"||typeof body.f!="string")throw invalidArgumentError("invalid page_token");let parsed=body;if(parsed.f!==fingerprintHash(fingerprint))throw invalidArgumentError("page_token was issued for a different request");if(parsed.p!==void 0&&!(Number.isSafeInteger(parsed.p)&&parsed.p>=0))throw invalidArgumentError("invalid page_token");return{cursor:{createdAt:parsed.c,id:parsed.i},...parsed.p===void 0?{}:{position:parsed.p}}}function listPageFingerprint(fields2){return JSON.stringify(fields2,(_key,value)=>typeof value=="bigint"?value.toString():value)}function field2(path14){return{from:"field",path:path14}}function label(key){return{from:"label",label:key}}var resolvedKeys=new WeakMap;function declareListIndex(declaration){if(!Number.isInteger(declaration.revision)||declaration.revision<1)throw new Error(`list index for ${apiResourceKindName(declaration.kind)}: revision must be a positive integer`);let keys=[];for(let[name,source]of Object.entries(declaration.keys))keys.push({name,read:resolveKeyReader(declaration,name,source)});let frozen=Object.freeze({...declaration,keys:Object.freeze({...declaration.keys})});return resolvedKeys.set(frozen,keys),frozen}function resolveKeyReader(declaration,name,source){switch(source.from){case"label":return resource=>resource.metadata?.labels?.[source.label]??"";case"field":{let localNames=resolveFieldPath(declaration,name,source.path);return resource=>{let value=resource;for(let localName of localNames){if(value===null||typeof value!="object")return"";value=value[localName]}return typeof value=="string"?value:""}}default:{let exhaustive=source;throw new Error(`unknown list key source: ${String(exhaustive)}`)}}}function resolveFieldPath(declaration,name,path14){let where=`list index for ${apiResourceKindName(declaration.kind)}, key '${name}'`,segments=path14.split("."),localNames=[],message6=declaration.schema;return segments.forEach((segment,index2)=>{let found=message6?.fields.find(f5=>f5.name===segment);if(found===void 0)throw new Error(`${where}: '${path14}' has no field '${segment}'`);if(localNames.push(found.localName),index2===segments.length-1){if(found.fieldKind!=="scalar"||found.scalar!==ScalarType2.STRING)throw new Error(`${where}: '${path14}' is not a string field`);return}if(found.fieldKind!=="message")throw new Error(`${where}: '${segment}' in '${path14}' is not a message`);message6=found.message}),localNames}function listIndexFactsOf(declaration,resource){let shaped=resource,keys=[];for(let resolved of keysOf(declaration)){let value=resolved.read(resource);value!==""&&keys.push({key:resolved.name,value})}return{org:shaped.metadata?.org??"",createdAt:listIndexInstant(shaped.status?.audit?.specAudit?.createdAt),revision:declaration.revision,keys}}function sameListKeyRows(a5,b7){return a5.createdAt===b7.createdAt&&a5.keys.length===b7.keys.length&&a5.keys.every((k5,i6)=>k5.key===b7.keys[i6]?.key&&k5.value===b7.keys[i6]?.value)}function keysOf(declaration){let keys=resolvedKeys.get(declaration);if(keys===void 0)throw new Error(`list index for ${apiResourceKindName(declaration.kind)} was not made by declareListIndex`);return keys}var MIN_INSTANT_SECONDS=-62135596800n,MAX_INSTANT_SECONDS=253402300799n;function listIndexInstant(timestamp2){if(timestamp2===void 0||timestamp2.seconds<MIN_INSTANT_SECONDS||timestamp2.seconds>MAX_INSTANT_SECONDS)return"";let iso=new Date(Number(timestamp2.seconds)*1e3).toISOString(),nanos=String(Math.max(0,Math.min(999999999,timestamp2.nanos))).padStart(9,"0");return`${iso.slice(0,19)}.${nanos}Z`}function listIndexInstantOfMillis(millis){let seconds=Math.floor(millis/1e3),nanos=(millis-seconds*1e3)*1e6;return listIndexInstant({seconds:BigInt(seconds),nanos})}function compareBytes2(a5,b7){return a5<b7?-1:a5>b7?1:0}function compareListIndexOrder(a5,b7){let byCreated=compareBytes2(b7.createdAt,a5.createdAt);return byCreated!==0?byCreated:compareBytes2(b7.id,a5.id)}function matchesListIndexQuery(id,facts,query){if(query.org!==void 0&&query.org!==""&&facts.org!==query.org)return!1;if(query.anyKey!==void 0){let wanted=query.anyKey;if(!facts.keys.some(k5=>wanted.some(w=>w.name===k5.key&&w.value===k5.value)))return!1}return!(query.createdAtOrAfter!==void 0&&facts.createdAt!==""&&compareBytes2(facts.createdAt,query.createdAtOrAfter)<0||query.after!==void 0&&compareListIndexOrder({createdAt:facts.createdAt,id},query.after)<=0)}function mergeListIndexRows(proven,unproven,limit){let byId=new Map;for(let row of[...proven,...unproven])byId.set(row.id,row);let merged=[...byId.values()].sort((a5,b7)=>compareListIndexOrder(a5.cursor,b7.cursor));return limit===void 0?merged:merged.slice(0,limit)}function assertListIndexLimit(limit){if(limit!==void 0&&(!Number.isInteger(limit)||limit<1))throw new Error(`list index limit must be a positive integer, got ${limit}`)}var ListIndexRegistry=class{byKind=new Map;constructor(declarations){for(let declaration of declarations){if(keysOf(declaration),this.byKind.has(declaration.kind))throw new Error(`list index for ${apiResourceKindName(declaration.kind)} is declared twice`);this.byKind.set(declaration.kind,declaration)}}declarationOf(kind){return this.byKind.get(kind)}declarations(){return[...this.byKind.values()]}factsOf(kind,resource){let declaration=this.byKind.get(kind);return declaration===void 0?void 0:listIndexFactsOf(declaration,resource)}require(declaration){if(this.byKind.get(declaration.kind)!==declaration)throw new Error(`list index for ${apiResourceKindName(declaration.kind)} is not registered with this store`)}};var agentExecutionListIndex=declareListIndex({kind:ApiResourceKind.agent_execution,schema:AgentExecutionSchema,revision:1,keys:{session:field2("spec.session_id")}});var EXECUTION_LIST_KEY="execution_list";async function loadAllAgentExecutions(store,logger2){let rows;try{rows=await store.listResources(ApiResourceKind.agent_execution)}catch(error2){throw internalError(error2,"failed to list agent executions")}return decodeExecutions(rows,logger2)}function newValidateListRequestStep(){return{name:"ValidateListRequest",execute(){}}}function newQueryExecutionPageStep(store,logger2,listReadScope){return{name:"QueryExecutionPage",async execute(ctx){let input=ctx.input,page=await readListPage({store,declaration:agentExecutionListIndex,query:{org:input.org},request:input,fingerprint:listPageFingerprint({lane:"agentExecution.list",org:input.org,phase:input.phase,tags:input.tags}),decode:data=>decodeExecution(data,logger2),keep:execution=>input.phase===ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED||(execution.status?.phase??ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED)===input.phase,scope:executions=>restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.agent_execution,executions,""),failure:"failed to list agent executions"});ctx.set(EXECUTION_LIST_KEY,page)}}}function newValidateListBySessionRequestStep(){return{name:"ValidateListBySessionRequest",execute(ctx){if(ctx.input.sessionId==="")throw invalidArgumentError("session_id is required")}}}function newQueryExecutionsBySessionStep(store,logger2,listReadScope){return{name:"QueryExecutionsBySession",async execute(ctx){let rows;try{rows=await store.queryResources(agentExecutionListIndex,{anyKey:[{name:"session",value:ctx.input.sessionId}]})}catch(error2){throw internalError(error2,"failed to list agent executions")}let executions=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.agent_execution,decodeExecutions(rows.map(row=>row.data),logger2),"");logger2.debug("Successfully queried executions by session",{sessionId:ctx.input.sessionId,count:executions.length});let page={entries:executions,nextPageToken:""};ctx.set(EXECUTION_LIST_KEY,page)}}}function newBuildExecutionListResponseStep(){return{name:"BuildExecutionListResponse",execute(ctx){let page=requirePage(ctx.get(EXECUTION_LIST_KEY));ctx.set(EXECUTION_LIST_KEY,create2(AgentExecutionListSchema,{totalPages:page.nextPageToken===""?1:0,entries:page.entries,nextPageToken:page.nextPageToken}))}}}function decodeExecution(data,logger2){try{return fromBinary2(AgentExecutionSchema,data)}catch(error2){logger2.warn("Failed to unmarshal execution, skipping",{error:error2 instanceof Error?error2.message:String(error2)});return}}function decodeExecutions(rows,logger2){let executions=[];for(let data of rows){let execution=decodeExecution(data,logger2);execution!==void 0&&executions.push(execution)}return executions}function requirePage(value){if(typeof value!="object"||value===null||!Array.isArray(value.entries))throw internalError(new Error("execution list not found in context"),"execution list not found in context");return value}var EXECUTION_USAGE_REPORT_KEY="execution_usage_report",EXECUTION_KEY2="execution",SESSION_USAGE_REPORT_KEY="session_usage_report",AGENT_USAGE_REPORT_KEY="agent_usage_report",ORG_USAGE_REPORT_KEY="org_usage_report";function aggregateUsageReport(){return create2(UsageReportAggregateSchema)}function mergeModelBreakdowns(){return[]}function buildExecutionSummary(exec){return create2(ExecutionUsageSummarySchema,{executionId:exec.metadata?.id??"",startedAt:exec.status?.startedAt??"",completedAt:exec.status?.completedAt??"",subAgentCount:exec.status?.subAgentExecutions.length??0,phase:exec.status?.phase??ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED})}function filterByDateRange(executions,from2,to){return from2===""&&to===""?executions:executions.filter(exec=>{let startedAt=exec.status?.startedAt??"";return!(startedAt===""||from2!==""&&startedAt<from2||to!==""&&startedAt>to)})}function filterByOrg(executions,orgId){let target=orgId.toLowerCase();return executions.filter(exec=>(exec.metadata?.org??"").toLowerCase()===target)}function filterByAgentId(executions,agentId){return executions.filter(exec=>(exec.spec?.agentId??"")===agentId)}function groupBySessionId(executions){let groups=new Map;for(let exec of executions){let sid=exec.spec?.sessionId??"",group4=groups.get(sid);group4===void 0?groups.set(sid,[exec]):group4.push(exec)}return groups}function groupByAgentId(executions){let groups=new Map;for(let exec of executions){let aid=exec.spec?.agentId??"",group4=groups.get(aid);group4===void 0?groups.set(aid,[exec]):group4.push(exec)}return groups}function extractDate(ts){return ts.length<10?"":ts.slice(0,10)}function earliestStartedAt(executions){let earliest="";for(let exec of executions){let sa=exec.status?.startedAt??"";sa!==""&&(earliest===""||sa<earliest)&&(earliest=sa)}return earliest}function latestStartedAt(executions){let latest="";for(let exec of executions){let sa=exec.status?.startedAt??"";sa!==""&&(latest===""||sa>latest)&&(latest=sa)}return latest}function buildSessionSummary(sessionId,executions){return create2(SessionUsageSummarySchema,{sessionId,executionCount:executions.length,firstExecutionAt:earliestStartedAt(executions),lastExecutionAt:latestStartedAt(executions)})}function buildAgentSummary(agentId,agentName,executions){return create2(AgentUsageSummarySchema,{agentId,agentName,executionCount:executions.length})}function groupByDate(executions){let groups=new Map;for(let exec of executions){let date2=extractDate(exec.status?.startedAt??"");if(date2==="")continue;let group4=groups.get(date2);group4===void 0?groups.set(date2,[exec]):group4.push(exec)}return groups}function buildDailyCostEntries(executions){let byDate=groupByDate(executions),entries=[];for(let[date2,group4]of byDate)entries.push(create2(DailyCostEntrySchema,{date:date2,executionCount:group4.length}));return entries.sort((a5,b7)=>a5.date<b7.date?-1:a5.date>b7.date?1:0),entries}function sortExecutionsByStartedAt(executions){executions.sort((a5,b7)=>{let sa=a5.status?.startedAt??"",sb=b7.status?.startedAt??"";return sa<sb?-1:sa>sb?1:0})}function distinctAgentIds(executions){let seen=new Set;for(let exec of executions){let aid=exec.spec?.agentId??"";aid!==""&&seen.add(aid)}return[...seen].sort()}function distinctSessionIds(executions){let seen=new Set;for(let exec of executions){let sid=exec.spec?.sessionId??"";sid!==""&&seen.add(sid)}return[...seen].sort()}function topAgentsByCost(summaries,n3){return summaries.sort((a5,b7)=>a5.billableCostMicros<b7.billableCostMicros?1:a5.billableCostMicros>b7.billableCostMicros?-1:0),n3>0&&summaries.length>n3?summaries.slice(0,n3):summaries}async function resolveAgentNameFromStore(deps,agentId){let agent;try{agent=await deps.store.getResource(ApiResourceKind.agent,agentId,AgentSchema)}catch{return deps.logger.debug("Could not resolve agent name, using ID",{agentId}),agentId}let name=agent.metadata?.name??"";return name!==""?name:agentId}async function getExecutionUsageReport(deps,req,identity2){let reqCtx=new RequestContext(AgentExecutionQueryController.method.getExecutionUsageReport.input,req,identity2,ApiResourceKind.agent_execution);return await newPipeline("get-execution-usage-report",deps.logger).addStep(newAuthorizeStep(AgentExecutionQueryController.method.getExecutionUsageReport,deps.authorizer)).addStep({name:"ValidateExecutionUsageReport",execute(ctx){if(ctx.input.executionId==="")throw invalidArgumentError("execution_id is required")}}).addStep(newLoadExecutionStep(deps.store)).addStep({name:"BuildExecutionUsageReport",execute(ctx){ctx.set(EXECUTION_USAGE_REPORT_KEY,create2(GetExecutionUsageReportOutputSchema,{aggregate:aggregateUsageReport()}))}}).build().execute(reqCtx),requireReport(reqCtx.get(EXECUTION_USAGE_REPORT_KEY),"execution usage report not found in context")}function newLoadExecutionStep(store){return{name:"LoadExecution",async execute(ctx){let executionId=ctx.input.executionId,execution;try{execution=await store.getResource(ApiResourceKind.agent_execution,executionId,AgentExecutionSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("agent_execution",executionId):internalError(error2,"failed to load agent execution")}ctx.set(EXECUTION_KEY2,execution)}}}async function getSessionUsageReport(deps,req,identity2){let reqCtx=new RequestContext(AgentExecutionQueryController.method.getSessionUsageReport.input,req,identity2,ApiResourceKind.agent_execution);return await newPipeline("get-session-usage-report",deps.logger).addStep(newAuthorizeStep(AgentExecutionQueryController.method.getSessionUsageReport,deps.authorizer)).addStep({name:"ValidateSessionUsageReport",execute(ctx){if(ctx.input.sessionId==="")throw invalidArgumentError("session_id is required")}}).addStep({name:"LoadSessionExecutions",async execute(ctx){let executions=(await loadAllAgentExecutions(deps.store,deps.logger)).filter(exec=>(exec.spec?.sessionId??"")===ctx.input.sessionId);deps.logger.debug("Loaded executions for session usage report",{sessionId:ctx.input.sessionId,count:executions.length}),ctx.set(EXECUTION_LIST_KEY,executions)}}).addStep({name:"BuildSessionUsageReport",execute(ctx){let executions=requireExecutionList(ctx.get(EXECUTION_LIST_KEY));sortExecutionsByStartedAt(executions),ctx.set(SESSION_USAGE_REPORT_KEY,create2(GetSessionUsageReportOutputSchema,{sessionId:ctx.input.sessionId,executionCount:executions.length,totalUsage:aggregateUsageReport(),executions:executions.map(buildExecutionSummary),modelBreakdown:mergeModelBreakdowns(),firstExecutionAt:earliestStartedAt(executions),lastExecutionAt:latestStartedAt(executions)}))}}).build().execute(reqCtx),requireReport(reqCtx.get(SESSION_USAGE_REPORT_KEY),"session usage report not found in context")}async function getAgentUsageReport(deps,req,identity2){let reqCtx=new RequestContext(AgentExecutionQueryController.method.getAgentUsageReport.input,req,identity2,ApiResourceKind.agent_execution);return await newPipeline("get-agent-usage-report",deps.logger).addStep(newAuthorizeStep(AgentExecutionQueryController.method.getAgentUsageReport,deps.authorizer)).addStep({name:"ValidateAgentUsageReport",execute(ctx){if(ctx.input.agentId==="")throw invalidArgumentError("agent_id is required");if(ctx.input.orgId==="")throw invalidArgumentError("org_id is required")}}).addStep({name:"LoadAgentExecutions",async execute(ctx){let all=await loadAllAgentExecutions(deps.store,deps.logger),filtered=filterByOrg(all,ctx.input.orgId);filtered=filterByAgentId(filtered,ctx.input.agentId),filtered=filterByDateRange(filtered,ctx.input.fromDate,ctx.input.toDate),deps.logger.debug("Loaded executions for agent usage report",{agentId:ctx.input.agentId,orgId:ctx.input.orgId,count:filtered.length}),ctx.set(EXECUTION_LIST_KEY,filtered)}}).addStep({name:"BuildAgentUsageReport",async execute(ctx){let executions=requireExecutionList(ctx.get(EXECUTION_LIST_KEY)),agentId=ctx.input.agentId,agentName=agentId;executions.length>0&&(agentName=await resolveAgentNameFromStore(deps,agentId)),sortExecutionsByStartedAt(executions);let bySession=groupBySessionId(executions),sessionSummaries=[];for(let[sid,group4]of bySession)sessionSummaries.push(buildSessionSummary(sid,group4));ctx.set(AGENT_USAGE_REPORT_KEY,create2(GetAgentUsageReportOutputSchema,{agentId,agentName,totalUsage:aggregateUsageReport(),modelBreakdown:mergeModelBreakdowns(),sessions:sessionSummaries,totalSessions:bySession.size,totalExecutions:executions.length}))}}).build().execute(reqCtx),requireReport(reqCtx.get(AGENT_USAGE_REPORT_KEY),"agent usage report not found in context")}var TOP_AGENTS_LIMIT=10;async function getOrgUsageReport(deps,req,identity2){let reqCtx=new RequestContext(AgentExecutionQueryController.method.getOrgUsageReport.input,req,identity2,ApiResourceKind.agent_execution);return await newPipeline("get-org-usage-report",deps.logger).addStep(newAuthorizeStep(AgentExecutionQueryController.method.getOrgUsageReport,deps.authorizer)).addStep({name:"ValidateOrgUsageReport",execute(ctx){if(ctx.input.orgId==="")throw invalidArgumentError("org_id is required");if(ctx.input.fromDate==="")throw invalidArgumentError("from_date is required");if(ctx.input.toDate==="")throw invalidArgumentError("to_date is required")}}).addStep({name:"LoadOrgExecutions",async execute(ctx){let all=await loadAllAgentExecutions(deps.store,deps.logger),filtered=filterByOrg(all,ctx.input.orgId);filtered=filterByDateRange(filtered,ctx.input.fromDate,ctx.input.toDate),deps.logger.debug("Loaded executions for org usage report",{orgId:ctx.input.orgId,count:filtered.length}),ctx.set(EXECUTION_LIST_KEY,filtered)}}).addStep({name:"BuildOrgUsageReport",async execute(ctx){let executions=requireExecutionList(ctx.get(EXECUTION_LIST_KEY)),byAgent=groupByAgentId(executions),agentSummaries=[];for(let[aid,group4]of byAgent){let name=aid===""?"(unknown agent)":await resolveAgentNameFromStore(deps,aid);agentSummaries.push(buildAgentSummary(aid,name,group4))}ctx.set(ORG_USAGE_REPORT_KEY,create2(GetOrgUsageReportOutputSchema,{orgId:ctx.input.orgId,totalAgents:distinctAgentIds(executions).length,totalSessions:distinctSessionIds(executions).length,totalExecutions:executions.length,modelBreakdown:mergeModelBreakdowns(),topAgentsByCost:topAgentsByCost(agentSummaries,TOP_AGENTS_LIMIT),dailyCosts:buildDailyCostEntries(executions)}))}}).build().execute(reqCtx),requireReport(reqCtx.get(ORG_USAGE_REPORT_KEY),"org usage report not found in context")}function requireExecutionList(value){if(!Array.isArray(value))throw internalError(new Error("execution list not found in context"),"execution list not found in context");return value}function requireReport(value,message6){if(value===void 0)throw internalError(new Error(message6),message6);return value}async function getExecutionSummary(deps,req,identity2){let cutoffMs=resolveAgentTimeCutoffMs(req.timeWindow),rows;try{rows=await deps.store.queryResources(agentExecutionListIndex,{org:req.org,...cutoffMs===void 0?{}:{createdAtOrAfter:listIndexInstantOfMillis(cutoffMs-1)}})}catch(error2){throw internalError(error2,"failed to list agent executions")}let executions=[];for(let row of rows)try{executions.push(fromBinary2(AgentExecutionSchema,row.data))}catch(error2){deps.logger.warn("Failed to unmarshal execution, skipping",{error:error2 instanceof Error?error2.message:String(error2)})}if(deps.listReadScope!==void 0&&(executions=await restrictListByReadScope(deps.listReadScope,identity2,ApiResourceKind.agent_execution,executions,""),executions.length===0))return create2(AgentExecutionSummarySchema);let phaseCounts={},activeCount=0,completedDurationsMs=[],failureCounts=new Map,agentNames=new Map;for(let exec of executions){let createdAtMs=auditCreatedAtMs(exec);if(createdAtMs!==void 0&&cutoffMs!==void 0&&createdAtMs<cutoffMs)continue;let phase=exec.status?.phase??ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED;phaseCounts[phase]=(phaseCounts[phase]??0)+1,isAgentActivePhase(phase)&&activeCount++;let agentId=exec.spec?.agentId??"";if(phase===ExecutionPhase.EXECUTION_COMPLETED){let d5=completionDurationMs(exec);d5>0&&completedDurationsMs.push(d5)}if(phase===ExecutionPhase.EXECUTION_FAILED&&agentId!==""){failureCounts.set(agentId,(failureCounts.get(agentId)??0)+1);let name=exec.metadata?.name??"";name!==""&&agentNames.set(agentId,name)}}let summary=create2(AgentExecutionSummarySchema,{activeCount,phaseCounts});if(completedDurationsMs.length>0){let totalMs=0;for(let d5 of completedDurationsMs)totalMs+=d5;summary.avgDuration=durationFromMs(totalMs/completedDurationsMs.length)}return summary.topFailingAgents=buildAgentFailureRanks(failureCounts,agentNames,10),summary}function resolveAgentTimeCutoffMs(tw){let now=Date.now();switch(tw){case AgentExecutionSummaryTimeWindow.LAST_24H:return now-1440*60*1e3;case AgentExecutionSummaryTimeWindow.LAST_7D:return now-10080*60*1e3;case AgentExecutionSummaryTimeWindow.LAST_30D:return now-720*60*60*1e3;case AgentExecutionSummaryTimeWindow.ALL_TIME:return;default:return now-10080*60*1e3}}function isAgentActivePhase(p3){return p3===ExecutionPhase.EXECUTION_PENDING||p3===ExecutionPhase.EXECUTION_IN_PROGRESS||p3===ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL||p3===ExecutionPhase.EXECUTION_PAUSED}function auditCreatedAtMs(exec){let ts=exec.status?.audit?.specAudit?.createdAt;if(ts!==void 0)return Number(ts.seconds)*1e3+Math.floor(ts.nanos/1e6)}function completionDurationMs(exec){let started=parseRfc3339Ms(exec.status?.startedAt??""),completed=parseRfc3339Ms(exec.status?.completedAt??"");return started===void 0||completed===void 0?0:completed-started}var RFC3339_PATTERN=/^\d{4}-\d{2}-\d{2}[Tt]\d{2}:\d{2}:\d{2}(\.\d+)?([Zz]|[+-]\d{2}:\d{2})$/;function parseRfc3339Ms(value){if(!RFC3339_PATTERN.test(value))return;let ms=Date.parse(value);return Number.isNaN(ms)?void 0:ms}function durationFromMs(ms){let truncatedMs=Math.trunc(ms),seconds=Math.trunc(truncatedMs/1e3),nanos=Math.trunc((truncatedMs-seconds*1e3)*1e6);return create2(DurationSchema,{seconds:BigInt(seconds),nanos})}function buildAgentFailureRanks(counts,names,limit){let entries=[...counts.entries()];return entries.sort((a5,b7)=>b7[1]-a5[1]),(entries.length>limit?entries.slice(0,limit):entries).map(([agentId,count])=>create2(AgentFailureRankSchema,{agentSlug:agentId,agentName:names.get(agentId)??"",failureCount:count}))}function registerAgentExecutionServices(router,deps){let lifecycleDeps={store:deps.store,logger:deps.logger,authorizer:deps.authorizer,broker:deps.broker,engineState:deps.engineState,executionContextBuilder:deps.executionContextBuilder,gateSteps:deps.gateSteps,statusObservers:deps.statusObservers,sandboxLane:deps.sandboxLane,temporalConfig:deps.temporalConfig},artifactDeps={store:deps.store,logger:deps.logger,artifactStorage:deps.artifactStorage,authorizer:deps.authorizer};router.service(AgentExecutionCommandController,{create:(execution,ctx)=>createExecution(deps,execution,ctx),update:(execution,ctx)=>update2(deps,execution,ctx),updateStatus:(input,ctx)=>updateStatus(deps,input,callerIdentityOf(ctx)),submitApproval:(input,ctx)=>submitApproval(deps,input,callerIdentityOf(ctx)),submitFileDecision:(input,ctx)=>submitFileDecision(deps,input,callerIdentityOf(ctx)),cancel:(input,ctx)=>cancelExecution(lifecycleDeps,input,callerIdentityOf(ctx)),terminate:(input,ctx)=>terminateExecution(lifecycleDeps,input,callerIdentityOf(ctx)),recover:(input,ctx)=>recoverExecution(lifecycleDeps,input,callerIdentityOf(ctx)),pause:(input,ctx)=>pauseExecution(lifecycleDeps,input,callerIdentityOf(ctx)),resume:(input,ctx)=>resumeExecution(lifecycleDeps,input,callerIdentityOf(ctx)),uploadAttachment:req=>uploadAttachment(artifactDeps,req),delete:(id,ctx)=>deleteExecution(deps,id,ctx)}),router.service(AgentExecutionQueryController,{get:(id,ctx)=>get2(deps,id,ctx),list:(req,ctx)=>list2(deps,req,ctx),listBySession:(req,ctx)=>listBySession(deps,req,ctx),subscribe:(id,ctx)=>subscribeExecution(deps,id,ctx),getArtifactDownloadUrl:(req,ctx)=>getArtifactDownloadUrl(artifactDeps,req,callerIdentityOf(ctx)),getArtifactContent:(req,ctx)=>getArtifactContent(artifactDeps,req,callerIdentityOf(ctx)),getExecutionUsageReport:(req,ctx)=>getExecutionUsageReport(deps,req,callerIdentityOf(ctx)),getSessionUsageReport:(req,ctx)=>getSessionUsageReport(deps,req,callerIdentityOf(ctx)),getAgentUsageReport:(req,ctx)=>getAgentUsageReport(deps,req,callerIdentityOf(ctx)),getOrgUsageReport:(req,ctx)=>getOrgUsageReport(deps,req,callerIdentityOf(ctx)),getExecutionSummary:(req,ctx)=>getExecutionSummary(deps,req,callerIdentityOf(ctx))})}async function createExecution(deps,execution,ctx){let reqCtx=new RequestContext(AgentExecutionSchema,execution,callerIdentityOf(ctx),kindOf2(ctx)),builder2=newPipeline("agent-execution-create",deps.logger).addStep(newAuthorizeStep(AgentExecutionCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newValidateServiceTierStep(deps.modelRegistry)).addStep(newValidateThinkingModeStep(deps.modelRegistry)).addStep(newAuthorizeRunTargetStep(deps.authorizer,agentExecutionRunTarget)).addStep(newResolveSlugStep()).addStep(newBuildNewStateStep()).addStep(newRecordRunnerLineageLabelsStep(deps.runnerCredentialProvider)).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newEnsureEngineAvailableStep(deps.engineState));for(let step of stepsForSlot(deps.gateSteps,"agent-execution-create:pre-side-effect-gate"))builder2.addStep(step);return await builder2.addStep(newCreateDefaultInstanceIfNeededStep({store:deps.store,logger:deps.logger,agentLoader:deps.agentLoader,agentInstanceCreator:deps.agentInstanceCreator,authorizationLifecycle:deps.authorizationLifecycle})).addStep(newCreateSessionIfNeededStep({logger:deps.logger,sessionCreator:deps.sessionCreator})).addStep(newComposeDeclaredPreferencesStep(deps.store,deps.logger)).addStep(newComposeRecalledMemoriesStep(deps.store,deps.logger)).addStep(newSetInitialPhaseStep()).addStep(newCreateExecutionContextStep(deps.executionContextBuilder)).addStep(newProcessAttachmentsStep(deps.logger)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,agentExecutionSearchExtractor,deps.logger)).addStep(newStartWorkflowStep({store:deps.store,logger:deps.logger,engineState:deps.engineState,statusObservers:deps.statusObservers})).addStep(newEnsureSessionSandboxStep({store:deps.store,logger:deps.logger,lane:deps.sandboxLane,temporalConfig:deps.temporalConfig})).build().execute(reqCtx),reqCtx.newState}function kindOf2(ctx){return ctx.values.get(apiResourceKindKey)}async function update2(deps,execution,ctx){let reqCtx=new RequestContext(AgentExecutionSchema,execution,callerIdentityOf(ctx),kindOf2(ctx));return await newPipeline("agent-execution-update",deps.logger).addStep(newAuthorizeStep(AgentExecutionCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,agentExecutionSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function deleteExecution(deps,id,ctx){let reqCtx=new RequestContext(AgentExecutionCommandController.method.delete.input,id,callerIdentityOf(ctx),kindOf2(ctx));await newPipeline("agent-execution-delete",deps.logger).addStep(newAuthorizeStep(AgentExecutionCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,AgentExecutionSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted execution not found in context"),"deleted execution not found in context");return deleted}async function get2(deps,id,ctx){let reqCtx=new RequestContext(AgentExecutionQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf2(ctx));return await newPipeline("agent-execution-get",deps.logger).addStep(newAuthorizeStep(AgentExecutionQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,AgentExecutionSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function list2(deps,req,ctx){let reqCtx=new RequestContext(AgentExecutionQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf2(ctx));return await newPipeline("agent-execution-list",deps.logger).addStep(newAuthorizeStep(AgentExecutionQueryController.method.list,deps.authorizer)).addStep(newValidateListRequestStep()).addStep(newQueryExecutionPageStep(deps.store,deps.logger,deps.listReadScope)).addStep(newBuildExecutionListResponseStep()).build().execute(reqCtx),requireListResult(reqCtx.get(EXECUTION_LIST_KEY))}async function listBySession(deps,req,ctx){let reqCtx=new RequestContext(AgentExecutionQueryController.method.listBySession.input,req,callerIdentityOf(ctx),kindOf2(ctx));return await newPipeline("agent-execution-list-by-session",deps.logger).addStep(newAuthorizeStep(AgentExecutionQueryController.method.listBySession,deps.authorizer)).addStep(newValidateListBySessionRequestStep()).addStep(newQueryExecutionsBySessionStep(deps.store,deps.logger,deps.listReadScope)).addStep(newBuildExecutionListResponseStep()).build().execute(reqCtx),requireListResult(reqCtx.get(EXECUTION_LIST_KEY))}function requireListResult(result){if(result===void 0||Array.isArray(result))throw internalError(new Error("execution list not found in context"),"execution list not found in context");return result}var import_node_fs5=require("node:fs"),import_promises4=require("node:fs/promises"),import_node_path9=__toESM(require("node:path"),1);function goQueryEscape(s2){let out="";for(let byte of Buffer.from(s2,"utf-8")){let c5=String.fromCharCode(byte);/[A-Za-z0-9\-_.~]/.test(c5)?out+=c5:c5===" "?out+="+":out+=`%${byte.toString(16).toUpperCase().padStart(2,"0")}`}return out}function goUrlValuesEncode(values){return Object.keys(values).sort().map(key=>`${goQueryEscape(key)}=${goQueryEscape(values[key]??"")}`).join("&")}var import_client_s3=__toESM(require_dist_cjs16(),1),import_s3_request_presigner=__toESM(require_dist_cjs17(),1);var R2_MAX_EXPIRATION_MS=10080*60*1e3,R2_CALL_TIMEOUT_MS=3e4;var R2ArtifactStorage=class{client;presign;bucket;constructor(config2,clients){if(config2.bucket==="")throw new Error("R2 bucket name is required");if(config2.endpoint==="")throw new Error("R2 endpoint is required");if(config2.accessKeyId==="")throw new Error("R2 access key ID is required");if(config2.secretAccessKey==="")throw new Error("R2 secret access key is required");if(this.bucket=config2.bucket,clients!==void 0){this.client=clients.client,this.presign=clients.presign;return}this.client=new import_client_s3.S3Client({region:config2.region===""?"auto":config2.region,endpoint:config2.endpoint,forcePathStyle:!0,credentials:{accessKeyId:config2.accessKeyId,secretAccessKey:config2.secretAccessKey}}),this.presign=import_s3_request_presigner.getSignedUrl}async upload(key,data,contentType){try{await this.client.send(new import_client_s3.PutObjectCommand({Bucket:this.bucket,Key:key,Body:data,...contentType!==""?{ContentType:contentType}:{}}))}catch(error2){throw new Error(`r2 upload failed: ${errorText(error2)}`,{cause:error2})}}async download(key){let body;try{let result=await this.client.send(new import_client_s3.GetObjectCommand({Bucket:this.bucket,Key:key}),{abortSignal:AbortSignal.timeout(R2_CALL_TIMEOUT_MS)});if(result.Body===void 0)throw new Error("empty response body");body=await result.Body.transformToByteArray()}catch(error2){throw isNotFoundError(error2)?new ArtifactStorageNotFoundError(key):new Error(`r2 download failed: ${errorText(error2)}`,{cause:error2})}return body}async size(key){try{let result=await this.client.send(new import_client_s3.HeadObjectCommand({Bucket:this.bucket,Key:key}));return Number(result.ContentLength??0)}catch(error2){throw isNotFoundError(error2)?new ArtifactStorageNotFoundError(key):new Error(`r2 head failed: ${errorText(error2)}`,{cause:error2})}}async presignPut(key,declaredSizeBytes,ttlMs){let clampedMs=Math.min(ttlMs,R2_MAX_EXPIRATION_MS),command5=new import_client_s3.PutObjectCommand({Bucket:this.bucket,Key:key,ContentLength:declaredSizeBytes});try{return{url:await this.presign(this.client,command5,{expiresIn:Math.floor(clampedMs/1e3)}),ttlMs:clampedMs}}catch(error2){throw new Error(`r2 presign failed: ${errorText(error2)}`,{cause:error2})}}async getSignedUrl(key,expiresInMs,downloadFilename){let clampedMs=Math.min(expiresInMs,R2_MAX_EXPIRATION_MS),command5=new import_client_s3.GetObjectCommand({Bucket:this.bucket,Key:key,...downloadFilename!==""?{ResponseContentDisposition:contentDispositionAttachment(downloadFilename)}:{}});try{return await this.presign(this.client,command5,{expiresIn:Math.floor(clampedMs/1e3)})}catch(error2){throw new Error(`r2 presign failed: ${errorText(error2)}`,{cause:error2})}}async delete(key){try{await this.client.send(new import_client_s3.DeleteObjectCommand({Bucket:this.bucket,Key:key}))}catch(error2){throw new Error(`r2 delete failed: ${errorText(error2)}`,{cause:error2})}}async exists(key){try{return await this.client.send(new import_client_s3.HeadObjectCommand({Bucket:this.bucket,Key:key})),!0}catch(error2){if(isNotFoundError(error2))return!1;throw new Error(`r2 head failed: ${errorText(error2)}`,{cause:error2})}}async health(){try{await this.client.send(new import_client_s3.HeadBucketCommand({Bucket:this.bucket}))}catch(error2){throw new Error(`r2 health check failed: ${errorText(error2)}`,{cause:error2})}}};function isNotFoundError(error2){if(error2==null)return!1;let name=error2.name??"";if(name==="NotFound"||name==="NoSuchKey"||error2.$metadata?.httpStatusCode===404)return!0;let message6=error2 instanceof Error?error2.message:String(error2);return message6.includes("404")||message6.includes("not found")}function errorText(error2){return error2 instanceof Error?error2.message:String(error2)}var LOCAL_DOWNLOAD_QUERY_PARAM="download",ArtifactStorageNotFoundError=class extends Error{constructor(key){super(`artifact not found: ${key}`),this.name="ArtifactStorageNotFoundError"}},BUILT_IN_STORAGE_TYPES=["local","r2"];function newArtifactStorage(config2,registeredDrivers=new Map){let storageType=config2.type===""?"local":config2.type;switch(storageType){case"local":return new LocalArtifactStorage(config2.localBasePath,config2.localServeUrl);case"r2":return new R2ArtifactStorage({bucket:config2.r2Bucket,endpoint:config2.r2Endpoint,accessKeyId:config2.r2AccessKeyId,secretAccessKey:config2.r2SecretAccessKey,region:config2.r2Region});default:{let registered=registeredDrivers.get(storageType);if(registered!==void 0)return registered();let known=[...BUILT_IN_STORAGE_TYPES,...registeredDrivers.keys()].map(name=>`'${name}'`).join(" or ");throw new Error(`unknown storage type: ${storageType} (must be ${known})`)}}}var LocalArtifactStorage=class{basePath;serveUrl;stagedUploadLane;constructor(basePath,serveUrl,stagedUploadLane){this.basePath=basePath,this.serveUrl=serveUrl,this.stagedUploadLane=stagedUploadLane,(0,import_node_fs5.mkdirSync)(this.root(),{recursive:!0})}async upload(key,data,_contentType){let filePath=this.resolveWithinRoot(key);await(0,import_promises4.mkdir)(import_node_path9.default.dirname(filePath),{recursive:!0}),await(0,import_promises4.writeFile)(filePath,data,{mode:384})}async download(key){let filePath=this.resolveWithinRoot(key);try{return await(0,import_promises4.readFile)(filePath)}catch(error2){throw error2.code==="ENOENT"?new ArtifactStorageNotFoundError(key):error2}}async size(key){let filePath=this.resolveWithinRoot(key);try{return(await(0,import_promises4.stat)(filePath)).size}catch(error2){throw error2.code==="ENOENT"?new ArtifactStorageNotFoundError(key):error2}}async presignPut(key,declaredSizeBytes,_ttlMs){if(this.stagedUploadLane===void 0)throw new Error("local presigned uploads not configured - no staged-upload lane is wired to this store instance");return this.resolveWithinRoot(key),this.stagedUploadLane.reserve(key,declaredSizeBytes)}async getSignedUrl(key,_expiresInMs,downloadFilename){if(this.serveUrl==="")throw new Error("local serve URL not configured");let url=`${this.serveUrl}/${key}`;return downloadFilename!==""&&(url+=`?${LOCAL_DOWNLOAD_QUERY_PARAM}=${goQueryEscape(downloadFilename)}`),url}async delete(key){let filePath=this.resolveWithinRoot(key);await(0,import_promises4.rm)(filePath,{force:!0}),await this.cleanupEmptyDirs(import_node_path9.default.dirname(filePath))}async exists(key){let filePath=this.resolveWithinRoot(key);try{return await(0,import_promises4.stat)(filePath),!0}catch(error2){if(error2.code==="ENOENT")return!1;throw error2}}async health(){if(!(await(0,import_promises4.stat)(this.root()).catch(error2=>{throw new Error(`artifacts directory not accessible: ${error2 instanceof Error?error2.message:String(error2)}`)})).isDirectory())throw new Error("artifacts path is not a directory");let testFile=import_node_path9.default.join(this.root(),".health_check");await(0,import_promises4.writeFile)(testFile,"ok",{mode:384}).catch(error2=>{throw new Error(`artifacts directory not writable: ${error2 instanceof Error?error2.message:String(error2)}`)}),await(0,import_promises4.rm)(testFile,{force:!0})}root(){return this.basePath}resolveWithinRoot(key){let root5=this.root(),full=import_node_path9.default.join(root5,key);if(!isWithin(root5,full))throw new Error(`storage key ${JSON.stringify(key)} resolves outside the artifact storage root`);return full}async cleanupEmptyDirs(dir){let root5=this.root();if(!(!isWithin(root5,dir)||import_node_path9.default.resolve(dir)===import_node_path9.default.resolve(root5))){try{await(0,import_promises4.rmdir)(dir)}catch{return}await this.cleanupEmptyDirs(import_node_path9.default.dirname(dir))}}};function isWithin(root5,p3){let cleanRoot=import_node_path9.default.resolve(root5),cleanPath=import_node_path9.default.resolve(p3);return cleanPath===cleanRoot||cleanPath.startsWith(cleanRoot+import_node_path9.default.sep)}function contentDispositionAttachment(filename){let ascii=sanitizeAsciiFilename(filename),disposition=`attachment; filename=${`"${ascii.replaceAll("\\","\\\\").replaceAll('"','\\"')}"`}`;return ascii!==filename&&(disposition+=`; filename*=UTF-8''${rfc5987Encode(filename)}`),disposition}function sanitizeAsciiFilename(filename){let out="";for(let r5 of filename){let code=r5.codePointAt(0)??0;out+=code<32||code>126?"_":r5}return out}function rfc5987Encode(filename){let bytes=Buffer.from(filename,"utf-8"),out="";for(let c5 of bytes)isRfc5987AttrChar(c5)?out+=String.fromCharCode(c5):out+=`%${c5.toString(16).toUpperCase().padStart(2,"0")}`;return out}function isRfc5987AttrChar(c5){return c5>=65&&c5<=90||c5>=97&&c5<=122||c5>=48&&c5<=57?!0:"!#$&+-.^_`|~".includes(String.fromCharCode(c5))}var StreamBroker=class{logger;subscribers=new Map;constructor(logger2){this.logger=logger2}subscribe(executionId){let subscription={queue:[],notify:void 0,closed:!1},set2=this.subscribers.get(executionId)??new Set;return set2.add(subscription),this.subscribers.set(executionId,set2),this.logger.debug("New subscriber registered",{executionId,totalSubscribers:set2.size}),subscription}unsubscribe(executionId,subscription){let set2=this.subscribers.get(executionId);set2===void 0||!set2.has(subscription)||(set2.delete(subscription),subscription.closed=!0,subscription.notify?.(),subscription.notify=void 0,this.logger.debug("Subscriber unregistered",{executionId,remainingSubscribers:set2.size}),set2.size===0&&this.subscribers.delete(executionId))}broadcast(execution){let executionId=execution.metadata?.id??"";if(executionId==="")return;let set2=this.subscribers.get(executionId);if(!(set2===void 0||set2.size===0)){this.logger.debug("Broadcasting execution update",{executionId,subscribers:set2.size});for(let subscription of set2){if(subscription.queue.length>=100){this.logger.warn("Subscriber channel full, dropping update",{executionId});continue}subscription.queue.push(execution),subscription.notify?.(),subscription.notify=void 0}}}getSubscriberCount(executionId){return this.subscribers.get(executionId)?.size??0}};var import_common2=__toESM(require_lib2(),1);function runCredentialForDispatch(credentials,executionId,logger2){let mintRunCredential=credentials.mintRunCredential?.bind(credentials);if(mintRunCredential===void 0)return"";try{return mintRunCredential(executionId)}catch(error2){return logger2.warn("Failed to mint the run credential \u2014 dispatching without it; the runner will fall back to the platform exchange",{execution_id:executionId,error:error2 instanceof Error?error2.message:String(error2)}),""}}var INVOKE_AGENT_EXECUTION_WORKFLOW_NAME="stigmer/agent-execution/invoke";function invokeWorkflowIdFor(executionId){return`${INVOKE_AGENT_EXECUTION_WORKFLOW_NAME}/${executionId}`}var SIGNAL_PAUSE="pause",SIGNAL_RESUME="resume",SIGNAL_APPROVAL_GATE_RESOLVED="approvalGateResolved";var MEMO_ACTIVITY_TASK_QUEUE="activityTaskQueue";var UPDATE_EXECUTION_STATUS_ACTIVITY_NAME="UpdateExecutionStatus",LOAD_AGENT_EXECUTION_ACTIVITY_NAME="LoadAgentExecution",READ_HARNESS_STATE_ID_ACTIVITY_NAME="ReadHarnessStateId",COMPLETE_EXTERNAL_ACTIVITY_NAME="stigmer/system/complete-external-activity";var TemporalExecutionEngine=class{deps;constructor(deps){this.deps=deps}async startInvokeWorkflow(input){let{client,config:config2,store,runnerCredentials,logger:logger2}=this.deps,dispatch;try{dispatch=await resolveActivityTaskQueue(store,input.sessionId,config2,input.activityTaskQueueOverride,logger2)}catch(error2){throw new EngineDispatchError(error2 instanceof Error?error2.message:String(error2))}let workflowId=invokeWorkflowIdFor(input.executionId),runCredential=runCredentialForDispatch(runnerCredentials,input.executionId,logger2),workflowInput={execution_id:input.executionId,session_id:input.sessionId,agent_id:input.agentId,...input.callbackToken.length>0?{callback_token:Buffer.from(input.callbackToken).toString("base64")}:{},...input.autoApproveAll?{auto_approve_all:!0}:{},...input.parentWorkflowId!==""?{parent_workflow_id:input.parentWorkflowId}:{},...dispatch.harness!==0?{harness:dispatch.harness}:{},...dispatch.executionTarget!==0?{execution_target:dispatch.executionTarget}:{},...runCredential!==""?{execution_context_token:runCredential}:{}};await client.workflow.start(INVOKE_AGENT_EXECUTION_WORKFLOW_NAME,{workflowId,taskQueue:config2.stigmerQueue,memo:{[MEMO_ACTIVITY_TASK_QUEUE]:dispatch.taskQueue},args:[workflowInput]}),logger2.info("Started InvokeAgentExecutionWorkflow",{workflow_id:workflowId,execution_id:input.executionId,stigmer_queue:config2.stigmerQueue,activity_queue:dispatch.taskQueue})}async signalApprovalGateResolved(executionId){let workflowId=invokeWorkflowIdFor(executionId);this.deps.logger.info("Sending approvalGateResolved signal to workflow",{workflow_id:workflowId,execution_id:executionId}),await this.signal(executionId,SIGNAL_APPROVAL_GATE_RESOLVED)}async signalPause(executionId,reason){await this.signal(executionId,SIGNAL_PAUSE,reason)}async signalResume(executionId){await this.signal(executionId,SIGNAL_RESUME)}async cancelWorkflow(executionId){let handle=this.deps.client.workflow.getHandle(invokeWorkflowIdFor(executionId));try{await handle.cancel()}catch(error2){throw mapNotFound(error2,executionId)}}async terminateWorkflow(executionId,reason){let handle=this.deps.client.workflow.getHandle(invokeWorkflowIdFor(executionId));try{await handle.terminate(reason)}catch(error2){throw mapNotFound(error2,executionId)}}async signal(executionId,signalName,...args){let handle=this.deps.client.workflow.getHandle(invokeWorkflowIdFor(executionId));try{await handle.signal(signalName,...args)}catch(error2){throw mapNotFound(error2,executionId)}}};function mapNotFound(error2,executionId){return error2 instanceof import_common2.WorkflowNotFoundError?new EngineWorkflowNotFoundError(executionId):error2}function newExecutionEngineStateProvider(deps){let memo;return()=>{let client=deps.manager.getClient();return client===void 0?ENGINE_DISCONNECTED:((memo===void 0||memo.client!==client)&&(memo={client,state:{connected:!0,engine:new TemporalExecutionEngine({client,config:deps.config,store:deps.store,runnerCredentials:deps.runnerCredentials,logger:deps.logger})}}),memo.state)}}var import_client68=__toESM(require_lib3(),1),import_common3=__toESM(require_lib2(),1),import_proto6=__toESM(require_protos2(),1);var MCP_SERVER_ENGINE_DISCONNECTED=Object.freeze({connected:!1});var CONNECT_WORKFLOW_NAME="stigmer/mcp-server/connect";function connectWorkflowIdFor(mcpServerId){return`${CONNECT_WORKFLOW_NAME}/${mcpServerId}`}var TemporalMcpServerConnectEngine=class{deps;constructor(deps){this.deps=deps}async startOrAttachConnect(mcpServerId,input,runTimeoutMs){let{client,config:config2,logger:logger2}=this.deps,workflowId=connectWorkflowIdFor(mcpServerId),runnerQueue=config2.runnerQueue,handle,attached=!1;try{handle=await client.workflow.start(CONNECT_WORKFLOW_NAME,{workflowId,taskQueue:runnerQueue,workflowRunTimeout:runTimeoutMs,args:[input]})}catch(error2){if(error2 instanceof import_common3.WorkflowExecutionAlreadyStartedError)logger2.info("Connect workflow already in flight \u2014 attaching to it",{workflow_id:workflowId,mcp_server_id:mcpServerId}),handle=client.workflow.getHandle(workflowId),attached=!0;else throw error2}return attached||logger2.info("Started MCP connect workflow",{workflow_id:workflowId,mcp_server_id:mcpServerId,runner_queue:runnerQueue}),{workflowId,attached,result:raceTimeoutMs=>awaitRunOutcome(handle,raceTimeoutMs)}}async isConnectRunRunning(workflowId){if(workflowId==="")return!1;try{return(await this.deps.client.workflow.getHandle(workflowId).describe()).status.name==="RUNNING"}catch{return!1}}async hasRunnerQueuePollers(){let{client,config:config2,logger:logger2}=this.deps;try{return((await client.workflowService.describeTaskQueue({namespace:client.options.namespace,taskQueue:{name:config2.runnerQueue},taskQueueType:import_proto6.default.temporal.api.enums.v1.TaskQueueType.TASK_QUEUE_TYPE_WORKFLOW})).pollers?.length??0)>0}catch(error2){logger2.debug("Could not describe runner task queue for connect pre-flight",{runner_queue:config2.runnerQueue,error:error2 instanceof Error?error2.message:String(error2)});return}}};async function awaitRunOutcome(handle,raceTimeoutMs){let resultPromise=handle.result().then(output=>({ok:!0,output:output??{}})).catch(error2=>({ok:!1,failure:classifyRunError(error2)}));if(raceTimeoutMs===void 0)return resultPromise;let backstop,backstopPromise=new Promise(resolve=>{backstop=setTimeout(()=>{resolve({ok:!1,failure:{kind:"other",message:"context deadline exceeded"}})},raceTimeoutMs)});try{return await Promise.race([resultPromise,backstopPromise])}finally{backstop!==void 0&&clearTimeout(backstop)}}function classifyRunError(error2){if(error2 instanceof import_client68.WorkflowFailedError){let application,timeout,cause=error2.cause;for(;cause!=null;)application===void 0&&cause instanceof import_common3.ApplicationFailure&&(application=cause),timeout===void 0&&cause instanceof import_common3.TimeoutFailure&&(timeout=cause),cause=cause.cause;return application!==void 0?{kind:"application",message:application.message}:timeout!==void 0?{kind:"timeout"}:{kind:"other",message:error2.cause?.message!==void 0&&error2.cause.message!==""?error2.cause.message:error2.message}}return error2 instanceof import_client68.WorkflowNotFoundError?{kind:"service-not-found"}:{kind:"other",message:error2 instanceof Error?error2.message:String(error2)}}function newMcpServerEngineStateProvider(deps){let memo;return()=>{let client=deps.manager.getClient();return client===void 0?MCP_SERVER_ENGINE_DISCONNECTED:((memo===void 0||memo.client!==client)&&(memo={client,state:{connected:!0,engine:new TemporalMcpServerConnectEngine({client,config:deps.config,logger:deps.logger})}}),memo.state)}}var import_node_fs6=require("node:fs"),import_node_url=require("node:url");function resolveWorkflowSource(options){let prebuiltPath=(0,import_node_url.fileURLToPath)(options.prebuiltSibling);if((0,import_node_fs6.existsSync)(prebuiltPath))return{kind:"prebuilt",codePath:prebuiltPath};for(let candidate of options.workflowsEntryCandidates){let candidatePath=(0,import_node_url.fileURLToPath)(candidate);if((0,import_node_fs6.existsSync)(candidatePath))return{kind:"runtime",workflowsPath:candidatePath}}throw new Error("no Temporal workflows entry found (checked: "+options.workflowsEntryCandidates.map(url=>(0,import_node_url.fileURLToPath)(url)).join(", ")+") \u2014 the build did not emit the workflows module")}var import_node_buffer=require("node:buffer");var DELETE_EXECUTION_CONTEXT_ACTIVITY_NAME="DeleteExecutionContext";async function deleteExecutionContextForExecution(store,logger2,executionId){logger2.debug("Cleaning up ExecutionContext for execution",{executionId});let ec2;try{ec2=await store.findByField(ApiResourceKind.execution_context,"spec.executionId",executionId,ExecutionContextSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError){logger2.debug("No ExecutionContext found for execution -- nothing to clean up",{executionId});return}logger2.warn("Failed to query ExecutionContext -- leaving cleanup to the operator",{executionId,error:error2 instanceof Error?error2.message:String(error2)});return}let contextId=ec2.metadata?.id??"",dataCount=Object.keys(ec2.spec?.data??{}).length;try{await store.deleteResource(ApiResourceKind.execution_context,contextId)}catch(error2){logger2.warn("Failed to delete ExecutionContext -- leaving cleanup to the operator",{executionId,contextId,error:error2 instanceof Error?error2.message:String(error2)});return}logger2.info("Deleted ExecutionContext for execution",{executionId,contextId,variables:dataCount})}function createAgentExecutionActivities(deps){let{store,logger:logger2}=deps;return{[UPDATE_EXECUTION_STATUS_ACTIVITY_NAME]:async(executionId,statusJson)=>{let status=fromJson(AgentExecutionStatusSchema,statusJson);await deps.statusWriter().updateStatus(create2(AgentExecutionUpdateStatusInputSchema,{executionId,status}))},[LOAD_AGENT_EXECUTION_ACTIVITY_NAME]:async executionId=>{let execution;try{execution=await store.getResource(ApiResourceKind.agent_execution,executionId,AgentExecutionSchema)}catch(error2){throw new Error(`load agent execution ${executionId}: ${error2 instanceof Error?error2.message:String(error2)}`,{cause:error2})}return toJson(AgentExecutionSchema,execution)},[READ_HARNESS_STATE_ID_ACTIVITY_NAME]:async sessionId=>{if(sessionId==="")return"";let session;try{session=await store.getResource(ApiResourceKind.session,sessionId,SessionSchema)}catch(error2){throw logger2.error("Failed to load session for harness_state_id",{session_id:sessionId,error:error2 instanceof Error?error2.message:String(error2)}),new Error(`load session ${sessionId} for harness_state_id: ${error2 instanceof Error?error2.message:String(error2)}`,{cause:error2})}return session.spec?.harnessStateId??""},[DELETE_EXECUTION_CONTEXT_ACTIVITY_NAME]:async executionId=>{await deleteExecutionContextForExecution(store,logger2,executionId)},[COMPLETE_EXTERNAL_ACTIVITY_NAME]:async input=>{if(input.callbackToken===""){logger2.warn("CompleteExternalActivity called with empty token - skipping (backward compatibility)");return}let taskToken=import_node_buffer.Buffer.from(input.callbackToken,"base64");logger2.info("Completing external activity",{token_preview:input.callbackToken.length>20?`${input.callbackToken.slice(0,20)}...`:input.callbackToken,token_length:taskToken.length,has_result:input.result!==void 0,has_error:input.errorMessage!==void 0});let client=deps.client();input.errorMessage!==void 0?(logger2.info("Reporting failure to external activity",{error:input.errorMessage}),await client.activity.fail(taskToken,new Error(input.errorMessage))):(logger2.info("Reporting success to external activity"),await client.activity.complete(taskToken,input.result??null)),logger2.info("Successfully completed external activity")}}}function newAgentExecutionWorkerFactory(deps){return async({createWorker,client})=>{let activities=createAgentExecutionActivities({store:deps.store,logger:deps.logger,statusWriter:deps.statusWriter,client}),workflowSource=resolveWorkflowSource({workflowsEntryCandidates:[new URL("./workflows/index.js",__stigmerImportMetaUrl),new URL("./workflows/index.ts",__stigmerImportMetaUrl)],prebuiltSibling:new URL("./workflow-bundle-agent-execution.js",__stigmerImportMetaUrl)});return deps.logger.info("Creating agent-execution Temporal worker",{stigmer_queue:deps.temporalConfig.stigmerQueue,runner_queue:deps.temporalConfig.runnerQueue,workflow_source:workflowSource.kind}),createWorker({taskQueue:deps.temporalConfig.stigmerQueue,activities,workflows:workflowSource.kind==="prebuilt"?{workflowBundle:{codePath:workflowSource.codePath}}:{workflowsPath:workflowSource.workflowsPath}})}}var import_client69=__toESM(require_lib3(),1),import_worker=__toESM(require_lib6(),1),INITIAL_CONNECT_MAX_ATTEMPTS=3,INITIAL_CONNECT_BASE_DELAY_MS=1e3,DIAL_CONNECT_TIMEOUT_MS=1e3,HEALTH_CHECK_INTERVAL_MS=15e3,HEALTH_CHECK_TIMEOUT_MS=5e3,RECONNECT_BACKOFF_CAP_MS=3e4,TEMPORAL_HEALTH_SERVICE="temporal.api.workflowservice.v1.WorkflowService",TemporalManager=class{hostPort;namespace;connectionSecurity;logger;payloadCodecs;workerFactories;client;connection;nativeConnection;workers=[];connected=!1;consecutiveFails=0;lastAttemptMs=0;reconnecting=!1;monitor;closed=!1;reconnectHooks=[];constructor(options){this.hostPort=options.hostPort,this.namespace=options.namespace,this.connectionSecurity=options.connection,this.logger=options.logger,this.payloadCodecs=options.payloadCodecs,this.workerFactories=options.workerFactories}getClient(){return this.client}isConnected(){return this.connected}addReconnectHook(hook){this.reconnectHooks.push(hook)}async initialConnect(){this.logger.info("Attempting initial Temporal connection with retry",{host_port:this.hostPort,namespace:this.namespace,max_retries:INITIAL_CONNECT_MAX_ATTEMPTS});for(let attempt=1;attempt<=INITIAL_CONNECT_MAX_ATTEMPTS;attempt++)try{let{connection,client}=await this.dial();return this.connection=connection,this.client=client,this.connected=!0,this.consecutiveFails=0,this.logger.info("Initial Temporal connection successful",{host_port:this.hostPort,attempt}),!0}catch(error2){if(attempt<INITIAL_CONNECT_MAX_ATTEMPTS){let delayMs=2**(attempt-1)*INITIAL_CONNECT_BASE_DELAY_MS;this.logger.warn("Temporal connection failed, retrying",{error:errorMessage(error2),attempt,retry_in_ms:delayMs}),await sleep2(delayMs)}else this.logger.warn("Failed initial Temporal connection after all retries - will retry via health monitor",{error:errorMessage(error2),attempts:attempt}),this.connected=!1,this.consecutiveFails=attempt,this.lastAttemptMs=Date.now()}return!1}async startWorkers(){if(this.client===void 0){this.logger.warn("No Temporal client available, workers not started");return}try{await this.createAndRunWorkers(),this.logger.info("All Temporal workers started",{worker_count:this.workers.length})}catch(error2){this.logger.warn("Failed to start Temporal workers - health monitor will retry",{error:errorMessage(error2)})}}startHealthMonitor(){this.logger.info("Starting Temporal health monitor"),this.checkAndReconnect(),this.monitor=setInterval(()=>{this.checkAndReconnect()},HEALTH_CHECK_INTERVAL_MS),this.monitor.unref()}async close(){this.closed=!0,this.monitor!==void 0&&(clearInterval(this.monitor),this.monitor=void 0),await this.shutdownWorkers(),this.nativeConnection!==void 0&&(await closeQuietly(()=>this.nativeConnection.close(),this.logger),this.nativeConnection=void 0),this.connection!==void 0&&(await closeQuietly(()=>this.connection.close(),this.logger),this.connection=void 0),this.logger.info("Temporal manager closed")}async dial(){let connection=await import_client69.Connection.connect({address:this.hostPort,connectTimeout:DIAL_CONNECT_TIMEOUT_MS,...this.connectionSecurity}),client=new import_client69.Client({connection,namespace:this.namespace,...this.payloadCodecs.length>0?{dataConverter:{payloadCodecs:this.payloadCodecs}}:{}});return{connection,client}}async checkAndReconnect(){if(!this.closed){if(this.connection!==void 0){if(await this.testConnection(this.connection)){this.connected||(this.connected=!0,this.consecutiveFails=0);return}this.logger.warn("Temporal connection unhealthy, initiating reconnection")}await this.attemptReconnection()}}async testConnection(connection){try{return(await connection.withDeadline(Date.now()+HEALTH_CHECK_TIMEOUT_MS,()=>connection.healthService.check({service:TEMPORAL_HEALTH_SERVICE}))).status===1}catch{return!1}}async attemptReconnection(){if(this.reconnecting)return;let backoffMs=this.calculateBackoff();if(!(Date.now()-this.lastAttemptMs<backoffMs)){this.reconnecting=!0,this.lastAttemptMs=Date.now();try{this.logger.info("Attempting Temporal reconnection",{attempt:this.consecutiveFails+1,backoff_ms:backoffMs});let dialed;try{dialed=await this.dial()}catch(error2){this.consecutiveFails++,this.connected=!1,this.logger.warn("Temporal reconnection failed, will retry",{error:errorMessage(error2),consecutive_failures:this.consecutiveFails});return}if(this.closed){await closeQuietly(()=>dialed.connection.close(),this.logger);return}let oldConnection=this.connection;if(this.connection=dialed.connection,this.client=dialed.client,this.consecutiveFails=0,this.connected=!0,this.logger.info("Temporal reconnected successfully"),await this.restartWorkers(),this.closed){await this.shutdownWorkers(),this.nativeConnection!==void 0&&(await closeQuietly(()=>this.nativeConnection.close(),this.logger),this.nativeConnection=void 0),await closeQuietly(()=>dialed.connection.close(),this.logger);return}for(let hook of[...this.reconnectHooks])hook();oldConnection!==void 0&&await closeQuietly(()=>oldConnection.close(),this.logger)}finally{this.reconnecting=!1}}}calculateBackoff(){if(this.consecutiveFails===0)return 0;let backoff=2**(this.consecutiveFails-1)*1e3;return Math.min(backoff,RECONNECT_BACKOFF_CAP_MS)}async restartWorkers(){this.logger.info("Stopping old workers",{worker_count:this.workers.length}),await this.shutdownWorkers(),this.nativeConnection!==void 0&&(await closeQuietly(()=>this.nativeConnection.close(),this.logger),this.nativeConnection=void 0),this.logger.info("Creating and starting new workers");try{await this.createAndRunWorkers(),this.logger.info("Workers restarted successfully",{worker_count:this.workers.length})}catch(error2){this.logger.warn("Failed to restart workers",{error:errorMessage(error2)})}}async createAndRunWorkers(){let nativeConnection=await import_worker.NativeConnection.connect({address:this.hostPort,...this.connectionSecurity});this.nativeConnection=nativeConnection;let deps={createWorker:options=>{let workflows=options.workflows;return import_worker.Worker.create({connection:nativeConnection,namespace:this.namespace,taskQueue:options.taskQueue,activities:options.activities,...workflows,...this.payloadCodecs.length>0?{dataConverter:{payloadCodecs:this.payloadCodecs}}:{}})},client:()=>{if(this.client===void 0)throw new Error("Temporal client requested before any connection succeeded (boot ordering bug)");return this.client}};this.workers=[];for(let factory of this.workerFactories){let worker=await factory(deps),taskQueue=worker.options.taskQueue;this.logger.info("Temporal worker started",{task_queue:taskQueue});let runPromise=worker.run().catch(error2=>{this.logger.error("Temporal worker stopped with error",{task_queue:taskQueue,error:errorMessage(error2)})});this.workers.push({worker,runPromise})}}async shutdownWorkers(){for(let{worker}of this.workers)try{worker.shutdown()}catch{}await Promise.all(this.workers.map(({runPromise})=>runPromise)),this.workers=[]}};function errorMessage(error2){return error2 instanceof Error?error2.message:String(error2)}function sleep2(ms){return new Promise(resolve=>setTimeout(resolve,ms))}async function closeQuietly(close,logger2){try{await close()}catch(error2){logger2.warn("Error closing Temporal connection",{error:errorMessage(error2)})}}var ServerDecryptionPayloadCodec=class{inner;constructor(inner){this.inner=inner}async encode(payloads){return payloads}async decode(payloads){return this.inner.decode(payloads)}};function loadServerPayloadCodecs(resolveKey){let config2=loadPayloadEncryptionConfig(name=>process.env[name]);return config2===void 0?[]:[new ServerDecryptionPayloadCodec(new EncryptionPayloadCodec({...config2,resolveKey}))]}var import_client70=__toESM(require_lib3(),1);var TICK_WORKFLOW_TYPE="schedule/tick",TICK_ID_PREFIX=`${TICK_WORKFLOW_TYPE}/`,PROBE_ID_PREFIX="schedule/probe/";function artifactId(scheduleResourceId){return TICK_ID_PREFIX+scheduleResourceId}function resourceIdOf(artifactIdValue){return artifactIdValue.startsWith(TICK_ID_PREFIX)?artifactIdValue.slice(TICK_ID_PREFIX.length):artifactIdValue}var RECORD_TICK_ACTIVITY_NAME="stigmer/schedule/record-tick",START_SCHEDULED_RUN_ACTIVITY_NAME="stigmer/schedule/start-run",POLL_EXECUTION_PHASE_ACTIVITY_NAME="stigmer/schedule/poll-phase",RECORD_SUCCESSFUL_RUN_ACTIVITY_NAME="stigmer/schedule/record-success",RECORD_FAILED_RUN_ACTIVITY_NAME="stigmer/schedule/record-failure",TICK_FIRED="FIRED",TICK_SKIPPED_DELETED="SKIPPED_DELETED",TICK_SKIPPED_DISABLED="SKIPPED_DISABLED",TICK_SKIPPED_AUTO_PAUSED="SKIPPED_AUTO_PAUSED",RUN_STARTED="STARTED",RUN_ALREADY_STARTED="ALREADY_STARTED",RUN_SKIPPED="SKIPPED",RUN_TARGET_MISSING="TARGET_MISSING",RUN_REFUSED="REFUSED",PHASE_RUNNING="RUNNING",PHASE_COMPLETED="COMPLETED",PHASE_FAILED="FAILED",PHASE_CANCELLED="CANCELLED",PHASE_TERMINATED="TERMINATED",PHASE_GONE="GONE",FAILURE_START_FAILED="START_FAILED",FAILURE_RUN_FAILED="RUN_FAILED",FAILURE_RUN_TIMED_OUT="RUN_TIMED_OUT";function note(schedule){return`cron=${specOf(schedule).cron} tz=${specOf(schedule).timeZone}`}function desiredPaused(schedule){return!specOf(schedule).enabled||(schedule.status?.pausedReason??"")!==""}function specOf(schedule){return{cron:schedule.spec?.cron??"",timeZone:schedule.spec?.timeZone??"",enabled:schedule.spec?.enabled??!1}}var ScheduleArtifact=class{config;constructor(config2){this.config=config2}createOptions(schedule){let resourceId=schedule.metadata?.id??"";return{scheduleId:artifactId(resourceId),spec:{cronExpressions:[specOf(schedule).cron],timezone:specOf(schedule).timeZone},action:this.tickAction(resourceId),policies:{overlap:import_client70.ScheduleOverlapPolicy.SKIP,catchupWindow:this.config.catchupWindowMinutes*6e4,pauseOnFailure:!1},state:{paused:desiredPaused(schedule),note:note(schedule)}}}applyDesiredState(previous,schedule){let resourceId=schedule.metadata?.id??"";return{spec:{cronExpressions:[specOf(schedule).cron],timezone:specOf(schedule).timeZone},action:this.tickAction(resourceId),policies:{overlap:import_client70.ScheduleOverlapPolicy.SKIP,catchupWindow:this.config.catchupWindowMinutes*6e4,pauseOnFailure:!1},state:{...previous.state,paused:desiredPaused(schedule),note:note(schedule)}}}tickAction(resourceId){return{type:"startWorkflow",workflowId:artifactId(resourceId),workflowType:TICK_WORKFLOW_TYPE,args:[resourceId],taskQueue:this.config.stigmerQueue,workflowRunTimeout:this.config.tickRunTimeoutHours*36e5}}};var ScheduleTemporalConfig=class{stigmerQueue;catchupWindowMinutes;tickRunTimeoutHours;maxConsecutiveFailures;runTrackingTimeoutMinutes;reconciliationEnabled;reconciliationIntervalMinutes;executionProfileMaxToolRounds;executionProfileMaxCostUsd;runHistoryRetentionDays;constructor(stigmerQueue,catchupWindowMinutes,tickRunTimeoutHours,maxConsecutiveFailures,runTrackingTimeoutMinutes,reconciliationEnabled,reconciliationIntervalMinutes,executionProfileMaxToolRounds,executionProfileMaxCostUsd,runHistoryRetentionDays){this.stigmerQueue=stigmerQueue,this.catchupWindowMinutes=catchupWindowMinutes,this.tickRunTimeoutHours=tickRunTimeoutHours,this.maxConsecutiveFailures=maxConsecutiveFailures,this.runTrackingTimeoutMinutes=runTrackingTimeoutMinutes,this.reconciliationEnabled=reconciliationEnabled,this.reconciliationIntervalMinutes=reconciliationIntervalMinutes,this.executionProfileMaxToolRounds=executionProfileMaxToolRounds,this.executionProfileMaxCostUsd=executionProfileMaxCostUsd,this.runHistoryRetentionDays=runHistoryRetentionDays}resolvedRunTrackingTimeoutMinutes(){let ceiling=(this.tickRunTimeoutHours-1)*60;ceiling<1&&(ceiling=1);let resolved=this.runTrackingTimeoutMinutes;return resolved>ceiling&&(resolved=ceiling),resolved<1&&(resolved=1),resolved}resolvedMaxConsecutiveFailures(){return this.maxConsecutiveFailures<1?1:this.maxConsecutiveFailures}resolvedRunHistoryRetentionDays(){return this.runHistoryRetentionDays<1?1:this.runHistoryRetentionDays}resolvedReconciliationIntervalMinutes(){return this.reconciliationIntervalMinutes<1?1:this.reconciliationIntervalMinutes}};function newScheduleConfigFromEnv(){return new ScheduleTemporalConfig(getEnv("TEMPORAL_SCHEDULE_STIGMER_TASK_QUEUE","schedule_stigmer"),getEnvInt("STIGMER_SCHEDULES_CATCHUP_WINDOW_MINUTES",60),getEnvInt("STIGMER_SCHEDULES_TICK_RUN_TIMEOUT_HOURS",24),getEnvInt("STIGMER_SCHEDULES_MAX_CONSECUTIVE_FAILURES",5),getEnvInt("STIGMER_SCHEDULES_RUN_TRACKING_TIMEOUT_MINUTES",60),getEnvBool("STIGMER_SCHEDULES_RECONCILIATION_ENABLED",!0),getEnvInt("STIGMER_SCHEDULES_RECONCILIATION_INTERVAL_MINUTES",5),getEnvInt("STIGMER_SCHEDULES_EXECUTION_PROFILE_MAX_TOOL_ROUNDS",20),getEnvFloat("STIGMER_SCHEDULES_EXECUTION_PROFILE_MAX_COST_USD",1),getEnvInt("STIGMER_SCHEDULES_RUN_HISTORY_RETENTION_DAYS",90))}function getEnv(key,defaultValue){let value=process.env[key];return value!==void 0&&value!==""?value:defaultValue}function getEnvInt(key,defaultValue){let value=process.env[key];return value===void 0||value===""||!/^[+-]?\d+$/.test(value)?defaultValue:Number.parseInt(value,10)}function getEnvBool(key,defaultValue){let value=process.env[key];return value===void 0||value===""?defaultValue:["1","t","T","TRUE","true","True"].includes(value)?!0:["0","f","F","FALSE","false","False"].includes(value)?!1:defaultValue}function getEnvFloat(key,defaultValue){let value=process.env[key];if(value===void 0||value==="")return defaultValue;let parsed=Number(value);return Number.isFinite(parsed)?parsed:defaultValue}var RUN_LEDGER_ORIGIN_CRON="cron",RUN_LEDGER_ORIGIN_MANUAL="manual",RUN_LEDGER_OUTCOME_STARTED="started",RUN_LEDGER_OUTCOME_REFUSED="refused",RUN_LEDGER_OUTCOME_TARGET_MISSING="target_missing",RUN_LEDGER_OUTCOME_SKIPPED="skipped",RUN_LEDGER_OUTCOME_COMPLETED="completed",RUN_LEDGER_OUTCOME_FAILED="failed",RUN_LEDGER_OUTCOME_TIMED_OUT="timed_out";function rfc3339Seconds2(date2){return date2.toISOString().replace(/\.\d{3}Z$/,"Z")}async function recordRunLedgerStart(store,logger2,scheduleId,org,nominalFireTimeRfc3339,origin,runStart){let base={scheduleId,org,nominalFireTime:nominalFireTimeRfc3339,origin,executionId:runStart.executionId,reason:runStart.failureReason,recordedAt:""},record2;switch(runStart.outcome){case RUN_STARTED:case RUN_ALREADY_STARTED:record2={...base,outcome:RUN_LEDGER_OUTCOME_STARTED,completedAt:""};break;case RUN_REFUSED:record2={...base,outcome:RUN_LEDGER_OUTCOME_REFUSED,completedAt:rfc3339Seconds2(new Date)};break;case RUN_TARGET_MISSING:record2={...base,outcome:RUN_LEDGER_OUTCOME_TARGET_MISSING,completedAt:rfc3339Seconds2(new Date)};break;case RUN_SKIPPED:record2={...base,outcome:RUN_LEDGER_OUTCOME_SKIPPED,completedAt:rfc3339Seconds2(new Date)};break;default:return}try{await store.upsertScheduleRun(record2)}catch(error2){logger2.warn("Fire-ledger row not written (best-effort \u2014 the run itself is unaffected)",{schedule_id:scheduleId,nominal_fire_time:nominalFireTimeRfc3339,outcome:record2.outcome,error:error2 instanceof Error?error2.message:String(error2)})}}async function recordRunLedgerVerdict(store,logger2,scheduleId,outcome,reason){try{await store.markLatestScheduleRunTerminal(scheduleId,RUN_LEDGER_ORIGIN_CRON,outcome,reason,rfc3339Seconds2(new Date))}catch(error2){logger2.warn("Fire-ledger verdict not written (best-effort \u2014 the streak write is unaffected)",{schedule_id:scheduleId,outcome,error:error2 instanceof Error?error2.message:String(error2)})}}async function recordManualFire(store,logger2,scheduleId,org,nominalFireTimeRfc3339,outcome){let runStart={outcome:RUN_STARTED,executionId:"",trackingTimeoutMinutes:0,failureReason:""};switch(outcome.kind){case"started":runStart.outcome=RUN_STARTED,runStart.executionId=outcome.executionId;break;case"targetMissing":runStart.outcome=RUN_TARGET_MISSING,runStart.failureReason=outcome.reason;break;case"refused":runStart.outcome=RUN_REFUSED,runStart.failureReason=`run refused: ${outcome.reason}`;break;default:{let exhaustive=outcome;throw new Error(`unknown run outcome ${String(exhaustive)}`)}}await recordRunLedgerStart(store,logger2,scheduleId,org,nominalFireTimeRfc3339,RUN_LEDGER_ORIGIN_MANUAL,runStart)}async function pruneRunLedger(store,logger2,retentionDays){let cutoff=rfc3339Seconds2(new Date(Date.now()-retentionDays*24*36e5)),pruned;try{pruned=await store.pruneScheduleRuns(cutoff)}catch(error2){logger2.warn("Fire-ledger retention prune failed (retried next pass)",{cutoff,error:error2 instanceof Error?error2.message:String(error2)});return}pruned>0&&logger2.info("Fire-ledger retention prune complete",{pruned,cutoff})}function formatCounts(counts){return`rows=${counts.rowsExamined} armed=${counts.armed} repaired=${counts.repaired} orphans_deleted=${counts.orphansDeleted} failures=${counts.failures}`}var ScheduleReconciler=class{clientProvider;store;syncer;config;logger;interval;stopped=!1;kickQueued=!1;running=Promise.resolve();constructor(clientProvider,store,syncer,config2,logger2){this.clientProvider=clientProvider,this.store=store,this.syncer=syncer,this.config=config2,this.logger=logger2}async runPass(){let counts={rowsExamined:0,armed:0,repaired:0,orphansDeleted:0,failures:0},client=this.clientProvider();if(client===void 0)return this.logger.debug("Schedule reconciliation skipped \u2014 Temporal not connected"),counts;let artifacts=new Map;try{for await(let entry of client.schedule.list({pageSize:100}))entry.scheduleId.startsWith(TICK_ID_PREFIX)?artifacts.set(resourceIdOf(entry.scheduleId),{note:entry.state.note??"",paused:entry.state.paused}):entry.scheduleId.startsWith(PROBE_ID_PREFIX)}catch(error2){return this.logger.error("Schedule reconciliation could not list artifacts",{error:message2(error2)}),counts.failures++,counts}let rows;try{rows=await this.listSchedules()}catch(error2){return this.logger.error("Schedule reconciliation could not list rows",{error:message2(error2)}),counts.failures++,counts}for(let row of rows){counts.rowsExamined++;let resourceId=row.metadata?.id??"",actual=artifacts.get(resourceId);if(artifacts.delete(resourceId),actual===void 0){try{await this.syncer.ensureAndRecord(row)}catch(error2){counts.failures++,this.logger.error("Reconciliation failed to arm a schedule (pass continues)",{schedule_id:resourceId,error:message2(error2)});continue}counts.armed++,this.logger.info("Reconciliation armed a schedule without an artifact",{schedule_id:resourceId})}else if(actual.note!==note(row)||actual.paused!==desiredPaused(row)){try{await this.syncer.ensureAndRecord(row)}catch(error2){counts.failures++,this.logger.error("Reconciliation failed to repair a drifted artifact (pass continues)",{schedule_id:resourceId,error:message2(error2)});continue}counts.repaired++,this.logger.info("Reconciliation repaired a drifted artifact",{schedule_id:resourceId,actual_note:actual.note,actual_paused:actual.paused})}}for(let resourceId of artifacts.keys()){try{await this.store.getResource(ApiResourceKind.schedule,resourceId,ScheduleSchema);continue}catch(error2){if(!(error2 instanceof ResourceNotFoundError)){counts.failures++,this.logger.error("Reconciliation could not confirm an orphan (leaving it; pass continues)",{schedule_id:resourceId,error:message2(error2)});continue}}try{await this.syncer.teardown(resourceId)}catch(error2){counts.failures++,this.logger.error("Reconciliation failed to delete an orphaned artifact (pass continues)",{schedule_id:resourceId,error:message2(error2)});continue}counts.orphansDeleted++,this.logger.info("Reconciliation deleted an orphaned artifact",{schedule_id:resourceId})}return await pruneRunLedger(this.store,this.logger,this.config.resolvedRunHistoryRetentionDays()),this.logger.info("Schedule reconciliation pass complete",{counts:formatCounts(counts)}),counts}startReconciliation(){return this.enqueuePass(),this.config.reconciliationEnabled?(this.interval=setInterval(()=>{this.enqueuePass()},this.config.resolvedReconciliationIntervalMinutes()*6e4),this.interval.unref()):this.logger.info("Periodic schedule reconciliation disabled (STIGMER_SCHEDULES_RECONCILIATION_ENABLED=false) \u2014 reconnect passes still run"),()=>{this.enqueuePass()}}async stop(){this.stopped=!0,this.interval!==void 0&&(clearInterval(this.interval),this.interval=void 0),await this.running}enqueuePass(){return this.stopped?Promise.resolve():this.kickQueued?this.running:(this.kickQueued=!0,this.running=this.running.then(async()=>{if(this.kickQueued=!1,!this.stopped)try{await this.runPass()}catch(error2){this.logger.error("Schedule reconciliation pass failed unexpectedly (the loop continues; the next tick or kick retries)",{error:message2(error2)})}}),this.running)}async listSchedules(){let blobs=await this.store.listResources(ApiResourceKind.schedule),schedules=[];for(let data of blobs)try{schedules.push(fromBinary2(ScheduleSchema,data))}catch(error2){this.logger.warn("Schedule reconciliation skipped a corrupt row",{error:message2(error2)})}return schedules}};function message2(error2){return error2 instanceof Error?error2.message:String(error2)}function scheduleModelPinningRefusal(spec){let agent=spec?.target.case==="agent"?spec.target.value:void 0;return agent?.harness!==Harness.CURSOR||(agent.runConfig?.modelName??"").trim()!==""?"":"spec.agent.run_config.model_name must name a pinned model when the run would use the Cursor harness \u2014 with no pinned model Cursor runs Auto, whose price variant follows the provider account's out-of-band default speed setting (stigmer/stigmer#362)"}function ensureStatus(schedule){return schedule.status===void 0&&(schedule.status=create2(ScheduleStatusSchema)),schedule.status}var SESSION_SUBJECT_PREFIX="Scheduled run: ",SCHEDULE_ID_LABEL_KEY2="stigmer.ai/schedule-id";function scheduledExecutionName(scheduleResourceId,nominalFireTime){return`${scheduleResourceId.toLowerCase().replaceAll("_","-")}-${executionNameFireTime(nominalFireTime)}`}function executionNameFireTime(nominal){let p3=utcParts(nominal);return`${p3.year}${p3.month}${p3.day}t${p3.hour}${p3.minute}${p3.second}z`}function composeMessage(schedule,nominalFireTime){let requested=schedule.spec?.timeZone??"",{zoneName,formatted}=fireContextLine(requested,nominalFireTime);return`${invocationOf(schedule)?.message??""}
-(Scheduled fire time: ${formatted} (${zoneName}))`}function fireContextLine(requestedZone,nominal){let zone=requestedZone,parts;try{parts=fireContextFormatter(zone===""?"UTC":zone).formatToParts(nominal),zone===""&&(zone="UTC")}catch{zone="UTC",parts=fireContextFormatter("UTC").formatToParts(nominal)}let get26=type2=>parts.find(part=>part.type===type2)?.value??"",formatted=`${get26("weekday")}, ${get26("year")}-${get26("month")}-${get26("day")} ${get26("hour")}:${get26("minute")}`;return{zoneName:zone,formatted}}function fireContextFormatter(timeZone){return new Intl.DateTimeFormat("en-US",{timeZone,weekday:"long",year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",hourCycle:"h23"})}function utcParts(date2){let pad=(value,width)=>String(value).padStart(width,"0");return{year:pad(date2.getUTCFullYear(),4),month:pad(date2.getUTCMonth()+1,2),day:pad(date2.getUTCDate(),2),hour:pad(date2.getUTCHours(),2),minute:pad(date2.getUTCMinutes(),2),second:pad(date2.getUTCSeconds(),2)}}function invocationOf(schedule){return schedule.spec?.target.case==="agent"?schedule.spec.target.value:void 0}var RunStarter=class{deps;constructor(deps){this.deps=deps}async startRun(schedule,nominalFireTime){let{store,logger:logger2}=this.deps,scheduleId=schedule.metadata?.id??"",org=schedule.metadata?.org??"",resolved=await this.resolveTargetAgent(schedule);if(resolved.agent===void 0)return logger2.warn("Schedule fire has no target agent",{schedule_id:scheduleId,reason:resolved.missingReason}),{kind:"targetMissing",reason:resolved.missingReason};let pinningRefusal=scheduleModelPinningRefusal(schedule.spec);if(pinningRefusal!=="")return logger2.error("Schedule fire refused by the model-pinning backstop",{schedule_id:scheduleId,reason:pinningRefusal}),{kind:"refused",reason:pinningRefusal};let executionName=scheduledExecutionName(scheduleId,nominalFireTime),existing;try{existing=await findResourceBySlug(store,ApiResourceKind.agent_execution,AgentExecutionSchema,executionName,org)}catch(error2){throw new Error(`look up execution ${executionName}: ${error2 instanceof Error?error2.message:String(error2)}`,{cause:error2})}if(existing!==void 0){let executionId2=existing.metadata?.id??"";return logger2.info("Schedule fire already has its execution (idempotent retry)",{schedule_id:scheduleId,execution_id:executionId2}),await this.stampLastExecutionId(scheduleId,executionId2),{kind:"started",executionId:executionId2,alreadyExisted:!0}}let fireCaller;if(this.deps.fireCallerMint!==void 0)try{fireCaller=await this.deps.fireCallerMint.mintFireCaller(org,scheduleId)}catch(error2){if(error2 instanceof ScheduleFireCallerRefusedError)return logger2.error("Schedule fire refused by the fire-caller mint",{schedule_id:scheduleId,org,reason:error2.message}),{kind:"refused",reason:error2.message};throw new Error(`mint schedule fire caller for ${scheduleId}: ${error2 instanceof Error?error2.message:String(error2)}`,{cause:error2})}let created;try{created=await this.deps.executions.create(this.buildExecutionRequest(schedule,resolved.agent,executionName,nominalFireTime),fireCaller)}catch(error2){if(!(error2 instanceof ConnectError))throw error2;switch(error2.code){case Code.AlreadyExists:{let winner;try{winner=await findResourceBySlug(store,ApiResourceKind.agent_execution,AgentExecutionSchema,executionName,org)}catch(findError){throw new Error(`duplicate-check refusal but no execution row for ${executionName}: ${findError instanceof Error?findError.message:String(findError)}`,{cause:findError})}if(winner===void 0)throw new Error(`duplicate-check refusal but no execution row for ${executionName}: ${error2.message}`,{cause:error2});let executionId2=winner.metadata?.id??"";return await this.stampLastExecutionId(scheduleId,executionId2),{kind:"started",executionId:executionId2,alreadyExisted:!0}}case Code.FailedPrecondition:case Code.PermissionDenied:case Code.NotFound:case Code.InvalidArgument:case Code.ResourceExhausted:return logger2.error("Schedule fire refused by a launch gate",{schedule_id:scheduleId,org,code:Code[error2.code],reason:error2.rawMessage}),{kind:"refused",reason:error2.rawMessage};default:throw error2}}let executionId=created.metadata?.id??"";return await this.stampLastExecutionId(scheduleId,executionId),{kind:"started",executionId,alreadyExisted:!1}}async resolveTargetAgent(schedule){let ref=invocationOf(schedule)?.agentRef,slug=ref?.slug??"";if(slug==="")return{missingReason:"schedule has no agent target"};let org=ref?.org??"";org===""&&(org=schedule.metadata?.org??"");let agent;try{agent=await findResourceBySlug(this.deps.store,ApiResourceKind.agent,AgentSchema,slug,org)}catch(error2){throw new Error(`resolve target agent ${org}/${slug}: ${error2 instanceof Error?error2.message:String(error2)}`,{cause:error2})}return agent===void 0?{missingReason:`target agent ${org}/${slug} not found`}:{agent,missingReason:""}}buildExecutionRequest(schedule,agent,executionName,nominalFireTime){let invocation=invocationOf(schedule),runConfig=invocation?.runConfig,executionConfig=create2(ExecutionConfigSchema,{approvalMode:ApprovalMode.UNATTENDED,maxToolRounds:clampedRunBound(runConfig?.maxToolRounds??0,this.deps.config.executionProfileMaxToolRounds),maxCostUsd:clampedRunBound(runConfig?.maxCostUsd??0,this.deps.config.executionProfileMaxCostUsd)}),model=(runConfig?.modelName??"").trim();model!==""&&(executionConfig.modelName=model),runConfig!==void 0&&runConfig.serviceTier!==ServiceTier.UNSPECIFIED&&(executionConfig.serviceTier=runConfig.serviceTier),runConfig!==void 0&&runConfig.thinkingMode!==ThinkingMode.UNSPECIFIED&&(executionConfig.thinkingMode=runConfig.thinkingMode);let sessionSpec=create2(SessionSpecSchema,{subject:SESSION_SUBJECT_PREFIX+(schedule.metadata?.slug??""),workspaceEntries:invocation?.workspaceEntries??[]});return invocation!==void 0&&invocation.harness!==Harness.UNSPECIFIED&&(sessionSpec.harness=invocation.harness),create2(AgentExecutionSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"AgentExecution",metadata:create2(ApiResourceMetadataSchema,{name:executionName,org:schedule.metadata?.org??"",labels:{[SCHEDULE_ID_LABEL_KEY2]:schedule.metadata?.id??""}}),spec:create2(AgentExecutionSpecSchema,{agentId:agent.metadata?.id??"",message:composeMessage(schedule,nominalFireTime),sessionSpec,executionConfig})})}async stampLastExecutionId(scheduleId,executionId){try{await this.deps.store.updateResource(ApiResourceKind.schedule,scheduleId,ScheduleSchema,live=>{let status=ensureStatus(live);status.lastExecutionId=executionId,bumpStatusAudit(status)})}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw new Error(`stamp last_execution_id on schedule ${scheduleId}: ${error2 instanceof Error?error2.message:String(error2)}`,{cause:error2})}}};function clampedRunBound(owner,platform2){return owner<=0?Math.max(platform2,0):platform2<=0?owner:Math.min(owner,platform2)}var import_client71=__toESM(require_lib3(),1);var TemporalUnavailableError=class extends Error{constructor(){super("temporal is not connected"),this.name="TemporalUnavailableError"}},ScheduleSyncer=class{clientProvider;store;artifact;logger;constructor(clientProvider,store,artifact,logger2){this.clientProvider=clientProvider,this.store=store,this.artifact=artifact,this.logger=logger2}async ensureAndRecord(schedule){let client=this.clientProvider();if(client===void 0)throw new TemporalUnavailableError;let resourceId=schedule.metadata?.id??"",id=artifactId(resourceId);try{await client.schedule.create(this.artifact.createOptions(schedule)),this.logger.info("Created schedule artifact",{artifact_id:id,note:note(schedule),paused:desiredPaused(schedule)})}catch(error2){if(!(error2 instanceof import_client71.ScheduleAlreadyRunning))throw new Error(`create schedule artifact ${id}: ${message3(error2)}`,{cause:error2});try{await client.schedule.getHandle(id).update(previous=>this.artifact.applyDesiredState(previous,schedule))}catch(updateError){throw new Error(`update schedule artifact ${id}: ${message3(updateError)}`,{cause:updateError})}this.logger.info("Updated schedule artifact",{artifact_id:id,note:note(schedule),paused:desiredPaused(schedule)})}return this.recordNextFireAt(schedule)}async peekNextFireAt(schedule){if(desiredPaused(schedule))return;let client=this.clientProvider();if(client===void 0)throw new TemporalUnavailableError;let description;try{description=await client.schedule.getHandle(artifactId(schedule.metadata?.id??"")).describe()}catch(error2){throw new Error(`describe schedule artifact: ${message3(error2)}`,{cause:error2})}return description.info.nextActionTimes[0]}async teardown(resourceId){let client=this.clientProvider();if(client===void 0)throw new TemporalUnavailableError;let id=artifactId(resourceId);try{await client.schedule.getHandle(id).delete()}catch(error2){if(error2 instanceof import_client71.ScheduleNotFoundError){this.logger.info("Schedule artifact already gone",{artifact_id:id});return}throw new Error(`delete schedule artifact ${id}: ${message3(error2)}`,{cause:error2})}this.logger.info("Deleted schedule artifact",{artifact_id:id})}async recordNextFireAt(schedule){let nextFireAt=await this.peekNextFireAt(schedule);try{await this.store.updateResource(ApiResourceKind.schedule,schedule.metadata?.id??"",ScheduleSchema,live=>{let status=ensureStatus(live);status.nextFireAt=nextFireAt===void 0?void 0:timestampFromDate(nextFireAt),bumpStatusAudit(status)})}catch(error2){if(error2 instanceof ResourceNotFoundError)return this.logger.info("Schedule row gone before next_fire_at stamp \u2014 skipping",{schedule_id:schedule.metadata?.id??""}),nextFireAt;throw new Error(`stamp next_fire_at: ${message3(error2)}`,{cause:error2})}return nextFireAt}};function message3(error2){return error2 instanceof Error?error2.message:String(error2)}function createScheduleTickActivities(deps){return{[RECORD_TICK_ACTIVITY_NAME]:(scheduleResourceId,nominalFireTimeRfc3339)=>recordTick(deps,scheduleResourceId,nominalFireTimeRfc3339),[START_SCHEDULED_RUN_ACTIVITY_NAME]:(scheduleResourceId,nominalFireTimeRfc3339)=>startScheduledRun(deps,scheduleResourceId,nominalFireTimeRfc3339),[POLL_EXECUTION_PHASE_ACTIVITY_NAME]:executionId=>pollExecutionPhase(deps,executionId),[RECORD_SUCCESSFUL_RUN_ACTIVITY_NAME]:scheduleResourceId=>recordSuccessfulRun(deps,scheduleResourceId),[RECORD_FAILED_RUN_ACTIVITY_NAME]:(scheduleResourceId,reason,kind)=>recordFailedRun(deps,scheduleResourceId,reason,kind)}}async function recordTick(deps,scheduleResourceId,nominalFireTimeRfc3339){let schedule;try{schedule=await deps.store.getResource(ApiResourceKind.schedule,scheduleResourceId,ScheduleSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return deps.logger.info("Schedule tick no-op \u2014 row deleted (orphaned artifact; the reconciliation pass removes it)",{schedule_id:scheduleResourceId}),TICK_SKIPPED_DELETED;throw new Error(`load schedule ${scheduleResourceId}: ${message4(error2)}`,{cause:error2})}if(!(schedule.spec?.enabled??!1))return deps.logger.info("Schedule tick no-op \u2014 owner-disabled",{schedule_id:scheduleResourceId}),TICK_SKIPPED_DISABLED;let pausedReason=schedule.status?.pausedReason??"";return pausedReason!==""?(deps.logger.info("Schedule tick no-op \u2014 platform-paused",{schedule_id:scheduleResourceId,reason:pausedReason}),TICK_SKIPPED_AUTO_PAUSED):(await recordFire(deps,schedule,nominalFireTimeRfc3339),TICK_FIRED)}async function recordFire(deps,schedule,nominalFireTimeRfc3339){let nominal=parseRfc3339(nominalFireTimeRfc3339),nextFireAt,peekFailed=!1;try{nextFireAt=await deps.syncer.peekNextFireAt(schedule)}catch(error2){peekFailed=!0,deps.logger.warn("Could not refresh next_fire_at during tick (recording the fire without it)",{schedule_id:schedule.metadata?.id??"",error:message4(error2)})}try{await deps.store.updateResource(ApiResourceKind.schedule,schedule.metadata?.id??"",ScheduleSchema,live=>{let status=ensureStatus(live);status.lastFireAt=timestampFromDate(nominal),peekFailed||(status.nextFireAt=nextFireAt===void 0?void 0:timestampFromDate(nextFireAt)),bumpStatusAudit(status)})}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw new Error(`record schedule fire on status: ${message4(error2)}`,{cause:error2})}deps.logger.info("Schedule fire recorded",{schedule_id:schedule.metadata?.id??"",nominal_fire_time:nominalFireTimeRfc3339})}async function startScheduledRun(deps,scheduleResourceId,nominalFireTimeRfc3339){let trackingBudget=deps.config.resolvedRunTrackingTimeoutMinutes(),schedule;try{schedule=await deps.store.getResource(ApiResourceKind.schedule,scheduleResourceId,ScheduleSchema)}catch(error2){if(!(error2 instanceof ResourceNotFoundError))throw new Error(`load schedule ${scheduleResourceId}: ${message4(error2)}`,{cause:error2});schedule=void 0}if(schedule===void 0||!(schedule.spec?.enabled??!1)||(schedule.status?.pausedReason??"")!==""){deps.logger.info("Schedule run start no-op \u2014 row deleted/disabled/paused between record and start",{schedule_id:scheduleResourceId});let skipped={outcome:RUN_SKIPPED,executionId:"",trackingTimeoutMinutes:trackingBudget,failureReason:""};return schedule!==void 0&&await recordRunLedgerStart(deps.store,deps.logger,scheduleResourceId,schedule.metadata?.org??"",nominalFireTimeRfc3339,RUN_LEDGER_ORIGIN_CRON,skipped),skipped}let nominal=parseRfc3339(nominalFireTimeRfc3339),outcome=await deps.runStarter.startRun(schedule,nominal),result={outcome:RUN_STARTED,executionId:"",trackingTimeoutMinutes:trackingBudget,failureReason:""};switch(outcome.kind){case"started":result.outcome=outcome.alreadyExisted?RUN_ALREADY_STARTED:RUN_STARTED,result.executionId=outcome.executionId,deps.logger.info("Schedule fire started its run",{schedule_id:scheduleResourceId,execution_id:outcome.executionId,already_existed:outcome.alreadyExisted});break;case"targetMissing":result.outcome=RUN_TARGET_MISSING,result.failureReason=outcome.reason;break;case"refused":result.outcome=RUN_REFUSED,result.failureReason=`run refused: ${outcome.reason}`;break;default:{let exhaustive=outcome;throw new Error(`unknown run outcome ${String(exhaustive)}`)}}return await recordRunLedgerStart(deps.store,deps.logger,scheduleResourceId,schedule.metadata?.org??"",nominalFireTimeRfc3339,RUN_LEDGER_ORIGIN_CRON,result),result}async function pollExecutionPhase(deps,executionId){let phase;try{phase=(await deps.store.getResource(ApiResourceKind.agent_execution,executionId,AgentExecutionSchema)).status?.phase??ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED}catch(error2){if(error2 instanceof ResourceNotFoundError)return PHASE_GONE;throw new Error(`load execution ${executionId}: ${message4(error2)}`,{cause:error2})}switch(phase){case ExecutionPhase.EXECUTION_COMPLETED:return PHASE_COMPLETED;case ExecutionPhase.EXECUTION_CANCELLED:return PHASE_CANCELLED;case ExecutionPhase.EXECUTION_TERMINATED:return PHASE_TERMINATED;case ExecutionPhase.EXECUTION_FAILED:return PHASE_FAILED;default:return PHASE_RUNNING}}async function recordSuccessfulRun(deps,scheduleResourceId){try{await deps.store.updateResource(ApiResourceKind.schedule,scheduleResourceId,ScheduleSchema,live=>{let status=ensureStatus(live);status.consecutiveFailures=0,bumpStatusAudit(status)})}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw new Error(`reset failure streak on schedule ${scheduleResourceId}: ${message4(error2)}`,{cause:error2})}await recordRunLedgerVerdict(deps.store,deps.logger,scheduleResourceId,RUN_LEDGER_OUTCOME_COMPLETED,""),deps.logger.info("Schedule run completed \u2014 failure streak reset",{schedule_id:scheduleResourceId})}async function recordFailedRun(deps,scheduleResourceId,reason,kind){let threshold=deps.config.resolvedMaxConsecutiveFailures(),pausedReason=`Paused after ${threshold} consecutive failed runs. Last failure: ${reason}`,recorded={consecutiveFailures:0,paused:!1},crossedThreshold=!1;try{await deps.store.updateResource(ApiResourceKind.schedule,scheduleResourceId,ScheduleSchema,live=>{let status=ensureStatus(live);status.consecutiveFailures++,status.consecutiveFailures>=threshold&&status.pausedReason===""&&(status.pausedReason=pausedReason,crossedThreshold=!0),status.consecutiveFailures>=threshold&&(status.nextFireAt=void 0),bumpStatusAudit(status),recorded={consecutiveFailures:status.consecutiveFailures,paused:status.pausedReason!==""}})}catch(error2){if(error2 instanceof ResourceNotFoundError)return deps.logger.info("Schedule run failure not recorded \u2014 row deleted mid-track",{schedule_id:scheduleResourceId,reason}),{consecutiveFailures:0,paused:!1};throw new Error(`record failed run on schedule ${scheduleResourceId}: ${message4(error2)}`,{cause:error2})}switch(deps.logger.warn("Schedule run failed",{failure_kind:kind,schedule_id:scheduleResourceId,consecutive_failures:recorded.consecutiveFailures,threshold,paused:recorded.paused,reason}),kind){case FAILURE_RUN_FAILED:await recordRunLedgerVerdict(deps.store,deps.logger,scheduleResourceId,RUN_LEDGER_OUTCOME_FAILED,reason);break;case FAILURE_RUN_TIMED_OUT:await recordRunLedgerVerdict(deps.store,deps.logger,scheduleResourceId,RUN_LEDGER_OUTCOME_TIMED_OUT,reason);break;case FAILURE_START_FAILED:break;default:{let exhaustive=kind;throw new Error(`unknown failure kind ${String(exhaustive)}`)}}if(crossedThreshold)try{let schedule=await deps.store.getResource(ApiResourceKind.schedule,scheduleResourceId,ScheduleSchema);await deps.syncer.ensureAndRecord(schedule)}catch(error2){deps.logger.error("Paused schedule's artifact not yet converged (the reconciliation pass will pause it)",{schedule_id:scheduleResourceId,error:message4(error2)})}return recorded}function parseRfc3339(value){let parsed=new Date(value);if(Number.isNaN(parsed.getTime()))throw new Error(`parse nominal fire time "${value}": invalid RFC-3339`);return parsed}function message4(error2){return error2 instanceof Error?error2.message:String(error2)}function newScheduleWorkerFactory(deps){return async({createWorker})=>{let activities=createScheduleTickActivities({store:deps.store,config:deps.config,syncer:deps.syncer,runStarter:deps.runStarter,logger:deps.logger}),workflowSource=resolveWorkflowSource({workflowsEntryCandidates:[new URL("./workflows/index.js",__stigmerImportMetaUrl),new URL("./workflows/index.ts",__stigmerImportMetaUrl)],prebuiltSibling:new URL("./workflow-bundle-schedule.js",__stigmerImportMetaUrl)});return deps.logger.info("Creating schedule-clock Temporal worker",{queue:deps.config.stigmerQueue,workflow_source:workflowSource.kind}),createWorker({taskQueue:deps.config.stigmerQueue,activities,workflows:workflowSource.kind==="prebuilt"?{workflowBundle:{codePath:workflowSource.codePath}}:{workflowsPath:workflowSource.workflowsPath}})}}var file_ai_stigmer_agentic_schedule_v1_io=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvc2NoZWR1bGUvdjEvaW8ucHJvdG8SHmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MSIjCgpTY2hlZHVsZUlkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEieAoaR2V0U2NoZWR1bGVzQnlBZ2VudFJlcXVlc3QSGAoIYWdlbnRfaWQYASABKAlCBrpIA8gBARIzCglwYWdlX2luZm8YAiABKAsyIC5haS5zdGlnbWVyLmNvbW1vbnMucnBjLlBhZ2VJbmZvEgsKA29yZxgDIAEoCSJcCgxTY2hlZHVsZUxpc3QSEwoLdG90YWxfY291bnQYASABKAUSNwoFaXRlbXMYAiADKAsyKC5haS5zdGlnbWVyLmFnZW50aWMuc2NoZWR1bGUudjEuU2NoZWR1bGUi4gEKFExpc3RTY2hlZHVsZXNSZXF1ZXN0EhQKA29yZxgBIAEoCUIHukgEcgIQARJQCgZsYWJlbHMYAiADKAsyQC5haS5zdGlnbWVyLmFnZW50aWMuc2NoZWR1bGUudjEuTGlzdFNjaGVkdWxlc1JlcXVlc3QuTGFiZWxzRW50cnkSMwoJcGFnZV9pbmZvGAMgASgLMiAuYWkuc3RpZ21lci5jb21tb25zLnJwYy5QYWdlSW5mbxotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIsYBChVTY2hlZHVsZVRyaWdnZXJSZXN1bHQSOgoIc2NoZWR1bGUYASABKAsyKC5haS5zdGlnbWVyLmFnZW50aWMuc2NoZWR1bGUudjEuU2NoZWR1bGUSQwoHb3V0Y29tZRgCIAEoDjIyLmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5TY2hlZHVsZVJ1bk91dGNvbWUSFAoMZXhlY3V0aW9uX2lkGAMgASgJEhYKDnJlZnVzYWxfcmVhc29uGAQgASgJIvcCCgtTY2hlZHVsZVJ1bhITCgtzY2hlZHVsZV9pZBgBIAEoCRILCgNvcmcYAiABKAkSNQoRbm9taW5hbF9maXJlX3RpbWUYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEkEKBm9yaWdpbhgEIAEoDjIxLmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5TY2hlZHVsZVJ1bk9yaWdpbhJDCgdvdXRjb21lGAUgASgOMjIuYWkuc3RpZ21lci5hZ2VudGljLnNjaGVkdWxlLnYxLlNjaGVkdWxlUnVuT3V0Y29tZRIOCgZyZWFzb24YBiABKAkSFAoMZXhlY3V0aW9uX2lkGAcgASgJEi8KC3JlY29yZGVkX2F0GAggASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIwCgxjb21wbGV0ZWRfYXQYCSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wImsKF0xpc3RTY2hlZHVsZVJ1bnNSZXF1ZXN0EhsKC3NjaGVkdWxlX2lkGAEgASgJQga6SAPIAQESMwoJcGFnZV9pbmZvGAIgASgLMiAuYWkuc3RpZ21lci5jb21tb25zLnJwYy5QYWdlSW5mbyJiCg9TY2hlZHVsZVJ1bkxpc3QSEwoLdG90YWxfY291bnQYASABKAUSOgoFaXRlbXMYAiADKAsyKy5haS5zdGlnbWVyLmFnZW50aWMuc2NoZWR1bGUudjEuU2NoZWR1bGVSdW4qdgoRU2NoZWR1bGVSdW5PcmlnaW4SIwofU0NIRURVTEVfUlVOX09SSUdJTl9VTlNQRUNJRklFRBAAEhwKGFNDSEVEVUxFX1JVTl9PUklHSU5fQ1JPThABEh4KGlNDSEVEVUxFX1JVTl9PUklHSU5fTUFOVUFMEAIqsgIKElNjaGVkdWxlUnVuT3V0Y29tZRIkCiBTQ0hFRFVMRV9SVU5fT1VUQ09NRV9VTlNQRUNJRklFRBAAEiAKHFNDSEVEVUxFX1JVTl9PVVRDT01FX1NUQVJURUQQARIgChxTQ0hFRFVMRV9SVU5fT1VUQ09NRV9SRUZVU0VEEAISJwojU0NIRURVTEVfUlVOX09VVENPTUVfVEFSR0VUX01JU1NJTkcQAxIgChxTQ0hFRFVMRV9SVU5fT1VUQ09NRV9TS0lQUEVEEAQSIgoeU0NIRURVTEVfUlVOX09VVENPTUVfQ09NUExFVEVEEAUSHwobU0NIRURVTEVfUlVOX09VVENPTUVfRkFJTEVEEAYSIgoeU0NIRURVTEVfUlVOX09VVENPTUVfVElNRURfT1VUEAdiBnByb3RvMw",[file_ai_stigmer_agentic_schedule_v1_api,file_ai_stigmer_commons_rpc_pagination,file_buf_validate_validate,file_google_protobuf_timestamp]);var ScheduleListSchema=messageDesc2(file_ai_stigmer_agentic_schedule_v1_io,2);var ScheduleTriggerResultSchema=messageDesc2(file_ai_stigmer_agentic_schedule_v1_io,4),ScheduleRunSchema=messageDesc2(file_ai_stigmer_agentic_schedule_v1_io,5);var ScheduleRunListSchema=messageDesc2(file_ai_stigmer_agentic_schedule_v1_io,7),ScheduleRunOrigin;(function(ScheduleRunOrigin2){ScheduleRunOrigin2[ScheduleRunOrigin2.UNSPECIFIED=0]="UNSPECIFIED",ScheduleRunOrigin2[ScheduleRunOrigin2.CRON=1]="CRON",ScheduleRunOrigin2[ScheduleRunOrigin2.MANUAL=2]="MANUAL"})(ScheduleRunOrigin||(ScheduleRunOrigin={}));var ScheduleRunOutcome;(function(ScheduleRunOutcome2){ScheduleRunOutcome2[ScheduleRunOutcome2.UNSPECIFIED=0]="UNSPECIFIED",ScheduleRunOutcome2[ScheduleRunOutcome2.STARTED=1]="STARTED",ScheduleRunOutcome2[ScheduleRunOutcome2.REFUSED=2]="REFUSED",ScheduleRunOutcome2[ScheduleRunOutcome2.TARGET_MISSING=3]="TARGET_MISSING",ScheduleRunOutcome2[ScheduleRunOutcome2.SKIPPED=4]="SKIPPED",ScheduleRunOutcome2[ScheduleRunOutcome2.COMPLETED=5]="COMPLETED",ScheduleRunOutcome2[ScheduleRunOutcome2.FAILED=6]="FAILED",ScheduleRunOutcome2[ScheduleRunOutcome2.TIMED_OUT=7]="TIMED_OUT"})(ScheduleRunOutcome||(ScheduleRunOutcome={}));var file_ai_stigmer_agentic_schedule_v1_command=fileDesc("CixhaS9zdGlnbWVyL2FnZW50aWMvc2NoZWR1bGUvdjEvY29tbWFuZC5wcm90bxIeYWkuc3RpZ21lci5hZ2VudGljLnNjaGVkdWxlLnYxMsEGChlTY2hlZHVsZUNvbW1hbmRDb250cm9sbGVyElsKBWFwcGx5EiguYWkuc3RpZ21lci5hZ2VudGljLnNjaGVkdWxlLnYxLlNjaGVkdWxlGiguYWkuc3RpZ21lci5hZ2VudGljLnNjaGVkdWxlLnYxLlNjaGVkdWxlEmIKBmNyZWF0ZRIoLmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5TY2hlZHVsZRooLmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5TY2hlZHVsZSIE0LgYARKUAQoGdXBkYXRlEiguYWkuc3RpZ21lci5hZ2VudGljLnNjaGVkdWxlLnYxLlNjaGVkdWxlGiguYWkuc3RpZ21lci5hZ2VudGljLnNjaGVkdWxlLnYxLlNjaGVkdWxlIjbCuBgyCAIQOCILbWV0YWRhdGEuaWQqH3VuYXV0aG9yaXplZCB0byB1cGRhdGUgc2NoZWR1bGUSkAEKBmRlbGV0ZRIqLmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5TY2hlZHVsZUlkGiguYWkuc3RpZ21lci5hZ2VudGljLnNjaGVkdWxlLnYxLlNjaGVkdWxlIjDCuBgsCAMQOCIFdmFsdWUqH3VuYXV0aG9yaXplZCB0byBkZWxldGUgc2NoZWR1bGUSkAEKBnJlc3VtZRIqLmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5TY2hlZHVsZUlkGiguYWkuc3RpZ21lci5hZ2VudGljLnNjaGVkdWxlLnYxLlNjaGVkdWxlIjDCuBgsCAIQOCIFdmFsdWUqH3VuYXV0aG9yaXplZCB0byByZXN1bWUgc2NoZWR1bGUSnwEKB3RyaWdnZXISKi5haS5zdGlnbWVyLmFnZW50aWMuc2NoZWR1bGUudjEuU2NoZWR1bGVJZBo1LmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5TY2hlZHVsZVRyaWdnZXJSZXN1bHQiMcK4GC0IAhA4IgV2YWx1ZSogdW5hdXRob3JpemVkIHRvIHRyaWdnZXIgc2NoZWR1bGUaBKD/KzhiBnByb3RvMw",[file_ai_stigmer_agentic_schedule_v1_api,file_ai_stigmer_agentic_schedule_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ScheduleCommandController=serviceDesc(file_ai_stigmer_agentic_schedule_v1_command,0);var file_ai_stigmer_agentic_schedule_v1_query=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvc2NoZWR1bGUvdjEvcXVlcnkucHJvdG8SHmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MTLGBQoXU2NoZWR1bGVRdWVyeUNvbnRyb2xsZXISigEKA2dldBIqLmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5TY2hlZHVsZUlkGiguYWkuc3RpZ21lci5hZ2VudGljLnNjaGVkdWxlLnYxLlNjaGVkdWxlIi3CuBgpCAEQOCIFdmFsdWUqHHVuYXV0aG9yaXplZCB0byBnZXQgc2NoZWR1bGUSdgoOZ2V0QnlSZWZlcmVuY2USNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2UaKC5haS5zdGlnbWVyLmFnZW50aWMuc2NoZWR1bGUudjEuU2NoZWR1bGUiBNC4GAESfAoKZ2V0QnlBZ2VudBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5HZXRTY2hlZHVsZXNCeUFnZW50UmVxdWVzdBosLmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5TY2hlZHVsZUxpc3QiBNC4GAEScAoEbGlzdBI0LmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5MaXN0U2NoZWR1bGVzUmVxdWVzdBosLmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5TY2hlZHVsZUxpc3QiBNC4GAESrwEKCGxpc3RSdW5zEjcuYWkuc3RpZ21lci5hZ2VudGljLnNjaGVkdWxlLnYxLkxpc3RTY2hlZHVsZVJ1bnNSZXF1ZXN0Gi8uYWkuc3RpZ21lci5hZ2VudGljLnNjaGVkdWxlLnYxLlNjaGVkdWxlUnVuTGlzdCI5wrgYNQgBEDgiC3NjaGVkdWxlX2lkKiJ1bmF1dGhvcml6ZWQgdG8gbGlzdCBzY2hlZHVsZSBydW5zGgSg/ys4YgZwcm90bzM",[file_ai_stigmer_agentic_schedule_v1_api,file_ai_stigmer_agentic_schedule_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ScheduleQueryController=serviceDesc(file_ai_stigmer_agentic_schedule_v1_query,0);function newArmScheduleStep(clock,logger2){return{name:"ArmScheduleArtifact",async execute(ctx){await armAndMirror(clock(),ctx.newState,logger2)}}}function newArmResumedScheduleStep(clock,logger2){return{name:"ArmResumedScheduleArtifact",async execute(ctx){let schedule=ctx.get(EXISTING_RESOURCE_KEY);schedule!==void 0&&await armAndMirror(clock(),schedule,logger2)}}}async function armAndMirror(clock,schedule,logger2){if(clock===void 0||schedule===void 0)return;let nextFireAt;try{nextFireAt=await clock.ensureAndRecord(schedule)}catch(error2){logger2.warn("Schedule artifact not armed \u2014 next_fire_at stays absent until the reconciliation pass converges it",{schedule_id:schedule.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)});return}schedule.status===void 0&&(schedule.status=create2(ScheduleStatusSchema)),schedule.status.nextFireAt=nextFireAt===void 0?void 0:timestampFromDate(nextFireAt)}function newTeardownScheduleArtifactStep(clock,logger2){return{name:"TeardownScheduleArtifact",async execute(ctx){let liveClock=clock();if(liveClock===void 0)return;let resourceId=ctx.get(RESOURCE_ID_KEY);if(!(typeof resourceId!="string"||resourceId===""))try{await liveClock.teardown(resourceId)}catch(error2){logger2.warn("Schedule artifact teardown failed (non-fatal \u2014 the orphan cannot fire past revalidation and the reconciliation pass removes it)",{schedule_id:resourceId,error:error2 instanceof Error?error2.message:String(error2)})}}}}function newDeleteScheduleRunsStep(store,logger2){return{name:"DeleteScheduleRuns",async execute(ctx){let resourceId=ctx.get(RESOURCE_ID_KEY);if(!(typeof resourceId!="string"||resourceId===""))try{await store.deleteScheduleRunsBySchedule(resourceId)}catch(error2){logger2.warn("Fire-ledger cleanup failed (non-fatal \u2014 orphaned rows answer no query; retention prunes them)",{schedule_id:resourceId,error:error2 instanceof Error?error2.message:String(error2)})}}}}var LIST_RUNS_RESULT_KEY="listRunsResult",DEFAULT_RUNS_PAGE_SIZE=50;function newLoadScheduleForRunsStep(store){return{name:"LoadScheduleForRuns",async execute(ctx){let scheduleId=ctx.input.scheduleId;try{await store.getResource(ApiResourceKind.schedule,scheduleId,ScheduleSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("Schedule",scheduleId):internalError(error2,"failed to load schedule")}}}}function newListRunsFromLedgerStep(store){return{name:"ListRunsFromLedger",async execute(ctx){let req=ctx.input,size=req.pageInfo?.size??0;size<=0&&(size=DEFAULT_RUNS_PAGE_SIZE);let num=req.pageInfo?.num??0;num<1&&(num=1);let offset=(num-1)*size,runs,total;try{({runs,total}=await store.listScheduleRuns(req.scheduleId,offset,size))}catch(error2){throw internalError(error2,"failed to list schedule runs")}let items=[];for(let record2 of runs)items.push(await toProtoRun(store,record2));ctx.set(LIST_RUNS_RESULT_KEY,create2(ScheduleRunListSchema,{totalCount:total,items}))}}}async function toProtoRun(store,record2){let run=create2(ScheduleRunSchema,{scheduleId:record2.scheduleId,org:record2.org,origin:runOriginFromLabel(record2.origin),outcome:runOutcomeFromLabel(record2.outcome),reason:record2.reason,executionId:record2.executionId}),nominal=parseTime(record2.nominalFireTime);nominal!==void 0&&(run.nominalFireTime=timestampFromDate(nominal));let recordedAt=parseTime(record2.recordedAt);if(recordedAt!==void 0&&(run.recordedAt=timestampFromDate(recordedAt)),record2.completedAt!==""){let completedAt=parseTime(record2.completedAt);return completedAt!==void 0&&(run.completedAt=timestampFromDate(completedAt)),run}if(record2.executionId==="")return run;let phase;try{phase=(await store.getResource(ApiResourceKind.agent_execution,record2.executionId,AgentExecutionSchema)).status?.phase??ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED}catch{return run}switch(phase){case ExecutionPhase.EXECUTION_COMPLETED:run.outcome=ScheduleRunOutcome.COMPLETED;break;case ExecutionPhase.EXECUTION_FAILED:case ExecutionPhase.EXECUTION_CANCELLED:case ExecutionPhase.EXECUTION_TERMINATED:run.outcome=ScheduleRunOutcome.FAILED,run.reason=`run ${record2.executionId} ended ${executionPhaseWord(phase)}`;break;default:break}return run}function executionPhaseWord(phase){switch(phase){case ExecutionPhase.EXECUTION_FAILED:return"failed";case ExecutionPhase.EXECUTION_CANCELLED:return"cancelled";case ExecutionPhase.EXECUTION_TERMINATED:return"terminated";default:return"unknown"}}function runOriginFromLabel(origin){switch(origin){case"cron":return ScheduleRunOrigin.CRON;case"manual":return ScheduleRunOrigin.MANUAL;default:return ScheduleRunOrigin.UNSPECIFIED}}function runOutcomeFromLabel(outcome){switch(outcome){case"started":return ScheduleRunOutcome.STARTED;case"refused":return ScheduleRunOutcome.REFUSED;case"target_missing":return ScheduleRunOutcome.TARGET_MISSING;case"skipped":return ScheduleRunOutcome.SKIPPED;case"completed":return ScheduleRunOutcome.COMPLETED;case"failed":return ScheduleRunOutcome.FAILED;case"timed_out":return ScheduleRunOutcome.TIMED_OUT;default:return ScheduleRunOutcome.UNSPECIFIED}}function parseTime(value){if(value==="")return;let parsed=new Date(value);return Number.isNaN(parsed.getTime())?void 0:parsed}function newPersistScheduleUpdateStep(store){return{name:"PersistScheduleUpdate",async execute(ctx){let newState=ctx.newState,scheduleId=newState.metadata?.id??"",live;try{live=await store.updateResource(ApiResourceKind.schedule,scheduleId,ScheduleSchema,row=>{row.apiVersion=newState.apiVersion,row.kind=newState.kind,row.metadata=newState.metadata,row.spec=newState.spec,newState.status?.audit!==void 0&&(row.status===void 0&&(row.status=create2(ScheduleStatusSchema)),row.status.audit=newState.status.audit)})}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("Schedule",scheduleId):internalError(error2,"failed to persist schedule update")}ctx.setNewState(live)}}}var NothingToClearError=class extends Error{constructor(){super("nothing to clear"),this.name="NothingToClearError"}};function newClearSchedulePauseStep(store){return{name:"ClearSchedulePause",async execute(ctx){let scheduleId=ctx.get(EXISTING_RESOURCE_KEY).metadata?.id??"",live;try{live=await store.updateResource(ApiResourceKind.schedule,scheduleId,ScheduleSchema,row=>{let status=row.status;if((status?.pausedReason??"")===""&&(status?.consecutiveFailures??0)===0)throw new NothingToClearError;row.status.pausedReason="",row.status.consecutiveFailures=0,setAuditFieldsForUpdate(ScheduleSchema,row,"status_audit",ctx.callerIdentity)})}catch(error2){if(error2 instanceof NothingToClearError){try{live=await store.getResource(ApiResourceKind.schedule,scheduleId,ScheduleSchema)}catch(readError){throw readError instanceof ResourceNotFoundError?notFoundError("Schedule",scheduleId):internalError(readError,"failed to resume schedule")}ctx.set(EXISTING_RESOURCE_KEY,live);return}throw error2 instanceof ResourceNotFoundError?notFoundError("Schedule",scheduleId):internalError(error2,"failed to resume schedule")}ctx.set(EXISTING_RESOURCE_KEY,live)}}}var CRON_SHORTHANDS=new Set(["@hourly","@daily","@weekly","@monthly","@yearly"]),CRON_FIELD_PATTERN=/^[0-9A-Za-z*,/-]+$/;function validateScheduleCron(cron){if(cron.startsWith("CRON_TZ=")||cron.startsWith("TZ="))throw invalidArgumentError("spec.cron must not carry a timezone prefix (CRON_TZ=/TZ=) \u2014 spec.time_zone is the single timezone authority");if(cron.includes("#"))throw invalidArgumentError("spec.cron must not contain a comment (#)");if(cron.startsWith("@")){if(cron.startsWith("@every"))throw invalidArgumentError("spec.cron must be a calendar expression \u2014 @every intervals are not supported");if(!CRON_SHORTHANDS.has(cron))throw invalidArgumentError(`spec.cron shorthand "${cron}" is not supported \u2014 use @hourly, @daily, @weekly, @monthly, or @yearly, or a 5-field cron expression`);return}let fields2=cron.split(/\s+/).filter(field3=>field3!=="");if(fields2.length!==5)throw invalidArgumentError(`spec.cron must have exactly 5 fields (minute hour day-of-month month day-of-week); got ${fields2.length}`);for(let field3 of fields2)if(!CRON_FIELD_PATTERN.test(field3))throw invalidArgumentError(`spec.cron field "${field3}" contains unsupported characters \u2014 allowed: digits, names, '*', ',', '-', '/'`)}function validateScheduleTimeZone(timeZone){if(timeZone==="Local"||!isLoadableTimeZone(timeZone))throw invalidArgumentError(`spec.time_zone "${timeZone}" is not a valid IANA time zone (e.g. "Asia/Kolkata")`)}var canonicalZones,canonicalZonesLowered;function zoneSets(){if(canonicalZones===void 0||canonicalZonesLowered===void 0){let values=Intl.supportedValuesOf("timeZone");canonicalZones=new Set(values),canonicalZonesLowered=new Set(values.map(zone=>zone.toLowerCase()))}return{exact:canonicalZones,lowered:canonicalZonesLowered}}function isLoadableTimeZone(timeZone){if(timeZone==="")return!0;let{exact,lowered}=zoneSets();if(exact.has(timeZone))return!0;if(lowered.has(timeZone.toLowerCase()))return!1;try{return new Intl.DateTimeFormat("en-US",{timeZone}),!0}catch{return!1}}function newResolveScheduleDefaultsStep(deps){return{name:"ResolveScheduleDefaults",async execute(ctx){let schedule=ctx.newState,metadata=schedule.metadata;if((metadata?.org??"")==="")throw invalidArgumentError("metadata.org is required for a schedule");let spec=schedule.spec;validateScheduleCron(spec?.cron??""),validateScheduleTimeZone(spec?.timeZone??"");let agentRef=spec?.target.case==="agent"?spec.target.value.agentRef:void 0;if((agentRef?.slug??"")==="")throw invalidArgumentError("spec.agent.agent_ref.slug is required");validateScheduleWorkspace(spec),validateScheduleModelPinning(deps.modelRegistry,spec);let refOrg=agentRef?.org??"";if(refOrg===""&&(refOrg=metadata?.org??""),refOrg!==(metadata?.org??""))throw failedPreconditionError(`spec.agent.agent_ref.org must match metadata.org \u2014 a schedule must live in the referenced agent's organization (${refOrg})`);let found;try{found=await findResourceBySlug(deps.store,ApiResourceKind.agent,AgentSchema,agentRef?.slug??"",refOrg)}catch(error2){throw internalError(error2,"failed to list agent resources")}if(found===void 0)throw notFoundError("Agent",agentRef?.slug??"");agentRef!==void 0&&(agentRef.org=refOrg),ctx.set(REFERENCED_AGENT_KEY,found)}}}var REFERENCED_AGENT_KEY="scheduleReferencedAgent",SCHEDULE_CREATE_DENIED_MESSAGE="You don't have permission to schedule this agent";function resolveScheduleCreateTargets(ctx){let agent=ctx.get(REFERENCED_AGENT_KEY);if(agent===void 0)throw new Error("referenced agent not found in context");return[{permission:IamPermission.can_edit,resourceKind:ApiResourceKind.agent,resourceId:agent.metadata?.id??"",deniedMessage:SCHEDULE_CREATE_DENIED_MESSAGE}]}function validateScheduleWorkspace(spec){let entries=spec?.target.case==="agent"?spec.target.value.workspaceEntries:[];for(let[i6,entry]of entries.entries())if(entry.source?.source.case!=="gitRepo")throw invalidArgumentError(`spec.agent.workspace_entries[${i6}] must use a git_repo source \u2014 a scheduled run has no connected client to serve a local_path`)}function validateScheduleModelPinning(modelRegistry,spec){let presence=scheduleModelPinningRefusal(spec);if(presence!=="")throw invalidArgumentError(presence);let invocation=spec?.target.case==="agent"?spec.target.value:void 0,existence=unknownModelPinRefusal(modelRegistry,"spec.agent.run_config.model_name",harnessName(invocation?.harness??0),invocation?.runConfig?.modelName??"");if(existence!=="")throw invalidArgumentError(existence)}function targetFieldName(spec){return spec?.target.case??""}function newValidateScheduleUpdateStep(deps){return{name:"ValidateScheduleUpdate",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing schedule not found in context"),"existing schedule not found in context");let newState=ctx.newState,inputTarget=targetFieldName(newState.spec),existingTarget=targetFieldName(existing.spec);if(inputTarget!==existingTarget)throw failedPreconditionError(`spec target is immutable (schedule target is ${existingTarget}) \u2014 create a new schedule for a different target kind`);let spec=newState.spec;validateScheduleCron(spec?.cron??""),validateScheduleTimeZone(spec?.timeZone??""),validateScheduleWorkspace(spec),validateScheduleModelPinning(deps.modelRegistry,spec);let inputRef=spec?.target.case==="agent"?spec.target.value.agentRef:void 0,existingRef=existing.spec?.target.case==="agent"?existing.spec.target.value.agentRef:void 0,inputOrg=inputRef?.org??"";if(inputOrg===""&&(inputOrg=existing.metadata?.org??""),(inputRef?.slug??"")!==(existingRef?.slug??"")||inputOrg!==(existingRef?.org??""))throw failedPreconditionError(`spec.agent.agent_ref is immutable (schedule runs ${existingRef?.org??""}/${existingRef?.slug??""}) \u2014 create a new schedule to run a different agent`)}}}var TRIGGER_DISABLED_MESSAGE="schedule is disabled (spec.enabled=false) \u2014 enable it before triggering",TRIGGER_NO_RUNNER_MESSAGE="this Stigmer server process has no schedule run starter wired \u2014 the schedule cannot fire",TRIGGER_RESULT_KEY="trigger_result";function newValidateTriggerableStep(){return{name:"ValidateTriggerable",execute(ctx){if(!(ctx.get(EXISTING_RESOURCE_KEY).spec?.enabled??!1))throw failedPreconditionError(TRIGGER_DISABLED_MESSAGE)}}}function newFireDirectRunStep(deps){return{name:"FireDirectRun",async execute(ctx){let runner=deps.runner();if(runner===void 0)throw failedPreconditionError(TRIGGER_NO_RUNNER_MESSAGE);let schedule=ctx.get(EXISTING_RESOURCE_KEY),scheduleId=schedule.metadata?.id??"",nominal=new Date(Math.floor(Date.now()/1e3)*1e3),nominalRfc3339=rfc3339Seconds2(nominal),outcome;try{outcome=await runner.startRun(schedule,nominal)}catch(error2){throw deps.logger.warn("Manual trigger's run start failed on infrastructure",{schedule_id:scheduleId,error:error2 instanceof Error?error2.message:String(error2)}),error2 instanceof ConnectError?rethrownStatusError(error2):error2}await stampLastFireAt(deps,scheduleId,nominal,ctx.callerIdentity),await recordManualFire(deps.store,deps.logger,scheduleId,schedule.metadata?.org??"",nominalRfc3339,outcome);let result=create2(ScheduleTriggerResultSchema);switch(outcome.kind){case"started":result.outcome=ScheduleRunOutcome.STARTED,result.executionId=outcome.executionId,deps.logger.info("Schedule triggered manually \u2014 run started",{schedule_id:scheduleId,execution_id:outcome.executionId,already_existed:outcome.alreadyExisted});break;case"targetMissing":result.outcome=ScheduleRunOutcome.TARGET_MISSING,result.refusalReason=outcome.reason,deps.logger.warn("Schedule triggered manually \u2014 target missing",{schedule_id:scheduleId,reason:outcome.reason});break;case"refused":result.outcome=ScheduleRunOutcome.REFUSED,result.refusalReason=outcome.reason,deps.logger.warn("Schedule triggered manually \u2014 run refused by a launch gate",{schedule_id:scheduleId,reason:outcome.reason});break;default:{let exhaustive=outcome;throw new Error(`unknown run outcome ${String(exhaustive)}`)}}try{result.schedule=await deps.store.getResource(ApiResourceKind.schedule,scheduleId,ScheduleSchema)}catch{result.schedule=schedule}ctx.set(TRIGGER_RESULT_KEY,result)}}}async function stampLastFireAt(deps,scheduleId,nominal,identity2){try{await deps.store.updateResource(ApiResourceKind.schedule,scheduleId,ScheduleSchema,live=>{live.status===void 0&&(live.status=create2(ScheduleStatusSchema)),live.status.lastFireAt=timestampFromDate(nominal),setAuditFieldsForUpdate(ScheduleSchema,live,"status_audit",identity2)})}catch(error2){if(error2 instanceof ResourceNotFoundError)return;deps.logger.warn("Manual fire's last_fire_at not stamped (best-effort \u2014 the run is unaffected)",{schedule_id:scheduleId,error:error2 instanceof Error?error2.message:String(error2)})}}function registerScheduleServices(router,deps){router.service(ScheduleCommandController,{apply:(schedule,ctx)=>apply2(deps,schedule,ctx),create:(schedule,ctx)=>createSchedule(deps,schedule,ctx),update:(schedule,ctx)=>update3(deps,schedule,ctx),delete:(scheduleId,ctx)=>deleteSchedule(deps,scheduleId,ctx),resume:(scheduleId,ctx)=>resume(deps,scheduleId,ctx),trigger:(scheduleId,ctx)=>trigger(deps,scheduleId,ctx)}),router.service(ScheduleQueryController,{get:(scheduleId,ctx)=>get4(deps,scheduleId,ctx),getByReference:(ref,ctx)=>getByReference2(deps,ref,ctx),getByAgent:(req,ctx)=>getByAgent(deps,req,ctx),list:(req,ctx)=>list4(deps,req,ctx),listRuns:(req,ctx)=>listRuns(deps,req,ctx)})}function kindOf3(ctx){return ctx.values.get(apiResourceKindKey)}async function createSchedule(deps,schedule,ctx){let reqCtx=new RequestContext(ScheduleSchema,schedule,callerIdentityOf(ctx),kindOf3(ctx));return await newPipeline("schedule-create",deps.logger).addStep(newAuthorizeStep(ScheduleCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveScheduleDefaultsStep(deps)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveScheduleCreateTargets)).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newArmScheduleStep(deps.clock,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update3(deps,schedule,ctx){let reqCtx=new RequestContext(ScheduleSchema,schedule,callerIdentityOf(ctx),kindOf3(ctx));return await newPipeline("schedule-update",deps.logger).addStep(newAuthorizeStep(ScheduleCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateScheduleUpdateStep(deps)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistScheduleUpdateStep(deps.store)).addStep(newArmScheduleStep(deps.clock,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply2(deps,schedule,ctx){let reqCtx=new RequestContext(ScheduleSchema,schedule,callerIdentityOf(ctx),kindOf3(ctx));await newPipeline("schedule-apply",deps.logger).addStep(newAuthorizeStep(ScheduleCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveScheduleDefaultsStep(deps)).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");let resolved=reqCtx.newState;return shouldCreate?(deps.logger.info("Schedule does not exist - delegating to CREATE",{slug:resolved.metadata?.slug??""}),createSchedule(deps,resolved,ctx)):(deps.logger.info("Schedule exists - delegating to UPDATE",{slug:resolved.metadata?.slug??"",id:resolved.metadata?.id??""}),update3(deps,resolved,ctx))}async function deleteSchedule(deps,scheduleId,ctx){let reqCtx=new RequestContext(ScheduleCommandController.method.delete.input,scheduleId,callerIdentityOf(ctx),kindOf3(ctx));await newPipeline("schedule-delete",deps.logger).addStep(newAuthorizeStep(ScheduleCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,ScheduleSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newTeardownScheduleArtifactStep(deps.clock,deps.logger)).addStep(newDeleteScheduleRunsStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted schedule not found in context"),"deleted schedule not found in context");return deleted}async function resume(deps,scheduleId,ctx){let reqCtx=new RequestContext(ScheduleCommandController.method.resume.input,scheduleId,callerIdentityOf(ctx),kindOf3(ctx));await newPipeline("schedule-resume",deps.logger).addStep(newAuthorizeStep(ScheduleCommandController.method.resume,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,ScheduleSchema)).addStep(newClearSchedulePauseStep(deps.store)).addStep(newArmResumedScheduleStep(deps.clock,deps.logger)).build().execute(reqCtx);let resumed=reqCtx.get(EXISTING_RESOURCE_KEY);if(resumed===void 0)throw internalError(new Error("resumed schedule not found in context"),"resumed schedule not found in context");return resumed}async function trigger(deps,scheduleId,ctx){let reqCtx=new RequestContext(ScheduleCommandController.method.trigger.input,scheduleId,callerIdentityOf(ctx),kindOf3(ctx));await newPipeline("schedule-trigger",deps.logger).addStep(newAuthorizeStep(ScheduleCommandController.method.trigger,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,ScheduleSchema)).addStep(newValidateTriggerableStep()).addStep(newFireDirectRunStep({store:deps.store,runner:deps.runner,logger:deps.logger})).build().execute(reqCtx);let result=reqCtx.get(TRIGGER_RESULT_KEY);if(result===void 0)throw internalError(new Error("trigger result not found in context"),"trigger result not found in context");return result}async function get4(deps,scheduleId,ctx){let reqCtx=new RequestContext(ScheduleQueryController.method.get.input,scheduleId,callerIdentityOf(ctx),kindOf3(ctx));return await newPipeline("schedule-get",deps.logger).addStep(newAuthorizeStep(ScheduleQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,ScheduleSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByReference2(deps,ref,ctx){let reqCtx=new RequestContext(ScheduleQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf3(ctx));return await newPipeline("schedule-get-by-reference",deps.logger).addStep(newAuthorizeStep(ScheduleQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,ScheduleSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(ScheduleQueryController.method.get))).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var SCHEDULE_LIST_KEY="scheduleList";async function getByAgent(deps,req,ctx){let reqCtx=new RequestContext(ScheduleQueryController.method.getByAgent.input,req,callerIdentityOf(ctx),kindOf3(ctx));await newPipeline("schedule-get-by-agent",deps.logger).addStep(newAuthorizeStep(ScheduleQueryController.method.getByAgent,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadSchedulesByAgentStep(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(SCHEDULE_LIST_KEY);if(result===void 0)throw internalError(new Error("schedule list not found in context"),"schedule list not found in context");return result}function newLoadSchedulesByAgentStep(store,listReadScope){return{name:"LoadSchedulesByAgent",async execute(ctx){let req=ctx.input,agentOrg,agentSlug;try{let agent=await store.getResource(ApiResourceKind.agent,req.agentId,AgentSchema);agentOrg=agent.metadata?.org??"",agentSlug=agent.metadata?.slug??""}catch{ctx.set(SCHEDULE_LIST_KEY,create2(ScheduleListSchema,{totalCount:0,items:[]}));return}let resources;try{resources=await store.listResources(ApiResourceKind.schedule)}catch(error2){throw internalError(error2,"failed to list schedules")}let decoded=[];for(let data of resources)try{decoded.push(fromBinary2(ScheduleSchema,data))}catch{continue}let ofAgent=decoded.filter(schedule=>{let ref=schedule.spec?.target.case==="agent"?schedule.spec.target.value.agentRef:void 0;return(ref?.org??"")!==agentOrg||(ref?.slug??"")!==agentSlug?!1:req.org===""||(schedule.metadata?.org??"")===req.org}),schedules=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.schedule,ofAgent,"");ctx.set(SCHEDULE_LIST_KEY,create2(ScheduleListSchema,{totalCount:schedules.length,items:schedules}))}}}async function list4(deps,req,ctx){let reqCtx=new RequestContext(ScheduleQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf3(ctx));await newPipeline("schedule-list",deps.logger).addStep(newAuthorizeStep(ScheduleQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgAndLabelsStep(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(SCHEDULE_LIST_KEY);if(result===void 0)throw internalError(new Error("schedule list not found in context"),"schedule list not found in context");return result}function newListByOrgAndLabelsStep(store,listReadScope){return{name:"ListByOrgAndLabels",async execute(ctx){let req=ctx.input,resources;try{resources=await store.listResources(ApiResourceKind.schedule)}catch(error2){throw internalError(error2,"failed to list schedules")}let decoded=[];for(let data of resources)try{decoded.push(fromBinary2(ScheduleSchema,data))}catch{continue}let schedules=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.schedule,decoded.filter(schedule=>(schedule.metadata?.org??"")===req.org&&matchesAllLabels(schedule.metadata?.labels??{},req.labels)),"");schedules.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(SCHEDULE_LIST_KEY,create2(ScheduleListSchema,{totalCount:schedules.length,items:schedules}))}}}async function listRuns(deps,req,ctx){let reqCtx=new RequestContext(ScheduleQueryController.method.listRuns.input,req,callerIdentityOf(ctx),kindOf3(ctx));await newPipeline("schedule-list-runs",deps.logger).addStep(newAuthorizeStep(ScheduleQueryController.method.listRuns,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadScheduleForRunsStep(deps.store)).addStep(newListRunsFromLedgerStep(deps.store)).build().execute(reqCtx);let result=reqCtx.get(LIST_RUNS_RESULT_KEY);if(result===void 0)throw internalError(new Error("schedule run list not found in context"),"schedule run list not found in context");return result}var RuntimeResolutionService=class{store;secretService;logger;constructor(store,secretService,logger2){this.store=store,this.secretService=secretService,this.logger=logger2}async resolveByReference(ref){if(ref===void 0||ref.slug==="")throw invalidArgumentError("environment reference with slug is required");if(ref.kind!==ApiResourceKind.api_resource_kind_unknown&&ref.kind!==ApiResourceKind.environment)throw invalidArgumentError(`kind mismatch: expected environment, got ${apiResourceKindName(ref.kind)}`);requireOrgForReference(ApiResourceKind.environment,ref.org);let env2;try{env2=await findResourceBySlug(this.store,ApiResourceKind.environment,EnvironmentSchema,ref.slug,ref.org)}catch(error2){throw internalError(error2,"failed to look up environment for runtime resolution")}if(env2===void 0)throw notFoundError("environment",ref.slug);return await this.decryptSecretValues(env2),env2}async decryptSecretValues(env2){let data=env2.spec?.data;if(data===void 0||Object.keys(data).length===0)return;let environmentId=env2.metadata?.id??"";for(let[key,value]of Object.entries(data))if(!(!value.isSecret||!this.secretService.isEncrypted(value.value)))try{value.value=await this.secretService.decrypt(value.value)}catch(error2){if(error2 instanceof EncryptionUnavailableError)throw internalError(error2,`environment ${environmentId} holds encrypted secret '${key}' but no encryption key is configured`);this.logger.warn("Undecryptable ciphertext in environment \u2014 dropping this value from runtime resolution",{key,environmentId,error:error2 instanceof Error?error2.message:String(error2)}),delete data[key]}}};var MANAGED_ENV_LABEL="stigmer.ai/managed",ManagedEnvironmentService=class{client;logger;constructor(client,logger2){this.client=client,this.logger=logger2}async createManagedEnvironment(name,org,caller){let created;try{created=await this.client.create(create2(EnvironmentSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"Environment",metadata:{name,org,labels:{[MANAGED_ENV_LABEL]:"true"}}}),caller)}catch(error2){throw new Error(`failed to create managed environment: ${error2 instanceof Error?error2.message:String(error2)}`)}let envId=created.metadata?.id??"";return this.logger.info("Created managed environment for OAuth token storage",{environment_id:envId,name,org}),envId}async deleteManagedEnvironment(environmentId){try{await this.client.delete(create2(ApiResourceDeleteInputSchema,{resourceId:environmentId}))}catch(error2){throw new Error(`failed to delete managed environment ${environmentId}: ${error2 instanceof Error?error2.message:String(error2)}`)}this.logger.info("Deleted managed environment",{environment_id:environmentId})}async readSecretValue(environmentId,key){let value;try{value=await this.client.getSecretValue(create2(EnvironmentSecretValueInputSchema,{environmentId,key}))}catch(error2){throw new Error(`failed to read secret ${JSON.stringify(key)} from managed environment ${environmentId}: ${error2 instanceof Error?error2.message:String(error2)}`)}return value.value}async updateSecrets(environmentId,variables){try{await this.client.updateVariables(create2(UpdateEnvironmentVariablesRequestSchema,{environmentId,variables}))}catch(error2){throw new Error(`failed to update secrets in managed environment ${environmentId}: ${error2 instanceof Error?error2.message:String(error2)}`)}}};var file_ai_stigmer_agentic_agentinstance_v1_io=fileDesc("CixhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRpbnN0YW5jZS92MS9pby5wcm90bxIjYWkuc3RpZ21lci5hZ2VudGljLmFnZW50aW5zdGFuY2UudjEiKAoPQWdlbnRJbnN0YW5jZUlkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEifQofR2V0QWdlbnRJbnN0YW5jZXNCeUFnZW50UmVxdWVzdBIYCghhZ2VudF9pZBgBIAEoCUIGukgDyAEBEjMKCXBhZ2VfaW5mbxgCIAEoCzIgLmFpLnN0aWdtZXIuY29tbW9ucy5ycGMuUGFnZUluZm8SCwoDb3JnGAMgASgJImsKEUFnZW50SW5zdGFuY2VMaXN0EhMKC3RvdGFsX2NvdW50GAEgASgFEkEKBWl0ZW1zGAIgAygLMjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50aW5zdGFuY2UudjEuQWdlbnRJbnN0YW5jZSLxAQoZTGlzdEFnZW50SW5zdGFuY2VzUmVxdWVzdBIUCgNvcmcYASABKAlCB7pIBHICEAESWgoGbGFiZWxzGAIgAygLMkouYWkuc3RpZ21lci5hZ2VudGljLmFnZW50aW5zdGFuY2UudjEuTGlzdEFnZW50SW5zdGFuY2VzUmVxdWVzdC5MYWJlbHNFbnRyeRIzCglwYWdlX2luZm8YAyABKAsyIC5haS5zdGlnbWVyLmNvbW1vbnMucnBjLlBhZ2VJbmZvGi0KC0xhYmVsc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAFiBnByb3RvMw",[file_ai_stigmer_agentic_agentinstance_v1_api,file_ai_stigmer_commons_rpc_pagination,file_buf_validate_validate]),AgentInstanceIdSchema=messageDesc2(file_ai_stigmer_agentic_agentinstance_v1_io,0);var AgentInstanceListSchema=messageDesc2(file_ai_stigmer_agentic_agentinstance_v1_io,2);var file_ai_stigmer_agentic_agentinstance_v1_command=fileDesc("CjFhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRpbnN0YW5jZS92MS9jb21tYW5kLnByb3RvEiNhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRpbnN0YW5jZS52MTK2BgoeQWdlbnRJbnN0YW5jZUNvbW1hbmRDb250cm9sbGVyEm8KBWFwcGx5EjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50aW5zdGFuY2UudjEuQWdlbnRJbnN0YW5jZRoyLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGluc3RhbmNlLnYxLkFnZW50SW5zdGFuY2USdgoGY3JlYXRlEjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50aW5zdGFuY2UudjEuQWdlbnRJbnN0YW5jZRoyLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGluc3RhbmNlLnYxLkFnZW50SW5zdGFuY2UiBNC4GAESrgEKBnVwZGF0ZRIyLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGluc3RhbmNlLnYxLkFnZW50SW5zdGFuY2UaMi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRpbnN0YW5jZS52MS5BZ2VudEluc3RhbmNlIjzCuBg4CAIQLSILbWV0YWRhdGEuaWQqJXVuYXV0aG9yaXplZCB0byB1cGRhdGUgYWdlbnQgaW5zdGFuY2USxgEKEHVwZGF0ZVZpc2liaWxpdHkSNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuVXBkYXRlVmlzaWJpbGl0eUlucHV0GjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50aW5zdGFuY2UudjEuQWdlbnRJbnN0YW5jZSJHwrgYQwgCEC0iC3Jlc291cmNlX2lkKjB1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGFnZW50IGluc3RhbmNlIHZpc2liaWxpdHkSqgEKBmRlbGV0ZRI0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGluc3RhbmNlLnYxLkFnZW50SW5zdGFuY2VJZBoyLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGluc3RhbmNlLnYxLkFnZW50SW5zdGFuY2UiNsK4GDIIAxAtIgV2YWx1ZSoldW5hdXRob3JpemVkIHRvIGRlbGV0ZSBhZ2VudCBpbnN0YW5jZRoEoP8rLWIGcHJvdG8z",[file_ai_stigmer_agentic_agentinstance_v1_api,file_ai_stigmer_agentic_agentinstance_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentInstanceCommandController=serviceDesc(file_ai_stigmer_agentic_agentinstance_v1_command,0);var file_ai_stigmer_agentic_agentinstance_v1_query=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRpbnN0YW5jZS92MS9xdWVyeS5wcm90bxIjYWkuc3RpZ21lci5hZ2VudGljLmFnZW50aW5zdGFuY2UudjEy6AQKHEFnZW50SW5zdGFuY2VRdWVyeUNvbnRyb2xsZXISpAEKA2dldBI0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGluc3RhbmNlLnYxLkFnZW50SW5zdGFuY2VJZBoyLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGluc3RhbmNlLnYxLkFnZW50SW5zdGFuY2UiM8K4GC8IARAtIgV2YWx1ZSoidW5hdXRob3JpemVkIHRvIGdldCBBZ2VudCBJbnN0YW5jZRKQAQoKZ2V0QnlBZ2VudBJELmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGluc3RhbmNlLnYxLkdldEFnZW50SW5zdGFuY2VzQnlBZ2VudFJlcXVlc3QaNi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRpbnN0YW5jZS52MS5BZ2VudEluc3RhbmNlTGlzdCIE0LgYARKAAQoOZ2V0QnlSZWZlcmVuY2USNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2UaMi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRpbnN0YW5jZS52MS5BZ2VudEluc3RhbmNlIgTQuBgBEoQBCgRsaXN0Ej4uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50aW5zdGFuY2UudjEuTGlzdEFnZW50SW5zdGFuY2VzUmVxdWVzdBo2LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGluc3RhbmNlLnYxLkFnZW50SW5zdGFuY2VMaXN0IgTQuBgBGgSg/ystYgZwcm90bzM",[file_ai_stigmer_agentic_agentinstance_v1_api,file_ai_stigmer_agentic_agentinstance_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentInstanceQueryController=serviceDesc(file_ai_stigmer_agentic_agentinstance_v1_query,0);var agentInstanceSearchExtractor={kind:ApiResourceKind.agent_instance,schema:AgentInstanceSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let instance=resource;return buildSearchResult({kind:ApiResourceKind.agent_instance,metadata:instance.metadata,summary:instance.spec?.description??"",score,createdAt:instance.status?.audit?.specAudit?.createdAt,updatedAt:instance.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let instance=resource,metadata=instance.metadata;if(metadata!==void 0)return{name:metadata.name,description:instance.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(instance.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var PARENT_AGENT_KEY="parent_agent";function newLoadParentAgentStep(agentLoader,logger2){return{name:"LoadParentAgent",async execute(ctx){let agentId=ctx.input.spec?.agentId??"";logger2.info("Loading parent agent",{agentId});let parentAgent;try{parentAgent=await agentLoader().get(agentId)}catch(error2){throw logger2.warn("Parent agent not found",{agentId,error:error2 instanceof Error?error2.message:String(error2)}),notFoundError("Agent",agentId)}logger2.debug("Loaded parent agent",{agentId,org:parentAgent.metadata?.org??""}),ctx.set(PARENT_AGENT_KEY,parentAgent)}}}var INSTANCE_PARENT_DENIED_MESSAGE="You don't have permission to create instances of this agent",INSTANCE_ORGANIZATION_DENIED_MESSAGE="unauthorized to create agent instance in this organization";function resolveInstanceCreateTargets(ctx){let parent=ctx.get(PARENT_AGENT_KEY);if(parent===void 0)throw new Error("parent agent not found in context");let metadata=ctx.newState.metadata,org=metadata?.org??"",parentId=parent.metadata?.id??"";return isDefaultInstance(metadata)&&isServerComposedRequest(ctx.callerIdentity)&&org===(parent.metadata?.org??"")?[]:[{permission:IamPermission.can_create_agent_instance,resourceKind:ApiResourceKind.organization,resourceId:org,deniedMessage:INSTANCE_ORGANIZATION_DENIED_MESSAGE},{permission:IamPermission.can_create_instance,resourceKind:ApiResourceKind.agent,resourceId:parentId,deniedMessage:INSTANCE_PARENT_DENIED_MESSAGE}]}function newValidateInstanceUpdateStep(){return{name:"ValidateInstanceUpdate",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing agent instance not found in context"),"existing agent instance not found in context");if((ctx.input.spec?.agentId??"")!==(existing.spec?.agentId??""))throw failedPreconditionError(`spec.agent_id is immutable (instance instantiates agent ${existing.spec?.agentId??""}) \u2014 create a new instance for a different agent`)}}}var UPDATE_VISIBILITY_INSTANCE_KEY="updateVisibilityInstance";function newRejectDefaultInstanceVisibilityUpdateStep(store){return{name:"RejectDefaultInstanceVisibilityUpdate",async execute(ctx){let instance=ctx.get(UPDATE_VISIBILITY_INSTANCE_KEY);isDefaultInstance(instance.metadata)&&rejectDefaultInstanceVisibilityUpdate();let parentId=instance.spec?.agentId??"";if(parentId==="")return;let parent;try{parent=await store.getResource(ApiResourceKind.agent,parentId,AgentSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw internalError(error2,"failed to load parent agent for default-instance check")}parent.status?.defaultInstanceId===(instance.metadata?.id??"")&&rejectDefaultInstanceVisibilityUpdate()}}}var LIST_RESULT_KEY="listResult",INSTANCE_LIST_KEY="instanceList";function newListByOrgAndLabelsStep2(store,logger2,listReadScope){return{name:"ListByOrgAndLabels",async execute(ctx){let{org,labels:filterLabels}=ctx.input,rows;try{rows=await store.listResources(ApiResourceKind.agent_instance)}catch(error2){throw internalError(error2,"failed to list agent instances")}let decoded=[];for(let data of rows)try{decoded.push(fromBinary2(AgentInstanceSchema,data))}catch(error2){logger2.warn("Failed to unmarshal agent instance, skipping",{error:error2 instanceof Error?error2.message:String(error2)});continue}let instances=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.agent_instance,decoded.filter(instance=>(instance.metadata?.org??"")===org&&matchesAllLabels(instance.metadata?.labels??{},filterLabels)),"");instances.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),logger2.info("Listed agent instances",{org,matchCount:instances.length,labelFilters:Object.keys(filterLabels).length}),ctx.set(LIST_RESULT_KEY,create2(AgentInstanceListSchema,{totalCount:instances.length,items:instances}))}}}function newLoadByAgentStep(store,listReadScope){return{name:"LoadByAgent",async execute(ctx){let req=ctx.input,agentId=req.agentId;if(agentId==="")throw invalidArgumentError("agent_id is required");let rows;try{rows=await store.listResources(ApiResourceKind.agent_instance)}catch(error2){throw internalError(error2,"failed to list agent instances")}let decoded=[];for(let data of rows)try{decoded.push(fromBinary2(AgentInstanceSchema,data))}catch{continue}let instances=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.agent_instance,decoded.filter(instance=>(instance.spec?.agentId??"")===agentId&&(req.org===""||(instance.metadata?.org??"")===req.org)),"");ctx.set(INSTANCE_LIST_KEY,create2(AgentInstanceListSchema,{totalCount:instances.length,items:instances}))}}}function registerAgentInstanceServices(router,deps){router.service(AgentInstanceCommandController,{apply:(instance,ctx)=>apply3(deps,instance,ctx),create:(instance,ctx)=>createInstance(deps,instance,ctx),update:(instance,ctx)=>update4(deps,instance,ctx),updateVisibility:(input,ctx)=>updateVisibility2(deps,input,ctx),delete:(id,ctx)=>deleteInstance(deps,id,ctx)}),router.service(AgentInstanceQueryController,{get:(id,ctx)=>get5(deps,id,ctx),getByAgent:(req,ctx)=>getByAgent2(deps,req,ctx),getByReference:(ref,ctx)=>getByReference3(deps,ref,ctx),list:(req,ctx)=>list5(deps,req,ctx)})}function kindOf4(ctx){return ctx.values.get(apiResourceKindKey)}async function createInstance(deps,instance,ctx){let reqCtx=new RequestContext(AgentInstanceSchema,instance,callerIdentityOf(ctx),kindOf4(ctx));return await newPipeline("agent-instance-create",deps.logger).addStep(newAuthorizeStep(AgentInstanceCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newLoadParentAgentStep(deps.parentAgentLoader,deps.logger)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveInstanceCreateTargets)).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,agentInstanceSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update4(deps,instance,ctx){let reqCtx=new RequestContext(AgentInstanceSchema,instance,callerIdentityOf(ctx),kindOf4(ctx));return await newPipeline("agent-instance-update",deps.logger).addStep(newAuthorizeStep(AgentInstanceCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateInstanceUpdateStep()).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,agentInstanceSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply3(deps,instance,ctx){let reqCtx=new RequestContext(AgentInstanceSchema,instance,callerIdentityOf(ctx),kindOf4(ctx));await newPipeline("agent-instance-apply",deps.logger).addStep(newAuthorizeStep(AgentInstanceCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createInstance(deps,instance,ctx):update4(deps,withResolvedApplyId(AgentInstanceSchema,instance,reqCtx),ctx)}async function deleteInstance(deps,instanceId,ctx){let reqCtx=new RequestContext(AgentInstanceCommandController.method.delete.input,instanceId,callerIdentityOf(ctx),kindOf4(ctx));await newPipeline("agent-instance-delete",deps.logger).addStep(newAuthorizeStep(AgentInstanceCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,AgentInstanceSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted agent instance not found in context"),"deleted agent instance not found in context");return deleted}async function updateVisibility2(deps,input,ctx){let reqCtx=new RequestContext(AgentInstanceCommandController.method.updateVisibility.input,input,callerIdentityOf(ctx),kindOf4(ctx));return await newPipeline("agent-instance-update-visibility",deps.logger).addStep(newAuthorizeStep(AgentInstanceCommandController.method.updateVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadInstanceForVisibilityUpdateStep(deps.store)).addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_INSTANCE_KEY)).addStep(newRejectDefaultInstanceVisibilityUpdateStep(deps.store)).addStep(newValidateVisibilityUpdateStep()).addStep(newSetInstanceVisibilityStep()).addStep(newPersistInstanceForVisibilityUpdateStep(deps.store)).addStep(newUpdateVisibilityTuplesStep(deps.authorizationLifecycle,UPDATE_VISIBILITY_INSTANCE_KEY)).addStep(newIndexInstanceAfterVisibilityUpdateStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(UPDATE_VISIBILITY_INSTANCE_KEY)}function newLoadInstanceForVisibilityUpdateStep(store){return{name:"LoadInstanceForVisibilityUpdate",async execute(ctx){let input=ctx.input,instance;try{instance=await store.getResource(ApiResourceKind.agent_instance,input.resourceId,AgentInstanceSchema)}catch{throw notFoundError("agent instance",input.resourceId)}ctx.set(UPDATE_VISIBILITY_INSTANCE_KEY,instance)}}}function newSetInstanceVisibilityStep(){return{name:"SetInstanceVisibility",execute(ctx){let instance=ctx.get(UPDATE_VISIBILITY_INSTANCE_KEY);instance.metadata!==void 0&&(instance.metadata.visibility=ctx.input.visibility),setAuditFieldsForUpdate(AgentInstanceSchema,instance,"status_audit",ctx.callerIdentity)}}}function newPersistInstanceForVisibilityUpdateStep(store){return{name:"PersistInstanceForVisibilityUpdate",async execute(ctx){let instance=ctx.get(UPDATE_VISIBILITY_INSTANCE_KEY);try{await store.saveResource(ApiResourceKind.agent_instance,instance.metadata?.id??"",AgentInstanceSchema,instance)}catch(error2){throw internalError(error2,"failed to save agent instance")}}}}function newIndexInstanceAfterVisibilityUpdateStep(store,logger2){return{name:"IndexInstanceAfterVisibilityUpdate",async execute(ctx){let instance=ctx.get(UPDATE_VISIBILITY_INSTANCE_KEY),entry=agentInstanceSearchExtractor.getSearchIndexEntry(instance);if(entry===void 0){logger2.warn("IndexInstanceAfterVisibilityUpdate: extractor returned nil, skipping",{id:instance.metadata?.id??""});return}try{await store.upsertSearchIndex(ApiResourceKind.agent_instance,instance.metadata?.id??"",entry)}catch(error2){logger2.warn("IndexInstanceAfterVisibilityUpdate: failed (best-effort)",{id:instance.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}}}async function get5(deps,id,ctx){let reqCtx=new RequestContext(AgentInstanceQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf4(ctx));return await newPipeline("agent-instance-get",deps.logger).addStep(newAuthorizeStep(AgentInstanceQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadTargetStep(deps.store,AgentInstanceSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByReference3(deps,ref,ctx){let reqCtx=new RequestContext(AgentInstanceQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf4(ctx));return await newPipeline("agent-instance-get-by-reference",deps.logger).addStep(newAuthorizeStep(AgentInstanceQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,AgentInstanceSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(AgentInstanceQueryController.method.get))).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByAgent2(deps,req,ctx){let reqCtx=new RequestContext(AgentInstanceQueryController.method.getByAgent.input,req,callerIdentityOf(ctx),kindOf4(ctx));await newPipeline("agent-instance-get-by-agent",deps.logger).addStep(newAuthorizeStep(AgentInstanceQueryController.method.getByAgent,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByAgentStep(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(INSTANCE_LIST_KEY);if(result===void 0)throw internalError(new Error("instance list not found in context"),"instance list not found in context");return result}async function list5(deps,req,ctx){let reqCtx=new RequestContext(AgentInstanceQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf4(ctx));await newPipeline("agent-instance-list",deps.logger).addStep(newAuthorizeStep(AgentInstanceQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgAndLabelsStep2(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY);if(result===void 0)throw internalError(new Error("agent instance list not found in context"),"agent instance list not found in context");return result}var file_ai_stigmer_agentic_agentchannel_v1_io=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL2lvLnByb3RvEiJhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxIicKDkFnZW50Q2hhbm5lbElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEifAoeR2V0QWdlbnRDaGFubmVsc0J5QWdlbnRSZXF1ZXN0EhgKCGFnZW50X2lkGAEgASgJQga6SAPIAQESMwoJcGFnZV9pbmZvGAIgASgLMiAuYWkuc3RpZ21lci5jb21tb25zLnJwYy5QYWdlSW5mbxILCgNvcmcYAyABKAkiaAoQQWdlbnRDaGFubmVsTGlzdBITCgt0b3RhbF9jb3VudBgBIAEoBRI/CgVpdGVtcxgCIAMoCzIwLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQWdlbnRDaGFubmVsIu4BChhMaXN0QWdlbnRDaGFubmVsc1JlcXVlc3QSFAoDb3JnGAEgASgJQge6SARyAhABElgKBmxhYmVscxgCIAMoCzJILmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuTGlzdEFnZW50Q2hhbm5lbHNSZXF1ZXN0LkxhYmVsc0VudHJ5EjMKCXBhZ2VfaW5mbxgDIAEoCzIgLmFpLnN0aWdtZXIuY29tbW9ucy5ycGMuUGFnZUluZm8aLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASI6ChtJbml0aWF0ZUNoYW5uZWxJbnN0YWxsSW5wdXQSGwoLcmVzb3VyY2VfaWQYASABKAlCBrpIA8gBASJbChxJbml0aWF0ZUNoYW5uZWxJbnN0YWxsT3V0cHV0EhkKEWF1dGhvcml6YXRpb25fdXJsGAEgASgJEg0KBXN0YXRlGAIgASgJEhEKCWNvbXBsZXRlZBgDIAEoCCJnChtDb21wbGV0ZUNoYW5uZWxJbnN0YWxsSW5wdXQSGwoLcmVzb3VyY2VfaWQYASABKAlCBrpIA8gBARIVCgVzdGF0ZRgCIAEoCUIGukgDyAEBEhQKBGNvZGUYAyABKAlCBrpIA8gBAWIGcHJvdG8z",[file_ai_stigmer_agentic_agentchannel_v1_api,file_ai_stigmer_commons_rpc_pagination,file_buf_validate_validate]);var AgentChannelListSchema=messageDesc2(file_ai_stigmer_agentic_agentchannel_v1_io,2);var file_ai_stigmer_agentic_agentchannel_v1_command=fileDesc("CjBhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL2NvbW1hbmQucHJvdG8SImFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEy9AcKHUFnZW50Q2hhbm5lbENvbW1hbmRDb250cm9sbGVyEmsKBWFwcGx5EjAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5BZ2VudENoYW5uZWwaMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbBJyCgZjcmVhdGUSMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbBowLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQWdlbnRDaGFubmVsIgTQuBgBEqkBCgZ1cGRhdGUSMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbBowLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQWdlbnRDaGFubmVsIjvCuBg3CAIQLyILbWV0YWRhdGEuaWQqJHVuYXV0aG9yaXplZCB0byB1cGRhdGUgYWdlbnQgY2hhbm5lbBLSAQoPaW5pdGlhdGVJbnN0YWxsEj8uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5Jbml0aWF0ZUNoYW5uZWxJbnN0YWxsSW5wdXQaQC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkluaXRpYXRlQ2hhbm5lbEluc3RhbGxPdXRwdXQiPMK4GDgIAhAvIgtyZXNvdXJjZV9pZColdW5hdXRob3JpemVkIHRvIGluc3RhbGwgYWdlbnQgY2hhbm5lbBLCAQoPY29tcGxldGVJbnN0YWxsEj8uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5Db21wbGV0ZUNoYW5uZWxJbnN0YWxsSW5wdXQaMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbCI8wrgYOAgCEC8iC3Jlc291cmNlX2lkKiV1bmF1dGhvcml6ZWQgdG8gaW5zdGFsbCBhZ2VudCBjaGFubmVsEqUBCgZkZWxldGUSMi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbElkGjAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5BZ2VudENoYW5uZWwiNcK4GDEIAxAvIgV2YWx1ZSokdW5hdXRob3JpemVkIHRvIGRlbGV0ZSBhZ2VudCBjaGFubmVsGgSg/ysvYgZwcm90bzM",[file_ai_stigmer_agentic_agentchannel_v1_api,file_ai_stigmer_agentic_agentchannel_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentChannelCommandController=serviceDesc(file_ai_stigmer_agentic_agentchannel_v1_command,0);var file_ai_stigmer_agentic_agentchannel_v1_query=fileDesc("Ci5haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL3F1ZXJ5LnByb3RvEiJhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxMtcEChtBZ2VudENoYW5uZWxRdWVyeUNvbnRyb2xsZXISnwEKA2dldBIyLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQWdlbnRDaGFubmVsSWQaMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbCIywrgYLggBEC8iBXZhbHVlKiF1bmF1dGhvcml6ZWQgdG8gZ2V0IGFnZW50IGNoYW5uZWwSfgoOZ2V0QnlSZWZlcmVuY2USNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2UaMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbCIE0LgYARKMAQoKZ2V0QnlBZ2VudBJCLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuR2V0QWdlbnRDaGFubmVsc0J5QWdlbnRSZXF1ZXN0GjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5BZ2VudENoYW5uZWxMaXN0IgTQuBgBEoABCgRsaXN0EjwuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5MaXN0QWdlbnRDaGFubmVsc1JlcXVlc3QaNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbExpc3QiBNC4GAEaBKD/Ky9iBnByb3RvMw",[file_ai_stigmer_agentic_agentchannel_v1_api,file_ai_stigmer_agentic_agentchannel_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentChannelQueryController=serviceDesc(file_ai_stigmer_agentic_agentchannel_v1_query,0);var INSTALL_UNAVAILABLE_MESSAGE="channel installs require Stigmer Cloud",PROACTIVE_MESSAGING_UNAVAILABLE_MESSAGE="proactive channel messaging requires Stigmer Cloud",CONVERSATION_PARTICIPATION_UNAVAILABLE_MESSAGE="conversation participation requires Stigmer Cloud",NO_DOWNLOADABLE_MEDIA_MESSAGE="no downloadable media at this timeline item",ORG_REQUIRED_MESSAGE="metadata.org is required for an agent channel",AGENT_REF_SLUG_REQUIRED_MESSAGE="spec.agent_ref.slug is required";function sameOrgInvariantMessage(refOrg){return`spec.agent_ref.org must match metadata.org \u2014 an agent channel must live in the referenced agent's organization (${refOrg})`}var APP_REF_REQUIRED_FOR_WHATSAPP_MESSAGE="spec.app_ref is required for WhatsApp channels \u2014 register your Meta app as a channel app and reference it",APP_REF_SAME_ORG_MESSAGE="spec.app_ref.org must match metadata.org \u2014 a channel can only install through its own organization's channel app",APP_REF_FROZEN_WHILE_INSTALLED_MESSAGE="spec.app_ref cannot change while the channel is installed \u2014 the workspace authorized the current app; uninstall or disconnect first, then rebind and re-install";function agentRefImmutableMessage(org,slug){return`spec.agent_ref is immutable (channel connects ${org}/${slug}) \u2014 create a new channel to connect a different agent`}function providerImmutableMessage(existingProvider){return`spec provider is immutable (channel provider is ${existingProvider}) \u2014 create a new channel for a different provider`}function validateChannelModelPin(registry,spec){let reason=unknownModelPinRefusal(registry,"spec.run_config.model_name","",spec?.runConfig?.modelName??"");if(reason!=="")throw invalidArgumentError(reason)}function newResolveChannelDefaultsStep(store,registry,channelRuntime){return{name:"ResolveChannelDefaults",async execute(ctx){let channel=ctx.newState,metadata=channel.metadata;if((metadata?.org??"")==="")throw invalidArgumentError(ORG_REQUIRED_MESSAGE);let agentRef=channel.spec?.agentRef;if((agentRef?.slug??"")==="")throw invalidArgumentError(AGENT_REF_SLUG_REQUIRED_MESSAGE);let refOrg=agentRef.org!==""?agentRef.org:metadata.org;if(refOrg!==metadata.org)throw failedPreconditionError(sameOrgInvariantMessage(refOrg));validateChannelModelPin(registry,channel.spec);let appRef=channel.spec?.appRef;if(channel.spec?.providerConfig.case==="whatsapp"&&(appRef?.slug??"")==="")throw invalidArgumentError(APP_REF_REQUIRED_FOR_WHATSAPP_MESSAGE);if((appRef?.slug??"")!==""){let appRefOrg=appRef.org!==""?appRef.org:metadata.org;if(appRefOrg!==metadata.org)throw failedPreconditionError(APP_REF_SAME_ORG_MESSAGE);appRef.org=appRefOrg}let agent;try{agent=await findResourceBySlug(store,ApiResourceKind.agent,AgentSchema,agentRef.slug,refOrg)}catch(error2){throw internalError(error2,"failed to list agent resources")}if(agent===void 0)throw notFoundError("Agent",agentRef.slug);agentRef.org=refOrg,ctx.set(REFERENCED_AGENT_KEY2,agent),channelRuntime!==void 0&&await channelRuntime.enforceWriteConstraints(ctx.newState)}}}var REFERENCED_AGENT_KEY2="agentChannelReferencedAgent",CHANNEL_CREATE_DENIED_MESSAGE="You don't have permission to connect this agent to a channel";function resolveChannelCreateTargets(ctx){let agent=ctx.get(REFERENCED_AGENT_KEY2);if(agent===void 0)throw new Error("referenced agent not found in context");return[{permission:IamPermission.can_edit,resourceKind:ApiResourceKind.agent,resourceId:agent.metadata?.id??"",deniedMessage:CHANNEL_CREATE_DENIED_MESSAGE}]}function newInitInstallStateStep(){return{name:"InitInstallState",execute(ctx){let channel=ctx.newState,status=channel.status??create2(AgentChannelStatusSchema);status.installState=AgentChannelInstallState.pending_install,channel.status=status}}}function providerFieldName(spec){let arm=spec?.providerConfig.case;return arm===void 0?"":AgentChannelSpecSchema.oneofs.find(o3=>o3.name==="provider_config")?.fields.find(f5=>f5.localName===arm)?.name??arm}function newValidateChannelUpdateStep(registry,channelRuntime){return{name:"ValidateChannelUpdate",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing agent channel not found in context"),"existing agent channel not found in context");let inputRef=ctx.input.spec?.agentRef,existingRef=existing.spec?.agentRef,inputOrg=(inputRef?.org??"")!==""?inputRef.org:existing.metadata?.org??"";if((inputRef?.slug??"")!==(existingRef?.slug??"")||inputOrg!==(existingRef?.org??""))throw failedPreconditionError(agentRefImmutableMessage(existingRef?.org??"",existingRef?.slug??""));let inputProvider=providerFieldName(ctx.input.spec),existingProvider=providerFieldName(existing.spec);if(inputProvider!==existingProvider)throw failedPreconditionError(providerImmutableMessage(existingProvider));validateChannelModelPin(registry,ctx.input.spec),validateAppRefUpdate(ctx,existing),channelRuntime!==void 0&&await channelRuntime.enforceWriteConstraints(ctx.input)}}}function newTeardownChannelRuntimeStep(channelRuntime){return{name:"TeardownChannelRuntime",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing agent channel not found in context"),"existing agent channel not found in context");await channelRuntime.teardownOnDelete(existing,ctx.callerIdentity)}}}function validateAppRefUpdate(ctx,existing){let inputAppRef=ctx.input.spec?.appRef,existingAppRef=existing.spec?.appRef;if(ctx.input.spec?.providerConfig.case==="whatsapp"&&(inputAppRef?.slug??"")==="")throw invalidArgumentError(APP_REF_REQUIRED_FOR_WHATSAPP_MESSAGE);let inputAppOrg="";if((inputAppRef?.slug??"")!==""&&(inputAppOrg=inputAppRef.org!==""?inputAppRef.org:existing.metadata?.org??""),inputAppOrg!==""&&inputAppOrg!==(existing.metadata?.org??""))throw failedPreconditionError(APP_REF_SAME_ORG_MESSAGE);let installed=existing.status?.installState===AgentChannelInstallState.installed,changed=(inputAppRef?.slug??"")!==(existingAppRef?.slug??"")||(inputAppRef?.slug??"")!==""&&inputAppOrg!==(existingAppRef?.org??"");if(installed&&changed)throw failedPreconditionError(APP_REF_FROZEN_WHILE_INSTALLED_MESSAGE)}function registerAgentChannelServices(router,deps){router.service(AgentChannelCommandController,{apply:(channel,ctx)=>apply4(deps,channel,ctx),create:(channel,ctx)=>createChannel(deps,channel,ctx),update:(channel,ctx)=>update5(deps,channel,ctx),initiateInstall:(input,ctx)=>initiateInstall(deps,input,ctx),completeInstall:(input,ctx)=>completeInstall(deps,input,ctx),delete:(channelId,ctx)=>deleteChannel(deps,channelId,ctx)}),router.service(AgentChannelQueryController,{get:(channelId,ctx)=>get6(deps,channelId,ctx),getByReference:(ref,ctx)=>getByReference4(deps,ref,ctx),getByAgent:(req,ctx)=>getByAgent3(deps,req,ctx),list:(req,ctx)=>list6(deps,req,ctx)})}function kindOf5(ctx){return ctx.values.get(apiResourceKindKey)}async function createChannel(deps,channel,ctx){let reqCtx=new RequestContext(AgentChannelSchema,channel,callerIdentityOf(ctx),kindOf5(ctx));return await newPipeline("agent-channel-create",deps.logger).addStep(newAuthorizeStep(AgentChannelCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveChannelDefaultsStep(deps.store,deps.modelRegistry,deps.channelRuntime)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveChannelCreateTargets)).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newInitInstallStateStep()).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update5(deps,channel,ctx){let reqCtx=new RequestContext(AgentChannelSchema,channel,callerIdentityOf(ctx),kindOf5(ctx));return await newPipeline("agent-channel-update",deps.logger).addStep(newAuthorizeStep(AgentChannelCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateChannelUpdateStep(deps.modelRegistry,deps.channelRuntime)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).build().execute(reqCtx),reqCtx.newState}async function apply4(deps,channel,ctx){let reqCtx=new RequestContext(AgentChannelSchema,channel,callerIdentityOf(ctx),kindOf5(ctx));await newPipeline("agent-channel-apply",deps.logger).addStep(newAuthorizeStep(AgentChannelCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveChannelDefaultsStep(deps.store,deps.modelRegistry,deps.channelRuntime)).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");let resolved=reqCtx.newState;return shouldCreate?createChannel(deps,resolved,ctx):update5(deps,resolved,ctx)}async function initiateInstall(deps,input,ctx){let channel=await loadChannelForInstall(deps,ctx,input.resourceId);if(await authorizeDirect(AgentChannelCommandController.method.initiateInstall,deps.authorizer,callerIdentityOf(ctx),input),deps.channelRuntime===void 0)throw failedPreconditionError(INSTALL_UNAVAILABLE_MESSAGE);return deps.channelRuntime.installs.initiateInstall(channel,input,callerIdentityOf(ctx))}async function completeInstall(deps,input,ctx){let channel=await loadChannelForInstall(deps,ctx,input.resourceId);if(await authorizeDirect(AgentChannelCommandController.method.completeInstall,deps.authorizer,callerIdentityOf(ctx),input),deps.channelRuntime===void 0)throw failedPreconditionError(INSTALL_UNAVAILABLE_MESSAGE);return deps.channelRuntime.installs.completeInstall(channel,input,callerIdentityOf(ctx))}async function loadChannelForInstall(deps,ctx,resourceId){try{return await deps.store.getResource(kindOf5(ctx),resourceId,AgentChannelSchema)}catch{throw notFoundError("AgentChannel",resourceId)}}async function deleteChannel(deps,channelId,ctx){let reqCtx=new RequestContext(AgentChannelCommandController.method.delete.input,channelId,callerIdentityOf(ctx),kindOf5(ctx)),pipeline2=newPipeline("agent-channel-delete",deps.logger).addStep(newAuthorizeStep(AgentChannelCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,AgentChannelSchema));deps.channelRuntime!==void 0&&pipeline2.addStep(newTeardownChannelRuntimeStep(deps.channelRuntime)),await pipeline2.addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted agent channel not found in context"),"deleted agent channel not found in context");return deleted}async function get6(deps,channelId,ctx){let reqCtx=new RequestContext(AgentChannelQueryController.method.get.input,channelId,callerIdentityOf(ctx),kindOf5(ctx));return await newPipeline("agent-channel-get",deps.logger).addStep(newAuthorizeStep(AgentChannelQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,AgentChannelSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByReference4(deps,ref,ctx){let reqCtx=new RequestContext(AgentChannelQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf5(ctx));return await newPipeline("agent-channel-get-by-reference",deps.logger).addStep(newAuthorizeStep(AgentChannelQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,AgentChannelSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(AgentChannelQueryController.method.get))).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var CHANNEL_LIST_KEY="agentChannelList";async function getByAgent3(deps,req,ctx){let reqCtx=new RequestContext(AgentChannelQueryController.method.getByAgent.input,req,callerIdentityOf(ctx),kindOf5(ctx));await newPipeline("agent-channel-get-by-agent",deps.logger).addStep(newAuthorizeStep(AgentChannelQueryController.method.getByAgent,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadChannelsByAgentStep(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(CHANNEL_LIST_KEY);if(result===void 0)throw internalError(new Error("agent channel list not found in context"),"agent channel list not found in context");return result}function newLoadChannelsByAgentStep(store,listReadScope){return{name:"LoadChannelsByAgent",async execute(ctx){let req=ctx.input,emptyList=create2(AgentChannelListSchema,{totalCount:0,items:[]}),agentOrg,agentSlug;try{let agent=await store.getResource(ApiResourceKind.agent,req.agentId,AgentSchema);agentOrg=agent.metadata?.org??"",agentSlug=agent.metadata?.slug??""}catch{ctx.set(CHANNEL_LIST_KEY,emptyList);return}let rows;try{rows=await store.listResources(ApiResourceKind.agent_channel)}catch(error2){throw internalError(error2,"failed to list agent channels")}let decoded=[];for(let bytes of rows)try{decoded.push(fromBinary2(AgentChannelSchema,bytes))}catch{continue}let channels=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.agent_channel,decoded.filter(channel=>{let ref=channel.spec?.agentRef;return(ref?.org??"")===agentOrg&&(ref?.slug??"")===agentSlug&&(req.org===""||(channel.metadata?.org??"")===req.org)}),"");ctx.set(CHANNEL_LIST_KEY,create2(AgentChannelListSchema,{totalCount:channels.length,items:channels}))}}}var LIST_RESULT_KEY2="listResult";async function list6(deps,req,ctx){let reqCtx=new RequestContext(AgentChannelQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf5(ctx));await newPipeline("agent-channel-list",deps.logger).addStep(newAuthorizeStep(AgentChannelQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgAndLabelsStep3(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY2);if(result===void 0)throw internalError(new Error("agent channel list not found in context"),"agent channel list not found in context");return result}function newListByOrgAndLabelsStep3(store,listReadScope){return{name:"ListByOrgAndLabels",async execute(ctx){let{org,labels:filterLabels}=ctx.input,rows;try{rows=await store.listResources(ctx.apiResourceKind)}catch(error2){throw internalError(error2,"failed to list agent channels")}let decoded=[];for(let bytes of rows)try{decoded.push(fromBinary2(AgentChannelSchema,bytes))}catch{continue}let channels=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.agent_channel,decoded.filter(channel=>(channel.metadata?.org??"")===org&&matchesAllLabels(channel.metadata?.labels??{},filterLabels)),"");channels.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(LIST_RESULT_KEY2,create2(AgentChannelListSchema,{totalCount:channels.length,items:channels}))}}}var file_ai_stigmer_agentic_agentchannel_v1_delivery=fileDesc("CjFhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL2RlbGl2ZXJ5LnByb3RvEiJhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxIvwFCg9DaGFubmVsRGVsaXZlcnkSEwoLZGVsaXZlcnlfaWQYASABKAkSGAoQYWdlbnRfY2hhbm5lbF9pZBgCIAEoCRILCgNvcmcYAyABKAkSFAoMZXhlY3V0aW9uX2lkGAQgASgJEhIKCnNlc3Npb25faWQYBSABKAkSGAoQY29udmVyc2F0aW9uX2tleRgGIAEoCRIZChFleHRlcm5hbF91c2VyX2tleRgHIAEoCRJJCgZzdGF0dXMYCCABKA4yOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNoYW5uZWxEZWxpdmVyeVN0YXR1cxIQCghhdHRlbXB0cxgJIAEoBRISCgpsYXN0X2Vycm9yGAogASgJEhcKD2lkZW1wb3RlbmN5X2tleRgLIAEoCRJJCgVzbGFjaxgMIAEoCzI4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuU2xhY2tEZWxpdmVyeUNvbnRleHRIABJPCgh3aGF0c2FwcBgQIAEoCzI7LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuV2hhdHNBcHBEZWxpdmVyeUNvbnRleHRIABIuCgpjcmVhdGVkX2F0GA0gASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIuCgp1cGRhdGVkX2F0GA4gASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIzCg9uZXh0X2F0dGVtcHRfYXQYDyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhIKCnJlcGx5X3RleHQYESABKAkSUwoMZmFpbHVyZV9raW5kGBIgASgOMj0uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5DaGFubmVsQXR0ZW1wdEZhaWx1cmVLaW5kEhYKDmF0dGVtcHRfZGV0YWlsGBMgASgJQhIKEGRlbGl2ZXJ5X2NvbnRleHQiVQoUU2xhY2tEZWxpdmVyeUNvbnRleHQSEgoKY2hhbm5lbF9pZBgBIAEoCRIRCgl0aHJlYWRfdHMYAiABKAkSFgoOcGxhY2Vob2xkZXJfdHMYAyABKAkiSwoXV2hhdHNBcHBEZWxpdmVyeUNvbnRleHQSFwoPcGhvbmVfbnVtYmVyX2lkGAEgASgJEhcKD3JlY2lwaWVudF93YV9pZBgCIAEoCSqIAQoVQ2hhbm5lbERlbGl2ZXJ5U3RhdHVzEicKI2NoYW5uZWxfZGVsaXZlcnlfc3RhdHVzX3Vuc3BlY2lmaWVkEAASCwoHcGVuZGluZxABEg4KCmRlbGl2ZXJpbmcQAhINCglkZWxpdmVyZWQQAxIKCgZmYWlsZWQQBBIOCgpzdXBwcmVzc2VkEAUqfQoZQ2hhbm5lbEF0dGVtcHRGYWlsdXJlS2luZBIfChthdHRlbXB0X2ZhaWx1cmVfdW5zcGVjaWZpZWQQABITCg9hdHRlbXB0X3JlZnVzZWQQARITCg9hdHRlbXB0X2Vycm9yZWQQAhIVChFhdHRlbXB0X3dpdGhkcmF3bhADYgZwcm90bzM",[file_google_protobuf_timestamp]);var ChannelDeliveryStatus;(function(ChannelDeliveryStatus2){ChannelDeliveryStatus2[ChannelDeliveryStatus2.channel_delivery_status_unspecified=0]="channel_delivery_status_unspecified",ChannelDeliveryStatus2[ChannelDeliveryStatus2.pending=1]="pending",ChannelDeliveryStatus2[ChannelDeliveryStatus2.delivering=2]="delivering",ChannelDeliveryStatus2[ChannelDeliveryStatus2.delivered=3]="delivered",ChannelDeliveryStatus2[ChannelDeliveryStatus2.failed=4]="failed",ChannelDeliveryStatus2[ChannelDeliveryStatus2.suppressed=5]="suppressed"})(ChannelDeliveryStatus||(ChannelDeliveryStatus={}));var ChannelAttemptFailureKind;(function(ChannelAttemptFailureKind2){ChannelAttemptFailureKind2[ChannelAttemptFailureKind2.attempt_failure_unspecified=0]="attempt_failure_unspecified",ChannelAttemptFailureKind2[ChannelAttemptFailureKind2.attempt_refused=1]="attempt_refused",ChannelAttemptFailureKind2[ChannelAttemptFailureKind2.attempt_errored=2]="attempt_errored",ChannelAttemptFailureKind2[ChannelAttemptFailureKind2.attempt_withdrawn=3]="attempt_withdrawn"})(ChannelAttemptFailureKind||(ChannelAttemptFailureKind={}));var file_ai_stigmer_agentic_agentchannel_v1_message_io=fileDesc("CjNhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL21lc3NhZ2VfaW8ucHJvdG8SImFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEivQEKF1NlbmRDaGFubmVsTWVzc2FnZUlucHV0EhgKB2NoYW5uZWwYASABKAlCB7pIBHICGD8SFAoDb3JnGAIgASgJQge6SARyAhg/Eh0KCXJlY2lwaWVudBgDIAEoCUIKukgHcgUQARiAARJTCgdwYXlsb2FkGAQgASgLMjouYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5DaGFubmVsT3V0Ym91bmRQYXlsb2FkQga6SAPIAQEisQEKFkNoYW5uZWxPdXRib3VuZFBheWxvYWQSPwoEdGV4dBgBIAEoCzIvLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuVGV4dFBheWxvYWRIABJHCgh0ZW1wbGF0ZRgCIAEoCzIzLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuVGVtcGxhdGVQYXlsb2FkSABCDQoEa2luZBIFukgCCAEiJwoLVGV4dFBheWxvYWQSGAoEYm9keRgBIAEoCUIKukgHcgUQARiAICKBAgoPVGVtcGxhdGVQYXlsb2FkEhgKBG5hbWUYASABKAlCCrpIB3IFEAEYgAQSGQoIbGFuZ3VhZ2UYAiABKAlCB7pIBHICGBASYQoKcGFyYW1ldGVycxgDIAMoCzJDLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuVGVtcGxhdGVQYXlsb2FkLlBhcmFtZXRlcnNFbnRyeUIIukgFmgECEDISIwoRaGVhZGVyX2ltYWdlX2xpbmsYBCABKAlCCLpIBXIDGIAQGjEKD1BhcmFtZXRlcnNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIq0BChhTZW5kQ2hhbm5lbE1lc3NhZ2VPdXRwdXQSRwoHb3V0Y29tZRgBIAEoDjI2LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQ2hhbm5lbFNlbmRPdXRjb21lEhsKE291dGJvdW5kX21lc3NhZ2VfaWQYAiABKAkSGwoTcHJvdmlkZXJfbWVzc2FnZV9pZBgDIAEoCRIOCgZkZXRhaWwYBCABKAkiYgoZTGlzdENoYW5uZWxUZW1wbGF0ZXNJbnB1dBIYCgdjaGFubmVsGAEgASgJQge6SARyAhg/EhQKA29yZxgCIAEoCUIHukgEcgIYPxIVCg1hcHByb3ZlZF9vbmx5GAMgASgIIlgKEENoYW5uZWxUZW1wbGF0ZXMSRAoHZW50cmllcxgBIAMoCzIzLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQ2hhbm5lbFRlbXBsYXRlIuYBCg9DaGFubmVsVGVtcGxhdGUSDAoEbmFtZRgBIAEoCRIQCghsYW5ndWFnZRgCIAEoCRIQCghjYXRlZ29yeRgDIAEoCRIOCgZzdGF0dXMYBCABKAkSGAoQcGFyYW1ldGVyX2Zvcm1hdBgFIAEoCRIXCg9wYXJhbWV0ZXJfbmFtZXMYBiADKAkSEQoJYm9keV90ZXh0GAcgASgJEhUKDWhlYWRlcl9mb3JtYXQYCCABKAkSGAoQcmVqZWN0aW9uX3JlYXNvbhgJIAEoCRIaChJ1bnN1cHBvcnRlZF9yZWFzb24YCiABKAkiHAoaTGlzdE1lc3NhZ2luZ0NoYW5uZWxzSW5wdXQiWgoRTWVzc2FnaW5nQ2hhbm5lbHMSRQoHZW50cmllcxgBIAMoCzI0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuTWVzc2FnaW5nQ2hhbm5lbCI1ChBNZXNzYWdpbmdDaGFubmVsEg8KB2NoYW5uZWwYASABKAkSEAoIcHJvdmlkZXIYAiABKAkqYQoSQ2hhbm5lbFNlbmRPdXRjb21lEiQKIGNoYW5uZWxfc2VuZF9vdXRjb21lX3Vuc3BlY2lmaWVkEAASDAoIYWNjZXB0ZWQQARIKCgZxdWV1ZWQQAhILCgdyZWZ1c2VkEANiBnByb3RvMw",[file_buf_validate_validate]);var MessagingChannelsSchema=messageDesc2(file_ai_stigmer_agentic_agentchannel_v1_message_io,9);var ChannelSendOutcome;(function(ChannelSendOutcome2){ChannelSendOutcome2[ChannelSendOutcome2.channel_send_outcome_unspecified=0]="channel_send_outcome_unspecified",ChannelSendOutcome2[ChannelSendOutcome2.accepted=1]="accepted",ChannelSendOutcome2[ChannelSendOutcome2.queued=2]="queued",ChannelSendOutcome2[ChannelSendOutcome2.refused=3]="refused"})(ChannelSendOutcome||(ChannelSendOutcome={}));var file_ai_stigmer_agentic_agentchannel_v1_outbound=fileDesc("CjFhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL291dGJvdW5kLnByb3RvEiJhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxIo8HChZDaGFubmVsT3V0Ym91bmRNZXNzYWdlEhsKE291dGJvdW5kX21lc3NhZ2VfaWQYASABKAkSGAoQYWdlbnRfY2hhbm5lbF9pZBgCIAEoCRILCgNvcmcYAyABKAkSEgoKc2Vzc2lvbl9pZBgEIAEoCRJJCgZvcmlnaW4YBSABKA4yOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNoYW5uZWxPdXRib3VuZE9yaWdpbhIRCglyZWNpcGllbnQYBiABKAkSSwoHcGF5bG9hZBgHIAEoCzI6LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQ2hhbm5lbE91dGJvdW5kUGF5bG9hZBJJCgZzdGF0dXMYCCABKA4yOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNoYW5uZWxEZWxpdmVyeVN0YXR1cxIQCghhdHRlbXB0cxgJIAEoBRISCgpsYXN0X2Vycm9yGAogASgJEhcKD2lkZW1wb3RlbmN5X2tleRgLIAEoCRIbChNwcm92aWRlcl9tZXNzYWdlX2lkGAwgASgJEi4KCmNyZWF0ZWRfYXQYDSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi4KCnVwZGF0ZWRfYXQYDiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjMKD25leHRfYXR0ZW1wdF9hdBgPIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASTgoNcmVjZWlwdF9zdGF0ZRgQIAEoDjI3LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQ2hhbm5lbFJlY2VpcHRTdGF0ZRIWCg5yZWNlaXB0X2RldGFpbBgRIAEoCRIaChJyZWNlaXB0X2Vycm9yX2NvZGUYEiABKAUSLgoKcmVjZWlwdF9hdBgTIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASFQoNcmVuZGVyZWRfYm9keRgUIAEoCRJTCgxmYWlsdXJlX2tpbmQYFSABKA4yPS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNoYW5uZWxBdHRlbXB0RmFpbHVyZUtpbmQSFgoOYXR0ZW1wdF9kZXRhaWwYFiABKAkqgwEKE0NoYW5uZWxSZWNlaXB0U3RhdGUSHQoZcmVjZWlwdF9zdGF0ZV91bnNwZWNpZmllZBAAEhAKDHJlY2VpcHRfc2VudBABEhUKEXJlY2VpcHRfZGVsaXZlcmVkEAISEAoMcmVjZWlwdF9yZWFkEAMSEgoOcmVjZWlwdF9mYWlsZWQQBCqHAQoVQ2hhbm5lbE91dGJvdW5kT3JpZ2luEicKI2NoYW5uZWxfb3V0Ym91bmRfb3JpZ2luX3Vuc3BlY2lmaWVkEAASGAoUY2hhbm5lbF9jb252ZXJzYXRpb24QARIMCghvcGVyYXRvchACEgwKCHBsYXRmb3JtEAMSDwoLcGFydGljaXBhbnQQBGIGcHJvdG8z",[file_ai_stigmer_agentic_agentchannel_v1_delivery,file_ai_stigmer_agentic_agentchannel_v1_message_io,file_google_protobuf_timestamp]);var ChannelReceiptState;(function(ChannelReceiptState2){ChannelReceiptState2[ChannelReceiptState2.receipt_state_unspecified=0]="receipt_state_unspecified",ChannelReceiptState2[ChannelReceiptState2.receipt_sent=1]="receipt_sent",ChannelReceiptState2[ChannelReceiptState2.receipt_delivered=2]="receipt_delivered",ChannelReceiptState2[ChannelReceiptState2.receipt_read=3]="receipt_read",ChannelReceiptState2[ChannelReceiptState2.receipt_failed=4]="receipt_failed"})(ChannelReceiptState||(ChannelReceiptState={}));var ChannelOutboundOrigin;(function(ChannelOutboundOrigin2){ChannelOutboundOrigin2[ChannelOutboundOrigin2.channel_outbound_origin_unspecified=0]="channel_outbound_origin_unspecified",ChannelOutboundOrigin2[ChannelOutboundOrigin2.channel_conversation=1]="channel_conversation",ChannelOutboundOrigin2[ChannelOutboundOrigin2.operator=2]="operator",ChannelOutboundOrigin2[ChannelOutboundOrigin2.platform=3]="platform",ChannelOutboundOrigin2[ChannelOutboundOrigin2.participant=4]="participant"})(ChannelOutboundOrigin||(ChannelOutboundOrigin={}));var file_ai_stigmer_agentic_agentchannel_v1_conversation_io=fileDesc("CjhhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL2NvbnZlcnNhdGlvbl9pby5wcm90bxIiYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MSL+AwoTQ2hhbm5lbENvbnZlcnNhdGlvbhIYChBhZ2VudF9jaGFubmVsX2lkGAEgASgJEhgKEGNvbnZlcnNhdGlvbl9rZXkYAiABKAkSCwoDb3JnGAMgASgJEkgKB2NvbnRyb2wYBCABKA4yNy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNvbnZlcnNhdGlvbkNvbnRyb2wSFQoNY29udHJvbGxlZF9ieRgFIAEoCRI2ChJjb250cm9sX2NoYW5nZWRfYXQYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhcKD25lZWRzX2F0dGVudGlvbhgHIAEoCBIYChBhdHRlbnRpb25fcmVhc29uGAggASgJEjgKFGF0dGVudGlvbl9jaGFuZ2VkX2F0GAkgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIUCgxkaXNwbGF5X25hbWUYCiABKAkSPAoYbGFzdF9jdXN0b21lcl9tZXNzYWdlX2F0GAsgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBI0ChBsYXN0X2FjdGl2aXR5X2F0GAwgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIWCg5hd2FpdGluZ19yZXBseRgNIAEoCCKGBgoYQ29udmVyc2F0aW9uVGltZWxpbmVJdGVtEg8KB2l0ZW1faWQYASABKAkSQgoEbGFuZRgCIAEoDjI0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQ29udmVyc2F0aW9uTGFuZRJKCgZhdXRob3IYAyABKA4yOi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNvbnZlcnNhdGlvbkl0ZW1BdXRob3ISEwoLYXV0aG9yZWRfYnkYBCABKAkSDAoEdGV4dBgFIAEoCRIdChVwcm92aWRlcl9tZXNzYWdlX3R5cGUYBiABKAkSJgoCYXQYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wElIKD2RlbGl2ZXJ5X3N0YXR1cxgIIAEoDjI5LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQ2hhbm5lbERlbGl2ZXJ5U3RhdHVzEk4KDXJlY2VpcHRfc3RhdGUYCSABKA4yNy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNoYW5uZWxSZWNlaXB0U3RhdGUSSQoGb3JpZ2luGAogASgOMjkuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5DaGFubmVsT3V0Ym91bmRPcmlnaW4SFgoOcmVjZWlwdF9kZXRhaWwYCyABKAkSGgoScmVjZWlwdF9lcnJvcl9jb2RlGAwgASgFEkcKBW1lZGlhGA0gASgLMjguYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5Db252ZXJzYXRpb25NZWRpYVJlZhIWCg5hdHRlbXB0X2RldGFpbBgOIAEoCRJbChRhdHRlbXB0X2ZhaWx1cmVfa2luZBgPIAEoDjI9LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQ2hhbm5lbEF0dGVtcHRGYWlsdXJlS2luZCJSChRDb252ZXJzYXRpb25NZWRpYVJlZhIQCghmaWxlbmFtZRgBIAEoCRIUCgxjb250ZW50X3R5cGUYAiABKAkSEgoKc2l6ZV9ieXRlcxgDIAEoAyLjAQodTGlzdENoYW5uZWxDb252ZXJzYXRpb25zSW5wdXQSFgoDb3JnGAEgASgJQgm6SAZyBBABGD8SIgoQYWdlbnRfY2hhbm5lbF9pZBgCIAEoCUIIukgFcgMYgAESMwoJcGFnZV9pbmZvGAMgASgLMiAuYWkuc3RpZ21lci5jb21tb25zLnJwYy5QYWdlSW5mbxJRCgZmaWx0ZXIYBCABKA4yQS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNoYW5uZWxDb252ZXJzYXRpb25MaXN0RmlsdGVyInYKF0NoYW5uZWxDb252ZXJzYXRpb25MaXN0EhMKC3RvdGFsX2NvdW50GAEgASgFEkYKBWl0ZW1zGAIgAygLMjcuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5DaGFubmVsQ29udmVyc2F0aW9uImkKG0dldENoYW5uZWxDb252ZXJzYXRpb25JbnB1dBIkChBhZ2VudF9jaGFubmVsX2lkGAEgASgJQgq6SAdyBRABGIABEiQKEGNvbnZlcnNhdGlvbl9rZXkYAiABKAlCCrpIB3IFEAEYgAEikQEKHEdldENvbnZlcnNhdGlvblRpbWVsaW5lSW5wdXQSJAoQYWdlbnRfY2hhbm5lbF9pZBgBIAEoCUIKukgHcgUQARiAARIkChBjb252ZXJzYXRpb25fa2V5GAIgASgJQgq6SAdyBRABGIABEhEKCXBhZ2Vfc2l6ZRgDIAEoBRISCgpwYWdlX3Rva2VuGAQgASgJInwKFENvbnZlcnNhdGlvblRpbWVsaW5lEksKBWl0ZW1zGAEgAygLMjwuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5Db252ZXJzYXRpb25UaW1lbGluZUl0ZW0SFwoPbmV4dF9wYWdlX3Rva2VuGAIgASgJIo8BCiRHZXRDb252ZXJzYXRpb25NZWRpYURvd25sb2FkVXJsSW5wdXQSJAoQYWdlbnRfY2hhbm5lbF9pZBgBIAEoCUIKukgHcgUQARiAARIkChBjb252ZXJzYXRpb25fa2V5GAIgASgJQgq6SAdyBRABGIABEhsKB2l0ZW1faWQYAyABKAlCCrpIB3IFEAEYgAIiWwocQ29udmVyc2F0aW9uTWVkaWFEb3dubG9hZFVybBILCgN1cmwYASABKAkSLgoKZXhwaXJlc19hdBgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiZgoYQ29udmVyc2F0aW9uQ29udHJvbElucHV0EiQKEGFnZW50X2NoYW5uZWxfaWQYASABKAlCCrpIB3IFEAEYgAESJAoQY29udmVyc2F0aW9uX2tleRgCIAEoCUIKukgHcgUQARiAASK7AQoYUmVwbHlUb0NvbnZlcnNhdGlvbklucHV0EiQKEGFnZW50X2NoYW5uZWxfaWQYASABKAlCCrpIB3IFEAEYgAESJAoQY29udmVyc2F0aW9uX2tleRgCIAEoCUIKukgHcgUQARiAARJTCgdwYXlsb2FkGAMgASgLMjouYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5DaGFubmVsT3V0Ym91bmRQYXlsb2FkQga6SAPIAQEiNwoZRXNjYWxhdGVDb252ZXJzYXRpb25JbnB1dBIaCgZyZWFzb24YASABKAlCCrpIB3IFEAEYgAgqYQoTQ29udmVyc2F0aW9uQ29udHJvbBIkCiBjb252ZXJzYXRpb25fY29udHJvbF91bnNwZWNpZmllZBAAEhEKDWNvbnRyb2xfYWdlbnQQARIRCg1jb250cm9sX2h1bWFuEAIqWQoQQ29udmVyc2F0aW9uTGFuZRIhCh1jb252ZXJzYXRpb25fbGFuZV91bnNwZWNpZmllZBAAEg8KC2xhbmVfcHVibGljEAESEQoNbGFuZV9pbnRlcm5hbBACKpMBChZDb252ZXJzYXRpb25JdGVtQXV0aG9yEigKJGNvbnZlcnNhdGlvbl9pdGVtX2F1dGhvcl91bnNwZWNpZmllZBAAEhMKD2F1dGhvcl9jdXN0b21lchABEhAKDGF1dGhvcl9hZ2VudBACEhMKD2F1dGhvcl90ZWFtbWF0ZRADEhMKD2F1dGhvcl9wbGF0Zm9ybRAEKmkKHUNoYW5uZWxDb252ZXJzYXRpb25MaXN0RmlsdGVyEjAKLGNoYW5uZWxfY29udmVyc2F0aW9uX2xpc3RfZmlsdGVyX3Vuc3BlY2lmaWVkEAASFgoSZmlsdGVyX3dhbnRzX2h1bWFuEAFiBnByb3RvMw",[file_ai_stigmer_agentic_agentchannel_v1_delivery,file_ai_stigmer_agentic_agentchannel_v1_message_io,file_ai_stigmer_agentic_agentchannel_v1_outbound,file_ai_stigmer_commons_rpc_pagination,file_buf_validate_validate,file_google_protobuf_timestamp]);var ChannelConversationListSchema=messageDesc2(file_ai_stigmer_agentic_agentchannel_v1_conversation_io,4);var ConversationTimelineSchema=messageDesc2(file_ai_stigmer_agentic_agentchannel_v1_conversation_io,7);var ConversationControl;(function(ConversationControl2){ConversationControl2[ConversationControl2.conversation_control_unspecified=0]="conversation_control_unspecified",ConversationControl2[ConversationControl2.control_agent=1]="control_agent",ConversationControl2[ConversationControl2.control_human=2]="control_human"})(ConversationControl||(ConversationControl={}));var ConversationLane;(function(ConversationLane2){ConversationLane2[ConversationLane2.conversation_lane_unspecified=0]="conversation_lane_unspecified",ConversationLane2[ConversationLane2.lane_public=1]="lane_public",ConversationLane2[ConversationLane2.lane_internal=2]="lane_internal"})(ConversationLane||(ConversationLane={}));var ConversationItemAuthor;(function(ConversationItemAuthor2){ConversationItemAuthor2[ConversationItemAuthor2.conversation_item_author_unspecified=0]="conversation_item_author_unspecified",ConversationItemAuthor2[ConversationItemAuthor2.author_customer=1]="author_customer",ConversationItemAuthor2[ConversationItemAuthor2.author_agent=2]="author_agent",ConversationItemAuthor2[ConversationItemAuthor2.author_teammate=3]="author_teammate",ConversationItemAuthor2[ConversationItemAuthor2.author_platform=4]="author_platform"})(ConversationItemAuthor||(ConversationItemAuthor={}));var ChannelConversationListFilter;(function(ChannelConversationListFilter2){ChannelConversationListFilter2[ChannelConversationListFilter2.channel_conversation_list_filter_unspecified=0]="channel_conversation_list_filter_unspecified",ChannelConversationListFilter2[ChannelConversationListFilter2.filter_wants_human=1]="filter_wants_human"})(ChannelConversationListFilter||(ChannelConversationListFilter={}));var file_ai_stigmer_agentic_agentchannel_v1_conversation_command=fileDesc("Cj1haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL2NvbnZlcnNhdGlvbl9jb21tYW5kLnByb3RvEiJhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxMrcICiRDaGFubmVsQ29udmVyc2F0aW9uQ29tbWFuZENvbnRyb2xsZXIS3QEKBXJlcGx5EjwuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5SZXBseVRvQ29udmVyc2F0aW9uSW5wdXQaPC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLlNlbmRDaGFubmVsTWVzc2FnZU91dHB1dCJYwrgYVAgkEC8iEGFnZW50X2NoYW5uZWxfaWQqPHVuYXV0aG9yaXplZCB0byBwYXJ0aWNpcGF0ZSBpbiBjb252ZXJzYXRpb25zIG9uIHRoaXMgY2hhbm5lbBLbAQoIdGFrZU92ZXISPC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNvbnZlcnNhdGlvbkNvbnRyb2xJbnB1dBo3LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQ2hhbm5lbENvbnZlcnNhdGlvbiJYwrgYVAgkEC8iEGFnZW50X2NoYW5uZWxfaWQqPHVuYXV0aG9yaXplZCB0byBwYXJ0aWNpcGF0ZSBpbiBjb252ZXJzYXRpb25zIG9uIHRoaXMgY2hhbm5lbBLbAQoIaGFuZEJhY2sSPC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNvbnZlcnNhdGlvbkNvbnRyb2xJbnB1dBo3LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQ2hhbm5lbENvbnZlcnNhdGlvbiJYwrgYVAgkEC8iEGFnZW50X2NoYW5uZWxfaWQqPHVuYXV0aG9yaXplZCB0byBwYXJ0aWNpcGF0ZSBpbiBjb252ZXJzYXRpb25zIG9uIHRoaXMgY2hhbm5lbBLhAQoOY2xlYXJBdHRlbnRpb24SPC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNvbnZlcnNhdGlvbkNvbnRyb2xJbnB1dBo3LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQ2hhbm5lbENvbnZlcnNhdGlvbiJYwrgYVAgkEC8iEGFnZW50X2NoYW5uZWxfaWQqPHVuYXV0aG9yaXplZCB0byBwYXJ0aWNpcGF0ZSBpbiBjb252ZXJzYXRpb25zIG9uIHRoaXMgY2hhbm5lbBKIAQoIZXNjYWxhdGUSPS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkVzY2FsYXRlQ29udmVyc2F0aW9uSW5wdXQaNy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNoYW5uZWxDb252ZXJzYXRpb24iBNC4GAEaBKD/Ky9iBnByb3RvMw",[file_ai_stigmer_agentic_agentchannel_v1_conversation_io,file_ai_stigmer_agentic_agentchannel_v1_message_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ChannelConversationCommandController=serviceDesc(file_ai_stigmer_agentic_agentchannel_v1_conversation_command,0);var file_ai_stigmer_agentic_agentchannel_v1_conversation_query=fileDesc("CjthaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL2NvbnZlcnNhdGlvbl9xdWVyeS5wcm90bxIiYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MTL0BgoiQ2hhbm5lbENvbnZlcnNhdGlvblF1ZXJ5Q29udHJvbGxlchKZAQoRbGlzdENvbnZlcnNhdGlvbnMSQS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkxpc3RDaGFubmVsQ29udmVyc2F0aW9uc0lucHV0GjsuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5DaGFubmVsQ29udmVyc2F0aW9uTGlzdCIE0LgYARLbAQoPZ2V0Q29udmVyc2F0aW9uEj8uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5HZXRDaGFubmVsQ29udmVyc2F0aW9uSW5wdXQaNy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNoYW5uZWxDb252ZXJzYXRpb24iTsK4GEoIARAvIhBhZ2VudF9jaGFubmVsX2lkKjJ1bmF1dGhvcml6ZWQgdG8gdmlldyBjb252ZXJzYXRpb25zIG9uIHRoaXMgY2hhbm5lbBLZAQoLZ2V0VGltZWxpbmUSQC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkdldENvbnZlcnNhdGlvblRpbWVsaW5lSW5wdXQaOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNvbnZlcnNhdGlvblRpbWVsaW5lIk7CuBhKCAEQLyIQYWdlbnRfY2hhbm5lbF9pZCoydW5hdXRob3JpemVkIHRvIHZpZXcgY29udmVyc2F0aW9ucyBvbiB0aGlzIGNoYW5uZWwS8QEKE2dldE1lZGlhRG93bmxvYWRVcmwSSC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkdldENvbnZlcnNhdGlvbk1lZGlhRG93bmxvYWRVcmxJbnB1dBpALmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQ29udmVyc2F0aW9uTWVkaWFEb3dubG9hZFVybCJOwrgYSggBEC8iEGFnZW50X2NoYW5uZWxfaWQqMnVuYXV0aG9yaXplZCB0byB2aWV3IGNvbnZlcnNhdGlvbnMgb24gdGhpcyBjaGFubmVsGgSg/ysvYgZwcm90bzM",[file_ai_stigmer_agentic_agentchannel_v1_conversation_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ChannelConversationQueryController=serviceDesc(file_ai_stigmer_agentic_agentchannel_v1_conversation_query,0);function registerChannelConversationServices(router,channelRuntime){if(channelRuntime===void 0){router.service(ChannelConversationQueryController,{listConversations:()=>create2(ChannelConversationListSchema),getTimeline:()=>create2(ConversationTimelineSchema),getConversation:input=>{throw notFoundError("channel conversation",input.conversationKey)},getMediaDownloadUrl:()=>{throw new ConnectError(NO_DOWNLOADABLE_MEDIA_MESSAGE,Code.NotFound)}}),router.service(ChannelConversationCommandController,{reply:()=>{throw failedPreconditionError(CONVERSATION_PARTICIPATION_UNAVAILABLE_MESSAGE)},takeOver:()=>{throw failedPreconditionError(CONVERSATION_PARTICIPATION_UNAVAILABLE_MESSAGE)},handBack:()=>{throw failedPreconditionError(CONVERSATION_PARTICIPATION_UNAVAILABLE_MESSAGE)},clearAttention:()=>{throw failedPreconditionError(CONVERSATION_PARTICIPATION_UNAVAILABLE_MESSAGE)},escalate:()=>{throw failedPreconditionError(CONVERSATION_PARTICIPATION_UNAVAILABLE_MESSAGE)}});return}let{conversations}=channelRuntime;router.service(ChannelConversationQueryController,{listConversations:(input,ctx)=>conversations.listConversations(input,callerIdentityOf(ctx)),getConversation:(input,ctx)=>conversations.getConversation(input,callerIdentityOf(ctx)),getTimeline:(input,ctx)=>conversations.getTimeline(input,callerIdentityOf(ctx)),getMediaDownloadUrl:(input,ctx)=>conversations.getMediaDownloadUrl(input,callerIdentityOf(ctx))}),router.service(ChannelConversationCommandController,{reply:(input,ctx)=>conversations.reply(input,callerIdentityOf(ctx)),takeOver:(input,ctx)=>conversations.takeOver(input,callerIdentityOf(ctx)),handBack:(input,ctx)=>conversations.handBack(input,callerIdentityOf(ctx)),clearAttention:(input,ctx)=>conversations.clearAttention(input,callerIdentityOf(ctx)),escalate:(input,ctx)=>conversations.escalate(input,callerIdentityOf(ctx))})}var file_ai_stigmer_agentic_agentchannel_v1_message_command=fileDesc("CjhhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL21lc3NhZ2VfY29tbWFuZC5wcm90bxIiYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MTK4AQofQ2hhbm5lbE1lc3NhZ2VDb21tYW5kQ29udHJvbGxlchKOAQoLc2VuZE1lc3NhZ2USOy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLlNlbmRDaGFubmVsTWVzc2FnZUlucHV0GjwuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5TZW5kQ2hhbm5lbE1lc3NhZ2VPdXRwdXQiBNC4GAEaBKD/Ky9iBnByb3RvMw",[file_ai_stigmer_agentic_agentchannel_v1_message_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ChannelMessageCommandController=serviceDesc(file_ai_stigmer_agentic_agentchannel_v1_message_command,0);var file_ai_stigmer_agentic_agentchannel_v1_message_query=fileDesc("CjZhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL21lc3NhZ2VfcXVlcnkucHJvdG8SImFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEyyQIKHUNoYW5uZWxNZXNzYWdlUXVlcnlDb250cm9sbGVyEooBCg1saXN0VGVtcGxhdGVzEj0uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5MaXN0Q2hhbm5lbFRlbXBsYXRlc0lucHV0GjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5DaGFubmVsVGVtcGxhdGVzIgTQuBgBEpQBChVsaXN0TWVzc2FnaW5nQ2hhbm5lbHMSPi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkxpc3RNZXNzYWdpbmdDaGFubmVsc0lucHV0GjUuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5NZXNzYWdpbmdDaGFubmVscyIE0LgYARoEoP8rL2IGcHJvdG8z",[file_ai_stigmer_agentic_agentchannel_v1_message_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ChannelMessageQueryController=serviceDesc(file_ai_stigmer_agentic_agentchannel_v1_message_query,0);function registerChannelMessageServices(router,channelRuntime){if(channelRuntime===void 0){router.service(ChannelMessageCommandController,{sendMessage:()=>{throw failedPreconditionError(PROACTIVE_MESSAGING_UNAVAILABLE_MESSAGE)}}),router.service(ChannelMessageQueryController,{listTemplates:()=>{throw failedPreconditionError(PROACTIVE_MESSAGING_UNAVAILABLE_MESSAGE)},listMessagingChannels:()=>create2(MessagingChannelsSchema)});return}let{messaging}=channelRuntime;router.service(ChannelMessageCommandController,{sendMessage:(input,ctx)=>messaging.sendMessage(input,callerIdentityOf(ctx))}),router.service(ChannelMessageQueryController,{listTemplates:(input,ctx)=>messaging.listTemplates(input,callerIdentityOf(ctx)),listMessagingChannels:(input,ctx)=>messaging.listMessagingChannels(input,callerIdentityOf(ctx))})}var file_ai_stigmer_agentic_agentshare_v1_io=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRzaGFyZS92MS9pby5wcm90bxIgYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEiJQoMQWdlbnRTaGFyZUlkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiegocR2V0QWdlbnRTaGFyZXNCeUFnZW50UmVxdWVzdBIYCghhZ2VudF9pZBgBIAEoCUIGukgDyAEBEjMKCXBhZ2VfaW5mbxgCIAEoCzIgLmFpLnN0aWdtZXIuY29tbW9ucy5ycGMuUGFnZUluZm8SCwoDb3JnGAMgASgJImIKDkFnZW50U2hhcmVMaXN0EhMKC3RvdGFsX2NvdW50GAEgASgFEjsKBWl0ZW1zGAIgAygLMiwuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuQWdlbnRTaGFyZSLoAQoWTGlzdEFnZW50U2hhcmVzUmVxdWVzdBIUCgNvcmcYASABKAlCB7pIBHICEAESVAoGbGFiZWxzGAIgAygLMkQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuTGlzdEFnZW50U2hhcmVzUmVxdWVzdC5MYWJlbHNFbnRyeRIzCglwYWdlX2luZm8YAyABKAsyIC5haS5zdGlnbWVyLmNvbW1vbnMucnBjLlBhZ2VJbmZvGi0KC0xhYmVsc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEiMwoUUm90YXRlU2hhcmVMaW5rSW5wdXQSGwoLcmVzb3VyY2VfaWQYASABKAlCBrpIA8gBASJSChdHZXRTaGFyZWRQcm9maWxlUmVxdWVzdBILCgNvcmcYASABKAkSDAoEc2x1ZxgCIAEoCRIcCgpsaW5rX3Rva2VuGAMgASgJQgi6SAVyAxiAASKBAQoSU2hhcmVkQWdlbnRQcm9maWxlEgsKA29yZxgBIAEoCRIMCgRzbHVnGAIgASgJEgwKBG5hbWUYAyABKAkSEwoLZGVzY3JpcHRpb24YBCABKAkSEAoIaWNvbl91cmwYBSABKAkSGwoTZGVmYXVsdF9pbnN0YW5jZV9pZBgGIAEoCWIGcHJvdG8z",[file_ai_stigmer_agentic_agentshare_v1_api,file_ai_stigmer_commons_rpc_pagination,file_buf_validate_validate]);var AgentShareListSchema=messageDesc2(file_ai_stigmer_agentic_agentshare_v1_io,2);var SharedAgentProfileSchema=messageDesc2(file_ai_stigmer_agentic_agentshare_v1_io,6);var file_ai_stigmer_agentic_agentshare_v1_command=fileDesc("Ci5haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRzaGFyZS92MS9jb21tYW5kLnByb3RvEiBhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRzaGFyZS52MTLuBQobQWdlbnRTaGFyZUNvbW1hbmRDb250cm9sbGVyEmMKBWFwcGx5EiwuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuQWdlbnRTaGFyZRosLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxLkFnZW50U2hhcmUSagoGY3JlYXRlEiwuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuQWdlbnRTaGFyZRosLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxLkFnZW50U2hhcmUiBNC4GAESnwEKBnVwZGF0ZRIsLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxLkFnZW50U2hhcmUaLC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRzaGFyZS52MS5BZ2VudFNoYXJlIjnCuBg1CAIQLiILbWV0YWRhdGEuaWQqInVuYXV0aG9yaXplZCB0byB1cGRhdGUgYWdlbnQgc2hhcmUStwEKD3JvdGF0ZVNoYXJlTGluaxI2LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxLlJvdGF0ZVNoYXJlTGlua0lucHV0GiwuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuQWdlbnRTaGFyZSI+wrgYOggCEC4iC3Jlc291cmNlX2lkKid1bmF1dGhvcml6ZWQgdG8gcm90YXRlIGFnZW50IHNoYXJlIGxpbmsSmwEKBmRlbGV0ZRIuLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxLkFnZW50U2hhcmVJZBosLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxLkFnZW50U2hhcmUiM8K4GC8IAxAuIgV2YWx1ZSoidW5hdXRob3JpemVkIHRvIGRlbGV0ZSBhZ2VudCBzaGFyZRoEoP8rLmIGcHJvdG8z",[file_ai_stigmer_agentic_agentshare_v1_api,file_ai_stigmer_agentic_agentshare_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentShareCommandController=serviceDesc(file_ai_stigmer_agentic_agentshare_v1_command,0);var file_ai_stigmer_agentic_agentshare_v1_query=fileDesc("CixhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRzaGFyZS92MS9xdWVyeS5wcm90bxIgYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEy0gYKGUFnZW50U2hhcmVRdWVyeUNvbnRyb2xsZXISlQEKA2dldBIuLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxLkFnZW50U2hhcmVJZBosLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxLkFnZW50U2hhcmUiMMK4GCwIARAuIgV2YWx1ZSofdW5hdXRob3JpemVkIHRvIGdldCBhZ2VudCBzaGFyZRJ6Cg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRosLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxLkFnZW50U2hhcmUiBNC4GAEShAEKCmdldEJ5QWdlbnQSPi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRzaGFyZS52MS5HZXRBZ2VudFNoYXJlc0J5QWdlbnRSZXF1ZXN0GjAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuQWdlbnRTaGFyZUxpc3QiBNC4GAESeAoEbGlzdBI4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxLkxpc3RBZ2VudFNoYXJlc1JlcXVlc3QaMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRzaGFyZS52MS5BZ2VudFNoYXJlTGlzdCIE0LgYARKJAQoQZ2V0U2hhcmVkUHJvZmlsZRI5LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxLkdldFNoYXJlZFByb2ZpbGVSZXF1ZXN0GjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuU2hhcmVkQWdlbnRQcm9maWxlIgTIuBgBEo0BChlnZXRTaGFyZWRQcm9maWxlRm9yTWVtYmVyEjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlGjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuU2hhcmVkQWdlbnRQcm9maWxlIgTQuBgBGgSg/ysuYgZwcm90bzM",[file_ai_stigmer_agentic_agentshare_v1_api,file_ai_stigmer_agentic_agentshare_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentShareQueryController=serviceDesc(file_ai_stigmer_agentic_agentshare_v1_query,0);var ORG_REQUIRED_MESSAGE2="metadata.org is required for an agent share",AGENT_REF_SLUG_REQUIRED_MESSAGE2="spec.agent_ref.slug is required",ORG_REQUIRED_FOR_LOOKUP_MESSAGE="org is required for shared agent lookup";function sameOrgInvariantMessage2(refOrg){return`spec.agent_ref.org must match metadata.org \u2014 a share must live in the referenced agent's organization (${refOrg})`}function agentRefImmutableMessage2(org,slug){return`spec.agent_ref is immutable (share references ${org}/${slug}) \u2014 create a new share to distribute a different agent`}var import_node_crypto15=require("node:crypto");var REFERENCED_AGENT_KEY3="agentShareReferencedAgent",SHARE_AGENT_DENIED_MESSAGE="You don't have permission to share this agent",SHARE_ORGANIZATION_DENIED_MESSAGE="You don't have permission to create agent shares in this organization";function resolveShareCreateTargets(ctx){let agent=ctx.get(REFERENCED_AGENT_KEY3);if(agent===void 0)throw new Error("referenced agent not found in context");return[{permission:IamPermission.can_edit,resourceKind:ApiResourceKind.agent,resourceId:agent.metadata?.id??"",deniedMessage:SHARE_AGENT_DENIED_MESSAGE},{permission:IamPermission.can_create_agent_share,resourceKind:ApiResourceKind.organization,resourceId:ctx.newState.metadata?.org??"",deniedMessage:SHARE_ORGANIZATION_DENIED_MESSAGE}]}function sharedNotFound(slug){return notFoundError("Agent",slug)}function newAuthorizeMemberAudienceStep(authorizer){return{name:"AuthorizeMemberAudience",async execute(ctx){let ref=ctx.input;if(ref.org===""||ctx.callerIdentity.callerClass==="internal")return;let decision=await evaluateAuthorizer(authorizer,ctx.callerIdentity,{permission:IamPermission.can_view,resourceKind:ApiResourceKind.organization,resourceId:ref.org});switch(decision.kind){case"allow":return;case"deny":case"not-found":throw sharedNotFound(ref.slug);case"unavailable":throw internalError(decision.cause,AUTHORIZATION_UNAVAILABLE_MESSAGE);default:{let exhaustive=decision;throw internalError(new Error(`unknown decision ${JSON.stringify(exhaustive)}`),AUTHORIZATION_UNAVAILABLE_MESSAGE)}}}}}function sharingLinkTokenAllowed(presented,live){if(live==="")return!0;if(presented==="")return!1;let presentedBytes=Buffer.from(presented),liveBytes=Buffer.from(live);return presentedBytes.length!==liveBytes.length?!1:(0,import_node_crypto15.timingSafeEqual)(presentedBytes,liveBytes)}function generateShareLinkToken(){return(0,import_node_crypto15.randomBytes)(20).toString("base64url")}async function findAgentByOrgAndSlug(store,org,slug){let rows;try{rows=await store.listResources(ApiResourceKind.agent)}catch(error2){throw internalError(error2,"failed to list agent resources")}for(let data of rows){let agent;try{agent=fromBinary2(AgentSchema,data)}catch{continue}if(agent.metadata?.slug===slug&&agent.metadata.org===org)return agent}}async function findShareByOrgAndSlug(store,org,slug){let rows;try{rows=await store.listResources(ApiResourceKind.agent_share)}catch(error2){throw internalError(error2,"failed to list agent share resources")}for(let data of rows){let share;try{share=fromBinary2(AgentShareSchema,data)}catch{continue}if(share.metadata?.slug===slug&&share.metadata.org===org)return share}}function newResolveShareDefaultsStep(store){return{name:"ResolveShareDefaults",async execute(ctx){let share=ctx.newState,metadata=share.metadata;if((metadata?.org??"")==="")throw invalidArgumentError(ORG_REQUIRED_MESSAGE2);let agentRef=share.spec?.agentRef;if((agentRef?.slug??"")==="")throw invalidArgumentError(AGENT_REF_SLUG_REQUIRED_MESSAGE2);if(agentRef.org===""&&(agentRef.org=metadata.org),agentRef.org!==metadata.org)throw failedPreconditionError(sameOrgInvariantMessage2(agentRef.org));let agent=await findAgentByOrgAndSlug(store,agentRef.org,agentRef.slug);if(agent===void 0)throw notFoundError("Agent",agentRef.slug);ctx.set(REFERENCED_AGENT_KEY3,agent),metadata.slug===""&&metadata.name===""&&(metadata.slug=agent.metadata?.slug??"",metadata.name=agent.metadata?.name??"")}}}function newStampAgentPinStep(){return{name:"StampAgentPin",execute(ctx){let agent=ctx.get(REFERENCED_AGENT_KEY3);if(agent===void 0)throw internalError(new Error("referenced agent not found in context"),"referenced agent not found in context (ResolveShareDefaults must run first)");let share=ctx.newState,status=share.status??create2(AgentShareStatusSchema);status.agentId=agent.metadata?.id??"",share.status=status}}}function newValidateShareUpdateStep(){return{name:"ValidateShareUpdate",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing agent share not found in context"),"existing agent share not found in context");let inputRef=ctx.input.spec?.agentRef,existingRef=existing.spec?.agentRef,inputOrg=(inputRef?.org??"")!==""?inputRef.org:existing.metadata?.org??"";if((inputRef?.slug??"")!==(existingRef?.slug??"")||inputOrg!==(existingRef?.org??""))throw failedPreconditionError(agentRefImmutableMessage2(existingRef?.org??"",existingRef?.slug??""))}}}async function buildSharedAgentProfile(store,share){let ref=share.spec?.agentRef,agent=await findAgentByOrgAndSlug(store,ref?.org??"",ref?.slug??"");if(agent===void 0)throw sharedNotFound(share.metadata?.slug??"");let pin=share.status?.agentId??"";if(pin!==""&&pin!==(agent.metadata?.id??"")||(share.metadata?.org??"")!==(agent.metadata?.org??""))throw sharedNotFound(share.metadata?.slug??"");return create2(SharedAgentProfileSchema,{org:share.metadata?.org??"",slug:share.metadata?.slug??"",name:agent.metadata?.name??"",description:agent.spec?.description??"",iconUrl:agent.spec?.iconUrl??"",defaultInstanceId:agent.status?.defaultInstanceId??""})}function registerAgentShareServices(router,deps){router.service(AgentShareCommandController,{apply:(share,ctx)=>apply5(deps,share,ctx),create:(share,ctx)=>createShare(deps,share,ctx),update:(share,ctx)=>update6(deps,share,ctx),rotateShareLink:(input,ctx)=>rotateShareLink(deps,input,ctx),delete:(shareId,ctx)=>deleteShare(deps,shareId,ctx)}),router.service(AgentShareQueryController,{get:(shareId,ctx)=>get7(deps,shareId,ctx),getByReference:(ref,ctx)=>getByReference5(deps,ref,ctx),getByAgent:(req,ctx)=>getByAgent4(deps,req,ctx),list:(req,ctx)=>list7(deps,req,ctx),getSharedProfile:(req,ctx)=>getSharedProfile(deps,req,ctx),getSharedProfileForMember:(ref,ctx)=>getSharedProfileForMember(deps,ref,ctx)})}function kindOf6(ctx){return ctx.values.get(apiResourceKindKey)}async function createShare(deps,share,ctx){let reqCtx=new RequestContext(AgentShareSchema,share,callerIdentityOf(ctx),kindOf6(ctx));return await newPipeline("agent-share-create",deps.logger).addStep(newAuthorizeStep(AgentShareCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveShareDefaultsStep(deps.store)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveShareCreateTargets)).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newStampAgentPinStep()).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update6(deps,share,ctx){let reqCtx=new RequestContext(AgentShareSchema,share,callerIdentityOf(ctx),kindOf6(ctx));return await newPipeline("agent-share-update",deps.logger).addStep(newAuthorizeStep(AgentShareCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateShareUpdateStep()).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).build().execute(reqCtx),reqCtx.newState}async function apply5(deps,share,ctx){let reqCtx=new RequestContext(AgentShareSchema,share,callerIdentityOf(ctx),kindOf6(ctx));await newPipeline("agent-share-apply",deps.logger).addStep(newAuthorizeStep(AgentShareCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveShareDefaultsStep(deps.store)).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");let resolved=reqCtx.newState;return shouldCreate?createShare(deps,resolved,ctx):update6(deps,resolved,ctx)}var ROTATE_SHARE_KEY="rotateShareLinkShare";async function rotateShareLink(deps,input,ctx){let reqCtx=new RequestContext(AgentShareCommandController.method.rotateShareLink.input,input,callerIdentityOf(ctx),kindOf6(ctx));return await newPipeline("agent-share-rotate-share-link",deps.logger).addStep(newAuthorizeStep(AgentShareCommandController.method.rotateShareLink,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadShareForLinkRotationStep(deps.store)).addStep(newRotateShareLinkTokenStep()).addStep(newPersistShareForLinkRotationStep(deps.store)).build().execute(reqCtx),reqCtx.get(ROTATE_SHARE_KEY)}function newLoadShareForLinkRotationStep(store){return{name:"LoadShareForLinkRotation",async execute(ctx){let share;try{share=await store.getResource(ctx.apiResourceKind,ctx.input.resourceId,AgentShareSchema)}catch{throw notFoundError("AgentShare",ctx.input.resourceId)}ctx.set(ROTATE_SHARE_KEY,share)}}}function newRotateShareLinkTokenStep(){return{name:"RotateShareLinkToken",execute(ctx){let share=ctx.get(ROTATE_SHARE_KEY),token;try{token=generateShareLinkToken()}catch(error2){throw internalError(error2,"failed to rotate share link")}let status=share.status??create2(AgentShareStatusSchema);status.shareLinkToken=token,share.status=status,setAuditFieldsForUpdate(AgentShareSchema,share,"status_audit",ctx.callerIdentity)}}}function newPersistShareForLinkRotationStep(store){return{name:"PersistShareForLinkRotation",async execute(ctx){let share=ctx.get(ROTATE_SHARE_KEY);try{await store.saveResource(ctx.apiResourceKind,share.metadata?.id??"",AgentShareSchema,share)}catch(error2){throw internalError(error2,"failed to save agent share")}}}}async function deleteShare(deps,shareId,ctx){let reqCtx=new RequestContext(AgentShareCommandController.method.delete.input,shareId,callerIdentityOf(ctx),kindOf6(ctx));await newPipeline("agent-share-delete",deps.logger).addStep(newAuthorizeStep(AgentShareCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,AgentShareSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted agent share not found in context"),"deleted agent share not found in context");return deleted}async function get7(deps,shareId,ctx){let reqCtx=new RequestContext(AgentShareQueryController.method.get.input,shareId,callerIdentityOf(ctx),kindOf6(ctx));return await newPipeline("agent-share-get",deps.logger).addStep(newAuthorizeStep(AgentShareQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,AgentShareSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByReference5(deps,ref,ctx){let reqCtx=new RequestContext(AgentShareQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf6(ctx));return await newPipeline("agent-share-get-by-reference",deps.logger).addStep(newAuthorizeStep(AgentShareQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,AgentShareSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(AgentShareQueryController.method.get))).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var SHARE_LIST_KEY="agentShareList";async function getByAgent4(deps,req,ctx){let reqCtx=new RequestContext(AgentShareQueryController.method.getByAgent.input,req,callerIdentityOf(ctx),kindOf6(ctx));await newPipeline("agent-share-get-by-agent",deps.logger).addStep(newAuthorizeStep(AgentShareQueryController.method.getByAgent,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadSharesByAgentStep(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(SHARE_LIST_KEY);if(result===void 0)throw internalError(new Error("agent share list not found in context"),"agent share list not found in context");return result}function newLoadSharesByAgentStep(store,listReadScope){return{name:"LoadSharesByAgent",async execute(ctx){let req=ctx.input,emptyList=create2(AgentShareListSchema,{totalCount:0,items:[]}),agentOrg,agentSlug;try{let agent=await store.getResource(ApiResourceKind.agent,req.agentId,AgentSchema);agentOrg=agent.metadata?.org??"",agentSlug=agent.metadata?.slug??""}catch{ctx.set(SHARE_LIST_KEY,emptyList);return}let rows;try{rows=await store.listResources(ApiResourceKind.agent_share)}catch(error2){throw internalError(error2,"failed to list agent shares")}let decoded=[];for(let bytes of rows)try{decoded.push(fromBinary2(AgentShareSchema,bytes))}catch{continue}let shares=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.agent_share,decoded.filter(share=>{let ref=share.spec?.agentRef;return(ref?.org??"")===agentOrg&&(ref?.slug??"")===agentSlug&&(req.org===""||(share.metadata?.org??"")===req.org)}),"");ctx.set(SHARE_LIST_KEY,create2(AgentShareListSchema,{totalCount:shares.length,items:shares}))}}}var LIST_RESULT_KEY3="listResult";async function list7(deps,req,ctx){let reqCtx=new RequestContext(AgentShareQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf6(ctx));await newPipeline("agent-share-list",deps.logger).addStep(newAuthorizeStep(AgentShareQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgAndLabelsStep4(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY3);if(result===void 0)throw internalError(new Error("agent share list not found in context"),"agent share list not found in context");return result}function newListByOrgAndLabelsStep4(store,logger2,listReadScope){return{name:"ListByOrgAndLabels",async execute(ctx){let{org,labels:filterLabels}=ctx.input,rows;try{rows=await store.listResources(ctx.apiResourceKind)}catch(error2){throw internalError(error2,"failed to list agent shares")}let decoded=[];for(let bytes of rows)try{decoded.push(fromBinary2(AgentShareSchema,bytes))}catch{logger2.warn("Failed to unmarshal agent share, skipping");continue}let shares=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.agent_share,decoded.filter(share=>(share.metadata?.org??"")===org&&matchesAllLabels(share.metadata?.labels??{},filterLabels)),"");shares.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(LIST_RESULT_KEY3,create2(AgentShareListSchema,{totalCount:shares.length,items:shares}))}}}var RESOLVED_SHARE_KEY="resolvedAgentShare",SHARED_PROFILE_KEY="sharedAgentProfile";async function getSharedProfile(deps,req,ctx){let reqCtx=new RequestContext(AgentShareQueryController.method.getSharedProfile.input,req,callerIdentityOf(ctx),kindOf6(ctx));return await newPipeline("agent-share-get-shared-profile",deps.logger).addStep(newAuthorizeStep(AgentShareQueryController.method.getSharedProfile,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadShareForProfileStep(deps.store)).addStep(newProjectSharedProfileStep(deps.store)).build().execute(reqCtx),reqCtx.get(SHARED_PROFILE_KEY)}async function getSharedProfileForMember(deps,ref,ctx){let reqCtx=new RequestContext(AgentShareQueryController.method.getSharedProfileForMember.input,ref,callerIdentityOf(ctx),kindOf6(ctx));return await newPipeline("agent-share-get-shared-profile-for-member",deps.logger).addStep(newAuthorizeStep(AgentShareQueryController.method.getSharedProfileForMember,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeMemberAudienceStep(deps.authorizer)).addStep(newLoadShareForMemberProfileStep(deps.store)).addStep(newProjectMemberSharedProfileStep(deps.store)).build().execute(reqCtx),reqCtx.get(SHARED_PROFILE_KEY)}function newLoadShareForProfileStep(store){return{name:"LoadShareForProfile",async execute(ctx){let req=ctx.input;if(req.org==="")throw invalidArgumentError(ORG_REQUIRED_FOR_LOOKUP_MESSAGE);let share=await findShareByOrgAndSlug(store,req.org,req.slug);if(share===void 0)throw sharedNotFound(req.slug);ctx.set(RESOLVED_SHARE_KEY,share)}}}function newLoadShareForMemberProfileStep(store){return{name:"LoadShareForMemberProfile",async execute(ctx){let ref=ctx.input;if(ref.org==="")throw invalidArgumentError(ORG_REQUIRED_FOR_LOOKUP_MESSAGE);let share=await findShareByOrgAndSlug(store,ref.org,ref.slug);if(share===void 0)throw sharedNotFound(ref.slug);ctx.set(RESOLVED_SHARE_KEY,share)}}}function newProjectSharedProfileStep(store){return{name:"ProjectSharedProfile",async execute(ctx){let share=ctx.get(RESOLVED_SHARE_KEY),req=ctx.input;if(share.spec?.enabled!==!0)throw sharedNotFound(req.slug);if(share.spec.audience===AgentShareAudience.org)throw sharedNotFound(req.slug);if(!sharingLinkTokenAllowed(req.linkToken,share.status?.shareLinkToken??""))throw sharedNotFound(req.slug);ctx.set(SHARED_PROFILE_KEY,await buildSharedAgentProfile(store,share))}}}function newProjectMemberSharedProfileStep(store){return{name:"ProjectMemberSharedProfile",async execute(ctx){let share=ctx.get(RESOLVED_SHARE_KEY);if(share.spec?.enabled!==!0)throw sharedNotFound(ctx.input.slug);if(!(share.spec.audience===AgentShareAudience.org)&&(share.status?.shareLinkToken??"")!=="")throw sharedNotFound(ctx.input.slug);ctx.set(SHARED_PROFILE_KEY,await buildSharedAgentProfile(store,share))}}}var file_ai_stigmer_iam_apikey_v1_io=fileDesc("CiFhaS9zdGlnbWVyL2lhbS9hcGlrZXkvdjEvaW8ucHJvdG8SGGFpLnN0aWdtZXIuaWFtLmFwaWtleS52MSI8CgdBcGlLZXlzEjEKB2VudHJpZXMYASADKAsyIC5haS5zdGlnbWVyLmlhbS5hcGlrZXkudjEuQXBpS2V5IiEKCEFwaUtleUlkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiIwoKQXBpS2V5SGFzaBIVCgV2YWx1ZRgBIAEoCUIGukgDyAEBYgZwcm90bzM",[file_ai_stigmer_iam_apikey_v1_api,file_buf_validate_validate]),ApiKeysSchema=messageDesc2(file_ai_stigmer_iam_apikey_v1_io,0);var file_ai_stigmer_iam_apikey_v1_command=fileDesc("CiZhaS9zdGlnbWVyL2lhbS9hcGlrZXkvdjEvY29tbWFuZC5wcm90bxIYYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxMvoCChdBcGlLZXlDb21tYW5kQ29udHJvbGxlchJSCgZjcmVhdGUSIC5haS5zdGlnbWVyLmlhbS5hcGlrZXkudjEuQXBpS2V5GiAuYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxLkFwaUtleSIE0LgYARKDAQoGdXBkYXRlEiAuYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxLkFwaUtleRogLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXkiNcK4GDEIAhAMIgttZXRhZGF0YS5pZCoedW5hdXRob3JpemVkIHRvIHVwZGF0ZSBhcGkga2V5En8KBmRlbGV0ZRIiLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXlJZBogLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXkiL8K4GCsIAxAMIgV2YWx1ZSoedW5hdXRob3JpemVkIHRvIGRlbGV0ZSBhcGkga2V5GgSg/ysMYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_apikey_v1_api,file_ai_stigmer_iam_apikey_v1_io]),ApiKeyCommandController=serviceDesc(file_ai_stigmer_iam_apikey_v1_command,0);var file_ai_stigmer_iam_apikey_v1_query=fileDesc("CiRhaS9zdGlnbWVyL2lhbS9hcGlrZXkvdjEvcXVlcnkucHJvdG8SGGFpLnN0aWdtZXIuaWFtLmFwaWtleS52MTLDAgoVQXBpS2V5UXVlcnlDb250cm9sbGVyEnoKA2dldBIiLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXlJZBogLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXkiLcK4GCkIARAMIgV2YWx1ZSocdW5hdXRob3JpemVkIHRvIHZpZXcgYXBpIGtleRJcCgxnZXRCeUtleUhhc2gSJC5haS5zdGlnbWVyLmlhbS5hcGlrZXkudjEuQXBpS2V5SGFzaBogLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXkiBNC4GAESSgoHZmluZEFsbBIWLmdvb2dsZS5wcm90b2J1Zi5FbXB0eRohLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXlzIgTQuBgBGgSg/ysMYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_apikey_v1_api,file_ai_stigmer_iam_apikey_v1_io,file_google_protobuf_empty]),ApiKeyQueryController=serviceDesc(file_ai_stigmer_iam_apikey_v1_query,0);var import_node_crypto16=require("node:crypto"),API_KEY_PREFIX="stk_",API_KEY_TOKEN_BYTES=32,API_KEY_FINGERPRINT_LENGTH=6;function generateApiKeyPlaintext(){return API_KEY_PREFIX+(0,import_node_crypto16.randomBytes)(API_KEY_TOKEN_BYTES).toString("base64url")}function hashApiKey(plaintext){if(plaintext==="")throw new Error("token must not be null or empty");return(0,import_node_crypto16.createHash)("sha256").update(plaintext,"utf8").digest("base64url")}function fingerprintOf(plaintext){return plaintext.length<=API_KEY_FINGERPRINT_LENGTH?plaintext:plaintext.slice(-API_KEY_FINGERPRINT_LENGTH)}function isApiKeyToken(token){return token.slice(0,API_KEY_PREFIX.length).toLowerCase()===API_KEY_PREFIX}async function findApiKeyByHash(store,keyHash){try{return await store.findByField(ApiResourceKind.api_key,"spec.keyHash",keyHash,ApiKeySchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}var API_KEY_PLAINTEXT_KEY="API_KEY_PLAINTEXT";function newGenerateApiKeyStep(){return{name:"GenerateApiKey",execute(ctx){let resource=ctx.newState;if(resource.spec===void 0)throw internalError(new Error("spec is nil after BuildNewState"),"generate api key");let plaintext=generateApiKeyPlaintext();resource.spec.keyHash=hashApiKey(plaintext),resource.spec.fingerprint=fingerprintOf(plaintext),ctx.set(API_KEY_PLAINTEXT_KEY,plaintext)}}}function newReplaceHashWithPlainTextStep(){return{name:"ReplaceHashWithPlainText",execute(ctx){let plaintext=ctx.get(API_KEY_PLAINTEXT_KEY);if(typeof plaintext!="string"||plaintext==="")throw internalError(new Error("plaintext API key not found in context"),"Failed to retrieve generated API key");let resource=ctx.newState;if(resource.spec===void 0)throw internalError(new Error("spec is nil after Persist"),"replace hash with plaintext");resource.spec.keyHash=plaintext}}}function newPreserveKeyMaterialStep(){return{name:"PreserveKeyMaterial",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing resource not in context - LoadExisting must run first"),"preserve key material");let resource=ctx.newState;if(resource.spec===void 0||existing.spec===void 0)throw internalError(new Error("spec is nil on update"),"preserve key material");resource.spec.keyHash=existing.spec.keyHash,resource.spec.fingerprint=existing.spec.fingerprint}}}var API_KEY_NOT_FOUND_BY_HASH_MESSAGE="ApiKey not found";function newLoadByKeyHashStep(store){return{name:"LoadByKeyHash",async execute(ctx){let found=await findApiKeyByHash(store,ctx.input.value);if(found===void 0)throw new ConnectError(API_KEY_NOT_FOUND_BY_HASH_MESSAGE,Code.NotFound);ctx.set(TARGET_RESOURCE_KEY,found)}}}function registerApiKeyServices(router,deps){router.service(ApiKeyCommandController,{create:(apiKey,ctx)=>createApiKey(deps,apiKey,ctx),update:(apiKey,ctx)=>update7(deps,apiKey,ctx),delete:(apiKeyId,ctx)=>deleteApiKey(deps,apiKeyId,ctx)}),router.service(ApiKeyQueryController,{get:(apiKeyId,ctx)=>get8(deps,apiKeyId,ctx),getByKeyHash:(apiKeyHash,ctx)=>getByKeyHash(deps,apiKeyHash,ctx),findAll:(empty,ctx)=>findAll(deps,empty,ctx)})}function kindOf7(ctx){return ctx.values.get(apiResourceKindKey)}async function createApiKey(deps,apiKey,ctx){let reqCtx=new RequestContext(ApiKeySchema,apiKey,callerIdentityOf(ctx),kindOf7(ctx));return await newPipeline("apikey-create",deps.logger).addStep(newAuthorizeStep(ApiKeyCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newGenerateApiKeyStep()).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newReplaceHashWithPlainTextStep()).build().execute(reqCtx),reqCtx.newState}async function update7(deps,apiKey,ctx){let reqCtx=new RequestContext(ApiKeySchema,apiKey,callerIdentityOf(ctx),kindOf7(ctx));return await newPipeline("apikey-update",deps.logger).addStep(newAuthorizeStep(ApiKeyCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newPreserveKeyMaterialStep()).addStep(newPersistStep(deps.store)).build().execute(reqCtx),reqCtx.newState}async function deleteApiKey(deps,apiKeyId,ctx){let reqCtx=new RequestContext(ApiKeyCommandController.method.delete.input,apiKeyId,callerIdentityOf(ctx),kindOf7(ctx));await newPipeline("apikey-delete",deps.logger).addStep(newAuthorizeStep(ApiKeyCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,ApiKeySchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("delete pipeline completed without a loaded resource"),"deleted api key not found in context");return deleted}async function get8(deps,apiKeyId,ctx){let reqCtx=new RequestContext(ApiKeyQueryController.method.get.input,apiKeyId,callerIdentityOf(ctx),kindOf7(ctx));return await newPipeline("apikey-get",deps.logger).addStep(newAuthorizeStep(ApiKeyQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,ApiKeySchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByKeyHash(deps,apiKeyHash,ctx){let reqCtx=new RequestContext(ApiKeyQueryController.method.getByKeyHash.input,apiKeyHash,callerIdentityOf(ctx),kindOf7(ctx));return await newPipeline("apikey-get-by-key-hash",deps.logger).addStep(newAuthorizeStep(ApiKeyQueryController.method.getByKeyHash,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByKeyHashStep(deps.store)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function findAll(deps,empty,ctx){let identity2=callerIdentityOf(ctx),reqCtx=new RequestContext(ApiKeyQueryController.method.findAll.input,empty,identity2,kindOf7(ctx));await newPipeline("apikey-find-all",deps.logger).addStep(newAuthorizeStep(ApiKeyQueryController.method.findAll,deps.authorizer)).build().execute(reqCtx);let rows;try{rows=await deps.store.listResources(ApiResourceKind.api_key)}catch(error2){throw internalError(error2,"failed to list api keys")}let entries=[...await restrictListByReadScope(deps.listReadScope,identity2,ApiResourceKind.api_key,rows.map(row=>fromBinary2(ApiKeySchema,row)),"")].sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt));return create2(ApiKeysSchema,{entries})}var file_ai_stigmer_iam_identityaccount_v1_io=fileDesc("CiphaS9zdGlnbWVyL2lhbS9pZGVudGl0eWFjY291bnQvdjEvaW8ucHJvdG8SIWFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MSJXChBJZGVudGl0eUFjY291bnRzEkMKB2VudHJpZXMYASADKAsyMi5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50IioKEUlkZW50aXR5QWNjb3VudElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiLQoUSWRlbnRpdHlBY2NvdW50RW1haWwSFQoFdmFsdWUYASABKAlCBrpIA8gBASIeCgVJZHBJZBIVCgV2YWx1ZRgBIAEoCUIGukgDyAEBImsKHExpc3RXaXRoSWRlbnRpdHlBY2NvdW50SWRSZXESGwoTaWRlbnRpdHlfYWNjb3VudF9pZBgBIAEoCRIuCgRwYWdlGAIgASgLMiAuYWkuc3RpZ21lci5jb21tb25zLnJwYy5QYWdlSW5mbyJwChRJZGVudGl0eUFjY291bnRzTGlzdBITCgt0b3RhbF9wYWdlcxgBIAEoBRJDCgdlbnRyaWVzGAIgAygLMjIuYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlhY2NvdW50LnYxLklkZW50aXR5QWNjb3VudCJSChNMaXN0V2l0aElkZW50aXR5T3JnEgsKA29yZxgBIAEoCRIuCgRwYWdlGAIgASgLMiAuYWkuc3RpZ21lci5jb21tb25zLnJwYy5QYWdlSW5mbyKbAQoRRXh0ZXJuYWxTdWJMb29rdXASEwoDb3JnGAEgASgJQga6SAPIAQESUwoVaWRlbnRpdHlfcHJvdmlkZXJfcmVmGAIgASgLMjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlEhwKDGV4dGVybmFsX3N1YhgDIAEoCUIGukgDyAEBIvgBChtDcmVhdGVGZWRlcmF0ZWRBY2NvdW50SW5wdXQSEwoDb3JnGAEgASgJQga6SAPIAQESUwoVaWRlbnRpdHlfcHJvdmlkZXJfcmVmGAIgASgLMjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlEhwKDGV4dGVybmFsX3N1YhgDIAEoCUIGukgDyAEBEhUKBWVtYWlsGAQgASgJQga6SAPIAQESEgoKZmlyc3RfbmFtZRgFIAEoCRIRCglsYXN0X25hbWUYBiABKAkSEwoLcGljdHVyZV91cmwYByABKAki+AEKG1VwZGF0ZUZlZGVyYXRlZEFjY291bnRJbnB1dBITCgNvcmcYASABKAlCBrpIA8gBARJTChVpZGVudGl0eV9wcm92aWRlcl9yZWYYAiABKAsyNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2USHAoMZXh0ZXJuYWxfc3ViGAMgASgJQga6SAPIAQESFQoFZW1haWwYBCABKAlCBrpIA8gBARISCgpmaXJzdF9uYW1lGAUgASgJEhEKCWxhc3RfbmFtZRgGIAEoCRITCgtwaWN0dXJlX3VybBgHIAEoCSLCAQogRGVwcm92aXNpb25GZWRlcmF0ZWRBY2NvdW50SW5wdXQSEwoDb3JnGAEgASgJQga6SAPIAQESUwoVaWRlbnRpdHlfcHJvdmlkZXJfcmVmGAIgASgLMjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlEhwKDGV4dGVybmFsX3N1YhgDIAEoCUIGukgDyAEBEhYKDmRlbGV0ZV9hY2NvdW50GAQgASgIYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_rpc_pagination,file_ai_stigmer_iam_identityaccount_v1_api,file_buf_validate_validate]);var file_ai_stigmer_iam_identityaccount_v1_command=fileDesc("Ci9haS9zdGlnbWVyL2lhbS9pZGVudGl0eWFjY291bnQvdjEvY29tbWFuZC5wcm90bxIhYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlhY2NvdW50LnYxMosKCiBJZGVudGl0eUFjY291bnRDb21tYW5kQ29udHJvbGxlchJ2CgZjcmVhdGUSMi5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50GjIuYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlhY2NvdW50LnYxLklkZW50aXR5QWNjb3VudCIE0LgYARKwAQoGdXBkYXRlEjIuYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlhY2NvdW50LnYxLklkZW50aXR5QWNjb3VudBoyLmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MS5JZGVudGl0eUFjY291bnQiPsK4GDoIAhALIgttZXRhZGF0YS5pZCondW5hdXRob3JpemVkIHRvIHVwZGF0ZSBpZGVudGl0eSBhY2NvdW50EqwBCgZkZWxldGUSNC5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50SWQaMi5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50IjjCuBg0CAMQCyIFdmFsdWUqJ3VuYXV0aG9yaXplZCB0byBkZWxldGUgaWRlbnRpdHkgYWNjb3VudBLaAQoWY3JlYXRlRmVkZXJhdGVkQWNjb3VudBI+LmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MS5DcmVhdGVGZWRlcmF0ZWRBY2NvdW50SW5wdXQaMi5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50IkzCuBhICBUQHiIDb3JnKj11bmF1dGhvcml6ZWQgdG8gY3JlYXRlIGlkZW50aXR5IGFjY291bnRzIGluIHRoaXMgb3JnYW5pemF0aW9uEtoBChZ1cGRhdGVGZWRlcmF0ZWRBY2NvdW50Ej4uYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlhY2NvdW50LnYxLlVwZGF0ZUZlZGVyYXRlZEFjY291bnRJbnB1dBoyLmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MS5JZGVudGl0eUFjY291bnQiTMK4GEgIFRAeIgNvcmcqPXVuYXV0aG9yaXplZCB0byBtYW5hZ2UgaWRlbnRpdHkgYWNjb3VudHMgaW4gdGhpcyBvcmdhbml6YXRpb24S5AEKG2RlcHJvdmlzaW9uRmVkZXJhdGVkQWNjb3VudBJDLmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MS5EZXByb3Zpc2lvbkZlZGVyYXRlZEFjY291bnRJbnB1dBoyLmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MS5JZGVudGl0eUFjY291bnQiTMK4GEgIFRAeIgNvcmcqPXVuYXV0aG9yaXplZCB0byBtYW5hZ2UgaWRlbnRpdHkgYWNjb3VudHMgaW4gdGhpcyBvcmdhbml6YXRpb24SZgoScHJvdmlzaW9uTXlBY2NvdW50EhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5GjIuYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlhY2NvdW50LnYxLklkZW50aXR5QWNjb3VudCIE0LgYARoEoP8rC2IGcHJvdG8z",[file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_identityaccount_v1_api,file_ai_stigmer_iam_identityaccount_v1_io,file_google_protobuf_empty]),IdentityAccountCommandController=serviceDesc(file_ai_stigmer_iam_identityaccount_v1_command,0);var file_ai_stigmer_iam_identityaccount_v1_query=fileDesc("Ci1haS9zdGlnbWVyL2lhbS9pZGVudGl0eWFjY291bnQvdjEvcXVlcnkucHJvdG8SIWFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MTKDCAoeSWRlbnRpdHlBY2NvdW50UXVlcnlDb250cm9sbGVyEqYBCgNnZXQSNC5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50SWQaMi5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50IjXCuBgxCAEQCyIFdmFsdWUqJHVuYXV0aG9yaXplZCB0byBnZXQgaWRlbnRpdHkgYWNjb3VudBJaCgZ3aG9BbUkSFi5nb29nbGUucHJvdG9idWYuRW1wdHkaMi5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50IgTQuBgBErABCgpnZXRCeUVtYWlsEjcuYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlhY2NvdW50LnYxLklkZW50aXR5QWNjb3VudEVtYWlsGjIuYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlhY2NvdW50LnYxLklkZW50aXR5QWNjb3VudCI1wrgYMQgBEAsiBXZhbHVlKiR1bmF1dGhvcml6ZWQgdG8gZ2V0IGlkZW50aXR5IGFjY291bnQSoQEKCmdldEJ5SWRwSWQSKC5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRwSWQaMi5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50IjXCuBgxCAEQCyIFdmFsdWUqJHVuYXV0aG9yaXplZCB0byBnZXQgaWRlbnRpdHkgYWNjb3VudBLLAQoQZ2V0QnlFeHRlcm5hbFN1YhI0LmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MS5FeHRlcm5hbFN1Ykxvb2t1cBoyLmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MS5JZGVudGl0eUFjY291bnQiTcK4GEkIFRAeIgNvcmcqPnVuYXV0aG9yaXplZCB0byBsb29rIHVwIGlkZW50aXR5IGFjY291bnRzIGluIHRoaXMgb3JnYW5pemF0aW9uErABCgxnZXRBY3RvckluZm8SNC5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50SWQaNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdEFjdG9yIjPCuBgvCAEQCyIFdmFsdWUqInVuYXV0aG9yaXplZCB0byBsb29rIHVwIGFjdG9yIGluZm8aBKD/KwtiBnByb3RvMw",[file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_apiresource_status,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_identityaccount_v1_api,file_ai_stigmer_iam_identityaccount_v1_io,file_google_protobuf_empty]),IdentityAccountQueryController=serviceDesc(file_ai_stigmer_iam_identityaccount_v1_query,0);var DuplicateAccountError=class extends Error{constructor(message6,options){super(message6,options),this.name="DuplicateAccountError"}};var KIND_NAME="IdentityAccount";function accountNotFoundError(handle){return new ConnectError(accountNotFoundMessage(handle),Code.NotFound)}function newDefaultAccountNameStep(){return{name:"DefaultAccountName",execute(ctx){let metadata=requireMetadata(ctx,"default account name");if(metadata.name===""){let spec=specOf2(ctx);metadata.name=spec.email!==""?spec.email:spec.idpId}}}}function newDeriveAccountIdStep(){return{name:"DeriveAccountId",execute(ctx){let metadata=requireMetadata(ctx,"derive account id"),idpId=specOf2(ctx).idpId;if(idpId==="")throw internalError(new Error("identity account idp_id is empty"),"derive account id");metadata.id=accountIdFor(idpId)}}}function newCheckDuplicateStep2(accounts){return{name:"CheckDuplicate",async execute(ctx){let metadata=requireMetadata(ctx,"duplicate check"),idpId=specOf2(ctx).idpId,existing;try{existing=await accounts.findById(metadata.id)}catch(error2){throw internalError(error2,"failed to check for duplicate identity account")}if(existing!==void 0)throw alreadyExistsError(KIND_NAME,`subject '${idpId}'`)}}}function assignDirectBackendFields(spec){return spec.isMachineAccount=isMachineSubject(spec.idpId),spec.provisioningMode=IdentityAccountProvisioningMode.direct,spec.identityProviderRef=void 0,spec}function assignPlatformClientBackendFields(spec){return spec.isMachineAccount=isMachineSubject(spec.idpId),spec.provisioningMode=IdentityAccountProvisioningMode.platform_client,spec.identityProviderRef=void 0,spec}function newAssignBackendFieldsStep(provisioning){return{name:"AssignBackendFields",execute(ctx){let spec=specOf2(ctx);switch(provisioning.mode){case"direct":if(isPlatformClientSubject(spec.idpId))throw invalidArgumentError(reservedSubjectMessage(spec.idpId));assignDirectBackendFields(spec);return;case"platform_client":if(!isPlatformClientSubject(spec.idpId))throw internalError(new Error(`a platform-client account's subject must carry the '${PLATFORM_CLIENT_SUBJECT_PREFIX}' prefix`),"assign backend fields");assignPlatformClientBackendFields(spec);return;default:{let exhaustive=provisioning;throw internalError(new Error(`unknown provisioning ${JSON.stringify(exhaustive)}`),"assign backend fields")}}}}}function newPersistNewAccountStep(accounts){return{name:"Persist",async execute(ctx){try{await accounts.save(ctx.newState)}catch(error2){throw error2 instanceof DuplicateAccountError?alreadyExistsError(KIND_NAME,`subject '${specOf2(ctx).idpId}'`):internalError(error2,"failed to save identity account")}}}}function newLoadExistingAccountStep(accounts){return{name:"LoadExisting",async execute(ctx){let metadata=requireMetadata(ctx,"load existing");if(metadata.id==="")throw invalidArgumentError("resource id is required for update");let existing=await readAccount(accounts,metadata.id);ctx.set(EXISTING_RESOURCE_KEY,existing)}}}function newGuardImmutableSubjectStep(){return{name:"GuardImmutableSubject",execute(ctx){let existingIdpId=existingAccountOf(ctx).spec?.idpId??"";if(specOf2(ctx).idpId!==existingIdpId)throw failedPreconditionError(idpIdImmutableMessage(existingIdpId))}}}function newPreserveBackendFieldsStep(){return{name:"AssignBackendFields",execute(ctx){let existingSpec=existingAccountOf(ctx).spec,spec=specOf2(ctx);spec.idpId=existingSpec?.idpId??spec.idpId,spec.email=existingSpec?.email??"",spec.isMachineAccount=existingSpec?.isMachineAccount??!1,spec.provisioningMode=existingSpec?.provisioningMode??IdentityAccountProvisioningMode.identity_account_provisioning_mode_unspecified,spec.identityProviderRef=existingSpec?.identityProviderRef}}}function newPersistUpdatedAccountStep(accounts){return{name:"Persist",async execute(ctx){try{await accounts.update(ctx.newState)}catch(error2){throw internalError(error2,"failed to save identity account")}}}}function newLoadTargetAccountStep(accounts){return{name:"LoadTarget",async execute(ctx){let id=idValueOf(ctx.input);if(id==="")throw invalidArgumentError("resource id is required");ctx.set(TARGET_RESOURCE_KEY,await readAccount(accounts,id))}}}function newLoadExistingAccountForDeleteStep(accounts){return{name:"LoadExistingForDelete",async execute(ctx){ctx.set(EXISTING_RESOURCE_KEY,await readAccount(accounts,requireResourceId2(ctx)))}}}function newDeleteAccountStep(accounts){return{name:"DeleteResource",async execute(ctx){try{await accounts.deleteById(requireResourceId2(ctx))}catch(error2){throw internalError(error2,"failed to delete identity account")}}}}async function readAccount(accounts,id){let account2=await accounts.findById(id);if(account2===void 0)throw accountNotFoundError(id);return account2}function requireMetadata(ctx,operation2){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("identity account metadata is nil"),operation2);return metadata}function specOf2(ctx){let state2=ctx.newState;return state2.spec===void 0&&(state2.spec=create2(IdentityAccountSpecSchema)),state2.spec}function existingAccountOf(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing identity account not found in context - LoadExisting must run first"),"identity account update ordering");return existing}function requireResourceId2(ctx){let id=ctx.get(RESOURCE_ID_KEY);if(typeof id!="string"||id==="")throw internalError(new Error("resource id not found in context (ExtractResourceId must run first)"),"identity account delete ordering");return id}var UserInfoFetchError=class extends Error{constructor(cause){super(cause instanceof Error?cause.message:String(cause),{cause}),this.name="UserInfoFetchError"}};function newDirectAccountProvisioner(deps){return{async provisionDirectAccount(idpId,caller){let existing=await deps.accounts.findDirectByIdpId(idpId);if(existing!==void 0)return{account:existing,created:!1};let profile=await profileOf(deps.userInfo,caller),input={name:displayNameOf(caller,profile),spec:assignDirectBackendFields(create2(IdentityAccountSpecSchema,{idpId,email:profile.email,firstName:profile.firstName,lastName:profile.lastName,pictureUrl:profile.pictureUrl})),provisioning:{mode:"direct"}};try{return{account:await deps.createAccount(input,caller),created:!0}}catch(error2){return{account:await resolveCreateRace(error2,()=>deps.accounts.findDirectByIdpId(idpId)),created:!1}}}}}async function profileOf(userInfo,caller){if(caller.issuer==="")return{email:caller.email??"",firstName:"",lastName:"",pictureUrl:""};try{return await userInfo.fetchUserProfile(caller.issuer,caller.rawToken)}catch(error2){throw new UserInfoFetchError(error2)}}function displayNameOf(caller,profile){return caller.issuer===""?caller.displayName??profile.email:profile.email}async function resolveCreateRace(error2,findWinner){let winner=await findWinner();if(winner===void 0)throw error2;return winner}function registerIdentityAccountServices(router,deps){router.service(IdentityAccountCommandController,{create:(account2,ctx)=>createRpc(deps,account2,ctx),update:(account2,ctx)=>update8(deps,account2,ctx),delete:(id,ctx)=>deleteAccount(deps,id,ctx),createFederatedAccount:(input,ctx)=>federated(deps,ctx,IdentityAccountCommandController.method.createFederatedAccount,input,(federation,ref,caller)=>federation.createFederatedAccount(input,ref,caller)),updateFederatedAccount:(input,ctx)=>federated(deps,ctx,IdentityAccountCommandController.method.updateFederatedAccount,input,(federation,ref,caller)=>federation.updateFederatedAccount(input,ref,caller)),deprovisionFederatedAccount:(input,ctx)=>federated(deps,ctx,IdentityAccountCommandController.method.deprovisionFederatedAccount,input,(federation,ref,caller)=>federation.deprovisionFederatedAccount(input,ref,caller)),provisionMyAccount:(empty,ctx)=>provisionMyAccount(deps,empty,ctx)}),router.service(IdentityAccountQueryController,{get:(id,ctx)=>get9(deps,id,ctx),whoAmI:(empty,ctx)=>whoAmI(deps,empty,ctx),getByEmail:(email,ctx)=>getByEmail(deps,email,ctx),getByIdpId:(idpId,ctx)=>getByIdpId(deps,idpId,ctx),getByExternalSub:(lookup3,ctx)=>federated(deps,ctx,IdentityAccountQueryController.method.getByExternalSub,lookup3,(federation,ref,caller)=>federation.getByExternalSub(lookup3,ref,caller)),getActorInfo:(id,ctx)=>getActorInfo(deps,id,ctx)})}function kindOf8(ctx){return ctx.values.get(apiResourceKindKey)}async function runCreateChain(deps,account2,caller,kind,provisioning){let reqCtx=new RequestContext(IdentityAccountSchema,account2,caller,kind);return await newPipeline("identityaccount-create",deps.logger).addStep(newAuthorizeStep(IdentityAccountCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newDefaultAccountNameStep()).addStep(newResolveSlugStep()).addStep(newDeriveAccountIdStep()).addStep(newCheckDuplicateStep2(deps.accounts)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newAssignBackendFieldsStep(provisioning)).addStep(newPersistNewAccountStep(deps.accounts)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),reqCtx.newState}function newCreateAccountPath(deps,kind){return(input,caller)=>runCreateChain(deps,create2(IdentityAccountSchema,{apiVersion:"iam.stigmer.ai/v1",kind:"IdentityAccount",metadata:{name:input.name,...input.provisioning.mode==="platform_client"?{org:input.provisioning.org}:{}},spec:input.spec}),caller,kind,input.provisioning)}function createRpc(deps,account2,ctx){let caller=callerIdentityOf(ctx);return guardInternalRpc(caller),runCreateChain(deps,account2,caller,kindOf8(ctx),{mode:"direct"})}function guardInternalRpc(caller){if(!isPlatformPipelineCaller(caller))throw new ConnectError(CREATE_IS_INTERNAL_MESSAGE,Code.PermissionDenied)}async function update8(deps,account2,ctx){let reqCtx=new RequestContext(IdentityAccountSchema,account2,callerIdentityOf(ctx),kindOf8(ctx));return await newPipeline("identityaccount-update",deps.logger).addStep(newAuthorizeStep(IdentityAccountCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingAccountStep(deps.accounts)).addStep(newGuardImmutableSubjectStep()).addStep(newBuildUpdateStateStep()).addStep(newPreserveBackendFieldsStep()).addStep(newPersistUpdatedAccountStep(deps.accounts)).build().execute(reqCtx),reqCtx.newState}async function deleteAccount(deps,id,ctx){let reqCtx=new RequestContext(IdentityAccountCommandController.method.delete.input,id,callerIdentityOf(ctx),kindOf8(ctx));await newPipeline("identityaccount-delete",deps.logger).addStep(newAuthorizeStep(IdentityAccountCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingAccountForDeleteStep(deps.accounts)).addStep(newDeleteAccountStep(deps.accounts)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("delete pipeline completed without a loaded resource"),"deleted identity account not found in context");return deleted}async function get9(deps,id,ctx){return loadTarget(deps,IdentityAccountQueryController.method.get,id,ctx)}async function getActorInfo(deps,id,ctx){let account2=await loadTarget(deps,IdentityAccountQueryController.method.getActorInfo,id,ctx),firstName=account2.spec?.firstName??"",lastName=account2.spec?.lastName??"";return create2(ApiResourceAuditActorSchema,{id:account2.metadata?.id??"",avatar:account2.spec?.pictureUrl??"",displayName:`${firstName} ${lastName}`.trim(),email:account2.spec?.email??""})}async function loadTarget(deps,method,id,ctx){let reqCtx=new RequestContext(method.input,id,callerIdentityOf(ctx),kindOf8(ctx));return await newPipeline(`identityaccount-${method.localName}`,deps.logger).addStep(newAuthorizeStep(method,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetAccountStep(deps.accounts)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function whoAmI(deps,_empty,ctx){let caller=callerIdentityOf(ctx),account2=await read(()=>accountForCaller(deps.accounts,caller),"failed to load identity account");if(account2===void 0)throw new ConnectError(ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE,Code.NotFound);return account2}async function getByEmail(deps,email,ctx){return lookupThenAuthorize(deps,IdentityAccountQueryController.method.getByEmail,email,ctx,()=>deps.accounts.findDirectByEmail(email.value),email.value)}async function getByIdpId(deps,idpId,ctx){return lookupThenAuthorize(deps,IdentityAccountQueryController.method.getByIdpId,idpId,ctx,()=>deps.accounts.findByIdpId(idpId.value),idpId.value)}async function lookupThenAuthorize(deps,method,input,ctx,lookup3,handle){let account2=await read(lookup3,"failed to look up identity account");if(account2===void 0)throw accountNotFoundError(handle);return await authorizeDirect(method,deps.authorizer,callerIdentityOf(ctx),input,{resourceId:account2.metadata?.id??""}),account2}async function provisionMyAccount(deps,_empty,ctx){let caller=callerIdentityOf(ctx),idpId=idpIdOf(caller);if(idpId==="")throw new ConnectError(NO_IDP_ID_MESSAGE,Code.Unauthenticated);let account2,created;try{({account:account2,created}=await deps.provisioner.provisionDirectAccount(idpId,caller))}catch(error2){throw error2 instanceof UserInfoFetchError?new ConnectError(`${USERINFO_UNAVAILABLE_PREFIX}${error2.message}`,Code.Unavailable):error2}let asAccount={...caller,identityId:account2.metadata?.id??""};if(created&&deps.membership!==void 0)try{await deps.membership.onAccountCreated(account2,asAccount)}catch(error2){throw internalError(error2,"failed to record organization membership")}let gates=stepsForSlot(deps.gateSteps,"identity-account-provision:post-persist");if(gates.length>0){let reqCtx=new RequestContext(IdentityAccountSchema,account2,asAccount,kindOf8(ctx)),pipeline2=newPipeline("identityaccount-provision-post-persist",deps.logger);for(let step of gates)pipeline2.addStep(step);await pipeline2.build().execute(reqCtx)}return account2}async function federated(deps,ctx,method,input,arm){let federation=deps.federation;if(federation===void 0)throw new ConnectError(federationUnimplementedMessage(`${method.parent.typeName}.${method.localName}`),Code.Unimplemented);let caller=callerIdentityOf(ctx),org=input.org,ref=input.identityProviderRef;if(ref===void 0||ref.slug==="")throw invalidArgumentError("identity_provider_ref with a valid slug is required");if(ref.org!==""&&ref.org!==org)throw invalidArgumentError(`identity_provider_ref.org '${ref.org}' does not match input org '${org}'`);await authorizeDirect(method,deps.authorizer,caller,input);let refOrg=ref.org!==""?ref.org:org;if(!await federation.providerExists(refOrg,ref.slug))throw new ConnectError(`IdentityProvider '${refOrg}/${ref.slug}' not found`,Code.NotFound);return ref.org=refOrg,arm(federation,ref,caller)}async function read(operation2,message6){try{return await operation2()}catch(error2){throw internalError(error2,message6)}}async function ensureOperatorAccount(deps,operator){let caller=trustedLocalIdentityFor(operator),idpId=localIdpIdFor(caller.identityId),existing=await deps.accounts.findById(accountIdFor(idpId));if(existing!==void 0)return existing;let name=operator.displayName!==""?operator.displayName:operator.email!==""?operator.email:SYSTEM_OPERATOR_IDENTITY_ID;try{return await deps.createAccount({name,spec:assignDirectBackendFields(create2(IdentityAccountSpecSchema,{idpId,email:operator.email})),provisioning:{mode:"direct"}},caller)}catch(error2){return resolveCreateRace(error2,()=>deps.accounts.findById(accountIdFor(idpId)))}}var KIND3=ApiResourceKind.identity_account;function newResourceIdentityAccountStore(store){async function readById(id){try{return await store.getResource(KIND3,id,IdentityAccountSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}async function readBySubject(idpId){if(idpId!=="")return readById(accountIdFor(idpId))}return{async save(account2){let id=account2.metadata?.id??"",idpId=account2.spec?.idpId??"";if(isDirect(account2)&&id!==accountIdFor(idpId))throw new Error("direct account id must be derived from its idp_id");if(await readById(id)!==void 0)throw new DuplicateAccountError(`identity account '${id}' already exists`);await store.saveResource(KIND3,id,IdentityAccountSchema,account2)},async update(account2){let id=account2.metadata?.id??"";await readById(id)!==void 0&&await store.saveResource(KIND3,id,IdentityAccountSchema,account2)},async deleteById(id){await store.deleteResource(KIND3,id)},findById:readById,findByIdpId:readBySubject,async findDirectByIdpId(idpId){let account2=await readBySubject(idpId);return account2!==void 0&&isDirect(account2)?account2:void 0},async findDirectByEmail(email){let account2;try{account2=await store.findByField(KIND3,"spec.email",email,IdentityAccountSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}return isDirect(account2)?account2:void 0},async findByIds(ids){let found=[];for(let id of new Set(ids)){let account2=await readById(id);account2!==void 0&&found.push(account2)}return found}}}function isDirect(account2){let mode=account2.spec?.provisioningMode;return account2.spec?.identityProviderRef===void 0&&mode!==IdentityAccountProvisioningMode.federated&&mode!==IdentityAccountProvisioningMode.platform_client}var file_ai_stigmer_iam_iampolicy_v1_io=fileDesc("CiRhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvaW8ucHJvdG8SG2FpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MSLDAgoSQXBpUmVzb3VyY2VSZWZWaWV3EgwKBGtpbmQYASABKAkSCgoCaWQYAiABKAkSEAoIcmVsYXRpb24YAyABKAkSDAoEbmFtZRgEIAEoCRINCgVlbWFpbBgFIAEoCRIMCgRzbHVnGAYgASgJEg4KBmF2YXRhchgHIAEoCRJACgdtZW1iZXJzGAggAygLMi8uYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmVmlldxI+CgV0ZWFtcxgJIAMoCzIvLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZlZpZXcSRAoPaWRlbnRpdHlfb3JpZ2luGAogASgLMisuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklkZW50aXR5T3JpZ2luIo4BCg5JZGVudGl0eU9yaWdpbhJdChFwcm92aXNpb25pbmdfbW9kZRgBIAEoDjJCLmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MS5JZGVudGl0eUFjY291bnRQcm92aXNpb25pbmdNb2RlEh0KFXByb3ZpZGVyX2Rpc3BsYXlfbmFtZRgCIAEoCSIkCgtJYW1Qb2xpY3lJZBIVCgV2YWx1ZRgBIAEoCUIGukgDyAEBIqcBChZQcmluY2lwYWxSZXNvdXJjZUlucHV0EkYKCXByaW5jaXBhbBgBIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBEkUKCHJlc291cmNlGAIgASgLMisuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmQga6SAPIAQEiqQEKF1Jlc291cmNlUHJpbmNpcGFsc0lucHV0EkUKCHJlc291cmNlGAEgASgLMisuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmQga6SAPIAQESRwoKcHJpbmNpcGFscxgCIAMoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBImQKFFJldm9rZU9yZ0FjY2Vzc0lucHV0EicKE2lkZW50aXR5X2FjY291bnRfaWQYASABKAlCCrpIB8gBAXICEAESIwoPb3JnYW5pemF0aW9uX2lkGAIgASgJQgq6SAfIAQFyAhABIkoKD0lhbVBvbGljaWVzTGlzdBI3CgdlbnRyaWVzGAEgAygLMiYuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeSJ7ChdMaXN0UmVzb3VyY2VBY2Nlc3NJbnB1dBJFCghyZXNvdXJjZRgBIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBEhkKEWluY2x1ZGVfaW5oZXJpdGVkGAIgASgIIl4KHVJlc291cmNlQWNjZXNzQnlQcmluY2lwYWxMaXN0Ej0KB2VudHJpZXMYASADKAsyLC5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuUHJpbmNpcGFsQWNjZXNzIowBCg9QcmluY2lwYWxBY2Nlc3MSQgoJcHJpbmNpcGFsGAEgASgLMi8uYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmVmlldxI1CgVyb2xlcxgCIAMoCzImLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5Sb2xlR3JhbnQimwEKCVJvbGVHcmFudBIzCgRyb2xlGAEgASgLMiUuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlJvbGVJbmZvEkMKDm93bmVyX3Jlc291cmNlGAIgASgLMisuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmEhQKDGlzX2luaGVyaXRlZBgDIAEoCCJUChhSZXNvdXJjZUFjY2Vzc0J5Um9sZUxpc3QSOAoHZW50cmllcxgBIAMoCzInLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5Sb2xlQWNjZXNzIocBCgpSb2xlQWNjZXNzEjQKBHJvbGUYASABKAsyJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuUm9sZUdyYW50EkMKCnByaW5jaXBhbHMYAiADKAsyLy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXBpUmVzb3VyY2VSZWZWaWV3IkcKCFJvbGVJbmZvEgoKAmlkGAEgASgJEgwKBGNvZGUYAiABKAkSDAoEbmFtZRgDIAEoCRITCgtkZXNjcmlwdGlvbhgEIAEoCSJOChZQcmluY2lwYWxSZXNvdXJjZVJvbGVzEjQKBXJvbGVzGAEgAygLMiUuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlJvbGVJbmZvIqYBChdDaGVja0F1dGhvcml6YXRpb25JbnB1dBJCCgZwb2xpY3kYASABKAsyKi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5U3BlY0IGukgDyAEBEkcKE2NvbnRleHR1YWxfcG9saWNpZXMYAiADKAsyKi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5U3BlYyIxChhDaGVja0F1dGhvcml6YXRpb25SZXN1bHQSFQoNaXNfYXV0aG9yaXplZBgBIAEoCCLIAQoWQ2hlY2tNeVBlcm1pc3Npb25JbnB1dBJFCghyZXNvdXJjZRgBIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBEh4KCHJlbGF0aW9uGAIgASgJQgy6SAnIAQFyBBABGEASRwoTY29udGV4dHVhbF9wb2xpY2llcxgDIAMoCzIqLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5JYW1Qb2xpY3lTcGVjIvIBCh5MaXN0QXV0aG9yaXplZFJlc291cmNlSWRzSW5wdXQSRgoJcHJpbmNpcGFsGAEgASgLMisuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmQga6SAPIAQESIQoNcmVzb3VyY2Vfa2luZBgCIAEoCUIKukgHyAEBcgIQARIcCghyZWxhdGlvbhgDIAEoCUIKukgHyAEBcgIQARJHChNjb250ZXh0dWFsX3BvbGljaWVzGAQgAygLMiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMiMQoZQXV0aG9yaXplZFJlc291cmNlSWRzTGlzdBIUCgxyZXNvdXJjZV9pZHMYASADKAki8wEKH0xpc3RBdXRob3JpemVkUHJpbmNpcGFsSWRzSW5wdXQSRQoIcmVzb3VyY2UYASABKAsyKy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXBpUmVzb3VyY2VSZWZCBrpIA8gBARIiCg5wcmluY2lwYWxfa2luZBgCIAEoCUIKukgHyAEBcgIQARIcCghyZWxhdGlvbhgDIAEoCUIKukgHyAEBcgIQARJHChNjb250ZXh0dWFsX3BvbGljaWVzGAQgAygLMiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMiMwoaQXV0aG9yaXplZFByaW5jaXBhbElkc0xpc3QSFQoNcHJpbmNpcGFsX2lkcxgBIAMoCSJZChdHZXRQcmluY2lwYWxzQ291bnRJbnB1dBIaCgZvcmdfaWQYASABKAlCCrpIB8gBAXICEAESIgoOcHJpbmNpcGFsX2tpbmQYAiABKAlCCrpIB8gBAXICEAEiIAoPUHJpbmNpcGFsc0NvdW50Eg0KBWNvdW50GAEgASgFYgZwcm90bzM",[file_ai_stigmer_iam_iampolicy_v1_api,file_ai_stigmer_iam_iampolicy_v1_spec,file_ai_stigmer_iam_identityaccount_v1_enum,file_buf_validate_validate]),ApiResourceRefViewSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,0),IdentityOriginSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,1);var RevokeOrgAccessInputSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,5);var ResourceAccessByPrincipalListSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,8),PrincipalAccessSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,9),RoleGrantSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,10);var RoleInfoSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,13),PrincipalResourceRolesSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,14);var CheckAuthorizationResultSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,16);var AuthorizedResourceIdsListSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,19);var AuthorizedPrincipalIdsListSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,21);var PrincipalsCountSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,23);var file_ai_stigmer_iam_iampolicy_v1_command=fileDesc("CilhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvY29tbWFuZC5wcm90bxIbYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxMuYIChpJYW1Qb2xpY3lDb21tYW5kQ29udHJvbGxlchKeAQoGY3JlYXRlEiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IkDCuBg8CAQaDXJlc291cmNlLmtpbmQiC3Jlc291cmNlLmlkKhx1bmF1dGhvcml6ZWQgdG8gZ3JhbnQgYWNjZXNzEp8BCgZkZWxldGUSKi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5U3BlYxomLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5JYW1Qb2xpY3kiQcK4GD0IBBoNcmVzb3VyY2Uua2luZCILcmVzb3VyY2UuaWQqHXVuYXV0aG9yaXplZCB0byByZXZva2UgYWNjZXNzEsIBCg9ib290c3RyYXBQb2xpY3kSKi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5U3BlYxomLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5JYW1Qb2xpY3kiW8K4GFcIERAfKkh1bmF1dGhvcml6ZWQgdG8gYm9vdHN0cmFwIHBvbGljeSAtIGNhbl9ib290c3RyYXBfaWFtIHBlcm1pc3Npb24gcmVxdWlyZWQyB3N0aWdtZXISxAEKF2NsZWFudXBSZXNvdXJjZVBvbGljaWVzEisuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmGhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5ImTCuBhgCBEQHypRdW5hdXRob3JpemVkIHRvIGNsZWFudXAgcmVzb3VyY2UgcG9saWNpZXMgLSBjYW5fYm9vdHN0cmFwX2lhbSBwZXJtaXNzaW9uIHJlcXVpcmVkMgdzdGlnbWVyEqMBCg9yZXZva2VPcmdBY2Nlc3MSMS5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuUmV2b2tlT3JnQWNjZXNzSW5wdXQaFi5nb29nbGUucHJvdG9idWYuRW1wdHkiRcK4GEEIBBAeIg9vcmdhbml6YXRpb25faWQqKnVuYXV0aG9yaXplZCB0byByZXZva2Ugb3JnYW5pemF0aW9uIGFjY2VzcxLMAQoYYm9vdHN0cmFwUmV2b2tlT3JnQWNjZXNzEjEuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlJldm9rZU9yZ0FjY2Vzc0lucHV0GhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5ImXCuBhhCBEQHypSdW5hdXRob3JpemVkIHRvIHJldm9rZSBvcmdhbml6YXRpb24gYWNjZXNzIC0gY2FuX2Jvb3RzdHJhcF9pYW0gcGVybWlzc2lvbiByZXF1aXJlZDIHc3RpZ21lchoEoP8rCmIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_iampolicy_v1_api,file_ai_stigmer_iam_iampolicy_v1_io,file_ai_stigmer_iam_iampolicy_v1_spec,file_google_protobuf_empty]),IamPolicyCommandController=serviceDesc(file_ai_stigmer_iam_iampolicy_v1_command,0);var file_ai_stigmer_iam_iampolicy_v1_query=fileDesc("CidhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvcXVlcnkucHJvdG8SG2FpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MTKgCwoYSWFtUG9saWN5UXVlcnlDb250cm9sbGVyEoUBCgNnZXQSKC5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5SWQaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IizCuBgoCAUqJHVuYXV0aG9yaXplZCB0byB2aWV3IGFjY2VzcyBwb2xpY2llcxKFAQoRY2hlY2tNeVBlcm1pc3Npb24SMy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQ2hlY2tNeVBlcm1pc3Npb25JbnB1dBo1LmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5DaGVja0F1dGhvcml6YXRpb25SZXN1bHQiBNC4GAEShwEKEmNoZWNrQXV0aG9yaXphdGlvbhI0LmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5DaGVja0F1dGhvcml6YXRpb25JbnB1dBo1LmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5DaGVja0F1dGhvcml6YXRpb25SZXN1bHQiBNC4GAESlgEKGWxpc3RBdXRob3JpemVkUmVzb3VyY2VJZHMSOy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuTGlzdEF1dGhvcml6ZWRSZXNvdXJjZUlkc0lucHV0GjYuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkF1dGhvcml6ZWRSZXNvdXJjZUlkc0xpc3QiBNC4GAES5gEKGmxpc3RBdXRob3JpemVkUHJpbmNpcGFsSWRzEjwuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkxpc3RBdXRob3JpemVkUHJpbmNpcGFsSWRzSW5wdXQaNy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXV0aG9yaXplZFByaW5jaXBhbElkc0xpc3QiUcK4GE0IBRoNcmVzb3VyY2Uua2luZCILcmVzb3VyY2UuaWQqLXVuYXV0aG9yaXplZCB0byB2aWV3IGF1dGhvcml6ZWQgcHJpbmNpcGFsIGlkcxLbAQodbGlzdFJlc291cmNlQWNjZXNzQnlQcmluY2lwYWwSNC5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuTGlzdFJlc291cmNlQWNjZXNzSW5wdXQaOi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuUmVzb3VyY2VBY2Nlc3NCeVByaW5jaXBhbExpc3QiSMK4GEQIBRoNcmVzb3VyY2Uua2luZCILcmVzb3VyY2UuaWQqJHVuYXV0aG9yaXplZCB0byB2aWV3IHJlc291cmNlIGFjY2VzcxLPAQoZZ2V0UHJpbmNpcGFsUmVzb3VyY2VSb2xlcxIzLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5QcmluY2lwYWxSZXNvdXJjZUlucHV0GjMuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlByaW5jaXBhbFJlc291cmNlUm9sZXMiSMK4GEQIBRoNcmVzb3VyY2Uua2luZCILcmVzb3VyY2UuaWQqJHVuYXV0aG9yaXplZCB0byB2aWV3IHByaW5jaXBhbCByb2xlcxKxAQoSZ2V0UHJpbmNpcGFsc0NvdW50EjQuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkdldFByaW5jaXBhbHNDb3VudElucHV0GiwuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlByaW5jaXBhbHNDb3VudCI3wrgYMwgFEB4iBm9yZ19pZColdW5hdXRob3JpemVkIHRvIHZpZXcgcHJpbmNpcGFscyBjb3VudBoEoP8rCmIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_iampolicy_v1_api,file_ai_stigmer_iam_iampolicy_v1_io]),IamPolicyQueryController=serviceDesc(file_ai_stigmer_iam_iampolicy_v1_query,0);var ROLE_DISPLAY=[{role:IamRole.owner,name:"Owner",description:"Full control of the resource including ownership transfer"},{role:IamRole.admin,name:"Administrator",description:"Administrative access with most permissions except ownership transfer"},{role:IamRole.member,name:"Member",description:"Read and limited write access to the resource"},{role:IamRole.viewer,name:"Viewer",description:"Read-only access to the resource"},{role:IamRole.participant,name:"Participant",description:"Reply to customers and manage conversation takeover on a channel"}],RELATION_TO_DISPLAY=new Map(ROLE_DISPLAY.map(entry=>[IamRole[entry.role],entry]));function assignableRelations(){return[...RELATION_TO_DISPLAY.keys()]}function isAssignableRole(relation){return RELATION_TO_DISPLAY.has(relation)}function roleInfoFromRelation(relation){let display=RELATION_TO_DISPLAY.get(relation);if(display===void 0)return create2(RoleInfoSchema);let code=IamRole[display.role];return create2(RoleInfoSchema,{id:code,code,name:display.name,description:display.description})}var MAX_HIERARCHY_DEPTH=5,TERMINAL_KINDS=new Set([kindEnumName(ApiResourceKind.platform)]);async function resolveHierarchy(policies,resourceKind,resourceId,includeInherited){let hierarchy=[{kind:resourceKind,id:resourceId}];if(!includeInherited)return hierarchy;let currentKind=resourceKind,currentId=resourceId;for(let depth=0;depth<MAX_HIERARCHY_DEPTH&&!TERMINAL_KINDS.has(currentKind);depth++){let parent=(await policies.findScopeTuple(currentKind,currentId))?.spec?.principal;if(parent===void 0)break;currentKind=parent.kind,currentId=parent.id,hierarchy.push({kind:currentKind,id:currentId})}return hierarchy}async function buildPrincipalAccessList(policies,displayResolver,principalDisplay,hierarchy){let grants=[];for(let[index2,level]of hierarchy.entries()){let rows=await policies.findByResourceWithRelations(level.kind,level.id,assignableRelations());for(let policy of rows)grants.push({policy,isInherited:index2>0,level})}if(grants.length===0)return[];let enriched=await resolvePrincipalViews(grants.map(g5=>g5.policy),displayResolver,principalDisplay),grouped=new Map;for(let grant of grants){let principal=grant.policy.spec?.principal;if(principal===void 0)continue;let key=`${principal.kind}:${principal.id}#${principal.relation}`,entry=grouped.get(key);if(entry===void 0){let view=enriched.get(`${principal.kind}:${principal.id}`);entry={principal:withRelation(view??create2(ApiResourceRefViewSchema,{kind:principal.kind,id:principal.id,name:principal.id}),principal.relation),roles:[]},grouped.set(key,entry)}entry.roles.push(buildGrant(grant.policy,grant.isInherited,grant.level))}return[...grouped.values()].map(entry=>create2(PrincipalAccessSchema,{principal:entry.principal,roles:entry.roles}))}async function resolvePrincipalViews(rows,displayResolver,principalDisplay){let accountKind=kindEnumName(ApiResourceKind.identity_account),idsByKind=new Map;for(let row of rows){let principal=row.spec?.principal;if(principal===void 0)continue;let ids=idsByKind.get(principal.kind)??new Set;ids.add(principal.id),idsByKind.set(principal.kind,ids)}let views=new Map;for(let[kindName,ids]of idsByKind){let resolved;if(kindName===accountKind)resolved=await displayResolver.resolveIdentityAccounts([...ids]);else{let kind=kindByEnumName(kindName);if(principalDisplay===void 0||kind===ApiResourceKind.api_resource_kind_unknown)continue;resolved=await principalDisplay.resolve(kind,[...ids])}for(let[id,view]of resolved)views.set(`${kindName}:${id}`,view)}return views}function withRelation(view,relation){let stamped=clone(ApiResourceRefViewSchema,view);return stamped.relation=relation,stamped}function buildGrant(policy,isInherited,level){return create2(RoleGrantSchema,{role:roleInfoFromRelation(policy.spec?.relation??""),isInherited,...isInherited?{ownerResource:create2(ApiResourceRefSchema,{kind:level.kind,id:level.id})}:{}})}var STIGMER_PROVIDER_LABEL="Stigmer";function newAccountDisplayResolver(accounts){return{async resolveIdentityAccounts(ids){let rows=await accounts.findByIds(ids),resolved=new Map;for(let account2 of rows){let id=account2.metadata?.id??"";resolved.set(id,viewOf(id,account2))}return resolved}}}function viewOf(id,account2){let spec=account2.spec;return create2(ApiResourceRefViewSchema,{kind:kindEnumName(ApiResourceKind.identity_account),id,name:displayNameOf2(spec?.firstName??"",spec?.lastName??"",account2.metadata?.name??"",spec?.email??""),email:spec?.email??"",avatar:spec?.pictureUrl??"",identityOrigin:create2(IdentityOriginSchema,{provisioningMode:spec?.provisioningMode??IdentityAccountProvisioningMode.identity_account_provisioning_mode_unspecified,providerDisplayName:providerLabelOf(spec?.provisioningMode)})})}function displayNameOf2(firstName,lastName,accountName,email){return firstName!==""&&lastName!==""?`${firstName} ${lastName}`:firstName!==""?firstName:lastName!==""?lastName:accountName!==""?accountName:email}function providerLabelOf(mode){switch(mode){case IdentityAccountProvisioningMode.direct:case IdentityAccountProvisioningMode.machine:return STIGMER_PROVIDER_LABEL;default:return""}}var byName;function permissionByEnumName(relation){return byName===void 0&&(byName=new Map(IamPermissionSchema.values.filter(value=>value.number!==IamPermission.unspecified).map(value=>[value.name,value.number]))),byName.get(relation)}function requireKnownResourceKind(kind){let resolved=kindByEnumName(kind);if(resolved===ApiResourceKind.api_resource_kind_unknown)throw new ConnectError(unknownResourceKindMessage(kind),Code.InvalidArgument);return resolved}function requireKnownPrincipalKind(kind){let resolved=kindByEnumName(kind);if(resolved===ApiResourceKind.api_resource_kind_unknown)throw new ConnectError(unknownPrincipalKindMessage(kind),Code.InvalidArgument);return resolved}function requireWellFormedTriple(spec){let{principal,resource}=refsOf(spec),malformed=malformedTripleField(spec);if(malformed!==void 0)throw new ConnectError(malformedTripleMessage(malformed),Code.InvalidArgument);return{principal,resource,resourceKind:requireKnownResourceKind(resource.kind),principalKind:requireKnownPrincipalKind(principal.kind)}}function refsOf(spec){if(spec.principal===void 0||spec.resource===void 0)throw new Error("policy spec must carry principal and resource");return{principal:spec.principal,resource:spec.resource}}var POLICY_RESULT_KEY="policyResult";function newValidateGrantableRoleStep(scope){return{name:"ValidateGrantableRole",execute(ctx){let spec=ctx.input,kindName=spec.resource?.kind??"",kind=requireKnownResourceKind(kindName),contract=grantableRolesFor(kind);if(contract.length===0)throw new ConnectError(noGrantableRolesMessage(kindName),Code.InvalidArgument);let scoped=new Set(scope.grantableRoles(kind));if(scoped.size===0)throw new ConnectError(PER_RESOURCE_GRANTS_UNIMPLEMENTED_MESSAGE,Code.Unimplemented);let principal=spec.principal;if(principal?.kind===TEAM_KIND_NAME){requireTeamGrant(spec.relation,principal.relation,kind,kindName,scoped);return}let grantable=contract.filter(role=>scoped.has(role));if(!grantable.some(role=>IamRole[role]===spec.relation))throw new ConnectError(roleNotGrantableMessage(spec.relation,kindName,grantable.map(role=>IamRole[role])),Code.InvalidArgument);let principalKindName=principal?.kind??"";if(requireKnownPrincipalKind(principalKindName)!==ApiResourceKind.identity_account)throw new ConnectError(principalNotGrantableMessage(principalKindName),Code.InvalidArgument);let qualifier=principal?.relation??"";if(qualifier!=="")throw new ConnectError(personQualifierMessage(qualifier),Code.InvalidArgument)}}}var TEAM_KIND_NAME=kindEnumName(ApiResourceKind.team);function requireTeamGrant(role,qualifier,kind,kindName,scoped){let teamGrantable=teamGrantableRolesFor(kind).filter(r5=>scoped.has(r5));if(teamGrantable.length===0)throw new ConnectError(teamNotGrantableMessage(kindName),Code.InvalidArgument);if(!teamGrantable.some(r5=>IamRole[r5]===role))throw new ConnectError(teamRoleNotGrantableMessage(role,kindName,teamGrantable.map(r5=>IamRole[r5])),Code.InvalidArgument);if(qualifier!==TEAM_MEMBERS_RELATION)throw new ConnectError(teamQualifierMessage(qualifier),Code.InvalidArgument)}function newGrantStep(grantPath){return{name:"Grant",async execute(ctx){let{policy}=await grantPath.grant(ctx.input,ctx.callerIdentity);ctx.set(POLICY_RESULT_KEY,policy)}}}function newRevokeStep(grantPath){return{name:"Revoke",async execute(ctx){let revoked=await grantPath.revokeBySpec(ctx.input);ctx.set(POLICY_RESULT_KEY,revoked??create2(IamPolicySchema))}}}function newRevokeOrgAccessStep(grantPath){return{name:"RevokeOrgAccess",execute(ctx){return grantPath.revokeOrgAccess(ctx.input.identityAccountId,ctx.input.organizationId)}}}function newCleanupResourceStep(grantPath){return{name:"CleanupResource",execute(ctx){let ref=ctx.input;return grantPath.cleanupResource(ref)}}}var ORGANIZATION_KIND_NAME=kindEnumName(ApiResourceKind.organization),IDENTITY_ACCOUNT_KIND_NAME=kindEnumName(ApiResourceKind.identity_account),OWNER_RELATION=IamRole[IamRole.owner],ORGANIZATION_OWNERS_KEY="organizationOwners";async function organizationOwners(ctx,policies,organizationId){let held=ctx.get(ORGANIZATION_OWNERS_KEY);if(held instanceof Set)return held;let rows=await policies.findByResourceWithRelations(ORGANIZATION_KIND_NAME,organizationId,[OWNER_RELATION]),owners=new Set(rows.map(row=>row.spec?.principal).filter(principal=>principal?.kind===IDENTITY_ACCOUNT_KIND_NAME).map(principal=>principal?.id??""));return ctx.set(ORGANIZATION_OWNERS_KEY,owners),owners}function specOwnerRoleChange(ctx){let{resource,principal,relation}=ctx.input;return resource?.kind!==ORGANIZATION_KIND_NAME||relation!==OWNER_RELATION?Promise.resolve(void 0):Promise.resolve({organizationId:resource.id,accountId:principal?.id??""})}function orgAccessOwnerRoleChange(policies){return async ctx=>{let{identityAccountId,organizationId}=ctx.input;return(await organizationOwners(ctx,policies,organizationId)).has(identityAccountId)?{organizationId,accountId:identityAccountId}:void 0}}function newAuthorizeOwnerAssignmentStep(authorizer,ownerRoleChange){return{name:"AuthorizeOwnerAssignment",async execute(ctx){if(ctx.callerIdentity.callerClass==="internal")return;let change=await ownerRoleChange(ctx);change!==void 0&&await authorizeResolvedResource(authorizer,ctx.callerIdentity,{permission:IamPermission.can_assign_roles,resourceKind:ApiResourceKind.organization,resourceId:change.organizationId},OWNER_ASSIGNMENT_DENIED_MESSAGE)}}}function newKeepOneOwnerStep(policies,ownerRoleChange){return{name:"KeepOneOwner",async execute(ctx){if(ctx.callerIdentity.callerClass==="internal")return;let change=await ownerRoleChange(ctx);if(change===void 0)return;let owners=await organizationOwners(ctx,policies,change.organizationId);if(owners.has(change.accountId)&&owners.size===1)throw new ConnectError(LAST_OWNER_MESSAGE,Code.FailedPrecondition)}}}var SELF_PRINCIPAL_ID="_self";function registerIamPolicyServices(router,deps){let displayResolver=newAccountDisplayResolver(deps.accounts),command5=IamPolicyCommandController.method;router.service(IamPolicyCommandController,{create:(spec,ctx)=>createPolicy(deps,spec,ctx),delete:(spec,ctx)=>deletePolicy(deps,spec,ctx),bootstrapPolicy:(spec,ctx)=>(guardSystemRpc(command5.bootstrapPolicy,callerIdentityOf(ctx)),grantThroughChain(deps,command5.bootstrapPolicy,spec,ctx,!1)),cleanupResourcePolicies:(ref,ctx)=>(guardSystemRpc(command5.cleanupResourcePolicies,callerIdentityOf(ctx)),cleanupResourcePolicies(deps,ref,ctx)),revokeOrgAccess:(input,ctx)=>revokeOrgAccess(deps,command5.revokeOrgAccess,input,ctx,!0),bootstrapRevokeOrgAccess:(input,ctx)=>(guardSystemRpc(command5.bootstrapRevokeOrgAccess,callerIdentityOf(ctx)),revokeOrgAccess(deps,command5.bootstrapRevokeOrgAccess,input,ctx,!1))}),router.service(IamPolicyQueryController,{get:(id,ctx)=>get10(deps,id,ctx),checkMyPermission:(input,ctx)=>checkMyPermission(deps,input,ctx),checkAuthorization:(input,ctx)=>checkAuthorization(deps,input,ctx),listAuthorizedResourceIds:(input,ctx)=>listAuthorizedResourceIds(deps,input,ctx),listAuthorizedPrincipalIds:(input,ctx)=>listAuthorizedPrincipalIds(deps,input,ctx),listResourceAccessByPrincipal:(input,ctx)=>listResourceAccessByPrincipal(deps,displayResolver,input,ctx),getPrincipalResourceRoles:(input,ctx)=>getPrincipalResourceRoles(deps,input,ctx),getPrincipalsCount:(input,ctx)=>getPrincipalsCount(deps,input,ctx)})}function kindOf9(ctx){return ctx.values.get(apiResourceKindKey)}function guardSystemRpc(method,caller){if(!isPlatformPipelineCaller(caller))throw new ConnectError(getOption(method,config).errorMsg,Code.PermissionDenied)}function createPolicy(deps,spec,ctx){return requireWellFormedTriple(spec),grantThroughChain(deps,IamPolicyCommandController.method.create,spec,ctx,!0)}async function grantThroughChain(deps,method,spec,ctx,validateRole){let reqCtx=new RequestContext(IamPolicySpecSchema,spec,callerIdentityOf(ctx),kindOf9(ctx)),pipeline2=newPipeline(`iampolicy-${method.localName}`,deps.logger).addStep(newAuthorizeStep(method,deps.authorizer)).addStep(newValidateProtoStep());if(validateRole){pipeline2.addStep(newValidateGrantableRoleStep(deps.grantScope)),pipeline2.addStep(newAuthorizeOwnerAssignmentStep(deps.authorizer,specOwnerRoleChange));for(let step of stepsForSlot(deps.gateSteps,"iam-policy-create:pre-side-effect-gate"))pipeline2.addStep(step)}return await pipeline2.addStep(newGrantStep(deps.grantPath)).build().execute(reqCtx),policyResultOf(reqCtx,method)}async function deletePolicy(deps,spec,ctx){requireWellFormedTriple(spec);let method=IamPolicyCommandController.method.delete,reqCtx=new RequestContext(IamPolicySpecSchema,spec,callerIdentityOf(ctx),kindOf9(ctx));return await newPipeline("iampolicy-delete",deps.logger).addStep(newAuthorizeStep(method,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeOwnerAssignmentStep(deps.authorizer,specOwnerRoleChange)).addStep(newKeepOneOwnerStep(deps.policies,specOwnerRoleChange)).addStep(newRevokeStep(deps.grantPath)).build().execute(reqCtx),policyResultOf(reqCtx,method)}async function revokeOrgAccess(deps,method,input,ctx,guardOwners){let reqCtx=new RequestContext(RevokeOrgAccessInputSchema,input,callerIdentityOf(ctx),kindOf9(ctx)),pipeline2=newPipeline(`iampolicy-${method.localName}`,deps.logger).addStep(newAuthorizeStep(method,deps.authorizer)).addStep(newValidateProtoStep());if(guardOwners){let ownerRoleChange=orgAccessOwnerRoleChange(deps.policies);pipeline2.addStep(newAuthorizeOwnerAssignmentStep(deps.authorizer,ownerRoleChange)).addStep(newKeepOneOwnerStep(deps.policies,ownerRoleChange))}return await pipeline2.addStep(newRevokeOrgAccessStep(deps.grantPath)).build().execute(reqCtx),create2(EmptySchema)}async function cleanupResourcePolicies(deps,ref,ctx){let method=IamPolicyCommandController.method.cleanupResourcePolicies,reqCtx=new RequestContext(ApiResourceRefSchema,ref,callerIdentityOf(ctx),kindOf9(ctx));return await newPipeline("iampolicy-cleanupResourcePolicies",deps.logger).addStep(newAuthorizeStep(method,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newCleanupResourceStep(deps.grantPath)).build().execute(reqCtx),create2(EmptySchema)}function policyResultOf(reqCtx,method){let result=reqCtx.get(POLICY_RESULT_KEY);if(result===void 0)throw internalError(new Error(`${method.localName} pipeline completed without a policy`),"policy not found in context");return result}async function get10(deps,id,ctx){let policy=await read2(()=>deps.policies.findById(id.value),"failed to load IAM policy");if(policy===void 0)throw new ConnectError(policyNotFoundMessage(id.value),Code.NotFound);let{resource}=refsOf(specOfRow(policy));return await authorizeDirect(IamPolicyQueryController.method.get,deps.authorizer,callerIdentityOf(ctx),id,{resourceKind:kindByEnumName(resource.kind),resourceId:resource.id}),policy}async function checkMyPermission(deps,input,ctx){let caller=requireAuthenticated(callerIdentityOf(ctx)),permission=permissionByEnumName(input.relation);if(permission===void 0)throw new ConnectError(unknownPermissionMessage(input.relation),Code.InvalidArgument);let resource=requireRef(input.resource),resourceKind=requireKnownResourceKind(resource.kind);if(input.contextualPolicies.length>0){let engine=requireQueryEngine(deps),principal=create2(ApiResourceRefSchema,{kind:kindEnumName(ApiResourceKind.identity_account),id:await callerPrincipalId(deps,caller)}),policy=create2(IamPolicySpecSchema,{principal,relation:input.relation,resource}),allowed=await engine.check(policy,input.contextualPolicies);return create2(CheckAuthorizationResultSchema,{isAuthorized:allowed})}if(!kindServedByEdition(resourceKind,deps.edition))return create2(CheckAuthorizationResultSchema,{isAuthorized:!1});if(permission===IamPermission.can_grant_access&&deps.grantScope.grantableRoles(resourceKind).length===0)return create2(CheckAuthorizationResultSchema,{isAuthorized:!1});let decision=await evaluateAuthorizer(deps.authorizer,caller,{permission,resourceKind,resourceId:resource.id});switch(decision.kind){case"allow":return create2(CheckAuthorizationResultSchema,{isAuthorized:!0});case"deny":case"not-found":return create2(CheckAuthorizationResultSchema,{isAuthorized:!1});case"unavailable":throw internalError(decision.cause,AUTHORIZATION_UNAVAILABLE_MESSAGE);default:{let exhaustive=decision;throw internalError(new Error(`unknown decision ${JSON.stringify(exhaustive)}`),AUTHORIZATION_UNAVAILABLE_MESSAGE)}}}async function checkAuthorization(deps,input,ctx){let caller=requireAuthenticated(callerIdentityOf(ctx)),policy=requireInputPolicy(input.policy);await enforcePrincipalTrust(deps,caller,policy.principal),requireWellFormedTriple(policy);let allowed=await requireQueryEngine(deps).check(policy,input.contextualPolicies);return create2(CheckAuthorizationResultSchema,{isAuthorized:allowed})}async function listAuthorizedResourceIds(deps,input,ctx){let caller=requireAuthenticated(callerIdentityOf(ctx)),principal=requireRef(input.principal);await enforcePrincipalTrust(deps,caller,principal),requireKnownPrincipalKind(principal.kind),requireKnownResourceKind(input.resourceKind);let resourceIds=await requireQueryEngine(deps).listResourceIds(principal,input.relation,input.resourceKind,input.contextualPolicies);return create2(AuthorizedResourceIdsListSchema,{resourceIds:[...resourceIds]})}async function listAuthorizedPrincipalIds(deps,input,ctx){let resource=requireRef(input.resource);requireKnownResourceKind(resource.kind),requireKnownPrincipalKind(input.principalKind),await authorizeDirect(IamPolicyQueryController.method.listAuthorizedPrincipalIds,deps.authorizer,callerIdentityOf(ctx),input);let principalIds=await requireQueryEngine(deps).listPrincipalIds(resource,input.relation,input.principalKind,input.contextualPolicies);return create2(AuthorizedPrincipalIdsListSchema,{principalIds:[...principalIds]})}async function listResourceAccessByPrincipal(deps,displayResolver,input,ctx){let resource=requireRef(input.resource);requireKnownResourceKind(resource.kind),await authorizeDirect(IamPolicyQueryController.method.listResourceAccessByPrincipal,deps.authorizer,callerIdentityOf(ctx),input);let entries=await read2(async()=>{let hierarchy=await resolveHierarchy(deps.policies,resource.kind,resource.id,input.includeInherited);return buildPrincipalAccessList(deps.policies,displayResolver,deps.principalDisplay,hierarchy)},"failed to list resource access");return create2(ResourceAccessByPrincipalListSchema,{entries:[...entries]})}async function getPrincipalResourceRoles(deps,input,ctx){let resource=requireRef(input.resource),principal=requireRef(input.principal);requireKnownResourceKind(resource.kind),requireKnownPrincipalKind(principal.kind),await authorizeDirect(IamPolicyQueryController.method.getPrincipalResourceRoles,deps.authorizer,callerIdentityOf(ctx),input);let roles=(await read2(()=>deps.policies.findByPrincipalAndResource(principal.kind,principal.id,resource.kind,resource.id),"failed to load principal roles")).map(policy=>policy.spec?.relation??"").filter(isAssignableRole).map(roleInfoFromRelation);return create2(PrincipalResourceRolesSchema,{roles})}async function getPrincipalsCount(deps,input,ctx){let principalKind=input.principalKind===""?void 0:input.principalKind;principalKind!==void 0&&requireKnownPrincipalKind(principalKind),await authorizeDirect(IamPolicyQueryController.method.getPrincipalsCount,deps.authorizer,callerIdentityOf(ctx),input);let count=await read2(()=>deps.policies.countDistinctPrincipalsByResource(kindEnumName(ApiResourceKind.organization),input.orgId,principalKind,assignableRelations()),"failed to count principals");return create2(PrincipalsCountSchema,{count})}function requireAuthenticated(caller){if(caller.identityId==="")throw new ConnectError(AUTHENTICATION_REQUIRED_MESSAGE,Code.Unauthenticated);return caller}async function callerPrincipalId(deps,caller){return(await read2(()=>accountForCaller(deps.accounts,caller),"failed to resolve the caller's account"))?.metadata?.id??caller.identityId}async function enforcePrincipalTrust(deps,caller,principal){if(caller.callerClass==="machine"||caller.callerClass==="internal")return;if(principal?.kind!==kindEnumName(ApiResourceKind.identity_account))throw new ConnectError("Only self identity_account permission checks are supported",Code.InvalidArgument);let requestedId=principal.id;if(requestedId===""||requestedId===SELF_PRINCIPAL_ID)throw new ConnectError(`The '${SELF_PRINCIPAL_ID}' principal alias is not supported \u2014 use checkMyPermission for self permission checks`,Code.InvalidArgument);if(requestedId!==await callerPrincipalId(deps,caller))throw new ConnectError("Principal must be the authenticated caller",Code.PermissionDenied)}function requireQueryEngine(deps){if(deps.queries===void 0)throw new ConnectError(AUTHORIZATION_QUERIES_UNIMPLEMENTED_MESSAGE,Code.Unimplemented);return deps.queries}function requireRef(ref){if(ref===void 0)throw internalError(new Error("required reference missing after boundary validation"),"required reference missing after boundary validation");return ref}function requireInputPolicy(policy){if(policy===void 0)throw internalError(new Error("required policy missing after boundary validation"),"required policy missing after boundary validation");return policy}function specOfRow(policy){if(policy.spec===void 0)throw internalError(new Error(`policy ${policy.metadata?.id??"?"} has no spec \u2014 corrupt row`),"failed to load IAM policy");return policy.spec}async function read2(operation2,message6){try{return await operation2()}catch(error2){throw internalError(error2,message6)}}var DuplicatePolicyError=class extends Error{constructor(message6,options){super(message6,options),this.name="DuplicatePolicyError"}};function newIamPolicyGrantPath(deps){let{policies,lifecycle,logger:logger2}=deps;async function findByTriple(spec){let{principal,resource}=refsOf(spec);return(await policies.findByPrincipalAndResource(principal.kind,principal.id,resource.kind,resource.id)).find(policy=>policy.spec!==void 0&&policy.spec.relation===spec.relation&&policy.spec.principal?.relation===principal.relation)}async function revokeRow(policy){let spec=policy.spec;if(spec===void 0)throw new Error(`policy ${policy.metadata?.id??"?"} has no spec \u2014 corrupt row`);await lifecycle?.onPolicyRevoked?.({spec,policy});let id=policy.metadata?.id??"";await policies.deleteById(id),logger2.info("iam policy revoked",fieldsOf(id,spec))}return{async grant(spec,caller){requireWellFormedTriple(spec);let policy=await findByTriple(spec),duplicate=policy!==void 0;if(policy===void 0){let fresh=buildRow(spec,caller);try{await policies.save(fresh),policy=fresh,logger2.info("iam policy granted",fieldsOf(policyIdFor(spec),spec))}catch(error2){if(!(error2 instanceof DuplicatePolicyError))throw error2;let winner=await findByTriple(spec);if(winner===void 0)throw error2;policy=winner,duplicate=!0}}return duplicate&&logger2.debug("iam policy already held",fieldsOf(policy.metadata?.id??"",spec)),await lifecycle?.onPolicyGranted?.({policy,duplicate}),{policy,duplicate}},async revokeBySpec(spec){requireWellFormedTriple(spec);let existing=await findByTriple(spec);if(existing===void 0){await lifecycle?.onPolicyRevoked?.({spec,policy:void 0});return}return await revokeRow(existing),existing},async cleanupResource(ref){let asResource=await policies.findByResource(ref.kind,ref.id),asPrincipal=await policies.findByPrincipal(ref.kind,ref.id);for(let policy of distinctById([...asResource,...asPrincipal]))await revokeRow(policy)},async revokeOrgAccess(identityAccountId,organizationId){let direct=await policies.findByPrincipalAndResource(kindEnumName(ApiResourceKind.identity_account),identityAccountId,kindEnumName(ApiResourceKind.organization),organizationId);for(let policy of direct)await revokeRow(policy)}}}function buildRow(spec,caller){let policy=create2(IamPolicySchema,{apiVersion:IAM_POLICY_API_VERSION,kind:IAM_POLICY_KIND,metadata:create2(ApiResourceMetadataSchema,{id:policyIdFor(spec)}),spec});return setAuditFieldsForCreate(IamPolicySchema,policy,caller),policy}function distinctById(policies){let seen=new Set;return policies.filter(policy=>{let id=policy.metadata?.id??"";return seen.has(id)?!1:(seen.add(id),!0)})}function fieldsOf(id,spec){return{policyId:id,relation:spec.relation,principalKind:spec.principal?.kind??"",principalId:spec.principal?.id??"",resourceKind:spec.resource?.kind??"",resourceId:spec.resource?.id??""}}function newOrganizationOnlyGrantScope(){return{grantableRoles(kind){return kind===ApiResourceKind.organization?grantableRolesFor(kind):[]}}}var iamPolicyListIndex=declareListIndex({kind:ApiResourceKind.iam_policy,schema:IamPolicySchema,revision:1,keys:{principal:field2("spec.principal.id")}});var KIND4=ApiResourceKind.iam_policy,NON_STRUCTURAL_PRINCIPAL_KINDS=USER_GRANT_PRINCIPAL_KINDS.map(kind=>kindEnumName(kind)),NON_STRUCTURAL_RELATIONS=["owner","creator"];function newResourceIamPolicyStore(store){async function readById(id){try{return await store.getResource(KIND4,id,IamPolicySchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}async function all(){return(await store.listResources(KIND4)).map(bytes=>fromBinary2(IamPolicySchema,bytes))}async function where(predicate){return(await all()).filter(predicate)}return{async save(policy){let id=policy.metadata?.id??"";if(policy.spec===void 0||id!==policyIdFor(policy.spec))throw new Error("policy id must be derived from its triple");if(await readById(id)!==void 0)throw new DuplicatePolicyError(`IAM policy '${id}' already exists`);await store.saveResource(KIND4,id,IamPolicySchema,policy)},async deleteById(id){await store.deleteResource(KIND4,id)},findById:readById,async findByPrincipal(principalKind,principalId){return(await store.queryResources(iamPolicyListIndex,{anyKey:[{name:"principal",value:principalId}]})).map(row=>fromBinary2(IamPolicySchema,row.data)).filter(policy=>onPrincipal(policy,principalKind,principalId))},findByResource(resourceKind,resourceId){return where(policy=>onResource(policy,resourceKind,resourceId))},findByPrincipalAndResource(principalKind,principalId,resourceKind,resourceId){return where(policy=>onPrincipal(policy,principalKind,principalId)&&onResource(policy,resourceKind,resourceId))},findByResourceWithRelations(resourceKind,resourceId,relations){return where(policy=>onResource(policy,resourceKind,resourceId)&&relations.includes(relationOf2(policy)))},async countDistinctPrincipalsByResource(resourceKind,resourceId,principalKind,relations){let principals=new Set;for(let policy of await all())onResource(policy,resourceKind,resourceId)&&relations.includes(relationOf2(policy))&&(principalKind===void 0||policy.spec?.principal?.kind===principalKind)&&principals.add(`${policy.spec?.principal?.kind??""}:${policy.spec?.principal?.id??""}`);return principals.size},async findScopeTuple(resourceKind,resourceId){return(await all()).find(policy=>onResource(policy,resourceKind,resourceId)&&!NON_STRUCTURAL_PRINCIPAL_KINDS.includes(policy.spec?.principal?.kind??"")&&!NON_STRUCTURAL_RELATIONS.includes(relationOf2(policy)))}}}function onPrincipal(policy,kind,id){return policy.spec?.principal?.kind===kind&&policy.spec?.principal?.id===id}function onResource(policy,kind,id){return policy.spec?.resource?.kind===kind&&policy.spec?.resource?.id===id}function relationOf2(policy){return policy.spec?.relation??""}var CLEANUP_KINDS=new Set([ApiResourceKind.organization,ApiResourceKind.identity_account]);function newBuiltInRoleLifecycle(deps){let{grantPath,accounts}=deps;return{async onResourceCreated(event){if(event.kind!==ApiResourceKind.organization||event.ownerAttribution!==OwnerAttributionType.DIRECT||event.caller.callerClass!=="user")return;let accountId=(await accountForCaller(accounts,event.caller))?.metadata?.id??"";accountId!==""&&await grantPath.grant(organizationRole(accountId,IamRole.owner,event.resourceId),{...event.caller,identityId:accountId})},async onResourceDeleted(event){CLEANUP_KINDS.has(event.kind)&&await grantPath.cleanupResource(create2(ApiResourceRefSchema,{kind:kindEnumName(event.kind),id:event.resourceId}))},async onVisibilityChanged(){}}}function discoveryUrl(issuer){return`${issuer.replace(/\/$/,"")}/.well-known/openid-configuration`}function newIssuerDiscovery(fetchImpl=fetch){let discovered=new Map;return{async discover(issuer){let cached2=discovered.get(issuer);if(cached2!==void 0)return cached2;let url=discoveryUrl(issuer),response=await fetchImpl(url);if(!response.ok)throw new Error(`OIDC discovery failed: ${url} answered HTTP ${response.status}`);let document2=await response.json();if(document2.issuer!==issuer)throw new Error(`OIDC discovery failed: document issuer '${typeof document2.issuer=="string"?document2.issuer:""}' does not match configured issuer '${issuer}'`);if(typeof document2.jwks_uri!="string"||document2.jwks_uri==="")throw new Error(`OIDC discovery failed: ${url} carries no jwks_uri`);let result={issuer,jwksUri:document2.jwks_uri,userinfoEndpoint:typeof document2.userinfo_endpoint=="string"&&document2.userinfo_endpoint!==""?document2.userinfo_endpoint:void 0};return discovered.set(issuer,result),result}}}function newOidcUserInfoClient(discovery2,fetchImpl=fetch){return{async fetchUserProfile(issuer,accessToken){let{userinfoEndpoint}=await discovery2.discover(issuer);if(userinfoEndpoint===void 0)throw new Error(`issuer '${issuer}' publishes no userinfo_endpoint in its discovery document`);let response=await fetchImpl(userinfoEndpoint,{headers:{authorization:`Bearer ${accessToken}`}});if(!response.ok)throw new Error(`userinfo answered ${response.status}`);let claims=await response.json(),text2=key=>{let value=claims[key];return typeof value=="string"?value:""};return{email:text2("email"),firstName:text2("given_name"),lastName:text2("family_name"),pictureUrl:text2("picture")}}}}var LAST_USED_RESOLUTION_MS=6e4;function lastUseIsStale(lastUsedAt,now){return lastUsedAt===void 0||now.getTime()-timestampDate(lastUsedAt).getTime()>=LAST_USED_RESOLUTION_MS}function stampLastUsed(status,usedAt){let stored=status.lastUsedAt;return stored!==void 0&&timestampDate(stored).getTime()>=usedAt.getTime()?!1:(status.lastUsedAt=timestampFromDate(usedAt),bumpStatusAudit(status),!0)}async function recordCredentialUse(use){if(lastUseIsStale(use.lastUsedAt,use.now))try{await use.write(status=>{stampLastUsed(status,use.now)})}catch(error2){if(error2 instanceof ResourceNotFoundError)return;use.logger.warn("Credential last_used_at not recorded (best-effort \u2014 the request is unaffected)",{credential:use.credential,id:use.id,error:error2 instanceof Error?error2.message:String(error2)})}}var INVALID_TOKEN_MESSAGE="invalid token",TOKEN_EXPIRED_MESSAGE="token has expired";function newApiKeyIdentityVerifier(deps){let{store,accounts,logger:logger2}=deps;return{name:"apikey",async verify(token){if(!isApiKeyToken(token))return null;let key=await findApiKeyByHash(store,hashApiKey(token));if(key===void 0)throw new ConnectError(INVALID_TOKEN_MESSAGE,Code.Unauthenticated);let now=deps.now(),expiresAt=key.spec?.expiresAt;if(expiresAt!==void 0&&timestampDate(expiresAt)<=now)throw new ConnectError(TOKEN_EXPIRED_MESSAGE,Code.Unauthenticated);let owner=key.status?.audit?.specAudit?.createdBy;if(owner===void 0||owner.id==="")throw new ConnectError(INVALID_TOKEN_MESSAGE,Code.Unauthenticated);let identityId=await identityIdForSubject(accounts,owner.id);return await recordKeyUse(store,logger2,key,now),{identityId,callerClass:"user",issuer:"",rawToken:token,...owner.email!==""?{email:owner.email}:{},...owner.displayName!==""?{displayName:owner.displayName}:{}}}}}function recordKeyUse(store,logger2,key,now){let id=key.metadata?.id??"";return recordCredentialUse({credential:"api key",id,lastUsedAt:key.status?.lastUsedAt,now,logger:logger2,write:stamp2=>store.updateResource(ApiResourceKind.api_key,id,ApiKeySchema,live=>{live.status??=create2(ApiKeyStatusSchema),stamp2(live.status)})})}var import_node_crypto17=require("node:crypto");var file_ai_stigmer_agentic_artifact_v1_io=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvYXJ0aWZhY3QvdjEvaW8ucHJvdG8SHmFpLnN0aWdtZXIuYWdlbnRpYy5hcnRpZmFjdC52MSIjCgpBcnRpZmFjdElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiXgoMQXJ0aWZhY3RMaXN0EhMKC3RvdGFsX3BhZ2VzGAEgASgFEjkKB2VudHJpZXMYAiADKAsyKC5haS5zdGlnbWVyLmFnZW50aWMuYXJ0aWZhY3QudjEuQXJ0aWZhY3QieQoTQ3JlYXRlQXJ0aWZhY3RJbnB1dBJCCgRzcGVjGAEgASgLMiwuYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxLkFydGlmYWN0U3BlY0IGukgDyAEBEh4KB2NvbnRlbnQYAiABKAxCDbpICsgBAXoFGICAgBkiiwEKH0xpc3RBcnRpZmFjdHNCeUV4ZWN1dGlvblJlcXVlc3QSHQoVd29ya2Zsb3dfZXhlY3V0aW9uX2lkGAEgASgJEhoKEmFnZW50X2V4ZWN1dGlvbl9pZBgCIAEoCRIVCglwYWdlX3NpemUYAyABKAVCAhgBEhYKCnBhZ2VfdG9rZW4YBCABKAlCAhgBIkwKGUdldEFydGlmYWN0Q29udGVudFJlcXVlc3QSHAoLYXJ0aWZhY3RfaWQYASABKAlCB7pIBHICEAESEQoJbWF4X2J5dGVzGAIgASgDInAKGkdldEFydGlmYWN0Q29udGVudFJlc3BvbnNlEg8KB2NvbnRlbnQYASABKAwSFAoMY29udGVudF90eXBlGAIgASgJEhgKEHRvdGFsX3NpemVfYnl0ZXMYAyABKAMSEQoJdHJ1bmNhdGVkGAQgASgIImEKE0FydGlmYWN0RG93bmxvYWRVcmwSCwoDdXJsGAEgASgJEhMKC3R0bF9zZWNvbmRzGAIgASgFEhIKCnNpemVfYnl0ZXMYAyABKAMSFAoMY29udGVudF90eXBlGAQgASgJYgZwcm90bzM",[file_ai_stigmer_agentic_artifact_v1_api,file_ai_stigmer_agentic_artifact_v1_spec,file_buf_validate_validate]);var ArtifactListSchema=messageDesc2(file_ai_stigmer_agentic_artifact_v1_io,1);var GetArtifactContentResponseSchema2=messageDesc2(file_ai_stigmer_agentic_artifact_v1_io,5),ArtifactDownloadUrlSchema=messageDesc2(file_ai_stigmer_agentic_artifact_v1_io,6);var file_ai_stigmer_agentic_artifact_v1_command=fileDesc("CixhaS9zdGlnbWVyL2FnZW50aWMvYXJ0aWZhY3QvdjEvY29tbWFuZC5wcm90bxIeYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxMqYCChlBcnRpZmFjdENvbW1hbmRDb250cm9sbGVyEm0KBmNyZWF0ZRIzLmFpLnN0aWdtZXIuYWdlbnRpYy5hcnRpZmFjdC52MS5DcmVhdGVBcnRpZmFjdElucHV0GiguYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxLkFydGlmYWN0IgTQuBgBEpMBCgZkZWxldGUSLS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VJZBooLmFpLnN0aWdtZXIuYWdlbnRpYy5hcnRpZmFjdC52MS5BcnRpZmFjdCIwwrgYLAgCEDciBXZhbHVlKh91bmF1dGhvcml6ZWQgdG8gZGVsZXRlIGFydGlmYWN0GgSg/ys3YgZwcm90bzM",[file_ai_stigmer_agentic_artifact_v1_api,file_ai_stigmer_agentic_artifact_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ArtifactCommandController=serviceDesc(file_ai_stigmer_agentic_artifact_v1_command,0);var file_ai_stigmer_agentic_artifact_v1_query=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvYXJ0aWZhY3QvdjEvcXVlcnkucHJvdG8SHmFpLnN0aWdtZXIuYWdlbnRpYy5hcnRpZmFjdC52MTKhBQoXQXJ0aWZhY3RRdWVyeUNvbnRyb2xsZXISigEKA2dldBIqLmFpLnN0aWdtZXIuYWdlbnRpYy5hcnRpZmFjdC52MS5BcnRpZmFjdElkGiguYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxLkFydGlmYWN0Ii3CuBgpCAEQNyIFdmFsdWUqHHVuYXV0aG9yaXplZCB0byBnZXQgYXJ0aWZhY3QShgEKD2xpc3RCeUV4ZWN1dGlvbhI/LmFpLnN0aWdtZXIuYWdlbnRpYy5hcnRpZmFjdC52MS5MaXN0QXJ0aWZhY3RzQnlFeGVjdXRpb25SZXF1ZXN0GiwuYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxLkFydGlmYWN0TGlzdCIE0LgYARKlAQoOZ2V0RG93bmxvYWRVcmwSKi5haS5zdGlnbWVyLmFnZW50aWMuYXJ0aWZhY3QudjEuQXJ0aWZhY3RJZBozLmFpLnN0aWdtZXIuYWdlbnRpYy5hcnRpZmFjdC52MS5BcnRpZmFjdERvd25sb2FkVXJsIjLCuBguCAEQNyIFdmFsdWUqIXVuYXV0aG9yaXplZCB0byBkb3dubG9hZCBhcnRpZmFjdBLBAQoKZ2V0Q29udGVudBI5LmFpLnN0aWdtZXIuYWdlbnRpYy5hcnRpZmFjdC52MS5HZXRBcnRpZmFjdENvbnRlbnRSZXF1ZXN0GjouYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxLkdldEFydGlmYWN0Q29udGVudFJlc3BvbnNlIjzCuBg4CAEQNyILYXJ0aWZhY3RfaWQqJXVuYXV0aG9yaXplZCB0byByZWFkIGFydGlmYWN0IGNvbnRlbnQaBKD/KzdiBnByb3RvMw",[file_ai_stigmer_agentic_artifact_v1_api,file_ai_stigmer_agentic_artifact_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ArtifactQueryController=serviceDesc(file_ai_stigmer_agentic_artifact_v1_query,0);var artifactListIndex=declareListIndex({kind:ApiResourceKind.artifact,schema:ArtifactSchema,revision:1,keys:{agent_execution:field2("spec.source.agent_execution_id"),workflow_execution:field2("spec.source.workflow_execution_id")}});var ARTIFACT_KIND="Artifact";var DEFAULT_MAX_CONTENT_BYTES=512n*1024n,DOWNLOAD_URL_EXPIRATION_MS=10080*60*1e3;function artifactNotFoundMessage(artifactId2){return`Artifact not found: ${artifactId2}`}function artifactBlobDeletedMessage(artifactId2){return`artifact blob has been deleted: ${artifactId2}`}function registerArtifactServices(router,deps){router.service(ArtifactCommandController,{create:(input,ctx)=>createArtifact(deps,input,callerIdentityOf(ctx)),delete:(id,ctx)=>deleteArtifact(deps,id,callerIdentityOf(ctx))}),router.service(ArtifactQueryController,{get:(id,ctx)=>get11(deps,id,ctx),listByExecution:(req,ctx)=>listByExecution(deps,req,ctx),getDownloadUrl:(id,ctx)=>getDownloadUrl(deps,id,callerIdentityOf(ctx)),getContent:(req,ctx)=>getContent(deps,req,callerIdentityOf(ctx))})}function kindOf10(ctx){return ctx.values.get(apiResourceKindKey)}async function createArtifact(deps,input,identity2){let spec=input.spec;if(spec===void 0)throw invalidArgumentError("spec is required");let content=input.content;if(content.length===0)throw invalidArgumentError("content is required");if(content.length>52428800)throw new ConnectError(`content exceeds maximum size of ${52428800} bytes`,Code.ResourceExhausted);let source=spec.source;if(source===void 0||source.workflowExecutionId===""&&source.agentExecutionId==="")throw invalidArgumentError("spec.source must include workflow_execution_id or agent_execution_id");let contentHash=(0,import_node_crypto17.createHash)("sha256").update(content).digest("hex");deps.logger.info("creating artifact",{contentHash,contentSize:content.length,contentType:spec.contentType,displayName:spec.displayName});try{await deps.artifactStorage.upload(contentHash,content,spec.contentType)}catch(error2){throw deps.logger.error("failed to upload artifact blob",{contentHash,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to upload artifact content")}let org=await deriveOrgFromSource(deps,source),artifactId2=generateId("art"),artifact=create2(ArtifactSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:ARTIFACT_KIND,metadata:{id:artifactId2,name:spec.displayName,org},spec,status:{contentHash,sizeBytes:BigInt(content.length),storageState:ArtifactStorageState.storage_state_stored,expiresAt:computeExpiresAt(spec.retention?.ttlDays)}});try{setAuditFieldsForCreate(ArtifactSchema,artifact,identity2)}catch(error2){deps.logger.error("failed to set audit fields on artifact",{error:error2 instanceof Error?error2.message:String(error2)})}try{await deps.store.saveResource(ApiResourceKind.artifact,artifactId2,ArtifactSchema,artifact)}catch(error2){throw deps.logger.error("failed to persist artifact metadata",{artifactId:artifactId2,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to persist artifact")}return deps.logger.info("artifact created successfully",{artifactId:artifactId2,contentHash,sizeBytes:content.length}),artifact}async function deriveOrgFromSource(deps,source){let lookups=[{id:source.workflowExecutionId,kind:ApiResourceKind.workflow_execution},{id:source.agentExecutionId,kind:ApiResourceKind.agent_execution}];for(let lookup3 of lookups)if(lookup3.id!=="")try{let org=(await deps.store.getResource(lookup3.kind,lookup3.id,ArtifactSchema)).metadata?.org??"";if(org!=="")return org}catch{}return""}function computeExpiresAt(ttlDaysInput){let ttlDays=ttlDaysInput??30;return ttlDays===-1?"":(ttlDays<=0&&(ttlDays=30),new Date(Date.now()+ttlDays*24*60*60*1e3).toISOString().replace(/\.\d{3}Z$/,"Z"))}async function deleteArtifact(deps,id,identity2){let resourceId=id.value;if(resourceId==="")throw invalidArgumentError("artifact id is required");let artifact=await loadArtifactOrNotFound(deps,resourceId);await authorizeDirect(ArtifactCommandController.method.delete,deps.authorizer,identity2,id),deps.logger.info("soft-deleting artifact",{artifactId:resourceId,previousState:ArtifactStorageState[artifact.status?.storageState??0]}),artifact.status===void 0&&(artifact.status=create2(ArtifactStatusSchema)),artifact.status.storageState=ArtifactStorageState.storage_state_deleted;try{setAuditFieldsForUpdate(ArtifactSchema,artifact,"status_audit",identity2)}catch(error2){deps.logger.error("failed to set audit fields on artifact delete",{error:error2 instanceof Error?error2.message:String(error2)})}try{await deps.store.saveResource(ApiResourceKind.artifact,resourceId,ArtifactSchema,artifact)}catch(error2){throw deps.logger.error("failed to persist artifact deletion",{artifactId:resourceId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to persist artifact deletion")}return deps.logger.info("artifact soft-deleted successfully",{artifactId:resourceId}),artifact}async function get11(deps,id,ctx){let reqCtx=new RequestContext(ArtifactQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf10(ctx));return await newPipeline("artifact-get",deps.logger).addStep(newAuthorizeStep(ArtifactQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,ArtifactSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var ARTIFACT_LIST_KEY="artifactList";async function listByExecution(deps,req,ctx){let reqCtx=new RequestContext(ArtifactQueryController.method.listByExecution.input,req,callerIdentityOf(ctx),kindOf10(ctx));await newPipeline("artifact-list-by-execution",deps.logger).addStep(newAuthorizeStep(ArtifactQueryController.method.listByExecution,deps.authorizer)).addStep({name:"ValidateListByExecutionRequest",execute(stepCtx){let input=stepCtx.input;if(input.workflowExecutionId===""&&input.agentExecutionId==="")throw invalidArgumentError("workflow_execution_id or agent_execution_id is required")}}).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,({input})=>[{permission:IamPermission.can_view,resourceKind:input.workflowExecutionId!==""?ApiResourceKind.workflow_execution:ApiResourceKind.agent_execution,resourceId:input.workflowExecutionId!==""?input.workflowExecutionId:input.agentExecutionId,deniedMessage:"unauthorized to list artifacts for this execution"}],"AuthorizeParentExecution")).addStep({name:"QueryArtifactsByExecution",async execute(stepCtx){let input=stepCtx.input,rows;try{rows=await deps.store.queryResources(artifactListIndex,{anyKey:[...input.workflowExecutionId===""?[]:[{name:"workflow_execution",value:input.workflowExecutionId}],...input.agentExecutionId===""?[]:[{name:"agent_execution",value:input.agentExecutionId}]]})}catch(error2){throw internalError(error2,"failed to list artifacts")}let artifacts=[];for(let row of rows)try{artifacts.push(fromBinary2(ArtifactSchema,row.data))}catch(error2){deps.logger.warn("failed to unmarshal artifact, skipping",{error:error2 instanceof Error?error2.message:String(error2)})}stepCtx.set(ARTIFACT_LIST_KEY,create2(ArtifactListSchema,{totalPages:1,entries:artifacts}))}}).build().execute(reqCtx);let list12=reqCtx.get(ARTIFACT_LIST_KEY);if(list12===void 0)throw internalError(new Error("artifact list missing from pipeline context"),"artifact list not found in pipeline context");return list12}async function getDownloadUrl(deps,id,identity2){let resourceId=id.value;if(resourceId==="")throw invalidArgumentError("artifact id is required");let artifact=await loadArtifactOrNotFound(deps,resourceId);await authorizeDirect(ArtifactQueryController.method.getDownloadUrl,deps.authorizer,identity2,id);let contentHash=requireLiveBlob(artifact,resourceId);deps.logger.info("generating download URL for artifact",{artifactId:resourceId,contentHash});let downloadUrl;try{downloadUrl=await deps.artifactStorage.getSignedUrl(contentHash,DOWNLOAD_URL_EXPIRATION_MS,"")}catch(error2){throw deps.logger.error("failed to generate download URL for artifact",{artifactId:resourceId,contentHash,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to generate download URL")}return create2(ArtifactDownloadUrlSchema,{url:downloadUrl,ttlSeconds:Math.floor(DOWNLOAD_URL_EXPIRATION_MS/1e3),sizeBytes:artifact.status?.sizeBytes??0n,contentType:artifact.spec?.contentType??""})}async function getContent(deps,req,identity2){let artifactId2=req.artifactId;if(artifactId2==="")throw invalidArgumentError("artifact_id is required");let artifact=await loadArtifactOrNotFound(deps,artifactId2);await authorizeDirect(ArtifactQueryController.method.getContent,deps.authorizer,identity2,req);let contentHash=requireLiveBlob(artifact,artifactId2),maxBytes=req.maxBytes;maxBytes<=0n&&(maxBytes=DEFAULT_MAX_CONTENT_BYTES);let data;try{data=await deps.artifactStorage.download(contentHash)}catch(error2){throw deps.logger.error("failed to download artifact content",{artifactId:artifactId2,contentHash,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to read artifact content")}let totalSize=BigInt(data.length),truncated=!1;return totalSize>maxBytes&&(data=data.subarray(0,Number(maxBytes)),truncated=!0),deps.logger.info("read artifact content",{artifactId:artifactId2,totalSizeBytes:data.length,truncated}),create2(GetArtifactContentResponseSchema2,{content:data,contentType:artifact.spec?.contentType??"",totalSizeBytes:totalSize,truncated})}async function loadArtifactOrNotFound(deps,artifactId2){try{return await deps.store.getResource(ApiResourceKind.artifact,artifactId2,ArtifactSchema)}catch{throw new ConnectError(artifactNotFoundMessage(artifactId2),Code.NotFound)}}function requireLiveBlob(artifact,artifactId2){if(artifact.status?.storageState===ArtifactStorageState.storage_state_deleted)throw new ConnectError(artifactBlobDeletedMessage(artifactId2),Code.FailedPrecondition);let contentHash=artifact.status?.contentHash??"";if(contentHash==="")throw internalError(new Error(`artifact has no content hash: ${artifactId2}`),`artifact has no content hash: ${artifactId2}`);return contentHash}var encoder4=new TextEncoder,decoder2=new TextDecoder,strictDecoder=new TextDecoder("utf-8",{fatal:!0}),MAX_INT32=2**32;function concat(...buffers){let size=buffers.reduce((acc,{length})=>acc+length,0),buf2=new Uint8Array(size),i6=0;for(let buffer of buffers)buf2.set(buffer,i6),i6+=buffer.length;return buf2}function encode(string){let bytes=new Uint8Array(string.length);for(let i6=0;i6<string.length;i6++){let code=string.charCodeAt(i6);if(code>127)throw new TypeError("non-ASCII string encountered in encode()");bytes[i6]=code}return bytes}var unusable=(name,prop="algorithm.name")=>new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);function checkUsage(key,usage){if(usage&&!key.usages.includes(usage))throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`)}function checkModulusLength(alg,key){let{modulusLength}=key.algorithm;if(typeof modulusLength!="number"||modulusLength<2048)throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`)}function checkCryptoKey(key,expected,usage){let algorithm=key.algorithm;if(algorithm.name!==expected.name)throw unusable(expected.name);if(expected.hash&&algorithm.hash?.name!==expected.hash)throw unusable(expected.hash,"algorithm.hash");if(expected.namedCurve&&algorithm.namedCurve!==expected.namedCurve)throw unusable(expected.namedCurve,"algorithm.namedCurve");if(expected.length!==void 0&&algorithm.length!==expected.length)throw unusable(expected.length,"algorithm.length");checkUsage(key,usage)}function message5(msg,actual,...types3){if(types3.length>2){let last=types3.pop();msg+=`one of type ${types3.join(", ")}, or ${last}.`}else types3.length===2?msg+=`one of type ${types3[0]} or ${types3[1]}.`:msg+=`of type ${types3[0]}.`;return actual==null?msg+=` Received ${actual}`:typeof actual=="function"&&actual.name?msg+=` Received function ${actual.name}`:typeof actual=="object"&&actual!=null&&actual.constructor?.name&&(msg+=` Received an instance of ${actual.constructor.name}`),msg}var withAlg=(alg,actual,...types3)=>message5(`Key for the ${alg} algorithm must be `,actual,...types3);var errors_exports={};__export(errors_exports,{JOSEAlgNotAllowed:()=>JOSEAlgNotAllowed,JOSEError:()=>JOSEError,JOSENotSupported:()=>JOSENotSupported,JWEDecryptionFailed:()=>JWEDecryptionFailed,JWEInvalid:()=>JWEInvalid,JWKInvalid:()=>JWKInvalid,JWKSInvalid:()=>JWKSInvalid,JWKSMultipleMatchingKeys:()=>JWKSMultipleMatchingKeys,JWKSNoMatchingKey:()=>JWKSNoMatchingKey,JWKSTimeout:()=>JWKSTimeout,JWSInvalid:()=>JWSInvalid,JWSSignatureVerificationFailed:()=>JWSSignatureVerificationFailed,JWTClaimValidationFailed:()=>JWTClaimValidationFailed,JWTExpired:()=>JWTExpired,JWTInvalid:()=>JWTInvalid});var JOSEError=class extends Error{static code="ERR_JOSE_GENERIC";code="ERR_JOSE_GENERIC";constructor(message6,options){super(message6,options),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},JWTClaimValidationFailed=class extends JOSEError{static code="ERR_JWT_CLAIM_VALIDATION_FAILED";code="ERR_JWT_CLAIM_VALIDATION_FAILED";claim;reason;payload;constructor(message6,payload,claim="unspecified",reason="unspecified"){super(message6,{cause:{claim,reason,payload}}),this.claim=claim,this.reason=reason,this.payload=payload}},JWTExpired=class extends JOSEError{static code="ERR_JWT_EXPIRED";code="ERR_JWT_EXPIRED";claim;reason;payload;constructor(message6,payload,claim="unspecified",reason="unspecified"){super(message6,{cause:{claim,reason,payload}}),this.claim=claim,this.reason=reason,this.payload=payload}},JOSEAlgNotAllowed=class extends JOSEError{static code="ERR_JOSE_ALG_NOT_ALLOWED";code="ERR_JOSE_ALG_NOT_ALLOWED"},JOSENotSupported=class extends JOSEError{static code="ERR_JOSE_NOT_SUPPORTED";code="ERR_JOSE_NOT_SUPPORTED"},JWEDecryptionFailed=class extends JOSEError{static code="ERR_JWE_DECRYPTION_FAILED";code="ERR_JWE_DECRYPTION_FAILED";constructor(message6="decryption operation failed",options){super(message6,options)}},JWEInvalid=class extends JOSEError{static code="ERR_JWE_INVALID";code="ERR_JWE_INVALID"},JWSInvalid=class extends JOSEError{static code="ERR_JWS_INVALID";code="ERR_JWS_INVALID"},JWTInvalid=class extends JOSEError{static code="ERR_JWT_INVALID";code="ERR_JWT_INVALID"},JWKInvalid=class extends JOSEError{static code="ERR_JWK_INVALID";code="ERR_JWK_INVALID"},JWKSInvalid=class extends JOSEError{static code="ERR_JWKS_INVALID";code="ERR_JWKS_INVALID"},JWKSNoMatchingKey=class extends JOSEError{static code="ERR_JWKS_NO_MATCHING_KEY";code="ERR_JWKS_NO_MATCHING_KEY";constructor(message6="no applicable key found in the JSON Web Key Set",options){super(message6,options)}},JWKSMultipleMatchingKeys=class extends JOSEError{[Symbol.asyncIterator]=async function*(){};static code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";constructor(message6="multiple matching keys found in the JSON Web Key Set",options){super(message6,options)}},JWKSTimeout=class extends JOSEError{static code="ERR_JWKS_TIMEOUT";code="ERR_JWKS_TIMEOUT";constructor(message6="request timed out",options){super(message6,options)}},JWSSignatureVerificationFailed=class extends JOSEError{static code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";constructor(message6="signature verification failed",options){super(message6,options)}};var isCryptoKey=key=>{if(key?.[Symbol.toStringTag]==="CryptoKey")return!0;try{return key instanceof CryptoKey}catch{return!1}},isKeyObject=key=>key?.[Symbol.toStringTag]==="KeyObject",isKeyLike=key=>isCryptoKey(key)||isKeyObject(key);function decodeBase64(encoded){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(encoded);let binary2=atob(encoded),bytes=new Uint8Array(binary2.length);for(let i6=0;i6<binary2.length;i6++)bytes[i6]=binary2.charCodeAt(i6);return bytes}var invalid="The input to be decoded is not correctly encoded.";function decode(input){if(Uint8Array.fromBase64)try{return Uint8Array.fromBase64(typeof input=="string"?input:decoder2.decode(input),{alphabet:"base64url"})}catch(cause){throw new TypeError(invalid,{cause})}let encoded=input;if(encoded instanceof Uint8Array&&(encoded=decoder2.decode(encoded)),encoded.includes("+")||encoded.includes("/"))throw new TypeError(invalid);encoded=encoded.replace(/-/g,"+").replace(/_/g,"/");try{return decodeBase64(encoded)}catch{throw new TypeError(invalid)}}function isObject3(input){if(typeof input!="object"||input===null||Object.prototype.toString.call(input)!=="[object Object]")return!1;let prototype=Object.getPrototypeOf(input);return prototype===null||Object.getPrototypeOf(prototype)===null}function isJwkSet(input){return isObject3(input)&&Array.isArray(input.keys)&&Array.from(input.keys).every(isObject3)}function decodeBase64url(value,label2,ErrorClass){try{return decode(value)}catch{throw new ErrorClass(`Failed to base64url decode the ${label2}`)}}function encodeBase64url(value,label2,ErrorClass){try{return encode(value)}catch{throw new ErrorClass(`The ${label2} is not a valid base64url string`)}}function parseJoseHeader(b64,ErrorClass,message6){let parsed;try{parsed=JSON.parse(strictDecoder.decode(decode(b64)))}catch{throw new ErrorClass(message6)}if(!isObject3(parsed))throw new ErrorClass(message6);return parsed}async function jwkToKey(entry,jwk){if(jwk.kty==="RSA"&&"oth"in jwk&&jwk.oth!==void 0)throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');if(!entry.kty.includes(jwk.kty))throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');let algorithm=entry.resolve?.({kty:jwk.kty,crv:jwk.crv})??entry.subtle,isPrivate=!!(jwk.d||jwk.priv),keyData={...jwk};return keyData.kty!=="AKP"&&delete keyData.alg,delete keyData.use,crypto.subtle.importKey("jwk",keyData,algorithm,jwk.ext??!isPrivate,jwk.key_ops??entry.usages[isPrivate?1:0])}function snapshotJwk(jwk){return{__proto__:null,...jwk}}function normalizeJwk(jwk){let normalized=snapshotJwk(jwk);if(normalized.ext!==void 0&&typeof normalized.ext!="boolean")throw new TypeError('"ext" (Extractable) Parameter must be a boolean');if(normalized.key_ops!==void 0){let value=normalized.key_ops,keyOps=Array.isArray(value)?[...value]:void 0;if(!keyOps||keyOps.some(operation2=>typeof operation2!="string")||new Set(keyOps).size!==keyOps.length)throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');normalized.key_ops=keyOps}return normalized}var tag=key=>key[Symbol.toStringTag],jwkMatchesOp=(entry,key,usage)=>{let{alg}=entry;if(key.use!==void 0){let expected=usage==="sign"||usage==="verify"?"sig":"enc";if(key.use!==expected)throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`)}if(key.alg!==void 0&&key.alg!==alg)throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);if(Array.isArray(key.key_ops)){let expectedKeyOp=usage==="encrypt"||usage==="decrypt"?entry.ops?.[usage==="encrypt"?0:1]:usage;if(expectedKeyOp&&!key.key_ops.includes(expectedKeyOp))throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`)}};function checkKeyType2(entry,key,usage){let{alg,secret}=entry,privateKey=usage==="decrypt"||usage==="sign";if(secret&&key instanceof Uint8Array)return[BYTES4,key];if(isObject3(key)){let normalized=normalizeJwk(key);if(typeof normalized.kty!="string")throw new TypeError(secret?withAlg(alg,key,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"):withAlg(alg,key,"CryptoKey","KeyObject","JSON Web Key"));if(!(secret?normalized.kty==="oct"&&typeof normalized.k=="string":normalized.kty!=="oct"&&(privateKey?normalized.kty==="AKP"&&typeof normalized.priv=="string"||typeof normalized.d=="string":normalized.d===void 0&&normalized.priv===void 0)))throw new TypeError(secret?'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present':`JSON Web Key for this operation must be a ${privateKey?"private":"public"} JWK`);return jwkMatchesOp(entry,normalized,usage),[JWK,key,normalized]}if(!isKeyLike(key))throw new TypeError(secret?withAlg(alg,key,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"):withAlg(alg,key,"CryptoKey","KeyObject","JSON Web Key"));if(secret){if(key.type!=="secret")throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`)}else{if(key.type==="secret")throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);let expectedType=privateKey?"private":"public";if((key.type==="public"||key.type==="private")&&key.type!==expectedType){let operation2=usage==="sign"?"signing":usage==="verify"?"verifying":`${usage.slice(0,-1)}tion`;throw new TypeError(`${tag(key)} instances for asymmetric algorithm ${operation2} must be of type "${expectedType}"`)}}return isCryptoKey(key)?[CRYPTO,key]:[KEYOBJECT,key]}var BYTES4=0,CRYPTO=1,KEYOBJECT=2,JWK=3,cache6,nist={__proto__:null,prime256v1:"P-256",secp384r1:"P-384",secp521r1:"P-521"};function cached(key,alg,value){cache6||=new WeakMap;let entry=cache6.get(key);return value&&(entry?entry[alg]=value:cache6.set(key,{[alg]:value})),value??entry?.[alg]}var handleJWK=async(key,jwk,entry)=>cached(key,entry.alg)??cached(key,entry.alg,await jwkToKey(entry,{...jwk,alg:entry.alg})),handleKeyObject=(keyObject,entry)=>{let hit=cached(keyObject,entry.alg);if(hit)return hit;let isPublic=keyObject.type==="public",usages=entry.usages[isPublic?0:1],{asymmetricKeyType}=keyObject,crv=nist[keyObject.asymmetricKeyDetails?.namedCurve],params=entry.resolve?.({crv,asymmetricKeyType})??entry.subtle;return cached(keyObject,entry.alg,keyObject.toCryptoKey(params,isPublic,usages))};async function prepareKey(entry,key,usage){let tagged=checkKeyType2(entry,key,usage);switch(tagged[0]){case BYTES4:case CRYPTO:return tagged[1];case JWK:{let key2=tagged[1],normalized=tagged[2];if(normalized.kty==="oct")return decode(normalized.k);if(!Object.isFrozen(key2)){let{key_ops}=key2;Array.isArray(key_ops)&&Object.freeze(key_ops),Object.freeze(key2)}return handleJWK(key2,normalized,entry)}case KEYOBJECT:{let keyObject=tagged[1];return keyObject.type==="secret"?keyObject.export():"toCryptoKey"in keyObject&&typeof keyObject.toCryptoKey=="function"?handleKeyObject(keyObject,entry):handleJWK(keyObject,keyObject.export({format:"jwk"}),entry)}}}function table(entries){let out={__proto__:null};for(let alg in entries)out[alg]={...entries[alg],alg};return out}var JWS_RECOGNIZED={__proto__:null,b64:!0};function validateAlgorithms(option,algorithms){if(algorithms!==void 0&&(!Array.isArray(algorithms)||algorithms.some(s2=>typeof s2!="string")))throw new TypeError(`"${option}" option must be an array of strings`);if(algorithms)return new Set(algorithms)}function validateCrit(Err,recognizedDefault,recognizedOption,protectedHeader,joseHeader){if(joseHeader.crit!==void 0&&protectedHeader?.crit===void 0)throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');if(!protectedHeader||protectedHeader.crit===void 0)return[];if(!Array.isArray(protectedHeader.crit)||protectedHeader.crit.length===0||protectedHeader.crit.some(input=>typeof input!="string"||input.length===0))throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let recognized=recognizedOption===void 0?recognizedDefault:{__proto__:null,...recognizedOption,...recognizedDefault};for(let parameter of protectedHeader.crit){if(!(parameter in recognized))throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);if(!Object.hasOwn(joseHeader,parameter)||joseHeader[parameter]===void 0)throw new Err(`Extension Header Parameter "${parameter}" is missing`);if(recognized[parameter]&&(!Object.hasOwn(protectedHeader,parameter)||protectedHeader[parameter]===void 0))throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`)}return protectedHeader.crit}function validateB64(protectedHeader,extensions){if(extensions.includes("b64")){let b64=protectedHeader.b64;if(typeof b64!="boolean")throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');return b64}return!0}async function getSigKey(entry,key,usage){return key instanceof Uint8Array?crypto.subtle.importKey("raw",key,entry.subtle,!1,[usage]):(checkCryptoKey(key,entry.subtle,usage),entry.minRsaBits&&checkModulusLength(entry.alg,key),key)}async function verify(entry,key,signature,data){let cryptoKey=await getSigKey(entry,key,"verify");try{return await crypto.subtle.verify(entry.signing,cryptoKey,signature,data)}catch{return!1}}var sig=[["verify"],["sign"]];function hmac(bits2){let subtle3={name:"HMAC",hash:`SHA-${bits2}`};return{kty:["oct"],secret:!0,subtle:subtle3,signing:subtle3,usages:sig}}function rsa(bits2,saltLength){let subtle3={name:saltLength?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:`SHA-${bits2}`};return{kty:["RSA"],subtle:subtle3,signing:saltLength?{...subtle3,saltLength}:subtle3,usages:sig,minRsaBits:2048}}function ecdsa(crv,bits2){return{kty:["EC"],crv,subtle:{name:"ECDSA",namedCurve:crv},signing:{name:"ECDSA",hash:`SHA-${bits2}`},usages:sig}}function eddsa(){let subtle3={name:"Ed25519"};return{kty:["OKP"],crv:"Ed25519",subtle:subtle3,signing:subtle3,usages:sig}}function mldsa(bits2){let subtle3={name:`ML-DSA-${bits2}`};return{kty:["AKP"],subtle:subtle3,signing:subtle3,usages:sig}}var JWS=table({HS256:hmac(256),HS384:hmac(384),HS512:hmac(512),RS256:rsa(256),RS384:rsa(384),RS512:rsa(512),PS256:rsa(256,32),PS384:rsa(384,48),PS512:rsa(512,64),ES256:ecdsa("P-256",256),ES384:ecdsa("P-384",384),ES512:ecdsa("P-521",512),EdDSA:eddsa(),Ed25519:eddsa(),"ML-DSA-44":mldsa(44),"ML-DSA-65":mldsa(65),"ML-DSA-87":mldsa(87)});function jwsAlgorithm(alg){let entry=typeof alg=="string"?JWS[alg]:void 0;if(!entry)throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);return entry}function prepareVerify(options){return[options&&validateAlgorithms("algorithms",options.algorithms),options?.crit]}function parseProtectedHeader(encodedProtected,parsedProtected=encodedProtected===void 0?{}:parseJoseHeader(encodedProtected,JWSInvalid,"JWS Protected Header is invalid")){return parsedProtected}function validateJwsHeaders(parsedProt,joseHeader,shared){let b64=validateB64(parsedProt,validateCrit(JWSInvalid,JWS_RECOGNIZED,shared[1],parsedProt,joseHeader)),alg=joseHeader.alg;if(typeof alg!="string"||!alg)throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');if(shared[0]&&!shared[0].has(alg))throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');return[b64,alg]}function encodeCompactUnencodedPayload(payload){try{return encode(payload)}catch{throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters")}}async function verifyPrepared(jws,shared,key,encodedProtected,parsedProt,alg,signingPayload){let resolvedKey=!1;typeof key=="function"&&(key=await key(parsedProt,jws),resolvedKey=!0);let b64=typeof signingPayload=="string",entry=jwsAlgorithm(alg),data=concat(encodedProtected!==void 0?encode(encodedProtected):new Uint8Array,encode("."),b64?shared[2]??=encodeBase64url(signingPayload,"payload",JWSInvalid):signingPayload),signature=decodeBase64url(jws.signature,"signature",JWSInvalid),k5=await prepareKey(entry,key,"verify");if(!await verify(entry,k5,signature,data))throw new JWSSignatureVerificationFailed;return[b64?decodeBase64url(signingPayload,"payload",JWSInvalid):signingPayload,parsedProt,b64,k5,resolvedKey]}async function verifyCompact(jws,shared,key){if(jws instanceof Uint8Array&&(jws=decoder2.decode(jws)),typeof jws!="string")throw new JWSInvalid("Compact JWS must be a string or Uint8Array");let{0:protectedHeader,1:payload,2:signature,length}=jws.split(".");if(length!==3)throw new JWSInvalid("Invalid Compact JWS");let compactJws={payload,protected:protectedHeader,signature},parsedProt=parseProtectedHeader(protectedHeader),[b64,alg]=validateJwsHeaders(parsedProt,parsedProt,shared),signingPayload=b64?payload:encodeCompactUnencodedPayload(payload);return verifyPrepared(compactJws,shared,key,protectedHeader,parsedProt,alg,signingPayload)}var epoch=date2=>Math.floor(date2.getTime()/1e3),multipliers={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},REGEX=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,checkFailed="check_failed";function invalidDuration(){throw new TypeError("Invalid time period format")}function secs(str2){typeof str2!="string"&&invalidDuration();let matched=REGEX.exec(str2);(!matched||matched[4]&&matched[1])&&invalidDuration();let value=parseFloat(matched[2]),numericDate=Math.round(value*multipliers[matched[3][0].toLowerCase()]);return Number.isFinite(numericDate)||invalidDuration(),matched[1]==="-"||matched[4]==="ago"?-numericDate:numericDate}function validateInput(label2,input){if(!Number.isFinite(input))throw new TypeError(`Invalid ${label2} input`);return input}var normalizeTyp=value=>{let normalized=value.toLowerCase();return value.includes("/")?normalized:`application/${normalized}`},checkAudiencePresence=(audPayload,audOption)=>typeof audPayload=="string"?audOption.includes(audPayload):Array.isArray(audPayload)?audOption.some(aud=>audPayload.includes(aud)):!1;function validateNumericDate(payload,claim,required=!1){let value=payload[claim];if(!(value===void 0&&!required)){if(typeof value!="number")throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`,payload,claim,"invalid");return value}}function unexpectedClaim(payload,claim){throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`,payload,claim,checkFailed)}function validateClaimsSet(protectedHeader,encodedPayload,options={}){let payload;try{payload=JSON.parse(strictDecoder.decode(encodedPayload))}catch{}if(!isObject3(payload))throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");let{typ}=options;if(typ!==void 0&&(typeof protectedHeader.typ!="string"||normalizeTyp(protectedHeader.typ)!==normalizeTyp(typ)))throw new JWTClaimValidationFailed('unexpected "typ" JWT header value',payload,"typ",checkFailed);let{requiredClaims=[],issuer,subject,audience,maxTokenAge}=options,presenceCheck=[...requiredClaims];maxTokenAge!==void 0&&presenceCheck.push("iat"),audience!==void 0&&presenceCheck.push("aud"),subject!==void 0&&presenceCheck.push("sub"),issuer!==void 0&&presenceCheck.push("iss");for(let claim of new Set(presenceCheck.reverse()))if(!Object.hasOwn(payload,claim))throw new JWTClaimValidationFailed(`missing required "${claim}" claim`,payload,claim,"missing");issuer!==void 0&&!(Array.isArray(issuer)?issuer:[issuer]).includes(payload.iss)&&unexpectedClaim(payload,"iss"),subject!==void 0&&payload.sub!==subject&&unexpectedClaim(payload,"sub"),audience!==void 0&&!checkAudiencePresence(payload.aud,typeof audience=="string"?[audience]:audience)&&unexpectedClaim(payload,"aud");let{clockTolerance:clockTolerance2}=options,tolerance=0;if(typeof clockTolerance2=="string")tolerance=secs(clockTolerance2);else if(clockTolerance2!==void 0){if(typeof clockTolerance2!="number")throw new TypeError("Invalid clockTolerance option type");tolerance=clockTolerance2}validateInput("clockTolerance option",tolerance);let{currentDate}=options,now=validateInput("currentDate option",epoch(currentDate===void 0?new Date:currentDate)),iat=validateNumericDate(payload,"iat",maxTokenAge!==void 0),nbf=validateNumericDate(payload,"nbf");if(nbf!==void 0&&nbf>now+tolerance)throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed',payload,"nbf",checkFailed);let exp=validateNumericDate(payload,"exp");if(exp!==void 0&&exp<=now-tolerance)throw new JWTExpired('"exp" claim timestamp check failed',payload,"exp",checkFailed);if(maxTokenAge!==void 0){let age=now-iat,max2=validateInput("maxTokenAge option",typeof maxTokenAge=="number"?maxTokenAge:secs(maxTokenAge));if(age-tolerance>max2)throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)',payload,"iat",checkFailed);if(age<-tolerance)throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)',payload,"iat",checkFailed)}return payload}async function jwtVerify(jwt,key,options){let verified=await verifyCompact(jwt,prepareVerify(options),key);if(!verified[2])throw new JWTInvalid("JWTs MUST NOT use unencoded payload");let result={payload:validateClaimsSet(verified[1],verified[0],options),protectedHeader:verified[1]};return typeof key=="function"?{...result,key:verified[3]}:result}function isUsableJWK(jwk,entry,alg,kid){let{kty,key_ops,ext,kid:jwkKid,alg:jwkAlg,use,crv}=snapshotJwk(jwk),keyOps=Array.isArray(key_ops)?[...key_ops]:key_ops;return(ext===void 0||typeof ext=="boolean")&&(keyOps===void 0||Array.isArray(keyOps)&&keyOps.every((operation2,index2)=>typeof operation2=="string"&&keyOps.indexOf(operation2)===index2)&&keyOps.includes("verify"))&&entry.kty.includes(kty)&&(kid===void 0||typeof kid=="string"&&kid===jwkKid)&&(jwkAlg===void 0?kty!=="AKP":alg===jwkAlg)&&(use===void 0||use==="sig")&&(!entry.crv||crv===entry.crv)}async function importWithAlgCache(cache7,jwk,entry){let cached2=cache7.get(jwk)||cache7.set(jwk,{}).get(jwk),{alg}=entry;if(cached2[alg]===void 0){let key=await jwkToKey(entry,{...jwk,alg,ext:!0});if(key.type!=="public")throw new JWKSInvalid("JSON Web Key Set members must be public keys");cached2[alg]=key}return cached2[alg]}function createLocalJWKSet(jwks){let snapshot;try{snapshot=structuredClone(jwks)}catch{}if(!isJwkSet(snapshot))throw new JWKSInvalid("JSON Web Key Set malformed");let cached2=new WeakMap;return Object.defineProperty(async(protectedHeader,token)=>{let{alg,kid}={...protectedHeader,...token?.header},entry=typeof alg=="string"?JWS[alg]:void 0;if(!entry||entry.secret)throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');let candidates=snapshot.keys.filter(jwk2=>isUsableJWK(jwk2,entry,alg,kid)),{0:jwk,length}=candidates;if(!length)throw new JWKSNoMatchingKey;if(length!==1){let error2=new JWKSMultipleMatchingKeys;throw error2[Symbol.asyncIterator]=async function*(){for(let jwk2 of candidates)try{yield await importWithAlgCache(cached2,jwk2,entry)}catch{}},error2}return importWithAlgCache(cached2,jwk,entry)},"jwks",{value:()=>structuredClone(snapshot)})}function isCloudflareWorkers(){return typeof WebSocketPair<"u"||typeof navigator<"u"&&navigator.userAgent==="Cloudflare-Workers"||typeof EdgeRuntime<"u"&&EdgeRuntime==="vercel"}var USER_AGENT2;(typeof navigator>"u"||!navigator.userAgent?.startsWith?.("Mozilla/5.0 "))&&(USER_AGENT2="jose/v6.2.10");var customFetch=Symbol();async function fetchJwks(url,headers2,signal3,fetchImpl=fetch){let response=await fetchImpl(url,{method:"GET",signal:signal3,redirect:"manual",headers:headers2}).catch(err2=>{throw err2.name==="TimeoutError"?new JWKSTimeout:err2});if(response.status!==200)throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await response.json()}catch{throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON")}}var jwksCache=Symbol();function isFreshFor(timestamp2,duration){return Number.isFinite(timestamp2)&&Date.now()<timestamp2+duration}function validateDuration(value,fallback3,option){if(Number.isNaN(value))throw new TypeError(`"${option}" option must not be NaN`);return typeof value=="number"?value:fallback3}function createRemoteJWKSet(url,options){if(!(url instanceof URL))throw new TypeError("url must be an instance of URL");let href=new URL(url.href).href,opts=options??{},timeoutOption=opts.timeoutDuration;if(typeof timeoutOption=="number"&&(!Number.isInteger(timeoutOption)||timeoutOption<0))throw new TypeError('"timeoutDuration" option must be a non-negative integer');let timeoutDuration=typeof timeoutOption=="number"?timeoutOption:5e3,cooldownDuration=validateDuration(opts.cooldownDuration,3e4,"cooldownDuration"),cacheMaxAge=validateDuration(opts.cacheMaxAge,6e5,"cacheMaxAge"),headers2=new Headers(opts.headers);USER_AGENT2&&!headers2.has("User-Agent")&&headers2.set("User-Agent",USER_AGENT2),headers2.has("accept")||headers2.set("accept","application/json, application/jwk-set+json");let fetchImpl=opts[customFetch],cache7=opts[jwksCache],jwksTimestamp,pendingFetch,reloadSequence=0,appliedSequence=0,local;if(cache7&&typeof cache7=="object"){let{uat,jwks}=cache7;isFreshFor(uat,cacheMaxAge)&&isJwkSet(jwks)&&(jwksTimestamp=uat,local=createLocalJWKSet(jwks))}let reload=async()=>{if(pendingFetch&&isCloudflareWorkers()&&(pendingFetch=void 0),!pendingFetch){let sequence=++reloadSequence,current=pendingFetch=fetchJwks(href,headers2,AbortSignal.timeout(timeoutDuration),fetchImpl).then(json2=>{let next=createLocalJWKSet(json2);if(sequence<=appliedSequence)return;local=next;let updatedAt=Date.now();cache7&&(cache7.uat=updatedAt,cache7.jwks=json2),jwksTimestamp=updatedAt,appliedSequence=sequence}).finally(()=>{pendingFetch===current&&(pendingFetch=void 0)})}await pendingFetch};return Object.defineProperties(async(protectedHeader,token)=>{(!local||!isFreshFor(jwksTimestamp,cacheMaxAge))&&await reload();try{return await local(protectedHeader,token)}catch(err2){if(err2 instanceof JWKSNoMatchingKey&&!isFreshFor(jwksTimestamp,cooldownDuration))return await reload(),local(protectedHeader,token);throw err2}},{coolingDown:{get:()=>isFreshFor(jwksTimestamp,cooldownDuration),enumerable:!0},fresh:{get:()=>isFreshFor(jwksTimestamp,cacheMaxAge),enumerable:!0},reload:{value:reload,enumerable:!0},reloading:{get:()=>!!pendingFetch,enumerable:!0},jwks:{value:()=>local?.jwks(),enumerable:!0}})}var TOKEN_EXPIRED_MESSAGE2="token has expired",TOKEN_AUDIENCE_MESSAGE="token audience does not match the expected audience",TOKEN_SIGNATURE_MESSAGE="token signature verification failed",INVALID_TOKEN_MESSAGE2="invalid token";function newOidcIdentityVerifier(config2){let jwks;async function jwksFor(){if(jwks!==void 0)return jwks;let{jwksUri}=await config2.discovery.discover(config2.issuer);return jwks=createRemoteJWKSet(new URL(jwksUri)),jwks}return{name:"oidc",async verify(token){if(!isJwtShaped(token))return null;let keys=await jwksFor(),payload;try{({payload}=await jwtVerify(token,keys,{issuer:config2.issuer,audience:config2.audience}))}catch(error2){throw classifyJoseError(error2)}if(typeof payload.sub!="string"||payload.sub==="")throw new ConnectError(INVALID_TOKEN_MESSAGE2,Code.Unauthenticated);return{identityId:await identityIdForSubject(config2.accounts,payload.sub),callerClass:"user",issuer:config2.issuer,rawToken:token,...typeof payload.email=="string"&&payload.email!==""?{email:payload.email}:{},...typeof payload.name=="string"&&payload.name!==""?{displayName:payload.name}:{}}}}}function isJwtShaped(token){let segments=token.split(".");return segments.length===3&&segments.every(s2=>s2!=="")}function classifyJoseError(error2){return error2 instanceof errors_exports.JWTExpired?new ConnectError(TOKEN_EXPIRED_MESSAGE2,Code.Unauthenticated):error2 instanceof errors_exports.JWTClaimValidationFailed?error2.claim==="aud"?new ConnectError(TOKEN_AUDIENCE_MESSAGE,Code.Unauthenticated):new ConnectError(INVALID_TOKEN_MESSAGE2,Code.Unauthenticated):error2 instanceof errors_exports.JWSSignatureVerificationFailed||error2 instanceof errors_exports.JWKSNoMatchingKey||error2 instanceof errors_exports.JWKSMultipleMatchingKeys||error2 instanceof errors_exports.JWKSInvalid?new ConnectError(TOKEN_SIGNATURE_MESSAGE,Code.Unauthenticated):error2 instanceof errors_exports.JWTInvalid||error2 instanceof errors_exports.JWSInvalid||error2 instanceof errors_exports.JOSENotSupported?new ConnectError(INVALID_TOKEN_MESSAGE2,Code.Unauthenticated):error2}var import_node_fs7=require("node:fs"),import_promises5=require("node:fs/promises"),import_node_http=__toESM(require("node:http"),1),import_node_path10=__toESM(require("node:path"),1);function createArtifactFileServer(options){let{basePath,logger:logger2}=options,server=import_node_http.default.createServer((req,res)=>{serveArtifact(basePath,req,res,logger2)});return{listen(port,host){return new Promise((resolve,reject2)=>{server.once("error",reject2),server.listen(port,host,()=>{server.removeListener("error",reject2);let address=server.address(),boundPort=address!==null&&typeof address=="object"?address.port:port;logger2.info("artifact HTTP file server listening",{port:boundPort,dir:basePath}),resolve(boundPort)})})},shutdown(){return new Promise(resolve=>{server.close(()=>resolve()),server.closeAllConnections()})}}}async function serveArtifact(basePath,req,res,logger2){try{if(req.method!=="GET"&&req.method!=="HEAD"){res.writeHead(405,{Allow:"GET, HEAD"}),res.end();return}let url=new URL(req.url??"/","http://localhost"),key;try{key=decodeURIComponent(url.pathname.replace(/^\/+/,""))}catch{res.writeHead(404),res.end(`404 page not found
+(Scheduled fire time: ${formatted} (${zoneName}))`}function fireContextLine(requestedZone,nominal){let zone=requestedZone,parts;try{parts=fireContextFormatter(zone===""?"UTC":zone).formatToParts(nominal),zone===""&&(zone="UTC")}catch{zone="UTC",parts=fireContextFormatter("UTC").formatToParts(nominal)}let get26=type2=>parts.find(part=>part.type===type2)?.value??"",formatted=`${get26("weekday")}, ${get26("year")}-${get26("month")}-${get26("day")} ${get26("hour")}:${get26("minute")}`;return{zoneName:zone,formatted}}function fireContextFormatter(timeZone){return new Intl.DateTimeFormat("en-US",{timeZone,weekday:"long",year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",hourCycle:"h23"})}function utcParts(date2){let pad=(value,width)=>String(value).padStart(width,"0");return{year:pad(date2.getUTCFullYear(),4),month:pad(date2.getUTCMonth()+1,2),day:pad(date2.getUTCDate(),2),hour:pad(date2.getUTCHours(),2),minute:pad(date2.getUTCMinutes(),2),second:pad(date2.getUTCSeconds(),2)}}function invocationOf(schedule){return schedule.spec?.target.case==="agent"?schedule.spec.target.value:void 0}var RunStarter=class{deps;constructor(deps){this.deps=deps}async startRun(schedule,nominalFireTime){let{store,logger:logger2}=this.deps,scheduleId=schedule.metadata?.id??"",org=schedule.metadata?.org??"",resolved=await this.resolveTargetAgent(schedule);if(resolved.agent===void 0)return logger2.warn("Schedule fire has no target agent",{schedule_id:scheduleId,reason:resolved.missingReason}),{kind:"targetMissing",reason:resolved.missingReason};let pinningRefusal=scheduleModelPinningRefusal(schedule.spec);if(pinningRefusal!=="")return logger2.error("Schedule fire refused by the model-pinning backstop",{schedule_id:scheduleId,reason:pinningRefusal}),{kind:"refused",reason:pinningRefusal};let executionName=scheduledExecutionName(scheduleId,nominalFireTime),existing;try{existing=await findResourceBySlug(store,ApiResourceKind.agent_execution,AgentExecutionSchema,executionName,org)}catch(error2){throw new Error(`look up execution ${executionName}: ${error2 instanceof Error?error2.message:String(error2)}`,{cause:error2})}if(existing!==void 0){let executionId2=existing.metadata?.id??"";return logger2.info("Schedule fire already has its execution (idempotent retry)",{schedule_id:scheduleId,execution_id:executionId2}),await this.stampLastExecutionId(scheduleId,executionId2),{kind:"started",executionId:executionId2,alreadyExisted:!0}}let fireCaller;if(this.deps.fireCallerMint!==void 0)try{fireCaller=await this.deps.fireCallerMint.mintFireCaller(org,scheduleId)}catch(error2){if(error2 instanceof ScheduleFireCallerRefusedError)return logger2.error("Schedule fire refused by the fire-caller mint",{schedule_id:scheduleId,org,reason:error2.message}),{kind:"refused",reason:error2.message};throw new Error(`mint schedule fire caller for ${scheduleId}: ${error2 instanceof Error?error2.message:String(error2)}`,{cause:error2})}let created;try{created=await this.deps.executions.create(this.buildExecutionRequest(schedule,resolved.agent,executionName,nominalFireTime),fireCaller)}catch(error2){if(!(error2 instanceof ConnectError))throw error2;switch(error2.code){case Code.AlreadyExists:{let winner;try{winner=await findResourceBySlug(store,ApiResourceKind.agent_execution,AgentExecutionSchema,executionName,org)}catch(findError){throw new Error(`duplicate-check refusal but no execution row for ${executionName}: ${findError instanceof Error?findError.message:String(findError)}`,{cause:findError})}if(winner===void 0)throw new Error(`duplicate-check refusal but no execution row for ${executionName}: ${error2.message}`,{cause:error2});let executionId2=winner.metadata?.id??"";return await this.stampLastExecutionId(scheduleId,executionId2),{kind:"started",executionId:executionId2,alreadyExisted:!0}}case Code.FailedPrecondition:case Code.PermissionDenied:case Code.NotFound:case Code.InvalidArgument:case Code.ResourceExhausted:return logger2.error("Schedule fire refused by a launch gate",{schedule_id:scheduleId,org,code:Code[error2.code],reason:error2.rawMessage}),{kind:"refused",reason:error2.rawMessage};default:throw error2}}let executionId=created.metadata?.id??"";return await this.stampLastExecutionId(scheduleId,executionId),{kind:"started",executionId,alreadyExisted:!1}}async resolveTargetAgent(schedule){let ref=invocationOf(schedule)?.agentRef,slug=ref?.slug??"";if(slug==="")return{missingReason:"schedule has no agent target"};let org=ref?.org??"";org===""&&(org=schedule.metadata?.org??"");let agent;try{agent=await findResourceBySlug(this.deps.store,ApiResourceKind.agent,AgentSchema,slug,org)}catch(error2){throw new Error(`resolve target agent ${org}/${slug}: ${error2 instanceof Error?error2.message:String(error2)}`,{cause:error2})}return agent===void 0?{missingReason:`target agent ${org}/${slug} not found`}:{agent,missingReason:""}}buildExecutionRequest(schedule,agent,executionName,nominalFireTime){let invocation=invocationOf(schedule),runConfig=invocation?.runConfig,executionConfig=create2(ExecutionConfigSchema,{approvalMode:ApprovalMode.UNATTENDED,maxToolRounds:clampedRunBound(runConfig?.maxToolRounds??0,this.deps.config.executionProfileMaxToolRounds),maxCostUsd:clampedRunBound(runConfig?.maxCostUsd??0,this.deps.config.executionProfileMaxCostUsd)}),model=(runConfig?.modelName??"").trim();model!==""&&(executionConfig.modelName=model),runConfig!==void 0&&runConfig.serviceTier!==ServiceTier.UNSPECIFIED&&(executionConfig.serviceTier=runConfig.serviceTier),runConfig!==void 0&&runConfig.thinkingMode!==ThinkingMode.UNSPECIFIED&&(executionConfig.thinkingMode=runConfig.thinkingMode);let sessionSpec=create2(SessionSpecSchema,{subject:SESSION_SUBJECT_PREFIX+(schedule.metadata?.slug??""),workspaceEntries:invocation?.workspaceEntries??[]});return invocation!==void 0&&invocation.harness!==Harness.UNSPECIFIED&&(sessionSpec.harness=invocation.harness),create2(AgentExecutionSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"AgentExecution",metadata:create2(ApiResourceMetadataSchema,{name:executionName,org:schedule.metadata?.org??"",labels:{[SCHEDULE_ID_LABEL_KEY2]:schedule.metadata?.id??""}}),spec:create2(AgentExecutionSpecSchema,{agentId:agent.metadata?.id??"",message:composeMessage(schedule,nominalFireTime),sessionSpec,executionConfig})})}async stampLastExecutionId(scheduleId,executionId){try{await this.deps.store.updateResource(ApiResourceKind.schedule,scheduleId,ScheduleSchema,live=>{let status=ensureStatus(live);status.lastExecutionId=executionId,bumpStatusAudit(status)})}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw new Error(`stamp last_execution_id on schedule ${scheduleId}: ${error2 instanceof Error?error2.message:String(error2)}`,{cause:error2})}}};function clampedRunBound(owner,platform2){return owner<=0?Math.max(platform2,0):platform2<=0?owner:Math.min(owner,platform2)}var import_client71=__toESM(require_lib3(),1);var TemporalUnavailableError=class extends Error{constructor(){super("temporal is not connected"),this.name="TemporalUnavailableError"}},ScheduleSyncer=class{clientProvider;store;artifact;logger;constructor(clientProvider,store,artifact,logger2){this.clientProvider=clientProvider,this.store=store,this.artifact=artifact,this.logger=logger2}async ensureAndRecord(schedule){let client=this.clientProvider();if(client===void 0)throw new TemporalUnavailableError;let resourceId=schedule.metadata?.id??"",id=artifactId(resourceId);try{await client.schedule.create(this.artifact.createOptions(schedule)),this.logger.info("Created schedule artifact",{artifact_id:id,note:note(schedule),paused:desiredPaused(schedule)})}catch(error2){if(!(error2 instanceof import_client71.ScheduleAlreadyRunning))throw new Error(`create schedule artifact ${id}: ${message3(error2)}`,{cause:error2});try{await client.schedule.getHandle(id).update(previous=>this.artifact.applyDesiredState(previous,schedule))}catch(updateError){throw new Error(`update schedule artifact ${id}: ${message3(updateError)}`,{cause:updateError})}this.logger.info("Updated schedule artifact",{artifact_id:id,note:note(schedule),paused:desiredPaused(schedule)})}return this.recordNextFireAt(schedule)}async peekNextFireAt(schedule){if(desiredPaused(schedule))return;let client=this.clientProvider();if(client===void 0)throw new TemporalUnavailableError;let description;try{description=await client.schedule.getHandle(artifactId(schedule.metadata?.id??"")).describe()}catch(error2){throw new Error(`describe schedule artifact: ${message3(error2)}`,{cause:error2})}return description.info.nextActionTimes[0]}async teardown(resourceId){let client=this.clientProvider();if(client===void 0)throw new TemporalUnavailableError;let id=artifactId(resourceId);try{await client.schedule.getHandle(id).delete()}catch(error2){if(error2 instanceof import_client71.ScheduleNotFoundError){this.logger.info("Schedule artifact already gone",{artifact_id:id});return}throw new Error(`delete schedule artifact ${id}: ${message3(error2)}`,{cause:error2})}this.logger.info("Deleted schedule artifact",{artifact_id:id})}async recordNextFireAt(schedule){let nextFireAt=await this.peekNextFireAt(schedule);try{await this.store.updateResource(ApiResourceKind.schedule,schedule.metadata?.id??"",ScheduleSchema,live=>{let status=ensureStatus(live);status.nextFireAt=nextFireAt===void 0?void 0:timestampFromDate(nextFireAt),bumpStatusAudit(status)})}catch(error2){if(error2 instanceof ResourceNotFoundError)return this.logger.info("Schedule row gone before next_fire_at stamp \u2014 skipping",{schedule_id:schedule.metadata?.id??""}),nextFireAt;throw new Error(`stamp next_fire_at: ${message3(error2)}`,{cause:error2})}return nextFireAt}};function message3(error2){return error2 instanceof Error?error2.message:String(error2)}function createScheduleTickActivities(deps){return{[RECORD_TICK_ACTIVITY_NAME]:(scheduleResourceId,nominalFireTimeRfc3339)=>recordTick(deps,scheduleResourceId,nominalFireTimeRfc3339),[START_SCHEDULED_RUN_ACTIVITY_NAME]:(scheduleResourceId,nominalFireTimeRfc3339)=>startScheduledRun(deps,scheduleResourceId,nominalFireTimeRfc3339),[POLL_EXECUTION_PHASE_ACTIVITY_NAME]:executionId=>pollExecutionPhase(deps,executionId),[RECORD_SUCCESSFUL_RUN_ACTIVITY_NAME]:scheduleResourceId=>recordSuccessfulRun(deps,scheduleResourceId),[RECORD_FAILED_RUN_ACTIVITY_NAME]:(scheduleResourceId,reason,kind)=>recordFailedRun(deps,scheduleResourceId,reason,kind)}}async function recordTick(deps,scheduleResourceId,nominalFireTimeRfc3339){let schedule;try{schedule=await deps.store.getResource(ApiResourceKind.schedule,scheduleResourceId,ScheduleSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return deps.logger.info("Schedule tick no-op \u2014 row deleted (orphaned artifact; the reconciliation pass removes it)",{schedule_id:scheduleResourceId}),TICK_SKIPPED_DELETED;throw new Error(`load schedule ${scheduleResourceId}: ${message4(error2)}`,{cause:error2})}if(!(schedule.spec?.enabled??!1))return deps.logger.info("Schedule tick no-op \u2014 owner-disabled",{schedule_id:scheduleResourceId}),TICK_SKIPPED_DISABLED;let pausedReason=schedule.status?.pausedReason??"";return pausedReason!==""?(deps.logger.info("Schedule tick no-op \u2014 platform-paused",{schedule_id:scheduleResourceId,reason:pausedReason}),TICK_SKIPPED_AUTO_PAUSED):(await recordFire(deps,schedule,nominalFireTimeRfc3339),TICK_FIRED)}async function recordFire(deps,schedule,nominalFireTimeRfc3339){let nominal=parseRfc3339(nominalFireTimeRfc3339),nextFireAt,peekFailed=!1;try{nextFireAt=await deps.syncer.peekNextFireAt(schedule)}catch(error2){peekFailed=!0,deps.logger.warn("Could not refresh next_fire_at during tick (recording the fire without it)",{schedule_id:schedule.metadata?.id??"",error:message4(error2)})}try{await deps.store.updateResource(ApiResourceKind.schedule,schedule.metadata?.id??"",ScheduleSchema,live=>{let status=ensureStatus(live);status.lastFireAt=timestampFromDate(nominal),peekFailed||(status.nextFireAt=nextFireAt===void 0?void 0:timestampFromDate(nextFireAt)),bumpStatusAudit(status)})}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw new Error(`record schedule fire on status: ${message4(error2)}`,{cause:error2})}deps.logger.info("Schedule fire recorded",{schedule_id:schedule.metadata?.id??"",nominal_fire_time:nominalFireTimeRfc3339})}async function startScheduledRun(deps,scheduleResourceId,nominalFireTimeRfc3339){let trackingBudget=deps.config.resolvedRunTrackingTimeoutMinutes(),schedule;try{schedule=await deps.store.getResource(ApiResourceKind.schedule,scheduleResourceId,ScheduleSchema)}catch(error2){if(!(error2 instanceof ResourceNotFoundError))throw new Error(`load schedule ${scheduleResourceId}: ${message4(error2)}`,{cause:error2});schedule=void 0}if(schedule===void 0||!(schedule.spec?.enabled??!1)||(schedule.status?.pausedReason??"")!==""){deps.logger.info("Schedule run start no-op \u2014 row deleted/disabled/paused between record and start",{schedule_id:scheduleResourceId});let skipped={outcome:RUN_SKIPPED,executionId:"",trackingTimeoutMinutes:trackingBudget,failureReason:""};return schedule!==void 0&&await recordRunLedgerStart(deps.store,deps.logger,scheduleResourceId,schedule.metadata?.org??"",nominalFireTimeRfc3339,RUN_LEDGER_ORIGIN_CRON,skipped),skipped}let nominal=parseRfc3339(nominalFireTimeRfc3339),outcome=await deps.runStarter.startRun(schedule,nominal),result={outcome:RUN_STARTED,executionId:"",trackingTimeoutMinutes:trackingBudget,failureReason:""};switch(outcome.kind){case"started":result.outcome=outcome.alreadyExisted?RUN_ALREADY_STARTED:RUN_STARTED,result.executionId=outcome.executionId,deps.logger.info("Schedule fire started its run",{schedule_id:scheduleResourceId,execution_id:outcome.executionId,already_existed:outcome.alreadyExisted});break;case"targetMissing":result.outcome=RUN_TARGET_MISSING,result.failureReason=outcome.reason;break;case"refused":result.outcome=RUN_REFUSED,result.failureReason=`run refused: ${outcome.reason}`;break;default:{let exhaustive=outcome;throw new Error(`unknown run outcome ${String(exhaustive)}`)}}return await recordRunLedgerStart(deps.store,deps.logger,scheduleResourceId,schedule.metadata?.org??"",nominalFireTimeRfc3339,RUN_LEDGER_ORIGIN_CRON,result),result}async function pollExecutionPhase(deps,executionId){let phase;try{phase=(await deps.store.getResource(ApiResourceKind.agent_execution,executionId,AgentExecutionSchema)).status?.phase??ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED}catch(error2){if(error2 instanceof ResourceNotFoundError)return PHASE_GONE;throw new Error(`load execution ${executionId}: ${message4(error2)}`,{cause:error2})}switch(phase){case ExecutionPhase.EXECUTION_COMPLETED:return PHASE_COMPLETED;case ExecutionPhase.EXECUTION_CANCELLED:return PHASE_CANCELLED;case ExecutionPhase.EXECUTION_TERMINATED:return PHASE_TERMINATED;case ExecutionPhase.EXECUTION_FAILED:return PHASE_FAILED;default:return PHASE_RUNNING}}async function recordSuccessfulRun(deps,scheduleResourceId){try{await deps.store.updateResource(ApiResourceKind.schedule,scheduleResourceId,ScheduleSchema,live=>{let status=ensureStatus(live);status.consecutiveFailures=0,bumpStatusAudit(status)})}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw new Error(`reset failure streak on schedule ${scheduleResourceId}: ${message4(error2)}`,{cause:error2})}await recordRunLedgerVerdict(deps.store,deps.logger,scheduleResourceId,RUN_LEDGER_OUTCOME_COMPLETED,""),deps.logger.info("Schedule run completed \u2014 failure streak reset",{schedule_id:scheduleResourceId})}async function recordFailedRun(deps,scheduleResourceId,reason,kind){let threshold=deps.config.resolvedMaxConsecutiveFailures(),pausedReason=`Paused after ${threshold} consecutive failed runs. Last failure: ${reason}`,recorded={consecutiveFailures:0,paused:!1},crossedThreshold=!1;try{await deps.store.updateResource(ApiResourceKind.schedule,scheduleResourceId,ScheduleSchema,live=>{let status=ensureStatus(live);status.consecutiveFailures++,status.consecutiveFailures>=threshold&&status.pausedReason===""&&(status.pausedReason=pausedReason,crossedThreshold=!0),status.consecutiveFailures>=threshold&&(status.nextFireAt=void 0),bumpStatusAudit(status),recorded={consecutiveFailures:status.consecutiveFailures,paused:status.pausedReason!==""}})}catch(error2){if(error2 instanceof ResourceNotFoundError)return deps.logger.info("Schedule run failure not recorded \u2014 row deleted mid-track",{schedule_id:scheduleResourceId,reason}),{consecutiveFailures:0,paused:!1};throw new Error(`record failed run on schedule ${scheduleResourceId}: ${message4(error2)}`,{cause:error2})}switch(deps.logger.warn("Schedule run failed",{failure_kind:kind,schedule_id:scheduleResourceId,consecutive_failures:recorded.consecutiveFailures,threshold,paused:recorded.paused,reason}),kind){case FAILURE_RUN_FAILED:await recordRunLedgerVerdict(deps.store,deps.logger,scheduleResourceId,RUN_LEDGER_OUTCOME_FAILED,reason);break;case FAILURE_RUN_TIMED_OUT:await recordRunLedgerVerdict(deps.store,deps.logger,scheduleResourceId,RUN_LEDGER_OUTCOME_TIMED_OUT,reason);break;case FAILURE_START_FAILED:break;default:{let exhaustive=kind;throw new Error(`unknown failure kind ${String(exhaustive)}`)}}if(crossedThreshold)try{let schedule=await deps.store.getResource(ApiResourceKind.schedule,scheduleResourceId,ScheduleSchema);await deps.syncer.ensureAndRecord(schedule)}catch(error2){deps.logger.error("Paused schedule's artifact not yet converged (the reconciliation pass will pause it)",{schedule_id:scheduleResourceId,error:message4(error2)})}return recorded}function parseRfc3339(value){let parsed=new Date(value);if(Number.isNaN(parsed.getTime()))throw new Error(`parse nominal fire time "${value}": invalid RFC-3339`);return parsed}function message4(error2){return error2 instanceof Error?error2.message:String(error2)}function newScheduleWorkerFactory(deps){return async({createWorker})=>{let activities=createScheduleTickActivities({store:deps.store,config:deps.config,syncer:deps.syncer,runStarter:deps.runStarter,logger:deps.logger}),workflowSource=resolveWorkflowSource({workflowsEntryCandidates:[new URL("./workflows/index.js",__stigmerImportMetaUrl),new URL("./workflows/index.ts",__stigmerImportMetaUrl)],prebuiltSibling:new URL("./workflow-bundle-schedule.js",__stigmerImportMetaUrl)});return deps.logger.info("Creating schedule-clock Temporal worker",{queue:deps.config.stigmerQueue,workflow_source:workflowSource.kind}),createWorker({taskQueue:deps.config.stigmerQueue,activities,workflows:workflowSource.kind==="prebuilt"?{workflowBundle:{codePath:workflowSource.codePath}}:{workflowsPath:workflowSource.workflowsPath}})}}var file_ai_stigmer_agentic_schedule_v1_io=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvc2NoZWR1bGUvdjEvaW8ucHJvdG8SHmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MSIjCgpTY2hlZHVsZUlkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEieAoaR2V0U2NoZWR1bGVzQnlBZ2VudFJlcXVlc3QSGAoIYWdlbnRfaWQYASABKAlCBrpIA8gBARIzCglwYWdlX2luZm8YAiABKAsyIC5haS5zdGlnbWVyLmNvbW1vbnMucnBjLlBhZ2VJbmZvEgsKA29yZxgDIAEoCSJcCgxTY2hlZHVsZUxpc3QSEwoLdG90YWxfY291bnQYASABKAUSNwoFaXRlbXMYAiADKAsyKC5haS5zdGlnbWVyLmFnZW50aWMuc2NoZWR1bGUudjEuU2NoZWR1bGUi4gEKFExpc3RTY2hlZHVsZXNSZXF1ZXN0EhQKA29yZxgBIAEoCUIHukgEcgIQARJQCgZsYWJlbHMYAiADKAsyQC5haS5zdGlnbWVyLmFnZW50aWMuc2NoZWR1bGUudjEuTGlzdFNjaGVkdWxlc1JlcXVlc3QuTGFiZWxzRW50cnkSMwoJcGFnZV9pbmZvGAMgASgLMiAuYWkuc3RpZ21lci5jb21tb25zLnJwYy5QYWdlSW5mbxotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIsYBChVTY2hlZHVsZVRyaWdnZXJSZXN1bHQSOgoIc2NoZWR1bGUYASABKAsyKC5haS5zdGlnbWVyLmFnZW50aWMuc2NoZWR1bGUudjEuU2NoZWR1bGUSQwoHb3V0Y29tZRgCIAEoDjIyLmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5TY2hlZHVsZVJ1bk91dGNvbWUSFAoMZXhlY3V0aW9uX2lkGAMgASgJEhYKDnJlZnVzYWxfcmVhc29uGAQgASgJIvcCCgtTY2hlZHVsZVJ1bhITCgtzY2hlZHVsZV9pZBgBIAEoCRILCgNvcmcYAiABKAkSNQoRbm9taW5hbF9maXJlX3RpbWUYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEkEKBm9yaWdpbhgEIAEoDjIxLmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5TY2hlZHVsZVJ1bk9yaWdpbhJDCgdvdXRjb21lGAUgASgOMjIuYWkuc3RpZ21lci5hZ2VudGljLnNjaGVkdWxlLnYxLlNjaGVkdWxlUnVuT3V0Y29tZRIOCgZyZWFzb24YBiABKAkSFAoMZXhlY3V0aW9uX2lkGAcgASgJEi8KC3JlY29yZGVkX2F0GAggASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIwCgxjb21wbGV0ZWRfYXQYCSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wImsKF0xpc3RTY2hlZHVsZVJ1bnNSZXF1ZXN0EhsKC3NjaGVkdWxlX2lkGAEgASgJQga6SAPIAQESMwoJcGFnZV9pbmZvGAIgASgLMiAuYWkuc3RpZ21lci5jb21tb25zLnJwYy5QYWdlSW5mbyJiCg9TY2hlZHVsZVJ1bkxpc3QSEwoLdG90YWxfY291bnQYASABKAUSOgoFaXRlbXMYAiADKAsyKy5haS5zdGlnbWVyLmFnZW50aWMuc2NoZWR1bGUudjEuU2NoZWR1bGVSdW4qdgoRU2NoZWR1bGVSdW5PcmlnaW4SIwofU0NIRURVTEVfUlVOX09SSUdJTl9VTlNQRUNJRklFRBAAEhwKGFNDSEVEVUxFX1JVTl9PUklHSU5fQ1JPThABEh4KGlNDSEVEVUxFX1JVTl9PUklHSU5fTUFOVUFMEAIqsgIKElNjaGVkdWxlUnVuT3V0Y29tZRIkCiBTQ0hFRFVMRV9SVU5fT1VUQ09NRV9VTlNQRUNJRklFRBAAEiAKHFNDSEVEVUxFX1JVTl9PVVRDT01FX1NUQVJURUQQARIgChxTQ0hFRFVMRV9SVU5fT1VUQ09NRV9SRUZVU0VEEAISJwojU0NIRURVTEVfUlVOX09VVENPTUVfVEFSR0VUX01JU1NJTkcQAxIgChxTQ0hFRFVMRV9SVU5fT1VUQ09NRV9TS0lQUEVEEAQSIgoeU0NIRURVTEVfUlVOX09VVENPTUVfQ09NUExFVEVEEAUSHwobU0NIRURVTEVfUlVOX09VVENPTUVfRkFJTEVEEAYSIgoeU0NIRURVTEVfUlVOX09VVENPTUVfVElNRURfT1VUEAdiBnByb3RvMw",[file_ai_stigmer_agentic_schedule_v1_api,file_ai_stigmer_commons_rpc_pagination,file_buf_validate_validate,file_google_protobuf_timestamp]);var ScheduleListSchema=messageDesc2(file_ai_stigmer_agentic_schedule_v1_io,2);var ScheduleTriggerResultSchema=messageDesc2(file_ai_stigmer_agentic_schedule_v1_io,4),ScheduleRunSchema=messageDesc2(file_ai_stigmer_agentic_schedule_v1_io,5);var ScheduleRunListSchema=messageDesc2(file_ai_stigmer_agentic_schedule_v1_io,7),ScheduleRunOrigin;(function(ScheduleRunOrigin2){ScheduleRunOrigin2[ScheduleRunOrigin2.UNSPECIFIED=0]="UNSPECIFIED",ScheduleRunOrigin2[ScheduleRunOrigin2.CRON=1]="CRON",ScheduleRunOrigin2[ScheduleRunOrigin2.MANUAL=2]="MANUAL"})(ScheduleRunOrigin||(ScheduleRunOrigin={}));var ScheduleRunOutcome;(function(ScheduleRunOutcome2){ScheduleRunOutcome2[ScheduleRunOutcome2.UNSPECIFIED=0]="UNSPECIFIED",ScheduleRunOutcome2[ScheduleRunOutcome2.STARTED=1]="STARTED",ScheduleRunOutcome2[ScheduleRunOutcome2.REFUSED=2]="REFUSED",ScheduleRunOutcome2[ScheduleRunOutcome2.TARGET_MISSING=3]="TARGET_MISSING",ScheduleRunOutcome2[ScheduleRunOutcome2.SKIPPED=4]="SKIPPED",ScheduleRunOutcome2[ScheduleRunOutcome2.COMPLETED=5]="COMPLETED",ScheduleRunOutcome2[ScheduleRunOutcome2.FAILED=6]="FAILED",ScheduleRunOutcome2[ScheduleRunOutcome2.TIMED_OUT=7]="TIMED_OUT"})(ScheduleRunOutcome||(ScheduleRunOutcome={}));var file_ai_stigmer_agentic_schedule_v1_command=fileDesc("CixhaS9zdGlnbWVyL2FnZW50aWMvc2NoZWR1bGUvdjEvY29tbWFuZC5wcm90bxIeYWkuc3RpZ21lci5hZ2VudGljLnNjaGVkdWxlLnYxMsEGChlTY2hlZHVsZUNvbW1hbmRDb250cm9sbGVyElsKBWFwcGx5EiguYWkuc3RpZ21lci5hZ2VudGljLnNjaGVkdWxlLnYxLlNjaGVkdWxlGiguYWkuc3RpZ21lci5hZ2VudGljLnNjaGVkdWxlLnYxLlNjaGVkdWxlEmIKBmNyZWF0ZRIoLmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5TY2hlZHVsZRooLmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5TY2hlZHVsZSIE0LgYARKUAQoGdXBkYXRlEiguYWkuc3RpZ21lci5hZ2VudGljLnNjaGVkdWxlLnYxLlNjaGVkdWxlGiguYWkuc3RpZ21lci5hZ2VudGljLnNjaGVkdWxlLnYxLlNjaGVkdWxlIjbCuBgyCAIQOCILbWV0YWRhdGEuaWQqH3VuYXV0aG9yaXplZCB0byB1cGRhdGUgc2NoZWR1bGUSkAEKBmRlbGV0ZRIqLmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5TY2hlZHVsZUlkGiguYWkuc3RpZ21lci5hZ2VudGljLnNjaGVkdWxlLnYxLlNjaGVkdWxlIjDCuBgsCAMQOCIFdmFsdWUqH3VuYXV0aG9yaXplZCB0byBkZWxldGUgc2NoZWR1bGUSkAEKBnJlc3VtZRIqLmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5TY2hlZHVsZUlkGiguYWkuc3RpZ21lci5hZ2VudGljLnNjaGVkdWxlLnYxLlNjaGVkdWxlIjDCuBgsCAIQOCIFdmFsdWUqH3VuYXV0aG9yaXplZCB0byByZXN1bWUgc2NoZWR1bGUSnwEKB3RyaWdnZXISKi5haS5zdGlnbWVyLmFnZW50aWMuc2NoZWR1bGUudjEuU2NoZWR1bGVJZBo1LmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5TY2hlZHVsZVRyaWdnZXJSZXN1bHQiMcK4GC0IAhA4IgV2YWx1ZSogdW5hdXRob3JpemVkIHRvIHRyaWdnZXIgc2NoZWR1bGUaBKD/KzhiBnByb3RvMw",[file_ai_stigmer_agentic_schedule_v1_api,file_ai_stigmer_agentic_schedule_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ScheduleCommandController=serviceDesc(file_ai_stigmer_agentic_schedule_v1_command,0);var file_ai_stigmer_agentic_schedule_v1_query=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvc2NoZWR1bGUvdjEvcXVlcnkucHJvdG8SHmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MTLGBQoXU2NoZWR1bGVRdWVyeUNvbnRyb2xsZXISigEKA2dldBIqLmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5TY2hlZHVsZUlkGiguYWkuc3RpZ21lci5hZ2VudGljLnNjaGVkdWxlLnYxLlNjaGVkdWxlIi3CuBgpCAEQOCIFdmFsdWUqHHVuYXV0aG9yaXplZCB0byBnZXQgc2NoZWR1bGUSdgoOZ2V0QnlSZWZlcmVuY2USNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2UaKC5haS5zdGlnbWVyLmFnZW50aWMuc2NoZWR1bGUudjEuU2NoZWR1bGUiBNC4GAESfAoKZ2V0QnlBZ2VudBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5HZXRTY2hlZHVsZXNCeUFnZW50UmVxdWVzdBosLmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5TY2hlZHVsZUxpc3QiBNC4GAEScAoEbGlzdBI0LmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5MaXN0U2NoZWR1bGVzUmVxdWVzdBosLmFpLnN0aWdtZXIuYWdlbnRpYy5zY2hlZHVsZS52MS5TY2hlZHVsZUxpc3QiBNC4GAESrwEKCGxpc3RSdW5zEjcuYWkuc3RpZ21lci5hZ2VudGljLnNjaGVkdWxlLnYxLkxpc3RTY2hlZHVsZVJ1bnNSZXF1ZXN0Gi8uYWkuc3RpZ21lci5hZ2VudGljLnNjaGVkdWxlLnYxLlNjaGVkdWxlUnVuTGlzdCI5wrgYNQgBEDgiC3NjaGVkdWxlX2lkKiJ1bmF1dGhvcml6ZWQgdG8gbGlzdCBzY2hlZHVsZSBydW5zGgSg/ys4YgZwcm90bzM",[file_ai_stigmer_agentic_schedule_v1_api,file_ai_stigmer_agentic_schedule_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ScheduleQueryController=serviceDesc(file_ai_stigmer_agentic_schedule_v1_query,0);function newArmScheduleStep(clock,logger2){return{name:"ArmScheduleArtifact",async execute(ctx){await armAndMirror(clock(),ctx.newState,logger2)}}}function newArmResumedScheduleStep(clock,logger2){return{name:"ArmResumedScheduleArtifact",async execute(ctx){let schedule=ctx.get(EXISTING_RESOURCE_KEY);schedule!==void 0&&await armAndMirror(clock(),schedule,logger2)}}}async function armAndMirror(clock,schedule,logger2){if(clock===void 0||schedule===void 0)return;let nextFireAt;try{nextFireAt=await clock.ensureAndRecord(schedule)}catch(error2){logger2.warn("Schedule artifact not armed \u2014 next_fire_at stays absent until the reconciliation pass converges it",{schedule_id:schedule.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)});return}schedule.status===void 0&&(schedule.status=create2(ScheduleStatusSchema)),schedule.status.nextFireAt=nextFireAt===void 0?void 0:timestampFromDate(nextFireAt)}function newTeardownScheduleArtifactStep(clock,logger2){return{name:"TeardownScheduleArtifact",async execute(ctx){let liveClock=clock();if(liveClock===void 0)return;let resourceId=ctx.get(RESOURCE_ID_KEY);if(!(typeof resourceId!="string"||resourceId===""))try{await liveClock.teardown(resourceId)}catch(error2){logger2.warn("Schedule artifact teardown failed (non-fatal \u2014 the orphan cannot fire past revalidation and the reconciliation pass removes it)",{schedule_id:resourceId,error:error2 instanceof Error?error2.message:String(error2)})}}}}function newDeleteScheduleRunsStep(store,logger2){return{name:"DeleteScheduleRuns",async execute(ctx){let resourceId=ctx.get(RESOURCE_ID_KEY);if(!(typeof resourceId!="string"||resourceId===""))try{await store.deleteScheduleRunsBySchedule(resourceId)}catch(error2){logger2.warn("Fire-ledger cleanup failed (non-fatal \u2014 orphaned rows answer no query; retention prunes them)",{schedule_id:resourceId,error:error2 instanceof Error?error2.message:String(error2)})}}}}var LIST_RUNS_RESULT_KEY="listRunsResult",DEFAULT_RUNS_PAGE_SIZE=50;function newLoadScheduleForRunsStep(store){return{name:"LoadScheduleForRuns",async execute(ctx){let scheduleId=ctx.input.scheduleId;try{await store.getResource(ApiResourceKind.schedule,scheduleId,ScheduleSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("Schedule",scheduleId):internalError(error2,"failed to load schedule")}}}}function newListRunsFromLedgerStep(store){return{name:"ListRunsFromLedger",async execute(ctx){let req=ctx.input,size=req.pageInfo?.size??0;size<=0&&(size=DEFAULT_RUNS_PAGE_SIZE);let num=req.pageInfo?.num??0;num<1&&(num=1);let offset=(num-1)*size,runs,total;try{({runs,total}=await store.listScheduleRuns(req.scheduleId,offset,size))}catch(error2){throw internalError(error2,"failed to list schedule runs")}let items=[];for(let record2 of runs)items.push(await toProtoRun(store,record2));ctx.set(LIST_RUNS_RESULT_KEY,create2(ScheduleRunListSchema,{totalCount:total,items}))}}}async function toProtoRun(store,record2){let run=create2(ScheduleRunSchema,{scheduleId:record2.scheduleId,org:record2.org,origin:runOriginFromLabel(record2.origin),outcome:runOutcomeFromLabel(record2.outcome),reason:record2.reason,executionId:record2.executionId}),nominal=parseTime(record2.nominalFireTime);nominal!==void 0&&(run.nominalFireTime=timestampFromDate(nominal));let recordedAt=parseTime(record2.recordedAt);if(recordedAt!==void 0&&(run.recordedAt=timestampFromDate(recordedAt)),record2.completedAt!==""){let completedAt=parseTime(record2.completedAt);return completedAt!==void 0&&(run.completedAt=timestampFromDate(completedAt)),run}if(record2.executionId==="")return run;let phase;try{phase=(await store.getResource(ApiResourceKind.agent_execution,record2.executionId,AgentExecutionSchema)).status?.phase??ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED}catch{return run}switch(phase){case ExecutionPhase.EXECUTION_COMPLETED:run.outcome=ScheduleRunOutcome.COMPLETED;break;case ExecutionPhase.EXECUTION_FAILED:case ExecutionPhase.EXECUTION_CANCELLED:case ExecutionPhase.EXECUTION_TERMINATED:run.outcome=ScheduleRunOutcome.FAILED,run.reason=`run ${record2.executionId} ended ${executionPhaseWord(phase)}`;break;default:break}return run}function executionPhaseWord(phase){switch(phase){case ExecutionPhase.EXECUTION_FAILED:return"failed";case ExecutionPhase.EXECUTION_CANCELLED:return"cancelled";case ExecutionPhase.EXECUTION_TERMINATED:return"terminated";default:return"unknown"}}function runOriginFromLabel(origin){switch(origin){case"cron":return ScheduleRunOrigin.CRON;case"manual":return ScheduleRunOrigin.MANUAL;default:return ScheduleRunOrigin.UNSPECIFIED}}function runOutcomeFromLabel(outcome){switch(outcome){case"started":return ScheduleRunOutcome.STARTED;case"refused":return ScheduleRunOutcome.REFUSED;case"target_missing":return ScheduleRunOutcome.TARGET_MISSING;case"skipped":return ScheduleRunOutcome.SKIPPED;case"completed":return ScheduleRunOutcome.COMPLETED;case"failed":return ScheduleRunOutcome.FAILED;case"timed_out":return ScheduleRunOutcome.TIMED_OUT;default:return ScheduleRunOutcome.UNSPECIFIED}}function parseTime(value){if(value==="")return;let parsed=new Date(value);return Number.isNaN(parsed.getTime())?void 0:parsed}function newPersistScheduleUpdateStep(store){return{name:"PersistScheduleUpdate",async execute(ctx){let newState=ctx.newState,scheduleId=newState.metadata?.id??"",live;try{live=await store.updateResource(ApiResourceKind.schedule,scheduleId,ScheduleSchema,row=>{row.apiVersion=newState.apiVersion,row.kind=newState.kind,row.metadata=newState.metadata,row.spec=newState.spec,newState.status?.audit!==void 0&&(row.status===void 0&&(row.status=create2(ScheduleStatusSchema)),row.status.audit=newState.status.audit)})}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("Schedule",scheduleId):internalError(error2,"failed to persist schedule update")}ctx.setNewState(live)}}}var NothingToClearError=class extends Error{constructor(){super("nothing to clear"),this.name="NothingToClearError"}};function newClearSchedulePauseStep(store){return{name:"ClearSchedulePause",async execute(ctx){let scheduleId=ctx.get(EXISTING_RESOURCE_KEY).metadata?.id??"",live;try{live=await store.updateResource(ApiResourceKind.schedule,scheduleId,ScheduleSchema,row=>{let status=row.status;if((status?.pausedReason??"")===""&&(status?.consecutiveFailures??0)===0)throw new NothingToClearError;row.status.pausedReason="",row.status.consecutiveFailures=0,setAuditFieldsForUpdate(ScheduleSchema,row,"status_audit",ctx.callerIdentity)})}catch(error2){if(error2 instanceof NothingToClearError){try{live=await store.getResource(ApiResourceKind.schedule,scheduleId,ScheduleSchema)}catch(readError){throw readError instanceof ResourceNotFoundError?notFoundError("Schedule",scheduleId):internalError(readError,"failed to resume schedule")}ctx.set(EXISTING_RESOURCE_KEY,live);return}throw error2 instanceof ResourceNotFoundError?notFoundError("Schedule",scheduleId):internalError(error2,"failed to resume schedule")}ctx.set(EXISTING_RESOURCE_KEY,live)}}}var CRON_SHORTHANDS=new Set(["@hourly","@daily","@weekly","@monthly","@yearly"]),CRON_FIELD_PATTERN=/^[0-9A-Za-z*,/-]+$/;function validateScheduleCron(cron){if(cron.startsWith("CRON_TZ=")||cron.startsWith("TZ="))throw invalidArgumentError("spec.cron must not carry a timezone prefix (CRON_TZ=/TZ=) \u2014 spec.time_zone is the single timezone authority");if(cron.includes("#"))throw invalidArgumentError("spec.cron must not contain a comment (#)");if(cron.startsWith("@")){if(cron.startsWith("@every"))throw invalidArgumentError("spec.cron must be a calendar expression \u2014 @every intervals are not supported");if(!CRON_SHORTHANDS.has(cron))throw invalidArgumentError(`spec.cron shorthand "${cron}" is not supported \u2014 use @hourly, @daily, @weekly, @monthly, or @yearly, or a 5-field cron expression`);return}let fields2=cron.split(/\s+/).filter(field3=>field3!=="");if(fields2.length!==5)throw invalidArgumentError(`spec.cron must have exactly 5 fields (minute hour day-of-month month day-of-week); got ${fields2.length}`);for(let field3 of fields2)if(!CRON_FIELD_PATTERN.test(field3))throw invalidArgumentError(`spec.cron field "${field3}" contains unsupported characters \u2014 allowed: digits, names, '*', ',', '-', '/'`)}function validateScheduleTimeZone(timeZone){if(timeZone==="Local"||!isLoadableTimeZone(timeZone))throw invalidArgumentError(`spec.time_zone "${timeZone}" is not a valid IANA time zone (e.g. "Asia/Kolkata")`)}var canonicalZones,canonicalZonesLowered;function zoneSets(){if(canonicalZones===void 0||canonicalZonesLowered===void 0){let values=Intl.supportedValuesOf("timeZone");canonicalZones=new Set(values),canonicalZonesLowered=new Set(values.map(zone=>zone.toLowerCase()))}return{exact:canonicalZones,lowered:canonicalZonesLowered}}function isLoadableTimeZone(timeZone){if(timeZone==="")return!0;let{exact,lowered}=zoneSets();if(exact.has(timeZone))return!0;if(lowered.has(timeZone.toLowerCase()))return!1;try{return new Intl.DateTimeFormat("en-US",{timeZone}),!0}catch{return!1}}function newResolveScheduleDefaultsStep(deps){return{name:"ResolveScheduleDefaults",async execute(ctx){let schedule=ctx.newState,metadata=schedule.metadata;if((metadata?.org??"")==="")throw invalidArgumentError("metadata.org is required for a schedule");let spec=schedule.spec;validateScheduleCron(spec?.cron??""),validateScheduleTimeZone(spec?.timeZone??"");let agentRef=spec?.target.case==="agent"?spec.target.value.agentRef:void 0;if((agentRef?.slug??"")==="")throw invalidArgumentError("spec.agent.agent_ref.slug is required");validateScheduleWorkspace(spec),validateScheduleModelPinning(deps.modelRegistry,spec);let refOrg=agentRef?.org??"";if(refOrg===""&&(refOrg=metadata?.org??""),refOrg!==(metadata?.org??""))throw failedPreconditionError(`spec.agent.agent_ref.org must match metadata.org \u2014 a schedule must live in the referenced agent's organization (${refOrg})`);let found;try{found=await findResourceBySlug(deps.store,ApiResourceKind.agent,AgentSchema,agentRef?.slug??"",refOrg)}catch(error2){throw internalError(error2,"failed to list agent resources")}if(found===void 0)throw notFoundError("Agent",agentRef?.slug??"");agentRef!==void 0&&(agentRef.org=refOrg),ctx.set(REFERENCED_AGENT_KEY,found)}}}var REFERENCED_AGENT_KEY="scheduleReferencedAgent",SCHEDULE_CREATE_DENIED_MESSAGE="You don't have permission to schedule this agent";function resolveScheduleCreateTargets(ctx){let agent=ctx.get(REFERENCED_AGENT_KEY);if(agent===void 0)throw new Error("referenced agent not found in context");return[{permission:IamPermission.can_edit,resourceKind:ApiResourceKind.agent,resourceId:agent.metadata?.id??"",deniedMessage:SCHEDULE_CREATE_DENIED_MESSAGE}]}function validateScheduleWorkspace(spec){let entries=spec?.target.case==="agent"?spec.target.value.workspaceEntries:[];for(let[i6,entry]of entries.entries())if(entry.source?.source.case!=="gitRepo")throw invalidArgumentError(`spec.agent.workspace_entries[${i6}] must use a git_repo source \u2014 a scheduled run has no connected client to serve a local_path`)}function validateScheduleModelPinning(modelRegistry,spec){let presence=scheduleModelPinningRefusal(spec);if(presence!=="")throw invalidArgumentError(presence);let invocation=spec?.target.case==="agent"?spec.target.value:void 0,existence=unknownModelPinRefusal(modelRegistry,"spec.agent.run_config.model_name",harnessName(invocation?.harness??0),invocation?.runConfig?.modelName??"");if(existence!=="")throw invalidArgumentError(existence)}function targetFieldName(spec){return spec?.target.case??""}function newValidateScheduleUpdateStep(deps){return{name:"ValidateScheduleUpdate",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing schedule not found in context"),"existing schedule not found in context");let newState=ctx.newState,inputTarget=targetFieldName(newState.spec),existingTarget=targetFieldName(existing.spec);if(inputTarget!==existingTarget)throw failedPreconditionError(`spec target is immutable (schedule target is ${existingTarget}) \u2014 create a new schedule for a different target kind`);let spec=newState.spec;validateScheduleCron(spec?.cron??""),validateScheduleTimeZone(spec?.timeZone??""),validateScheduleWorkspace(spec),validateScheduleModelPinning(deps.modelRegistry,spec);let inputRef=spec?.target.case==="agent"?spec.target.value.agentRef:void 0,existingRef=existing.spec?.target.case==="agent"?existing.spec.target.value.agentRef:void 0,inputOrg=inputRef?.org??"";if(inputOrg===""&&(inputOrg=existing.metadata?.org??""),(inputRef?.slug??"")!==(existingRef?.slug??"")||inputOrg!==(existingRef?.org??""))throw failedPreconditionError(`spec.agent.agent_ref is immutable (schedule runs ${existingRef?.org??""}/${existingRef?.slug??""}) \u2014 create a new schedule to run a different agent`)}}}var TRIGGER_DISABLED_MESSAGE="schedule is disabled (spec.enabled=false) \u2014 enable it before triggering",TRIGGER_NO_RUNNER_MESSAGE="this Stigmer server process has no schedule run starter wired \u2014 the schedule cannot fire",TRIGGER_RESULT_KEY="trigger_result";function newValidateTriggerableStep(){return{name:"ValidateTriggerable",execute(ctx){if(!(ctx.get(EXISTING_RESOURCE_KEY).spec?.enabled??!1))throw failedPreconditionError(TRIGGER_DISABLED_MESSAGE)}}}function newFireDirectRunStep(deps){return{name:"FireDirectRun",async execute(ctx){let runner=deps.runner();if(runner===void 0)throw failedPreconditionError(TRIGGER_NO_RUNNER_MESSAGE);let schedule=ctx.get(EXISTING_RESOURCE_KEY),scheduleId=schedule.metadata?.id??"",nominal=new Date(Math.floor(Date.now()/1e3)*1e3),nominalRfc3339=rfc3339Seconds2(nominal),outcome;try{outcome=await runner.startRun(schedule,nominal)}catch(error2){throw deps.logger.warn("Manual trigger's run start failed on infrastructure",{schedule_id:scheduleId,error:error2 instanceof Error?error2.message:String(error2)}),error2 instanceof ConnectError?rethrownStatusError(error2):error2}await stampLastFireAt(deps,scheduleId,nominal,ctx.callerIdentity),await recordManualFire(deps.store,deps.logger,scheduleId,schedule.metadata?.org??"",nominalRfc3339,outcome);let result=create2(ScheduleTriggerResultSchema);switch(outcome.kind){case"started":result.outcome=ScheduleRunOutcome.STARTED,result.executionId=outcome.executionId,deps.logger.info("Schedule triggered manually \u2014 run started",{schedule_id:scheduleId,execution_id:outcome.executionId,already_existed:outcome.alreadyExisted});break;case"targetMissing":result.outcome=ScheduleRunOutcome.TARGET_MISSING,result.refusalReason=outcome.reason,deps.logger.warn("Schedule triggered manually \u2014 target missing",{schedule_id:scheduleId,reason:outcome.reason});break;case"refused":result.outcome=ScheduleRunOutcome.REFUSED,result.refusalReason=outcome.reason,deps.logger.warn("Schedule triggered manually \u2014 run refused by a launch gate",{schedule_id:scheduleId,reason:outcome.reason});break;default:{let exhaustive=outcome;throw new Error(`unknown run outcome ${String(exhaustive)}`)}}try{result.schedule=await deps.store.getResource(ApiResourceKind.schedule,scheduleId,ScheduleSchema)}catch{result.schedule=schedule}ctx.set(TRIGGER_RESULT_KEY,result)}}}async function stampLastFireAt(deps,scheduleId,nominal,identity2){try{await deps.store.updateResource(ApiResourceKind.schedule,scheduleId,ScheduleSchema,live=>{live.status===void 0&&(live.status=create2(ScheduleStatusSchema)),live.status.lastFireAt=timestampFromDate(nominal),setAuditFieldsForUpdate(ScheduleSchema,live,"status_audit",identity2)})}catch(error2){if(error2 instanceof ResourceNotFoundError)return;deps.logger.warn("Manual fire's last_fire_at not stamped (best-effort \u2014 the run is unaffected)",{schedule_id:scheduleId,error:error2 instanceof Error?error2.message:String(error2)})}}function registerScheduleServices(router,deps){router.service(ScheduleCommandController,{apply:(schedule,ctx)=>apply2(deps,schedule,ctx),create:(schedule,ctx)=>createSchedule(deps,schedule,ctx),update:(schedule,ctx)=>update3(deps,schedule,ctx),delete:(scheduleId,ctx)=>deleteSchedule(deps,scheduleId,ctx),resume:(scheduleId,ctx)=>resume(deps,scheduleId,ctx),trigger:(scheduleId,ctx)=>trigger(deps,scheduleId,ctx)}),router.service(ScheduleQueryController,{get:(scheduleId,ctx)=>get4(deps,scheduleId,ctx),getByReference:(ref,ctx)=>getByReference2(deps,ref,ctx),getByAgent:(req,ctx)=>getByAgent(deps,req,ctx),list:(req,ctx)=>list4(deps,req,ctx),listRuns:(req,ctx)=>listRuns(deps,req,ctx)})}function kindOf3(ctx){return ctx.values.get(apiResourceKindKey)}async function createSchedule(deps,schedule,ctx){let reqCtx=new RequestContext(ScheduleSchema,schedule,callerIdentityOf(ctx),kindOf3(ctx));return await newPipeline("schedule-create",deps.logger).addStep(newAuthorizeStep(ScheduleCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveScheduleDefaultsStep(deps)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveScheduleCreateTargets)).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newArmScheduleStep(deps.clock,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update3(deps,schedule,ctx){let reqCtx=new RequestContext(ScheduleSchema,schedule,callerIdentityOf(ctx),kindOf3(ctx));return await newPipeline("schedule-update",deps.logger).addStep(newAuthorizeStep(ScheduleCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateScheduleUpdateStep(deps)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistScheduleUpdateStep(deps.store)).addStep(newArmScheduleStep(deps.clock,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply2(deps,schedule,ctx){let reqCtx=new RequestContext(ScheduleSchema,schedule,callerIdentityOf(ctx),kindOf3(ctx));await newPipeline("schedule-apply",deps.logger).addStep(newAuthorizeStep(ScheduleCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveScheduleDefaultsStep(deps)).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");let resolved=reqCtx.newState;return shouldCreate?(deps.logger.info("Schedule does not exist - delegating to CREATE",{slug:resolved.metadata?.slug??""}),createSchedule(deps,resolved,ctx)):(deps.logger.info("Schedule exists - delegating to UPDATE",{slug:resolved.metadata?.slug??"",id:resolved.metadata?.id??""}),update3(deps,resolved,ctx))}async function deleteSchedule(deps,scheduleId,ctx){let reqCtx=new RequestContext(ScheduleCommandController.method.delete.input,scheduleId,callerIdentityOf(ctx),kindOf3(ctx));await newPipeline("schedule-delete",deps.logger).addStep(newAuthorizeStep(ScheduleCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,ScheduleSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newTeardownScheduleArtifactStep(deps.clock,deps.logger)).addStep(newDeleteScheduleRunsStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted schedule not found in context"),"deleted schedule not found in context");return deleted}async function resume(deps,scheduleId,ctx){let reqCtx=new RequestContext(ScheduleCommandController.method.resume.input,scheduleId,callerIdentityOf(ctx),kindOf3(ctx));await newPipeline("schedule-resume",deps.logger).addStep(newAuthorizeStep(ScheduleCommandController.method.resume,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,ScheduleSchema)).addStep(newClearSchedulePauseStep(deps.store)).addStep(newArmResumedScheduleStep(deps.clock,deps.logger)).build().execute(reqCtx);let resumed=reqCtx.get(EXISTING_RESOURCE_KEY);if(resumed===void 0)throw internalError(new Error("resumed schedule not found in context"),"resumed schedule not found in context");return resumed}async function trigger(deps,scheduleId,ctx){let reqCtx=new RequestContext(ScheduleCommandController.method.trigger.input,scheduleId,callerIdentityOf(ctx),kindOf3(ctx));await newPipeline("schedule-trigger",deps.logger).addStep(newAuthorizeStep(ScheduleCommandController.method.trigger,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,ScheduleSchema)).addStep(newValidateTriggerableStep()).addStep(newFireDirectRunStep({store:deps.store,runner:deps.runner,logger:deps.logger})).build().execute(reqCtx);let result=reqCtx.get(TRIGGER_RESULT_KEY);if(result===void 0)throw internalError(new Error("trigger result not found in context"),"trigger result not found in context");return result}async function get4(deps,scheduleId,ctx){let reqCtx=new RequestContext(ScheduleQueryController.method.get.input,scheduleId,callerIdentityOf(ctx),kindOf3(ctx));return await newPipeline("schedule-get",deps.logger).addStep(newAuthorizeStep(ScheduleQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,ScheduleSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByReference2(deps,ref,ctx){let reqCtx=new RequestContext(ScheduleQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf3(ctx));return await newPipeline("schedule-get-by-reference",deps.logger).addStep(newAuthorizeStep(ScheduleQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,ScheduleSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(ScheduleQueryController.method.get))).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var SCHEDULE_LIST_KEY="scheduleList";async function getByAgent(deps,req,ctx){let reqCtx=new RequestContext(ScheduleQueryController.method.getByAgent.input,req,callerIdentityOf(ctx),kindOf3(ctx));await newPipeline("schedule-get-by-agent",deps.logger).addStep(newAuthorizeStep(ScheduleQueryController.method.getByAgent,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadSchedulesByAgentStep(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(SCHEDULE_LIST_KEY);if(result===void 0)throw internalError(new Error("schedule list not found in context"),"schedule list not found in context");return result}function newLoadSchedulesByAgentStep(store,listReadScope){return{name:"LoadSchedulesByAgent",async execute(ctx){let req=ctx.input,agentOrg,agentSlug;try{let agent=await store.getResource(ApiResourceKind.agent,req.agentId,AgentSchema);agentOrg=agent.metadata?.org??"",agentSlug=agent.metadata?.slug??""}catch{ctx.set(SCHEDULE_LIST_KEY,create2(ScheduleListSchema,{totalCount:0,items:[]}));return}let resources;try{resources=await store.listResources(ApiResourceKind.schedule)}catch(error2){throw internalError(error2,"failed to list schedules")}let decoded=[];for(let data of resources)try{decoded.push(fromBinary2(ScheduleSchema,data))}catch{continue}let ofAgent=decoded.filter(schedule=>{let ref=schedule.spec?.target.case==="agent"?schedule.spec.target.value.agentRef:void 0;return(ref?.org??"")!==agentOrg||(ref?.slug??"")!==agentSlug?!1:req.org===""||(schedule.metadata?.org??"")===req.org}),schedules=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.schedule,ofAgent,"");ctx.set(SCHEDULE_LIST_KEY,create2(ScheduleListSchema,{totalCount:schedules.length,items:schedules}))}}}async function list4(deps,req,ctx){let reqCtx=new RequestContext(ScheduleQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf3(ctx));await newPipeline("schedule-list",deps.logger).addStep(newAuthorizeStep(ScheduleQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgAndLabelsStep(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(SCHEDULE_LIST_KEY);if(result===void 0)throw internalError(new Error("schedule list not found in context"),"schedule list not found in context");return result}function newListByOrgAndLabelsStep(store,listReadScope){return{name:"ListByOrgAndLabels",async execute(ctx){let req=ctx.input,resources;try{resources=await store.listResources(ApiResourceKind.schedule)}catch(error2){throw internalError(error2,"failed to list schedules")}let decoded=[];for(let data of resources)try{decoded.push(fromBinary2(ScheduleSchema,data))}catch{continue}let schedules=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.schedule,decoded.filter(schedule=>(schedule.metadata?.org??"")===req.org&&matchesAllLabels(schedule.metadata?.labels??{},req.labels)),"");schedules.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(SCHEDULE_LIST_KEY,create2(ScheduleListSchema,{totalCount:schedules.length,items:schedules}))}}}async function listRuns(deps,req,ctx){let reqCtx=new RequestContext(ScheduleQueryController.method.listRuns.input,req,callerIdentityOf(ctx),kindOf3(ctx));await newPipeline("schedule-list-runs",deps.logger).addStep(newAuthorizeStep(ScheduleQueryController.method.listRuns,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadScheduleForRunsStep(deps.store)).addStep(newListRunsFromLedgerStep(deps.store)).build().execute(reqCtx);let result=reqCtx.get(LIST_RUNS_RESULT_KEY);if(result===void 0)throw internalError(new Error("schedule run list not found in context"),"schedule run list not found in context");return result}var RuntimeResolutionService=class{store;secretService;logger;constructor(store,secretService,logger2){this.store=store,this.secretService=secretService,this.logger=logger2}async resolveByReference(ref){if(ref===void 0||ref.slug==="")throw invalidArgumentError("environment reference with slug is required");if(ref.kind!==ApiResourceKind.api_resource_kind_unknown&&ref.kind!==ApiResourceKind.environment)throw invalidArgumentError(`kind mismatch: expected environment, got ${apiResourceKindName(ref.kind)}`);requireOrgForReference(ApiResourceKind.environment,ref.org);let env2;try{env2=await findResourceBySlug(this.store,ApiResourceKind.environment,EnvironmentSchema,ref.slug,ref.org)}catch(error2){throw internalError(error2,"failed to look up environment for runtime resolution")}if(env2===void 0)throw notFoundError("environment",ref.slug);return await this.decryptSecretValues(env2),env2}async decryptSecretValues(env2){let data=env2.spec?.data;if(data===void 0||Object.keys(data).length===0)return;let environmentId=env2.metadata?.id??"";for(let[key,value]of Object.entries(data))if(!(!value.isSecret||!this.secretService.isEncrypted(value.value)))try{value.value=await this.secretService.decrypt(value.value)}catch(error2){if(error2 instanceof EncryptionUnavailableError)throw internalError(error2,`environment ${environmentId} holds encrypted secret '${key}' but no encryption key is configured`);this.logger.warn("Undecryptable ciphertext in environment \u2014 dropping this value from runtime resolution",{key,environmentId,error:error2 instanceof Error?error2.message:String(error2)}),delete data[key]}}};var MANAGED_ENV_LABEL="stigmer.ai/managed",ManagedEnvironmentService=class{client;logger;constructor(client,logger2){this.client=client,this.logger=logger2}async createManagedEnvironment(name,org,caller){let created;try{created=await this.client.create(create2(EnvironmentSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"Environment",metadata:{name,org,labels:{[MANAGED_ENV_LABEL]:"true"}}}),caller)}catch(error2){throw new Error(`failed to create managed environment: ${error2 instanceof Error?error2.message:String(error2)}`)}let envId=created.metadata?.id??"";return this.logger.info("Created managed environment for OAuth token storage",{environment_id:envId,name,org}),envId}async deleteManagedEnvironment(environmentId){try{await this.client.delete(create2(ApiResourceDeleteInputSchema,{resourceId:environmentId}))}catch(error2){throw new Error(`failed to delete managed environment ${environmentId}: ${error2 instanceof Error?error2.message:String(error2)}`)}this.logger.info("Deleted managed environment",{environment_id:environmentId})}async readSecretValue(environmentId,key){let value;try{value=await this.client.getSecretValue(create2(EnvironmentSecretValueInputSchema,{environmentId,key}))}catch(error2){throw new Error(`failed to read secret ${JSON.stringify(key)} from managed environment ${environmentId}: ${error2 instanceof Error?error2.message:String(error2)}`)}return value.value}async updateSecrets(environmentId,variables){try{await this.client.updateVariables(create2(UpdateEnvironmentVariablesRequestSchema,{environmentId,variables}))}catch(error2){throw new Error(`failed to update secrets in managed environment ${environmentId}: ${error2 instanceof Error?error2.message:String(error2)}`)}}};var file_ai_stigmer_agentic_agentinstance_v1_io=fileDesc("CixhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRpbnN0YW5jZS92MS9pby5wcm90bxIjYWkuc3RpZ21lci5hZ2VudGljLmFnZW50aW5zdGFuY2UudjEiKAoPQWdlbnRJbnN0YW5jZUlkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEifQofR2V0QWdlbnRJbnN0YW5jZXNCeUFnZW50UmVxdWVzdBIYCghhZ2VudF9pZBgBIAEoCUIGukgDyAEBEjMKCXBhZ2VfaW5mbxgCIAEoCzIgLmFpLnN0aWdtZXIuY29tbW9ucy5ycGMuUGFnZUluZm8SCwoDb3JnGAMgASgJImsKEUFnZW50SW5zdGFuY2VMaXN0EhMKC3RvdGFsX2NvdW50GAEgASgFEkEKBWl0ZW1zGAIgAygLMjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50aW5zdGFuY2UudjEuQWdlbnRJbnN0YW5jZSLxAQoZTGlzdEFnZW50SW5zdGFuY2VzUmVxdWVzdBIUCgNvcmcYASABKAlCB7pIBHICEAESWgoGbGFiZWxzGAIgAygLMkouYWkuc3RpZ21lci5hZ2VudGljLmFnZW50aW5zdGFuY2UudjEuTGlzdEFnZW50SW5zdGFuY2VzUmVxdWVzdC5MYWJlbHNFbnRyeRIzCglwYWdlX2luZm8YAyABKAsyIC5haS5zdGlnbWVyLmNvbW1vbnMucnBjLlBhZ2VJbmZvGi0KC0xhYmVsc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAFiBnByb3RvMw",[file_ai_stigmer_agentic_agentinstance_v1_api,file_ai_stigmer_commons_rpc_pagination,file_buf_validate_validate]),AgentInstanceIdSchema=messageDesc2(file_ai_stigmer_agentic_agentinstance_v1_io,0);var AgentInstanceListSchema=messageDesc2(file_ai_stigmer_agentic_agentinstance_v1_io,2);var file_ai_stigmer_agentic_agentinstance_v1_command=fileDesc("CjFhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRpbnN0YW5jZS92MS9jb21tYW5kLnByb3RvEiNhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRpbnN0YW5jZS52MTK2BgoeQWdlbnRJbnN0YW5jZUNvbW1hbmRDb250cm9sbGVyEm8KBWFwcGx5EjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50aW5zdGFuY2UudjEuQWdlbnRJbnN0YW5jZRoyLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGluc3RhbmNlLnYxLkFnZW50SW5zdGFuY2USdgoGY3JlYXRlEjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50aW5zdGFuY2UudjEuQWdlbnRJbnN0YW5jZRoyLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGluc3RhbmNlLnYxLkFnZW50SW5zdGFuY2UiBNC4GAESrgEKBnVwZGF0ZRIyLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGluc3RhbmNlLnYxLkFnZW50SW5zdGFuY2UaMi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRpbnN0YW5jZS52MS5BZ2VudEluc3RhbmNlIjzCuBg4CAIQLSILbWV0YWRhdGEuaWQqJXVuYXV0aG9yaXplZCB0byB1cGRhdGUgYWdlbnQgaW5zdGFuY2USxgEKEHVwZGF0ZVZpc2liaWxpdHkSNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuVXBkYXRlVmlzaWJpbGl0eUlucHV0GjIuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50aW5zdGFuY2UudjEuQWdlbnRJbnN0YW5jZSJHwrgYQwgCEC0iC3Jlc291cmNlX2lkKjB1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGFnZW50IGluc3RhbmNlIHZpc2liaWxpdHkSqgEKBmRlbGV0ZRI0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGluc3RhbmNlLnYxLkFnZW50SW5zdGFuY2VJZBoyLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGluc3RhbmNlLnYxLkFnZW50SW5zdGFuY2UiNsK4GDIIAxAtIgV2YWx1ZSoldW5hdXRob3JpemVkIHRvIGRlbGV0ZSBhZ2VudCBpbnN0YW5jZRoEoP8rLWIGcHJvdG8z",[file_ai_stigmer_agentic_agentinstance_v1_api,file_ai_stigmer_agentic_agentinstance_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentInstanceCommandController=serviceDesc(file_ai_stigmer_agentic_agentinstance_v1_command,0);var file_ai_stigmer_agentic_agentinstance_v1_query=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRpbnN0YW5jZS92MS9xdWVyeS5wcm90bxIjYWkuc3RpZ21lci5hZ2VudGljLmFnZW50aW5zdGFuY2UudjEy6AQKHEFnZW50SW5zdGFuY2VRdWVyeUNvbnRyb2xsZXISpAEKA2dldBI0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGluc3RhbmNlLnYxLkFnZW50SW5zdGFuY2VJZBoyLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGluc3RhbmNlLnYxLkFnZW50SW5zdGFuY2UiM8K4GC8IARAtIgV2YWx1ZSoidW5hdXRob3JpemVkIHRvIGdldCBBZ2VudCBJbnN0YW5jZRKQAQoKZ2V0QnlBZ2VudBJELmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGluc3RhbmNlLnYxLkdldEFnZW50SW5zdGFuY2VzQnlBZ2VudFJlcXVlc3QaNi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRpbnN0YW5jZS52MS5BZ2VudEluc3RhbmNlTGlzdCIE0LgYARKAAQoOZ2V0QnlSZWZlcmVuY2USNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2UaMi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRpbnN0YW5jZS52MS5BZ2VudEluc3RhbmNlIgTQuBgBEoQBCgRsaXN0Ej4uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50aW5zdGFuY2UudjEuTGlzdEFnZW50SW5zdGFuY2VzUmVxdWVzdBo2LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGluc3RhbmNlLnYxLkFnZW50SW5zdGFuY2VMaXN0IgTQuBgBGgSg/ystYgZwcm90bzM",[file_ai_stigmer_agentic_agentinstance_v1_api,file_ai_stigmer_agentic_agentinstance_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentInstanceQueryController=serviceDesc(file_ai_stigmer_agentic_agentinstance_v1_query,0);var agentInstanceSearchExtractor={kind:ApiResourceKind.agent_instance,schema:AgentInstanceSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let instance=resource;return buildSearchResult({kind:ApiResourceKind.agent_instance,metadata:instance.metadata,summary:instance.spec?.description??"",score,createdAt:instance.status?.audit?.specAudit?.createdAt,updatedAt:instance.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let instance=resource,metadata=instance.metadata;if(metadata!==void 0)return{name:metadata.name,description:instance.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(instance.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var PARENT_AGENT_KEY="parent_agent";function newLoadParentAgentStep(agentLoader,logger2){return{name:"LoadParentAgent",async execute(ctx){let agentId=ctx.input.spec?.agentId??"";logger2.info("Loading parent agent",{agentId});let parentAgent;try{parentAgent=await agentLoader().get(agentId)}catch(error2){throw logger2.warn("Parent agent not found",{agentId,error:error2 instanceof Error?error2.message:String(error2)}),notFoundError("Agent",agentId)}logger2.debug("Loaded parent agent",{agentId,org:parentAgent.metadata?.org??""}),ctx.set(PARENT_AGENT_KEY,parentAgent)}}}var INSTANCE_PARENT_DENIED_MESSAGE="You don't have permission to create instances of this agent",INSTANCE_ORGANIZATION_DENIED_MESSAGE="unauthorized to create agent instance in this organization";function resolveInstanceCreateTargets(ctx){let parent=ctx.get(PARENT_AGENT_KEY);if(parent===void 0)throw new Error("parent agent not found in context");let metadata=ctx.newState.metadata,org=metadata?.org??"",parentId=parent.metadata?.id??"";return isDefaultInstance(metadata)&&isServerComposedRequest(ctx.callerIdentity)&&org===(parent.metadata?.org??"")?[]:[{permission:IamPermission.can_create_agent_instance,resourceKind:ApiResourceKind.organization,resourceId:org,deniedMessage:INSTANCE_ORGANIZATION_DENIED_MESSAGE},{permission:IamPermission.can_create_instance,resourceKind:ApiResourceKind.agent,resourceId:parentId,deniedMessage:INSTANCE_PARENT_DENIED_MESSAGE}]}function newValidateInstanceUpdateStep(){return{name:"ValidateInstanceUpdate",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing agent instance not found in context"),"existing agent instance not found in context");if((ctx.input.spec?.agentId??"")!==(existing.spec?.agentId??""))throw failedPreconditionError(`spec.agent_id is immutable (instance instantiates agent ${existing.spec?.agentId??""}) \u2014 create a new instance for a different agent`)}}}var UPDATE_VISIBILITY_INSTANCE_KEY="updateVisibilityInstance";function newRejectDefaultInstanceVisibilityUpdateStep(store){return{name:"RejectDefaultInstanceVisibilityUpdate",async execute(ctx){let instance=ctx.get(UPDATE_VISIBILITY_INSTANCE_KEY);isDefaultInstance(instance.metadata)&&rejectDefaultInstanceVisibilityUpdate();let parentId=instance.spec?.agentId??"";if(parentId==="")return;let parent;try{parent=await store.getResource(ApiResourceKind.agent,parentId,AgentSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw internalError(error2,"failed to load parent agent for default-instance check")}parent.status?.defaultInstanceId===(instance.metadata?.id??"")&&rejectDefaultInstanceVisibilityUpdate()}}}var LIST_RESULT_KEY="listResult",INSTANCE_LIST_KEY="instanceList";function newListByOrgAndLabelsStep2(store,logger2,listReadScope){return{name:"ListByOrgAndLabels",async execute(ctx){let{org,labels:filterLabels}=ctx.input,rows;try{rows=await store.listResources(ApiResourceKind.agent_instance)}catch(error2){throw internalError(error2,"failed to list agent instances")}let decoded=[];for(let data of rows)try{decoded.push(fromBinary2(AgentInstanceSchema,data))}catch(error2){logger2.warn("Failed to unmarshal agent instance, skipping",{error:error2 instanceof Error?error2.message:String(error2)});continue}let instances=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.agent_instance,decoded.filter(instance=>(instance.metadata?.org??"")===org&&matchesAllLabels(instance.metadata?.labels??{},filterLabels)),"");instances.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),logger2.info("Listed agent instances",{org,matchCount:instances.length,labelFilters:Object.keys(filterLabels).length}),ctx.set(LIST_RESULT_KEY,create2(AgentInstanceListSchema,{totalCount:instances.length,items:instances}))}}}function newLoadByAgentStep(store,listReadScope){return{name:"LoadByAgent",async execute(ctx){let req=ctx.input,agentId=req.agentId;if(agentId==="")throw invalidArgumentError("agent_id is required");let rows;try{rows=await store.listResources(ApiResourceKind.agent_instance)}catch(error2){throw internalError(error2,"failed to list agent instances")}let decoded=[];for(let data of rows)try{decoded.push(fromBinary2(AgentInstanceSchema,data))}catch{continue}let instances=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.agent_instance,decoded.filter(instance=>(instance.spec?.agentId??"")===agentId&&(req.org===""||(instance.metadata?.org??"")===req.org)),"");ctx.set(INSTANCE_LIST_KEY,create2(AgentInstanceListSchema,{totalCount:instances.length,items:instances}))}}}function registerAgentInstanceServices(router,deps){router.service(AgentInstanceCommandController,{apply:(instance,ctx)=>apply3(deps,instance,ctx),create:(instance,ctx)=>createInstance(deps,instance,ctx),update:(instance,ctx)=>update4(deps,instance,ctx),updateVisibility:(input,ctx)=>updateVisibility2(deps,input,ctx),delete:(id,ctx)=>deleteInstance(deps,id,ctx)}),router.service(AgentInstanceQueryController,{get:(id,ctx)=>get5(deps,id,ctx),getByAgent:(req,ctx)=>getByAgent2(deps,req,ctx),getByReference:(ref,ctx)=>getByReference3(deps,ref,ctx),list:(req,ctx)=>list5(deps,req,ctx)})}function kindOf4(ctx){return ctx.values.get(apiResourceKindKey)}async function createInstance(deps,instance,ctx){let reqCtx=new RequestContext(AgentInstanceSchema,instance,callerIdentityOf(ctx),kindOf4(ctx));return await newPipeline("agent-instance-create",deps.logger).addStep(newAuthorizeStep(AgentInstanceCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newLoadParentAgentStep(deps.parentAgentLoader,deps.logger)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveInstanceCreateTargets)).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,agentInstanceSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update4(deps,instance,ctx){let reqCtx=new RequestContext(AgentInstanceSchema,instance,callerIdentityOf(ctx),kindOf4(ctx));return await newPipeline("agent-instance-update",deps.logger).addStep(newAuthorizeStep(AgentInstanceCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateInstanceUpdateStep()).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,agentInstanceSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply3(deps,instance,ctx){let reqCtx=new RequestContext(AgentInstanceSchema,instance,callerIdentityOf(ctx),kindOf4(ctx));await newPipeline("agent-instance-apply",deps.logger).addStep(newAuthorizeStep(AgentInstanceCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createInstance(deps,instance,ctx):update4(deps,withResolvedApplyId(AgentInstanceSchema,instance,reqCtx),ctx)}async function deleteInstance(deps,instanceId,ctx){let reqCtx=new RequestContext(AgentInstanceCommandController.method.delete.input,instanceId,callerIdentityOf(ctx),kindOf4(ctx));await newPipeline("agent-instance-delete",deps.logger).addStep(newAuthorizeStep(AgentInstanceCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,AgentInstanceSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted agent instance not found in context"),"deleted agent instance not found in context");return deleted}async function updateVisibility2(deps,input,ctx){let reqCtx=new RequestContext(AgentInstanceCommandController.method.updateVisibility.input,input,callerIdentityOf(ctx),kindOf4(ctx));return await newPipeline("agent-instance-update-visibility",deps.logger).addStep(newAuthorizeStep(AgentInstanceCommandController.method.updateVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadInstanceForVisibilityUpdateStep(deps.store)).addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_INSTANCE_KEY)).addStep(newRejectDefaultInstanceVisibilityUpdateStep(deps.store)).addStep(newValidateVisibilityUpdateStep()).addStep(newSetInstanceVisibilityStep()).addStep(newPersistInstanceForVisibilityUpdateStep(deps.store)).addStep(newUpdateVisibilityTuplesStep(deps.authorizationLifecycle,UPDATE_VISIBILITY_INSTANCE_KEY)).addStep(newIndexInstanceAfterVisibilityUpdateStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(UPDATE_VISIBILITY_INSTANCE_KEY)}function newLoadInstanceForVisibilityUpdateStep(store){return{name:"LoadInstanceForVisibilityUpdate",async execute(ctx){let input=ctx.input,instance;try{instance=await store.getResource(ApiResourceKind.agent_instance,input.resourceId,AgentInstanceSchema)}catch{throw notFoundError("agent instance",input.resourceId)}ctx.set(UPDATE_VISIBILITY_INSTANCE_KEY,instance)}}}function newSetInstanceVisibilityStep(){return{name:"SetInstanceVisibility",execute(ctx){let instance=ctx.get(UPDATE_VISIBILITY_INSTANCE_KEY);instance.metadata!==void 0&&(instance.metadata.visibility=ctx.input.visibility),setAuditFieldsForUpdate(AgentInstanceSchema,instance,"status_audit",ctx.callerIdentity)}}}function newPersistInstanceForVisibilityUpdateStep(store){return{name:"PersistInstanceForVisibilityUpdate",async execute(ctx){let instance=ctx.get(UPDATE_VISIBILITY_INSTANCE_KEY);try{await store.saveResource(ApiResourceKind.agent_instance,instance.metadata?.id??"",AgentInstanceSchema,instance)}catch(error2){throw internalError(error2,"failed to save agent instance")}}}}function newIndexInstanceAfterVisibilityUpdateStep(store,logger2){return{name:"IndexInstanceAfterVisibilityUpdate",async execute(ctx){let instance=ctx.get(UPDATE_VISIBILITY_INSTANCE_KEY),entry=agentInstanceSearchExtractor.getSearchIndexEntry(instance);if(entry===void 0){logger2.warn("IndexInstanceAfterVisibilityUpdate: extractor returned nil, skipping",{id:instance.metadata?.id??""});return}try{await store.upsertSearchIndex(ApiResourceKind.agent_instance,instance.metadata?.id??"",entry)}catch(error2){logger2.warn("IndexInstanceAfterVisibilityUpdate: failed (best-effort)",{id:instance.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}}}async function get5(deps,id,ctx){let reqCtx=new RequestContext(AgentInstanceQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf4(ctx));return await newPipeline("agent-instance-get",deps.logger).addStep(newAuthorizeStep(AgentInstanceQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadTargetStep(deps.store,AgentInstanceSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByReference3(deps,ref,ctx){let reqCtx=new RequestContext(AgentInstanceQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf4(ctx));return await newPipeline("agent-instance-get-by-reference",deps.logger).addStep(newAuthorizeStep(AgentInstanceQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,AgentInstanceSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(AgentInstanceQueryController.method.get))).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByAgent2(deps,req,ctx){let reqCtx=new RequestContext(AgentInstanceQueryController.method.getByAgent.input,req,callerIdentityOf(ctx),kindOf4(ctx));await newPipeline("agent-instance-get-by-agent",deps.logger).addStep(newAuthorizeStep(AgentInstanceQueryController.method.getByAgent,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByAgentStep(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(INSTANCE_LIST_KEY);if(result===void 0)throw internalError(new Error("instance list not found in context"),"instance list not found in context");return result}async function list5(deps,req,ctx){let reqCtx=new RequestContext(AgentInstanceQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf4(ctx));await newPipeline("agent-instance-list",deps.logger).addStep(newAuthorizeStep(AgentInstanceQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgAndLabelsStep2(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY);if(result===void 0)throw internalError(new Error("agent instance list not found in context"),"agent instance list not found in context");return result}var file_ai_stigmer_agentic_agentchannel_v1_io=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL2lvLnByb3RvEiJhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxIicKDkFnZW50Q2hhbm5lbElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEifAoeR2V0QWdlbnRDaGFubmVsc0J5QWdlbnRSZXF1ZXN0EhgKCGFnZW50X2lkGAEgASgJQga6SAPIAQESMwoJcGFnZV9pbmZvGAIgASgLMiAuYWkuc3RpZ21lci5jb21tb25zLnJwYy5QYWdlSW5mbxILCgNvcmcYAyABKAkiaAoQQWdlbnRDaGFubmVsTGlzdBITCgt0b3RhbF9jb3VudBgBIAEoBRI/CgVpdGVtcxgCIAMoCzIwLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQWdlbnRDaGFubmVsIu4BChhMaXN0QWdlbnRDaGFubmVsc1JlcXVlc3QSFAoDb3JnGAEgASgJQge6SARyAhABElgKBmxhYmVscxgCIAMoCzJILmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuTGlzdEFnZW50Q2hhbm5lbHNSZXF1ZXN0LkxhYmVsc0VudHJ5EjMKCXBhZ2VfaW5mbxgDIAEoCzIgLmFpLnN0aWdtZXIuY29tbW9ucy5ycGMuUGFnZUluZm8aLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASI6ChtJbml0aWF0ZUNoYW5uZWxJbnN0YWxsSW5wdXQSGwoLcmVzb3VyY2VfaWQYASABKAlCBrpIA8gBASJbChxJbml0aWF0ZUNoYW5uZWxJbnN0YWxsT3V0cHV0EhkKEWF1dGhvcml6YXRpb25fdXJsGAEgASgJEg0KBXN0YXRlGAIgASgJEhEKCWNvbXBsZXRlZBgDIAEoCCJnChtDb21wbGV0ZUNoYW5uZWxJbnN0YWxsSW5wdXQSGwoLcmVzb3VyY2VfaWQYASABKAlCBrpIA8gBARIVCgVzdGF0ZRgCIAEoCUIGukgDyAEBEhQKBGNvZGUYAyABKAlCBrpIA8gBAWIGcHJvdG8z",[file_ai_stigmer_agentic_agentchannel_v1_api,file_ai_stigmer_commons_rpc_pagination,file_buf_validate_validate]);var AgentChannelListSchema=messageDesc2(file_ai_stigmer_agentic_agentchannel_v1_io,2);var file_ai_stigmer_agentic_agentchannel_v1_command=fileDesc("CjBhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL2NvbW1hbmQucHJvdG8SImFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEy9AcKHUFnZW50Q2hhbm5lbENvbW1hbmRDb250cm9sbGVyEmsKBWFwcGx5EjAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5BZ2VudENoYW5uZWwaMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbBJyCgZjcmVhdGUSMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbBowLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQWdlbnRDaGFubmVsIgTQuBgBEqkBCgZ1cGRhdGUSMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbBowLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQWdlbnRDaGFubmVsIjvCuBg3CAIQLyILbWV0YWRhdGEuaWQqJHVuYXV0aG9yaXplZCB0byB1cGRhdGUgYWdlbnQgY2hhbm5lbBLSAQoPaW5pdGlhdGVJbnN0YWxsEj8uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5Jbml0aWF0ZUNoYW5uZWxJbnN0YWxsSW5wdXQaQC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkluaXRpYXRlQ2hhbm5lbEluc3RhbGxPdXRwdXQiPMK4GDgIAhAvIgtyZXNvdXJjZV9pZColdW5hdXRob3JpemVkIHRvIGluc3RhbGwgYWdlbnQgY2hhbm5lbBLCAQoPY29tcGxldGVJbnN0YWxsEj8uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5Db21wbGV0ZUNoYW5uZWxJbnN0YWxsSW5wdXQaMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbCI8wrgYOAgCEC8iC3Jlc291cmNlX2lkKiV1bmF1dGhvcml6ZWQgdG8gaW5zdGFsbCBhZ2VudCBjaGFubmVsEqUBCgZkZWxldGUSMi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbElkGjAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5BZ2VudENoYW5uZWwiNcK4GDEIAxAvIgV2YWx1ZSokdW5hdXRob3JpemVkIHRvIGRlbGV0ZSBhZ2VudCBjaGFubmVsGgSg/ysvYgZwcm90bzM",[file_ai_stigmer_agentic_agentchannel_v1_api,file_ai_stigmer_agentic_agentchannel_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentChannelCommandController=serviceDesc(file_ai_stigmer_agentic_agentchannel_v1_command,0);var file_ai_stigmer_agentic_agentchannel_v1_query=fileDesc("Ci5haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL3F1ZXJ5LnByb3RvEiJhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxMtcEChtBZ2VudENoYW5uZWxRdWVyeUNvbnRyb2xsZXISnwEKA2dldBIyLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQWdlbnRDaGFubmVsSWQaMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbCIywrgYLggBEC8iBXZhbHVlKiF1bmF1dGhvcml6ZWQgdG8gZ2V0IGFnZW50IGNoYW5uZWwSfgoOZ2V0QnlSZWZlcmVuY2USNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2UaMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbCIE0LgYARKMAQoKZ2V0QnlBZ2VudBJCLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuR2V0QWdlbnRDaGFubmVsc0J5QWdlbnRSZXF1ZXN0GjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5BZ2VudENoYW5uZWxMaXN0IgTQuBgBEoABCgRsaXN0EjwuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5MaXN0QWdlbnRDaGFubmVsc1JlcXVlc3QaNC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkFnZW50Q2hhbm5lbExpc3QiBNC4GAEaBKD/Ky9iBnByb3RvMw",[file_ai_stigmer_agentic_agentchannel_v1_api,file_ai_stigmer_agentic_agentchannel_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentChannelQueryController=serviceDesc(file_ai_stigmer_agentic_agentchannel_v1_query,0);var INSTALL_UNAVAILABLE_MESSAGE="channel installs require Stigmer Cloud",PROACTIVE_MESSAGING_UNAVAILABLE_MESSAGE="proactive channel messaging requires Stigmer Cloud",CONVERSATION_PARTICIPATION_UNAVAILABLE_MESSAGE="conversation participation requires Stigmer Cloud",NO_DOWNLOADABLE_MEDIA_MESSAGE="no downloadable media at this timeline item",ORG_REQUIRED_MESSAGE="metadata.org is required for an agent channel",AGENT_REF_SLUG_REQUIRED_MESSAGE="spec.agent_ref.slug is required";function sameOrgInvariantMessage(refOrg){return`spec.agent_ref.org must match metadata.org \u2014 an agent channel must live in the referenced agent's organization (${refOrg})`}var APP_REF_REQUIRED_FOR_WHATSAPP_MESSAGE="spec.app_ref is required for WhatsApp channels \u2014 register your Meta app as a channel app and reference it",APP_REF_SAME_ORG_MESSAGE="spec.app_ref.org must match metadata.org \u2014 a channel can only install through its own organization's channel app",APP_REF_FROZEN_WHILE_INSTALLED_MESSAGE="spec.app_ref cannot change while the channel is installed \u2014 the workspace authorized the current app; uninstall or disconnect first, then rebind and re-install";function agentRefImmutableMessage(org,slug){return`spec.agent_ref is immutable (channel connects ${org}/${slug}) \u2014 create a new channel to connect a different agent`}function providerImmutableMessage(existingProvider){return`spec provider is immutable (channel provider is ${existingProvider}) \u2014 create a new channel for a different provider`}function validateChannelModelPin(registry,spec){let reason=unknownModelPinRefusal(registry,"spec.run_config.model_name","",spec?.runConfig?.modelName??"");if(reason!=="")throw invalidArgumentError(reason)}function newResolveChannelDefaultsStep(store,registry,channelRuntime){return{name:"ResolveChannelDefaults",async execute(ctx){let channel=ctx.newState,metadata=channel.metadata;if((metadata?.org??"")==="")throw invalidArgumentError(ORG_REQUIRED_MESSAGE);let agentRef=channel.spec?.agentRef;if((agentRef?.slug??"")==="")throw invalidArgumentError(AGENT_REF_SLUG_REQUIRED_MESSAGE);let refOrg=agentRef.org!==""?agentRef.org:metadata.org;if(refOrg!==metadata.org)throw failedPreconditionError(sameOrgInvariantMessage(refOrg));validateChannelModelPin(registry,channel.spec);let appRef=channel.spec?.appRef;if(channel.spec?.providerConfig.case==="whatsapp"&&(appRef?.slug??"")==="")throw invalidArgumentError(APP_REF_REQUIRED_FOR_WHATSAPP_MESSAGE);if((appRef?.slug??"")!==""){let appRefOrg=appRef.org!==""?appRef.org:metadata.org;if(appRefOrg!==metadata.org)throw failedPreconditionError(APP_REF_SAME_ORG_MESSAGE);appRef.org=appRefOrg}let agent;try{agent=await findResourceBySlug(store,ApiResourceKind.agent,AgentSchema,agentRef.slug,refOrg)}catch(error2){throw internalError(error2,"failed to list agent resources")}if(agent===void 0)throw notFoundError("Agent",agentRef.slug);agentRef.org=refOrg,ctx.set(REFERENCED_AGENT_KEY2,agent),channelRuntime!==void 0&&await channelRuntime.enforceWriteConstraints(ctx.newState)}}}var REFERENCED_AGENT_KEY2="agentChannelReferencedAgent",CHANNEL_CREATE_DENIED_MESSAGE="You don't have permission to connect this agent to a channel";function resolveChannelCreateTargets(ctx){let agent=ctx.get(REFERENCED_AGENT_KEY2);if(agent===void 0)throw new Error("referenced agent not found in context");return[{permission:IamPermission.can_edit,resourceKind:ApiResourceKind.agent,resourceId:agent.metadata?.id??"",deniedMessage:CHANNEL_CREATE_DENIED_MESSAGE}]}function newInitInstallStateStep(){return{name:"InitInstallState",execute(ctx){let channel=ctx.newState,status=channel.status??create2(AgentChannelStatusSchema);status.installState=AgentChannelInstallState.pending_install,channel.status=status}}}function providerFieldName(spec){let arm=spec?.providerConfig.case;return arm===void 0?"":AgentChannelSpecSchema.oneofs.find(o3=>o3.name==="provider_config")?.fields.find(f5=>f5.localName===arm)?.name??arm}function newValidateChannelUpdateStep(registry,channelRuntime){return{name:"ValidateChannelUpdate",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing agent channel not found in context"),"existing agent channel not found in context");let inputRef=ctx.input.spec?.agentRef,existingRef=existing.spec?.agentRef,inputOrg=(inputRef?.org??"")!==""?inputRef.org:existing.metadata?.org??"";if((inputRef?.slug??"")!==(existingRef?.slug??"")||inputOrg!==(existingRef?.org??""))throw failedPreconditionError(agentRefImmutableMessage(existingRef?.org??"",existingRef?.slug??""));let inputProvider=providerFieldName(ctx.input.spec),existingProvider=providerFieldName(existing.spec);if(inputProvider!==existingProvider)throw failedPreconditionError(providerImmutableMessage(existingProvider));validateChannelModelPin(registry,ctx.input.spec),validateAppRefUpdate(ctx,existing),channelRuntime!==void 0&&await channelRuntime.enforceWriteConstraints(ctx.input)}}}function newTeardownChannelRuntimeStep(channelRuntime){return{name:"TeardownChannelRuntime",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing agent channel not found in context"),"existing agent channel not found in context");await channelRuntime.teardownOnDelete(existing,ctx.callerIdentity)}}}function validateAppRefUpdate(ctx,existing){let inputAppRef=ctx.input.spec?.appRef,existingAppRef=existing.spec?.appRef;if(ctx.input.spec?.providerConfig.case==="whatsapp"&&(inputAppRef?.slug??"")==="")throw invalidArgumentError(APP_REF_REQUIRED_FOR_WHATSAPP_MESSAGE);let inputAppOrg="";if((inputAppRef?.slug??"")!==""&&(inputAppOrg=inputAppRef.org!==""?inputAppRef.org:existing.metadata?.org??""),inputAppOrg!==""&&inputAppOrg!==(existing.metadata?.org??""))throw failedPreconditionError(APP_REF_SAME_ORG_MESSAGE);let installed=existing.status?.installState===AgentChannelInstallState.installed,changed=(inputAppRef?.slug??"")!==(existingAppRef?.slug??"")||(inputAppRef?.slug??"")!==""&&inputAppOrg!==(existingAppRef?.org??"");if(installed&&changed)throw failedPreconditionError(APP_REF_FROZEN_WHILE_INSTALLED_MESSAGE)}function registerAgentChannelServices(router,deps){router.service(AgentChannelCommandController,{apply:(channel,ctx)=>apply4(deps,channel,ctx),create:(channel,ctx)=>createChannel(deps,channel,ctx),update:(channel,ctx)=>update5(deps,channel,ctx),initiateInstall:(input,ctx)=>initiateInstall(deps,input,ctx),completeInstall:(input,ctx)=>completeInstall(deps,input,ctx),delete:(channelId,ctx)=>deleteChannel(deps,channelId,ctx)}),router.service(AgentChannelQueryController,{get:(channelId,ctx)=>get6(deps,channelId,ctx),getByReference:(ref,ctx)=>getByReference4(deps,ref,ctx),getByAgent:(req,ctx)=>getByAgent3(deps,req,ctx),list:(req,ctx)=>list6(deps,req,ctx)})}function kindOf5(ctx){return ctx.values.get(apiResourceKindKey)}async function createChannel(deps,channel,ctx){let reqCtx=new RequestContext(AgentChannelSchema,channel,callerIdentityOf(ctx),kindOf5(ctx));return await newPipeline("agent-channel-create",deps.logger).addStep(newAuthorizeStep(AgentChannelCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveChannelDefaultsStep(deps.store,deps.modelRegistry,deps.channelRuntime)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveChannelCreateTargets)).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newInitInstallStateStep()).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update5(deps,channel,ctx){let reqCtx=new RequestContext(AgentChannelSchema,channel,callerIdentityOf(ctx),kindOf5(ctx));return await newPipeline("agent-channel-update",deps.logger).addStep(newAuthorizeStep(AgentChannelCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateChannelUpdateStep(deps.modelRegistry,deps.channelRuntime)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).build().execute(reqCtx),reqCtx.newState}async function apply4(deps,channel,ctx){let reqCtx=new RequestContext(AgentChannelSchema,channel,callerIdentityOf(ctx),kindOf5(ctx));await newPipeline("agent-channel-apply",deps.logger).addStep(newAuthorizeStep(AgentChannelCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveChannelDefaultsStep(deps.store,deps.modelRegistry,deps.channelRuntime)).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");let resolved=reqCtx.newState;return shouldCreate?createChannel(deps,resolved,ctx):update5(deps,resolved,ctx)}async function initiateInstall(deps,input,ctx){let channel=await loadChannelForInstall(deps,ctx,input.resourceId);if(await authorizeDirect(AgentChannelCommandController.method.initiateInstall,deps.authorizer,callerIdentityOf(ctx),input),deps.channelRuntime===void 0)throw failedPreconditionError(INSTALL_UNAVAILABLE_MESSAGE);return deps.channelRuntime.installs.initiateInstall(channel,input,callerIdentityOf(ctx))}async function completeInstall(deps,input,ctx){let channel=await loadChannelForInstall(deps,ctx,input.resourceId);if(await authorizeDirect(AgentChannelCommandController.method.completeInstall,deps.authorizer,callerIdentityOf(ctx),input),deps.channelRuntime===void 0)throw failedPreconditionError(INSTALL_UNAVAILABLE_MESSAGE);return deps.channelRuntime.installs.completeInstall(channel,input,callerIdentityOf(ctx))}async function loadChannelForInstall(deps,ctx,resourceId){try{return await deps.store.getResource(kindOf5(ctx),resourceId,AgentChannelSchema)}catch{throw notFoundError("AgentChannel",resourceId)}}async function deleteChannel(deps,channelId,ctx){let reqCtx=new RequestContext(AgentChannelCommandController.method.delete.input,channelId,callerIdentityOf(ctx),kindOf5(ctx)),pipeline2=newPipeline("agent-channel-delete",deps.logger).addStep(newAuthorizeStep(AgentChannelCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,AgentChannelSchema));deps.channelRuntime!==void 0&&pipeline2.addStep(newTeardownChannelRuntimeStep(deps.channelRuntime)),await pipeline2.addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted agent channel not found in context"),"deleted agent channel not found in context");return deleted}async function get6(deps,channelId,ctx){let reqCtx=new RequestContext(AgentChannelQueryController.method.get.input,channelId,callerIdentityOf(ctx),kindOf5(ctx));return await newPipeline("agent-channel-get",deps.logger).addStep(newAuthorizeStep(AgentChannelQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,AgentChannelSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByReference4(deps,ref,ctx){let reqCtx=new RequestContext(AgentChannelQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf5(ctx));return await newPipeline("agent-channel-get-by-reference",deps.logger).addStep(newAuthorizeStep(AgentChannelQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,AgentChannelSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(AgentChannelQueryController.method.get))).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var CHANNEL_LIST_KEY="agentChannelList";async function getByAgent3(deps,req,ctx){let reqCtx=new RequestContext(AgentChannelQueryController.method.getByAgent.input,req,callerIdentityOf(ctx),kindOf5(ctx));await newPipeline("agent-channel-get-by-agent",deps.logger).addStep(newAuthorizeStep(AgentChannelQueryController.method.getByAgent,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadChannelsByAgentStep(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(CHANNEL_LIST_KEY);if(result===void 0)throw internalError(new Error("agent channel list not found in context"),"agent channel list not found in context");return result}function newLoadChannelsByAgentStep(store,listReadScope){return{name:"LoadChannelsByAgent",async execute(ctx){let req=ctx.input,emptyList=create2(AgentChannelListSchema,{totalCount:0,items:[]}),agentOrg,agentSlug;try{let agent=await store.getResource(ApiResourceKind.agent,req.agentId,AgentSchema);agentOrg=agent.metadata?.org??"",agentSlug=agent.metadata?.slug??""}catch{ctx.set(CHANNEL_LIST_KEY,emptyList);return}let rows;try{rows=await store.listResources(ApiResourceKind.agent_channel)}catch(error2){throw internalError(error2,"failed to list agent channels")}let decoded=[];for(let bytes of rows)try{decoded.push(fromBinary2(AgentChannelSchema,bytes))}catch{continue}let channels=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.agent_channel,decoded.filter(channel=>{let ref=channel.spec?.agentRef;return(ref?.org??"")===agentOrg&&(ref?.slug??"")===agentSlug&&(req.org===""||(channel.metadata?.org??"")===req.org)}),"");ctx.set(CHANNEL_LIST_KEY,create2(AgentChannelListSchema,{totalCount:channels.length,items:channels}))}}}var LIST_RESULT_KEY2="listResult";async function list6(deps,req,ctx){let reqCtx=new RequestContext(AgentChannelQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf5(ctx));await newPipeline("agent-channel-list",deps.logger).addStep(newAuthorizeStep(AgentChannelQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgAndLabelsStep3(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY2);if(result===void 0)throw internalError(new Error("agent channel list not found in context"),"agent channel list not found in context");return result}function newListByOrgAndLabelsStep3(store,listReadScope){return{name:"ListByOrgAndLabels",async execute(ctx){let{org,labels:filterLabels}=ctx.input,rows;try{rows=await store.listResources(ctx.apiResourceKind)}catch(error2){throw internalError(error2,"failed to list agent channels")}let decoded=[];for(let bytes of rows)try{decoded.push(fromBinary2(AgentChannelSchema,bytes))}catch{continue}let channels=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.agent_channel,decoded.filter(channel=>(channel.metadata?.org??"")===org&&matchesAllLabels(channel.metadata?.labels??{},filterLabels)),"");channels.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(LIST_RESULT_KEY2,create2(AgentChannelListSchema,{totalCount:channels.length,items:channels}))}}}var file_ai_stigmer_agentic_agentchannel_v1_delivery=fileDesc("CjFhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL2RlbGl2ZXJ5LnByb3RvEiJhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxIvwFCg9DaGFubmVsRGVsaXZlcnkSEwoLZGVsaXZlcnlfaWQYASABKAkSGAoQYWdlbnRfY2hhbm5lbF9pZBgCIAEoCRILCgNvcmcYAyABKAkSFAoMZXhlY3V0aW9uX2lkGAQgASgJEhIKCnNlc3Npb25faWQYBSABKAkSGAoQY29udmVyc2F0aW9uX2tleRgGIAEoCRIZChFleHRlcm5hbF91c2VyX2tleRgHIAEoCRJJCgZzdGF0dXMYCCABKA4yOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNoYW5uZWxEZWxpdmVyeVN0YXR1cxIQCghhdHRlbXB0cxgJIAEoBRISCgpsYXN0X2Vycm9yGAogASgJEhcKD2lkZW1wb3RlbmN5X2tleRgLIAEoCRJJCgVzbGFjaxgMIAEoCzI4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuU2xhY2tEZWxpdmVyeUNvbnRleHRIABJPCgh3aGF0c2FwcBgQIAEoCzI7LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuV2hhdHNBcHBEZWxpdmVyeUNvbnRleHRIABIuCgpjcmVhdGVkX2F0GA0gASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIuCgp1cGRhdGVkX2F0GA4gASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIzCg9uZXh0X2F0dGVtcHRfYXQYDyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhIKCnJlcGx5X3RleHQYESABKAkSUwoMZmFpbHVyZV9raW5kGBIgASgOMj0uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5DaGFubmVsQXR0ZW1wdEZhaWx1cmVLaW5kEhYKDmF0dGVtcHRfZGV0YWlsGBMgASgJQhIKEGRlbGl2ZXJ5X2NvbnRleHQiVQoUU2xhY2tEZWxpdmVyeUNvbnRleHQSEgoKY2hhbm5lbF9pZBgBIAEoCRIRCgl0aHJlYWRfdHMYAiABKAkSFgoOcGxhY2Vob2xkZXJfdHMYAyABKAkiSwoXV2hhdHNBcHBEZWxpdmVyeUNvbnRleHQSFwoPcGhvbmVfbnVtYmVyX2lkGAEgASgJEhcKD3JlY2lwaWVudF93YV9pZBgCIAEoCSqIAQoVQ2hhbm5lbERlbGl2ZXJ5U3RhdHVzEicKI2NoYW5uZWxfZGVsaXZlcnlfc3RhdHVzX3Vuc3BlY2lmaWVkEAASCwoHcGVuZGluZxABEg4KCmRlbGl2ZXJpbmcQAhINCglkZWxpdmVyZWQQAxIKCgZmYWlsZWQQBBIOCgpzdXBwcmVzc2VkEAUqfQoZQ2hhbm5lbEF0dGVtcHRGYWlsdXJlS2luZBIfChthdHRlbXB0X2ZhaWx1cmVfdW5zcGVjaWZpZWQQABITCg9hdHRlbXB0X3JlZnVzZWQQARITCg9hdHRlbXB0X2Vycm9yZWQQAhIVChFhdHRlbXB0X3dpdGhkcmF3bhADYgZwcm90bzM",[file_google_protobuf_timestamp]);var ChannelDeliveryStatus;(function(ChannelDeliveryStatus2){ChannelDeliveryStatus2[ChannelDeliveryStatus2.channel_delivery_status_unspecified=0]="channel_delivery_status_unspecified",ChannelDeliveryStatus2[ChannelDeliveryStatus2.pending=1]="pending",ChannelDeliveryStatus2[ChannelDeliveryStatus2.delivering=2]="delivering",ChannelDeliveryStatus2[ChannelDeliveryStatus2.delivered=3]="delivered",ChannelDeliveryStatus2[ChannelDeliveryStatus2.failed=4]="failed",ChannelDeliveryStatus2[ChannelDeliveryStatus2.suppressed=5]="suppressed"})(ChannelDeliveryStatus||(ChannelDeliveryStatus={}));var ChannelAttemptFailureKind;(function(ChannelAttemptFailureKind2){ChannelAttemptFailureKind2[ChannelAttemptFailureKind2.attempt_failure_unspecified=0]="attempt_failure_unspecified",ChannelAttemptFailureKind2[ChannelAttemptFailureKind2.attempt_refused=1]="attempt_refused",ChannelAttemptFailureKind2[ChannelAttemptFailureKind2.attempt_errored=2]="attempt_errored",ChannelAttemptFailureKind2[ChannelAttemptFailureKind2.attempt_withdrawn=3]="attempt_withdrawn"})(ChannelAttemptFailureKind||(ChannelAttemptFailureKind={}));var file_ai_stigmer_agentic_agentchannel_v1_message_io=fileDesc("CjNhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL21lc3NhZ2VfaW8ucHJvdG8SImFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEivQEKF1NlbmRDaGFubmVsTWVzc2FnZUlucHV0EhgKB2NoYW5uZWwYASABKAlCB7pIBHICGD8SFAoDb3JnGAIgASgJQge6SARyAhg/Eh0KCXJlY2lwaWVudBgDIAEoCUIKukgHcgUQARiAARJTCgdwYXlsb2FkGAQgASgLMjouYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5DaGFubmVsT3V0Ym91bmRQYXlsb2FkQga6SAPIAQEisQEKFkNoYW5uZWxPdXRib3VuZFBheWxvYWQSPwoEdGV4dBgBIAEoCzIvLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuVGV4dFBheWxvYWRIABJHCgh0ZW1wbGF0ZRgCIAEoCzIzLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuVGVtcGxhdGVQYXlsb2FkSABCDQoEa2luZBIFukgCCAEiJwoLVGV4dFBheWxvYWQSGAoEYm9keRgBIAEoCUIKukgHcgUQARiAICKBAgoPVGVtcGxhdGVQYXlsb2FkEhgKBG5hbWUYASABKAlCCrpIB3IFEAEYgAQSGQoIbGFuZ3VhZ2UYAiABKAlCB7pIBHICGBASYQoKcGFyYW1ldGVycxgDIAMoCzJDLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuVGVtcGxhdGVQYXlsb2FkLlBhcmFtZXRlcnNFbnRyeUIIukgFmgECEDISIwoRaGVhZGVyX2ltYWdlX2xpbmsYBCABKAlCCLpIBXIDGIAQGjEKD1BhcmFtZXRlcnNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIq0BChhTZW5kQ2hhbm5lbE1lc3NhZ2VPdXRwdXQSRwoHb3V0Y29tZRgBIAEoDjI2LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQ2hhbm5lbFNlbmRPdXRjb21lEhsKE291dGJvdW5kX21lc3NhZ2VfaWQYAiABKAkSGwoTcHJvdmlkZXJfbWVzc2FnZV9pZBgDIAEoCRIOCgZkZXRhaWwYBCABKAkiYgoZTGlzdENoYW5uZWxUZW1wbGF0ZXNJbnB1dBIYCgdjaGFubmVsGAEgASgJQge6SARyAhg/EhQKA29yZxgCIAEoCUIHukgEcgIYPxIVCg1hcHByb3ZlZF9vbmx5GAMgASgIIlgKEENoYW5uZWxUZW1wbGF0ZXMSRAoHZW50cmllcxgBIAMoCzIzLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQ2hhbm5lbFRlbXBsYXRlIuYBCg9DaGFubmVsVGVtcGxhdGUSDAoEbmFtZRgBIAEoCRIQCghsYW5ndWFnZRgCIAEoCRIQCghjYXRlZ29yeRgDIAEoCRIOCgZzdGF0dXMYBCABKAkSGAoQcGFyYW1ldGVyX2Zvcm1hdBgFIAEoCRIXCg9wYXJhbWV0ZXJfbmFtZXMYBiADKAkSEQoJYm9keV90ZXh0GAcgASgJEhUKDWhlYWRlcl9mb3JtYXQYCCABKAkSGAoQcmVqZWN0aW9uX3JlYXNvbhgJIAEoCRIaChJ1bnN1cHBvcnRlZF9yZWFzb24YCiABKAkiHAoaTGlzdE1lc3NhZ2luZ0NoYW5uZWxzSW5wdXQiWgoRTWVzc2FnaW5nQ2hhbm5lbHMSRQoHZW50cmllcxgBIAMoCzI0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuTWVzc2FnaW5nQ2hhbm5lbCI1ChBNZXNzYWdpbmdDaGFubmVsEg8KB2NoYW5uZWwYASABKAkSEAoIcHJvdmlkZXIYAiABKAkqYQoSQ2hhbm5lbFNlbmRPdXRjb21lEiQKIGNoYW5uZWxfc2VuZF9vdXRjb21lX3Vuc3BlY2lmaWVkEAASDAoIYWNjZXB0ZWQQARIKCgZxdWV1ZWQQAhILCgdyZWZ1c2VkEANiBnByb3RvMw",[file_buf_validate_validate]);var MessagingChannelsSchema=messageDesc2(file_ai_stigmer_agentic_agentchannel_v1_message_io,9);var ChannelSendOutcome;(function(ChannelSendOutcome2){ChannelSendOutcome2[ChannelSendOutcome2.channel_send_outcome_unspecified=0]="channel_send_outcome_unspecified",ChannelSendOutcome2[ChannelSendOutcome2.accepted=1]="accepted",ChannelSendOutcome2[ChannelSendOutcome2.queued=2]="queued",ChannelSendOutcome2[ChannelSendOutcome2.refused=3]="refused"})(ChannelSendOutcome||(ChannelSendOutcome={}));var file_ai_stigmer_agentic_agentchannel_v1_outbound=fileDesc("CjFhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL291dGJvdW5kLnByb3RvEiJhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxIo8HChZDaGFubmVsT3V0Ym91bmRNZXNzYWdlEhsKE291dGJvdW5kX21lc3NhZ2VfaWQYASABKAkSGAoQYWdlbnRfY2hhbm5lbF9pZBgCIAEoCRILCgNvcmcYAyABKAkSEgoKc2Vzc2lvbl9pZBgEIAEoCRJJCgZvcmlnaW4YBSABKA4yOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNoYW5uZWxPdXRib3VuZE9yaWdpbhIRCglyZWNpcGllbnQYBiABKAkSSwoHcGF5bG9hZBgHIAEoCzI6LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQ2hhbm5lbE91dGJvdW5kUGF5bG9hZBJJCgZzdGF0dXMYCCABKA4yOS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNoYW5uZWxEZWxpdmVyeVN0YXR1cxIQCghhdHRlbXB0cxgJIAEoBRISCgpsYXN0X2Vycm9yGAogASgJEhcKD2lkZW1wb3RlbmN5X2tleRgLIAEoCRIbChNwcm92aWRlcl9tZXNzYWdlX2lkGAwgASgJEi4KCmNyZWF0ZWRfYXQYDSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi4KCnVwZGF0ZWRfYXQYDiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjMKD25leHRfYXR0ZW1wdF9hdBgPIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASTgoNcmVjZWlwdF9zdGF0ZRgQIAEoDjI3LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQ2hhbm5lbFJlY2VpcHRTdGF0ZRIWCg5yZWNlaXB0X2RldGFpbBgRIAEoCRIaChJyZWNlaXB0X2Vycm9yX2NvZGUYEiABKAUSLgoKcmVjZWlwdF9hdBgTIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASFQoNcmVuZGVyZWRfYm9keRgUIAEoCRJTCgxmYWlsdXJlX2tpbmQYFSABKA4yPS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNoYW5uZWxBdHRlbXB0RmFpbHVyZUtpbmQSFgoOYXR0ZW1wdF9kZXRhaWwYFiABKAkqgwEKE0NoYW5uZWxSZWNlaXB0U3RhdGUSHQoZcmVjZWlwdF9zdGF0ZV91bnNwZWNpZmllZBAAEhAKDHJlY2VpcHRfc2VudBABEhUKEXJlY2VpcHRfZGVsaXZlcmVkEAISEAoMcmVjZWlwdF9yZWFkEAMSEgoOcmVjZWlwdF9mYWlsZWQQBCqHAQoVQ2hhbm5lbE91dGJvdW5kT3JpZ2luEicKI2NoYW5uZWxfb3V0Ym91bmRfb3JpZ2luX3Vuc3BlY2lmaWVkEAASGAoUY2hhbm5lbF9jb252ZXJzYXRpb24QARIMCghvcGVyYXRvchACEgwKCHBsYXRmb3JtEAMSDwoLcGFydGljaXBhbnQQBGIGcHJvdG8z",[file_ai_stigmer_agentic_agentchannel_v1_delivery,file_ai_stigmer_agentic_agentchannel_v1_message_io,file_google_protobuf_timestamp]);var ChannelReceiptState;(function(ChannelReceiptState2){ChannelReceiptState2[ChannelReceiptState2.receipt_state_unspecified=0]="receipt_state_unspecified",ChannelReceiptState2[ChannelReceiptState2.receipt_sent=1]="receipt_sent",ChannelReceiptState2[ChannelReceiptState2.receipt_delivered=2]="receipt_delivered",ChannelReceiptState2[ChannelReceiptState2.receipt_read=3]="receipt_read",ChannelReceiptState2[ChannelReceiptState2.receipt_failed=4]="receipt_failed"})(ChannelReceiptState||(ChannelReceiptState={}));var ChannelOutboundOrigin;(function(ChannelOutboundOrigin2){ChannelOutboundOrigin2[ChannelOutboundOrigin2.channel_outbound_origin_unspecified=0]="channel_outbound_origin_unspecified",ChannelOutboundOrigin2[ChannelOutboundOrigin2.channel_conversation=1]="channel_conversation",ChannelOutboundOrigin2[ChannelOutboundOrigin2.operator=2]="operator",ChannelOutboundOrigin2[ChannelOutboundOrigin2.platform=3]="platform",ChannelOutboundOrigin2[ChannelOutboundOrigin2.participant=4]="participant"})(ChannelOutboundOrigin||(ChannelOutboundOrigin={}));var file_ai_stigmer_agentic_agentchannel_v1_conversation_io=fileDesc("CjhhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL2NvbnZlcnNhdGlvbl9pby5wcm90bxIiYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MSL+AwoTQ2hhbm5lbENvbnZlcnNhdGlvbhIYChBhZ2VudF9jaGFubmVsX2lkGAEgASgJEhgKEGNvbnZlcnNhdGlvbl9rZXkYAiABKAkSCwoDb3JnGAMgASgJEkgKB2NvbnRyb2wYBCABKA4yNy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNvbnZlcnNhdGlvbkNvbnRyb2wSFQoNY29udHJvbGxlZF9ieRgFIAEoCRI2ChJjb250cm9sX2NoYW5nZWRfYXQYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhcKD25lZWRzX2F0dGVudGlvbhgHIAEoCBIYChBhdHRlbnRpb25fcmVhc29uGAggASgJEjgKFGF0dGVudGlvbl9jaGFuZ2VkX2F0GAkgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIUCgxkaXNwbGF5X25hbWUYCiABKAkSPAoYbGFzdF9jdXN0b21lcl9tZXNzYWdlX2F0GAsgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBI0ChBsYXN0X2FjdGl2aXR5X2F0GAwgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIWCg5hd2FpdGluZ19yZXBseRgNIAEoCCKGBgoYQ29udmVyc2F0aW9uVGltZWxpbmVJdGVtEg8KB2l0ZW1faWQYASABKAkSQgoEbGFuZRgCIAEoDjI0LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQ29udmVyc2F0aW9uTGFuZRJKCgZhdXRob3IYAyABKA4yOi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNvbnZlcnNhdGlvbkl0ZW1BdXRob3ISEwoLYXV0aG9yZWRfYnkYBCABKAkSDAoEdGV4dBgFIAEoCRIdChVwcm92aWRlcl9tZXNzYWdlX3R5cGUYBiABKAkSJgoCYXQYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wElIKD2RlbGl2ZXJ5X3N0YXR1cxgIIAEoDjI5LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQ2hhbm5lbERlbGl2ZXJ5U3RhdHVzEk4KDXJlY2VpcHRfc3RhdGUYCSABKA4yNy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNoYW5uZWxSZWNlaXB0U3RhdGUSSQoGb3JpZ2luGAogASgOMjkuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5DaGFubmVsT3V0Ym91bmRPcmlnaW4SFgoOcmVjZWlwdF9kZXRhaWwYCyABKAkSGgoScmVjZWlwdF9lcnJvcl9jb2RlGAwgASgFEkcKBW1lZGlhGA0gASgLMjguYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5Db252ZXJzYXRpb25NZWRpYVJlZhIWCg5hdHRlbXB0X2RldGFpbBgOIAEoCRJbChRhdHRlbXB0X2ZhaWx1cmVfa2luZBgPIAEoDjI9LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQ2hhbm5lbEF0dGVtcHRGYWlsdXJlS2luZCJSChRDb252ZXJzYXRpb25NZWRpYVJlZhIQCghmaWxlbmFtZRgBIAEoCRIUCgxjb250ZW50X3R5cGUYAiABKAkSEgoKc2l6ZV9ieXRlcxgDIAEoAyLjAQodTGlzdENoYW5uZWxDb252ZXJzYXRpb25zSW5wdXQSFgoDb3JnGAEgASgJQgm6SAZyBBABGD8SIgoQYWdlbnRfY2hhbm5lbF9pZBgCIAEoCUIIukgFcgMYgAESMwoJcGFnZV9pbmZvGAMgASgLMiAuYWkuc3RpZ21lci5jb21tb25zLnJwYy5QYWdlSW5mbxJRCgZmaWx0ZXIYBCABKA4yQS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNoYW5uZWxDb252ZXJzYXRpb25MaXN0RmlsdGVyInYKF0NoYW5uZWxDb252ZXJzYXRpb25MaXN0EhMKC3RvdGFsX2NvdW50GAEgASgFEkYKBWl0ZW1zGAIgAygLMjcuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5DaGFubmVsQ29udmVyc2F0aW9uImkKG0dldENoYW5uZWxDb252ZXJzYXRpb25JbnB1dBIkChBhZ2VudF9jaGFubmVsX2lkGAEgASgJQgq6SAdyBRABGIABEiQKEGNvbnZlcnNhdGlvbl9rZXkYAiABKAlCCrpIB3IFEAEYgAEikQEKHEdldENvbnZlcnNhdGlvblRpbWVsaW5lSW5wdXQSJAoQYWdlbnRfY2hhbm5lbF9pZBgBIAEoCUIKukgHcgUQARiAARIkChBjb252ZXJzYXRpb25fa2V5GAIgASgJQgq6SAdyBRABGIABEhEKCXBhZ2Vfc2l6ZRgDIAEoBRISCgpwYWdlX3Rva2VuGAQgASgJInwKFENvbnZlcnNhdGlvblRpbWVsaW5lEksKBWl0ZW1zGAEgAygLMjwuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5Db252ZXJzYXRpb25UaW1lbGluZUl0ZW0SFwoPbmV4dF9wYWdlX3Rva2VuGAIgASgJIo8BCiRHZXRDb252ZXJzYXRpb25NZWRpYURvd25sb2FkVXJsSW5wdXQSJAoQYWdlbnRfY2hhbm5lbF9pZBgBIAEoCUIKukgHcgUQARiAARIkChBjb252ZXJzYXRpb25fa2V5GAIgASgJQgq6SAdyBRABGIABEhsKB2l0ZW1faWQYAyABKAlCCrpIB3IFEAEYgAIiWwocQ29udmVyc2F0aW9uTWVkaWFEb3dubG9hZFVybBILCgN1cmwYASABKAkSLgoKZXhwaXJlc19hdBgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiZgoYQ29udmVyc2F0aW9uQ29udHJvbElucHV0EiQKEGFnZW50X2NoYW5uZWxfaWQYASABKAlCCrpIB3IFEAEYgAESJAoQY29udmVyc2F0aW9uX2tleRgCIAEoCUIKukgHcgUQARiAASK7AQoYUmVwbHlUb0NvbnZlcnNhdGlvbklucHV0EiQKEGFnZW50X2NoYW5uZWxfaWQYASABKAlCCrpIB3IFEAEYgAESJAoQY29udmVyc2F0aW9uX2tleRgCIAEoCUIKukgHcgUQARiAARJTCgdwYXlsb2FkGAMgASgLMjouYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5DaGFubmVsT3V0Ym91bmRQYXlsb2FkQga6SAPIAQEiNwoZRXNjYWxhdGVDb252ZXJzYXRpb25JbnB1dBIaCgZyZWFzb24YASABKAlCCrpIB3IFEAEYgAgqYQoTQ29udmVyc2F0aW9uQ29udHJvbBIkCiBjb252ZXJzYXRpb25fY29udHJvbF91bnNwZWNpZmllZBAAEhEKDWNvbnRyb2xfYWdlbnQQARIRCg1jb250cm9sX2h1bWFuEAIqWQoQQ29udmVyc2F0aW9uTGFuZRIhCh1jb252ZXJzYXRpb25fbGFuZV91bnNwZWNpZmllZBAAEg8KC2xhbmVfcHVibGljEAESEQoNbGFuZV9pbnRlcm5hbBACKpMBChZDb252ZXJzYXRpb25JdGVtQXV0aG9yEigKJGNvbnZlcnNhdGlvbl9pdGVtX2F1dGhvcl91bnNwZWNpZmllZBAAEhMKD2F1dGhvcl9jdXN0b21lchABEhAKDGF1dGhvcl9hZ2VudBACEhMKD2F1dGhvcl90ZWFtbWF0ZRADEhMKD2F1dGhvcl9wbGF0Zm9ybRAEKmkKHUNoYW5uZWxDb252ZXJzYXRpb25MaXN0RmlsdGVyEjAKLGNoYW5uZWxfY29udmVyc2F0aW9uX2xpc3RfZmlsdGVyX3Vuc3BlY2lmaWVkEAASFgoSZmlsdGVyX3dhbnRzX2h1bWFuEAFiBnByb3RvMw",[file_ai_stigmer_agentic_agentchannel_v1_delivery,file_ai_stigmer_agentic_agentchannel_v1_message_io,file_ai_stigmer_agentic_agentchannel_v1_outbound,file_ai_stigmer_commons_rpc_pagination,file_buf_validate_validate,file_google_protobuf_timestamp]);var ChannelConversationListSchema=messageDesc2(file_ai_stigmer_agentic_agentchannel_v1_conversation_io,4);var ConversationTimelineSchema=messageDesc2(file_ai_stigmer_agentic_agentchannel_v1_conversation_io,7);var ConversationControl;(function(ConversationControl2){ConversationControl2[ConversationControl2.conversation_control_unspecified=0]="conversation_control_unspecified",ConversationControl2[ConversationControl2.control_agent=1]="control_agent",ConversationControl2[ConversationControl2.control_human=2]="control_human"})(ConversationControl||(ConversationControl={}));var ConversationLane;(function(ConversationLane2){ConversationLane2[ConversationLane2.conversation_lane_unspecified=0]="conversation_lane_unspecified",ConversationLane2[ConversationLane2.lane_public=1]="lane_public",ConversationLane2[ConversationLane2.lane_internal=2]="lane_internal"})(ConversationLane||(ConversationLane={}));var ConversationItemAuthor;(function(ConversationItemAuthor2){ConversationItemAuthor2[ConversationItemAuthor2.conversation_item_author_unspecified=0]="conversation_item_author_unspecified",ConversationItemAuthor2[ConversationItemAuthor2.author_customer=1]="author_customer",ConversationItemAuthor2[ConversationItemAuthor2.author_agent=2]="author_agent",ConversationItemAuthor2[ConversationItemAuthor2.author_teammate=3]="author_teammate",ConversationItemAuthor2[ConversationItemAuthor2.author_platform=4]="author_platform"})(ConversationItemAuthor||(ConversationItemAuthor={}));var ChannelConversationListFilter;(function(ChannelConversationListFilter2){ChannelConversationListFilter2[ChannelConversationListFilter2.channel_conversation_list_filter_unspecified=0]="channel_conversation_list_filter_unspecified",ChannelConversationListFilter2[ChannelConversationListFilter2.filter_wants_human=1]="filter_wants_human"})(ChannelConversationListFilter||(ChannelConversationListFilter={}));var file_ai_stigmer_agentic_agentchannel_v1_conversation_command=fileDesc("Cj1haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL2NvbnZlcnNhdGlvbl9jb21tYW5kLnByb3RvEiJhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxMrcICiRDaGFubmVsQ29udmVyc2F0aW9uQ29tbWFuZENvbnRyb2xsZXIS3QEKBXJlcGx5EjwuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5SZXBseVRvQ29udmVyc2F0aW9uSW5wdXQaPC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLlNlbmRDaGFubmVsTWVzc2FnZU91dHB1dCJYwrgYVAgkEC8iEGFnZW50X2NoYW5uZWxfaWQqPHVuYXV0aG9yaXplZCB0byBwYXJ0aWNpcGF0ZSBpbiBjb252ZXJzYXRpb25zIG9uIHRoaXMgY2hhbm5lbBLbAQoIdGFrZU92ZXISPC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNvbnZlcnNhdGlvbkNvbnRyb2xJbnB1dBo3LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQ2hhbm5lbENvbnZlcnNhdGlvbiJYwrgYVAgkEC8iEGFnZW50X2NoYW5uZWxfaWQqPHVuYXV0aG9yaXplZCB0byBwYXJ0aWNpcGF0ZSBpbiBjb252ZXJzYXRpb25zIG9uIHRoaXMgY2hhbm5lbBLbAQoIaGFuZEJhY2sSPC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNvbnZlcnNhdGlvbkNvbnRyb2xJbnB1dBo3LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQ2hhbm5lbENvbnZlcnNhdGlvbiJYwrgYVAgkEC8iEGFnZW50X2NoYW5uZWxfaWQqPHVuYXV0aG9yaXplZCB0byBwYXJ0aWNpcGF0ZSBpbiBjb252ZXJzYXRpb25zIG9uIHRoaXMgY2hhbm5lbBLhAQoOY2xlYXJBdHRlbnRpb24SPC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNvbnZlcnNhdGlvbkNvbnRyb2xJbnB1dBo3LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQ2hhbm5lbENvbnZlcnNhdGlvbiJYwrgYVAgkEC8iEGFnZW50X2NoYW5uZWxfaWQqPHVuYXV0aG9yaXplZCB0byBwYXJ0aWNpcGF0ZSBpbiBjb252ZXJzYXRpb25zIG9uIHRoaXMgY2hhbm5lbBKIAQoIZXNjYWxhdGUSPS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkVzY2FsYXRlQ29udmVyc2F0aW9uSW5wdXQaNy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNoYW5uZWxDb252ZXJzYXRpb24iBNC4GAEaBKD/Ky9iBnByb3RvMw",[file_ai_stigmer_agentic_agentchannel_v1_conversation_io,file_ai_stigmer_agentic_agentchannel_v1_message_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ChannelConversationCommandController=serviceDesc(file_ai_stigmer_agentic_agentchannel_v1_conversation_command,0);var file_ai_stigmer_agentic_agentchannel_v1_conversation_query=fileDesc("CjthaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL2NvbnZlcnNhdGlvbl9xdWVyeS5wcm90bxIiYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MTL0BgoiQ2hhbm5lbENvbnZlcnNhdGlvblF1ZXJ5Q29udHJvbGxlchKZAQoRbGlzdENvbnZlcnNhdGlvbnMSQS5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkxpc3RDaGFubmVsQ29udmVyc2F0aW9uc0lucHV0GjsuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5DaGFubmVsQ29udmVyc2F0aW9uTGlzdCIE0LgYARLbAQoPZ2V0Q29udmVyc2F0aW9uEj8uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5HZXRDaGFubmVsQ29udmVyc2F0aW9uSW5wdXQaNy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNoYW5uZWxDb252ZXJzYXRpb24iTsK4GEoIARAvIhBhZ2VudF9jaGFubmVsX2lkKjJ1bmF1dGhvcml6ZWQgdG8gdmlldyBjb252ZXJzYXRpb25zIG9uIHRoaXMgY2hhbm5lbBLZAQoLZ2V0VGltZWxpbmUSQC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkdldENvbnZlcnNhdGlvblRpbWVsaW5lSW5wdXQaOC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkNvbnZlcnNhdGlvblRpbWVsaW5lIk7CuBhKCAEQLyIQYWdlbnRfY2hhbm5lbF9pZCoydW5hdXRob3JpemVkIHRvIHZpZXcgY29udmVyc2F0aW9ucyBvbiB0aGlzIGNoYW5uZWwS8QEKE2dldE1lZGlhRG93bmxvYWRVcmwSSC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkdldENvbnZlcnNhdGlvbk1lZGlhRG93bmxvYWRVcmxJbnB1dBpALmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEuQ29udmVyc2F0aW9uTWVkaWFEb3dubG9hZFVybCJOwrgYSggBEC8iEGFnZW50X2NoYW5uZWxfaWQqMnVuYXV0aG9yaXplZCB0byB2aWV3IGNvbnZlcnNhdGlvbnMgb24gdGhpcyBjaGFubmVsGgSg/ysvYgZwcm90bzM",[file_ai_stigmer_agentic_agentchannel_v1_conversation_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ChannelConversationQueryController=serviceDesc(file_ai_stigmer_agentic_agentchannel_v1_conversation_query,0);function registerChannelConversationServices(router,channelRuntime){if(channelRuntime===void 0){router.service(ChannelConversationQueryController,{listConversations:()=>create2(ChannelConversationListSchema),getTimeline:()=>create2(ConversationTimelineSchema),getConversation:input=>{throw notFoundError("channel conversation",input.conversationKey)},getMediaDownloadUrl:()=>{throw new ConnectError(NO_DOWNLOADABLE_MEDIA_MESSAGE,Code.NotFound)}}),router.service(ChannelConversationCommandController,{reply:()=>{throw failedPreconditionError(CONVERSATION_PARTICIPATION_UNAVAILABLE_MESSAGE)},takeOver:()=>{throw failedPreconditionError(CONVERSATION_PARTICIPATION_UNAVAILABLE_MESSAGE)},handBack:()=>{throw failedPreconditionError(CONVERSATION_PARTICIPATION_UNAVAILABLE_MESSAGE)},clearAttention:()=>{throw failedPreconditionError(CONVERSATION_PARTICIPATION_UNAVAILABLE_MESSAGE)},escalate:()=>{throw failedPreconditionError(CONVERSATION_PARTICIPATION_UNAVAILABLE_MESSAGE)}});return}let{conversations}=channelRuntime;router.service(ChannelConversationQueryController,{listConversations:(input,ctx)=>conversations.listConversations(input,callerIdentityOf(ctx)),getConversation:(input,ctx)=>conversations.getConversation(input,callerIdentityOf(ctx)),getTimeline:(input,ctx)=>conversations.getTimeline(input,callerIdentityOf(ctx)),getMediaDownloadUrl:(input,ctx)=>conversations.getMediaDownloadUrl(input,callerIdentityOf(ctx))}),router.service(ChannelConversationCommandController,{reply:(input,ctx)=>conversations.reply(input,callerIdentityOf(ctx)),takeOver:(input,ctx)=>conversations.takeOver(input,callerIdentityOf(ctx)),handBack:(input,ctx)=>conversations.handBack(input,callerIdentityOf(ctx)),clearAttention:(input,ctx)=>conversations.clearAttention(input,callerIdentityOf(ctx)),escalate:(input,ctx)=>conversations.escalate(input,callerIdentityOf(ctx))})}var file_ai_stigmer_agentic_agentchannel_v1_message_command=fileDesc("CjhhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL21lc3NhZ2VfY29tbWFuZC5wcm90bxIiYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MTK4AQofQ2hhbm5lbE1lc3NhZ2VDb21tYW5kQ29udHJvbGxlchKOAQoLc2VuZE1lc3NhZ2USOy5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLlNlbmRDaGFubmVsTWVzc2FnZUlucHV0GjwuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5TZW5kQ2hhbm5lbE1lc3NhZ2VPdXRwdXQiBNC4GAEaBKD/Ky9iBnByb3RvMw",[file_ai_stigmer_agentic_agentchannel_v1_message_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ChannelMessageCommandController=serviceDesc(file_ai_stigmer_agentic_agentchannel_v1_message_command,0);var file_ai_stigmer_agentic_agentchannel_v1_message_query=fileDesc("CjZhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRjaGFubmVsL3YxL21lc3NhZ2VfcXVlcnkucHJvdG8SImFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudGNoYW5uZWwudjEyyQIKHUNoYW5uZWxNZXNzYWdlUXVlcnlDb250cm9sbGVyEooBCg1saXN0VGVtcGxhdGVzEj0uYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5MaXN0Q2hhbm5lbFRlbXBsYXRlc0lucHV0GjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5DaGFubmVsVGVtcGxhdGVzIgTQuBgBEpQBChVsaXN0TWVzc2FnaW5nQ2hhbm5lbHMSPi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRjaGFubmVsLnYxLkxpc3RNZXNzYWdpbmdDaGFubmVsc0lucHV0GjUuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50Y2hhbm5lbC52MS5NZXNzYWdpbmdDaGFubmVscyIE0LgYARoEoP8rL2IGcHJvdG8z",[file_ai_stigmer_agentic_agentchannel_v1_message_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ChannelMessageQueryController=serviceDesc(file_ai_stigmer_agentic_agentchannel_v1_message_query,0);function registerChannelMessageServices(router,channelRuntime){if(channelRuntime===void 0){router.service(ChannelMessageCommandController,{sendMessage:()=>{throw failedPreconditionError(PROACTIVE_MESSAGING_UNAVAILABLE_MESSAGE)}}),router.service(ChannelMessageQueryController,{listTemplates:()=>{throw failedPreconditionError(PROACTIVE_MESSAGING_UNAVAILABLE_MESSAGE)},listMessagingChannels:()=>create2(MessagingChannelsSchema)});return}let{messaging}=channelRuntime;router.service(ChannelMessageCommandController,{sendMessage:(input,ctx)=>messaging.sendMessage(input,callerIdentityOf(ctx))}),router.service(ChannelMessageQueryController,{listTemplates:(input,ctx)=>messaging.listTemplates(input,callerIdentityOf(ctx)),listMessagingChannels:(input,ctx)=>messaging.listMessagingChannels(input,callerIdentityOf(ctx))})}var file_ai_stigmer_agentic_agentshare_v1_io=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRzaGFyZS92MS9pby5wcm90bxIgYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEiJQoMQWdlbnRTaGFyZUlkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiegocR2V0QWdlbnRTaGFyZXNCeUFnZW50UmVxdWVzdBIYCghhZ2VudF9pZBgBIAEoCUIGukgDyAEBEjMKCXBhZ2VfaW5mbxgCIAEoCzIgLmFpLnN0aWdtZXIuY29tbW9ucy5ycGMuUGFnZUluZm8SCwoDb3JnGAMgASgJImIKDkFnZW50U2hhcmVMaXN0EhMKC3RvdGFsX2NvdW50GAEgASgFEjsKBWl0ZW1zGAIgAygLMiwuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuQWdlbnRTaGFyZSLoAQoWTGlzdEFnZW50U2hhcmVzUmVxdWVzdBIUCgNvcmcYASABKAlCB7pIBHICEAESVAoGbGFiZWxzGAIgAygLMkQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuTGlzdEFnZW50U2hhcmVzUmVxdWVzdC5MYWJlbHNFbnRyeRIzCglwYWdlX2luZm8YAyABKAsyIC5haS5zdGlnbWVyLmNvbW1vbnMucnBjLlBhZ2VJbmZvGi0KC0xhYmVsc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEiMwoUUm90YXRlU2hhcmVMaW5rSW5wdXQSGwoLcmVzb3VyY2VfaWQYASABKAlCBrpIA8gBASJSChdHZXRTaGFyZWRQcm9maWxlUmVxdWVzdBILCgNvcmcYASABKAkSDAoEc2x1ZxgCIAEoCRIcCgpsaW5rX3Rva2VuGAMgASgJQgi6SAVyAxiAASKBAQoSU2hhcmVkQWdlbnRQcm9maWxlEgsKA29yZxgBIAEoCRIMCgRzbHVnGAIgASgJEgwKBG5hbWUYAyABKAkSEwoLZGVzY3JpcHRpb24YBCABKAkSEAoIaWNvbl91cmwYBSABKAkSGwoTZGVmYXVsdF9pbnN0YW5jZV9pZBgGIAEoCWIGcHJvdG8z",[file_ai_stigmer_agentic_agentshare_v1_api,file_ai_stigmer_commons_rpc_pagination,file_buf_validate_validate]);var AgentShareListSchema=messageDesc2(file_ai_stigmer_agentic_agentshare_v1_io,2);var SharedAgentProfileSchema=messageDesc2(file_ai_stigmer_agentic_agentshare_v1_io,6);var file_ai_stigmer_agentic_agentshare_v1_command=fileDesc("Ci5haS9zdGlnbWVyL2FnZW50aWMvYWdlbnRzaGFyZS92MS9jb21tYW5kLnByb3RvEiBhaS5zdGlnbWVyLmFnZW50aWMuYWdlbnRzaGFyZS52MTLuBQobQWdlbnRTaGFyZUNvbW1hbmRDb250cm9sbGVyEmMKBWFwcGx5EiwuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuQWdlbnRTaGFyZRosLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxLkFnZW50U2hhcmUSagoGY3JlYXRlEiwuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuQWdlbnRTaGFyZRosLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxLkFnZW50U2hhcmUiBNC4GAESnwEKBnVwZGF0ZRIsLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxLkFnZW50U2hhcmUaLC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRzaGFyZS52MS5BZ2VudFNoYXJlIjnCuBg1CAIQLiILbWV0YWRhdGEuaWQqInVuYXV0aG9yaXplZCB0byB1cGRhdGUgYWdlbnQgc2hhcmUStwEKD3JvdGF0ZVNoYXJlTGluaxI2LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxLlJvdGF0ZVNoYXJlTGlua0lucHV0GiwuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuQWdlbnRTaGFyZSI+wrgYOggCEC4iC3Jlc291cmNlX2lkKid1bmF1dGhvcml6ZWQgdG8gcm90YXRlIGFnZW50IHNoYXJlIGxpbmsSmwEKBmRlbGV0ZRIuLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxLkFnZW50U2hhcmVJZBosLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxLkFnZW50U2hhcmUiM8K4GC8IAxAuIgV2YWx1ZSoidW5hdXRob3JpemVkIHRvIGRlbGV0ZSBhZ2VudCBzaGFyZRoEoP8rLmIGcHJvdG8z",[file_ai_stigmer_agentic_agentshare_v1_api,file_ai_stigmer_agentic_agentshare_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentShareCommandController=serviceDesc(file_ai_stigmer_agentic_agentshare_v1_command,0);var file_ai_stigmer_agentic_agentshare_v1_query=fileDesc("CixhaS9zdGlnbWVyL2FnZW50aWMvYWdlbnRzaGFyZS92MS9xdWVyeS5wcm90bxIgYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEy0gYKGUFnZW50U2hhcmVRdWVyeUNvbnRyb2xsZXISlQEKA2dldBIuLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxLkFnZW50U2hhcmVJZBosLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxLkFnZW50U2hhcmUiMMK4GCwIARAuIgV2YWx1ZSofdW5hdXRob3JpemVkIHRvIGdldCBhZ2VudCBzaGFyZRJ6Cg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRosLmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxLkFnZW50U2hhcmUiBNC4GAEShAEKCmdldEJ5QWdlbnQSPi5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRzaGFyZS52MS5HZXRBZ2VudFNoYXJlc0J5QWdlbnRSZXF1ZXN0GjAuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuQWdlbnRTaGFyZUxpc3QiBNC4GAESeAoEbGlzdBI4LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxLkxpc3RBZ2VudFNoYXJlc1JlcXVlc3QaMC5haS5zdGlnbWVyLmFnZW50aWMuYWdlbnRzaGFyZS52MS5BZ2VudFNoYXJlTGlzdCIE0LgYARKJAQoQZ2V0U2hhcmVkUHJvZmlsZRI5LmFpLnN0aWdtZXIuYWdlbnRpYy5hZ2VudHNoYXJlLnYxLkdldFNoYXJlZFByb2ZpbGVSZXF1ZXN0GjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuU2hhcmVkQWdlbnRQcm9maWxlIgTIuBgBEo0BChlnZXRTaGFyZWRQcm9maWxlRm9yTWVtYmVyEjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlGjQuYWkuc3RpZ21lci5hZ2VudGljLmFnZW50c2hhcmUudjEuU2hhcmVkQWdlbnRQcm9maWxlIgTQuBgBGgSg/ysuYgZwcm90bzM",[file_ai_stigmer_agentic_agentshare_v1_api,file_ai_stigmer_agentic_agentshare_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),AgentShareQueryController=serviceDesc(file_ai_stigmer_agentic_agentshare_v1_query,0);var ORG_REQUIRED_MESSAGE2="metadata.org is required for an agent share",AGENT_REF_SLUG_REQUIRED_MESSAGE2="spec.agent_ref.slug is required",ORG_REQUIRED_FOR_LOOKUP_MESSAGE="org is required for shared agent lookup";function sameOrgInvariantMessage2(refOrg){return`spec.agent_ref.org must match metadata.org \u2014 a share must live in the referenced agent's organization (${refOrg})`}function agentRefImmutableMessage2(org,slug){return`spec.agent_ref is immutable (share references ${org}/${slug}) \u2014 create a new share to distribute a different agent`}var import_node_crypto15=require("node:crypto");var REFERENCED_AGENT_KEY3="agentShareReferencedAgent",SHARE_AGENT_DENIED_MESSAGE="You don't have permission to share this agent",SHARE_ORGANIZATION_DENIED_MESSAGE="You don't have permission to create agent shares in this organization";function resolveShareCreateTargets(ctx){let agent=ctx.get(REFERENCED_AGENT_KEY3);if(agent===void 0)throw new Error("referenced agent not found in context");return[{permission:IamPermission.can_edit,resourceKind:ApiResourceKind.agent,resourceId:agent.metadata?.id??"",deniedMessage:SHARE_AGENT_DENIED_MESSAGE},{permission:IamPermission.can_create_agent_share,resourceKind:ApiResourceKind.organization,resourceId:ctx.newState.metadata?.org??"",deniedMessage:SHARE_ORGANIZATION_DENIED_MESSAGE}]}function sharedNotFound(slug){return notFoundError("Agent",slug)}function newAuthorizeMemberAudienceStep(authorizer){return{name:"AuthorizeMemberAudience",async execute(ctx){let ref=ctx.input;if(ref.org===""||ctx.callerIdentity.callerClass==="internal")return;let decision=await evaluateAuthorizer(authorizer,ctx.callerIdentity,{permission:IamPermission.can_view,resourceKind:ApiResourceKind.organization,resourceId:ref.org});switch(decision.kind){case"allow":return;case"deny":case"not-found":throw sharedNotFound(ref.slug);case"unavailable":throw internalError(decision.cause,AUTHORIZATION_UNAVAILABLE_MESSAGE);default:{let exhaustive=decision;throw internalError(new Error(`unknown decision ${JSON.stringify(exhaustive)}`),AUTHORIZATION_UNAVAILABLE_MESSAGE)}}}}}function sharingLinkTokenAllowed(presented,live){if(live==="")return!0;if(presented==="")return!1;let presentedBytes=Buffer.from(presented),liveBytes=Buffer.from(live);return presentedBytes.length!==liveBytes.length?!1:(0,import_node_crypto15.timingSafeEqual)(presentedBytes,liveBytes)}function generateShareLinkToken(){return(0,import_node_crypto15.randomBytes)(20).toString("base64url")}async function findAgentByOrgAndSlug(store,org,slug){let rows;try{rows=await store.listResources(ApiResourceKind.agent)}catch(error2){throw internalError(error2,"failed to list agent resources")}for(let data of rows){let agent;try{agent=fromBinary2(AgentSchema,data)}catch{continue}if(agent.metadata?.slug===slug&&agent.metadata.org===org)return agent}}async function findShareByOrgAndSlug(store,org,slug){let rows;try{rows=await store.listResources(ApiResourceKind.agent_share)}catch(error2){throw internalError(error2,"failed to list agent share resources")}for(let data of rows){let share;try{share=fromBinary2(AgentShareSchema,data)}catch{continue}if(share.metadata?.slug===slug&&share.metadata.org===org)return share}}function newResolveShareDefaultsStep(store){return{name:"ResolveShareDefaults",async execute(ctx){let share=ctx.newState,metadata=share.metadata;if((metadata?.org??"")==="")throw invalidArgumentError(ORG_REQUIRED_MESSAGE2);let agentRef=share.spec?.agentRef;if((agentRef?.slug??"")==="")throw invalidArgumentError(AGENT_REF_SLUG_REQUIRED_MESSAGE2);if(agentRef.org===""&&(agentRef.org=metadata.org),agentRef.org!==metadata.org)throw failedPreconditionError(sameOrgInvariantMessage2(agentRef.org));let agent=await findAgentByOrgAndSlug(store,agentRef.org,agentRef.slug);if(agent===void 0)throw notFoundError("Agent",agentRef.slug);ctx.set(REFERENCED_AGENT_KEY3,agent),metadata.slug===""&&metadata.name===""&&(metadata.slug=agent.metadata?.slug??"",metadata.name=agent.metadata?.name??"")}}}function newStampAgentPinStep(){return{name:"StampAgentPin",execute(ctx){let agent=ctx.get(REFERENCED_AGENT_KEY3);if(agent===void 0)throw internalError(new Error("referenced agent not found in context"),"referenced agent not found in context (ResolveShareDefaults must run first)");let share=ctx.newState,status=share.status??create2(AgentShareStatusSchema);status.agentId=agent.metadata?.id??"",share.status=status}}}function newValidateShareUpdateStep(){return{name:"ValidateShareUpdate",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing agent share not found in context"),"existing agent share not found in context");let inputRef=ctx.input.spec?.agentRef,existingRef=existing.spec?.agentRef,inputOrg=(inputRef?.org??"")!==""?inputRef.org:existing.metadata?.org??"";if((inputRef?.slug??"")!==(existingRef?.slug??"")||inputOrg!==(existingRef?.org??""))throw failedPreconditionError(agentRefImmutableMessage2(existingRef?.org??"",existingRef?.slug??""))}}}async function buildSharedAgentProfile(store,share){let ref=share.spec?.agentRef,agent=await findAgentByOrgAndSlug(store,ref?.org??"",ref?.slug??"");if(agent===void 0)throw sharedNotFound(share.metadata?.slug??"");let pin=share.status?.agentId??"";if(pin!==""&&pin!==(agent.metadata?.id??"")||(share.metadata?.org??"")!==(agent.metadata?.org??""))throw sharedNotFound(share.metadata?.slug??"");return create2(SharedAgentProfileSchema,{org:share.metadata?.org??"",slug:share.metadata?.slug??"",name:agent.metadata?.name??"",description:agent.spec?.description??"",iconUrl:agent.spec?.iconUrl??"",defaultInstanceId:agent.status?.defaultInstanceId??""})}function registerAgentShareServices(router,deps){router.service(AgentShareCommandController,{apply:(share,ctx)=>apply5(deps,share,ctx),create:(share,ctx)=>createShare(deps,share,ctx),update:(share,ctx)=>update6(deps,share,ctx),rotateShareLink:(input,ctx)=>rotateShareLink(deps,input,ctx),delete:(shareId,ctx)=>deleteShare(deps,shareId,ctx)}),router.service(AgentShareQueryController,{get:(shareId,ctx)=>get7(deps,shareId,ctx),getByReference:(ref,ctx)=>getByReference5(deps,ref,ctx),getByAgent:(req,ctx)=>getByAgent4(deps,req,ctx),list:(req,ctx)=>list7(deps,req,ctx),getSharedProfile:(req,ctx)=>getSharedProfile(deps,req,ctx),getSharedProfileForMember:(ref,ctx)=>getSharedProfileForMember(deps,ref,ctx)})}function kindOf6(ctx){return ctx.values.get(apiResourceKindKey)}async function createShare(deps,share,ctx){let reqCtx=new RequestContext(AgentShareSchema,share,callerIdentityOf(ctx),kindOf6(ctx));return await newPipeline("agent-share-create",deps.logger).addStep(newAuthorizeStep(AgentShareCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveShareDefaultsStep(deps.store)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveShareCreateTargets)).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newStampAgentPinStep()).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update6(deps,share,ctx){let reqCtx=new RequestContext(AgentShareSchema,share,callerIdentityOf(ctx),kindOf6(ctx));return await newPipeline("agent-share-update",deps.logger).addStep(newAuthorizeStep(AgentShareCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateShareUpdateStep()).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).build().execute(reqCtx),reqCtx.newState}async function apply5(deps,share,ctx){let reqCtx=new RequestContext(AgentShareSchema,share,callerIdentityOf(ctx),kindOf6(ctx));await newPipeline("agent-share-apply",deps.logger).addStep(newAuthorizeStep(AgentShareCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveShareDefaultsStep(deps.store)).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");let resolved=reqCtx.newState;return shouldCreate?createShare(deps,resolved,ctx):update6(deps,resolved,ctx)}var ROTATE_SHARE_KEY="rotateShareLinkShare";async function rotateShareLink(deps,input,ctx){let reqCtx=new RequestContext(AgentShareCommandController.method.rotateShareLink.input,input,callerIdentityOf(ctx),kindOf6(ctx));return await newPipeline("agent-share-rotate-share-link",deps.logger).addStep(newAuthorizeStep(AgentShareCommandController.method.rotateShareLink,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadShareForLinkRotationStep(deps.store)).addStep(newRotateShareLinkTokenStep()).addStep(newPersistShareForLinkRotationStep(deps.store)).build().execute(reqCtx),reqCtx.get(ROTATE_SHARE_KEY)}function newLoadShareForLinkRotationStep(store){return{name:"LoadShareForLinkRotation",async execute(ctx){let share;try{share=await store.getResource(ctx.apiResourceKind,ctx.input.resourceId,AgentShareSchema)}catch{throw notFoundError("AgentShare",ctx.input.resourceId)}ctx.set(ROTATE_SHARE_KEY,share)}}}function newRotateShareLinkTokenStep(){return{name:"RotateShareLinkToken",execute(ctx){let share=ctx.get(ROTATE_SHARE_KEY),token;try{token=generateShareLinkToken()}catch(error2){throw internalError(error2,"failed to rotate share link")}let status=share.status??create2(AgentShareStatusSchema);status.shareLinkToken=token,share.status=status,setAuditFieldsForUpdate(AgentShareSchema,share,"status_audit",ctx.callerIdentity)}}}function newPersistShareForLinkRotationStep(store){return{name:"PersistShareForLinkRotation",async execute(ctx){let share=ctx.get(ROTATE_SHARE_KEY);try{await store.saveResource(ctx.apiResourceKind,share.metadata?.id??"",AgentShareSchema,share)}catch(error2){throw internalError(error2,"failed to save agent share")}}}}async function deleteShare(deps,shareId,ctx){let reqCtx=new RequestContext(AgentShareCommandController.method.delete.input,shareId,callerIdentityOf(ctx),kindOf6(ctx));await newPipeline("agent-share-delete",deps.logger).addStep(newAuthorizeStep(AgentShareCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,AgentShareSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted agent share not found in context"),"deleted agent share not found in context");return deleted}async function get7(deps,shareId,ctx){let reqCtx=new RequestContext(AgentShareQueryController.method.get.input,shareId,callerIdentityOf(ctx),kindOf6(ctx));return await newPipeline("agent-share-get",deps.logger).addStep(newAuthorizeStep(AgentShareQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,AgentShareSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByReference5(deps,ref,ctx){let reqCtx=new RequestContext(AgentShareQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf6(ctx));return await newPipeline("agent-share-get-by-reference",deps.logger).addStep(newAuthorizeStep(AgentShareQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,AgentShareSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(AgentShareQueryController.method.get))).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var SHARE_LIST_KEY="agentShareList";async function getByAgent4(deps,req,ctx){let reqCtx=new RequestContext(AgentShareQueryController.method.getByAgent.input,req,callerIdentityOf(ctx),kindOf6(ctx));await newPipeline("agent-share-get-by-agent",deps.logger).addStep(newAuthorizeStep(AgentShareQueryController.method.getByAgent,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadSharesByAgentStep(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(SHARE_LIST_KEY);if(result===void 0)throw internalError(new Error("agent share list not found in context"),"agent share list not found in context");return result}function newLoadSharesByAgentStep(store,listReadScope){return{name:"LoadSharesByAgent",async execute(ctx){let req=ctx.input,emptyList=create2(AgentShareListSchema,{totalCount:0,items:[]}),agentOrg,agentSlug;try{let agent=await store.getResource(ApiResourceKind.agent,req.agentId,AgentSchema);agentOrg=agent.metadata?.org??"",agentSlug=agent.metadata?.slug??""}catch{ctx.set(SHARE_LIST_KEY,emptyList);return}let rows;try{rows=await store.listResources(ApiResourceKind.agent_share)}catch(error2){throw internalError(error2,"failed to list agent shares")}let decoded=[];for(let bytes of rows)try{decoded.push(fromBinary2(AgentShareSchema,bytes))}catch{continue}let shares=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.agent_share,decoded.filter(share=>{let ref=share.spec?.agentRef;return(ref?.org??"")===agentOrg&&(ref?.slug??"")===agentSlug&&(req.org===""||(share.metadata?.org??"")===req.org)}),"");ctx.set(SHARE_LIST_KEY,create2(AgentShareListSchema,{totalCount:shares.length,items:shares}))}}}var LIST_RESULT_KEY3="listResult";async function list7(deps,req,ctx){let reqCtx=new RequestContext(AgentShareQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf6(ctx));await newPipeline("agent-share-list",deps.logger).addStep(newAuthorizeStep(AgentShareQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgAndLabelsStep4(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY3);if(result===void 0)throw internalError(new Error("agent share list not found in context"),"agent share list not found in context");return result}function newListByOrgAndLabelsStep4(store,logger2,listReadScope){return{name:"ListByOrgAndLabels",async execute(ctx){let{org,labels:filterLabels}=ctx.input,rows;try{rows=await store.listResources(ctx.apiResourceKind)}catch(error2){throw internalError(error2,"failed to list agent shares")}let decoded=[];for(let bytes of rows)try{decoded.push(fromBinary2(AgentShareSchema,bytes))}catch{logger2.warn("Failed to unmarshal agent share, skipping");continue}let shares=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.agent_share,decoded.filter(share=>(share.metadata?.org??"")===org&&matchesAllLabels(share.metadata?.labels??{},filterLabels)),"");shares.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(LIST_RESULT_KEY3,create2(AgentShareListSchema,{totalCount:shares.length,items:shares}))}}}var RESOLVED_SHARE_KEY="resolvedAgentShare",SHARED_PROFILE_KEY="sharedAgentProfile";async function getSharedProfile(deps,req,ctx){let reqCtx=new RequestContext(AgentShareQueryController.method.getSharedProfile.input,req,callerIdentityOf(ctx),kindOf6(ctx));return await newPipeline("agent-share-get-shared-profile",deps.logger).addStep(newAuthorizeStep(AgentShareQueryController.method.getSharedProfile,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadShareForProfileStep(deps.store)).addStep(newProjectSharedProfileStep(deps.store)).build().execute(reqCtx),reqCtx.get(SHARED_PROFILE_KEY)}async function getSharedProfileForMember(deps,ref,ctx){let reqCtx=new RequestContext(AgentShareQueryController.method.getSharedProfileForMember.input,ref,callerIdentityOf(ctx),kindOf6(ctx));return await newPipeline("agent-share-get-shared-profile-for-member",deps.logger).addStep(newAuthorizeStep(AgentShareQueryController.method.getSharedProfileForMember,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeMemberAudienceStep(deps.authorizer)).addStep(newLoadShareForMemberProfileStep(deps.store)).addStep(newProjectMemberSharedProfileStep(deps.store)).build().execute(reqCtx),reqCtx.get(SHARED_PROFILE_KEY)}function newLoadShareForProfileStep(store){return{name:"LoadShareForProfile",async execute(ctx){let req=ctx.input;if(req.org==="")throw invalidArgumentError(ORG_REQUIRED_FOR_LOOKUP_MESSAGE);let share=await findShareByOrgAndSlug(store,req.org,req.slug);if(share===void 0)throw sharedNotFound(req.slug);ctx.set(RESOLVED_SHARE_KEY,share)}}}function newLoadShareForMemberProfileStep(store){return{name:"LoadShareForMemberProfile",async execute(ctx){let ref=ctx.input;if(ref.org==="")throw invalidArgumentError(ORG_REQUIRED_FOR_LOOKUP_MESSAGE);let share=await findShareByOrgAndSlug(store,ref.org,ref.slug);if(share===void 0)throw sharedNotFound(ref.slug);ctx.set(RESOLVED_SHARE_KEY,share)}}}function newProjectSharedProfileStep(store){return{name:"ProjectSharedProfile",async execute(ctx){let share=ctx.get(RESOLVED_SHARE_KEY),req=ctx.input;if(share.spec?.enabled!==!0)throw sharedNotFound(req.slug);if(share.spec.audience===AgentShareAudience.org)throw sharedNotFound(req.slug);if(!sharingLinkTokenAllowed(req.linkToken,share.status?.shareLinkToken??""))throw sharedNotFound(req.slug);ctx.set(SHARED_PROFILE_KEY,await buildSharedAgentProfile(store,share))}}}function newProjectMemberSharedProfileStep(store){return{name:"ProjectMemberSharedProfile",async execute(ctx){let share=ctx.get(RESOLVED_SHARE_KEY);if(share.spec?.enabled!==!0)throw sharedNotFound(ctx.input.slug);if(!(share.spec.audience===AgentShareAudience.org)&&(share.status?.shareLinkToken??"")!=="")throw sharedNotFound(ctx.input.slug);ctx.set(SHARED_PROFILE_KEY,await buildSharedAgentProfile(store,share))}}}var file_ai_stigmer_iam_apikey_v1_io=fileDesc("CiFhaS9zdGlnbWVyL2lhbS9hcGlrZXkvdjEvaW8ucHJvdG8SGGFpLnN0aWdtZXIuaWFtLmFwaWtleS52MSI8CgdBcGlLZXlzEjEKB2VudHJpZXMYASADKAsyIC5haS5zdGlnbWVyLmlhbS5hcGlrZXkudjEuQXBpS2V5IiEKCEFwaUtleUlkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiIwoKQXBpS2V5SGFzaBIVCgV2YWx1ZRgBIAEoCUIGukgDyAEBYgZwcm90bzM",[file_ai_stigmer_iam_apikey_v1_api,file_buf_validate_validate]),ApiKeysSchema=messageDesc2(file_ai_stigmer_iam_apikey_v1_io,0);var file_ai_stigmer_iam_apikey_v1_command=fileDesc("CiZhaS9zdGlnbWVyL2lhbS9hcGlrZXkvdjEvY29tbWFuZC5wcm90bxIYYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxMvoCChdBcGlLZXlDb21tYW5kQ29udHJvbGxlchJSCgZjcmVhdGUSIC5haS5zdGlnbWVyLmlhbS5hcGlrZXkudjEuQXBpS2V5GiAuYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxLkFwaUtleSIE0LgYARKDAQoGdXBkYXRlEiAuYWkuc3RpZ21lci5pYW0uYXBpa2V5LnYxLkFwaUtleRogLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXkiNcK4GDEIAhAMIgttZXRhZGF0YS5pZCoedW5hdXRob3JpemVkIHRvIHVwZGF0ZSBhcGkga2V5En8KBmRlbGV0ZRIiLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXlJZBogLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXkiL8K4GCsIAxAMIgV2YWx1ZSoedW5hdXRob3JpemVkIHRvIGRlbGV0ZSBhcGkga2V5GgSg/ysMYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_apikey_v1_api,file_ai_stigmer_iam_apikey_v1_io]),ApiKeyCommandController=serviceDesc(file_ai_stigmer_iam_apikey_v1_command,0);var file_ai_stigmer_iam_apikey_v1_query=fileDesc("CiRhaS9zdGlnbWVyL2lhbS9hcGlrZXkvdjEvcXVlcnkucHJvdG8SGGFpLnN0aWdtZXIuaWFtLmFwaWtleS52MTLDAgoVQXBpS2V5UXVlcnlDb250cm9sbGVyEnoKA2dldBIiLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXlJZBogLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXkiLcK4GCkIARAMIgV2YWx1ZSocdW5hdXRob3JpemVkIHRvIHZpZXcgYXBpIGtleRJcCgxnZXRCeUtleUhhc2gSJC5haS5zdGlnbWVyLmlhbS5hcGlrZXkudjEuQXBpS2V5SGFzaBogLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXkiBNC4GAESSgoHZmluZEFsbBIWLmdvb2dsZS5wcm90b2J1Zi5FbXB0eRohLmFpLnN0aWdtZXIuaWFtLmFwaWtleS52MS5BcGlLZXlzIgTQuBgBGgSg/ysMYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_apikey_v1_api,file_ai_stigmer_iam_apikey_v1_io,file_google_protobuf_empty]),ApiKeyQueryController=serviceDesc(file_ai_stigmer_iam_apikey_v1_query,0);var import_node_crypto16=require("node:crypto"),API_KEY_PREFIX="stk_",API_KEY_TOKEN_BYTES=32,API_KEY_FINGERPRINT_LENGTH=6;function generateApiKeyPlaintext(){return API_KEY_PREFIX+(0,import_node_crypto16.randomBytes)(API_KEY_TOKEN_BYTES).toString("base64url")}function hashApiKey(plaintext){if(plaintext==="")throw new Error("token must not be null or empty");return(0,import_node_crypto16.createHash)("sha256").update(plaintext,"utf8").digest("base64url")}function fingerprintOf(plaintext){return plaintext.length<=API_KEY_FINGERPRINT_LENGTH?plaintext:plaintext.slice(-API_KEY_FINGERPRINT_LENGTH)}function isApiKeyToken(token){return token.slice(0,API_KEY_PREFIX.length).toLowerCase()===API_KEY_PREFIX}async function findApiKeyByHash(store,keyHash){try{return await store.findByField(ApiResourceKind.api_key,"spec.keyHash",keyHash,ApiKeySchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}var API_KEY_PLAINTEXT_KEY="API_KEY_PLAINTEXT";function newGenerateApiKeyStep(){return{name:"GenerateApiKey",execute(ctx){let resource=ctx.newState;if(resource.spec===void 0)throw internalError(new Error("spec is nil after BuildNewState"),"generate api key");let plaintext=generateApiKeyPlaintext();resource.spec.keyHash=hashApiKey(plaintext),resource.spec.fingerprint=fingerprintOf(plaintext),ctx.set(API_KEY_PLAINTEXT_KEY,plaintext)}}}function newReplaceHashWithPlainTextStep(){return{name:"ReplaceHashWithPlainText",execute(ctx){let plaintext=ctx.get(API_KEY_PLAINTEXT_KEY);if(typeof plaintext!="string"||plaintext==="")throw internalError(new Error("plaintext API key not found in context"),"Failed to retrieve generated API key");let resource=ctx.newState;if(resource.spec===void 0)throw internalError(new Error("spec is nil after Persist"),"replace hash with plaintext");resource.spec.keyHash=plaintext}}}function newPreserveKeyMaterialStep(){return{name:"PreserveKeyMaterial",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing resource not in context - LoadExisting must run first"),"preserve key material");let resource=ctx.newState;if(resource.spec===void 0||existing.spec===void 0)throw internalError(new Error("spec is nil on update"),"preserve key material");resource.spec.keyHash=existing.spec.keyHash,resource.spec.fingerprint=existing.spec.fingerprint}}}var API_KEY_NOT_FOUND_BY_HASH_MESSAGE="ApiKey not found";function newLoadByKeyHashStep(store){return{name:"LoadByKeyHash",async execute(ctx){let found=await findApiKeyByHash(store,ctx.input.value);if(found===void 0)throw new ConnectError(API_KEY_NOT_FOUND_BY_HASH_MESSAGE,Code.NotFound);ctx.set(TARGET_RESOURCE_KEY,found)}}}function registerApiKeyServices(router,deps){router.service(ApiKeyCommandController,{create:(apiKey,ctx)=>createApiKey(deps,apiKey,ctx),update:(apiKey,ctx)=>update7(deps,apiKey,ctx),delete:(apiKeyId,ctx)=>deleteApiKey(deps,apiKeyId,ctx)}),router.service(ApiKeyQueryController,{get:(apiKeyId,ctx)=>get8(deps,apiKeyId,ctx),getByKeyHash:(apiKeyHash,ctx)=>getByKeyHash(deps,apiKeyHash,ctx),findAll:(empty,ctx)=>findAll(deps,empty,ctx)})}function kindOf7(ctx){return ctx.values.get(apiResourceKindKey)}async function createApiKey(deps,apiKey,ctx){let reqCtx=new RequestContext(ApiKeySchema,apiKey,callerIdentityOf(ctx),kindOf7(ctx));return await newPipeline("apikey-create",deps.logger).addStep(newAuthorizeStep(ApiKeyCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newGenerateApiKeyStep()).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newReplaceHashWithPlainTextStep()).build().execute(reqCtx),reqCtx.newState}async function update7(deps,apiKey,ctx){let reqCtx=new RequestContext(ApiKeySchema,apiKey,callerIdentityOf(ctx),kindOf7(ctx));return await newPipeline("apikey-update",deps.logger).addStep(newAuthorizeStep(ApiKeyCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newPreserveKeyMaterialStep()).addStep(newPersistStep(deps.store)).build().execute(reqCtx),reqCtx.newState}async function deleteApiKey(deps,apiKeyId,ctx){let reqCtx=new RequestContext(ApiKeyCommandController.method.delete.input,apiKeyId,callerIdentityOf(ctx),kindOf7(ctx));await newPipeline("apikey-delete",deps.logger).addStep(newAuthorizeStep(ApiKeyCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,ApiKeySchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("delete pipeline completed without a loaded resource"),"deleted api key not found in context");return deleted}async function get8(deps,apiKeyId,ctx){let reqCtx=new RequestContext(ApiKeyQueryController.method.get.input,apiKeyId,callerIdentityOf(ctx),kindOf7(ctx));return await newPipeline("apikey-get",deps.logger).addStep(newAuthorizeStep(ApiKeyQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,ApiKeySchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByKeyHash(deps,apiKeyHash,ctx){let reqCtx=new RequestContext(ApiKeyQueryController.method.getByKeyHash.input,apiKeyHash,callerIdentityOf(ctx),kindOf7(ctx));return await newPipeline("apikey-get-by-key-hash",deps.logger).addStep(newAuthorizeStep(ApiKeyQueryController.method.getByKeyHash,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByKeyHashStep(deps.store)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function findAll(deps,empty,ctx){let identity2=callerIdentityOf(ctx),reqCtx=new RequestContext(ApiKeyQueryController.method.findAll.input,empty,identity2,kindOf7(ctx));await newPipeline("apikey-find-all",deps.logger).addStep(newAuthorizeStep(ApiKeyQueryController.method.findAll,deps.authorizer)).build().execute(reqCtx);let rows;try{rows=await deps.store.listResources(ApiResourceKind.api_key)}catch(error2){throw internalError(error2,"failed to list api keys")}let entries=[...await restrictListByReadScope(deps.listReadScope,identity2,ApiResourceKind.api_key,rows.map(row=>fromBinary2(ApiKeySchema,row)),"")].sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt));return create2(ApiKeysSchema,{entries})}var file_ai_stigmer_iam_identityaccount_v1_io=fileDesc("CiphaS9zdGlnbWVyL2lhbS9pZGVudGl0eWFjY291bnQvdjEvaW8ucHJvdG8SIWFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MSJXChBJZGVudGl0eUFjY291bnRzEkMKB2VudHJpZXMYASADKAsyMi5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50IioKEUlkZW50aXR5QWNjb3VudElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiLQoUSWRlbnRpdHlBY2NvdW50RW1haWwSFQoFdmFsdWUYASABKAlCBrpIA8gBASIeCgVJZHBJZBIVCgV2YWx1ZRgBIAEoCUIGukgDyAEBImsKHExpc3RXaXRoSWRlbnRpdHlBY2NvdW50SWRSZXESGwoTaWRlbnRpdHlfYWNjb3VudF9pZBgBIAEoCRIuCgRwYWdlGAIgASgLMiAuYWkuc3RpZ21lci5jb21tb25zLnJwYy5QYWdlSW5mbyJwChRJZGVudGl0eUFjY291bnRzTGlzdBITCgt0b3RhbF9wYWdlcxgBIAEoBRJDCgdlbnRyaWVzGAIgAygLMjIuYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlhY2NvdW50LnYxLklkZW50aXR5QWNjb3VudCJSChNMaXN0V2l0aElkZW50aXR5T3JnEgsKA29yZxgBIAEoCRIuCgRwYWdlGAIgASgLMiAuYWkuc3RpZ21lci5jb21tb25zLnJwYy5QYWdlSW5mbyKbAQoRRXh0ZXJuYWxTdWJMb29rdXASEwoDb3JnGAEgASgJQga6SAPIAQESUwoVaWRlbnRpdHlfcHJvdmlkZXJfcmVmGAIgASgLMjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlEhwKDGV4dGVybmFsX3N1YhgDIAEoCUIGukgDyAEBIvgBChtDcmVhdGVGZWRlcmF0ZWRBY2NvdW50SW5wdXQSEwoDb3JnGAEgASgJQga6SAPIAQESUwoVaWRlbnRpdHlfcHJvdmlkZXJfcmVmGAIgASgLMjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlEhwKDGV4dGVybmFsX3N1YhgDIAEoCUIGukgDyAEBEhUKBWVtYWlsGAQgASgJQga6SAPIAQESEgoKZmlyc3RfbmFtZRgFIAEoCRIRCglsYXN0X25hbWUYBiABKAkSEwoLcGljdHVyZV91cmwYByABKAki+AEKG1VwZGF0ZUZlZGVyYXRlZEFjY291bnRJbnB1dBITCgNvcmcYASABKAlCBrpIA8gBARJTChVpZGVudGl0eV9wcm92aWRlcl9yZWYYAiABKAsyNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2USHAoMZXh0ZXJuYWxfc3ViGAMgASgJQga6SAPIAQESFQoFZW1haWwYBCABKAlCBrpIA8gBARISCgpmaXJzdF9uYW1lGAUgASgJEhEKCWxhc3RfbmFtZRgGIAEoCRITCgtwaWN0dXJlX3VybBgHIAEoCSLCAQogRGVwcm92aXNpb25GZWRlcmF0ZWRBY2NvdW50SW5wdXQSEwoDb3JnGAEgASgJQga6SAPIAQESUwoVaWRlbnRpdHlfcHJvdmlkZXJfcmVmGAIgASgLMjQuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlUmVmZXJlbmNlEhwKDGV4dGVybmFsX3N1YhgDIAEoCUIGukgDyAEBEhYKDmRlbGV0ZV9hY2NvdW50GAQgASgIYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_rpc_pagination,file_ai_stigmer_iam_identityaccount_v1_api,file_buf_validate_validate]);var file_ai_stigmer_iam_identityaccount_v1_command=fileDesc("Ci9haS9zdGlnbWVyL2lhbS9pZGVudGl0eWFjY291bnQvdjEvY29tbWFuZC5wcm90bxIhYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlhY2NvdW50LnYxMosKCiBJZGVudGl0eUFjY291bnRDb21tYW5kQ29udHJvbGxlchJ2CgZjcmVhdGUSMi5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50GjIuYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlhY2NvdW50LnYxLklkZW50aXR5QWNjb3VudCIE0LgYARKwAQoGdXBkYXRlEjIuYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlhY2NvdW50LnYxLklkZW50aXR5QWNjb3VudBoyLmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MS5JZGVudGl0eUFjY291bnQiPsK4GDoIAhALIgttZXRhZGF0YS5pZCondW5hdXRob3JpemVkIHRvIHVwZGF0ZSBpZGVudGl0eSBhY2NvdW50EqwBCgZkZWxldGUSNC5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50SWQaMi5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50IjjCuBg0CAMQCyIFdmFsdWUqJ3VuYXV0aG9yaXplZCB0byBkZWxldGUgaWRlbnRpdHkgYWNjb3VudBLaAQoWY3JlYXRlRmVkZXJhdGVkQWNjb3VudBI+LmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MS5DcmVhdGVGZWRlcmF0ZWRBY2NvdW50SW5wdXQaMi5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50IkzCuBhICBUQHiIDb3JnKj11bmF1dGhvcml6ZWQgdG8gY3JlYXRlIGlkZW50aXR5IGFjY291bnRzIGluIHRoaXMgb3JnYW5pemF0aW9uEtoBChZ1cGRhdGVGZWRlcmF0ZWRBY2NvdW50Ej4uYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlhY2NvdW50LnYxLlVwZGF0ZUZlZGVyYXRlZEFjY291bnRJbnB1dBoyLmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MS5JZGVudGl0eUFjY291bnQiTMK4GEgIFRAeIgNvcmcqPXVuYXV0aG9yaXplZCB0byBtYW5hZ2UgaWRlbnRpdHkgYWNjb3VudHMgaW4gdGhpcyBvcmdhbml6YXRpb24S5AEKG2RlcHJvdmlzaW9uRmVkZXJhdGVkQWNjb3VudBJDLmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MS5EZXByb3Zpc2lvbkZlZGVyYXRlZEFjY291bnRJbnB1dBoyLmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MS5JZGVudGl0eUFjY291bnQiTMK4GEgIFRAeIgNvcmcqPXVuYXV0aG9yaXplZCB0byBtYW5hZ2UgaWRlbnRpdHkgYWNjb3VudHMgaW4gdGhpcyBvcmdhbml6YXRpb24SZgoScHJvdmlzaW9uTXlBY2NvdW50EhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5GjIuYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlhY2NvdW50LnYxLklkZW50aXR5QWNjb3VudCIE0LgYARoEoP8rC2IGcHJvdG8z",[file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_identityaccount_v1_api,file_ai_stigmer_iam_identityaccount_v1_io,file_google_protobuf_empty]),IdentityAccountCommandController=serviceDesc(file_ai_stigmer_iam_identityaccount_v1_command,0);var file_ai_stigmer_iam_identityaccount_v1_query=fileDesc("Ci1haS9zdGlnbWVyL2lhbS9pZGVudGl0eWFjY291bnQvdjEvcXVlcnkucHJvdG8SIWFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MTKDCAoeSWRlbnRpdHlBY2NvdW50UXVlcnlDb250cm9sbGVyEqYBCgNnZXQSNC5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50SWQaMi5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50IjXCuBgxCAEQCyIFdmFsdWUqJHVuYXV0aG9yaXplZCB0byBnZXQgaWRlbnRpdHkgYWNjb3VudBJaCgZ3aG9BbUkSFi5nb29nbGUucHJvdG9idWYuRW1wdHkaMi5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50IgTQuBgBErABCgpnZXRCeUVtYWlsEjcuYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlhY2NvdW50LnYxLklkZW50aXR5QWNjb3VudEVtYWlsGjIuYWkuc3RpZ21lci5pYW0uaWRlbnRpdHlhY2NvdW50LnYxLklkZW50aXR5QWNjb3VudCI1wrgYMQgBEAsiBXZhbHVlKiR1bmF1dGhvcml6ZWQgdG8gZ2V0IGlkZW50aXR5IGFjY291bnQSoQEKCmdldEJ5SWRwSWQSKC5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRwSWQaMi5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50IjXCuBgxCAEQCyIFdmFsdWUqJHVuYXV0aG9yaXplZCB0byBnZXQgaWRlbnRpdHkgYWNjb3VudBLLAQoQZ2V0QnlFeHRlcm5hbFN1YhI0LmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MS5FeHRlcm5hbFN1Ykxvb2t1cBoyLmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MS5JZGVudGl0eUFjY291bnQiTcK4GEkIFRAeIgNvcmcqPnVuYXV0aG9yaXplZCB0byBsb29rIHVwIGlkZW50aXR5IGFjY291bnRzIGluIHRoaXMgb3JnYW5pemF0aW9uErABCgxnZXRBY3RvckluZm8SNC5haS5zdGlnbWVyLmlhbS5pZGVudGl0eWFjY291bnQudjEuSWRlbnRpdHlBY2NvdW50SWQaNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VBdWRpdEFjdG9yIjPCuBgvCAEQCyIFdmFsdWUqInVuYXV0aG9yaXplZCB0byBsb29rIHVwIGFjdG9yIGluZm8aBKD/KwtiBnByb3RvMw",[file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_apiresource_status,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_identityaccount_v1_api,file_ai_stigmer_iam_identityaccount_v1_io,file_google_protobuf_empty]),IdentityAccountQueryController=serviceDesc(file_ai_stigmer_iam_identityaccount_v1_query,0);var DuplicateAccountError=class extends Error{constructor(message6,options){super(message6,options),this.name="DuplicateAccountError"}};var KIND_NAME="IdentityAccount";function accountNotFoundError(handle){return new ConnectError(accountNotFoundMessage(handle),Code.NotFound)}function newDefaultAccountNameStep(){return{name:"DefaultAccountName",execute(ctx){let metadata=requireMetadata(ctx,"default account name");if(metadata.name===""){let spec=specOf2(ctx);metadata.name=spec.email!==""?spec.email:spec.idpId}}}}function newDeriveAccountIdStep(){return{name:"DeriveAccountId",execute(ctx){let metadata=requireMetadata(ctx,"derive account id"),idpId=specOf2(ctx).idpId;if(idpId==="")throw internalError(new Error("identity account idp_id is empty"),"derive account id");metadata.id=accountIdFor(idpId)}}}function newCheckDuplicateStep2(accounts){return{name:"CheckDuplicate",async execute(ctx){let metadata=requireMetadata(ctx,"duplicate check"),idpId=specOf2(ctx).idpId,existing;try{existing=await accounts.findById(metadata.id)}catch(error2){throw internalError(error2,"failed to check for duplicate identity account")}if(existing!==void 0)throw alreadyExistsError(KIND_NAME,`subject '${idpId}'`)}}}function assignDirectBackendFields(spec){return spec.isMachineAccount=isMachineSubject(spec.idpId),spec.provisioningMode=IdentityAccountProvisioningMode.direct,spec.identityProviderRef=void 0,spec}function assignPlatformClientBackendFields(spec){return spec.isMachineAccount=isMachineSubject(spec.idpId),spec.provisioningMode=IdentityAccountProvisioningMode.platform_client,spec.identityProviderRef=void 0,spec}function newAssignBackendFieldsStep(provisioning){return{name:"AssignBackendFields",execute(ctx){let spec=specOf2(ctx);switch(provisioning.mode){case"direct":if(isPlatformClientSubject(spec.idpId))throw invalidArgumentError(reservedSubjectMessage(spec.idpId));assignDirectBackendFields(spec);return;case"platform_client":if(!isPlatformClientSubject(spec.idpId))throw internalError(new Error(`a platform-client account's subject must carry the '${PLATFORM_CLIENT_SUBJECT_PREFIX}' prefix`),"assign backend fields");assignPlatformClientBackendFields(spec);return;default:{let exhaustive=provisioning;throw internalError(new Error(`unknown provisioning ${JSON.stringify(exhaustive)}`),"assign backend fields")}}}}}function newPersistNewAccountStep(accounts){return{name:"Persist",async execute(ctx){try{await accounts.save(ctx.newState)}catch(error2){throw error2 instanceof DuplicateAccountError?alreadyExistsError(KIND_NAME,`subject '${specOf2(ctx).idpId}'`):internalError(error2,"failed to save identity account")}}}}function newLoadExistingAccountStep(accounts){return{name:"LoadExisting",async execute(ctx){let metadata=requireMetadata(ctx,"load existing");if(metadata.id==="")throw invalidArgumentError("resource id is required for update");let existing=await readAccount(accounts,metadata.id);ctx.set(EXISTING_RESOURCE_KEY,existing)}}}function newGuardImmutableSubjectStep(){return{name:"GuardImmutableSubject",execute(ctx){let existingIdpId=existingAccountOf(ctx).spec?.idpId??"";if(specOf2(ctx).idpId!==existingIdpId)throw failedPreconditionError(idpIdImmutableMessage(existingIdpId))}}}function newPreserveBackendFieldsStep(){return{name:"AssignBackendFields",execute(ctx){let existingSpec=existingAccountOf(ctx).spec,spec=specOf2(ctx);spec.idpId=existingSpec?.idpId??spec.idpId,spec.email=existingSpec?.email??"",spec.isMachineAccount=existingSpec?.isMachineAccount??!1,spec.provisioningMode=existingSpec?.provisioningMode??IdentityAccountProvisioningMode.identity_account_provisioning_mode_unspecified,spec.identityProviderRef=existingSpec?.identityProviderRef}}}function newPersistUpdatedAccountStep(accounts){return{name:"Persist",async execute(ctx){try{await accounts.update(ctx.newState)}catch(error2){throw internalError(error2,"failed to save identity account")}}}}function newLoadTargetAccountStep(accounts){return{name:"LoadTarget",async execute(ctx){let id=idValueOf(ctx.input);if(id==="")throw invalidArgumentError("resource id is required");ctx.set(TARGET_RESOURCE_KEY,await readAccount(accounts,id))}}}function newLoadExistingAccountForDeleteStep(accounts){return{name:"LoadExistingForDelete",async execute(ctx){ctx.set(EXISTING_RESOURCE_KEY,await readAccount(accounts,requireResourceId2(ctx)))}}}function newDeleteAccountStep(accounts){return{name:"DeleteResource",async execute(ctx){try{await accounts.deleteById(requireResourceId2(ctx))}catch(error2){throw internalError(error2,"failed to delete identity account")}}}}async function readAccount(accounts,id){let account2=await accounts.findById(id);if(account2===void 0)throw accountNotFoundError(id);return account2}function requireMetadata(ctx,operation2){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("identity account metadata is nil"),operation2);return metadata}function specOf2(ctx){let state2=ctx.newState;return state2.spec===void 0&&(state2.spec=create2(IdentityAccountSpecSchema)),state2.spec}function existingAccountOf(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing identity account not found in context - LoadExisting must run first"),"identity account update ordering");return existing}function requireResourceId2(ctx){let id=ctx.get(RESOURCE_ID_KEY);if(typeof id!="string"||id==="")throw internalError(new Error("resource id not found in context (ExtractResourceId must run first)"),"identity account delete ordering");return id}var UserInfoFetchError=class extends Error{constructor(cause){super(cause instanceof Error?cause.message:String(cause),{cause}),this.name="UserInfoFetchError"}};function newDirectAccountProvisioner(deps){return{async provisionDirectAccount(idpId,caller){let existing=await deps.accounts.findDirectByIdpId(idpId);if(existing!==void 0)return{account:existing,created:!1};let profile=await profileOf(deps.userInfo,caller),input={name:displayNameOf(caller,profile),spec:assignDirectBackendFields(create2(IdentityAccountSpecSchema,{idpId,email:profile.email,firstName:profile.firstName,lastName:profile.lastName,pictureUrl:profile.pictureUrl})),provisioning:{mode:"direct"}};try{return{account:await deps.createAccount(input,caller),created:!0}}catch(error2){return{account:await resolveCreateRace(error2,()=>deps.accounts.findDirectByIdpId(idpId)),created:!1}}}}}async function profileOf(userInfo,caller){if(caller.issuer==="")return{email:caller.email??"",firstName:"",lastName:"",pictureUrl:""};try{return await userInfo.fetchUserProfile(caller.issuer,caller.rawToken)}catch(error2){throw new UserInfoFetchError(error2)}}function displayNameOf(caller,profile){return caller.issuer===""?caller.displayName??profile.email:profile.email}async function resolveCreateRace(error2,findWinner){let winner=await findWinner();if(winner===void 0)throw error2;return winner}function registerIdentityAccountServices(router,deps){router.service(IdentityAccountCommandController,{create:(account2,ctx)=>createRpc(deps,account2,ctx),update:(account2,ctx)=>update8(deps,account2,ctx),delete:(id,ctx)=>deleteAccount(deps,id,ctx),createFederatedAccount:(input,ctx)=>federated(deps,ctx,IdentityAccountCommandController.method.createFederatedAccount,input,(federation,ref,caller)=>federation.createFederatedAccount(input,ref,caller)),updateFederatedAccount:(input,ctx)=>federated(deps,ctx,IdentityAccountCommandController.method.updateFederatedAccount,input,(federation,ref,caller)=>federation.updateFederatedAccount(input,ref,caller)),deprovisionFederatedAccount:(input,ctx)=>federated(deps,ctx,IdentityAccountCommandController.method.deprovisionFederatedAccount,input,(federation,ref,caller)=>federation.deprovisionFederatedAccount(input,ref,caller)),provisionMyAccount:(empty,ctx)=>provisionMyAccount(deps,empty,ctx)}),router.service(IdentityAccountQueryController,{get:(id,ctx)=>get9(deps,id,ctx),whoAmI:(empty,ctx)=>whoAmI(deps,empty,ctx),getByEmail:(email,ctx)=>getByEmail(deps,email,ctx),getByIdpId:(idpId,ctx)=>getByIdpId(deps,idpId,ctx),getByExternalSub:(lookup3,ctx)=>federated(deps,ctx,IdentityAccountQueryController.method.getByExternalSub,lookup3,(federation,ref,caller)=>federation.getByExternalSub(lookup3,ref,caller)),getActorInfo:(id,ctx)=>getActorInfo(deps,id,ctx)})}function kindOf8(ctx){return ctx.values.get(apiResourceKindKey)}async function runCreateChain(deps,account2,caller,kind,provisioning){let reqCtx=new RequestContext(IdentityAccountSchema,account2,caller,kind);return await newPipeline("identityaccount-create",deps.logger).addStep(newAuthorizeStep(IdentityAccountCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newDefaultAccountNameStep()).addStep(newResolveSlugStep()).addStep(newDeriveAccountIdStep()).addStep(newCheckDuplicateStep2(deps.accounts)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newAssignBackendFieldsStep(provisioning)).addStep(newPersistNewAccountStep(deps.accounts)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),reqCtx.newState}function newCreateAccountPath(deps,kind){return(input,caller)=>runCreateChain(deps,create2(IdentityAccountSchema,{apiVersion:"iam.stigmer.ai/v1",kind:"IdentityAccount",metadata:{name:input.name,...input.provisioning.mode==="platform_client"?{org:input.provisioning.org}:{}},spec:input.spec}),caller,kind,input.provisioning)}function createRpc(deps,account2,ctx){let caller=callerIdentityOf(ctx);return guardInternalRpc(caller),runCreateChain(deps,account2,caller,kindOf8(ctx),{mode:"direct"})}function guardInternalRpc(caller){if(!isPlatformPipelineCaller(caller))throw new ConnectError(CREATE_IS_INTERNAL_MESSAGE,Code.PermissionDenied)}async function update8(deps,account2,ctx){let reqCtx=new RequestContext(IdentityAccountSchema,account2,callerIdentityOf(ctx),kindOf8(ctx));return await newPipeline("identityaccount-update",deps.logger).addStep(newAuthorizeStep(IdentityAccountCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingAccountStep(deps.accounts)).addStep(newGuardImmutableSubjectStep()).addStep(newBuildUpdateStateStep()).addStep(newPreserveBackendFieldsStep()).addStep(newPersistUpdatedAccountStep(deps.accounts)).build().execute(reqCtx),reqCtx.newState}async function deleteAccount(deps,id,ctx){let reqCtx=new RequestContext(IdentityAccountCommandController.method.delete.input,id,callerIdentityOf(ctx),kindOf8(ctx));await newPipeline("identityaccount-delete",deps.logger).addStep(newAuthorizeStep(IdentityAccountCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingAccountForDeleteStep(deps.accounts)).addStep(newDeleteAccountStep(deps.accounts)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("delete pipeline completed without a loaded resource"),"deleted identity account not found in context");return deleted}async function get9(deps,id,ctx){return loadTarget(deps,IdentityAccountQueryController.method.get,id,ctx)}async function getActorInfo(deps,id,ctx){let account2=await loadTarget(deps,IdentityAccountQueryController.method.getActorInfo,id,ctx),firstName=account2.spec?.firstName??"",lastName=account2.spec?.lastName??"";return create2(ApiResourceAuditActorSchema,{id:account2.metadata?.id??"",avatar:account2.spec?.pictureUrl??"",displayName:`${firstName} ${lastName}`.trim(),email:account2.spec?.email??""})}async function loadTarget(deps,method,id,ctx){let reqCtx=new RequestContext(method.input,id,callerIdentityOf(ctx),kindOf8(ctx));return await newPipeline(`identityaccount-${method.localName}`,deps.logger).addStep(newAuthorizeStep(method,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetAccountStep(deps.accounts)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function whoAmI(deps,_empty,ctx){let caller=callerIdentityOf(ctx),account2=await read(()=>accountForCaller(deps.accounts,caller),"failed to load identity account");if(account2===void 0)throw new ConnectError(ACCOUNT_NOT_FOUND_FOR_CALLER_MESSAGE,Code.NotFound);return account2}async function getByEmail(deps,email,ctx){return lookupThenAuthorize(deps,IdentityAccountQueryController.method.getByEmail,email,ctx,()=>deps.accounts.findDirectByEmail(email.value),email.value)}async function getByIdpId(deps,idpId,ctx){return lookupThenAuthorize(deps,IdentityAccountQueryController.method.getByIdpId,idpId,ctx,()=>deps.accounts.findByIdpId(idpId.value),idpId.value)}async function lookupThenAuthorize(deps,method,input,ctx,lookup3,handle){let account2=await read(lookup3,"failed to look up identity account");if(account2===void 0)throw accountNotFoundError(handle);return await authorizeDirect(method,deps.authorizer,callerIdentityOf(ctx),input,{resourceId:account2.metadata?.id??""}),account2}async function provisionMyAccount(deps,_empty,ctx){let caller=callerIdentityOf(ctx),idpId=idpIdOf(caller);if(idpId==="")throw new ConnectError(NO_IDP_ID_MESSAGE,Code.Unauthenticated);let account2,created;try{({account:account2,created}=await deps.provisioner.provisionDirectAccount(idpId,caller))}catch(error2){throw error2 instanceof UserInfoFetchError?new ConnectError(`${USERINFO_UNAVAILABLE_PREFIX}${error2.message}`,Code.Unavailable):error2}let asAccount={...caller,identityId:account2.metadata?.id??""};if(created&&deps.membership!==void 0)try{await deps.membership.onAccountCreated(account2,asAccount)}catch(error2){throw internalError(error2,"failed to record organization membership")}let gates=stepsForSlot(deps.gateSteps,"identity-account-provision:post-persist");if(gates.length>0){let reqCtx=new RequestContext(IdentityAccountSchema,account2,asAccount,kindOf8(ctx)),pipeline2=newPipeline("identityaccount-provision-post-persist",deps.logger);for(let step of gates)pipeline2.addStep(step);await pipeline2.build().execute(reqCtx)}return account2}async function federated(deps,ctx,method,input,arm){let federation=deps.federation;if(federation===void 0)throw new ConnectError(federationUnimplementedMessage(`${method.parent.typeName}.${method.localName}`),Code.Unimplemented);let caller=callerIdentityOf(ctx),org=input.org,ref=input.identityProviderRef;if(ref===void 0||ref.slug==="")throw invalidArgumentError("identity_provider_ref with a valid slug is required");if(ref.org!==""&&ref.org!==org)throw invalidArgumentError(`identity_provider_ref.org '${ref.org}' does not match input org '${org}'`);await authorizeDirect(method,deps.authorizer,caller,input);let refOrg=ref.org!==""?ref.org:org;if(!await federation.providerExists(refOrg,ref.slug))throw new ConnectError(`IdentityProvider '${refOrg}/${ref.slug}' not found`,Code.NotFound);return ref.org=refOrg,arm(federation,ref,caller)}async function read(operation2,message6){try{return await operation2()}catch(error2){throw internalError(error2,message6)}}async function ensureOperatorAccount(deps,operator){let caller=trustedLocalIdentityFor(operator),idpId=localIdpIdFor(caller.identityId),existing=await deps.accounts.findById(accountIdFor(idpId));if(existing!==void 0)return existing;let name=operator.displayName!==""?operator.displayName:operator.email!==""?operator.email:SYSTEM_OPERATOR_IDENTITY_ID;try{return await deps.createAccount({name,spec:assignDirectBackendFields(create2(IdentityAccountSpecSchema,{idpId,email:operator.email})),provisioning:{mode:"direct"}},caller)}catch(error2){return resolveCreateRace(error2,()=>deps.accounts.findById(accountIdFor(idpId)))}}var KIND3=ApiResourceKind.identity_account;function newResourceIdentityAccountStore(store){async function readById(id){try{return await store.getResource(KIND3,id,IdentityAccountSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}async function readBySubject(idpId){if(idpId!=="")return readById(accountIdFor(idpId))}return{async save(account2){let id=account2.metadata?.id??"",idpId=account2.spec?.idpId??"";if(isDirect(account2)&&id!==accountIdFor(idpId))throw new Error("direct account id must be derived from its idp_id");if(await readById(id)!==void 0)throw new DuplicateAccountError(`identity account '${id}' already exists`);await store.saveResource(KIND3,id,IdentityAccountSchema,account2)},async update(account2){let id=account2.metadata?.id??"";await readById(id)!==void 0&&await store.saveResource(KIND3,id,IdentityAccountSchema,account2)},async deleteById(id){await store.deleteResource(KIND3,id)},findById:readById,findByIdpId:readBySubject,async findDirectByIdpId(idpId){let account2=await readBySubject(idpId);return account2!==void 0&&isDirect(account2)?account2:void 0},async findDirectByEmail(email){let account2;try{account2=await store.findByField(KIND3,"spec.email",email,IdentityAccountSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}return isDirect(account2)?account2:void 0},async findByIds(ids){let found=[];for(let id of new Set(ids)){let account2=await readById(id);account2!==void 0&&found.push(account2)}return found}}}function isDirect(account2){let mode=account2.spec?.provisioningMode;return account2.spec?.identityProviderRef===void 0&&mode!==IdentityAccountProvisioningMode.federated&&mode!==IdentityAccountProvisioningMode.platform_client}var file_ai_stigmer_iam_iampolicy_v1_io=fileDesc("CiRhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvaW8ucHJvdG8SG2FpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MSLDAgoSQXBpUmVzb3VyY2VSZWZWaWV3EgwKBGtpbmQYASABKAkSCgoCaWQYAiABKAkSEAoIcmVsYXRpb24YAyABKAkSDAoEbmFtZRgEIAEoCRINCgVlbWFpbBgFIAEoCRIMCgRzbHVnGAYgASgJEg4KBmF2YXRhchgHIAEoCRJACgdtZW1iZXJzGAggAygLMi8uYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmVmlldxI+CgV0ZWFtcxgJIAMoCzIvLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZlZpZXcSRAoPaWRlbnRpdHlfb3JpZ2luGAogASgLMisuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklkZW50aXR5T3JpZ2luIo4BCg5JZGVudGl0eU9yaWdpbhJdChFwcm92aXNpb25pbmdfbW9kZRgBIAEoDjJCLmFpLnN0aWdtZXIuaWFtLmlkZW50aXR5YWNjb3VudC52MS5JZGVudGl0eUFjY291bnRQcm92aXNpb25pbmdNb2RlEh0KFXByb3ZpZGVyX2Rpc3BsYXlfbmFtZRgCIAEoCSIkCgtJYW1Qb2xpY3lJZBIVCgV2YWx1ZRgBIAEoCUIGukgDyAEBIqcBChZQcmluY2lwYWxSZXNvdXJjZUlucHV0EkYKCXByaW5jaXBhbBgBIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBEkUKCHJlc291cmNlGAIgASgLMisuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmQga6SAPIAQEiqQEKF1Jlc291cmNlUHJpbmNpcGFsc0lucHV0EkUKCHJlc291cmNlGAEgASgLMisuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmQga6SAPIAQESRwoKcHJpbmNpcGFscxgCIAMoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBImQKFFJldm9rZU9yZ0FjY2Vzc0lucHV0EicKE2lkZW50aXR5X2FjY291bnRfaWQYASABKAlCCrpIB8gBAXICEAESIwoPb3JnYW5pemF0aW9uX2lkGAIgASgJQgq6SAfIAQFyAhABIkoKD0lhbVBvbGljaWVzTGlzdBI3CgdlbnRyaWVzGAEgAygLMiYuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeSJ7ChdMaXN0UmVzb3VyY2VBY2Nlc3NJbnB1dBJFCghyZXNvdXJjZRgBIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBEhkKEWluY2x1ZGVfaW5oZXJpdGVkGAIgASgIIl4KHVJlc291cmNlQWNjZXNzQnlQcmluY2lwYWxMaXN0Ej0KB2VudHJpZXMYASADKAsyLC5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuUHJpbmNpcGFsQWNjZXNzIowBCg9QcmluY2lwYWxBY2Nlc3MSQgoJcHJpbmNpcGFsGAEgASgLMi8uYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmVmlldxI1CgVyb2xlcxgCIAMoCzImLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5Sb2xlR3JhbnQimwEKCVJvbGVHcmFudBIzCgRyb2xlGAEgASgLMiUuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlJvbGVJbmZvEkMKDm93bmVyX3Jlc291cmNlGAIgASgLMisuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmEhQKDGlzX2luaGVyaXRlZBgDIAEoCCJUChhSZXNvdXJjZUFjY2Vzc0J5Um9sZUxpc3QSOAoHZW50cmllcxgBIAMoCzInLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5Sb2xlQWNjZXNzIocBCgpSb2xlQWNjZXNzEjQKBHJvbGUYASABKAsyJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuUm9sZUdyYW50EkMKCnByaW5jaXBhbHMYAiADKAsyLy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXBpUmVzb3VyY2VSZWZWaWV3IkcKCFJvbGVJbmZvEgoKAmlkGAEgASgJEgwKBGNvZGUYAiABKAkSDAoEbmFtZRgDIAEoCRITCgtkZXNjcmlwdGlvbhgEIAEoCSJOChZQcmluY2lwYWxSZXNvdXJjZVJvbGVzEjQKBXJvbGVzGAEgAygLMiUuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlJvbGVJbmZvIqYBChdDaGVja0F1dGhvcml6YXRpb25JbnB1dBJCCgZwb2xpY3kYASABKAsyKi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5U3BlY0IGukgDyAEBEkcKE2NvbnRleHR1YWxfcG9saWNpZXMYAiADKAsyKi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5U3BlYyIxChhDaGVja0F1dGhvcml6YXRpb25SZXN1bHQSFQoNaXNfYXV0aG9yaXplZBgBIAEoCCLIAQoWQ2hlY2tNeVBlcm1pc3Npb25JbnB1dBJFCghyZXNvdXJjZRgBIAEoCzIrLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5BcGlSZXNvdXJjZVJlZkIGukgDyAEBEh4KCHJlbGF0aW9uGAIgASgJQgy6SAnIAQFyBBABGEASRwoTY29udGV4dHVhbF9wb2xpY2llcxgDIAMoCzIqLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5JYW1Qb2xpY3lTcGVjIvIBCh5MaXN0QXV0aG9yaXplZFJlc291cmNlSWRzSW5wdXQSRgoJcHJpbmNpcGFsGAEgASgLMisuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmQga6SAPIAQESIQoNcmVzb3VyY2Vfa2luZBgCIAEoCUIKukgHyAEBcgIQARIcCghyZWxhdGlvbhgDIAEoCUIKukgHyAEBcgIQARJHChNjb250ZXh0dWFsX3BvbGljaWVzGAQgAygLMiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMiMQoZQXV0aG9yaXplZFJlc291cmNlSWRzTGlzdBIUCgxyZXNvdXJjZV9pZHMYASADKAki8wEKH0xpc3RBdXRob3JpemVkUHJpbmNpcGFsSWRzSW5wdXQSRQoIcmVzb3VyY2UYASABKAsyKy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXBpUmVzb3VyY2VSZWZCBrpIA8gBARIiCg5wcmluY2lwYWxfa2luZBgCIAEoCUIKukgHyAEBcgIQARIcCghyZWxhdGlvbhgDIAEoCUIKukgHyAEBcgIQARJHChNjb250ZXh0dWFsX3BvbGljaWVzGAQgAygLMiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMiMwoaQXV0aG9yaXplZFByaW5jaXBhbElkc0xpc3QSFQoNcHJpbmNpcGFsX2lkcxgBIAMoCSJZChdHZXRQcmluY2lwYWxzQ291bnRJbnB1dBIaCgZvcmdfaWQYASABKAlCCrpIB8gBAXICEAESIgoOcHJpbmNpcGFsX2tpbmQYAiABKAlCCrpIB8gBAXICEAEiIAoPUHJpbmNpcGFsc0NvdW50Eg0KBWNvdW50GAEgASgFYgZwcm90bzM",[file_ai_stigmer_iam_iampolicy_v1_api,file_ai_stigmer_iam_iampolicy_v1_spec,file_ai_stigmer_iam_identityaccount_v1_enum,file_buf_validate_validate]),ApiResourceRefViewSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,0),IdentityOriginSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,1);var RevokeOrgAccessInputSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,5);var ResourceAccessByPrincipalListSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,8),PrincipalAccessSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,9),RoleGrantSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,10);var RoleInfoSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,13),PrincipalResourceRolesSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,14);var CheckAuthorizationResultSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,16);var AuthorizedResourceIdsListSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,19);var AuthorizedPrincipalIdsListSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,21);var PrincipalsCountSchema=messageDesc2(file_ai_stigmer_iam_iampolicy_v1_io,23);var file_ai_stigmer_iam_iampolicy_v1_command=fileDesc("CilhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvY29tbWFuZC5wcm90bxIbYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxMuYIChpJYW1Qb2xpY3lDb21tYW5kQ29udHJvbGxlchKeAQoGY3JlYXRlEiouYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLklhbVBvbGljeVNwZWMaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IkDCuBg8CAQaDXJlc291cmNlLmtpbmQiC3Jlc291cmNlLmlkKhx1bmF1dGhvcml6ZWQgdG8gZ3JhbnQgYWNjZXNzEp8BCgZkZWxldGUSKi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5U3BlYxomLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5JYW1Qb2xpY3kiQcK4GD0IBBoNcmVzb3VyY2Uua2luZCILcmVzb3VyY2UuaWQqHXVuYXV0aG9yaXplZCB0byByZXZva2UgYWNjZXNzEsIBCg9ib290c3RyYXBQb2xpY3kSKi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5U3BlYxomLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5JYW1Qb2xpY3kiW8K4GFcIERAfKkh1bmF1dGhvcml6ZWQgdG8gYm9vdHN0cmFwIHBvbGljeSAtIGNhbl9ib290c3RyYXBfaWFtIHBlcm1pc3Npb24gcmVxdWlyZWQyB3N0aWdtZXISxAEKF2NsZWFudXBSZXNvdXJjZVBvbGljaWVzEisuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkFwaVJlc291cmNlUmVmGhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5ImTCuBhgCBEQHypRdW5hdXRob3JpemVkIHRvIGNsZWFudXAgcmVzb3VyY2UgcG9saWNpZXMgLSBjYW5fYm9vdHN0cmFwX2lhbSBwZXJtaXNzaW9uIHJlcXVpcmVkMgdzdGlnbWVyEqMBCg9yZXZva2VPcmdBY2Nlc3MSMS5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuUmV2b2tlT3JnQWNjZXNzSW5wdXQaFi5nb29nbGUucHJvdG9idWYuRW1wdHkiRcK4GEEIBBAeIg9vcmdhbml6YXRpb25faWQqKnVuYXV0aG9yaXplZCB0byByZXZva2Ugb3JnYW5pemF0aW9uIGFjY2VzcxLMAQoYYm9vdHN0cmFwUmV2b2tlT3JnQWNjZXNzEjEuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlJldm9rZU9yZ0FjY2Vzc0lucHV0GhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5ImXCuBhhCBEQHypSdW5hdXRob3JpemVkIHRvIHJldm9rZSBvcmdhbml6YXRpb24gYWNjZXNzIC0gY2FuX2Jvb3RzdHJhcF9pYW0gcGVybWlzc2lvbiByZXF1aXJlZDIHc3RpZ21lchoEoP8rCmIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_iampolicy_v1_api,file_ai_stigmer_iam_iampolicy_v1_io,file_ai_stigmer_iam_iampolicy_v1_spec,file_google_protobuf_empty]),IamPolicyCommandController=serviceDesc(file_ai_stigmer_iam_iampolicy_v1_command,0);var file_ai_stigmer_iam_iampolicy_v1_query=fileDesc("CidhaS9zdGlnbWVyL2lhbS9pYW1wb2xpY3kvdjEvcXVlcnkucHJvdG8SG2FpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MTKgCwoYSWFtUG9saWN5UXVlcnlDb250cm9sbGVyEoUBCgNnZXQSKC5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5SWQaJi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuSWFtUG9saWN5IizCuBgoCAUqJHVuYXV0aG9yaXplZCB0byB2aWV3IGFjY2VzcyBwb2xpY2llcxKFAQoRY2hlY2tNeVBlcm1pc3Npb24SMy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQ2hlY2tNeVBlcm1pc3Npb25JbnB1dBo1LmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5DaGVja0F1dGhvcml6YXRpb25SZXN1bHQiBNC4GAEShwEKEmNoZWNrQXV0aG9yaXphdGlvbhI0LmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5DaGVja0F1dGhvcml6YXRpb25JbnB1dBo1LmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5DaGVja0F1dGhvcml6YXRpb25SZXN1bHQiBNC4GAESlgEKGWxpc3RBdXRob3JpemVkUmVzb3VyY2VJZHMSOy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuTGlzdEF1dGhvcml6ZWRSZXNvdXJjZUlkc0lucHV0GjYuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkF1dGhvcml6ZWRSZXNvdXJjZUlkc0xpc3QiBNC4GAES5gEKGmxpc3RBdXRob3JpemVkUHJpbmNpcGFsSWRzEjwuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkxpc3RBdXRob3JpemVkUHJpbmNpcGFsSWRzSW5wdXQaNy5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuQXV0aG9yaXplZFByaW5jaXBhbElkc0xpc3QiUcK4GE0IBRoNcmVzb3VyY2Uua2luZCILcmVzb3VyY2UuaWQqLXVuYXV0aG9yaXplZCB0byB2aWV3IGF1dGhvcml6ZWQgcHJpbmNpcGFsIGlkcxLbAQodbGlzdFJlc291cmNlQWNjZXNzQnlQcmluY2lwYWwSNC5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuTGlzdFJlc291cmNlQWNjZXNzSW5wdXQaOi5haS5zdGlnbWVyLmlhbS5pYW1wb2xpY3kudjEuUmVzb3VyY2VBY2Nlc3NCeVByaW5jaXBhbExpc3QiSMK4GEQIBRoNcmVzb3VyY2Uua2luZCILcmVzb3VyY2UuaWQqJHVuYXV0aG9yaXplZCB0byB2aWV3IHJlc291cmNlIGFjY2VzcxLPAQoZZ2V0UHJpbmNpcGFsUmVzb3VyY2VSb2xlcxIzLmFpLnN0aWdtZXIuaWFtLmlhbXBvbGljeS52MS5QcmluY2lwYWxSZXNvdXJjZUlucHV0GjMuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlByaW5jaXBhbFJlc291cmNlUm9sZXMiSMK4GEQIBRoNcmVzb3VyY2Uua2luZCILcmVzb3VyY2UuaWQqJHVuYXV0aG9yaXplZCB0byB2aWV3IHByaW5jaXBhbCByb2xlcxKxAQoSZ2V0UHJpbmNpcGFsc0NvdW50EjQuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLkdldFByaW5jaXBhbHNDb3VudElucHV0GiwuYWkuc3RpZ21lci5pYW0uaWFtcG9saWN5LnYxLlByaW5jaXBhbHNDb3VudCI3wrgYMwgFEB4iBm9yZ19pZColdW5hdXRob3JpemVkIHRvIHZpZXcgcHJpbmNpcGFscyBjb3VudBoEoP8rCmIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_iampolicy_v1_api,file_ai_stigmer_iam_iampolicy_v1_io]),IamPolicyQueryController=serviceDesc(file_ai_stigmer_iam_iampolicy_v1_query,0);var ROLE_DISPLAY=[{role:IamRole.owner,name:"Owner",description:"Full control of the resource including ownership transfer"},{role:IamRole.admin,name:"Administrator",description:"Administrative access with most permissions except ownership transfer"},{role:IamRole.member,name:"Member",description:"Read and limited write access to the resource"},{role:IamRole.viewer,name:"Viewer",description:"Read-only access to the resource"},{role:IamRole.participant,name:"Participant",description:"Reply to customers and manage conversation takeover on a channel"}],RELATION_TO_DISPLAY=new Map(ROLE_DISPLAY.map(entry=>[IamRole[entry.role],entry]));function assignableRelations(){return[...RELATION_TO_DISPLAY.keys()]}function isAssignableRole(relation){return RELATION_TO_DISPLAY.has(relation)}function roleInfoFromRelation(relation){let display=RELATION_TO_DISPLAY.get(relation);if(display===void 0)return create2(RoleInfoSchema);let code=IamRole[display.role];return create2(RoleInfoSchema,{id:code,code,name:display.name,description:display.description})}var MAX_HIERARCHY_DEPTH=5,TERMINAL_KINDS=new Set([kindEnumName(ApiResourceKind.platform)]);async function resolveHierarchy(policies,resourceKind,resourceId,includeInherited){let hierarchy=[{kind:resourceKind,id:resourceId}];if(!includeInherited)return hierarchy;let currentKind=resourceKind,currentId=resourceId;for(let depth=0;depth<MAX_HIERARCHY_DEPTH&&!TERMINAL_KINDS.has(currentKind);depth++){let parent=(await policies.findScopeTuple(currentKind,currentId))?.spec?.principal;if(parent===void 0)break;currentKind=parent.kind,currentId=parent.id,hierarchy.push({kind:currentKind,id:currentId})}return hierarchy}async function buildPrincipalAccessList(policies,displayResolver,principalDisplay,hierarchy){let grants=[];for(let[index2,level]of hierarchy.entries()){let rows=await policies.findByResourceWithRelations(level.kind,level.id,assignableRelations());for(let policy of rows)grants.push({policy,isInherited:index2>0,level})}if(grants.length===0)return[];let enriched=await resolvePrincipalViews(grants.map(g5=>g5.policy),displayResolver,principalDisplay),grouped=new Map;for(let grant of grants){let principal=grant.policy.spec?.principal;if(principal===void 0)continue;let key=`${principal.kind}:${principal.id}#${principal.relation}`,entry=grouped.get(key);if(entry===void 0){let view=enriched.get(`${principal.kind}:${principal.id}`);entry={principal:withRelation(view??create2(ApiResourceRefViewSchema,{kind:principal.kind,id:principal.id,name:principal.id}),principal.relation),roles:[]},grouped.set(key,entry)}entry.roles.push(buildGrant(grant.policy,grant.isInherited,grant.level))}return[...grouped.values()].map(entry=>create2(PrincipalAccessSchema,{principal:entry.principal,roles:entry.roles}))}async function resolvePrincipalViews(rows,displayResolver,principalDisplay){let accountKind=kindEnumName(ApiResourceKind.identity_account),idsByKind=new Map;for(let row of rows){let principal=row.spec?.principal;if(principal===void 0)continue;let ids=idsByKind.get(principal.kind)??new Set;ids.add(principal.id),idsByKind.set(principal.kind,ids)}let views=new Map;for(let[kindName,ids]of idsByKind){let resolved;if(kindName===accountKind)resolved=await displayResolver.resolveIdentityAccounts([...ids]);else{let kind=kindByEnumName(kindName);if(principalDisplay===void 0||kind===ApiResourceKind.api_resource_kind_unknown)continue;resolved=await principalDisplay.resolve(kind,[...ids])}for(let[id,view]of resolved)views.set(`${kindName}:${id}`,view)}return views}function withRelation(view,relation){let stamped=clone(ApiResourceRefViewSchema,view);return stamped.relation=relation,stamped}function buildGrant(policy,isInherited,level){return create2(RoleGrantSchema,{role:roleInfoFromRelation(policy.spec?.relation??""),isInherited,...isInherited?{ownerResource:create2(ApiResourceRefSchema,{kind:level.kind,id:level.id})}:{}})}var STIGMER_PROVIDER_LABEL="Stigmer";function newAccountDisplayResolver(accounts){return{async resolveIdentityAccounts(ids){let rows=await accounts.findByIds(ids),resolved=new Map;for(let account2 of rows){let id=account2.metadata?.id??"";resolved.set(id,viewOf(id,account2))}return resolved}}}function viewOf(id,account2){let spec=account2.spec;return create2(ApiResourceRefViewSchema,{kind:kindEnumName(ApiResourceKind.identity_account),id,name:displayNameOf2(spec?.firstName??"",spec?.lastName??"",account2.metadata?.name??"",spec?.email??""),email:spec?.email??"",avatar:spec?.pictureUrl??"",identityOrigin:create2(IdentityOriginSchema,{provisioningMode:spec?.provisioningMode??IdentityAccountProvisioningMode.identity_account_provisioning_mode_unspecified,providerDisplayName:providerLabelOf(spec?.provisioningMode)})})}function displayNameOf2(firstName,lastName,accountName,email){return firstName!==""&&lastName!==""?`${firstName} ${lastName}`:firstName!==""?firstName:lastName!==""?lastName:accountName!==""?accountName:email}function providerLabelOf(mode){switch(mode){case IdentityAccountProvisioningMode.direct:case IdentityAccountProvisioningMode.machine:return STIGMER_PROVIDER_LABEL;default:return""}}var byName;function permissionByEnumName(relation){return byName===void 0&&(byName=new Map(IamPermissionSchema.values.filter(value=>value.number!==IamPermission.unspecified).map(value=>[value.name,value.number]))),byName.get(relation)}function requireKnownResourceKind(kind){let resolved=kindByEnumName(kind);if(resolved===ApiResourceKind.api_resource_kind_unknown)throw new ConnectError(unknownResourceKindMessage(kind),Code.InvalidArgument);return resolved}function requireKnownPrincipalKind(kind){let resolved=kindByEnumName(kind);if(resolved===ApiResourceKind.api_resource_kind_unknown)throw new ConnectError(unknownPrincipalKindMessage(kind),Code.InvalidArgument);return resolved}function requireWellFormedTriple(spec){let{principal,resource}=refsOf(spec),malformed=malformedTripleField(spec);if(malformed!==void 0)throw new ConnectError(malformedTripleMessage(malformed),Code.InvalidArgument);return{principal,resource,resourceKind:requireKnownResourceKind(resource.kind),principalKind:requireKnownPrincipalKind(principal.kind)}}function refsOf(spec){if(spec.principal===void 0||spec.resource===void 0)throw new Error("policy spec must carry principal and resource");return{principal:spec.principal,resource:spec.resource}}var POLICY_RESULT_KEY="policyResult";function newValidateGrantableRoleStep(scope){return{name:"ValidateGrantableRole",execute(ctx){let spec=ctx.input,kindName=spec.resource?.kind??"",kind=requireKnownResourceKind(kindName),contract=grantableRolesFor(kind);if(contract.length===0)throw new ConnectError(noGrantableRolesMessage(kindName),Code.InvalidArgument);let scoped=new Set(scope.grantableRoles(kind));if(scoped.size===0)throw new ConnectError(PER_RESOURCE_GRANTS_UNIMPLEMENTED_MESSAGE,Code.Unimplemented);let principal=spec.principal;if(principal?.kind===TEAM_KIND_NAME){requireTeamGrant(spec.relation,principal.relation,kind,kindName,scoped);return}let grantable=contract.filter(role=>scoped.has(role));if(!grantable.some(role=>IamRole[role]===spec.relation))throw new ConnectError(roleNotGrantableMessage(spec.relation,kindName,grantable.map(role=>IamRole[role])),Code.InvalidArgument);let principalKindName=principal?.kind??"";if(requireKnownPrincipalKind(principalKindName)!==ApiResourceKind.identity_account)throw new ConnectError(principalNotGrantableMessage(principalKindName),Code.InvalidArgument);let qualifier=principal?.relation??"";if(qualifier!=="")throw new ConnectError(personQualifierMessage(qualifier),Code.InvalidArgument)}}}var TEAM_KIND_NAME=kindEnumName(ApiResourceKind.team);function requireTeamGrant(role,qualifier,kind,kindName,scoped){let teamGrantable=teamGrantableRolesFor(kind).filter(r5=>scoped.has(r5));if(teamGrantable.length===0)throw new ConnectError(teamNotGrantableMessage(kindName),Code.InvalidArgument);if(!teamGrantable.some(r5=>IamRole[r5]===role))throw new ConnectError(teamRoleNotGrantableMessage(role,kindName,teamGrantable.map(r5=>IamRole[r5])),Code.InvalidArgument);if(qualifier!==TEAM_MEMBERS_RELATION)throw new ConnectError(teamQualifierMessage(qualifier),Code.InvalidArgument)}function newGrantStep(grantPath){return{name:"Grant",async execute(ctx){let{policy}=await grantPath.grant(ctx.input,ctx.callerIdentity);ctx.set(POLICY_RESULT_KEY,policy)}}}function newRevokeStep(grantPath){return{name:"Revoke",async execute(ctx){let revoked=await grantPath.revokeBySpec(ctx.input);ctx.set(POLICY_RESULT_KEY,revoked??create2(IamPolicySchema))}}}function newRevokeOrgAccessStep(grantPath){return{name:"RevokeOrgAccess",execute(ctx){return grantPath.revokeOrgAccess(ctx.input.identityAccountId,ctx.input.organizationId)}}}function newCleanupResourceStep(grantPath){return{name:"CleanupResource",execute(ctx){let ref=ctx.input;return grantPath.cleanupResource(ref)}}}var ORGANIZATION_KIND_NAME=kindEnumName(ApiResourceKind.organization),IDENTITY_ACCOUNT_KIND_NAME=kindEnumName(ApiResourceKind.identity_account),OWNER_RELATION=IamRole[IamRole.owner],ORGANIZATION_OWNERS_KEY="organizationOwners";async function organizationOwners(ctx,policies,organizationId){let held=ctx.get(ORGANIZATION_OWNERS_KEY);if(held instanceof Set)return held;let rows=await policies.findByResourceWithRelations(ORGANIZATION_KIND_NAME,organizationId,[OWNER_RELATION]),owners=new Set(rows.map(row=>row.spec?.principal).filter(principal=>principal?.kind===IDENTITY_ACCOUNT_KIND_NAME).map(principal=>principal?.id??""));return ctx.set(ORGANIZATION_OWNERS_KEY,owners),owners}function specOwnerRoleChange(ctx){let{resource,principal,relation}=ctx.input;return resource?.kind!==ORGANIZATION_KIND_NAME||relation!==OWNER_RELATION?Promise.resolve(void 0):Promise.resolve({organizationId:resource.id,accountId:principal?.id??""})}function orgAccessOwnerRoleChange(policies){return async ctx=>{let{identityAccountId,organizationId}=ctx.input;return(await organizationOwners(ctx,policies,organizationId)).has(identityAccountId)?{organizationId,accountId:identityAccountId}:void 0}}function newAuthorizeOwnerAssignmentStep(authorizer,ownerRoleChange){return{name:"AuthorizeOwnerAssignment",async execute(ctx){if(ctx.callerIdentity.callerClass==="internal")return;let change=await ownerRoleChange(ctx);change!==void 0&&await authorizeResolvedResource(authorizer,ctx.callerIdentity,{permission:IamPermission.can_assign_roles,resourceKind:ApiResourceKind.organization,resourceId:change.organizationId},OWNER_ASSIGNMENT_DENIED_MESSAGE)}}}function newKeepOneOwnerStep(policies,ownerRoleChange){return{name:"KeepOneOwner",async execute(ctx){if(ctx.callerIdentity.callerClass==="internal")return;let change=await ownerRoleChange(ctx);if(change===void 0)return;let owners=await organizationOwners(ctx,policies,change.organizationId);if(owners.has(change.accountId)&&owners.size===1)throw new ConnectError(LAST_OWNER_MESSAGE,Code.FailedPrecondition)}}}var SELF_PRINCIPAL_ID="_self";function registerIamPolicyServices(router,deps){let displayResolver=newAccountDisplayResolver(deps.accounts),command5=IamPolicyCommandController.method;router.service(IamPolicyCommandController,{create:(spec,ctx)=>createPolicy(deps,spec,ctx),delete:(spec,ctx)=>deletePolicy(deps,spec,ctx),bootstrapPolicy:(spec,ctx)=>(guardSystemRpc(command5.bootstrapPolicy,callerIdentityOf(ctx)),grantThroughChain(deps,command5.bootstrapPolicy,spec,ctx,!1)),cleanupResourcePolicies:(ref,ctx)=>(guardSystemRpc(command5.cleanupResourcePolicies,callerIdentityOf(ctx)),cleanupResourcePolicies(deps,ref,ctx)),revokeOrgAccess:(input,ctx)=>revokeOrgAccess(deps,command5.revokeOrgAccess,input,ctx,!0),bootstrapRevokeOrgAccess:(input,ctx)=>(guardSystemRpc(command5.bootstrapRevokeOrgAccess,callerIdentityOf(ctx)),revokeOrgAccess(deps,command5.bootstrapRevokeOrgAccess,input,ctx,!1))}),router.service(IamPolicyQueryController,{get:(id,ctx)=>get10(deps,id,ctx),checkMyPermission:(input,ctx)=>checkMyPermission(deps,input,ctx),checkAuthorization:(input,ctx)=>checkAuthorization(deps,input,ctx),listAuthorizedResourceIds:(input,ctx)=>listAuthorizedResourceIds(deps,input,ctx),listAuthorizedPrincipalIds:(input,ctx)=>listAuthorizedPrincipalIds(deps,input,ctx),listResourceAccessByPrincipal:(input,ctx)=>listResourceAccessByPrincipal(deps,displayResolver,input,ctx),getPrincipalResourceRoles:(input,ctx)=>getPrincipalResourceRoles(deps,input,ctx),getPrincipalsCount:(input,ctx)=>getPrincipalsCount(deps,input,ctx)})}function kindOf9(ctx){return ctx.values.get(apiResourceKindKey)}function guardSystemRpc(method,caller){if(!isPlatformPipelineCaller(caller))throw new ConnectError(getOption(method,config).errorMsg,Code.PermissionDenied)}function createPolicy(deps,spec,ctx){return requireWellFormedTriple(spec),grantThroughChain(deps,IamPolicyCommandController.method.create,spec,ctx,!0)}async function grantThroughChain(deps,method,spec,ctx,validateRole){let reqCtx=new RequestContext(IamPolicySpecSchema,spec,callerIdentityOf(ctx),kindOf9(ctx)),pipeline2=newPipeline(`iampolicy-${method.localName}`,deps.logger).addStep(newAuthorizeStep(method,deps.authorizer)).addStep(newValidateProtoStep());if(validateRole){pipeline2.addStep(newValidateGrantableRoleStep(deps.grantScope)),pipeline2.addStep(newAuthorizeOwnerAssignmentStep(deps.authorizer,specOwnerRoleChange));for(let step of stepsForSlot(deps.gateSteps,"iam-policy-create:pre-side-effect-gate"))pipeline2.addStep(step)}return await pipeline2.addStep(newGrantStep(deps.grantPath)).build().execute(reqCtx),policyResultOf(reqCtx,method)}async function deletePolicy(deps,spec,ctx){requireWellFormedTriple(spec);let method=IamPolicyCommandController.method.delete,reqCtx=new RequestContext(IamPolicySpecSchema,spec,callerIdentityOf(ctx),kindOf9(ctx));return await newPipeline("iampolicy-delete",deps.logger).addStep(newAuthorizeStep(method,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeOwnerAssignmentStep(deps.authorizer,specOwnerRoleChange)).addStep(newKeepOneOwnerStep(deps.policies,specOwnerRoleChange)).addStep(newRevokeStep(deps.grantPath)).build().execute(reqCtx),policyResultOf(reqCtx,method)}async function revokeOrgAccess(deps,method,input,ctx,guardOwners){let reqCtx=new RequestContext(RevokeOrgAccessInputSchema,input,callerIdentityOf(ctx),kindOf9(ctx)),pipeline2=newPipeline(`iampolicy-${method.localName}`,deps.logger).addStep(newAuthorizeStep(method,deps.authorizer)).addStep(newValidateProtoStep());if(guardOwners){let ownerRoleChange=orgAccessOwnerRoleChange(deps.policies);pipeline2.addStep(newAuthorizeOwnerAssignmentStep(deps.authorizer,ownerRoleChange)).addStep(newKeepOneOwnerStep(deps.policies,ownerRoleChange))}return await pipeline2.addStep(newRevokeOrgAccessStep(deps.grantPath)).build().execute(reqCtx),create2(EmptySchema)}async function cleanupResourcePolicies(deps,ref,ctx){let method=IamPolicyCommandController.method.cleanupResourcePolicies,reqCtx=new RequestContext(ApiResourceRefSchema,ref,callerIdentityOf(ctx),kindOf9(ctx));return await newPipeline("iampolicy-cleanupResourcePolicies",deps.logger).addStep(newAuthorizeStep(method,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newCleanupResourceStep(deps.grantPath)).build().execute(reqCtx),create2(EmptySchema)}function policyResultOf(reqCtx,method){let result=reqCtx.get(POLICY_RESULT_KEY);if(result===void 0)throw internalError(new Error(`${method.localName} pipeline completed without a policy`),"policy not found in context");return result}async function get10(deps,id,ctx){let policy=await read2(()=>deps.policies.findById(id.value),"failed to load IAM policy");if(policy===void 0)throw new ConnectError(policyNotFoundMessage(id.value),Code.NotFound);let{resource}=refsOf(specOfRow(policy));return await authorizeDirect(IamPolicyQueryController.method.get,deps.authorizer,callerIdentityOf(ctx),id,{resourceKind:kindByEnumName(resource.kind),resourceId:resource.id}),policy}async function checkMyPermission(deps,input,ctx){let caller=requireAuthenticated(callerIdentityOf(ctx)),permission=permissionByEnumName(input.relation);if(permission===void 0)throw new ConnectError(unknownPermissionMessage(input.relation),Code.InvalidArgument);let resource=requireRef(input.resource),resourceKind=requireKnownResourceKind(resource.kind);if(input.contextualPolicies.length>0){let engine=requireQueryEngine(deps),principal=create2(ApiResourceRefSchema,{kind:kindEnumName(ApiResourceKind.identity_account),id:await callerPrincipalId(deps,caller)}),policy=create2(IamPolicySpecSchema,{principal,relation:input.relation,resource}),allowed=await engine.check(policy,input.contextualPolicies);return create2(CheckAuthorizationResultSchema,{isAuthorized:allowed})}if(!kindServedByEdition(resourceKind,deps.edition))return create2(CheckAuthorizationResultSchema,{isAuthorized:!1});if(permission===IamPermission.can_grant_access&&deps.grantScope.grantableRoles(resourceKind).length===0)return create2(CheckAuthorizationResultSchema,{isAuthorized:!1});let decision=await evaluateAuthorizer(deps.authorizer,caller,{permission,resourceKind,resourceId:resource.id});switch(decision.kind){case"allow":return create2(CheckAuthorizationResultSchema,{isAuthorized:!0});case"deny":case"not-found":return create2(CheckAuthorizationResultSchema,{isAuthorized:!1});case"unavailable":throw internalError(decision.cause,AUTHORIZATION_UNAVAILABLE_MESSAGE);default:{let exhaustive=decision;throw internalError(new Error(`unknown decision ${JSON.stringify(exhaustive)}`),AUTHORIZATION_UNAVAILABLE_MESSAGE)}}}async function checkAuthorization(deps,input,ctx){let caller=requireAuthenticated(callerIdentityOf(ctx)),policy=requireInputPolicy(input.policy);await enforcePrincipalTrust(deps,caller,policy.principal),requireWellFormedTriple(policy);let allowed=await requireQueryEngine(deps).check(policy,input.contextualPolicies);return create2(CheckAuthorizationResultSchema,{isAuthorized:allowed})}async function listAuthorizedResourceIds(deps,input,ctx){let caller=requireAuthenticated(callerIdentityOf(ctx)),principal=requireRef(input.principal);await enforcePrincipalTrust(deps,caller,principal),requireKnownPrincipalKind(principal.kind),requireKnownResourceKind(input.resourceKind);let resourceIds=await requireQueryEngine(deps).listResourceIds(principal,input.relation,input.resourceKind,input.contextualPolicies);return create2(AuthorizedResourceIdsListSchema,{resourceIds:[...resourceIds]})}async function listAuthorizedPrincipalIds(deps,input,ctx){let resource=requireRef(input.resource);requireKnownResourceKind(resource.kind),requireKnownPrincipalKind(input.principalKind),await authorizeDirect(IamPolicyQueryController.method.listAuthorizedPrincipalIds,deps.authorizer,callerIdentityOf(ctx),input);let principalIds=await requireQueryEngine(deps).listPrincipalIds(resource,input.relation,input.principalKind,input.contextualPolicies);return create2(AuthorizedPrincipalIdsListSchema,{principalIds:[...principalIds]})}async function listResourceAccessByPrincipal(deps,displayResolver,input,ctx){let resource=requireRef(input.resource);requireKnownResourceKind(resource.kind),await authorizeDirect(IamPolicyQueryController.method.listResourceAccessByPrincipal,deps.authorizer,callerIdentityOf(ctx),input);let entries=await read2(async()=>{let hierarchy=await resolveHierarchy(deps.policies,resource.kind,resource.id,input.includeInherited);return buildPrincipalAccessList(deps.policies,displayResolver,deps.principalDisplay,hierarchy)},"failed to list resource access");return create2(ResourceAccessByPrincipalListSchema,{entries:[...entries]})}async function getPrincipalResourceRoles(deps,input,ctx){let resource=requireRef(input.resource),principal=requireRef(input.principal);requireKnownResourceKind(resource.kind),requireKnownPrincipalKind(principal.kind),await authorizeDirect(IamPolicyQueryController.method.getPrincipalResourceRoles,deps.authorizer,callerIdentityOf(ctx),input);let roles=(await read2(()=>deps.policies.findByPrincipalAndResource(principal.kind,principal.id,resource.kind,resource.id),"failed to load principal roles")).map(policy=>policy.spec?.relation??"").filter(isAssignableRole).map(roleInfoFromRelation);return create2(PrincipalResourceRolesSchema,{roles})}async function getPrincipalsCount(deps,input,ctx){let principalKind=input.principalKind===""?void 0:input.principalKind;principalKind!==void 0&&requireKnownPrincipalKind(principalKind),await authorizeDirect(IamPolicyQueryController.method.getPrincipalsCount,deps.authorizer,callerIdentityOf(ctx),input);let count=await read2(()=>deps.policies.countDistinctPrincipalsByResource(kindEnumName(ApiResourceKind.organization),input.orgId,principalKind,assignableRelations()),"failed to count principals");return create2(PrincipalsCountSchema,{count})}function requireAuthenticated(caller){if(caller.identityId==="")throw new ConnectError(AUTHENTICATION_REQUIRED_MESSAGE,Code.Unauthenticated);return caller}async function callerPrincipalId(deps,caller){return(await read2(()=>accountForCaller(deps.accounts,caller),"failed to resolve the caller's account"))?.metadata?.id??caller.identityId}async function enforcePrincipalTrust(deps,caller,principal){if(caller.callerClass==="machine"||caller.callerClass==="internal")return;if(principal?.kind!==kindEnumName(ApiResourceKind.identity_account))throw new ConnectError("Only self identity_account permission checks are supported",Code.InvalidArgument);let requestedId=principal.id;if(requestedId===""||requestedId===SELF_PRINCIPAL_ID)throw new ConnectError(`The '${SELF_PRINCIPAL_ID}' principal alias is not supported \u2014 use checkMyPermission for self permission checks`,Code.InvalidArgument);if(requestedId!==await callerPrincipalId(deps,caller))throw new ConnectError("Principal must be the authenticated caller",Code.PermissionDenied)}function requireQueryEngine(deps){if(deps.queries===void 0)throw new ConnectError(AUTHORIZATION_QUERIES_UNIMPLEMENTED_MESSAGE,Code.Unimplemented);return deps.queries}function requireRef(ref){if(ref===void 0)throw internalError(new Error("required reference missing after boundary validation"),"required reference missing after boundary validation");return ref}function requireInputPolicy(policy){if(policy===void 0)throw internalError(new Error("required policy missing after boundary validation"),"required policy missing after boundary validation");return policy}function specOfRow(policy){if(policy.spec===void 0)throw internalError(new Error(`policy ${policy.metadata?.id??"?"} has no spec \u2014 corrupt row`),"failed to load IAM policy");return policy.spec}async function read2(operation2,message6){try{return await operation2()}catch(error2){throw internalError(error2,message6)}}var DuplicatePolicyError=class extends Error{constructor(message6,options){super(message6,options),this.name="DuplicatePolicyError"}};var OWNER_RELATION2=IamRole[IamRole.owner];function newIamPolicyGrantPath(deps){let{policies,lifecycle,logger:logger2}=deps;async function findByTriple(spec){let{principal,resource}=refsOf(spec);return(await policies.findByPrincipalAndResource(principal.kind,principal.id,resource.kind,resource.id)).find(policy=>policy.spec!==void 0&&policy.spec.relation===spec.relation&&policy.spec.principal?.relation===principal.relation)}async function revokeRow(policy){let spec=policy.spec;if(spec===void 0)throw new Error(`policy ${policy.metadata?.id??"?"} has no spec \u2014 corrupt row`);await lifecycle?.onPolicyRevoked?.({spec,policy});let id=policy.metadata?.id??"";await policies.deleteById(id),logger2.info("iam policy revoked",fieldsOf(id,spec))}return{async grant(spec,caller){requireWellFormedTriple(spec);let policy=await findByTriple(spec),duplicate=policy!==void 0;if(policy===void 0){let fresh=buildRow(spec,caller);try{await policies.save(fresh),policy=fresh,logger2.info("iam policy granted",fieldsOf(policyIdFor(spec),spec))}catch(error2){if(!(error2 instanceof DuplicatePolicyError))throw error2;let winner=await findByTriple(spec);if(winner===void 0)throw error2;policy=winner,duplicate=!0}}return duplicate&&logger2.debug("iam policy already held",fieldsOf(policy.metadata?.id??"",spec)),await lifecycle?.onPolicyGranted?.({policy,duplicate}),{policy,duplicate}},async revokeBySpec(spec){requireWellFormedTriple(spec);let existing=await findByTriple(spec);if(existing===void 0){await lifecycle?.onPolicyRevoked?.({spec,policy:void 0});return}return await revokeRow(existing),existing},async cleanupResource(ref){let asPrincipal=await policies.findByPrincipal(ref.kind,ref.id),asResource=await policies.findByResource(ref.kind,ref.id),isOwner=policy=>policy.spec?.relation===OWNER_RELATION2;for(let policy of distinctById([...asPrincipal,...asResource.filter(policy2=>!isOwner(policy2)),...asResource.filter(isOwner)]))await revokeRow(policy)},async revokeOrgAccess(identityAccountId,organizationId){let direct=await policies.findByPrincipalAndResource(kindEnumName(ApiResourceKind.identity_account),identityAccountId,kindEnumName(ApiResourceKind.organization),organizationId);for(let policy of direct)await revokeRow(policy)}}}function buildRow(spec,caller){let policy=create2(IamPolicySchema,{apiVersion:IAM_POLICY_API_VERSION,kind:IAM_POLICY_KIND,metadata:create2(ApiResourceMetadataSchema,{id:policyIdFor(spec)}),spec});return setAuditFieldsForCreate(IamPolicySchema,policy,caller),policy}function distinctById(policies){let seen=new Set;return policies.filter(policy=>{let id=policy.metadata?.id??"";return seen.has(id)?!1:(seen.add(id),!0)})}function fieldsOf(id,spec){return{policyId:id,relation:spec.relation,principalKind:spec.principal?.kind??"",principalId:spec.principal?.id??"",resourceKind:spec.resource?.kind??"",resourceId:spec.resource?.id??""}}function newOrganizationOnlyGrantScope(){return{grantableRoles(kind){return kind===ApiResourceKind.organization?grantableRolesFor(kind):[]}}}var iamPolicyListIndex=declareListIndex({kind:ApiResourceKind.iam_policy,schema:IamPolicySchema,revision:1,keys:{principal:field2("spec.principal.id")}});var KIND4=ApiResourceKind.iam_policy,NON_STRUCTURAL_PRINCIPAL_KINDS=USER_GRANT_PRINCIPAL_KINDS.map(kind=>kindEnumName(kind)),NON_STRUCTURAL_RELATIONS=["owner","creator"];function newResourceIamPolicyStore(store){async function readById(id){try{return await store.getResource(KIND4,id,IamPolicySchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}async function all(){return(await store.listResources(KIND4)).map(bytes=>fromBinary2(IamPolicySchema,bytes))}async function where(predicate){return(await all()).filter(predicate)}return{async save(policy){let id=policy.metadata?.id??"";if(policy.spec===void 0||id!==policyIdFor(policy.spec))throw new Error("policy id must be derived from its triple");if(await readById(id)!==void 0)throw new DuplicatePolicyError(`IAM policy '${id}' already exists`);await store.saveResource(KIND4,id,IamPolicySchema,policy)},async deleteById(id){await store.deleteResource(KIND4,id)},findById:readById,async findByPrincipal(principalKind,principalId){return(await store.queryResources(iamPolicyListIndex,{anyKey:[{name:"principal",value:principalId}]})).map(row=>fromBinary2(IamPolicySchema,row.data)).filter(policy=>onPrincipal(policy,principalKind,principalId))},findByResource(resourceKind,resourceId){return where(policy=>onResource(policy,resourceKind,resourceId))},findByPrincipalAndResource(principalKind,principalId,resourceKind,resourceId){return where(policy=>onPrincipal(policy,principalKind,principalId)&&onResource(policy,resourceKind,resourceId))},findByResourceWithRelations(resourceKind,resourceId,relations){return where(policy=>onResource(policy,resourceKind,resourceId)&&relations.includes(relationOf2(policy)))},async countDistinctPrincipalsByResource(resourceKind,resourceId,principalKind,relations){let principals=new Set;for(let policy of await all())onResource(policy,resourceKind,resourceId)&&relations.includes(relationOf2(policy))&&(principalKind===void 0||policy.spec?.principal?.kind===principalKind)&&principals.add(`${policy.spec?.principal?.kind??""}:${policy.spec?.principal?.id??""}`);return principals.size},async findScopeTuple(resourceKind,resourceId){return(await all()).find(policy=>onResource(policy,resourceKind,resourceId)&&!NON_STRUCTURAL_PRINCIPAL_KINDS.includes(policy.spec?.principal?.kind??"")&&!NON_STRUCTURAL_RELATIONS.includes(relationOf2(policy)))}}}function onPrincipal(policy,kind,id){return policy.spec?.principal?.kind===kind&&policy.spec?.principal?.id===id}function onResource(policy,kind,id){return policy.spec?.resource?.kind===kind&&policy.spec?.resource?.id===id}function relationOf2(policy){return policy.spec?.relation??""}var CLEANUP_KINDS=new Set([ApiResourceKind.organization,ApiResourceKind.identity_account]);function newBuiltInRoleLifecycle(deps){let{grantPath,accounts}=deps;return{async onResourceCreated(event){if(event.kind!==ApiResourceKind.organization||event.ownerAttribution!==OwnerAttributionType.DIRECT||event.caller.callerClass!=="user")return;let accountId=(await accountForCaller(accounts,event.caller))?.metadata?.id??"";accountId!==""&&await grantPath.grant(organizationRole(accountId,IamRole.owner,event.resourceId),{...event.caller,identityId:accountId})},async onResourceDeleted(event){CLEANUP_KINDS.has(event.kind)&&await grantPath.cleanupResource(create2(ApiResourceRefSchema,{kind:kindEnumName(event.kind),id:event.resourceId}))},async onVisibilityChanged(){}}}function discoveryUrl(issuer){return`${issuer.replace(/\/$/,"")}/.well-known/openid-configuration`}function newIssuerDiscovery(fetchImpl=fetch){let discovered=new Map;return{async discover(issuer){let cached2=discovered.get(issuer);if(cached2!==void 0)return cached2;let url=discoveryUrl(issuer),response=await fetchImpl(url);if(!response.ok)throw new Error(`OIDC discovery failed: ${url} answered HTTP ${response.status}`);let document2=await response.json();if(document2.issuer!==issuer)throw new Error(`OIDC discovery failed: document issuer '${typeof document2.issuer=="string"?document2.issuer:""}' does not match configured issuer '${issuer}'`);if(typeof document2.jwks_uri!="string"||document2.jwks_uri==="")throw new Error(`OIDC discovery failed: ${url} carries no jwks_uri`);let result={issuer,jwksUri:document2.jwks_uri,userinfoEndpoint:typeof document2.userinfo_endpoint=="string"&&document2.userinfo_endpoint!==""?document2.userinfo_endpoint:void 0};return discovered.set(issuer,result),result}}}function newOidcUserInfoClient(discovery2,fetchImpl=fetch){return{async fetchUserProfile(issuer,accessToken){let{userinfoEndpoint}=await discovery2.discover(issuer);if(userinfoEndpoint===void 0)throw new Error(`issuer '${issuer}' publishes no userinfo_endpoint in its discovery document`);let response=await fetchImpl(userinfoEndpoint,{headers:{authorization:`Bearer ${accessToken}`}});if(!response.ok)throw new Error(`userinfo answered ${response.status}`);let claims=await response.json(),text2=key=>{let value=claims[key];return typeof value=="string"?value:""};return{email:text2("email"),firstName:text2("given_name"),lastName:text2("family_name"),pictureUrl:text2("picture")}}}}var LAST_USED_RESOLUTION_MS=6e4;function lastUseIsStale(lastUsedAt,now){return lastUsedAt===void 0||now.getTime()-timestampDate(lastUsedAt).getTime()>=LAST_USED_RESOLUTION_MS}function stampLastUsed(status,usedAt){let stored=status.lastUsedAt;return stored!==void 0&&timestampDate(stored).getTime()>=usedAt.getTime()?!1:(status.lastUsedAt=timestampFromDate(usedAt),bumpStatusAudit(status),!0)}async function recordCredentialUse(use){if(lastUseIsStale(use.lastUsedAt,use.now))try{await use.write(status=>{stampLastUsed(status,use.now)})}catch(error2){if(error2 instanceof ResourceNotFoundError)return;use.logger.warn("Credential last_used_at not recorded (best-effort \u2014 the request is unaffected)",{credential:use.credential,id:use.id,error:error2 instanceof Error?error2.message:String(error2)})}}var INVALID_TOKEN_MESSAGE="invalid token",TOKEN_EXPIRED_MESSAGE="token has expired";function newApiKeyIdentityVerifier(deps){let{store,accounts,logger:logger2}=deps;return{name:"apikey",async verify(token){if(!isApiKeyToken(token))return null;let key=await findApiKeyByHash(store,hashApiKey(token));if(key===void 0)throw new ConnectError(INVALID_TOKEN_MESSAGE,Code.Unauthenticated);let now=deps.now(),expiresAt=key.spec?.expiresAt;if(expiresAt!==void 0&&timestampDate(expiresAt)<=now)throw new ConnectError(TOKEN_EXPIRED_MESSAGE,Code.Unauthenticated);let owner=key.status?.audit?.specAudit?.createdBy;if(owner===void 0||owner.id==="")throw new ConnectError(INVALID_TOKEN_MESSAGE,Code.Unauthenticated);let identityId=await identityIdForSubject(accounts,owner.id);return await recordKeyUse(store,logger2,key,now),{identityId,callerClass:"user",issuer:"",rawToken:token,...owner.email!==""?{email:owner.email}:{},...owner.displayName!==""?{displayName:owner.displayName}:{}}}}}function recordKeyUse(store,logger2,key,now){let id=key.metadata?.id??"";return recordCredentialUse({credential:"api key",id,lastUsedAt:key.status?.lastUsedAt,now,logger:logger2,write:stamp2=>store.updateResource(ApiResourceKind.api_key,id,ApiKeySchema,live=>{live.status??=create2(ApiKeyStatusSchema),stamp2(live.status)})})}var import_node_crypto17=require("node:crypto");var file_ai_stigmer_agentic_artifact_v1_io=fileDesc("CidhaS9zdGlnbWVyL2FnZW50aWMvYXJ0aWZhY3QvdjEvaW8ucHJvdG8SHmFpLnN0aWdtZXIuYWdlbnRpYy5hcnRpZmFjdC52MSIjCgpBcnRpZmFjdElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiXgoMQXJ0aWZhY3RMaXN0EhMKC3RvdGFsX3BhZ2VzGAEgASgFEjkKB2VudHJpZXMYAiADKAsyKC5haS5zdGlnbWVyLmFnZW50aWMuYXJ0aWZhY3QudjEuQXJ0aWZhY3QieQoTQ3JlYXRlQXJ0aWZhY3RJbnB1dBJCCgRzcGVjGAEgASgLMiwuYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxLkFydGlmYWN0U3BlY0IGukgDyAEBEh4KB2NvbnRlbnQYAiABKAxCDbpICsgBAXoFGICAgBkiiwEKH0xpc3RBcnRpZmFjdHNCeUV4ZWN1dGlvblJlcXVlc3QSHQoVd29ya2Zsb3dfZXhlY3V0aW9uX2lkGAEgASgJEhoKEmFnZW50X2V4ZWN1dGlvbl9pZBgCIAEoCRIVCglwYWdlX3NpemUYAyABKAVCAhgBEhYKCnBhZ2VfdG9rZW4YBCABKAlCAhgBIkwKGUdldEFydGlmYWN0Q29udGVudFJlcXVlc3QSHAoLYXJ0aWZhY3RfaWQYASABKAlCB7pIBHICEAESEQoJbWF4X2J5dGVzGAIgASgDInAKGkdldEFydGlmYWN0Q29udGVudFJlc3BvbnNlEg8KB2NvbnRlbnQYASABKAwSFAoMY29udGVudF90eXBlGAIgASgJEhgKEHRvdGFsX3NpemVfYnl0ZXMYAyABKAMSEQoJdHJ1bmNhdGVkGAQgASgIImEKE0FydGlmYWN0RG93bmxvYWRVcmwSCwoDdXJsGAEgASgJEhMKC3R0bF9zZWNvbmRzGAIgASgFEhIKCnNpemVfYnl0ZXMYAyABKAMSFAoMY29udGVudF90eXBlGAQgASgJYgZwcm90bzM",[file_ai_stigmer_agentic_artifact_v1_api,file_ai_stigmer_agentic_artifact_v1_spec,file_buf_validate_validate]);var ArtifactListSchema=messageDesc2(file_ai_stigmer_agentic_artifact_v1_io,1);var GetArtifactContentResponseSchema2=messageDesc2(file_ai_stigmer_agentic_artifact_v1_io,5),ArtifactDownloadUrlSchema=messageDesc2(file_ai_stigmer_agentic_artifact_v1_io,6);var file_ai_stigmer_agentic_artifact_v1_command=fileDesc("CixhaS9zdGlnbWVyL2FnZW50aWMvYXJ0aWZhY3QvdjEvY29tbWFuZC5wcm90bxIeYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxMqYCChlBcnRpZmFjdENvbW1hbmRDb250cm9sbGVyEm0KBmNyZWF0ZRIzLmFpLnN0aWdtZXIuYWdlbnRpYy5hcnRpZmFjdC52MS5DcmVhdGVBcnRpZmFjdElucHV0GiguYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxLkFydGlmYWN0IgTQuBgBEpMBCgZkZWxldGUSLS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VJZBooLmFpLnN0aWdtZXIuYWdlbnRpYy5hcnRpZmFjdC52MS5BcnRpZmFjdCIwwrgYLAgCEDciBXZhbHVlKh91bmF1dGhvcml6ZWQgdG8gZGVsZXRlIGFydGlmYWN0GgSg/ys3YgZwcm90bzM",[file_ai_stigmer_agentic_artifact_v1_api,file_ai_stigmer_agentic_artifact_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ArtifactCommandController=serviceDesc(file_ai_stigmer_agentic_artifact_v1_command,0);var file_ai_stigmer_agentic_artifact_v1_query=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvYXJ0aWZhY3QvdjEvcXVlcnkucHJvdG8SHmFpLnN0aWdtZXIuYWdlbnRpYy5hcnRpZmFjdC52MTKhBQoXQXJ0aWZhY3RRdWVyeUNvbnRyb2xsZXISigEKA2dldBIqLmFpLnN0aWdtZXIuYWdlbnRpYy5hcnRpZmFjdC52MS5BcnRpZmFjdElkGiguYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxLkFydGlmYWN0Ii3CuBgpCAEQNyIFdmFsdWUqHHVuYXV0aG9yaXplZCB0byBnZXQgYXJ0aWZhY3QShgEKD2xpc3RCeUV4ZWN1dGlvbhI/LmFpLnN0aWdtZXIuYWdlbnRpYy5hcnRpZmFjdC52MS5MaXN0QXJ0aWZhY3RzQnlFeGVjdXRpb25SZXF1ZXN0GiwuYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxLkFydGlmYWN0TGlzdCIE0LgYARKlAQoOZ2V0RG93bmxvYWRVcmwSKi5haS5zdGlnbWVyLmFnZW50aWMuYXJ0aWZhY3QudjEuQXJ0aWZhY3RJZBozLmFpLnN0aWdtZXIuYWdlbnRpYy5hcnRpZmFjdC52MS5BcnRpZmFjdERvd25sb2FkVXJsIjLCuBguCAEQNyIFdmFsdWUqIXVuYXV0aG9yaXplZCB0byBkb3dubG9hZCBhcnRpZmFjdBLBAQoKZ2V0Q29udGVudBI5LmFpLnN0aWdtZXIuYWdlbnRpYy5hcnRpZmFjdC52MS5HZXRBcnRpZmFjdENvbnRlbnRSZXF1ZXN0GjouYWkuc3RpZ21lci5hZ2VudGljLmFydGlmYWN0LnYxLkdldEFydGlmYWN0Q29udGVudFJlc3BvbnNlIjzCuBg4CAEQNyILYXJ0aWZhY3RfaWQqJXVuYXV0aG9yaXplZCB0byByZWFkIGFydGlmYWN0IGNvbnRlbnQaBKD/KzdiBnByb3RvMw",[file_ai_stigmer_agentic_artifact_v1_api,file_ai_stigmer_agentic_artifact_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ArtifactQueryController=serviceDesc(file_ai_stigmer_agentic_artifact_v1_query,0);var artifactListIndex=declareListIndex({kind:ApiResourceKind.artifact,schema:ArtifactSchema,revision:1,keys:{agent_execution:field2("spec.source.agent_execution_id"),workflow_execution:field2("spec.source.workflow_execution_id")}});var ARTIFACT_KIND="Artifact";var DEFAULT_MAX_CONTENT_BYTES=512n*1024n,DOWNLOAD_URL_EXPIRATION_MS=10080*60*1e3;function artifactNotFoundMessage(artifactId2){return`Artifact not found: ${artifactId2}`}function artifactBlobDeletedMessage(artifactId2){return`artifact blob has been deleted: ${artifactId2}`}function registerArtifactServices(router,deps){router.service(ArtifactCommandController,{create:(input,ctx)=>createArtifact(deps,input,callerIdentityOf(ctx)),delete:(id,ctx)=>deleteArtifact(deps,id,callerIdentityOf(ctx))}),router.service(ArtifactQueryController,{get:(id,ctx)=>get11(deps,id,ctx),listByExecution:(req,ctx)=>listByExecution(deps,req,ctx),getDownloadUrl:(id,ctx)=>getDownloadUrl(deps,id,callerIdentityOf(ctx)),getContent:(req,ctx)=>getContent(deps,req,callerIdentityOf(ctx))})}function kindOf10(ctx){return ctx.values.get(apiResourceKindKey)}async function createArtifact(deps,input,identity2){let spec=input.spec;if(spec===void 0)throw invalidArgumentError("spec is required");let content=input.content;if(content.length===0)throw invalidArgumentError("content is required");if(content.length>52428800)throw new ConnectError(`content exceeds maximum size of ${52428800} bytes`,Code.ResourceExhausted);let source=spec.source;if(source===void 0||source.workflowExecutionId===""&&source.agentExecutionId==="")throw invalidArgumentError("spec.source must include workflow_execution_id or agent_execution_id");let contentHash=(0,import_node_crypto17.createHash)("sha256").update(content).digest("hex");deps.logger.info("creating artifact",{contentHash,contentSize:content.length,contentType:spec.contentType,displayName:spec.displayName});try{await deps.artifactStorage.upload(contentHash,content,spec.contentType)}catch(error2){throw deps.logger.error("failed to upload artifact blob",{contentHash,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to upload artifact content")}let org=await deriveOrgFromSource(deps,source),artifactId2=generateId("art"),artifact=create2(ArtifactSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:ARTIFACT_KIND,metadata:{id:artifactId2,name:spec.displayName,org},spec,status:{contentHash,sizeBytes:BigInt(content.length),storageState:ArtifactStorageState.storage_state_stored,expiresAt:computeExpiresAt(spec.retention?.ttlDays)}});try{setAuditFieldsForCreate(ArtifactSchema,artifact,identity2)}catch(error2){deps.logger.error("failed to set audit fields on artifact",{error:error2 instanceof Error?error2.message:String(error2)})}try{await deps.store.saveResource(ApiResourceKind.artifact,artifactId2,ArtifactSchema,artifact)}catch(error2){throw deps.logger.error("failed to persist artifact metadata",{artifactId:artifactId2,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to persist artifact")}return deps.logger.info("artifact created successfully",{artifactId:artifactId2,contentHash,sizeBytes:content.length}),artifact}async function deriveOrgFromSource(deps,source){let lookups=[{id:source.workflowExecutionId,kind:ApiResourceKind.workflow_execution},{id:source.agentExecutionId,kind:ApiResourceKind.agent_execution}];for(let lookup3 of lookups)if(lookup3.id!=="")try{let org=(await deps.store.getResource(lookup3.kind,lookup3.id,ArtifactSchema)).metadata?.org??"";if(org!=="")return org}catch{}return""}function computeExpiresAt(ttlDaysInput){let ttlDays=ttlDaysInput??30;return ttlDays===-1?"":(ttlDays<=0&&(ttlDays=30),new Date(Date.now()+ttlDays*24*60*60*1e3).toISOString().replace(/\.\d{3}Z$/,"Z"))}async function deleteArtifact(deps,id,identity2){let resourceId=id.value;if(resourceId==="")throw invalidArgumentError("artifact id is required");let artifact=await loadArtifactOrNotFound(deps,resourceId);await authorizeDirect(ArtifactCommandController.method.delete,deps.authorizer,identity2,id),deps.logger.info("soft-deleting artifact",{artifactId:resourceId,previousState:ArtifactStorageState[artifact.status?.storageState??0]}),artifact.status===void 0&&(artifact.status=create2(ArtifactStatusSchema)),artifact.status.storageState=ArtifactStorageState.storage_state_deleted;try{setAuditFieldsForUpdate(ArtifactSchema,artifact,"status_audit",identity2)}catch(error2){deps.logger.error("failed to set audit fields on artifact delete",{error:error2 instanceof Error?error2.message:String(error2)})}try{await deps.store.saveResource(ApiResourceKind.artifact,resourceId,ArtifactSchema,artifact)}catch(error2){throw deps.logger.error("failed to persist artifact deletion",{artifactId:resourceId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to persist artifact deletion")}return deps.logger.info("artifact soft-deleted successfully",{artifactId:resourceId}),artifact}async function get11(deps,id,ctx){let reqCtx=new RequestContext(ArtifactQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf10(ctx));return await newPipeline("artifact-get",deps.logger).addStep(newAuthorizeStep(ArtifactQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,ArtifactSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var ARTIFACT_LIST_KEY="artifactList";async function listByExecution(deps,req,ctx){let reqCtx=new RequestContext(ArtifactQueryController.method.listByExecution.input,req,callerIdentityOf(ctx),kindOf10(ctx));await newPipeline("artifact-list-by-execution",deps.logger).addStep(newAuthorizeStep(ArtifactQueryController.method.listByExecution,deps.authorizer)).addStep({name:"ValidateListByExecutionRequest",execute(stepCtx){let input=stepCtx.input;if(input.workflowExecutionId===""&&input.agentExecutionId==="")throw invalidArgumentError("workflow_execution_id or agent_execution_id is required")}}).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,({input})=>[{permission:IamPermission.can_view,resourceKind:input.workflowExecutionId!==""?ApiResourceKind.workflow_execution:ApiResourceKind.agent_execution,resourceId:input.workflowExecutionId!==""?input.workflowExecutionId:input.agentExecutionId,deniedMessage:"unauthorized to list artifacts for this execution"}],"AuthorizeParentExecution")).addStep({name:"QueryArtifactsByExecution",async execute(stepCtx){let input=stepCtx.input,rows;try{rows=await deps.store.queryResources(artifactListIndex,{anyKey:[...input.workflowExecutionId===""?[]:[{name:"workflow_execution",value:input.workflowExecutionId}],...input.agentExecutionId===""?[]:[{name:"agent_execution",value:input.agentExecutionId}]]})}catch(error2){throw internalError(error2,"failed to list artifacts")}let artifacts=[];for(let row of rows)try{artifacts.push(fromBinary2(ArtifactSchema,row.data))}catch(error2){deps.logger.warn("failed to unmarshal artifact, skipping",{error:error2 instanceof Error?error2.message:String(error2)})}stepCtx.set(ARTIFACT_LIST_KEY,create2(ArtifactListSchema,{totalPages:1,entries:artifacts}))}}).build().execute(reqCtx);let list12=reqCtx.get(ARTIFACT_LIST_KEY);if(list12===void 0)throw internalError(new Error("artifact list missing from pipeline context"),"artifact list not found in pipeline context");return list12}async function getDownloadUrl(deps,id,identity2){let resourceId=id.value;if(resourceId==="")throw invalidArgumentError("artifact id is required");let artifact=await loadArtifactOrNotFound(deps,resourceId);await authorizeDirect(ArtifactQueryController.method.getDownloadUrl,deps.authorizer,identity2,id);let contentHash=requireLiveBlob(artifact,resourceId);deps.logger.info("generating download URL for artifact",{artifactId:resourceId,contentHash});let downloadUrl;try{downloadUrl=await deps.artifactStorage.getSignedUrl(contentHash,DOWNLOAD_URL_EXPIRATION_MS,"")}catch(error2){throw deps.logger.error("failed to generate download URL for artifact",{artifactId:resourceId,contentHash,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to generate download URL")}return create2(ArtifactDownloadUrlSchema,{url:downloadUrl,ttlSeconds:Math.floor(DOWNLOAD_URL_EXPIRATION_MS/1e3),sizeBytes:artifact.status?.sizeBytes??0n,contentType:artifact.spec?.contentType??""})}async function getContent(deps,req,identity2){let artifactId2=req.artifactId;if(artifactId2==="")throw invalidArgumentError("artifact_id is required");let artifact=await loadArtifactOrNotFound(deps,artifactId2);await authorizeDirect(ArtifactQueryController.method.getContent,deps.authorizer,identity2,req);let contentHash=requireLiveBlob(artifact,artifactId2),maxBytes=req.maxBytes;maxBytes<=0n&&(maxBytes=DEFAULT_MAX_CONTENT_BYTES);let data;try{data=await deps.artifactStorage.download(contentHash)}catch(error2){throw deps.logger.error("failed to download artifact content",{artifactId:artifactId2,contentHash,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to read artifact content")}let totalSize=BigInt(data.length),truncated=!1;return totalSize>maxBytes&&(data=data.subarray(0,Number(maxBytes)),truncated=!0),deps.logger.info("read artifact content",{artifactId:artifactId2,totalSizeBytes:data.length,truncated}),create2(GetArtifactContentResponseSchema2,{content:data,contentType:artifact.spec?.contentType??"",totalSizeBytes:totalSize,truncated})}async function loadArtifactOrNotFound(deps,artifactId2){try{return await deps.store.getResource(ApiResourceKind.artifact,artifactId2,ArtifactSchema)}catch{throw new ConnectError(artifactNotFoundMessage(artifactId2),Code.NotFound)}}function requireLiveBlob(artifact,artifactId2){if(artifact.status?.storageState===ArtifactStorageState.storage_state_deleted)throw new ConnectError(artifactBlobDeletedMessage(artifactId2),Code.FailedPrecondition);let contentHash=artifact.status?.contentHash??"";if(contentHash==="")throw internalError(new Error(`artifact has no content hash: ${artifactId2}`),`artifact has no content hash: ${artifactId2}`);return contentHash}var encoder4=new TextEncoder,decoder2=new TextDecoder,strictDecoder=new TextDecoder("utf-8",{fatal:!0}),MAX_INT32=2**32;function concat(...buffers){let size=buffers.reduce((acc,{length})=>acc+length,0),buf2=new Uint8Array(size),i6=0;for(let buffer of buffers)buf2.set(buffer,i6),i6+=buffer.length;return buf2}function encode(string){let bytes=new Uint8Array(string.length);for(let i6=0;i6<string.length;i6++){let code=string.charCodeAt(i6);if(code>127)throw new TypeError("non-ASCII string encountered in encode()");bytes[i6]=code}return bytes}var unusable=(name,prop="algorithm.name")=>new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);function checkUsage(key,usage){if(usage&&!key.usages.includes(usage))throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`)}function checkModulusLength(alg,key){let{modulusLength}=key.algorithm;if(typeof modulusLength!="number"||modulusLength<2048)throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`)}function checkCryptoKey(key,expected,usage){let algorithm=key.algorithm;if(algorithm.name!==expected.name)throw unusable(expected.name);if(expected.hash&&algorithm.hash?.name!==expected.hash)throw unusable(expected.hash,"algorithm.hash");if(expected.namedCurve&&algorithm.namedCurve!==expected.namedCurve)throw unusable(expected.namedCurve,"algorithm.namedCurve");if(expected.length!==void 0&&algorithm.length!==expected.length)throw unusable(expected.length,"algorithm.length");checkUsage(key,usage)}function message5(msg,actual,...types3){if(types3.length>2){let last=types3.pop();msg+=`one of type ${types3.join(", ")}, or ${last}.`}else types3.length===2?msg+=`one of type ${types3[0]} or ${types3[1]}.`:msg+=`of type ${types3[0]}.`;return actual==null?msg+=` Received ${actual}`:typeof actual=="function"&&actual.name?msg+=` Received function ${actual.name}`:typeof actual=="object"&&actual!=null&&actual.constructor?.name&&(msg+=` Received an instance of ${actual.constructor.name}`),msg}var withAlg=(alg,actual,...types3)=>message5(`Key for the ${alg} algorithm must be `,actual,...types3);var errors_exports={};__export(errors_exports,{JOSEAlgNotAllowed:()=>JOSEAlgNotAllowed,JOSEError:()=>JOSEError,JOSENotSupported:()=>JOSENotSupported,JWEDecryptionFailed:()=>JWEDecryptionFailed,JWEInvalid:()=>JWEInvalid,JWKInvalid:()=>JWKInvalid,JWKSInvalid:()=>JWKSInvalid,JWKSMultipleMatchingKeys:()=>JWKSMultipleMatchingKeys,JWKSNoMatchingKey:()=>JWKSNoMatchingKey,JWKSTimeout:()=>JWKSTimeout,JWSInvalid:()=>JWSInvalid,JWSSignatureVerificationFailed:()=>JWSSignatureVerificationFailed,JWTClaimValidationFailed:()=>JWTClaimValidationFailed,JWTExpired:()=>JWTExpired,JWTInvalid:()=>JWTInvalid});var JOSEError=class extends Error{static code="ERR_JOSE_GENERIC";code="ERR_JOSE_GENERIC";constructor(message6,options){super(message6,options),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},JWTClaimValidationFailed=class extends JOSEError{static code="ERR_JWT_CLAIM_VALIDATION_FAILED";code="ERR_JWT_CLAIM_VALIDATION_FAILED";claim;reason;payload;constructor(message6,payload,claim="unspecified",reason="unspecified"){super(message6,{cause:{claim,reason,payload}}),this.claim=claim,this.reason=reason,this.payload=payload}},JWTExpired=class extends JOSEError{static code="ERR_JWT_EXPIRED";code="ERR_JWT_EXPIRED";claim;reason;payload;constructor(message6,payload,claim="unspecified",reason="unspecified"){super(message6,{cause:{claim,reason,payload}}),this.claim=claim,this.reason=reason,this.payload=payload}},JOSEAlgNotAllowed=class extends JOSEError{static code="ERR_JOSE_ALG_NOT_ALLOWED";code="ERR_JOSE_ALG_NOT_ALLOWED"},JOSENotSupported=class extends JOSEError{static code="ERR_JOSE_NOT_SUPPORTED";code="ERR_JOSE_NOT_SUPPORTED"},JWEDecryptionFailed=class extends JOSEError{static code="ERR_JWE_DECRYPTION_FAILED";code="ERR_JWE_DECRYPTION_FAILED";constructor(message6="decryption operation failed",options){super(message6,options)}},JWEInvalid=class extends JOSEError{static code="ERR_JWE_INVALID";code="ERR_JWE_INVALID"},JWSInvalid=class extends JOSEError{static code="ERR_JWS_INVALID";code="ERR_JWS_INVALID"},JWTInvalid=class extends JOSEError{static code="ERR_JWT_INVALID";code="ERR_JWT_INVALID"},JWKInvalid=class extends JOSEError{static code="ERR_JWK_INVALID";code="ERR_JWK_INVALID"},JWKSInvalid=class extends JOSEError{static code="ERR_JWKS_INVALID";code="ERR_JWKS_INVALID"},JWKSNoMatchingKey=class extends JOSEError{static code="ERR_JWKS_NO_MATCHING_KEY";code="ERR_JWKS_NO_MATCHING_KEY";constructor(message6="no applicable key found in the JSON Web Key Set",options){super(message6,options)}},JWKSMultipleMatchingKeys=class extends JOSEError{[Symbol.asyncIterator]=async function*(){};static code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";constructor(message6="multiple matching keys found in the JSON Web Key Set",options){super(message6,options)}},JWKSTimeout=class extends JOSEError{static code="ERR_JWKS_TIMEOUT";code="ERR_JWKS_TIMEOUT";constructor(message6="request timed out",options){super(message6,options)}},JWSSignatureVerificationFailed=class extends JOSEError{static code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";constructor(message6="signature verification failed",options){super(message6,options)}};var isCryptoKey=key=>{if(key?.[Symbol.toStringTag]==="CryptoKey")return!0;try{return key instanceof CryptoKey}catch{return!1}},isKeyObject=key=>key?.[Symbol.toStringTag]==="KeyObject",isKeyLike=key=>isCryptoKey(key)||isKeyObject(key);function decodeBase64(encoded){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(encoded);let binary2=atob(encoded),bytes=new Uint8Array(binary2.length);for(let i6=0;i6<binary2.length;i6++)bytes[i6]=binary2.charCodeAt(i6);return bytes}var invalid="The input to be decoded is not correctly encoded.";function decode(input){if(Uint8Array.fromBase64)try{return Uint8Array.fromBase64(typeof input=="string"?input:decoder2.decode(input),{alphabet:"base64url"})}catch(cause){throw new TypeError(invalid,{cause})}let encoded=input;if(encoded instanceof Uint8Array&&(encoded=decoder2.decode(encoded)),encoded.includes("+")||encoded.includes("/"))throw new TypeError(invalid);encoded=encoded.replace(/-/g,"+").replace(/_/g,"/");try{return decodeBase64(encoded)}catch{throw new TypeError(invalid)}}function isObject3(input){if(typeof input!="object"||input===null||Object.prototype.toString.call(input)!=="[object Object]")return!1;let prototype=Object.getPrototypeOf(input);return prototype===null||Object.getPrototypeOf(prototype)===null}function isJwkSet(input){return isObject3(input)&&Array.isArray(input.keys)&&Array.from(input.keys).every(isObject3)}function decodeBase64url(value,label2,ErrorClass){try{return decode(value)}catch{throw new ErrorClass(`Failed to base64url decode the ${label2}`)}}function encodeBase64url(value,label2,ErrorClass){try{return encode(value)}catch{throw new ErrorClass(`The ${label2} is not a valid base64url string`)}}function parseJoseHeader(b64,ErrorClass,message6){let parsed;try{parsed=JSON.parse(strictDecoder.decode(decode(b64)))}catch{throw new ErrorClass(message6)}if(!isObject3(parsed))throw new ErrorClass(message6);return parsed}async function jwkToKey(entry,jwk){if(jwk.kty==="RSA"&&"oth"in jwk&&jwk.oth!==void 0)throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');if(!entry.kty.includes(jwk.kty))throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');let algorithm=entry.resolve?.({kty:jwk.kty,crv:jwk.crv})??entry.subtle,isPrivate=!!(jwk.d||jwk.priv),keyData={...jwk};return keyData.kty!=="AKP"&&delete keyData.alg,delete keyData.use,crypto.subtle.importKey("jwk",keyData,algorithm,jwk.ext??!isPrivate,jwk.key_ops??entry.usages[isPrivate?1:0])}function snapshotJwk(jwk){return{__proto__:null,...jwk}}function normalizeJwk(jwk){let normalized=snapshotJwk(jwk);if(normalized.ext!==void 0&&typeof normalized.ext!="boolean")throw new TypeError('"ext" (Extractable) Parameter must be a boolean');if(normalized.key_ops!==void 0){let value=normalized.key_ops,keyOps=Array.isArray(value)?[...value]:void 0;if(!keyOps||keyOps.some(operation2=>typeof operation2!="string")||new Set(keyOps).size!==keyOps.length)throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');normalized.key_ops=keyOps}return normalized}var tag=key=>key[Symbol.toStringTag],jwkMatchesOp=(entry,key,usage)=>{let{alg}=entry;if(key.use!==void 0){let expected=usage==="sign"||usage==="verify"?"sig":"enc";if(key.use!==expected)throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`)}if(key.alg!==void 0&&key.alg!==alg)throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);if(Array.isArray(key.key_ops)){let expectedKeyOp=usage==="encrypt"||usage==="decrypt"?entry.ops?.[usage==="encrypt"?0:1]:usage;if(expectedKeyOp&&!key.key_ops.includes(expectedKeyOp))throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`)}};function checkKeyType2(entry,key,usage){let{alg,secret}=entry,privateKey=usage==="decrypt"||usage==="sign";if(secret&&key instanceof Uint8Array)return[BYTES4,key];if(isObject3(key)){let normalized=normalizeJwk(key);if(typeof normalized.kty!="string")throw new TypeError(secret?withAlg(alg,key,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"):withAlg(alg,key,"CryptoKey","KeyObject","JSON Web Key"));if(!(secret?normalized.kty==="oct"&&typeof normalized.k=="string":normalized.kty!=="oct"&&(privateKey?normalized.kty==="AKP"&&typeof normalized.priv=="string"||typeof normalized.d=="string":normalized.d===void 0&&normalized.priv===void 0)))throw new TypeError(secret?'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present':`JSON Web Key for this operation must be a ${privateKey?"private":"public"} JWK`);return jwkMatchesOp(entry,normalized,usage),[JWK,key,normalized]}if(!isKeyLike(key))throw new TypeError(secret?withAlg(alg,key,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"):withAlg(alg,key,"CryptoKey","KeyObject","JSON Web Key"));if(secret){if(key.type!=="secret")throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`)}else{if(key.type==="secret")throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);let expectedType=privateKey?"private":"public";if((key.type==="public"||key.type==="private")&&key.type!==expectedType){let operation2=usage==="sign"?"signing":usage==="verify"?"verifying":`${usage.slice(0,-1)}tion`;throw new TypeError(`${tag(key)} instances for asymmetric algorithm ${operation2} must be of type "${expectedType}"`)}}return isCryptoKey(key)?[CRYPTO,key]:[KEYOBJECT,key]}var BYTES4=0,CRYPTO=1,KEYOBJECT=2,JWK=3,cache6,nist={__proto__:null,prime256v1:"P-256",secp384r1:"P-384",secp521r1:"P-521"};function cached(key,alg,value){cache6||=new WeakMap;let entry=cache6.get(key);return value&&(entry?entry[alg]=value:cache6.set(key,{[alg]:value})),value??entry?.[alg]}var handleJWK=async(key,jwk,entry)=>cached(key,entry.alg)??cached(key,entry.alg,await jwkToKey(entry,{...jwk,alg:entry.alg})),handleKeyObject=(keyObject,entry)=>{let hit=cached(keyObject,entry.alg);if(hit)return hit;let isPublic=keyObject.type==="public",usages=entry.usages[isPublic?0:1],{asymmetricKeyType}=keyObject,crv=nist[keyObject.asymmetricKeyDetails?.namedCurve],params=entry.resolve?.({crv,asymmetricKeyType})??entry.subtle;return cached(keyObject,entry.alg,keyObject.toCryptoKey(params,isPublic,usages))};async function prepareKey(entry,key,usage){let tagged=checkKeyType2(entry,key,usage);switch(tagged[0]){case BYTES4:case CRYPTO:return tagged[1];case JWK:{let key2=tagged[1],normalized=tagged[2];if(normalized.kty==="oct")return decode(normalized.k);if(!Object.isFrozen(key2)){let{key_ops}=key2;Array.isArray(key_ops)&&Object.freeze(key_ops),Object.freeze(key2)}return handleJWK(key2,normalized,entry)}case KEYOBJECT:{let keyObject=tagged[1];return keyObject.type==="secret"?keyObject.export():"toCryptoKey"in keyObject&&typeof keyObject.toCryptoKey=="function"?handleKeyObject(keyObject,entry):handleJWK(keyObject,keyObject.export({format:"jwk"}),entry)}}}function table(entries){let out={__proto__:null};for(let alg in entries)out[alg]={...entries[alg],alg};return out}var JWS_RECOGNIZED={__proto__:null,b64:!0};function validateAlgorithms(option,algorithms){if(algorithms!==void 0&&(!Array.isArray(algorithms)||algorithms.some(s2=>typeof s2!="string")))throw new TypeError(`"${option}" option must be an array of strings`);if(algorithms)return new Set(algorithms)}function validateCrit(Err,recognizedDefault,recognizedOption,protectedHeader,joseHeader){if(joseHeader.crit!==void 0&&protectedHeader?.crit===void 0)throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');if(!protectedHeader||protectedHeader.crit===void 0)return[];if(!Array.isArray(protectedHeader.crit)||protectedHeader.crit.length===0||protectedHeader.crit.some(input=>typeof input!="string"||input.length===0))throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let recognized=recognizedOption===void 0?recognizedDefault:{__proto__:null,...recognizedOption,...recognizedDefault};for(let parameter of protectedHeader.crit){if(!(parameter in recognized))throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);if(!Object.hasOwn(joseHeader,parameter)||joseHeader[parameter]===void 0)throw new Err(`Extension Header Parameter "${parameter}" is missing`);if(recognized[parameter]&&(!Object.hasOwn(protectedHeader,parameter)||protectedHeader[parameter]===void 0))throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`)}return protectedHeader.crit}function validateB64(protectedHeader,extensions){if(extensions.includes("b64")){let b64=protectedHeader.b64;if(typeof b64!="boolean")throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');return b64}return!0}async function getSigKey(entry,key,usage){return key instanceof Uint8Array?crypto.subtle.importKey("raw",key,entry.subtle,!1,[usage]):(checkCryptoKey(key,entry.subtle,usage),entry.minRsaBits&&checkModulusLength(entry.alg,key),key)}async function verify(entry,key,signature,data){let cryptoKey=await getSigKey(entry,key,"verify");try{return await crypto.subtle.verify(entry.signing,cryptoKey,signature,data)}catch{return!1}}var sig=[["verify"],["sign"]];function hmac(bits2){let subtle3={name:"HMAC",hash:`SHA-${bits2}`};return{kty:["oct"],secret:!0,subtle:subtle3,signing:subtle3,usages:sig}}function rsa(bits2,saltLength){let subtle3={name:saltLength?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:`SHA-${bits2}`};return{kty:["RSA"],subtle:subtle3,signing:saltLength?{...subtle3,saltLength}:subtle3,usages:sig,minRsaBits:2048}}function ecdsa(crv,bits2){return{kty:["EC"],crv,subtle:{name:"ECDSA",namedCurve:crv},signing:{name:"ECDSA",hash:`SHA-${bits2}`},usages:sig}}function eddsa(){let subtle3={name:"Ed25519"};return{kty:["OKP"],crv:"Ed25519",subtle:subtle3,signing:subtle3,usages:sig}}function mldsa(bits2){let subtle3={name:`ML-DSA-${bits2}`};return{kty:["AKP"],subtle:subtle3,signing:subtle3,usages:sig}}var JWS=table({HS256:hmac(256),HS384:hmac(384),HS512:hmac(512),RS256:rsa(256),RS384:rsa(384),RS512:rsa(512),PS256:rsa(256,32),PS384:rsa(384,48),PS512:rsa(512,64),ES256:ecdsa("P-256",256),ES384:ecdsa("P-384",384),ES512:ecdsa("P-521",512),EdDSA:eddsa(),Ed25519:eddsa(),"ML-DSA-44":mldsa(44),"ML-DSA-65":mldsa(65),"ML-DSA-87":mldsa(87)});function jwsAlgorithm(alg){let entry=typeof alg=="string"?JWS[alg]:void 0;if(!entry)throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);return entry}function prepareVerify(options){return[options&&validateAlgorithms("algorithms",options.algorithms),options?.crit]}function parseProtectedHeader(encodedProtected,parsedProtected=encodedProtected===void 0?{}:parseJoseHeader(encodedProtected,JWSInvalid,"JWS Protected Header is invalid")){return parsedProtected}function validateJwsHeaders(parsedProt,joseHeader,shared){let b64=validateB64(parsedProt,validateCrit(JWSInvalid,JWS_RECOGNIZED,shared[1],parsedProt,joseHeader)),alg=joseHeader.alg;if(typeof alg!="string"||!alg)throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');if(shared[0]&&!shared[0].has(alg))throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');return[b64,alg]}function encodeCompactUnencodedPayload(payload){try{return encode(payload)}catch{throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters")}}async function verifyPrepared(jws,shared,key,encodedProtected,parsedProt,alg,signingPayload){let resolvedKey=!1;typeof key=="function"&&(key=await key(parsedProt,jws),resolvedKey=!0);let b64=typeof signingPayload=="string",entry=jwsAlgorithm(alg),data=concat(encodedProtected!==void 0?encode(encodedProtected):new Uint8Array,encode("."),b64?shared[2]??=encodeBase64url(signingPayload,"payload",JWSInvalid):signingPayload),signature=decodeBase64url(jws.signature,"signature",JWSInvalid),k5=await prepareKey(entry,key,"verify");if(!await verify(entry,k5,signature,data))throw new JWSSignatureVerificationFailed;return[b64?decodeBase64url(signingPayload,"payload",JWSInvalid):signingPayload,parsedProt,b64,k5,resolvedKey]}async function verifyCompact(jws,shared,key){if(jws instanceof Uint8Array&&(jws=decoder2.decode(jws)),typeof jws!="string")throw new JWSInvalid("Compact JWS must be a string or Uint8Array");let{0:protectedHeader,1:payload,2:signature,length}=jws.split(".");if(length!==3)throw new JWSInvalid("Invalid Compact JWS");let compactJws={payload,protected:protectedHeader,signature},parsedProt=parseProtectedHeader(protectedHeader),[b64,alg]=validateJwsHeaders(parsedProt,parsedProt,shared),signingPayload=b64?payload:encodeCompactUnencodedPayload(payload);return verifyPrepared(compactJws,shared,key,protectedHeader,parsedProt,alg,signingPayload)}var epoch=date2=>Math.floor(date2.getTime()/1e3),multipliers={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},REGEX=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,checkFailed="check_failed";function invalidDuration(){throw new TypeError("Invalid time period format")}function secs(str2){typeof str2!="string"&&invalidDuration();let matched=REGEX.exec(str2);(!matched||matched[4]&&matched[1])&&invalidDuration();let value=parseFloat(matched[2]),numericDate=Math.round(value*multipliers[matched[3][0].toLowerCase()]);return Number.isFinite(numericDate)||invalidDuration(),matched[1]==="-"||matched[4]==="ago"?-numericDate:numericDate}function validateInput(label2,input){if(!Number.isFinite(input))throw new TypeError(`Invalid ${label2} input`);return input}var normalizeTyp=value=>{let normalized=value.toLowerCase();return value.includes("/")?normalized:`application/${normalized}`},checkAudiencePresence=(audPayload,audOption)=>typeof audPayload=="string"?audOption.includes(audPayload):Array.isArray(audPayload)?audOption.some(aud=>audPayload.includes(aud)):!1;function validateNumericDate(payload,claim,required=!1){let value=payload[claim];if(!(value===void 0&&!required)){if(typeof value!="number")throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`,payload,claim,"invalid");return value}}function unexpectedClaim(payload,claim){throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`,payload,claim,checkFailed)}function validateClaimsSet(protectedHeader,encodedPayload,options={}){let payload;try{payload=JSON.parse(strictDecoder.decode(encodedPayload))}catch{}if(!isObject3(payload))throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");let{typ}=options;if(typ!==void 0&&(typeof protectedHeader.typ!="string"||normalizeTyp(protectedHeader.typ)!==normalizeTyp(typ)))throw new JWTClaimValidationFailed('unexpected "typ" JWT header value',payload,"typ",checkFailed);let{requiredClaims=[],issuer,subject,audience,maxTokenAge}=options,presenceCheck=[...requiredClaims];maxTokenAge!==void 0&&presenceCheck.push("iat"),audience!==void 0&&presenceCheck.push("aud"),subject!==void 0&&presenceCheck.push("sub"),issuer!==void 0&&presenceCheck.push("iss");for(let claim of new Set(presenceCheck.reverse()))if(!Object.hasOwn(payload,claim))throw new JWTClaimValidationFailed(`missing required "${claim}" claim`,payload,claim,"missing");issuer!==void 0&&!(Array.isArray(issuer)?issuer:[issuer]).includes(payload.iss)&&unexpectedClaim(payload,"iss"),subject!==void 0&&payload.sub!==subject&&unexpectedClaim(payload,"sub"),audience!==void 0&&!checkAudiencePresence(payload.aud,typeof audience=="string"?[audience]:audience)&&unexpectedClaim(payload,"aud");let{clockTolerance:clockTolerance2}=options,tolerance=0;if(typeof clockTolerance2=="string")tolerance=secs(clockTolerance2);else if(clockTolerance2!==void 0){if(typeof clockTolerance2!="number")throw new TypeError("Invalid clockTolerance option type");tolerance=clockTolerance2}validateInput("clockTolerance option",tolerance);let{currentDate}=options,now=validateInput("currentDate option",epoch(currentDate===void 0?new Date:currentDate)),iat=validateNumericDate(payload,"iat",maxTokenAge!==void 0),nbf=validateNumericDate(payload,"nbf");if(nbf!==void 0&&nbf>now+tolerance)throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed',payload,"nbf",checkFailed);let exp=validateNumericDate(payload,"exp");if(exp!==void 0&&exp<=now-tolerance)throw new JWTExpired('"exp" claim timestamp check failed',payload,"exp",checkFailed);if(maxTokenAge!==void 0){let age=now-iat,max2=validateInput("maxTokenAge option",typeof maxTokenAge=="number"?maxTokenAge:secs(maxTokenAge));if(age-tolerance>max2)throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)',payload,"iat",checkFailed);if(age<-tolerance)throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)',payload,"iat",checkFailed)}return payload}async function jwtVerify(jwt,key,options){let verified=await verifyCompact(jwt,prepareVerify(options),key);if(!verified[2])throw new JWTInvalid("JWTs MUST NOT use unencoded payload");let result={payload:validateClaimsSet(verified[1],verified[0],options),protectedHeader:verified[1]};return typeof key=="function"?{...result,key:verified[3]}:result}function isUsableJWK(jwk,entry,alg,kid){let{kty,key_ops,ext,kid:jwkKid,alg:jwkAlg,use,crv}=snapshotJwk(jwk),keyOps=Array.isArray(key_ops)?[...key_ops]:key_ops;return(ext===void 0||typeof ext=="boolean")&&(keyOps===void 0||Array.isArray(keyOps)&&keyOps.every((operation2,index2)=>typeof operation2=="string"&&keyOps.indexOf(operation2)===index2)&&keyOps.includes("verify"))&&entry.kty.includes(kty)&&(kid===void 0||typeof kid=="string"&&kid===jwkKid)&&(jwkAlg===void 0?kty!=="AKP":alg===jwkAlg)&&(use===void 0||use==="sig")&&(!entry.crv||crv===entry.crv)}async function importWithAlgCache(cache7,jwk,entry){let cached2=cache7.get(jwk)||cache7.set(jwk,{}).get(jwk),{alg}=entry;if(cached2[alg]===void 0){let key=await jwkToKey(entry,{...jwk,alg,ext:!0});if(key.type!=="public")throw new JWKSInvalid("JSON Web Key Set members must be public keys");cached2[alg]=key}return cached2[alg]}function createLocalJWKSet(jwks){let snapshot;try{snapshot=structuredClone(jwks)}catch{}if(!isJwkSet(snapshot))throw new JWKSInvalid("JSON Web Key Set malformed");let cached2=new WeakMap;return Object.defineProperty(async(protectedHeader,token)=>{let{alg,kid}={...protectedHeader,...token?.header},entry=typeof alg=="string"?JWS[alg]:void 0;if(!entry||entry.secret)throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');let candidates=snapshot.keys.filter(jwk2=>isUsableJWK(jwk2,entry,alg,kid)),{0:jwk,length}=candidates;if(!length)throw new JWKSNoMatchingKey;if(length!==1){let error2=new JWKSMultipleMatchingKeys;throw error2[Symbol.asyncIterator]=async function*(){for(let jwk2 of candidates)try{yield await importWithAlgCache(cached2,jwk2,entry)}catch{}},error2}return importWithAlgCache(cached2,jwk,entry)},"jwks",{value:()=>structuredClone(snapshot)})}function isCloudflareWorkers(){return typeof WebSocketPair<"u"||typeof navigator<"u"&&navigator.userAgent==="Cloudflare-Workers"||typeof EdgeRuntime<"u"&&EdgeRuntime==="vercel"}var USER_AGENT2;(typeof navigator>"u"||!navigator.userAgent?.startsWith?.("Mozilla/5.0 "))&&(USER_AGENT2="jose/v6.2.10");var customFetch=Symbol();async function fetchJwks(url,headers2,signal3,fetchImpl=fetch){let response=await fetchImpl(url,{method:"GET",signal:signal3,redirect:"manual",headers:headers2}).catch(err2=>{throw err2.name==="TimeoutError"?new JWKSTimeout:err2});if(response.status!==200)throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await response.json()}catch{throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON")}}var jwksCache=Symbol();function isFreshFor(timestamp2,duration){return Number.isFinite(timestamp2)&&Date.now()<timestamp2+duration}function validateDuration(value,fallback3,option){if(Number.isNaN(value))throw new TypeError(`"${option}" option must not be NaN`);return typeof value=="number"?value:fallback3}function createRemoteJWKSet(url,options){if(!(url instanceof URL))throw new TypeError("url must be an instance of URL");let href=new URL(url.href).href,opts=options??{},timeoutOption=opts.timeoutDuration;if(typeof timeoutOption=="number"&&(!Number.isInteger(timeoutOption)||timeoutOption<0))throw new TypeError('"timeoutDuration" option must be a non-negative integer');let timeoutDuration=typeof timeoutOption=="number"?timeoutOption:5e3,cooldownDuration=validateDuration(opts.cooldownDuration,3e4,"cooldownDuration"),cacheMaxAge=validateDuration(opts.cacheMaxAge,6e5,"cacheMaxAge"),headers2=new Headers(opts.headers);USER_AGENT2&&!headers2.has("User-Agent")&&headers2.set("User-Agent",USER_AGENT2),headers2.has("accept")||headers2.set("accept","application/json, application/jwk-set+json");let fetchImpl=opts[customFetch],cache7=opts[jwksCache],jwksTimestamp,pendingFetch,reloadSequence=0,appliedSequence=0,local;if(cache7&&typeof cache7=="object"){let{uat,jwks}=cache7;isFreshFor(uat,cacheMaxAge)&&isJwkSet(jwks)&&(jwksTimestamp=uat,local=createLocalJWKSet(jwks))}let reload=async()=>{if(pendingFetch&&isCloudflareWorkers()&&(pendingFetch=void 0),!pendingFetch){let sequence=++reloadSequence,current=pendingFetch=fetchJwks(href,headers2,AbortSignal.timeout(timeoutDuration),fetchImpl).then(json2=>{let next=createLocalJWKSet(json2);if(sequence<=appliedSequence)return;local=next;let updatedAt=Date.now();cache7&&(cache7.uat=updatedAt,cache7.jwks=json2),jwksTimestamp=updatedAt,appliedSequence=sequence}).finally(()=>{pendingFetch===current&&(pendingFetch=void 0)})}await pendingFetch};return Object.defineProperties(async(protectedHeader,token)=>{(!local||!isFreshFor(jwksTimestamp,cacheMaxAge))&&await reload();try{return await local(protectedHeader,token)}catch(err2){if(err2 instanceof JWKSNoMatchingKey&&!isFreshFor(jwksTimestamp,cooldownDuration))return await reload(),local(protectedHeader,token);throw err2}},{coolingDown:{get:()=>isFreshFor(jwksTimestamp,cooldownDuration),enumerable:!0},fresh:{get:()=>isFreshFor(jwksTimestamp,cacheMaxAge),enumerable:!0},reload:{value:reload,enumerable:!0},reloading:{get:()=>!!pendingFetch,enumerable:!0},jwks:{value:()=>local?.jwks(),enumerable:!0}})}var TOKEN_EXPIRED_MESSAGE2="token has expired",TOKEN_AUDIENCE_MESSAGE="token audience does not match the expected audience",TOKEN_SIGNATURE_MESSAGE="token signature verification failed",INVALID_TOKEN_MESSAGE2="invalid token";function newOidcIdentityVerifier(config2){let jwks;async function jwksFor(){if(jwks!==void 0)return jwks;let{jwksUri}=await config2.discovery.discover(config2.issuer);return jwks=createRemoteJWKSet(new URL(jwksUri)),jwks}return{name:"oidc",async verify(token){if(!isJwtShaped(token))return null;let keys=await jwksFor(),payload;try{({payload}=await jwtVerify(token,keys,{issuer:config2.issuer,audience:config2.audience}))}catch(error2){throw classifyJoseError(error2)}if(typeof payload.sub!="string"||payload.sub==="")throw new ConnectError(INVALID_TOKEN_MESSAGE2,Code.Unauthenticated);return{identityId:await identityIdForSubject(config2.accounts,payload.sub),callerClass:"user",issuer:config2.issuer,rawToken:token,...typeof payload.email=="string"&&payload.email!==""?{email:payload.email}:{},...typeof payload.name=="string"&&payload.name!==""?{displayName:payload.name}:{}}}}}function isJwtShaped(token){let segments=token.split(".");return segments.length===3&&segments.every(s2=>s2!=="")}function classifyJoseError(error2){return error2 instanceof errors_exports.JWTExpired?new ConnectError(TOKEN_EXPIRED_MESSAGE2,Code.Unauthenticated):error2 instanceof errors_exports.JWTClaimValidationFailed?error2.claim==="aud"?new ConnectError(TOKEN_AUDIENCE_MESSAGE,Code.Unauthenticated):new ConnectError(INVALID_TOKEN_MESSAGE2,Code.Unauthenticated):error2 instanceof errors_exports.JWSSignatureVerificationFailed||error2 instanceof errors_exports.JWKSNoMatchingKey||error2 instanceof errors_exports.JWKSMultipleMatchingKeys||error2 instanceof errors_exports.JWKSInvalid?new ConnectError(TOKEN_SIGNATURE_MESSAGE,Code.Unauthenticated):error2 instanceof errors_exports.JWTInvalid||error2 instanceof errors_exports.JWSInvalid||error2 instanceof errors_exports.JOSENotSupported?new ConnectError(INVALID_TOKEN_MESSAGE2,Code.Unauthenticated):error2}var import_node_fs7=require("node:fs"),import_promises5=require("node:fs/promises"),import_node_http=__toESM(require("node:http"),1),import_node_path10=__toESM(require("node:path"),1);function createArtifactFileServer(options){let{basePath,logger:logger2}=options,server=import_node_http.default.createServer((req,res)=>{serveArtifact(basePath,req,res,logger2)});return{listen(port,host){return new Promise((resolve,reject2)=>{server.once("error",reject2),server.listen(port,host,()=>{server.removeListener("error",reject2);let address=server.address(),boundPort=address!==null&&typeof address=="object"?address.port:port;logger2.info("artifact HTTP file server listening",{port:boundPort,dir:basePath}),resolve(boundPort)})})},shutdown(){return new Promise(resolve=>{server.close(()=>resolve()),server.closeAllConnections()})}}}async function serveArtifact(basePath,req,res,logger2){try{if(req.method!=="GET"&&req.method!=="HEAD"){res.writeHead(405,{Allow:"GET, HEAD"}),res.end();return}let url=new URL(req.url??"/","http://localhost"),key;try{key=decodeURIComponent(url.pathname.replace(/^\/+/,""))}catch{res.writeHead(404),res.end(`404 page not found
 `);return}let root5=import_node_path10.default.resolve(basePath),filePath=import_node_path10.default.resolve(root5,key);if(filePath!==root5&&!filePath.startsWith(root5+import_node_path10.default.sep)){res.writeHead(404),res.end(`404 page not found
 `);return}let info;try{info=await(0,import_promises5.stat)(filePath)}catch{res.writeHead(404),res.end(`404 page not found
 `);return}if(!info.isFile()){res.writeHead(404),res.end(`404 page not found
-`);return}let headers2={"Content-Length":String(info.size)},downloadName=url.searchParams.get(LOCAL_DOWNLOAD_QUERY_PARAM)??"";if(downloadName!==""&&(headers2["Content-Disposition"]=contentDispositionAttachment(downloadName)),res.writeHead(200,headers2),req.method==="HEAD"){res.end();return}let stream=(0,import_node_fs7.createReadStream)(filePath);stream.on("error",error2=>{logger2.error("artifact file stream failed",{key,error:error2.message}),res.destroy()}),stream.pipe(res)}catch(error2){logger2.error("artifact file server request failed",{error:error2 instanceof Error?error2.message:String(error2)}),res.headersSent||res.writeHead(500),res.end()}}async function warnOnLegacyArtifactLayout(basePath,logger2){for(let sub of["attachments","artifacts"]){let legacy=import_node_path10.default.join(basePath,"artifacts",sub);try{if((await(0,import_promises5.stat)(legacy)).isDirectory()){logger2.warn("Detected artifacts under a pre-#285 layout at <base>/artifacts/*. The artifact root is now <base> itself. Move <base>/artifacts/* up into <base> (or set ARTIFACT_LOCAL_BASE_PATH to the old <base>/artifacts) so existing artifacts remain reachable.",{legacyDir:import_node_path10.default.join(basePath,"artifacts"),artifactRoot:basePath});return}}catch{}}}var file_ai_stigmer_agentic_channelapp_v1_command=fileDesc("Ci5haS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9jb21tYW5kLnByb3RvEiBhaS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MTKOBQobQ2hhbm5lbEFwcENvbW1hbmRDb250cm9sbGVyEmMKBWFwcGx5EiwuYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEuQ2hhbm5lbEFwcBosLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAStQEKBmNyZWF0ZRIsLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAaLC5haS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MS5DaGFubmVsQXBwIk/CuBhLCB8QHiIMbWV0YWRhdGEub3JnKjd1bmF1dGhvcml6ZWQgdG8gY3JlYXRlIGNoYW5uZWwgYXBwIGluIHRoaXMgb3JnYW5pemF0aW9uEp8BCgZ1cGRhdGUSLC5haS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MS5DaGFubmVsQXBwGiwuYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEuQ2hhbm5lbEFwcCI5wrgYNQgCEDAiC21ldGFkYXRhLmlkKiJ1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGNoYW5uZWwgYXBwEqkBCgZkZWxldGUSNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VEZWxldGVJbnB1dBosLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAiOcK4GDUIAxAwIgtyZXNvdXJjZV9pZCoidW5hdXRob3JpemVkIHRvIGRlbGV0ZSBjaGFubmVsIGFwcBoEoP8rMGIGcHJvdG8z",[file_ai_stigmer_agentic_channelapp_v1_api,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ChannelAppCommandController=serviceDesc(file_ai_stigmer_agentic_channelapp_v1_command,0);var file_ai_stigmer_agentic_channelapp_v1_io=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9pby5wcm90bxIgYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEiTAoLQ2hhbm5lbEFwcHMSPQoHZW50cmllcxgBIAMoCzIsLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAiMQoZTGlzdENoYW5uZWxBcHBzQnlPcmdJbnB1dBIUCgNvcmcYASABKAlCB7pIBHICEAFiBnByb3RvMw",[file_ai_stigmer_agentic_channelapp_v1_api,file_buf_validate_validate]),ChannelAppsSchema=messageDesc2(file_ai_stigmer_agentic_channelapp_v1_io,0);var file_ai_stigmer_agentic_channelapp_v1_query=fileDesc("CixhaS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9xdWVyeS5wcm90bxIgYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEy9gMKGUNoYW5uZWxBcHBRdWVyeUNvbnRyb2xsZXISlQEKA2dldBItLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUlkGiwuYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEuQ2hhbm5lbEFwcCIxwrgYLQgBEDAiBXZhbHVlKiB1bmF1dGhvcml6ZWQgdG8gdmlldyBjaGFubmVsIGFwcBJ6Cg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRosLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAiBNC4GAESvgEKCWxpc3RCeU9yZxI7LmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkxpc3RDaGFubmVsQXBwc0J5T3JnSW5wdXQaLS5haS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MS5DaGFubmVsQXBwcyJFwrgYQQgBEB4iA29yZyo2dW5hdXRob3JpemVkIHRvIGxpc3QgY2hhbm5lbCBhcHBzIGluIHRoaXMgb3JnYW5pemF0aW9uGgSg/yswYgZwcm90bzM",[file_ai_stigmer_agentic_channelapp_v1_api,file_ai_stigmer_agentic_channelapp_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ChannelAppQueryController=serviceDesc(file_ai_stigmer_agentic_channelapp_v1_query,0);async function destroySecretBackingState(secretService,logger2,fields2,storedValues){for(let storedValue of storedValues)if(storedValue!=="")try{await secretService.delete(storedValue)}catch(error2){logger2.error("secret backing-state destruction failed after persist \u2014 external state may be orphaned",{...fields2,error:error2 instanceof Error?error2.message:String(error2)})}}function newDestroySecretBackingStateStep(secretService,logger2,extractSecretValues){return{name:"DestroySecretBackingState",async execute(ctx){let deleted=ctx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)return;let metadata=deleted.metadata;await destroySecretBackingState(secretService,logger2,{kind:getKindName(ctx.apiResourceKind),resourceId:metadata?.id??""},extractSecretValues(deleted))}}}var REDACTED_MARKER2="***REDACTED***";function plaintextRequiredMessage(fieldName){return`${fieldName} must be plaintext \u2014 values carrying the 'enc:' encryption prefix are not accepted from clients`}function markerOnCreateMessage(fieldName){return`cannot use the redaction marker as ${fieldName} on create`}function noExistingSecretMessage(fieldName){return`cannot preserve ${fieldName}: no existing secret value found`}var PROVIDER_IMMUTABLE_MESSAGE="the provider of a channel app cannot be changed";function deleteBlockedByChannelMessage(org,slug,channelName){return`cannot delete ChannelApp '${org}/${slug}': referenced by agent channel '${channelName}'`}function redactChannelApp(app){let provider=app.spec?.providerConfig;switch(provider?.case){case"slack":redactSlack(provider.value);return;case"whatsapp":redactWhatsApp(provider.value);return;case void 0:return;default:{let exhaustive=provider;throw new Error(`unhandled provider arm: ${String(exhaustive)}`)}}}function redactSlack(slack){slack.clientSecret!==""&&(slack.clientSecret=REDACTED_MARKER2),slack.signingSecret!==""&&(slack.signingSecret=REDACTED_MARKER2)}function redactWhatsApp(whatsapp){whatsapp.appSecret!==""&&(whatsapp.appSecret=REDACTED_MARKER2),whatsapp.accessToken!==""&&(whatsapp.accessToken=REDACTED_MARKER2),whatsapp.verifyToken!==""&&(whatsapp.verifyToken=REDACTED_MARKER2)}function secretValuesOfChannelApp(app){let provider=app.spec?.providerConfig;switch(provider?.case){case"slack":return[provider.value.clientSecret,provider.value.signingSecret];case"whatsapp":return[provider.value.appSecret,provider.value.accessToken,provider.value.verifyToken];case void 0:return[];default:{let exhaustive=provider;throw new Error(`unhandled provider arm: ${String(exhaustive)}`)}}}function newEncryptChannelAppSecretsForCreateStep(secretService,logger2){return newEncryptChannelAppSecretsStep(secretService,logger2,!0)}function newEncryptChannelAppSecretsForUpdateStep(secretService,logger2){return newEncryptChannelAppSecretsStep(secretService,logger2,!1)}function newEncryptChannelAppSecretsStep(secretService,logger2,isCreate){async function resolveSecret(ctx,fieldName,requestValue,readExisting){if(requestValue==="")return requestValue;if(requestValue===REDACTED_MARKER2)return preserveExistingSecret2(ctx,fieldName,readExisting);if(isCiphertextShaped(requestValue))throw invalidArgumentError(plaintextRequiredMessage(fieldName));if(!secretService.isEnabled())return logger2.warn(`Encryption disabled: ${fieldName} will be stored in plaintext`),requestValue;try{return await secretService.encrypt(requestValue,EncryptionScope.forOrganization(ctx.newState.metadata?.org??""))}catch(error2){throw internalError(error2,`failed to encrypt ${fieldName}`)}}function preserveExistingSecret2(ctx,fieldName,readExisting){if(isCreate)throw invalidArgumentError(markerOnCreateMessage(fieldName));let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing resource not loaded"),`cannot preserve ${fieldName}: existing resource not loaded`);let existingSecret=readExisting(existing);if(existingSecret==="")throw invalidArgumentError(noExistingSecretMessage(fieldName));return existingSecret}return{name:"EncryptChannelAppSecrets",async execute(ctx){let provider=ctx.newState.spec?.providerConfig;switch(provider?.case){case"slack":{let slack=provider.value;slack.clientSecret=await resolveSecret(ctx,"client_secret",slack.clientSecret,existing=>existing.spec?.providerConfig.case==="slack"?existing.spec.providerConfig.value.clientSecret:""),slack.signingSecret=await resolveSecret(ctx,"signing_secret",slack.signingSecret,existing=>existing.spec?.providerConfig.case==="slack"?existing.spec.providerConfig.value.signingSecret:"");return}case"whatsapp":{let whatsapp=provider.value;whatsapp.appSecret=await resolveSecret(ctx,"app_secret",whatsapp.appSecret,existing=>existing.spec?.providerConfig.case==="whatsapp"?existing.spec.providerConfig.value.appSecret:""),whatsapp.accessToken=await resolveSecret(ctx,"access_token",whatsapp.accessToken,existing=>existing.spec?.providerConfig.case==="whatsapp"?existing.spec.providerConfig.value.accessToken:""),whatsapp.verifyToken=await resolveSecret(ctx,"verify_token",whatsapp.verifyToken,existing=>existing.spec?.providerConfig.case==="whatsapp"?existing.spec.providerConfig.value.verifyToken:"");return}case void 0:return;default:{let exhaustive=provider;throw new Error(`unhandled provider arm: ${String(exhaustive)}`)}}}}}function newValidateProviderImmutableStep(){return{name:"ValidateProviderImmutable",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing channel app not found in context"),"existing channel app not found in context");let existingCase=existing.spec?.providerConfig.case,inputCase=ctx.input.spec?.providerConfig.case;if(existingCase!==inputCase)throw invalidArgumentError(PROVIDER_IMMUTABLE_MESSAGE)}}}function newCheckNoReferencingChannelsStep(store,logger2){return{name:"CheckNoReferencingChannels",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing ChannelApp not loaded in delete pipeline"),"existing ChannelApp not loaded in delete pipeline");let org=existing.metadata?.org??"",slug=existing.metadata?.slug??"",rows;try{rows=await store.listResources(ApiResourceKind.agent_channel)}catch(error2){throw internalError(error2,"failed to list agent channels for referential integrity check")}for(let bytes of rows){let channel;try{channel=fromBinary2(AgentChannelSchema,bytes)}catch{logger2.warn("Failed to unmarshal agent channel during referential integrity check, skipping");continue}let ref=channel.spec?.appRef;if(ref===void 0||ref.slug==="")continue;if((ref.org!==""?ref.org:channel.metadata?.org??"")===org&&ref.slug===slug)throw failedPreconditionError(deleteBlockedByChannelMessage(org,slug,channel.metadata?.name??""))}}}}function registerChannelAppServices(router,deps){router.service(ChannelAppCommandController,{apply:(app,ctx)=>apply6(deps,app,ctx),create:(app,ctx)=>createChannelApp(deps,app,ctx),update:(app,ctx)=>update9(deps,app,ctx),delete:(input,ctx)=>deleteChannelApp(deps,input,ctx)}),router.service(ChannelAppQueryController,{get:(id,ctx)=>get12(deps,id,ctx),getByReference:(ref,ctx)=>getByReference6(deps,ref,ctx),listByOrg:(req,ctx)=>listByOrg(deps,req,ctx)})}function kindOf11(ctx){return ctx.values.get(apiResourceKindKey)}async function createChannelApp(deps,app,ctx){let reqCtx=new RequestContext(ChannelAppSchema,app,callerIdentityOf(ctx),kindOf11(ctx));return await newPipeline("channelapp-create",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newEncryptChannelAppSecretsForCreateStep(deps.secretService,deps.logger)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),redactChannelApp(reqCtx.newState),reqCtx.newState}async function update9(deps,app,ctx){let reqCtx=new RequestContext(ChannelAppSchema,app,callerIdentityOf(ctx),kindOf11(ctx));return await newPipeline("channelapp-update",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateProviderImmutableStep()).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newEncryptChannelAppSecretsForUpdateStep(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).build().execute(reqCtx),redactChannelApp(reqCtx.newState),reqCtx.newState}async function apply6(deps,app,ctx){let reqCtx=new RequestContext(ChannelAppSchema,app,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-apply",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createChannelApp(deps,app,ctx):update9(deps,withResolvedApplyId(ChannelAppSchema,app,reqCtx),ctx)}async function deleteChannelApp(deps,input,ctx){let reqCtx=new RequestContext(ChannelAppCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf11(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("channelapp-delete",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,ChannelAppSchema)).addStep(newCheckNoReferencingChannelsStep(deps.store,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDestroySecretBackingStateStep(deps.secretService,deps.logger,secretValuesOfChannelApp)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted ChannelApp not found in context"),"deleted ChannelApp not found in context");let app=deleted;return redactChannelApp(app),app}async function get12(deps,id,ctx){let reqCtx=new RequestContext(ChannelAppQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-get",deps.logger).addStep(newAuthorizeStep(ChannelAppQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,ChannelAppSchema)).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactChannelApp(app),app}async function getByReference6(deps,ref,ctx){let reqCtx=new RequestContext(ChannelAppQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-get-by-reference",deps.logger).addStep(newAuthorizeStep(ChannelAppQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,ChannelAppSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(ChannelAppQueryController.method.get))).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactChannelApp(app),app}var LIST_RESULT_KEY4="listResult";async function listByOrg(deps,req,ctx){let reqCtx=new RequestContext(ChannelAppQueryController.method.listByOrg.input,req,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-list-by-org",deps.logger).addStep(newAuthorizeStep(ChannelAppQueryController.method.listByOrg,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgStep(deps.store,deps.logger)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY4);if(result===void 0)throw internalError(new Error("ChannelApp list not found in context"),"ChannelApp list not found in context");return result}function newListByOrgStep(store,logger2){return{name:"ListByOrg",async execute(ctx){let org=ctx.input.org,rows;try{rows=await store.listResources(ApiResourceKind.channel_app)}catch(error2){throw internalError(error2,"failed to list ChannelApps")}let apps=[];for(let bytes of rows){let app;try{app=fromBinary2(ChannelAppSchema,bytes)}catch{logger2.warn("Failed to unmarshal ChannelApp, skipping");continue}(app.metadata?.org??"")===org&&(redactChannelApp(app),apps.push(app))}apps.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(LIST_RESULT_KEY4,create2(ChannelAppsSchema,{entries:apps}))}}}var file_ai_stigmer_agentic_environment_v1_command=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvZW52aXJvbm1lbnQvdjEvY29tbWFuZC5wcm90bxIhYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxMoMKChxFbnZpcm9ubWVudENvbW1hbmRDb250cm9sbGVyEmcKBWFwcGx5Ei4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50Gi4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50ErkBCgZjcmVhdGUSLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiT8K4GEsIDBAeIgxtZXRhZGF0YS5vcmcqN3VuYXV0aG9yaXplZCB0byBjcmVhdGUgZW52aXJvbm1lbnQgaW4gdGhpcyBvcmdhbml6YXRpb24SowEKBnVwZGF0ZRIuLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudBouLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudCI5wrgYNQgCEDUiC21ldGFkYXRhLmlkKiJ1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGVudmlyb25tZW50Er8BChB1cGRhdGVWaXNpYmlsaXR5EjUuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLlVwZGF0ZVZpc2liaWxpdHlJbnB1dBouLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudCJEwrgYQAgCEDUiC3Jlc291cmNlX2lkKi11bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGVudmlyb25tZW50IHZpc2liaWxpdHkSqwEKBmRlbGV0ZRI2LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZURlbGV0ZUlucHV0Gi4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50IjnCuBg1CAIQNSILcmVzb3VyY2VfaWQqInVuYXV0aG9yaXplZCB0byBkZWxldGUgZW52aXJvbm1lbnQSzwEKD3VwZGF0ZVZhcmlhYmxlcxJELmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5VcGRhdGVFbnZpcm9ubWVudFZhcmlhYmxlc1JlcXVlc3QaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiRsK4GEIIAhA1Ig5lbnZpcm9ubWVudF9pZCosdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBlbnZpcm9ubWVudCB2YXJpYWJsZXMSzwEKD3JlbW92ZVZhcmlhYmxlcxJELmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5SZW1vdmVFbnZpcm9ubWVudFZhcmlhYmxlc1JlcXVlc3QaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiRsK4GEIIAhA1Ig5lbnZpcm9ubWVudF9pZCosdW5hdXRob3JpemVkIHRvIHJlbW92ZSBlbnZpcm9ubWVudCB2YXJpYWJsZXMaBKD/KzViBnByb3RvMw",[file_ai_stigmer_agentic_environment_v1_api,file_ai_stigmer_agentic_environment_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),EnvironmentCommandController=serviceDesc(file_ai_stigmer_agentic_environment_v1_command,0);var file_ai_stigmer_agentic_environment_v1_query=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvZW52aXJvbm1lbnQvdjEvcXVlcnkucHJvdG8SIWFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MTKMBQoaRW52aXJvbm1lbnRRdWVyeUNvbnRyb2xsZXISlgEKA2dldBItLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUlkGi4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50IjDCuBgsCAEQNSIFdmFsdWUqH3VuYXV0aG9yaXplZCB0byBnZXQgZW52aXJvbm1lbnQSfAoOZ2V0QnlSZWZlcmVuY2USNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2UaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiBNC4GAES0gEKDmdldFNlY3JldFZhbHVlEj4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50U2VjcmV0VmFsdWVJbnB1dBozLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudFZhbHVlIkvCuBhHCBAQNSIOZW52aXJvbm1lbnRfaWQqMXVuYXV0aG9yaXplZCB0byByZWFkIHNlY3JldCB2YWx1ZXMgKGNyZWF0b3Itb25seSkSfAoEbGlzdBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5MaXN0RW52aXJvbm1lbnRzUmVxdWVzdBoyLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudExpc3QiBNC4GAEaBKD/KzViBnByb3RvMw",[file_ai_stigmer_agentic_environment_v1_api,file_ai_stigmer_agentic_environment_v1_io,file_ai_stigmer_agentic_environment_v1_spec,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),EnvironmentQueryController=serviceDesc(file_ai_stigmer_agentic_environment_v1_query,0);function redactEnvironmentSecrets(env2){let data=env2?.spec?.data;if(data!==void 0)for(let value of Object.values(data))value.isSecret&&value.value!==""&&(value.value=REDACTED_MARKER)}function shareRestrictionReason(metadata){let labels=metadata?.labels??{};return labels[PERSONAL_LABEL_KEY]===PERSONAL_LABEL_VALUE?PERSONAL_SHARE_RESTRICTION:labels[MANAGED_LABEL_KEY]===MANAGED_LABEL_VALUE?MANAGED_SHARE_RESTRICTION:""}var environmentSearchExtractor={kind:ApiResourceKind.environment,schema:EnvironmentSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let env2=resource;return buildSearchResult({kind:ApiResourceKind.environment,metadata:env2.metadata,summary:env2.spec?.description??"",score,createdAt:env2.status?.audit?.specAudit?.createdAt,updatedAt:env2.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let env2=resource,metadata=env2.metadata;if(metadata!==void 0)return{name:metadata.name,description:env2.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(env2.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var SECRET_VALUE_KEY="secretValue",UPDATED_ENVIRONMENT_KEY="updatedEnvironment";function newPreserveRedactedSecretsStep(){return{name:"PreserveRedactedSecrets",execute(ctx){let data=ctx.newState.spec?.data;if(data===void 0||Object.keys(data).length===0)return;let existingData=ctx.get(EXISTING_RESOURCE_KEY)?.spec?.data??{};for(let[key,value]of Object.entries(data))if(value.isSecret){if(value.value===REDACTED_MARKER){let existingEntry=existingData[key];if(existingEntry!==void 0&&existingEntry.isSecret){data[key]=existingEntry;continue}throw invalidArgumentError(markerRejectionMessage(key))}if(isCiphertextShaped(value.value))throw invalidArgumentError(forgedCiphertextMessage(key))}}}}function newEncryptSecretValuesStep(secretService,logger2){return{name:"EncryptSecretValues",async execute(ctx){let env2=ctx.newState,data=env2.spec?.data;if(!(data===void 0||Object.keys(data).length===0)){if(!secretService.isEnabled()){hasNonEmptySecret(data)&&logger2.warn("Encryption disabled: environment secret values will be stored in plaintext",{environmentId:env2.metadata?.id??""});return}for(let[key,value]of Object.entries(data))if(!(!value.isSecret||value.value===""))try{value.value=await secretService.encrypt(value.value,EncryptionScope.forOrganization(env2.metadata?.org??""))}catch(error2){throw internalError(error2,`failed to encrypt secret value for variable '${key}'`)}}}}}function hasNonEmptySecret(data){return Object.values(data).some(v=>v.isSecret&&v.value!=="")}function newEnforcePersonalUniquenessStep(store){return{name:"EnforcePersonalEnvUniqueness",async execute(ctx){let metadata=ctx.newState.metadata;if(metadata===void 0||metadata.labels[PERSONAL_LABEL_KEY]!==PERSONAL_LABEL_VALUE)return;let existing;try{existing=await findResourceByLabelAndOrg(store,ctx.apiResourceKind,EnvironmentSchema,PERSONAL_LABEL_KEY,PERSONAL_LABEL_VALUE,metadata.org)}catch(error2){throw internalError(error2,"failed to check personal environment uniqueness")}if(existing!==void 0)throw new ConnectError(personalEnvironmentExistsMessage(existing.metadata?.id??""),Code.AlreadyExists)}}}function newLoadEnvironmentByIdStep(store){return{name:"LoadEnvironmentByID",async execute(ctx){let environmentId=ctx.input.environmentId;if(typeof environmentId!="string"||environmentId==="")throw invalidArgumentError("environment_id is required");let env2;try{env2=await store.getResource(ctx.apiResourceKind,environmentId,EnvironmentSchema)}catch{throw notFoundError("environment",environmentId)}ctx.set(TARGET_RESOURCE_KEY,env2)}}}function newExtractAndDecryptSingleKeyStep(secretService,logger2){return{name:"ExtractAndDecryptSingleKey",async execute(ctx){let key=ctx.input.key,env2=ctx.get(TARGET_RESOURCE_KEY);if(env2===void 0)throw internalError(new Error("targetResource missing or wrong type"),"environment not loaded in context");let envValue=env2.spec?.data[key];if(envValue===void 0)throw notFoundError("environment key",key);if(envValue.isSecret&&envValue.value!==""){let decrypted;try{decrypted=await secretService.decrypt(envValue.value)}catch(error2){throw logger2.error("Failed to decrypt secret value",{key,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to decrypt secret value")}ctx.set(SECRET_VALUE_KEY,create2(EnvironmentValueSchema,{value:decrypted,isSecret:!0,description:envValue.description}));return}ctx.set(SECRET_VALUE_KEY,envValue)}}}function newMergeVariablesAndPersistStep(store,secretService,logger2){return{name:"MergeVariablesAndPersist",async execute(ctx){let env2=ctx.get(TARGET_RESOURCE_KEY);if(env2===void 0)throw internalError(new Error("targetResource missing or wrong type"),"environment not loaded in context");env2.spec===void 0&&(env2.spec=create2(EnvironmentSpecSchema,{}));let incoming=ctx.input.variables;for(let[key,incomingValue]of Object.entries(incoming)){let value=incomingValue;if(value.isSecret&&value.value===REDACTED_MARKER){let existing=env2.spec.data[key];if(existing!==void 0&&existing.isSecret)continue;throw invalidArgumentError(markerRejectionMessage(key))}if(value.isSecret&&isCiphertextShaped(value.value))throw invalidArgumentError(forgedCiphertextMessage(key));if(value.isSecret&&value.value!=="")if(!secretService.isEnabled())logger2.warn("Encryption disabled: environment secret value will be stored in plaintext",{key});else{let encrypted;try{encrypted=await secretService.encrypt(value.value,EncryptionScope.forOrganization(env2.metadata?.org??""))}catch(error2){throw internalError(error2,`failed to encrypt secret value for variable '${key}'`)}value=create2(EnvironmentValueSchema,{value:encrypted,isSecret:!0,description:value.description})}env2.spec.data[key]=value}try{setAuditFieldsForUpdate(EnvironmentSchema,env2,"spec_audit",ctx.callerIdentity)}catch(error2){throw internalError(error2,"failed to set audit fields")}try{await store.saveResource(ctx.apiResourceKind,env2.metadata?.id??"",EnvironmentSchema,env2)}catch(error2){throw internalError(error2,"failed to persist environment after merging variables")}ctx.set(UPDATED_ENVIRONMENT_KEY,env2)}}}function newRemoveVariableKeysAndPersistStep(store,secretService,logger2){return{name:"RemoveVariableKeysAndPersist",async execute(ctx){let env2=ctx.get(TARGET_RESOURCE_KEY);if(env2===void 0)throw internalError(new Error("targetResource missing or wrong type"),"environment not loaded in context");let keys=ctx.input.keys,removedSecretValues=[];if(env2.spec?.data!==void 0)for(let key of keys){let removed=env2.spec.data[key];removed!==void 0&&removed.isSecret&&removedSecretValues.push(removed.value),delete env2.spec.data[key]}try{setAuditFieldsForUpdate(EnvironmentSchema,env2,"spec_audit",ctx.callerIdentity)}catch(error2){throw internalError(error2,"failed to set audit fields")}try{await store.saveResource(ctx.apiResourceKind,env2.metadata?.id??"",EnvironmentSchema,env2)}catch(error2){throw internalError(error2,"failed to persist environment after removing variables")}await destroySecretBackingState(secretService,logger2,{kind:"environment",resourceId:env2.metadata?.id??"",operation:"removeVariables"},removedSecretValues),ctx.set(UPDATED_ENVIRONMENT_KEY,env2)}}}function newDestroyDroppedEnvironmentSecretsStep(secretService,logger2){return{name:"DestroyDroppedEnvironmentSecrets",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY),oldData=existing?.spec?.data;if(oldData===void 0)return;let newData=ctx.newState.spec?.data??{},droppedSecretValues=Object.entries(oldData).filter(([key,value])=>value.isSecret&&newData[key]===void 0).map(([,value])=>value.value);await destroySecretBackingState(secretService,logger2,{kind:"environment",resourceId:existing?.metadata?.id??"",operation:"update"},droppedSecretValues)}}}function secretValuesOfEnvironment(env2){return Object.values(env2.spec?.data??{}).filter(value=>value.isSecret).map(value=>value.value)}function registerEnvironmentServices(router,deps){router.service(EnvironmentCommandController,{apply:(env2,ctx)=>apply7(deps,env2,ctx),create:(env2,ctx)=>createEnvironment(deps,env2,ctx),update:(env2,ctx)=>update10(deps,env2,ctx),updateVisibility:(input,ctx)=>updateVisibility3(deps,input,ctx),delete:(input,ctx)=>deleteEnvironment(deps,input,ctx),updateVariables:(req,ctx)=>updateVariables(deps,req,ctx),removeVariables:(req,ctx)=>removeVariables(deps,req,ctx)}),router.service(EnvironmentQueryController,{get:(id,ctx)=>get13(deps,id,ctx),getByReference:(ref,ctx)=>getByReference7(deps,ref,ctx),getSecretValue:(input,ctx)=>getSecretValue(deps,input,ctx),list:(req,ctx)=>list8(deps,req,ctx)})}function kindOf12(ctx){return ctx.values.get(apiResourceKindKey)}async function createEnvironment(deps,env2,ctx){let reqCtx=new RequestContext(EnvironmentSchema,env2,callerIdentityOf(ctx),kindOf12(ctx));return await newPipeline("environment-create",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newEnforcePersonalUniquenessStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPreserveRedactedSecretsStep()).addStep(newEncryptSecretValuesStep(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,environmentSearchExtractor,deps.logger)).build().execute(reqCtx),redactEnvironmentSecrets(reqCtx.newState),reqCtx.newState}async function update10(deps,env2,ctx){let reqCtx=new RequestContext(EnvironmentSchema,env2,callerIdentityOf(ctx),kindOf12(ctx));return await newPipeline("environment-update",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPreserveRedactedSecretsStep()).addStep(newEncryptSecretValuesStep(deps.secretService,deps.logger)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newDestroyDroppedEnvironmentSecretsStep(deps.secretService,deps.logger)).addStep(newIndexSearchStep(deps.store,environmentSearchExtractor,deps.logger)).build().execute(reqCtx),redactEnvironmentSecrets(reqCtx.newState),reqCtx.newState}async function apply7(deps,env2,ctx){let reqCtx=new RequestContext(EnvironmentSchema,env2,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-apply",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createEnvironment(deps,env2,ctx):update10(deps,withResolvedApplyId(EnvironmentSchema,env2,reqCtx),ctx)}async function deleteEnvironment(deps,input,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf12(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("environment-delete",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,EnvironmentSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDestroySecretBackingStateStep(deps.secretService,deps.logger,secretValuesOfEnvironment)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted environment not found in context"),"deleted environment not found in context");let env2=deleted;return redactEnvironmentSecrets(env2),env2}var UPDATE_VISIBILITY_ENVIRONMENT_KEY="updateVisibilityEnvironment";async function updateVisibility3(deps,input,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.updateVisibility.input,input,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-update-visibility",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.updateVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentForVisibilityUpdateStep(deps.store)).addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_ENVIRONMENT_KEY)).addStep(newValidateVisibilityUpdateStep()).addStep(newValidateEnvironmentShareRestrictionStep()).addStep(newSetEnvironmentVisibilityStep()).addStep(newPersistEnvironmentForVisibilityUpdateStep(deps.store)).addStep(newUpdateVisibilityTuplesStep(deps.authorizationLifecycle,UPDATE_VISIBILITY_ENVIRONMENT_KEY)).addStep(newIndexEnvironmentAfterVisibilityUpdateStep(deps.store,deps.logger)).build().execute(reqCtx);let env2=reqCtx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY);return redactEnvironmentSecrets(env2),env2}function newLoadEnvironmentForVisibilityUpdateStep(store){return{name:"LoadEnvironmentForVisibilityUpdate",async execute(ctx){let input=ctx.input,env2;try{env2=await store.getResource(ctx.apiResourceKind,input.resourceId,EnvironmentSchema)}catch{throw notFoundError("environment",input.resourceId)}ctx.set(UPDATE_VISIBILITY_ENVIRONMENT_KEY,env2)}}}function newValidateEnvironmentShareRestrictionStep(){return{name:"ValidateEnvironmentShareRestriction",execute(ctx){if(ctx.input.visibility!==ApiResourceVisibility.visibility_org)return;let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY),reason=shareRestrictionReason(env2.metadata);if(reason!=="")throw failedPreconditionError(reason)}}}function newSetEnvironmentVisibilityStep(){return{name:"SetVisibility",execute(ctx){let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY);env2.metadata!==void 0&&(env2.metadata.visibility=ctx.input.visibility),setAuditFieldsForUpdate(EnvironmentSchema,env2,"status_audit",ctx.callerIdentity)}}}function newPersistEnvironmentForVisibilityUpdateStep(store){return{name:"PersistEnvironmentForVisibilityUpdate",async execute(ctx){let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY);try{await store.saveResource(ctx.apiResourceKind,env2.metadata?.id??"",EnvironmentSchema,env2)}catch(error2){throw internalError(error2,"failed to save environment")}}}}function newIndexEnvironmentAfterVisibilityUpdateStep(store,logger2){return{name:"IndexEnvironmentAfterVisibilityUpdate",async execute(ctx){let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY),entry=environmentSearchExtractor.getSearchIndexEntry(env2);if(entry===void 0){logger2.warn("IndexEnvironmentAfterVisibilityUpdate: extractor returned nil, skipping",{id:env2.metadata?.id??""});return}try{await store.upsertSearchIndex(ctx.apiResourceKind,env2.metadata?.id??"",entry)}catch(error2){logger2.warn("IndexEnvironmentAfterVisibilityUpdate: failed (best-effort)",{id:env2.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}}}async function updateVariables(deps,req,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.updateVariables.input,req,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-update-variables",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.updateVariables,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentByIdStep(deps.store)).addStep(newMergeVariablesAndPersistStep(deps.store,deps.secretService,deps.logger)).build().execute(reqCtx);let updated=reqCtx.get(UPDATED_ENVIRONMENT_KEY);return redactEnvironmentSecrets(updated),updated}async function removeVariables(deps,req,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.removeVariables.input,req,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-remove-variables",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.removeVariables,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentByIdStep(deps.store)).addStep(newRemoveVariableKeysAndPersistStep(deps.store,deps.secretService,deps.logger)).build().execute(reqCtx);let updated=reqCtx.get(UPDATED_ENVIRONMENT_KEY);return redactEnvironmentSecrets(updated),updated}async function get13(deps,id,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-get",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,EnvironmentSchema)).build().execute(reqCtx);let env2=reqCtx.get(TARGET_RESOURCE_KEY);return redactEnvironmentSecrets(env2),env2}async function getByReference7(deps,ref,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-get-by-reference",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,EnvironmentSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(EnvironmentQueryController.method.get))).build().execute(reqCtx);let env2=reqCtx.get(TARGET_RESOURCE_KEY);return redactEnvironmentSecrets(env2),env2}async function getSecretValue(deps,input,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.getSecretValue.input,input,callerIdentityOf(ctx),kindOf12(ctx));return await newPipeline("environment-get-secret-value",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.getSecretValue,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentByIdStep(deps.store)).addStep(newExtractAndDecryptSingleKeyStep(deps.secretService,deps.logger)).build().execute(reqCtx),reqCtx.get(SECRET_VALUE_KEY)}var LIST_RESULT_KEY5="listResult";async function list8(deps,req,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-list",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgAndLabelsStep5(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY5);if(result===void 0)throw internalError(new Error("environment list not found in context"),"environment list not found in context");return result}function newListByOrgAndLabelsStep5(store,listReadScope){return{name:"ListByOrgAndLabels",async execute(ctx){let{org,labels:filterLabels}=ctx.input,rows;try{rows=await store.listResources(ctx.apiResourceKind)}catch(error2){throw internalError(error2,"failed to list environments")}let decoded=[];for(let bytes of rows)try{decoded.push(fromBinary2(EnvironmentSchema,bytes))}catch{continue}let requested=decoded.filter(env2=>(env2.metadata?.org??"")===org&&matchesAllLabels(env2.metadata?.labels??{},filterLabels)),environments=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.environment,requested,"");for(let env2 of environments)redactEnvironmentSecrets(env2);environments.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(LIST_RESULT_KEY5,create2(EnvironmentListSchema,{totalCount:environments.length,items:environments}))}}}var file_ai_stigmer_agentic_executioncontext_v1_command=fileDesc("CjRhaS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9jb21tYW5kLnByb3RvEiZhaS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MTLpAwohRXhlY3V0aW9uQ29udGV4dENvbW1hbmRDb250cm9sbGVyEnsKBWFwcGx5EjguYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEuRXhlY3V0aW9uQ29udGV4dBo4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQSggEKBmNyZWF0ZRI4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQaOC5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25Db250ZXh0IgTQuBgBErsBCgZkZWxldGUSNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VEZWxldGVJbnB1dBo4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQiP8K4GDsIAhA2IgtyZXNvdXJjZV9pZCoodW5hdXRob3JpemVkIHRvIGRlbGV0ZSBleGVjdXRpb24gY29udGV4dBoEoP8rNmIGcHJvdG8z",[file_ai_stigmer_agentic_executioncontext_v1_api,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ExecutionContextCommandController=serviceDesc(file_ai_stigmer_agentic_executioncontext_v1_command,0);var file_ai_stigmer_agentic_executioncontext_v1_io=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9pby5wcm90bxImYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEiKwoSRXhlY3V0aW9uQ29udGV4dElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiQQogRXhlY3V0aW9uQ29udGV4dEV4ZWN1dGlvbklkSW5wdXQSHQoMZXhlY3V0aW9uX2lkGAEgASgJQge6SARyAhABYgZwcm90bzM",[file_buf_validate_validate]);var file_ai_stigmer_agentic_executioncontext_v1_query=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9xdWVyeS5wcm90bxImYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEyhQQKH0V4ZWN1dGlvbkNvbnRleHRRdWVyeUNvbnRyb2xsZXISswEKA2dldBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHRJZBo4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQiNsK4GDIIARA2IgV2YWx1ZSoldW5hdXRob3JpemVkIHRvIGdldCBleGVjdXRpb24gY29udGV4dBKGAQoOZ2V0QnlSZWZlcmVuY2USNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2UaOC5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25Db250ZXh0IgTQuBgBEpwBChBnZXRCeUV4ZWN1dGlvbklkEkguYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEuRXhlY3V0aW9uQ29udGV4dEV4ZWN1dGlvbklkSW5wdXQaOC5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25Db250ZXh0IgTQuBgBGgSg/ys2YgZwcm90bzM",[file_ai_stigmer_agentic_executioncontext_v1_api,file_ai_stigmer_agentic_executioncontext_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ExecutionContextQueryController=serviceDesc(file_ai_stigmer_agentic_executioncontext_v1_query,0);function redactExecutionContextSecrets(ec2){let data=ec2?.spec?.data;if(data!==void 0)for(let value of Object.values(data))value.isSecret&&value.value!==""&&(value.value=REDACTED_MARKER)}var import_node_crypto18=require("node:crypto"),CONNECT_EXECUTION_ID_PREFIX="connect-";function newConnectExecutionId(mcpServerId){return`${CONNECT_EXECUTION_ID_PREFIX}${mcpServerId}-${(0,import_node_crypto18.randomUUID)().slice(0,8)}`}function isConnectExecutionId(executionId){return executionId.startsWith(CONNECT_EXECUTION_ID_PREFIX)}function isTerminalWorkflowExecutionPhase(phase){switch(phase){case ExecutionPhase2.EXECUTION_COMPLETED:case ExecutionPhase2.EXECUTION_FAILED:case ExecutionPhase2.EXECUTION_CANCELLED:case ExecutionPhase2.EXECUTION_TERMINATED:return!0;default:return!1}}var RUNNER_VERIFIER_NAME="runner",RUNNER_CREDENTIAL_INVALID_MESSAGE="runner credential is not valid on this server",RUNNER_CREDENTIAL_NOT_LIVE_MESSAGE="runner credential names a run that is over or belongs to nobody this server recognizes",RUN_CREDENTIAL_NOT_RUNS_PERSON_MESSAGE="a run credential is minted only for the person whose run it is",WORKFLOW_LINEAGE_BINDING_MISMATCH_MESSAGE="workflow lineage label names a workflow execution this runner credential is not bound to",MEMORY_CAPTURE_ORG_MISMATCH_MESSAGE="memory capture is scoped to the session's organization";function boundExecutionKindOf(executionId){switch(kindByIdPrefix(executionId)){case ApiResourceKind.agent_execution:return"agent-execution";case ApiResourceKind.workflow_execution:return"workflow-execution";default:return isConnectExecutionId(executionId)?"mcp-connect":void 0}}function bindsARun(kind){switch(kind){case"agent-execution":case"workflow-execution":return!0;case"mcp-connect":return!1;default:{let exhaustive=kind;throw new Error(`unknown bound execution kind ${String(exhaustive)}`)}}}async function loadBoundExecution(store,executionId,now=Date.now()){let kind=boundExecutionKindOf(executionId);if(kind!==void 0)switch(kind){case"agent-execution":{let row=await getRow(store,ApiResourceKind.agent_execution,executionId,AgentExecutionSchema);return row===void 0?void 0:{kind,executionId,org:row.metadata?.org??"",createdBy:creatorStampOf(AgentExecutionSchema,row),sessionId:row.spec?.sessionId??"",live:isLive(row.status!==void 0&&isTerminalExecutionPhase(row.status.phase),row.status?.completedAt??"",now)}}case"workflow-execution":{let row=await getRow(store,ApiResourceKind.workflow_execution,executionId,WorkflowExecutionSchema);return row===void 0?void 0:{kind,executionId,org:row.metadata?.org??"",createdBy:creatorStampOf(WorkflowExecutionSchema,row),sessionId:"",live:isLive(row.status!==void 0&&isTerminalWorkflowExecutionPhase(row.status.phase),row.status?.completedAt??"",now)}}case"mcp-connect":{let row=await getExecutionContextRow(store,executionId);return row===void 0?void 0:{kind,executionId,org:row.metadata?.org??"",createdBy:creatorStampOf(ExecutionContextSchema,row),sessionId:"",live:!0}}default:{let exhaustive=kind;throw new Error(`unknown bound execution kind ${String(exhaustive)}`)}}}function isLive(terminal,completedAt,now){if(!terminal)return!0;let finishedAt=Date.parse(completedAt);return Number.isNaN(finishedAt)?!1:now-finishedAt<6e5}function creatorStampOf(schema2,row){return auditOf(schema2,row)?.specAudit?.createdBy?.id??""}async function getRow(store,kind,id,schema2){try{return await store.getResource(kind,id,schema2)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}async function getExecutionContextRow(store,executionId){try{return await store.findByField(ApiResourceKind.execution_context,"spec.executionId",executionId,ExecutionContextSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}function ciphertextShapedMessage(key){return`value for '${key}' looks like stored ciphertext (enc:v<N>: prefix); supply the plaintext value`}var ENCRYPT_BATCH_FAILURE_MESSAGE="failed to encrypt secret values";function encryptionKeyMissingMessage(executionId,key){return`execution context for ${executionId} holds encrypted secret '${key}' but no encryption key is configured`}async function resolveValuesForCaller(deps,ctx,ec2){if(await runnerMayDecrypt(deps,ctx,ec2)){await decryptSecretValues(deps,ec2);return}redactExecutionContextSecrets(ec2)}async function runnerMayDecrypt(deps,ctx,ec2){let authorizeRead=deps.runnerAuthService.authorizeExecutionContextRead?.bind(deps.runnerAuthService);if(authorizeRead!==void 0){let token2=bearerToken(ctx);if(token2==="")return!1;try{return await authorizeRead(token2,ec2.spec?.executionId??"")}catch(error2){return deps.logger.warn("ExecutionContext read authorization failed \u2014 redacting secrets",{error:error2 instanceof Error?error2.message:String(error2)}),!1}}let token=bearerToken(ctx),executionId=verifyRunnerToken(deps,token,ec2);return executionId===void 0?!1:!isClockedToken(token)&&!await runIsLive(deps,executionId)?(deps.logger.debug("Run credential presented for a run that is over - redacting execution context secrets",{executionId}),!1):(deps.logger.debug("Scope-bound runner token presented - decrypting execution context secrets",{executionId}),!0)}function verifyRunnerToken(deps,token,ec2){if(token==="")return;let tokenExecutionId;try{tokenExecutionId=deps.runnerAuthService.verify(TOKEN_TYPE_EXECUTION_SCOPED,token)}catch{deps.logger.debug("Presented runner token failed verification - redacting execution context secrets");return}if(tokenExecutionId!==(ec2.spec?.executionId??"")){deps.logger.warn("Runner token is not scope-bound to this execution context - redacting secrets",{tokenExecutionId,executionId:ec2.spec?.executionId??""});return}return tokenExecutionId}async function runIsLive(deps,executionId){try{let execution=await loadBoundExecution(deps.store,executionId);return execution!==void 0&&bindsARun(execution.kind)&&execution.live}catch(error2){throw internalError(error2,"failed to load the run credential's execution")}}function bearerToken(ctx){return parseBearerToken(ctx.requestHeader.get("authorization")??"")}async function decryptSecretValues(deps,ec2){let executionId=ec2.spec?.executionId??"",data=ec2.spec?.data??{};for(let[key,value]of Object.entries(data))if(!(!value.isSecret||!deps.secretService.isEncrypted(value.value)))try{value.value=await deps.secretService.decrypt(value.value)}catch(error2){if(error2 instanceof EncryptionUnavailableError)throw internalError(error2,encryptionKeyMissingMessage(executionId,key));deps.logger.warn("Undecryptable ciphertext in execution context \u2014 dropping this value from the runner read",{key,executionId,error:error2 instanceof Error?error2.message:String(error2)}),delete data[key]}}var executionContextSearchExtractor={kind:ApiResourceKind.execution_context,schema:ExecutionContextSchema,getSearchSummary(){return""},toSearchResult(resource,score){let ec2=resource;return buildSearchResult({kind:ApiResourceKind.execution_context,metadata:ec2.metadata,summary:"",score,createdAt:ec2.status?.audit?.specAudit?.createdAt,updatedAt:ec2.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let ec2=resource,metadata=ec2.metadata;if(metadata!==void 0)return{name:metadata.name,description:"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(ec2.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};function newRejectCiphertextShapedStep(){return{name:"RejectCiphertextShapedValues",execute(ctx){let data=ctx.input.spec?.data??{};for(let[key,value]of Object.entries(data))if(isCiphertextShaped(value.value))throw invalidArgumentError(ciphertextShapedMessage(key))}}}function newEncryptSecretValuesStep2(secretService,logger2){return{name:"EncryptSecretValues",async execute(ctx){let ec2=ctx.newState,data=ec2.spec?.data;if(data===void 0||Object.keys(data).length===0)return;if(!secretService.isEnabled()){hasNonEmptySecret2(data)&&logger2.warn("Encryption disabled: execution context secret values will be stored in plaintext",{executionId:ec2.spec?.executionId??""});return}let toSeal=new Map;for(let[key,value]of Object.entries(data))!value.isSecret||value.value===""||toSeal.set(key,value.value);if(toSeal.size===0)return;let sealed;try{sealed=await secretService.encryptAllAtMostV2(toSeal,EncryptionScope.forOrganization(ec2.metadata?.org??""))}catch(error2){throw internalError(error2,ENCRYPT_BATCH_FAILURE_MESSAGE)}for(let[key,value]of Object.entries(data)){let sealedValue=sealed.get(key);sealedValue!==void 0&&(value.value=sealedValue)}}}}function hasNonEmptySecret2(data){return Object.values(data).some(v=>v.isSecret&&v.value!=="")}function newLoadByExecutionIdStep(store){return{name:"LoadByExecutionId",async execute(ctx){let input=ctx.input;if(input.executionId==="")throw invalidArgumentError("execution_id is required");let executionContext;try{executionContext=await store.findByField(ctx.apiResourceKind,"spec.executionId",input.executionId,ExecutionContextSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("execution_context",`execution_id=${input.executionId}`):internalError(error2,"failed to query execution context")}ctx.set(TARGET_RESOURCE_KEY,executionContext)}}}function newAuthorizeExecutionContextCreateStep(authorizer){return{name:"AuthorizeCreate",async execute(ctx){let caller=ctx.callerIdentity;if(isServerComposedRequest(caller))return;let decision;try{decision=await authorizer.authorize(caller,{permission:IamPermission.can_create_execution_in,resourceKind:ApiResourceKind.organization,resourceId:ctx.newState.metadata?.org??""})}catch(error2){throw internalError(error2 instanceof Error?error2:new Error(String(error2)),"execution-context create authorization could not be completed")}switch(decision.kind){case"allow":return;case"deny":case"not-found":throw new ConnectError("unauthorized to create execution context in this organization",Code.PermissionDenied);case"unavailable":throw internalError(decision.cause,"execution-context create authorization could not be completed");default:{let exhaustive=decision;throw internalError(new Error(`unknown decision ${JSON.stringify(exhaustive)}`),"execution-context create authorization could not be completed")}}}}}function registerExecutionContextServices(router,deps){router.service(ExecutionContextCommandController,{apply:(ec2,ctx)=>apply8(deps,ec2,ctx),create:(ec2,ctx)=>createExecutionContext(deps,ec2,ctx),delete:(input,ctx)=>deleteExecutionContext(deps,input,ctx)}),router.service(ExecutionContextQueryController,{get:(id,ctx)=>get14(deps,id,ctx),getByReference:(ref,ctx)=>getByReference8(deps,ref,ctx),getByExecutionId:(input,ctx)=>getByExecutionId(deps,input,ctx)})}function kindOf13(ctx){return ctx.values.get(apiResourceKindKey)}async function createExecutionContext(deps,ec2,ctx){let reqCtx=new RequestContext(ExecutionContextSchema,ec2,callerIdentityOf(ctx),kindOf13(ctx));return await newPipeline("execution-context-create",deps.logger).addStep(newAuthorizeStep(ExecutionContextCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeExecutionContextCreateStep(deps.authorizer)).addStep(newValidateVisibilityStep()).addStep(newRejectCiphertextShapedStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newEncryptSecretValuesStep2(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,executionContextSearchExtractor,deps.logger)).build().execute(reqCtx),redactExecutionContextSecrets(reqCtx.newState),reqCtx.newState}async function apply8(deps,ec2,ctx){let reqCtx=new RequestContext(ExecutionContextSchema,ec2,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-apply",deps.logger).addStep(newAuthorizeStep(ExecutionContextCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");if(shouldCreate)return createExecutionContext(deps,ec2,ctx);throw deps.logger.warn("ExecutionContext already exists - UPDATE not supported",{slug:ec2.metadata?.name??"",id:ec2.metadata?.id??""}),alreadyExistsError("ExecutionContext",ec2.metadata?.name??"")}async function deleteExecutionContext(deps,input,ctx){let reqCtx=new RequestContext(ExecutionContextCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf13(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("execution-context-delete",deps.logger).addStep(newAuthorizeStep(ExecutionContextCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,ExecutionContextSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted execution context not found in context"),"deleted execution context not found in context");let ec2=deleted;return redactExecutionContextSecrets(ec2),ec2}async function get14(deps,id,ctx){let reqCtx=new RequestContext(ExecutionContextQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-get",deps.logger).addStep(newAuthorizeStep(ExecutionContextQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,ExecutionContextSchema)).build().execute(reqCtx);let ec2=reqCtx.get(TARGET_RESOURCE_KEY);return redactExecutionContextSecrets(ec2),ec2}async function getByReference8(deps,ref,ctx){let reqCtx=new RequestContext(ExecutionContextQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-get-by-reference",deps.logger).addStep(newAuthorizeStep(ExecutionContextQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,ExecutionContextSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(ExecutionContextQueryController.method.get))).build().execute(reqCtx);let ec2=reqCtx.get(TARGET_RESOURCE_KEY);return redactExecutionContextSecrets(ec2),ec2}async function getByExecutionId(deps,input,ctx){let reqCtx=new RequestContext(ExecutionContextQueryController.method.getByExecutionId.input,input,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-get-by-execution-id",deps.logger).addStep(newAuthorizeStep(ExecutionContextQueryController.method.getByExecutionId,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByExecutionIdStep(deps.store)).build().execute(reqCtx);let ec2=reqCtx.get(TARGET_RESOURCE_KEY);return await resolveValuesForCaller(deps,ctx,ec2),ec2}var import_node_crypto19=require("node:crypto");var file_ai_stigmer_platform_github_v1_service=fileDesc("CithaS9zdGlnbWVyL3BsYXRmb3JtL2dpdGh1Yi92MS9zZXJ2aWNlLnByb3RvEh1haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MSI8ChtHZXRPQXV0aEF1dGhvcml6ZVVybFJlcXVlc3QSHQoMcmVkaXJlY3RfdXJpGAEgASgJQge6SARyAhABIkQKHEdldE9BdXRoQXV0aG9yaXplVXJsUmVzcG9uc2USFQoNYXV0aG9yaXplX3VybBgBIAEoCRINCgVzdGF0ZRgCIAEoCSJoChhFeGNoYW5nZU9BdXRoQ29kZVJlcXVlc3QSFQoEY29kZRgBIAEoCUIHukgEcgIQARIWCgVzdGF0ZRgCIAEoCUIHukgEcgIQARIdCgxyZWRpcmVjdF91cmkYAyABKAlCB7pIBHICEAEiVAoZRXhjaGFuZ2VPQXV0aENvZGVSZXNwb25zZRIUCgxhY2Nlc3NfdG9rZW4YASABKAkSEgoKdG9rZW5fdHlwZRgCIAEoCRINCgVzY29wZRgDIAEoCTK2AgoNR2l0SHViU2VydmljZRKVAQoUZ2V0T0F1dGhBdXRob3JpemVVcmwSOi5haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MS5HZXRPQXV0aEF1dGhvcml6ZVVybFJlcXVlc3QaOy5haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MS5HZXRPQXV0aEF1dGhvcml6ZVVybFJlc3BvbnNlIgTQuBgBEowBChFleGNoYW5nZU9BdXRoQ29kZRI3LmFpLnN0aWdtZXIucGxhdGZvcm0uZ2l0aHViLnYxLkV4Y2hhbmdlT0F1dGhDb2RlUmVxdWVzdBo4LmFpLnN0aWdtZXIucGxhdGZvcm0uZ2l0aHViLnYxLkV4Y2hhbmdlT0F1dGhDb2RlUmVzcG9uc2UiBNC4GAFiBnByb3RvMw",[file_ai_stigmer_commons_rpc_method_options,file_buf_validate_validate]);var GetOAuthAuthorizeUrlResponseSchema=messageDesc2(file_ai_stigmer_platform_github_v1_service,1);var ExchangeOAuthCodeResponseSchema=messageDesc2(file_ai_stigmer_platform_github_v1_service,3),GitHubService=serviceDesc(file_ai_stigmer_platform_github_v1_service,0);var GITHUB_AUTHORIZE_URL="https://github.com/login/oauth/authorize",GITHUB_TOKEN_URL="https://github.com/login/oauth/access_token",OAUTH_SCOPES="repo,read:user",HTTP_TIMEOUT_MS=1e4;function registerGitHubServices(router,deps){router.service(GitHubService,{getOAuthAuthorizeUrl:req=>getOAuthAuthorizeUrl(deps,req),exchangeOAuthCode:req=>exchangeOAuthCode(deps,req)})}function getOAuthAuthorizeUrl(deps,req){if(deps.clientId==="")throw failedPreconditionError("GitHub OAuth is not configured (STIGMER_GITHUB_CLIENT_ID not set)");let state2;try{state2=(0,import_node_crypto19.randomBytes)(16).toString("hex")}catch(error2){throw deps.logger.error("failed to generate OAuth state",{error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to generate OAuth state")}let authorizeUrl=GITHUB_AUTHORIZE_URL+"?"+goUrlValuesEncode({client_id:deps.clientId,redirect_uri:req.redirectUri,scope:OAUTH_SCOPES,state:state2});return create2(GetOAuthAuthorizeUrlResponseSchema,{authorizeUrl,state:state2})}async function exchangeOAuthCode(deps,req){if(deps.clientId===""||deps.clientSecret==="")throw failedPreconditionError("GitHub OAuth is not configured");let body=goUrlValuesEncode({client_id:deps.clientId,client_secret:deps.clientSecret,code:req.code,redirect_uri:req.redirectUri}),fetchImpl=deps.fetchImpl??fetch,response;try{response=await fetchImpl(GITHUB_TOKEN_URL,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body,signal:AbortSignal.timeout(HTTP_TIMEOUT_MS)})}catch(error2){throw deps.logger.error("GitHub token exchange failed",{error:error2 instanceof Error?error2.message:String(error2)}),unavailableError("failed to reach GitHub for token exchange")}let raw;try{raw=await response.text()}catch(error2){throw deps.logger.error("failed to read GitHub token response",{error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to read GitHub response")}let tokenResponse;try{tokenResponse=JSON.parse(raw)}catch(error2){throw deps.logger.error("failed to parse GitHub token response",{error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to parse GitHub response")}if(tokenResponse.error!==void 0&&tokenResponse.error!=="")throw deps.logger.warn("GitHub OAuth error",{error:tokenResponse.error,description:tokenResponse.error_description??""}),invalidArgumentError(`GitHub OAuth error: ${tokenResponse.error_description??""}`);return create2(ExchangeOAuthCodeResponseSchema,{accessToken:tokenResponse.access_token??"",tokenType:tokenResponse.token_type??"",scope:tokenResponse.scope??""})}var file_ai_stigmer_agentic_memory_v1_io=fileDesc("CiVhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2lvLnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxIiEKCE1lbW9yeUlkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiYAoTTGlzdE1lbW9yaWVzUmVxdWVzdBIUCgNvcmcYASABKAlCB7pIBHICEAESMwoJcGFnZV9pbmZvGAIgASgLMiAuYWkuc3RpZ21lci5jb21tb25zLnJwYy5QYWdlSW5mbyJWCgpNZW1vcnlMaXN0EhMKC3RvdGFsX2NvdW50GAEgASgFEjMKBWl0ZW1zGAIgAygLMiQuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnliBnByb3RvMw",[file_ai_stigmer_agentic_memory_v1_api,file_ai_stigmer_commons_rpc_pagination,file_buf_validate_validate]),MemoryIdSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_io,0);var MemoryListSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_io,2);var file_ai_stigmer_agentic_memory_v1_command=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2NvbW1hbmQucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEypQUKF01lbW9yeUNvbW1hbmRDb250cm9sbGVyEloKBmNyZWF0ZRIkLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5GiQuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnkiBNC4GAESigEKBnVwZGF0ZRIkLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5GiQuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnkiNMK4GDAIAhA5IgttZXRhZGF0YS5pZCoddW5hdXRob3JpemVkIHRvIHVwZGF0ZSBtZW1vcnkShgEKBmRlbGV0ZRImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIuwrgYKggDEDkiBXZhbHVlKh11bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG1lbW9yeRKIAQoHY29uZmlybRImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIvwrgYKwgCEDkiBXZhbHVlKh51bmF1dGhvcml6ZWQgdG8gY29uZmlybSBtZW1vcnkShgEKBnJlamVjdBImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIuwrgYKggCEDkiBXZhbHVlKh11bmF1dGhvcml6ZWQgdG8gcmVqZWN0IG1lbW9yeRoEoP8rOWIGcHJvdG8z",[file_ai_stigmer_agentic_memory_v1_api,file_ai_stigmer_agentic_memory_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),MemoryCommandController=serviceDesc(file_ai_stigmer_agentic_memory_v1_command,0);var file_ai_stigmer_agentic_memory_v1_query=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL3F1ZXJ5LnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxMosCChVNZW1vcnlRdWVyeUNvbnRyb2xsZXISgAEKA2dldBImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIrwrgYJwgBEDkiBXZhbHVlKhp1bmF1dGhvcml6ZWQgdG8gZ2V0IG1lbW9yeRJpCgRsaXN0EjEuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5MaXN0TWVtb3JpZXNSZXF1ZXN0GiguYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnlMaXN0IgTQuBgBGgSg/ys5YgZwcm90bzM",[file_ai_stigmer_agentic_memory_v1_api,file_ai_stigmer_agentic_memory_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),MemoryQueryController=serviceDesc(file_ai_stigmer_agentic_memory_v1_query,0);var PLATFORM_CLIENT_KIND_NAME="PlatformClient",SYSTEM_SHARE_CLIENT_SLUG="system-share-client",RESERVED_PLATFORM_CLIENT_SLUGS=new Set([SYSTEM_SHARE_CLIENT_SLUG]),USER_TOKEN_CLAIMS={subject:"sub",externalUserId:"ext_user_id",email:"email",name:"name",org:"org",platformClientId:"platform_client_id"},BEARER_TOKEN_TYPE="Bearer";function reservedSlugMessage(slug){return`The slug '${slug}' is reserved for the platform's system-managed resources and cannot be used. If you did not provide a slug explicitly, it was derived from the resource name \u2014 choose a different name or provide an explicit slug.`}function systemManagedMessage(verb){return`This platform client is system-managed and cannot be ${verb}`}function referenceNotFoundMessage(org,slug){return`PlatformClient '${org}/${slug}' not found`}var INVALID_CLIENT_CREDENTIALS_MESSAGE="Invalid client_id or client_secret",EXPIRED_CLIENT_SECRET_MESSAGE="PlatformClient secret has expired. Rotating the secret does not extend it; the client's owner must set a later expires_at or set never_expires.";function organizationMismatchMessage(owningOrg){return`org_id must be empty or the PlatformClient's owning organization ('${owningOrg}'); cross-organization minting is not supported`}function noAccountMessage(externalUserId,org){return`User '${externalUserId}' has no Stigmer account in organization '${org}'. Enable auto_provision_accounts on the PlatformClient or create the account first.`}var OWNER_AUTO_GRANT_MESSAGE="auto_grant_role cannot be 'owner'; organization ownership must be assigned explicitly.",PROVISIONING_FAILED_MESSAGE="Account provisioning failed. No partial account was left behind; the request is safe to retry.";function blankSubjectPartMessage(part){return`${part} must not be null or blank`}function subjectSeparatorMessage(part,value){return`${part} must not contain the separator character '|': ${value}`}function foreignAccountMessage(externalUserId,org){return`User '${externalUserId}' in organization '${org}' resolves to an account no platform client provisioned \u2014 refusing to mint a token for it`}var MINTING_REQUIRES_AUTHENTICATION_MESSAGE="mintUserToken requires a server that authenticates its callers: this server trusts every request, so nothing would verify the token \u2014 configure an identity provider (STIGMER_OIDC_ISSUER) to enable PlatformClient token minting",MINTING_DISABLED_MESSAGE="mintUserToken is disabled: this server's platform-token key ring holds no signing key",GUEST_MINT_UNIMPLEMENTED_MESSAGE="PlatformClientTokenController.mintGuestToken is not implemented: guest tokens for shared agents are served by the Cloud edition",TOKEN_NAMES_NO_CLIENT_MESSAGE="platform token names no platform client",DELETED_CLIENT_MESSAGE="The platform client that minted this token has been deleted, so the token is no longer accepted. Mint a new user token from an active platform client.";function originRefusalMessage(origin){return`Request origin '${origin}' is not in this platform client's allowed_origins. Add it to the PlatformClient's allowed_origins to permit browser requests from this origin.`}var import_node_crypto20=require("node:crypto"),PLATFORM_TOKEN_ISSUER="stigmer",TOKEN_TYPE_CLAIM="token_type",ENVELOPE_CLAIMS=new Set(["iss","iat","exp","jti","aud"]),PLATFORM_TOKEN_REFUSAL_MESSAGES={signature:"platform token signature verification failed",expired:"platform token is expired",audience:"platform token was minted for another environment",subject:"platform token carries no subject"};function signPlatformToken(ring,claims,options={}){for(let name of Object.keys(claims))if(ENVELOPE_CLAIMS.has(name))throw new Error(`platform-token claim '${name}' belongs to the envelope and cannot be set by a lane`);let ttlSeconds=options.ttlSeconds??ring.ttlSeconds;if(!Number.isInteger(ttlSeconds)||ttlSeconds<=0)throw new Error(`platform-token lifetime must be a positive integer number of seconds, got ${ttlSeconds}`);let issuedAt=Math.floor((options.now??new Date).getTime()/1e3),expiresAtSeconds=issuedAt+ttlSeconds,header={alg:"RS256",typ:"JWT",kid:ring.signer.kid},payload={iss:PLATFORM_TOKEN_ISSUER,iat:issuedAt,exp:expiresAtSeconds,jti:(0,import_node_crypto20.randomUUID)(),...ring.audience!==""?{aud:ring.audience}:{},...claims},signingInput=`${base64UrlJson(header)}.${base64UrlJson(payload)}`,signature=(0,import_node_crypto20.sign)("sha256",Buffer.from(signingInput),ring.signer.key);return{token:`${signingInput}.${signature.toString("base64url")}`,expiresAt:new Date(expiresAtSeconds*1e3)}}function verifyPlatformToken(ring,token,now=new Date){let decoded=decode2(token);if(decoded===void 0||decoded.payload.iss!==PLATFORM_TOKEN_ISSUER)return{outcome:"foreign"};let signingInput=Buffer.from(`${decoded.encodedHeader}.${decoded.encodedPayload}`);if(!ring.verificationKeys.some(key=>(0,import_node_crypto20.verify)("sha256",signingInput,key,decoded.signature)))return{outcome:"refused",refusal:"signature"};let exp=decoded.payload.exp;if(typeof exp!="number"||exp*1e3<=now.getTime())return{outcome:"refused",refusal:"expired"};let aud=decoded.payload.aud;if(ring.audience!==""&&aud!==void 0&&!audienceMatches(aud,ring.audience))return{outcome:"refused",refusal:"audience"};let sub=decoded.payload.sub;return typeof sub!="string"||sub===""?{outcome:"refused",refusal:"subject"}:{outcome:"verified",token:{subject:sub,tokenType:stringClaim(decoded.payload,TOKEN_TYPE_CLAIM),payload:decoded.payload}}}function platformTokenRefusalError(refusal2){return new ConnectError(PLATFORM_TOKEN_REFUSAL_MESSAGES[refusal2],Code.Unauthenticated)}function decodeVerifiedPlatformTokenPayload(token){let decoded=decode2(token);return decoded!==void 0&&decoded.payload.iss===PLATFORM_TOKEN_ISSUER?decoded.payload:void 0}function stringClaim(payload,name){let value=payload[name];return typeof value=="string"&&value!==""?value:void 0}function decode2(token){let parts=token.split(".");if(parts.length!==3)return;let[encodedHeader="",encodedPayload="",encodedSignature=""]=parts,header=parseJsonObject(encodedHeader),payload=parseJsonObject(encodedPayload);if(!(header===void 0||payload===void 0))return{encodedHeader,encodedPayload,payload,signature:Buffer.from(encodedSignature,"base64url")}}function parseJsonObject(segment){try{let value=JSON.parse(Buffer.from(segment,"base64url").toString("utf8"));return typeof value=="object"&&value!==null&&!Array.isArray(value)?value:void 0}catch{return}}function audienceMatches(aud,expected){return typeof aud=="string"?aud===expected:Array.isArray(aud)&&aud.includes(expected)}function base64UrlJson(value){return Buffer.from(JSON.stringify(value)).toString("base64url")}var MEMORY_CAPTURE_CALLER_MESSAGE="memory can only be captured for a first-party human operator",MEMORY_CAPTURE_CREDENTIAL_KEY="memoryCaptureCredential";function newGuardMemoryCaptureStep(provider){return{name:"GuardMemoryCapture",async execute(ctx){let caller=ctx.callerIdentity;if(isServerComposedRequest(caller))return;let decide=provider?.authorizeMemoryCapture;if(decide!==void 0){let org=metadataOf(ctx.newState)?.org??"",decision=await decide.call(provider,caller,org);switch(decision.verdict){case"admit":ctx.set(MEMORY_CAPTURE_CREDENTIAL_KEY,{subjectIdentityAccountId:decision.subjectIdentityAccountId,provedSessionId:decision.provedSessionId});return;case"refuse":throw new ConnectError(MEMORY_CAPTURE_CALLER_MESSAGE,Code.PermissionDenied);case"no-opinion":break;default:{let exhaustive=decision;throw new Error(`unknown memory capture decision ${JSON.stringify(exhaustive)}`)}}}if(caller.callerClass==="machine"||carriesPlatformClientClaim(caller.rawToken))throw new ConnectError(MEMORY_CAPTURE_CALLER_MESSAGE,Code.PermissionDenied)}}}function memoryCaptureCredentialOf(ctx){let payload=ctx.get(MEMORY_CAPTURE_CREDENTIAL_KEY);if(typeof payload=="object"&&payload!==null&&"subjectIdentityAccountId"in payload&&"provedSessionId"in payload)return payload}function carriesPlatformClientClaim(rawToken){let payload=decodeVerifiedPlatformTokenPayload(rawToken);return payload!==void 0&&stringClaim(payload,USER_TOKEN_CLAIMS.platformClientId)!==void 0}var MEMORY_FULL_MESSAGE="memory is full \u2014 review and delete existing memories";function memoryDisabledMessage(org){return`memory is not enabled for organization ${org} \u2014 an organization admin can enable it in organization preferences`}var MEMORY_CONFIRM_REJECTED_MESSAGE="memory was rejected \u2014 delete it and let the agent propose it again",MEMORY_REJECT_CONFIRMED_MESSAGE="memory was confirmed \u2014 delete it to stop it from being recalled",MEMORY_SUBJECT_IMMUTABLE_MESSAGE="spec.subject_identity_account_id is immutable \u2014 it is derived from the capturing credential at create",MEMORY_PROVENANCE_IMMUTABLE_MESSAGE="spec.provenance is immutable \u2014 it records where the fact came from";var LIST_RESULT_KEY6="listResult";function newResolveMemoryDefaultsStep(){return{name:"ResolveMemoryDefaults",execute(ctx){let memory=ctx.newState,metadata=memory.metadata;if((metadata?.org??"")==="")throw invalidArgumentError("metadata.org is required for a memory");if(metadata===void 0)throw internalError(new Error("metadata is nil"),"metadata is nil");metadata.id===""&&(metadata.id=generateId("mem")),metadata.name===""&&metadata.slug===""&&(metadata.name=metadata.id);let spec=memory.spec;if(spec===void 0)throw internalError(new Error("memory spec is nil"),"memory spec is nil");let captureCredential=memoryCaptureCredentialOf(ctx);spec.subjectIdentityAccountId=captureCredential?.subjectIdentityAccountId??"",spec.provenance!==void 0&&(spec.provenance.toolCallId=""),captureCredential!==void 0&&(spec.provenance===void 0&&(spec.provenance=create2(MemoryProvenanceSchema,{})),spec.provenance.sessionId=captureCredential.provedSessionId)}}}var MEMORY_CREATE_DENIED_MESSAGE="unauthorized to capture memory in this organization";function resolveMemoryCreateTargets(ctx){return isServerComposedRequest(ctx.callerIdentity)?[]:[{permission:IamPermission.can_create_session,resourceKind:ApiResourceKind.organization,resourceId:ctx.newState.metadata?.org??"",deniedMessage:MEMORY_CREATE_DENIED_MESSAGE}]}function newCheckMemoryEnablementStep(store){return{name:"CheckMemoryEnablement",async execute(ctx){let orgID=ctx.newState.metadata?.org??"",org;try{org=await store.getResource(ApiResourceKind.organization,orgID,OrganizationSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("Organization",orgID):internalError(error2,"failed to load organization for memory enablement check")}if(org.spec?.preferences?.memoryEnabled!==!0)throw failedPreconditionError(memoryDisabledMessage(orgID))}}}function newCheckMemoryCapStep(store){return{name:"CheckMemoryCap",async execute(ctx){let newState=ctx.newState,org=newState.metadata?.org??"",subject=newState.spec?.subjectIdentityAccountId??"",rows;try{rows=await store.listResources(ApiResourceKind.memory)}catch(error2){throw internalError(error2,"failed to count memories for cap check")}let count=0;for(let bytes of rows){let existing=unmarshalMemory(bytes);existing!==void 0&&(existing.metadata?.org??"")===org&&(existing.spec?.subjectIdentityAccountId??"")===subject&&count++}if(count>=100)throw failedPreconditionError(MEMORY_FULL_MESSAGE)}}}function newInitializeMemoryLifecycleStep(){return{name:"InitializeMemoryLifecycle",execute(ctx){let memory=ctx.newState;memory.status===void 0&&(memory.status=create2(MemoryStatusSchema,{})),memory.status.lifecycleState=MemoryLifecycleState.lifecycle_state_proposed,memory.status.stateChangedAt=timestampNow()}}}function newValidateMemoryUpdateStep(){return{name:"ValidateMemoryUpdate",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing memory not found in context"),"existing memory not found in context");let newState=ctx.newState;if((newState.spec?.subjectIdentityAccountId??"")!==(existing.spec?.subjectIdentityAccountId??""))throw failedPreconditionError(MEMORY_SUBJECT_IMMUTABLE_MESSAGE);let newProvenance=newState.spec?.provenance,existingProvenance=existing.spec?.provenance;if(!(newProvenance===void 0||existingProvenance===void 0?newProvenance===existingProvenance:equals(MemoryProvenanceSchema,newProvenance,existingProvenance)))throw failedPreconditionError(MEMORY_PROVENANCE_IMMUTABLE_MESSAGE)}}}function newPersistMemoryUpdateStep(store){return{name:"PersistMemoryUpdate",async execute(ctx){let newState=ctx.newState,memoryId=newState.metadata?.id??"",live;try{live=await store.updateResource(ApiResourceKind.memory,memoryId,MemorySchema,row=>{row.apiVersion=newState.apiVersion,row.kind=newState.kind,row.metadata=newState.metadata,row.spec=newState.spec,newState.status?.audit!==void 0&&(row.status===void 0&&(row.status=create2(MemoryStatusSchema,{})),row.status.audit=newState.status.audit)})}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("Memory",memoryId):internalError(error2,"failed to persist memory update")}ctx.setNewState(live)}}}function newTransitionMemoryLifecycleStep(store,target,blockedMessage){return{name:"TransitionMemoryLifecycle",async execute(ctx){let memoryId=ctx.get(EXISTING_RESOURCE_KEY).metadata?.id??"",transitionNoOp=new Error("memory already in target state"),blocked,live;try{live=await store.updateResource(ApiResourceKind.memory,memoryId,MemorySchema,row=>{live=row;let current=row.status?.lifecycleState??MemoryLifecycleState.lifecycle_state_unspecified;if(current===target)throw transitionNoOp;if(current!==MemoryLifecycleState.lifecycle_state_proposed&&current!==MemoryLifecycleState.lifecycle_state_unspecified)throw blocked=failedPreconditionError(blockedMessage),blocked;row.status===void 0&&(row.status=create2(MemoryStatusSchema,{})),row.status.lifecycleState=target,row.status.stateChangedAt=timestampNow(),setAuditFieldsForUpdate(MemorySchema,row,"status_audit",ctx.callerIdentity)})}catch(error2){if(error2!==transitionNoOp)throw blocked!==void 0&&error2===blocked?blocked:error2 instanceof ResourceNotFoundError?notFoundError("Memory",memoryId):internalError(error2,"failed to transition memory lifecycle")}if(live===void 0)throw internalError(new Error("transition closure did not observe the row"),"failed to transition memory lifecycle");ctx.set(EXISTING_RESOURCE_KEY,live)}}}function newListMemoriesByOrgStep(store,listReadScope){return{name:"ListMemoriesByOrg",async execute(ctx){let org=ctx.input.org,rows;try{rows=await store.listResources(ApiResourceKind.memory)}catch(error2){throw internalError(error2,"failed to list memories")}let decoded=[];for(let bytes of rows){let memory=unmarshalMemory(bytes);memory!==void 0&&decoded.push(memory)}let memories=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.memory,decoded.filter(memory=>(memory.metadata?.org??"")===org),"");memories.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(LIST_RESULT_KEY6,create2(MemoryListSchema,{totalCount:memories.length,items:memories}))}}}function unmarshalMemory(data){try{return fromBinary2(MemorySchema,data)}catch{return}}function registerMemoryServices(router,deps){router.service(MemoryCommandController,{create:(memory,ctx)=>createMemory(deps,memory,ctx),update:(memory,ctx)=>update11(deps,memory,ctx),delete:(id,ctx)=>deleteMemory(deps,id,ctx),confirm:(id,ctx)=>confirm(deps,id,ctx),reject:(id,ctx)=>reject(deps,id,ctx)}),router.service(MemoryQueryController,{get:(id,ctx)=>get15(deps,id,ctx),list:(req,ctx)=>list9(deps,req,ctx)})}function kindOf14(ctx){return ctx.values.get(apiResourceKindKey)}async function createMemory(deps,memory,ctx){let reqCtx=new RequestContext(MemorySchema,memory,callerIdentityOf(ctx),kindOf14(ctx));return await newPipeline("memory-create",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newGuardMemoryCaptureStep(deps.runnerCredentialProvider)).addStep(newValidateVisibilityStep()).addStep(newResolveMemoryDefaultsStep()).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveMemoryCreateTargets)).addStep(newCheckMemoryEnablementStep(deps.store)).addStep(newCheckMemoryCapStep(deps.store)).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newInitializeMemoryLifecycleStep()).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update11(deps,memory,ctx){let reqCtx=new RequestContext(MemorySchema,memory,callerIdentityOf(ctx),kindOf14(ctx));return await newPipeline("memory-update",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateMemoryUpdateStep()).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistMemoryUpdateStep(deps.store)).build().execute(reqCtx),reqCtx.newState}async function confirm(deps,memoryId,ctx){return runTransition(deps,memoryId,ctx,"memory-confirm",MemoryCommandController.method.confirm,MemoryLifecycleState.lifecycle_state_confirmed,MEMORY_CONFIRM_REJECTED_MESSAGE)}async function reject(deps,memoryId,ctx){return runTransition(deps,memoryId,ctx,"memory-reject",MemoryCommandController.method.reject,MemoryLifecycleState.lifecycle_state_rejected,MEMORY_REJECT_CONFIRMED_MESSAGE)}async function runTransition(deps,memoryId,ctx,name,method,target,blockedMessage){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline(name,deps.logger).addStep(newAuthorizeStep(method,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,MemorySchema)).addStep(newTransitionMemoryLifecycleStep(deps.store,target,blockedMessage)).build().execute(reqCtx);let transitioned=reqCtx.get(EXISTING_RESOURCE_KEY);if(transitioned===void 0)throw internalError(new Error("transitioned memory not found in context"),"transitioned memory not found in context");return transitioned}async function deleteMemory(deps,memoryId,ctx){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline("memory-delete",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,MemorySchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted memory not found in context"),"deleted memory not found in context");return deleted}async function get15(deps,memoryId,ctx){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline("memory-get",deps.logger).addStep(newAuthorizeStep(MemoryQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadTargetStep(deps.store,MemorySchema)).build().execute(reqCtx);let target=reqCtx.get(TARGET_RESOURCE_KEY);if(target===void 0)throw internalError(new Error("target memory not found in context"),"target memory not found in context");return target}async function list9(deps,req,ctx){let reqCtx=new RequestContext(MemoryQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline("memory-list",deps.logger).addStep(newAuthorizeStep(MemoryQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListMemoriesByOrgStep(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY6);if(result===void 0)throw internalError(new Error("memory list not found in context"),"memory list not found in context");return result}var file_ai_stigmer_iam_oauthapp_v1_command=fileDesc("CihhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9jb21tYW5kLnByb3RvEhphaS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MTLOBAoZT0F1dGhBcHBDb21tYW5kQ29udHJvbGxlchJTCgVhcHBseRIkLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwGiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHASowEKBmNyZWF0ZRIkLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwGiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHAiTcK4GEkIFxAeIgxtZXRhZGF0YS5vcmcqNXVuYXV0aG9yaXplZCB0byBjcmVhdGUgb2F1dGggYXBwIGluIHRoaXMgb3JnYW5pemF0aW9uEo0BCgZ1cGRhdGUSJC5haS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MS5PQXV0aEFwcBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIjfCuBgzCAIQFiILbWV0YWRhdGEuaWQqIHVuYXV0aG9yaXplZCB0byB1cGRhdGUgb2F1dGggYXBwEp8BCgZkZWxldGUSNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VEZWxldGVJbnB1dBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIjfCuBgzCAMQFiILcmVzb3VyY2VfaWQqIHVuYXV0aG9yaXplZCB0byBkZWxldGUgb2F1dGggYXBwGgSg/ysWYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_oauthapp_v1_api]),OAuthAppCommandController=serviceDesc(file_ai_stigmer_iam_oauthapp_v1_command,0);var file_ai_stigmer_iam_oauthapp_v1_io=fileDesc("CiNhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9pby5wcm90bxIaYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEiJgoKT0F1dGhBcHBJZBIYCgV2YWx1ZRgBIAEoCUIJukgGcgQQARhAIkIKCU9BdXRoQXBwcxI1CgdlbnRyaWVzGAEgAygLMiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHAiLwoXTGlzdE9BdXRoQXBwc0J5T3JnSW5wdXQSFAoDb3JnGAEgASgJQge6SARyAhABYgZwcm90bzM",[file_ai_stigmer_iam_oauthapp_v1_api,file_buf_validate_validate]);var OAuthAppsSchema=messageDesc2(file_ai_stigmer_iam_oauthapp_v1_io,1);var file_ai_stigmer_iam_oauthapp_v1_query=fileDesc("CiZhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9xdWVyeS5wcm90bxIaYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEy0AMKF09BdXRoQXBwUXVlcnlDb250cm9sbGVyEosBCgNnZXQSLS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VJZBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIi/CuBgrCAEQFiIFdmFsdWUqHnVuYXV0aG9yaXplZCB0byB2aWV3IG9hdXRoIGFwcBJyCg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIgTQuBgBEqwBCglsaXN0QnlPcmcSMy5haS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MS5MaXN0T0F1dGhBcHBzQnlPcmdJbnB1dBolLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwcyJDwrgYPwgBEB4iA29yZyo0dW5hdXRob3JpemVkIHRvIGxpc3Qgb2F1dGggYXBwcyBpbiB0aGlzIG9yZ2FuaXphdGlvbhoEoP8rFmIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_oauthapp_v1_api,file_ai_stigmer_iam_oauthapp_v1_io]),OAuthAppQueryController=serviceDesc(file_ai_stigmer_iam_oauthapp_v1_query,0);var REDACTED_MARKER3="***REDACTED***",MARKER_ON_CREATE_MESSAGE="cannot use the redaction marker as client_secret on create",PRESERVE_NO_EXISTING_SECRET_MESSAGE="cannot preserve client_secret: no existing secret value found",CIPHERTEXT_SHAPED_SECRET_MESSAGE="client_secret must be plaintext \u2014 values carrying the 'enc:' encryption prefix are not accepted from clients";function deleteBlockedByMcpServerMessage(org,slug,mcpServerName){return`cannot delete OAuthApp '${org}/${slug}': referenced by MCP server '${mcpServerName}'`}async function resolveOAuthAppRef(store,ref,logger2){let slug=ref?.slug??"";if(slug==="")return;let rows=await store.listResources(ApiResourceKind.oauth_app),slugMatches=[];for(let data of rows){let app;try{app=fromBinary2(OAuthAppSchema,data)}catch{continue}if((app.metadata?.slug??"")!==slug)continue;let refOrg=ref?.org??"";if(refOrg!==""&&app.metadata?.org===refOrg)return app;slugMatches.push(app)}if(slugMatches.length!==0){if(slugMatches.length===1)return slugMatches[0];logger2.warn("oauth_app_ref is ambiguous (slug exists in several orgs, none matching the ref); refusing to pick \u2014 pin the ref's org to resolve",{oauthAppSlug:slug,refOrg:ref?.org??"",candidateOrgs:slugMatches.map(app=>app.metadata?.org??"")})}}function redactOAuthApp(app){app.spec!==void 0&&app.spec.clientSecret!==""&&(app.spec.clientSecret=REDACTED_MARKER3)}function newEncryptClientSecretForCreateStep(secretService,logger2){return newEncryptClientSecretStep(secretService,logger2,!0)}function newEncryptClientSecretForUpdateStep(secretService,logger2){return newEncryptClientSecretStep(secretService,logger2,!1)}function newEncryptClientSecretStep(secretService,logger2,isCreate){return{name:"EncryptClientSecret",async execute(ctx){let app=ctx.newState;if(app.spec===void 0)return;let clientSecret=app.spec.clientSecret;if(clientSecret!==""){if(clientSecret===REDACTED_MARKER3){preserveExistingSecret(ctx,app,isCreate,logger2);return}if(isCiphertextShaped(clientSecret))throw invalidArgumentError(CIPHERTEXT_SHAPED_SECRET_MESSAGE);if(!secretService.isEnabled()){logger2.warn("encryption disabled: client_secret will be stored in plaintext");return}try{app.spec.clientSecret=await secretService.encrypt(clientSecret,EncryptionScope.forOrganization(app.metadata?.org??""))}catch(error2){throw internalError(error2,"failed to encrypt client_secret")}}}}}function preserveExistingSecret(ctx,app,isCreate,logger2){if(isCreate)throw invalidArgumentError(MARKER_ON_CREATE_MESSAGE);let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing resource not loaded"),"cannot preserve client_secret: existing resource not loaded");let existingSecret=existing.spec?.clientSecret??"";if(existingSecret==="")throw invalidArgumentError(PRESERVE_NO_EXISTING_SECRET_MESSAGE);app.spec!==void 0&&(app.spec.clientSecret=existingSecret),logger2.debug("preserved existing encrypted client_secret",{oauthAppId:app.metadata?.id??""})}function newCheckNoReferencingMcpServersStep(store,logger2){return{name:"CheckNoReferencingMcpServers",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing OAuthApp missing from pipeline context"),"existing OAuthApp not loaded in delete pipeline");let resources;try{resources=await store.listResources(ApiResourceKind.mcp_server)}catch(error2){throw internalError(error2,"failed to list MCP servers for referential integrity check")}for(let data of resources){let mcp;try{mcp=fromBinary2(McpServerSchema,data)}catch(error2){logger2.warn("failed to unmarshal MCP server during referential integrity check, skipping",{error:error2 instanceof Error?error2.message:String(error2)});continue}let ref=mcp.spec?.auth?.oauthAppRef;if(ref===void 0)continue;let resolved;try{resolved=await resolveOAuthAppRef(store,ref,logger2)}catch(error2){throw internalError(error2,"failed to resolve oauth_app_ref during referential integrity check")}if(resolved!==void 0&&(resolved.metadata?.id??"")===(existing.metadata?.id??""))throw failedPreconditionError(deleteBlockedByMcpServerMessage(existing.metadata?.org??"",existing.metadata?.slug??"",mcp.metadata?.name??""))}}}}function registerOAuthAppServices(router,deps){router.service(OAuthAppCommandController,{apply:(app,ctx)=>apply9(deps,app,ctx),create:(app,ctx)=>createOAuthApp(deps,app,ctx),update:(app,ctx)=>update12(deps,app,ctx),delete:(input,ctx)=>deleteOAuthApp(deps,input,ctx)}),router.service(OAuthAppQueryController,{get:(id,ctx)=>get16(deps,id,ctx),getByReference:(ref,ctx)=>getByReference9(deps,ref,ctx),listByOrg:(req,ctx)=>listByOrg2(deps,req,ctx)})}function kindOf15(ctx){return ctx.values.get(apiResourceKindKey)}async function createOAuthApp(deps,app,ctx){let reqCtx=new RequestContext(OAuthAppSchema,app,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-create",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newEncryptClientSecretForCreateStep(deps.secretService,deps.logger)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx);let result=reqCtx.newState;return redactOAuthApp(result),result}async function update12(deps,app,ctx){let reqCtx=new RequestContext(OAuthAppSchema,app,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-update",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newEncryptClientSecretForUpdateStep(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).build().execute(reqCtx);let result=reqCtx.newState;return redactOAuthApp(result),result}async function apply9(deps,app,ctx){let reqCtx=new RequestContext(OAuthAppSchema,app,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-apply",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createOAuthApp(deps,app,ctx):update12(deps,withResolvedApplyId(OAuthAppSchema,app,reqCtx),ctx)}async function deleteOAuthApp(deps,input,ctx){let reqCtx=new RequestContext(OAuthAppCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf15(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("oauthapp-delete",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,OAuthAppSchema)).addStep(newCheckNoReferencingMcpServersStep(deps.store,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDestroySecretBackingStateStep(deps.secretService,deps.logger,app2=>app2.spec===void 0?[]:[app2.spec.clientSecret])).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted OAuthApp not found in context"),"deleted OAuthApp not found in context");let app=deleted;return redactOAuthApp(app),app}async function get16(deps,id,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-get",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,OAuthAppSchema)).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactOAuthApp(app),app}async function getByReference9(deps,ref,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-get-by-reference",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,OAuthAppSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(OAuthAppQueryController.method.get))).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactOAuthApp(app),app}var LIST_RESULT_KEY7="listResult";async function listByOrg2(deps,req,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.listByOrg.input,req,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-list-by-org",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.listByOrg,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgStep2(deps.store,deps.listReadScope,deps.logger)).build().execute(reqCtx);let list12=reqCtx.get(LIST_RESULT_KEY7);if(list12===void 0)throw internalError(new Error("list result missing from pipeline context"),"OAuthApp list not found in context");return list12}function newListByOrgStep2(store,listReadScope,logger2){return{name:"ListByOrg",async execute(ctx){let org=ctx.input.org,resources;try{resources=await store.listResources(ApiResourceKind.oauth_app)}catch(error2){throw internalError(error2,"failed to list OAuthApps")}let requested=[];for(let data of resources){let app;try{app=fromBinary2(OAuthAppSchema,data)}catch(error2){logger2.warn("failed to unmarshal OAuthApp, skipping",{error:error2 instanceof Error?error2.message:String(error2)});continue}(app.metadata?.org??"")===org&&requested.push(app)}let apps=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.oauth_app,requested,"");for(let app of apps)redactOAuthApp(app);apps.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),logger2.info("listed OAuthApps by organization",{org,matchCount:apps.length}),ctx.set(LIST_RESULT_KEY7,create2(OAuthAppsSchema,{entries:apps}))}}}var file_ai_stigmer_iam_platformclient_v1_io=fileDesc("CilhaS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS9pby5wcm90bxIgYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEiLAoQUGxhdGZvcm1DbGllbnRJZBIYCgV2YWx1ZRgBIAEoCUIJukgGcgQQARhAIlQKD1BsYXRmb3JtQ2xpZW50cxJBCgdlbnRyaWVzGAEgAygLMjAuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuUGxhdGZvcm1DbGllbnQiNQodTGlzdFBsYXRmb3JtQ2xpZW50c0J5T3JnSW5wdXQSFAoDb3JnGAEgASgJQge6SARyAhABIoABChxQbGF0Zm9ybUNsaWVudENyZWF0ZVJlc3BvbnNlEkkKD3BsYXRmb3JtX2NsaWVudBgBIAEoCzIwLmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLlBsYXRmb3JtQ2xpZW50EhUKDWNsaWVudF9zZWNyZXQYAiABKAliBnByb3RvMw",[file_ai_stigmer_iam_platformclient_v1_api,file_buf_validate_validate]);var PlatformClientsSchema=messageDesc2(file_ai_stigmer_iam_platformclient_v1_io,1);var PlatformClientCreateResponseSchema=messageDesc2(file_ai_stigmer_iam_platformclient_v1_io,3);var file_ai_stigmer_iam_platformclient_v1_command=fileDesc("Ci5haS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS9jb21tYW5kLnByb3RvEiBhaS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MTKgBgofUGxhdGZvcm1DbGllbnRDb21tYW5kQ29udHJvbGxlchLPAQoGY3JlYXRlEjAuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuUGxhdGZvcm1DbGllbnQaPi5haS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MS5QbGF0Zm9ybUNsaWVudENyZWF0ZVJlc3BvbnNlIlPCuBhPCBgQHiIMbWV0YWRhdGEub3JnKjt1bmF1dGhvcml6ZWQgdG8gY3JlYXRlIHBsYXRmb3JtIGNsaWVudCBpbiB0aGlzIG9yZ2FuaXphdGlvbhKrAQoGdXBkYXRlEjAuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuUGxhdGZvcm1DbGllbnQaMC5haS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MS5QbGF0Zm9ybUNsaWVudCI9wrgYOQgCEBciC21ldGFkYXRhLmlkKiZ1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIHBsYXRmb3JtIGNsaWVudBKxAQoGZGVsZXRlEjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlRGVsZXRlSW5wdXQaMC5haS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MS5QbGF0Zm9ybUNsaWVudCI9wrgYOQgDEBciC3Jlc291cmNlX2lkKiZ1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIHBsYXRmb3JtIGNsaWVudBLCAQoMcm90YXRlU2VjcmV0EjIuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuUGxhdGZvcm1DbGllbnRJZBo+LmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLlBsYXRmb3JtQ2xpZW50Q3JlYXRlUmVzcG9uc2UiPsK4GDoIAhAXIgV2YWx1ZSotdW5hdXRob3JpemVkIHRvIHJvdGF0ZSBwbGF0Zm9ybSBjbGllbnQgc2VjcmV0GgSg/ysXYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_platformclient_v1_api,file_ai_stigmer_iam_platformclient_v1_io]),PlatformClientCommandController=serviceDesc(file_ai_stigmer_iam_platformclient_v1_command,0);var file_ai_stigmer_iam_platformclient_v1_query=fileDesc("CixhaS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS9xdWVyeS5wcm90bxIgYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEykgQKHVBsYXRmb3JtQ2xpZW50UXVlcnlDb250cm9sbGVyEp0BCgNnZXQSLS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VJZBowLmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLlBsYXRmb3JtQ2xpZW50IjXCuBgxCAEQFyIFdmFsdWUqJHVuYXV0aG9yaXplZCB0byB2aWV3IHBsYXRmb3JtIGNsaWVudBJ+Cg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRowLmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLlBsYXRmb3JtQ2xpZW50IgTQuBgBEsoBCglsaXN0QnlPcmcSPy5haS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MS5MaXN0UGxhdGZvcm1DbGllbnRzQnlPcmdJbnB1dBoxLmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLlBsYXRmb3JtQ2xpZW50cyJJwrgYRQgBEB4iA29yZyo6dW5hdXRob3JpemVkIHRvIGxpc3QgcGxhdGZvcm0gY2xpZW50cyBpbiB0aGlzIG9yZ2FuaXphdGlvbhoEoP8rF2IGcHJvdG8z",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_platformclient_v1_api,file_ai_stigmer_iam_platformclient_v1_io]),PlatformClientQueryController=serviceDesc(file_ai_stigmer_iam_platformclient_v1_query,0);var import_node_crypto21=require("node:crypto"),CLIENT_ID_PREFIX="stgm_cid_",CLIENT_SECRET_PREFIX="stgm_cs_",CLIENT_ID_BYTES=32,CLIENT_SECRET_BYTES=48,SECRET_FINGERPRINT_LENGTH=6;function generateClientId(){return CLIENT_ID_PREFIX+(0,import_node_crypto21.randomBytes)(CLIENT_ID_BYTES).toString("base64url")}function generateClientSecret(){return CLIENT_SECRET_PREFIX+(0,import_node_crypto21.randomBytes)(CLIENT_SECRET_BYTES).toString("base64url")}function hashClientSecret(secret){return(0,import_node_crypto21.createHash)("sha256").update(secret,"utf8").digest("base64url")}function secretFingerprint(secret){return secret.length<=SECRET_FINGERPRINT_LENGTH?secret:secret.slice(-SECRET_FINGERPRINT_LENGTH)}function secretMatchesHash(secret,storedHash){if(storedHash==="")return!1;let presented=Buffer.from(hashClientSecret(secret),"utf8"),stored=Buffer.from(storedHash,"utf8");return presented.length===stored.length&&(0,import_node_crypto21.timingSafeEqual)(presented,stored)}var DuplicatePlatformClientError=class extends Error{constructor(message6,options){super(message6,options),this.name="DuplicatePlatformClientError"}};var CLIENT_SECRET_PLAINTEXT_KEY="platformClientSecretPlaintext";function redactPlatformClient(client){return client.spec!==void 0&&(client.spec.clientSecretHash=""),client}function parkedClientSecret(ctx){let secret=ctx.get(CLIENT_SECRET_PLAINTEXT_KEY);if(typeof secret!="string"||secret==="")throw internalError(new Error("no client secret parked \u2014 a credential step must run first"),"platform client credentials");return secret}function newRefuseReservedSlugStep(){return{name:"RefuseReservedSlug",execute(ctx){let slug=metadataOf(ctx.newState)?.slug??"";if(RESERVED_PLATFORM_CLIENT_SLUGS.has(slug))throw invalidArgumentError(reservedSlugMessage(slug))}}}function newCheckDuplicateStep3(clients){return{name:"CheckDuplicate",async execute(ctx){let metadata=requireMetadata2(ctx,"duplicate check"),existing=await clients.findByOrgAndSlug(metadata.org,metadata.slug);if(existing!==void 0)throw alreadyExistsError(PLATFORM_CLIENT_KIND_NAME,`slug '${metadata.slug}' in org '${metadata.org}' (id: ${existing.metadata?.id??""})`)}}}function newGenerateClientCredentialsStep(){return{name:"GenerateClientCredentials",execute(ctx){let spec=specOf3(ctx.newState),secret=generateClientSecret();spec.clientId=generateClientId(),spec.clientSecretHash=hashClientSecret(secret),spec.secretFingerprint=secretFingerprint(secret),ctx.set(CLIENT_SECRET_PLAINTEXT_KEY,secret)}}}function newPersistNewClientStep(clients){return{name:"Persist",async execute(ctx){try{await clients.save(ctx.newState)}catch(error2){if(error2 instanceof DuplicatePlatformClientError){let metadata=requireMetadata2(ctx,"persist");throw alreadyExistsError(PLATFORM_CLIENT_KIND_NAME,`slug '${metadata.slug}' in org '${metadata.org}'`)}throw internalError(error2,"failed to save platform client")}}}}function newLoadExistingClientStep(clients){return{name:"LoadExisting",async execute(ctx){let metadata=requireMetadata2(ctx,"load existing"),existing;if(metadata.id!==""){if(existing=await clients.findById(metadata.id),existing===void 0)throw notFoundError(PLATFORM_CLIENT_KIND_NAME,metadata.id)}else if(metadata.slug!==""){if(existing=await clients.findByOrgAndSlug(metadata.org,metadata.slug),existing===void 0)throw notFoundError(PLATFORM_CLIENT_KIND_NAME,metadata.slug);metadata.id=existing.metadata?.id??""}else throw invalidArgumentError("resource id or slug is required for update");ctx.set(EXISTING_RESOURCE_KEY,existing)}}}function newPreserveClientCredentialsStep(){return{name:"PreserveClientCredentials",execute(ctx){let existing=storedClientOf(ctx,EXISTING_RESOURCE_KEY),spec=specOf3(ctx.newState);spec.clientId=existing.spec?.clientId??"",spec.clientSecretHash=existing.spec?.clientSecretHash??"",spec.secretFingerprint=existing.spec?.secretFingerprint??""}}}function newPersistUpdatedClientStep(clients){return{name:"Persist",async execute(ctx){try{await clients.update(ctx.newState)}catch(error2){throw internalError(error2,"failed to save platform client")}}}}function newRefuseSystemManagedStep(verb,key){return{name:"RefuseSystemManaged",execute(ctx){if(storedClientOf(ctx,key).metadata?.labels[SYSTEM_MANAGED_LABEL]===RESERVED_LABEL_TRUE)throw failedPreconditionError(systemManagedMessage(verb))}}}function newLoadTargetClientStep(clients){return{name:"LoadTarget",async execute(ctx){let id=idValueOf(ctx.input);if(id==="")throw invalidArgumentError("resource id is required");ctx.set(TARGET_RESOURCE_KEY,await readClient(clients,id))}}}function newLoadClientByReferenceStep(clients){return{name:"LoadByReference",async execute(ctx){let ref=ctx.input;if(ref.slug==="")throw invalidArgumentError("slug is required in reference");if(ref.kind!==ApiResourceKind.api_resource_kind_unknown&&ref.kind!==ApiResourceKind.platform_client)throw invalidArgumentError(`kind mismatch: expected platform_client, got ${ApiResourceKind[ref.kind]??String(ref.kind)}`);requireOrgForReference(ApiResourceKind.platform_client,ref.org);let client=await clients.findByOrgAndSlug(ref.org,ref.slug);if(client===void 0)throw new ConnectError(referenceNotFoundMessage(ref.org,ref.slug),Code.NotFound);ctx.set(TARGET_RESOURCE_KEY,client)}}}function newRotateClientCredentialsStep(){return{name:"RotateClientCredentials",execute(ctx){let client=storedClientOf(ctx,TARGET_RESOURCE_KEY),spec=specOf3(client),secret=generateClientSecret();spec.clientSecretHash=hashClientSecret(secret),spec.secretFingerprint=secretFingerprint(secret),updateAuditFields(PlatformClientSchema,client,client,ctx.callerIdentity),ctx.set(CLIENT_SECRET_PLAINTEXT_KEY,secret)}}}function newPersistTargetClientStep(clients){return{name:"Persist",async execute(ctx){try{await clients.update(storedClientOf(ctx,TARGET_RESOURCE_KEY))}catch(error2){throw internalError(error2,"failed to save platform client")}}}}function newLoadExistingClientForDeleteStep(clients){return{name:"LoadExistingForDelete",async execute(ctx){ctx.set(EXISTING_RESOURCE_KEY,await readClient(clients,requireResourceId3(ctx)))}}}function newDeleteClientStep(clients){return{name:"DeleteResource",async execute(ctx){try{await clients.deleteById(requireResourceId3(ctx))}catch(error2){throw internalError(error2,"failed to delete platform client")}}}}async function readClient(clients,id){let client=await clients.findById(id);if(client===void 0)throw notFoundError(PLATFORM_CLIENT_KIND_NAME,id);return client}function storedClientOf(ctx,key){let client=ctx.get(key);if(client===void 0)throw internalError(new Error(`no platform client under '${key}' \u2014 its load step must run first`),"platform client chain ordering");return client}function requireMetadata2(ctx,operation2){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("platform client metadata is nil"),operation2);return metadata}function specOf3(client){return client.spec===void 0&&(client.spec=create2(PlatformClientSpecSchema)),client.spec}function requireResourceId3(ctx){let id=ctx.get(RESOURCE_ID_KEY);if(typeof id!="string"||id==="")throw internalError(new Error("resource id not found in context (the delete handler sets it)"),"platform client delete ordering");return id}function registerPlatformClientServices(router,deps){router.service(PlatformClientCommandController,{create:(client,ctx)=>createClient2(deps,client,ctx),update:(client,ctx)=>updateClient(deps,client,ctx),delete:(input,ctx)=>deleteClient(deps,input,ctx),rotateSecret:(id,ctx)=>rotateSecret(deps,id,ctx)}),router.service(PlatformClientQueryController,{get:(id,ctx)=>get17(deps,id,ctx),getByReference:(ref,ctx)=>getByReference10(deps,ref,ctx),listByOrg:(input,ctx)=>listByOrg3(deps,input,ctx)})}function kindOf16(ctx){return ctx.values.get(apiResourceKindKey)}async function createClient2(deps,client,ctx){let reqCtx=new RequestContext(PlatformClientSchema,client,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("platformclient-create",deps.logger).addStep(newAuthorizeStep(PlatformClientCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newRefuseReservedSlugStep()).addStep(newCheckDuplicateStep3(deps.clients)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newGenerateClientCredentialsStep()).addStep(newPersistNewClientStep(deps.clients)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),create2(PlatformClientCreateResponseSchema,{platformClient:redactPlatformClient(reqCtx.newState),clientSecret:parkedClientSecret(reqCtx)})}async function updateClient(deps,client,ctx){let reqCtx=new RequestContext(PlatformClientSchema,client,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("platformclient-update",deps.logger).addStep(newAuthorizeStep(PlatformClientCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingClientStep(deps.clients)).addStep(newRefuseSystemManagedStep("updated",EXISTING_RESOURCE_KEY)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPreserveClientCredentialsStep()).addStep(newPersistUpdatedClientStep(deps.clients)).build().execute(reqCtx),redactPlatformClient(reqCtx.newState)}async function deleteClient(deps,input,ctx){let reqCtx=new RequestContext(PlatformClientCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf16(ctx));return reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("platformclient-delete",deps.logger).addStep(newAuthorizeStep(PlatformClientCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingClientForDeleteStep(deps.clients)).addStep(newRefuseSystemManagedStep("deleted",EXISTING_RESOURCE_KEY)).addStep(newDeleteClientStep(deps.clients)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),redactPlatformClient(storedClientOf(reqCtx,EXISTING_RESOURCE_KEY))}async function rotateSecret(deps,id,ctx){let reqCtx=new RequestContext(PlatformClientCommandController.method.rotateSecret.input,id,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("platformclient-rotate-secret",deps.logger).addStep(newAuthorizeStep(PlatformClientCommandController.method.rotateSecret,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetClientStep(deps.clients)).addStep(newRefuseSystemManagedStep("rotated",TARGET_RESOURCE_KEY)).addStep(newRotateClientCredentialsStep()).addStep(newPersistTargetClientStep(deps.clients)).build().execute(reqCtx),create2(PlatformClientCreateResponseSchema,{platformClient:redactPlatformClient(storedClientOf(reqCtx,TARGET_RESOURCE_KEY)),clientSecret:parkedClientSecret(reqCtx)})}async function get17(deps,id,ctx){let reqCtx=new RequestContext(PlatformClientQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("platformclient-get",deps.logger).addStep(newAuthorizeStep(PlatformClientQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetClientStep(deps.clients)).build().execute(reqCtx),redactPlatformClient(storedClientOf(reqCtx,TARGET_RESOURCE_KEY))}async function getByReference10(deps,ref,ctx){let reqCtx=new RequestContext(PlatformClientQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("platformclient-get-by-reference",deps.logger).addStep(newAuthorizeStep(PlatformClientQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadClientByReferenceStep(deps.clients)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(PlatformClientQueryController.method.get))).build().execute(reqCtx),redactPlatformClient(storedClientOf(reqCtx,TARGET_RESOURCE_KEY))}async function listByOrg3(deps,input,ctx){let caller=callerIdentityOf(ctx),reqCtx=new RequestContext(PlatformClientQueryController.method.listByOrg.input,input,caller,kindOf16(ctx));await newPipeline("platformclient-list-by-org",deps.logger).addStep(newAuthorizeStep(PlatformClientQueryController.method.listByOrg,deps.authorizer)).addStep(newValidateProtoStep()).build().execute(reqCtx);let candidates;try{candidates=await deps.clients.findByOrg(input.org)}catch(error2){throw internalError(error2,"failed to list platform clients")}let entries=[...await restrictListByReadScope(deps.listReadScope,caller,ApiResourceKind.platform_client,candidates,input.org)].sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)).map(redactPlatformClient);return create2(PlatformClientsSchema,{entries})}var OPAQUE_ORIGIN="null";function newPlatformClientOriginGuard(deps){return{name:"platform-client-origin",async guard(caller,method,headers2){let origin=headers2.get("origin")??"";if(origin.trim()==="")return;let platformClientId=mintingClientOf(caller);if(platformClientId===void 0)return;let procedure=`/${method.parent.typeName}/${method.name}`,client=await deps.clients.findById(platformClientId);if(client===void 0)throw new ConnectError(DELETED_CLIENT_MESSAGE,Code.Unauthenticated);if(!originAllowed(origin,client.spec?.allowedOrigins??[]))throw deps.logger.warn("origin refusal: origin not in allowed_origins",{procedure,platformClientId,origin}),new ConnectError(originRefusalMessage(origin),Code.PermissionDenied)}}}function mintingClientOf(caller){let payload=decodeVerifiedPlatformTokenPayload(caller.rawToken);if(!(payload===void 0||stringClaim(payload,TOKEN_TYPE_CLAIM)!==void 0))return stringClaim(payload,USER_TOKEN_CLAIMS.platformClientId)}function originAllowed(origin,allowed){if(allowed.length===0)return!0;if(origin===OPAQUE_ORIGIN)return!1;let presented=origin.toLowerCase();return allowed.some(entry=>entry.toLowerCase()===presented)}var KIND5=ApiResourceKind.platform_client;function newResourcePlatformClientStore(store){async function readById(id){try{return await store.getResource(KIND5,id,PlatformClientSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}async function readByClientId(clientId){if(clientId!=="")try{return await store.findByField(KIND5,"spec.clientId",clientId,PlatformClientSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}async function listOrg(org){let clients=[];for(let data of await store.listResources(KIND5)){let client;try{client=fromBinary2(PlatformClientSchema,data)}catch{continue}(client.metadata?.org??"")===org&&clients.push(client)}return clients}async function readByOrgAndSlug(org,slug){if(!(org===""||slug===""))return(await listOrg(org)).find(client=>(client.metadata?.slug??"")===slug)}return{async save(client){let id=client.metadata?.id??"",org=client.metadata?.org??"",slug=client.metadata?.slug??"";if(await readById(id)!==void 0)throw new DuplicatePlatformClientError(`platform client '${id}' already exists`);if(await readByOrgAndSlug(org,slug)!==void 0)throw new DuplicatePlatformClientError(`platform client '${org}/${slug}' already exists`);if(await readByClientId(client.spec?.clientId??"")!==void 0)throw new DuplicatePlatformClientError("a platform client already holds this client_id");await store.saveResource(KIND5,id,PlatformClientSchema,client)},async update(client){let id=client.metadata?.id??"";await readById(id)!==void 0&&await store.saveResource(KIND5,id,PlatformClientSchema,client)},async modifyById(id,modify){try{return await store.updateResource(KIND5,id,PlatformClientSchema,modify)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}},async deleteById(id){await store.deleteResource(KIND5,id)},findById:readById,findByClientId:readByClientId,findByOrgAndSlug:readByOrgAndSlug,findByOrg:listOrg}}var file_ai_stigmer_iam_platformclient_v1_token=fileDesc("CixhaS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS90b2tlbi5wcm90bxIgYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEiugEKFE1pbnRVc2VyVG9rZW5SZXF1ZXN0EhoKCWNsaWVudF9pZBgBIAEoCUIHukgEcgIQARIeCg1jbGllbnRfc2VjcmV0GAIgASgJQge6SARyAhABEhsKB3VzZXJfaWQYAyABKAlCCrpIB3IFEAEYgAISHAoKdXNlcl9lbWFpbBgEIAEoCUIIukgFcgMYwAISGwoJdXNlcl9uYW1lGAUgASgJQgi6SAVyAxiAAhIOCgZvcmdfaWQYBiABKAkiVQoVTWludFVzZXJUb2tlblJlc3BvbnNlEhQKDGFjY2Vzc190b2tlbhgBIAEoCRISCgp0b2tlbl90eXBlGAIgASgJEhIKCmV4cGlyZXNfaW4YAyABKAUiyQMKFU1pbnRHdWVzdFRva2VuUmVxdWVzdBIUCgNvcmcYASABKAlCB7pIBHICEAESFQoEc2x1ZxgCIAEoCUIHukgEcgIQARIXCg9ndWVzdF9jb29raWVfaWQYAyABKAkSywIKDGVtYmVkX29yaWdpbhgEIAEoCUK0ArpIsAK6AawCChNlbWJlZF9vcmlnaW4uZm9ybWF0EndlbWJlZF9vcmlnaW4gbXVzdCBiZSBlbXB0eSwgIm51bGwiLCBvciBhbiBleGFjdCB3ZWIgb3JpZ2luIGxpa2UgaHR0cHM6Ly9leGFtcGxlLmNvbSAobm8gcGF0aCwgcXVlcnksIG9yIHRyYWlsaW5nIHNsYXNoKRqbAXRoaXMgPT0gJycgfHwgdGhpcyA9PSAnbnVsbCcgfHwgdGhpcy5tYXRjaGVzKCdeaHR0cHM/Oi8vW0EtWmEtejAtOV0oW0EtWmEtejAtOS1dKltBLVphLXowLTldKT8oXFwuW0EtWmEtejAtOV0oW0EtWmEtejAtOS1dKltBLVphLXowLTldKT8pKig6WzAtOV17MSw1fSk/JCcpEhwKCmxpbmtfdG9rZW4YBSABKAlCCLpIBXIDGIABIm8KFk1pbnRHdWVzdFRva2VuUmVzcG9uc2USFAoMYWNjZXNzX3Rva2VuGAEgASgJEhIKCnRva2VuX3R5cGUYAiABKAkSEgoKZXhwaXJlc19pbhgDIAEoBRIXCg9ndWVzdF9jb29raWVfaWQYBCABKAkytAIKHVBsYXRmb3JtQ2xpZW50VG9rZW5Db250cm9sbGVyEoYBCg1taW50VXNlclRva2VuEjYuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuTWludFVzZXJUb2tlblJlcXVlc3QaNy5haS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MS5NaW50VXNlclRva2VuUmVzcG9uc2UiBMi4GAESiQEKDm1pbnRHdWVzdFRva2VuEjcuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuTWludEd1ZXN0VG9rZW5SZXF1ZXN0GjguYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuTWludEd1ZXN0VG9rZW5SZXNwb25zZSIEyLgYAWIGcHJvdG8z",[file_ai_stigmer_commons_rpc_method_options,file_buf_validate_validate]);var MintUserTokenResponseSchema=messageDesc2(file_ai_stigmer_iam_platformclient_v1_token,1);var PlatformClientTokenController=serviceDesc(file_ai_stigmer_iam_platformclient_v1_token,0);var import_node_crypto22=require("node:crypto");var PLATFORM_TOKEN_KEY_ENV_VAR="STIGMER_PLATFORM_TOKEN_KEY",PLATFORM_TOKEN_KEY_FILE_NAME="platform-token.key",DEFAULT_PLATFORM_TOKEN_TTL_SECONDS=900,MIN_RSA_MODULUS_BITS=2048;function canSign(ring){return ring.signer!==void 0}function resolvePlatformTokenKeys(input){if(input.requireAuthentication){if(input.supplied!==void 0)return input.supplied;if(input.edition!==ServerEdition.oss)throw new Error(`the ${ServerEdition[input.edition]} edition requires authentication but registers no platform-token key ring \u2014 register drivers.platformTokenKeys; only open source generates its own key`);return openSourcePlatformTokenKeyRing(input.options)}}function openSourcePlatformTokenKeyRing(options={}){let privateKey=getOrCreateKey(RSA_PRIVATE_KEY,PLATFORM_TOKEN_KEY_ENV_VAR,PLATFORM_TOKEN_KEY_FILE_NAME,options);return{signer:{key:privateKey,kid:kidOf(privateKey)},verificationKeys:[(0,import_node_crypto22.createPublicKey)(privateKey)],audience:"",ttlSeconds:DEFAULT_PLATFORM_TOKEN_TTL_SECONDS}}var RSA_PRIVATE_KEY={fromEnv(envVar,decoded){let key=parseKey2(()=>(0,import_node_crypto22.createPrivateKey)(decoded.toString("utf8")),envVar);return requireRsa(key,envVar)},fromFile(content){try{let key=(0,import_node_crypto22.createPrivateKey)(content.toString("utf8"));return isUsableRsa(key)?key:void 0}catch{return}},generate(){return(0,import_node_crypto22.generateKeyPairSync)("rsa",{modulusLength:MIN_RSA_MODULUS_BITS}).privateKey},toFile(key){return Buffer.from(key.export({format:"pem",type:"pkcs8"}))}};function kidOf(key){let publicKey=key.type==="private"?(0,import_node_crypto22.createPublicKey)(key):key;return(0,import_node_crypto22.createHash)("sha256").update(spkiOf(publicKey)).digest("base64url").slice(0,16)}function spkiOf(publicKey){return publicKey.export({format:"der",type:"spki"})}function parseKey2(parse5,what){try{return parse5()}catch(error2){throw new Error(`${what} is not a readable PEM key: ${error2 instanceof Error?error2.message:String(error2)}`)}}function requireRsa(key,what){if(!isUsableRsa(key))throw new Error(`${what} must be an RSA key of at least ${MIN_RSA_MODULUS_BITS} bits`);return key}function isUsableRsa(key){return key.asymmetricKeyType==="rsa"&&(key.asymmetricKeyDetails?.modulusLength??0)>=MIN_RSA_MODULUS_BITS}var SUBJECT_SEPARATOR="|",DEFAULT_AUTO_GRANT_ROLE=IamRole.viewer;async function mintUserToken(deps,request){let keys=deps.keys;if(keys===void 0)throw new ConnectError(MINTING_REQUIRES_AUTHENTICATION_MESSAGE,Code.FailedPrecondition);if(!canSign(keys))throw new ConnectError(MINTING_DISABLED_MESSAGE,Code.FailedPrecondition);let client=await authenticateClient(deps,request),owningOrg=client.metadata?.org??"";if(request.orgId!==""&&request.orgId!==owningOrg)throw new ConnectError(organizationMismatchMessage(owningOrg),Code.InvalidArgument);let user={externalUserId:request.userId,email:request.userEmail,name:request.userName},accountId=await resolveOrProvisionAccount(deps,client,owningOrg,user),now=deps.now(),signed=signPlatformToken(keys,{[USER_TOKEN_CLAIMS.subject]:accountId,[USER_TOKEN_CLAIMS.externalUserId]:user.externalUserId,[USER_TOKEN_CLAIMS.email]:user.email,[USER_TOKEN_CLAIMS.name]:user.name,[USER_TOKEN_CLAIMS.org]:owningOrg,[USER_TOKEN_CLAIMS.platformClientId]:client.metadata?.id??""},{now});return await recordClientUse(deps,client,now),create2(MintUserTokenResponseSchema,{accessToken:signed.token,tokenType:BEARER_TOKEN_TYPE,expiresIn:keys.ttlSeconds})}async function authenticateClient(deps,request){let client;try{client=await deps.clients.findByClientId(request.clientId)}catch(error2){throw internalError(error2,"failed to authenticate platform client")}if(client===void 0||!secretMatchesHash(request.clientSecret,client.spec?.clientSecretHash??""))throw new ConnectError(INVALID_CLIENT_CREDENTIALS_MESSAGE,Code.Unauthenticated);let spec=client.spec;if(spec?.neverExpires!==!0&&spec?.expiresAt!==void 0&&deps.now().getTime()>timestampDate(spec.expiresAt).getTime())throw new ConnectError(EXPIRED_CLIENT_SECRET_MESSAGE,Code.FailedPrecondition);return client}function recordClientUse(deps,client,now){let id=client.metadata?.id??"";return recordCredentialUse({credential:"platform client",id,lastUsedAt:client.status?.lastUsedAt,now,logger:deps.logger,write:stamp2=>deps.clients.modifyById(id,live=>{live.status??=create2(PlatformClientStatusSchema),stamp2(live.status)})})}async function resolveOrProvisionAccount(deps,client,org,user){let idpId=platformClientSubject(org,user.externalUserId),existing=await findAccount(deps,idpId);if(existing!==void 0)return platformClientAccountId(existing,user,org);let spec=client.spec;if(spec?.autoProvisionAccounts!==!0)throw new ConnectError(noAccountMessage(user.externalUserId,org),Code.FailedPrecondition);let input=accountInput(idpId,org,user),actor=serverActingFor(client.metadata?.id??"");spec.autoGrantOnOrg&&await grantAutoRole(deps,client,org,accountIdFor(idpId),actor);try{return(await deps.createAccount(input,actor)).metadata?.id??""}catch(error2){let winner=await resolveCreateRace(error2,()=>deps.accounts.findByIdpId(idpId));return platformClientAccountId(winner,user,org)}}async function findAccount(deps,idpId){try{return await deps.accounts.findByIdpId(idpId)}catch(error2){throw internalError(error2,"failed to resolve platform client user")}}function platformClientAccountId(account2,user,org){if(account2.spec?.provisioningMode!==IdentityAccountProvisioningMode.platform_client)throw new ConnectError(foreignAccountMessage(user.externalUserId,org),Code.FailedPrecondition);return account2.metadata?.id??""}function accountInput(idpId,org,user){let input={name:user.email!==""?user.email:user.externalUserId,spec:create2(IdentityAccountSpecSchema,{idpId,email:user.email,...splitName(user.name,user.email)}),provisioning:{mode:"platform_client",org}},result=validator().validate(IdentityAccountSchema,create2(IdentityAccountSchema,{apiVersion:"iam.stigmer.ai/v1",kind:"IdentityAccount",metadata:{name:input.name,org},spec:input.spec}));if(result.kind==="invalid")throw new ConnectError(result.error.message,Code.InvalidArgument);if(result.kind==="error")throw new ConnectError(`validation could not run: ${result.error.message}`,Code.Internal);return input}async function grantAutoRole(deps,client,org,accountId,actor){let configured=client.spec?.autoGrantRole??IamRole.iam_role_unspecified;if(configured===IamRole.owner)throw new ConnectError(OWNER_AUTO_GRANT_MESSAGE,Code.InvalidArgument);let role=configured===IamRole.iam_role_unspecified?DEFAULT_AUTO_GRANT_ROLE:configured;try{await deps.grantPath.grant(organizationRole(accountId,role,org),actor)}catch(error2){throw deps.logger.error("platform client auto-grant failed; nothing was provisioned",{accountId,platformClientId:client.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)}),new ConnectError(PROVISIONING_FAILED_MESSAGE,Code.Internal)}}function platformClientSubject(org,externalUserId){return requireSubjectPart("org",org),requireSubjectPart("externalUserId",externalUserId),`${PLATFORM_CLIENT_SUBJECT_PREFIX}${org}${SUBJECT_SEPARATOR}${externalUserId}`}function requireSubjectPart(part,value){if(value.trim()==="")throw new ConnectError(blankSubjectPartMessage(part),Code.InvalidArgument);if(value.includes(SUBJECT_SEPARATOR))throw new ConnectError(subjectSeparatorMessage(part,value),Code.InvalidArgument)}function splitName(name,email){if(name!==""){let space=name.indexOf(" ");return space>0?{firstName:name.slice(0,space),lastName:name.slice(space+1)}:{firstName:name,lastName:""}}let at2=email.indexOf("@");return{firstName:at2>=0?email.slice(0,at2):email,lastName:""}}function registerPlatformClientTokenService(router,deps){router.service(PlatformClientTokenController,{mintUserToken:request=>mintUserToken(deps.mint,request),mintGuestToken:(request,ctx)=>{if(deps.guestTokenMinting===void 0)throw new ConnectError(GUEST_MINT_UNIMPLEMENTED_MESSAGE,Code.Unimplemented);return deps.guestTokenMinting.mintGuestToken(request,ctx.requestHeader)}})}function newPlatformClientTokenVerifier(deps){return{name:"platform-client",async verify(token){let result=verifyPlatformToken(deps.keys,token,deps.now?.());switch(result.outcome){case"foreign":return null;case"refused":throw platformTokenRefusalError(result.refusal);case"verified":break;default:{let exhaustive=result;throw new Error(`unknown verification ${JSON.stringify(exhaustive)}`)}}let verified=result.token;if(verified.tokenType!==void 0)return null;let platformClientId=stringClaim(verified.payload,USER_TOKEN_CLAIMS.platformClientId);if(platformClientId===void 0)throw new ConnectError(TOKEN_NAMES_NO_CLIENT_MESSAGE,Code.Unauthenticated);if(await deps.clients.findById(platformClientId)===void 0)throw new ConnectError(DELETED_CLIENT_MESSAGE,Code.Unauthenticated);let email=stringClaim(verified.payload,USER_TOKEN_CLAIMS.email),displayName=stringClaim(verified.payload,USER_TOKEN_CLAIMS.name);return{identityId:verified.subject,callerClass:"user",issuer:PLATFORM_TOKEN_ISSUER,rawToken:token,...email!==void 0?{email}:{},...displayName!==void 0?{displayName}:{},platformClientId}}}}var file_ai_stigmer_tenancy_organization_v1_io=fileDesc("CithaS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL2lvLnByb3RvEiJhaS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxIlIKDU9yZ2FuaXphdGlvbnMSQQoHZW50cmllcxgBIAMoCzIwLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uImoKEE9yZ2FuaXphdGlvbkxpc3QSEwoLdG90YWxfcGFnZXMYASABKAUSQQoHZW50cmllcxgCIAMoCzIwLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uIioKDk9yZ2FuaXphdGlvbklkEhgKBXZhbHVlGAEgASgJQgm6SAZyBBABGEAimwEKGk9yZ2FuaXphdGlvbkV4dGVybmFsTG9va3VwElsKFWlkZW50aXR5X3Byb3ZpZGVyX3JlZhgBIAEoCzI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZUIGukgDyAEBEiAKD2V4dGVybmFsX29yZ19pZBgCIAEoCUIHukgEcgIQAWIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_tenancy_organization_v1_api,file_buf_validate_validate]),OrganizationsSchema=messageDesc2(file_ai_stigmer_tenancy_organization_v1_io,0),OrganizationListSchema=messageDesc2(file_ai_stigmer_tenancy_organization_v1_io,1);var file_ai_stigmer_tenancy_organization_v1_command=fileDesc("CjBhaS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL2NvbW1hbmQucHJvdG8SImFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEy2AQKHU9yZ2FuaXphdGlvbkNvbW1hbmRDb250cm9sbGVyEmsKBWFwcGx5EjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24aMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhJyCgZjcmVhdGUSMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhowLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uIgTQuBgBEqgBCgZ1cGRhdGUSMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhowLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uIjrCuBg2CAIQHiILbWV0YWRhdGEuaWQqI3VuYXV0aG9yaXplZCB0byB1cGRhdGUgb3JnYW5pemF0aW9uEqQBCgZkZWxldGUSMi5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbklkGjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24iNMK4GDAIAxAeIgV2YWx1ZSojdW5hdXRob3JpemVkIHRvIGRlbGV0ZSBvcmdhbml6YXRpb24aBKD/Kx5iBnByb3RvMw",[file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_tenancy_organization_v1_api,file_ai_stigmer_tenancy_organization_v1_io]),OrganizationCommandController=serviceDesc(file_ai_stigmer_tenancy_organization_v1_command,0);var file_ai_stigmer_tenancy_organization_v1_query=fileDesc("Ci5haS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL3F1ZXJ5LnByb3RvEiJhaS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxMrkEChtPcmdhbml6YXRpb25RdWVyeUNvbnRyb2xsZXISnwEKA2dldBIyLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uSWQaMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbiIywrgYLggBEB4iBXZhbHVlKiF1bmF1dGhvcml6ZWQgdG8gdmlldyBvcmdhbml6YXRpb24SewoEZmluZBI3LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5GaW5kQXBpUmVzb3VyY2VzUmVxdWVzdBo0LmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uTGlzdCIE0LgYARJmChNmaW5kTXlPcmdhbml6YXRpb25zEhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5GjEuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb25zIgTQuBgBEowBChJnZXRCeUV4dGVybmFsT3JnSWQSPi5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbkV4dGVybmFsTG9va3VwGjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24iBNC4GAEaBKD/Kx5iBnByb3RvMw",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_tenancy_organization_v1_api,file_ai_stigmer_tenancy_organization_v1_io,file_google_protobuf_empty]),OrganizationQueryController=serviceDesc(file_ai_stigmer_tenancy_organization_v1_query,0);var organizationSearchExtractor={kind:ApiResourceKind.organization,schema:OrganizationSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let org=resource;return buildSearchResult({kind:ApiResourceKind.organization,metadata:org.metadata,summary:org.spec?.description??"",score,createdAt:org.status?.audit?.specAudit?.createdAt,updatedAt:org.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let org=resource,metadata=org.metadata;if(metadata!==void 0)return{name:metadata.name,description:org.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(org.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};function newCheckOrgDuplicateStep(store){return{name:"CheckDuplicate",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("organization metadata is nil"),"duplicate check");if(metadata.slug==="")throw internalError(new Error("organization slug is empty"),"duplicate check");try{await store.getResource(ctx.apiResourceKind,metadata.slug,OrganizationSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw internalError(error2,"failed to check for duplicate organization")}throw alreadyExistsError("Organization",`slug '${metadata.slug}'`)}}}function newCopySlugToIdStep(){return{name:"CopySlugToId",execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("organization metadata is nil"),"copy slug to id");if(metadata.slug==="")throw internalError(new Error("organization slug is empty"),"copy slug to id");metadata.id=metadata.slug}}}function registerOrganizationServices(router,deps){router.service(OrganizationCommandController,{apply:(org,ctx)=>apply10(deps,org,ctx),create:(org,ctx)=>createOrganization(deps,org,ctx),update:(org,ctx)=>update13(deps,org,ctx),delete:(orgId,ctx)=>deleteOrganization(deps,orgId,ctx)});let externalLookup=deps.organizationDirectory?.lookupExternalOrganization?.bind(deps.organizationDirectory);router.service(OrganizationQueryController,{get:(orgId,ctx)=>get18(deps,orgId,ctx),find:(req,ctx)=>find(deps,req,ctx),findMyOrganizations:(_,ctx)=>findMyOrganizations(deps,ctx),...externalLookup===void 0?{}:{getByExternalOrgId:(lookup3,ctx)=>getByExternalOrgId(deps,externalLookup,lookup3,ctx)}})}function kindOf17(ctx){return ctx.values.get(apiResourceKindKey)}async function createOrganization(deps,org,ctx){let reqCtx=new RequestContext(OrganizationSchema,org,callerIdentityOf(ctx),kindOf17(ctx)),builder2=newPipeline("organization-create",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newCheckOrgDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newCopySlugToIdStep());for(let step of stepsForSlot(deps.gateSteps,"org-create:pre-side-effect-gate"))builder2.addStep(step);builder2.addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger));for(let step of stepsForSlot(deps.gateSteps,"org-create:post-persist"))builder2.addStep(step);return await builder2.addStep(newIndexSearchStep(deps.store,organizationSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update13(deps,org,ctx){let reqCtx=new RequestContext(OrganizationSchema,org,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("organization-update",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,organizationSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply10(deps,org,ctx){let reqCtx=new RequestContext(OrganizationSchema,org,callerIdentityOf(ctx),kindOf17(ctx));await newPipeline("organization-apply",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createOrganization(deps,org,ctx):update13(deps,withResolvedApplyId(OrganizationSchema,org,reqCtx),ctx)}async function deleteOrganization(deps,orgId,ctx){let reqCtx=new RequestContext(OrganizationCommandController.method.delete.input,orgId,callerIdentityOf(ctx),kindOf17(ctx));await newPipeline("organization-delete",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,OrganizationSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted organization not found in context"),"delete operation lost its loaded resource");return deleted}async function get18(deps,orgId,ctx){let reqCtx=new RequestContext(OrganizationQueryController.method.get.input,orgId,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("organization-get",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,OrganizationSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var FIND_RESULT_KEY="findResult";async function find(deps,req,ctx){if(deps.organizationDirectory?.refusesEnumeration===!0)throw new ConnectError("ai.stigmer.tenancy.organization.v1.OrganizationQueryController.find is not implemented",Code.Unimplemented);let reqCtx=new RequestContext(OrganizationQueryController.method.find.input,req,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("organization-find",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.find,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListAllOrganizationsStep(deps.store)).build().execute(reqCtx),reqCtx.get(FIND_RESULT_KEY)}function newListAllOrganizationsStep(store){return{name:"ListAllOrganizations",async execute(ctx){let data;try{data=await store.listResources(ctx.apiResourceKind)}catch(error2){throw internalError(error2,"failed to list organizations")}let orgs=[];for(let bytes of data)try{orgs.push(fromBinary2(OrganizationSchema,bytes))}catch{continue}let req=ctx.input,pageSize=req.pageSize,pageNumber=req.pageNumber;req.page!==void 0&&(req.page.size>0&&(pageSize=req.page.size),req.page.num>0&&(pageNumber=req.page.num)),pageSize<=0&&(pageSize=20),pageSize>100&&(pageSize=100),pageNumber<=0&&(pageNumber=1);let totalPages=Math.ceil(orgs.length/pageSize),start=(pageNumber-1)*pageSize,entries=start>=orgs.length?[]:orgs.slice(start,start+pageSize);ctx.set(FIND_RESULT_KEY,create2(OrganizationListSchema,{totalPages,entries}))}}}async function findMyOrganizations(deps,ctx){let directory=deps.organizationDirectory;if(directory!==void 0){let authorized=await directory.listMyOrganizationIds(callerIdentityOf(ctx));if(authorized!=="all"){let entries2=[];for(let id of authorized)try{entries2.push(await deps.store.getResource(ApiResourceKind.organization,id,OrganizationSchema))}catch(error2){if(error2 instanceof ResourceNotFoundError)continue;throw internalError(error2,"failed to list organizations")}return create2(OrganizationsSchema,{entries:entries2})}}let data;try{data=await deps.store.listResources(ApiResourceKind.organization)}catch(error2){throw internalError(error2,"failed to list organizations")}let entries=[];for(let bytes of data)try{entries.push(fromBinary2(OrganizationSchema,bytes))}catch{continue}return create2(OrganizationsSchema,{entries})}async function getByExternalOrgId(deps,lookup3,input,ctx){let reqCtx=new RequestContext(OrganizationQueryController.method.getByExternalOrgId.input,input,callerIdentityOf(ctx),kindOf17(ctx));if(await newPipeline("organization-get-by-external-org-id",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.getByExternalOrgId,deps.authorizer)).addStep(newValidateProtoStep()).build().execute(reqCtx),input.externalOrgId==="")throw invalidArgumentError("external_org_id is required");let found=await lookup3({org:input.identityProviderRef?.org??"",slug:input.identityProviderRef?.slug??""},input.externalOrgId);if(found.kind==="no-identity-provider")throw notFoundError("Organization",input.externalOrgId);await authorizeResolvedResource(deps.authorizer,reqCtx.callerIdentity,{permission:IamPermission.can_view,resourceKind:ApiResourceKind.identity_provider,resourceId:found.identityProviderId},EXTERNAL_LOOKUP_DENIED_MESSAGE);let orgId=found.organizationId;if(orgId===void 0)throw notFoundError("Organization",input.externalOrgId);try{return await deps.store.getResource(ApiResourceKind.organization,orgId,OrganizationSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("Organization",input.externalOrgId):internalError(error2,"failed to load organization")}}var EXTERNAL_LOOKUP_DENIED_MESSAGE="unauthorized to view identity provider";var file_ai_stigmer_agentic_mcpserver_v1_io=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL2lvLnByb3RvEh9haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxIiQKC01jcFNlcnZlcklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiggIKDENvbm5lY3RJbnB1dBIdCg1tY3Bfc2VydmVyX2lkGAEgASgJQga6SAPIAQESUgoLcnVudGltZV9lbnYYAiADKAsyPS5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkNvbm5lY3RJbnB1dC5SdW50aW1lRW52RW50cnkSFAoDb3JnGAMgASgJQge6SARyAhABGmkKD1J1bnRpbWVFbnZFbnRyeRILCgNrZXkYASABKAkSRQoFdmFsdWUYAiABKAsyNi5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25WYWx1ZToCOAEiUAoZSW5pdGlhdGVPQXV0aENvbm5lY3RJbnB1dBIdCg1tY3Bfc2VydmVyX2lkGAEgASgJQga6SAPIAQESFAoDb3JnGAIgASgJQge6SARyAhABIm0KGkluaXRpYXRlT0F1dGhDb25uZWN0T3V0cHV0EhkKEWF1dGhvcml6YXRpb25fdXJsGAEgASgJEg0KBXN0YXRlGAIgASgJEg4KBnNjb3BlcxgDIAMoCRIVCg1wcm92aWRlcl9uYW1lGAQgASgJIncKGUNvbXBsZXRlT0F1dGhDb25uZWN0SW5wdXQSHQoNbWNwX3NlcnZlcl9pZBgBIAEoCUIGukgDyAEBEiMKEmF1dGhvcml6YXRpb25fY29kZRgCIAEoCUIHukgEcgIQARIWCgVzdGF0ZRgDIAEoCUIHukgEcgIQASJkChpDb21wbGV0ZU9BdXRoQ29ubmVjdE91dHB1dBIRCgljb25uZWN0ZWQYASABKAgSFgoOdGFyZ2V0X2Vudl92YXIYAiABKAkSGwoTdG9rZW5fbGlmZXRpbWVfaGludBgDIAEoCSJNChhHZXRPQXV0aEdyYW50U3RhdHVzSW5wdXQSGwoLcmVzb3VyY2VfaWQYASABKAlCBrpIA8gBARIUCgNvcmcYAiABKAlCB7pIBHICEAEizwEKGUdldE9BdXRoR3JhbnRTdGF0dXNPdXRwdXQSEQoJY29ubmVjdGVkGAEgASgIEh8KF2FjY2Vzc190b2tlbl9leHBpcmVzX2F0GAIgASgDEhYKDnRhcmdldF9lbnZfdmFyGAMgASgJEhMKC2F1dGhfbWV0aG9kGAQgASgJElEKEWNvbm5lY3Rpb25faGVhbHRoGAUgASgOMjYuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5PQXV0aENvbm5lY3Rpb25IZWFsdGgiSQoURGlzY29ubmVjdE9BdXRoSW5wdXQSGwoLcmVzb3VyY2VfaWQYASABKAlCBrpIA8gBARIUCgNvcmcYAiABKAlCB7pIBHICEAEiLQoVRGlzY29ubmVjdE9BdXRoT3V0cHV0EhQKDGRpc2Nvbm5lY3RlZBgBIAEoCCKEAQoTU2V0T3JnT0F1dGhBcHBJbnB1dBIbCgtyZXNvdXJjZV9pZBgBIAEoCUIGukgDyAEBEhQKA29yZxgCIAEoCUIHukgEcgIQARIaCgljbGllbnRfaWQYAyABKAlCB7pIBHICEAESHgoNY2xpZW50X3NlY3JldBgEIAEoCUIHukgEcgIQASIsChRTZXRPcmdPQXV0aEFwcE91dHB1dBIUCgxvYXV0aF9hcHBfaWQYASABKAkiSAoTR2V0T3JnT0F1dGhBcHBJbnB1dBIbCgtyZXNvdXJjZV9pZBgBIAEoCUIGukgDyAEBEhQKA29yZxgCIAEoCUIHukgEcgIQASJVChRHZXRPcmdPQXV0aEFwcE91dHB1dBIUCgxoYXNfb3ZlcnJpZGUYASABKAgSFAoMb2F1dGhfYXBwX2lkGAIgASgJEhEKCWNsaWVudF9pZBgDIAEoCSJLChZEZWxldGVPcmdPQXV0aEFwcElucHV0EhsKC3Jlc291cmNlX2lkGAEgASgJQga6SAPIAQESFAoDb3JnGAIgASgJQge6SARyAhABIioKF0RlbGV0ZU9yZ09BdXRoQXBwT3V0cHV0Eg8KB2RlbGV0ZWQYASABKAgq7QEKFU9BdXRoQ29ubmVjdGlvbkhlYWx0aBInCiNPQVVUSF9DT05ORUNUSU9OX0hFQUxUSF9VTlNQRUNJRklFRBAAEiMKH09BVVRIX0NPTk5FQ1RJT05fSEVBTFRIX0hFQUxUSFkQARIpCiVPQVVUSF9DT05ORUNUSU9OX0hFQUxUSF9UT0tFTl9FWFBJUkVEEAISNQoxT0FVVEhfQ09OTkVDVElPTl9IRUFMVEhfVE9LRU5fRVhQSVJFRF9SRUZSRVNIQUJMRRADEiQKIE9BVVRIX0NPTk5FQ1RJT05fSEVBTFRIX05PX0dSQU5UEARiBnByb3RvMw",[file_ai_stigmer_agentic_executioncontext_v1_spec,file_buf_validate_validate]);var InitiateOAuthConnectOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,3);var CompleteOAuthConnectOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,5);var GetOAuthGrantStatusOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,7);var DisconnectOAuthOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,9);var OAuthConnectionHealth;(function(OAuthConnectionHealth2){OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_UNSPECIFIED=0]="OAUTH_CONNECTION_HEALTH_UNSPECIFIED",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_HEALTHY=1]="OAUTH_CONNECTION_HEALTH_HEALTHY",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED=2]="OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED_REFRESHABLE=3]="OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED_REFRESHABLE",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_NO_GRANT=4]="OAUTH_CONNECTION_HEALTH_NO_GRANT"})(OAuthConnectionHealth||(OAuthConnectionHealth={}));var file_ai_stigmer_agentic_mcpserver_v1_command=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL2NvbW1hbmQucHJvdG8SH2FpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEynREKGk1jcFNlcnZlckNvbW1hbmRDb250cm9sbGVyEl8KBWFwcGx5EiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchKwAQoGY3JlYXRlEiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciJOwrgYSggrEB4iDG1ldGFkYXRhLm9yZyo2dW5hdXRob3JpemVkIHRvIGNyZWF0ZSBtY3Agc2VydmVyIGluIHRoaXMgb3JnYW5pemF0aW9uEpoBCgZ1cGRhdGUSKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIjjCuBg0CAIQLCILbWV0YWRhdGEuaWQqIXVuYXV0aG9yaXplZCB0byB1cGRhdGUgbWNwIHNlcnZlchKmAQoGZGVsZXRlEjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlRGVsZXRlSW5wdXQaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciI4wrgYNAgDECwiC3Jlc291cmNlX2lkKiF1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG1jcCBzZXJ2ZXISugEKEHVwZGF0ZVZpc2liaWxpdHkSNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuVXBkYXRlVmlzaWJpbGl0eUlucHV0GiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIiQ8K4GD8IAhAsIgtyZXNvdXJjZV9pZCosdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBtY3Agc2VydmVyIHZpc2liaWxpdHkSpAEKB2Nvbm5lY3QSLS5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkNvbm5lY3RJbnB1dBoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIj7CuBg6CBYQLCINbWNwX3NlcnZlcl9pZColdW5hdXRob3JpemVkIHRvIGNvbm5lY3QgdG8gbWNwIHNlcnZlchKpAQoMc3RhcnRDb25uZWN0Ei0uYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Db25uZWN0SW5wdXQaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciI+wrgYOggWECwiDW1jcF9zZXJ2ZXJfaWQqJXVuYXV0aG9yaXplZCB0byBjb25uZWN0IHRvIG1jcCBzZXJ2ZXIS3wEKFGluaXRpYXRlT0F1dGhDb25uZWN0EjouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Jbml0aWF0ZU9BdXRoQ29ubmVjdElucHV0GjsuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Jbml0aWF0ZU9BdXRoQ29ubmVjdE91dHB1dCJOwrgYSggWECwiDW1jcF9zZXJ2ZXJfaWQqNXVuYXV0aG9yaXplZCB0byBpbml0aWF0ZSBvYXV0aCBjb25uZWN0IGZvciBtY3Agc2VydmVyEt8BChRjb21wbGV0ZU9BdXRoQ29ubmVjdBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuQ29tcGxldGVPQXV0aENvbm5lY3RJbnB1dBo7LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuQ29tcGxldGVPQXV0aENvbm5lY3RPdXRwdXQiTsK4GEoIFhAsIg1tY3Bfc2VydmVyX2lkKjV1bmF1dGhvcml6ZWQgdG8gY29tcGxldGUgb2F1dGggY29ubmVjdCBmb3IgbWNwIHNlcnZlchLIAQoPZGlzY29ubmVjdE9BdXRoEjUuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5EaXNjb25uZWN0T0F1dGhJbnB1dBo2LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuRGlzY29ubmVjdE9BdXRoT3V0cHV0IkbCuBhCCBYQLCILcmVzb3VyY2VfaWQqL3VuYXV0aG9yaXplZCB0byBkaXNjb25uZWN0IG9hdXRoIGZvciBtY3Agc2VydmVyErgBCg5zZXRPcmdPQXV0aEFwcBI0LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuU2V0T3JnT0F1dGhBcHBJbnB1dBo1LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuU2V0T3JnT0F1dGhBcHBPdXRwdXQiOcK4GDUIFxAeIgNvcmcqKnVuYXV0aG9yaXplZCB0byBzZXQgb3JnIG9hdXRoIGFwcCBvdmVycmlkZRLEAQoRZGVsZXRlT3JnT0F1dGhBcHASNy5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkRlbGV0ZU9yZ09BdXRoQXBwSW5wdXQaOC5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkRlbGV0ZU9yZ09BdXRoQXBwT3V0cHV0IjzCuBg4CBcQHiIDb3JnKi11bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG9yZyBvYXV0aCBhcHAgb3ZlcnJpZGUaBKD/KyxiBnByb3RvMw",[file_ai_stigmer_agentic_mcpserver_v1_api,file_ai_stigmer_agentic_mcpserver_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),McpServerCommandController=serviceDesc(file_ai_stigmer_agentic_mcpserver_v1_command,0);var file_ai_stigmer_agentic_mcpserver_v1_query=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL3F1ZXJ5LnByb3RvEh9haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxMssFChhNY3BTZXJ2ZXJRdWVyeUNvbnRyb2xsZXISkgEKA2dldBItLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUlkGiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIiMMK4GCwIARAsIgV2YWx1ZSofdW5hdXRob3JpemVkIHRvIHZpZXcgbWNwIHNlcnZlchJ4Cg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIgTQuBgBEtUBChNnZXRPQXV0aEdyYW50U3RhdHVzEjkuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5HZXRPQXV0aEdyYW50U3RhdHVzSW5wdXQaOi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkdldE9BdXRoR3JhbnRTdGF0dXNPdXRwdXQiR8K4GEMIARAsIgtyZXNvdXJjZV9pZCowdW5hdXRob3JpemVkIHRvIHZpZXcgb2F1dGggc3RhdHVzIGZvciBtY3Agc2VydmVyEsEBCg5nZXRPcmdPQXV0aEFwcBI0LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuR2V0T3JnT0F1dGhBcHBJbnB1dBo1LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuR2V0T3JnT0F1dGhBcHBPdXRwdXQiQsK4GD4IARAsIgtyZXNvdXJjZV9pZCordW5hdXRob3JpemVkIHRvIHZpZXcgb3JnIG9hdXRoIGFwcCBvdmVycmlkZRoEoP8rLGIGcHJvdG8z",[file_ai_stigmer_agentic_mcpserver_v1_api,file_ai_stigmer_agentic_mcpserver_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),McpServerQueryController=serviceDesc(file_ai_stigmer_agentic_mcpserver_v1_query,0);async function completeOAuthConnect(deps,input,identity2){let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");let stateParam=input.state;if(stateParam==="")throw invalidArgumentError("state is required");let code=input.authorizationCode;if(code==="")throw invalidArgumentError("authorization_code is required");let pendingState;try{pendingState=await deps.pendingOAuthStates.getAndDelete(stateParam)}catch(error2){throw internalError(error2,"failed to load pending OAuth state")}if(pendingState===void 0)throw failedPreconditionError("no pending OAuth state found for the given state parameter (expired or already used)");if(pendingState.mcpServerId!==mcpServerId)throw failedPreconditionError("state parameter does not match the requested mcp_server_id");await authorizeDirect(McpServerCommandController.method.completeOAuthConnect,deps.authorizer,identity2,input,{resourceId:pendingState.mcpServerId});try{pendingState=await unsealPendingOAuthState(deps.secretService,pendingState)}catch(error2){throw deps.logger.error("Failed to decrypt pending OAuth state secrets",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to decrypt OAuth handshake secrets \u2014 please retry the connect flow")}let tokenResponse;try{tokenResponse=await exchangeCode(pendingState.tokenEndpoint,code,pendingState.redirectUri,pendingState.codeVerifier,pendingState.clientId,pendingState.clientSecret,pendingState.tokenAuthMethod,deps.outboundFetch)}catch(error2){throw unavailableError(`token exchange failed: ${error2 instanceof Error?error2.message:String(error2)}`)}let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}let org=pendingState.org;org===""&&(org=mcpServer.metadata?.org??"");let managedEnvId=await resolveOrCreateManagedEnvironment(deps,pendingState.identityAccountId,mcpServerId,org,mcpServer.metadata?.name??"",identity2),tokenVars={[pendingState.targetEnvVar]:create2(EnvironmentValueSchema,{value:tokenResponse.accessToken,isSecret:!0})},refreshTokenEnvVar=`${pendingState.targetEnvVar}_REFRESH_TOKEN`;tokenResponse.refreshToken!==""&&(tokenVars[refreshTokenEnvVar]=create2(EnvironmentValueSchema,{value:tokenResponse.refreshToken,isSecret:!0}));try{await deps.managedEnv.updateSecrets(managedEnvId,tokenVars)}catch(error2){throw internalError(error2,"failed to store OAuth tokens in managed environment")}let expiresAt=0;tokenResponse.expiresIn>0&&(expiresAt=Math.floor(Date.now()/1e3)+tokenResponse.expiresIn);try{await deps.oauthGrants.upsert({identityAccountId:pendingState.identityAccountId,resourceId:mcpServerId,resourceKind:"mcp_server",orgId:org,accessTokenExpiresAt:expiresAt,clientId:pendingState.clientId,authMethod:pendingState.authMethod,tokenEndpoint:pendingState.tokenEndpoint,accessTokenEnvVar:pendingState.targetEnvVar,refreshTokenEnvVar,environmentId:managedEnvId,createdAt:0,updatedAt:0})}catch(error2){throw internalError(error2,"failed to create OAuth grant record")}let auth=mcpServer.spec?.auth;return deps.logger.info("OAuth Connect completed: tokens stored in managed environment",{mcp_server_id:mcpServerId,auth_method:pendingState.authMethod,target_env_var:pendingState.targetEnvVar,managed_env_id:managedEnvId,expires_at:expiresAt,has_refresh_token:tokenResponse.refreshToken!==""}),create2(CompleteOAuthConnectOutputSchema,{connected:!0,targetEnvVar:pendingState.targetEnvVar,tokenLifetimeHint:auth?.tokenLifetimeHint??""})}async function unsealPendingOAuthState(secretService,state2){let verifier;try{verifier=await secretService.decrypt(state2.codeVerifier)}catch(error2){throw new Error(`failed to decrypt code_verifier: ${error2 instanceof Error?error2.message:String(error2)}`)}let secret;try{secret=await secretService.decrypt(state2.clientSecret)}catch(error2){throw new Error(`failed to decrypt client_secret: ${error2 instanceof Error?error2.message:String(error2)}`)}return{...state2,codeVerifier:verifier,clientSecret:secret}}async function resolveOrCreateManagedEnvironment(deps,identityAccountId,mcpServerId,org,mcpServerName,caller){let existingGrant;try{existingGrant=await deps.oauthGrants.find(identityAccountId,mcpServerId,org)}catch(error2){deps.logger.warn("Failed to look up existing OAuth grant (non-fatal, will create new managed env)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}if(existingGrant!==void 0&&existingGrant.environmentId!=="")return deps.logger.info("Reusing existing managed environment for OAuth re-connect",{mcp_server_id:mcpServerId,environment_id:existingGrant.environmentId}),existingGrant.environmentId;let envName=`OAuth: ${mcpServerName}`;try{return await deps.managedEnv.createManagedEnvironment(envName,org,caller)}catch(error2){throw internalError(error2,"failed to create managed environment for OAuth tokens")}}function convertToDiscoveredCapabilities(output){let capabilities=create2(DiscoveredCapabilitiesSchema,{lastDiscoveredAt:timestampNow()});for(let t of output.tools??[]){let tool=create2(DiscoveredToolSchema,{name:t.name??"",description:t.description??""});t.input_schema!==void 0&&(tool.inputSchema=t.input_schema),capabilities.tools.push(tool)}for(let rt of output.resource_templates??[])capabilities.resourceTemplates.push(create2(DiscoveredResourceTemplateSchema,{uriTemplate:rt.uri_template??"",name:rt.name??"",description:rt.description??"",mimeType:rt.mime_type??""}));return capabilities}function convertToToolApprovals(output){let approvals=[];for(let a5 of output.tool_approvals??[])a5.requires_approval!==!0||(a5.tool_name??"")===""||approvals.push(create2(ToolApprovalPolicySchema,{toolName:a5.tool_name,message:a5.message??"",fromDestructiveHint:a5.from_destructive_hint??!1}));return approvals}function setToolApprovalsFromConnect(status,output){let approvals=convertToToolApprovals(output);return approvals.length>0&&(status.toolApprovals=approvals),approvals.length}function settleConnectStatus(mcpStatus,workflowId,failure){let cs=mcpStatus.connectStatus;if(cs===void 0&&(cs=create2(ConnectStatusSchema),mcpStatus.connectStatus=cs),cs.workflowId=workflowId,cs.finishedAt=timestampNow(),cs.warning="",failure===void 0){cs.phase=ConnectPhase.succeeded,cs.failureCode="",cs.failureMessage="";return}cs.phase=ConnectPhase.failed,cs.failureCode=grpcCodeName(failure.code),cs.failureMessage=failure.rawMessage}async function persistConnectResult(store,mcpServerId,workflowId,output){let toolApprovalCount=0;return{persisted:await store.updateResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema,mcpServer=>{mcpServer.status===void 0&&(mcpServer.status=create2(McpServerStatusSchema)),mcpServer.status.discoveredCapabilities=convertToDiscoveredCapabilities(output),toolApprovalCount=setToolApprovalsFromConnect(mcpServer.status,output),settleConnectStatus(mcpServer.status,workflowId,void 0)}),toolApprovalCount}}async function persistConnectStarting(store,mcpServerId,workflowId,warning2){return store.updateResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema,mcpServer=>{mcpServer.status===void 0&&(mcpServer.status=create2(McpServerStatusSchema)),mcpServer.status.connectStatus=create2(ConnectStatusSchema,{phase:ConnectPhase.connecting,workflowId,startedAt:timestampNow(),warning:warning2})})}async function persistConnectFailure(store,logger2,mcpServerId,failure){try{await store.updateResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema,mcpServer=>{mcpServer.status===void 0&&(mcpServer.status=create2(McpServerStatusSchema)),settleConnectStatus(mcpServer.status,mcpServer.status.connectStatus?.workflowId??"",failure)})}catch(error2){if(error2 instanceof ResourceNotFoundError){logger2.info("Skipping connect failure persistence: MCP server deleted before connect settled",{mcp_server_id:mcpServerId});return}logger2.warn("Failed to record connect failure on connect_status (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}}var CONNECT_TIMEOUT={ms:42e4,goLabel:"7m0s"},ASYNC_CONNECT_TIMEOUT={ms:3600*1e3,goLabel:"1h0m0s"},BEST_EFFORT_CONNECT_GET_BUFFER_MS=15e3;async function connect(deps,input,identity2){let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");if(input.org==="")throw invalidArgumentError("org is required for connect");let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}await authorizeDirect(McpServerCommandController.method.connect,deps.authorizer,identity2,input);let engineState=deps.engineState();if(!engineState.connected)throw failedPreconditionError("connect is not available: Temporal not configured");let prepared=await prepareConnect(deps,mcpServer,input,identity2);try{let run;try{run=await engineState.engine.startOrAttachConnect(mcpServerId,prepared.workflowInput,CONNECT_TIMEOUT.ms)}catch(error2){throw deps.logger.error("Failed to start MCP connect workflow",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to start connect workflow")}if(!run.attached)try{await persistConnectStarting(deps.store,mcpServerId,run.workflowId,"")}catch(error2){deps.logger.warn("Failed to record CONNECTING on connect_status (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}let outcome=await run.result(CONNECT_TIMEOUT.ms+BEST_EFFORT_CONNECT_GET_BUFFER_MS);if(!outcome.ok){let failure=mapConnectFailure(deps.logger,mcpServer,run.workflowId,outcome.failure,CONNECT_TIMEOUT);throw await persistConnectFailure(deps.store,deps.logger,mcpServerId,failure),failure}let persisted,toolApprovalCount;try{({persisted,toolApprovalCount}=await persistConnectResult(deps.store,mcpServerId,run.workflowId,outcome.output))}catch(error2){throw internalError(error2,"failed to save mcp server after connect")}return deps.logger.info("MCP server connect completed and stored",{mcp_server_id:mcpServerId,tools:persisted.status?.discoveredCapabilities?.tools.length??0,resource_templates:persisted.status?.discoveredCapabilities?.resourceTemplates.length??0,tool_approvals:toolApprovalCount}),persisted}finally{prepared.ecResourceId!==""&&await deleteConnectExecutionContext(deps,prepared.ecResourceId,prepared.executionId)}}async function prepareConnect(deps,mcpServer,input,identity2){let mcpServerId=mcpServer.metadata?.id??"",callerOrg=input.org;Object.keys(input.runtimeEnv).length===0&&await refreshOAuthTokenIfNeeded(deps,mcpServer,callerOrg);let executionId=newConnectExecutionId(mcpServerId),ecResourceId=await createConnectExecutionContext(deps,mcpServer,executionId,callerOrg,input.runtimeEnv,identity2),workflowInput={mcp_server_id:mcpServerId,...ecResourceId!==""?{execution_context_id:executionId}:{}};if(ecResourceId!==""&&deps.runnerAuth.isEnabled(TOKEN_TYPE_EXECUTION_SCOPED))try{let minted=deps.runnerAuth.mint(TOKEN_TYPE_EXECUTION_SCOPED,executionId,0);return{workflowInput:{...workflowInput,execution_context_token:minted.token},ecResourceId,executionId}}catch(error2){deps.logger.warn("Failed to mint connect EC token \u2014 discovery will read redacted credentials",{execution_id:executionId,error:error2 instanceof Error?error2.message:String(error2)})}return{workflowInput,ecResourceId,executionId}}async function createConnectExecutionContext(deps,mcpServer,executionId,callerOrg,runtimeEnv,caller){let ecData;if(Object.keys(runtimeEnv).length>0)ecData=runtimeEnv,deps.logger.info("Using runtime_env for connect ExecutionContext (one-time use)",{execution_id:executionId,runtime_env_count:Object.keys(runtimeEnv).length});else{let envDecls=mcpServer.spec?.env??{};if(Object.keys(envDecls).length===0)return deps.logger.debug("MCP server has no env declarations \u2014 skipping ExecutionContext creation",{execution_id:executionId}),"";let mcpServerId=mcpServer.metadata?.id??"",{oauthVars,remainingDecls}=await resolveOAuthVarsFromManagedEnv(deps,mcpServerId,callerOrg,envDecls),personalVars={};Object.keys(remainingDecls).length>0&&(personalVars=await resolveFromPersonalEnvironment(deps,callerOrg,remainingDecls)),ecData={...personalVars,...oauthVars},deps.logger.info("Resolved env vars for connect ExecutionContext",{execution_id:executionId,oauth_count:Object.keys(oauthVars).length,personal_count:Object.keys(personalVars).length})}if(Object.keys(ecData).length===0)return"";let created;try{created=await deps.executionContext.create(create2(ExecutionContextSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"ExecutionContext",metadata:{name:`exec-ctx-${executionId}`,org:callerOrg},spec:{executionId,data:ecData}}),caller)}catch(error2){throw internalError(error2,"failed to create connect ExecutionContext")}let resourceId=created.metadata?.id??"";return deps.logger.info("Created ephemeral ExecutionContext for MCP connect",{execution_context_id:resourceId,execution_id:executionId,data_entries:Object.keys(ecData).length}),resourceId}async function resolveOAuthVarsFromManagedEnv(deps,mcpServerId,org,envDecls){let grant;try{grant=await deps.oauthGrants.find("",mcpServerId,org)}catch{return{oauthVars:{},remainingDecls:envDecls}}if(grant===void 0||grant.environmentId==="")return{oauthVars:{},remainingDecls:envDecls};let oauthKey=grant.accessTokenEnvVar;if(!(oauthKey in envDecls))return{oauthVars:{},remainingDecls:envDecls};let tokenValue="";try{tokenValue=await deps.managedEnv.readSecretValue(grant.environmentId,oauthKey)}catch(error2){return deps.logger.warn("Failed to read OAuth token from managed environment \u2014 falling back to personal env",{mcp_server_id:mcpServerId,oauth_key:oauthKey,managed_env_id:grant.environmentId,error:error2 instanceof Error?error2.message:String(error2)}),{oauthVars:{},remainingDecls:envDecls}}if(tokenValue==="")return deps.logger.warn("Failed to read OAuth token from managed environment \u2014 falling back to personal env",{mcp_server_id:mcpServerId,oauth_key:oauthKey,managed_env_id:grant.environmentId}),{oauthVars:{},remainingDecls:envDecls};let remainingDecls={};for(let[k5,v]of Object.entries(envDecls))k5!==oauthKey&&(remainingDecls[k5]=v);return deps.logger.debug("Resolved OAuth token from managed environment",{mcp_server_id:mcpServerId,oauth_key:oauthKey,managed_env_id:grant.environmentId}),{oauthVars:{[oauthKey]:create2(ExecutionValueSchema,{value:tokenValue,isSecret:!0})},remainingDecls}}async function resolveFromPersonalEnvironment(deps,org,envDecls){let resolution=await resolveDeclaredFromPersonalEnvironment(deps.environmentReader,deps.logger,org,envDecls);if(resolution.kind==="no-personal-environment"){let requiredKeys=Object.entries(envDecls).filter(([,decl])=>!decl.optional).map(([key])=>key);if(requiredKeys.length===0)return{};throw failedPreconditionError(`personal environment not found for org '${org}'; save required credentials first: [${requiredKeys.join(" ")}]`)}if(resolution.missing.length>0)throw failedPreconditionError(`missing required credentials in personal environment: [${resolution.missing.join(" ")}]`);return{...resolution.values}}async function deleteConnectExecutionContext(deps,resourceId,executionId){try{await deps.executionContext.delete({resourceId})}catch(error2){deps.logger.warn("Failed to delete connect ExecutionContext (non-fatal)",{resource_id:resourceId,execution_id:executionId,error:error2 instanceof Error?error2.message:String(error2)});return}deps.logger.debug("Deleted ephemeral connect ExecutionContext",{resource_id:resourceId,execution_id:executionId})}function mapConnectFailure(logger2,mcpServer,workflowId,failure,budget){let mcpServerId=mcpServer.metadata?.id??"";switch(logger2.error("MCP connect workflow failed",{workflow_id:workflowId,mcp_server_id:mcpServerId,failure_kind:failure.kind}),failure.kind){case"application":return failedPreconditionError(buildConnectFailureMessage(mcpServer,failure.message));case"timeout":return new ConnectError(`connect did not complete within the ${budget.goLabel} budget for MCP server '${mcpServerId}' \u2014 if this repeats, check that your runner is running and healthy`,Code.DeadlineExceeded);case"service-not-found":return unavailableError(`connect service temporarily unavailable for MCP server '${mcpServerId}'`);case"other":return new ConnectError(buildConnectFailureMessage(mcpServer,failure.message),Code.Internal);default:{let exhaustive=failure;throw new Error(`unhandled connect failure ${String(exhaustive)}`)}}}function buildConnectFailureMessage(mcpServer,cause){let name=mcpServer.metadata?.name??"";if(cause.includes("requires OAuth"))return cause;if(mcpServer.spec?.serverType.case==="stdio"){let slug=mcpServer.metadata?.slug??"";return`connect failed for MCP server '${name}': ${cause}. This is a stdio server launched by your local runner \u2014 verify the command is installed and its arguments and environment variables are correct. Preview discovery locally with: stigmer connect mcp-server ${slug} --dry-run`}return`connect failed for MCP server '${name}': ${cause}. Check that the server URL is reachable and your credentials are valid.`}async function refreshOAuthTokenIfNeeded(deps,mcpServer,callerOrg){if(mcpServer.spec?.auth===void 0)return;let mcpServerId=mcpServer.metadata?.id??"",grant;try{grant=await deps.oauthGrants.find("",mcpServerId,callerOrg)}catch(error2){deps.logger.warn("Failed to load OAuth grant for pre-flight check (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}if(grant===void 0)return;if(grant.environmentId===""){deps.logger.warn("OAuth grant has no managed environment ID \u2014 user must re-authenticate via OAuth Connect",{mcp_server_id:mcpServerId});return}let refreshTokenValue;try{refreshTokenValue=await deps.managedEnv.readSecretValue(grant.environmentId,grant.refreshTokenEnvVar)}catch(error2){deps.logger.debug("No refresh token found in managed environment (may not be OAuth-connected)",{mcp_server_id:mcpServerId,refresh_token_var:grant.refreshTokenEnvVar,managed_env_id:grant.environmentId,error:error2 instanceof Error?error2.message:String(error2)});return}let clientSecret="",tokenAuthMethod="";if(grant.authMethod==="vendor_oauth")try{({clientSecret,tokenAuthMethod}=await loadOAuthAppClientCredentials(deps,mcpServer))}catch(error2){deps.logger.warn("Failed to load OAuthApp client secret for refresh",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}let result;try{result=await refreshTokenIfExpired(grant,refreshTokenValue,clientSecret,tokenAuthMethod,deps.logger,deps.outboundFetch)}catch(error2){throw failedPreconditionError(error2 instanceof Error?error2.message:String(error2))}if(!result.refreshed)return;let tokenVars={[grant.accessTokenEnvVar]:create2(EnvironmentValueSchema,{value:result.newAccessToken,isSecret:!0})};result.newRefreshToken!==refreshTokenValue&&(tokenVars[grant.refreshTokenEnvVar]=create2(EnvironmentValueSchema,{value:result.newRefreshToken,isSecret:!0}));try{await deps.managedEnv.updateSecrets(grant.environmentId,tokenVars)}catch(error2){throw internalError(error2,"failed to update refreshed tokens in managed environment")}try{await deps.oauthGrants.upsert({...grant,accessTokenExpiresAt:result.newExpiresAt})}catch(error2){deps.logger.warn("Failed to update OAuth grant after refresh (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}}async function loadOAuthAppClientCredentials(deps,mcpServer){let ref=mcpServer.spec?.auth?.oauthAppRef;if(ref===void 0||ref.slug==="")return{clientSecret:"",tokenAuthMethod:""};let app;try{app=await resolveOAuthAppRef(deps.store,ref,deps.logger)}catch(error2){throw new Error(`failed to list oauth apps: ${error2 instanceof Error?error2.message:String(error2)}`)}if(app===void 0)throw new Error(`OAuthApp '${ref.slug}' not found`);let tokenAuthMethod=tokenAuthMethodFromSpec(app.spec?.tokenEndpointAuthMethod??TokenEndpointAuthMethod.UNSPECIFIED),secret=app.spec?.clientSecret??"";return deps.secretService.isEncrypted(secret)&&(secret=await deps.secretService.decrypt(secret)),{clientSecret:secret,tokenAuthMethod}}function tokenAuthMethodFromSpec(method){return method===TokenEndpointAuthMethod.CLIENT_SECRET_POST?TOKEN_AUTH_METHOD_POST:TOKEN_AUTH_METHOD_BASIC}async function startBestEffortConnect(deps,mcpServer){let engineState=deps.engineState();if(!engineState.connected)return;let envKeys=Object.keys(mcpServer.spec?.env??{}).length;if(envKeys>0){deps.logger.debug("Skipping best-effort auto-connect: MCP server has env declarations (requires manual connect)",{mcp_server_id:mcpServer.metadata?.id??"",env_keys:envKeys});return}let mcpServerId=mcpServer.metadata?.id??"",run;try{run=await engineState.engine.startOrAttachConnect(mcpServerId,{mcp_server_id:mcpServerId},CONNECT_TIMEOUT.ms)}catch(error2){deps.logger.warn("Failed to start best-effort connect workflow (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}if(!run.attached)try{await persistConnectStarting(deps.store,mcpServerId,run.workflowId,"")}catch(error2){deps.logger.warn("Failed to record CONNECTING for best-effort connect (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}let outcome=await run.result(CONNECT_TIMEOUT.ms+BEST_EFFORT_CONNECT_GET_BUFFER_MS);if(!outcome.ok){let failure=mapConnectFailure(deps.logger,mcpServer,run.workflowId,outcome.failure,CONNECT_TIMEOUT);await persistConnectFailure(deps.store,deps.logger,mcpServerId,failure);return}let persisted,toolApprovalCount;try{({persisted,toolApprovalCount}=await persistConnectResult(deps.store,mcpServerId,run.workflowId,outcome.output))}catch(error2){if(error2 instanceof ResourceNotFoundError){deps.logger.info("Skipping best-effort connect persistence: MCP server deleted before connect completed",{mcp_server_id:mcpServerId});return}deps.logger.warn("Failed to persist best-effort connect result (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}deps.logger.info("Best-effort auto-connect completed and stored",{workflow_id:run.workflowId,mcp_server_id:mcpServerId,tools:persisted.status?.discoveredCapabilities?.tools.length??0,resource_templates:persisted.status?.discoveredCapabilities?.resourceTemplates.length??0,tool_approvals:toolApprovalCount})}async function disconnectOAuth(deps,input,identity2){let resourceId=input.resourceId;if(resourceId==="")throw invalidArgumentError("resource_id is required");let org=input.org;if(org==="")throw invalidArgumentError("org is required");await authorizeDirect(McpServerCommandController.method.disconnectOAuth,deps.authorizer,identity2,input);let grant;try{grant=await deps.oauthGrants.find("",resourceId,org)}catch(error2){throw internalError(error2,"failed to look up OAuth grant")}if(grant===void 0)return deps.logger.debug("No OAuth grant to disconnect",{resource_id:resourceId,org}),create2(DisconnectOAuthOutputSchema,{disconnected:!1});let envId=grant.environmentId;if(envId!=="")try{await deps.managedEnv.deleteManagedEnvironment(envId)}catch(error2){deps.logger.warn("Failed to delete managed environment \u2014 may already be deleted",{resource_id:resourceId,environment_id:envId,error:error2 instanceof Error?error2.message:String(error2)})}try{await deps.oauthGrants.delete("",resourceId,org)}catch(error2){throw internalError(error2,"failed to delete OAuth grant")}return deps.logger.info("OAuth connection disconnected",{resource_id:resourceId,org,env_deleted:envId!==""}),create2(DisconnectOAuthOutputSchema,{disconnected:!0})}function isOAuthChallenge(wwwAuthenticate){let value=wwwAuthenticate.toLowerCase();return value.includes("bearer")?value.includes("oauth")||value.includes("resource_metadata"):!1}function parseResourceMetadataUrl(wwwAuthenticate){return/resource_metadata="([^"]+)"/i.exec(wwwAuthenticate)?.[1]}function protectedResourceMetadataUrls(resource){let bare=`${resource.origin}/.well-known/oauth-protected-resource`,path14=resource.pathname.replace(/\/+$/,"");return path14===""?[bare]:[`${bare}${path14}`,bare]}function authorizationServerMetadataUrls(issuer){let path14=issuer.pathname.replace(/\/+$/,""),urls=[...path14===""?[]:[`${issuer.origin}/.well-known/oauth-authorization-server${path14}`],`${issuer.origin}/.well-known/oauth-authorization-server`,...path14===""?[]:[`${issuer.origin}${path14}/.well-known/openid-configuration`],`${issuer.origin}/.well-known/openid-configuration`];return[...new Set(urls)]}async function resolveAuthorizationServers(resourceUrl,pointer,deps){let attempts=[],candidates=pointer!==void 0?[pointer]:protectedResourceMetadataUrls(new URL(resourceUrl));for(let candidate of candidates){let read3=await readJson(candidate,deps,attempts);if(read3===void 0)continue;let issuers=readStringArray(read3,"authorization_servers");if(issuers.length>0)return{issuers,attempts}}return{issuers:[],attempts}}async function readAuthorizationServerMetadata(issuer,deps){let attempts=[],parsed;try{parsed=new URL(issuer)}catch{return{kind:"not-found",attempts}}for(let metadataUrl of authorizationServerMetadataUrls(parsed)){let document2=await readJson(metadataUrl,deps,attempts);if(document2===void 0)continue;let authorizationEndpoint=readString(document2,"authorization_endpoint"),tokenEndpoint=readString(document2,"token_endpoint");if(authorizationEndpoint===""||tokenEndpoint===""){let last=attempts.pop();last!==void 0&&attempts.push({...last,missing:authorizationEndpoint===""?"authorization_endpoint":"token_endpoint"});continue}return{kind:"found",attempts,metadata:{metadataUrl,issuer:readString(document2,"issuer"),authorizationEndpoint,tokenEndpoint,registrationEndpoint:readString(document2,"registration_endpoint"),scopesSupported:readStringArray(document2,"scopes_supported"),codeChallengeMethodsSupported:readStringArray(document2,"code_challenge_methods_supported")}}}return{kind:"not-found",attempts}}async function readJson(url,deps,attempts){let response;try{response=await deps.fetchImpl(url,{method:"GET",headers:{Accept:"application/json"},signal:AbortSignal.timeout(deps.timeoutMs)})}catch(error2){attempts.push({url,error:error2 instanceof Error?error2.message:String(error2)});return}if(attempts.push({url,status:response.status}),response.status!==200){await response.body?.cancel().catch(()=>{});return}try{let parsed=await response.json();return isRecord(parsed)?parsed:void 0}catch{return}}function readString(record2,key){let value=record2[key];return typeof value=="string"?value:""}function readStringArray(record2,key){let list12=record2[key];return Array.isArray(list12)?list12.filter(item=>typeof item=="string"):[]}function isRecord(value){return typeof value=="object"&&value!==null&&!Array.isArray(value)}var MCP_PROTOCOL_VERSION="2025-06-18";function baseHeaders(headers2){return{"Content-Type":"application/json",Accept:"application/json, text/event-stream","MCP-Protocol-Version":MCP_PROTOCOL_VERSION,...headers2??{}}}function initializeRequest(clientName,headers2){return{method:"POST",headers:baseHeaders(headers2),body:JSON.stringify({jsonrpc:"2.0",id:1,method:"initialize",params:{protocolVersion:MCP_PROTOCOL_VERSION,capabilities:{},clientInfo:{name:clientName,version:"0"}}})}}async function probeEndpointAuth(url,headers2,deps){let request=initializeRequest(deps.clientName,headers2),response;try{response=await deps.fetchImpl(url,{method:request.method,headers:{...request.headers},body:request.body,signal:AbortSignal.timeout(deps.timeoutMs)})}catch(error2){return{kind:"unreachable",error:describeError(error2)}}if(await response.body?.cancel().catch(()=>{}),response.status===401){let challenge=response.headers.get("www-authenticate")??"";return isOAuthChallenge(challenge)?{kind:"oauth",challenge,resourceMetadataUrl:parseResourceMetadataUrl(challenge)}:{kind:"challenge-not-oauth",challenge}}return response.status>=200&&response.status<300?{kind:"accepted",status:response.status}:{kind:"http-other",status:response.status}}function describeError(error2){return error2 instanceof Error?`${error2.name}: ${error2.message}`:String(error2)}var ENDPOINT_PROBE_TIMEOUT_MS=3e3,PROBE_CLIENT_NAME="stigmer-server",ACCESS_TOKEN_VAR_SUFFIX="_ACCESS_TOKEN",AUTHORIZATION_HEADER="authorization";function newCompleteEndpointAuthStep(deps){return{name:"CompleteEndpointAuth",async execute(ctx){let server=ctx.newState,spec=server.spec;if(spec===void 0)return;applyTokenPathDefault(spec,server.metadata?.slug??"");let existing=ctx.get(EXISTING_RESOURCE_KEY),derived=existing!==void 0?derivedCompletionOf(existing):void 0,url=authorShapeUrl(spec);if(url===void 0){derived!==void 0&&echoesDerived(spec,derived)?stamp(ctx,server):dropLabel(server);return}if(derived!==void 0&&derived.url===url){applyCompletion(spec,derived.variable,derived.description),stamp(ctx,server);return}if(await probe(url,spec,deps)!=="oauth"){dropLabel(server);return}let variable=accessTokenVariable(server.metadata?.slug??"");applyCompletion(spec,variable,tokenDescription(server.metadata?.slug??"")),stamp(ctx,server)}}}function authorShapeUrl(spec){if(spec.serverType.case==="http"&&spec.auth===void 0&&!(Object.keys(spec.env).length>0)){for(let[name,value]of Object.entries(spec.serverType.value.headers))if(name.toLowerCase()===AUTHORIZATION_HEADER||value.includes("${"))return;return spec.serverType.value.url}}function derivedCompletionOf(existing){if(existing.metadata?.labels[MCP_AUTH_LABEL]!==MCP_AUTH_ENDPOINT)return;let spec=existing.spec;if(spec===void 0||spec.serverType.case!=="http")return;let variable=spec.auth?.targetEnvVar??"";if(variable!=="")return{url:spec.serverType.value.url,variable,description:spec.env[variable]?.description??""}}function echoesDerived(spec,derived){if(spec.serverType.case!=="http"||spec.serverType.value.url!==derived.url)return!1;let auth=spec.auth;if(auth===void 0||auth.targetEnvVar!==derived.variable||!auth.oauthOnly||(auth.oauthAppRef?.slug??"")!==""||auth.discoveryUrl!==""||auth.scopeHints.length>0||auth.tokenLifetimeHint!=="")return!1;let envKeys=Object.keys(spec.env);if(envKeys.length!==1||envKeys[0]!==derived.variable)return!1;let declaration=spec.env[derived.variable];if(declaration===void 0||!declaration.isSecret||declaration.optional)return!1;let headers2=Object.entries(spec.serverType.value.headers),authorization=headers2.filter(([name])=>name.toLowerCase()===AUTHORIZATION_HEADER);return authorization.length!==1||authorization[0]?.[1]!==bearerHeader(derived.variable)?!1:headers2.every(([name,value])=>name.toLowerCase()===AUTHORIZATION_HEADER||!value.includes("${"))}function applyCompletion(spec,variable,description){spec.auth=create2(McpServerAuthSchema,{targetEnvVar:variable,oauthOnly:!0}),spec.env[variable]=create2(EnvVarDeclarationSchema,{isSecret:!0,optional:!1,description}),applyTokenPathDefault(spec,"")}function applyTokenPathDefault(spec,slug){let variable=spec.auth?.targetEnvVar??"";if(variable===""||(spec.env[variable]===void 0&&(spec.env[variable]=create2(EnvVarDeclarationSchema,{isSecret:!0,optional:!1,description:tokenDescription(slug)})),spec.serverType.case!=="http"))return;let headers2=spec.serverType.value.headers,reference=`\${${variable}}`;Object.values(headers2).some(value=>value.includes(reference))||(headers2.Authorization=bearerHeader(variable))}function bearerHeader(variable){return`Bearer \${${variable}}`}function accessTokenVariable(slug){let stem=slug.toUpperCase().replace(/[^A-Z0-9]+/g,"_").replace(/^_+|_+$/g,"");return`${stem===""?"MCP":stem}${ACCESS_TOKEN_VAR_SUFFIX}`}function tokenDescription(slug){return`OAuth access token for the '${slug}' MCP server; Sign in fills it`}function stamp(ctx,server){server.metadata!==void 0&&(server.metadata.labels[MCP_AUTH_LABEL]=MCP_AUTH_ENDPOINT,recordServerStampedReservedLabels(ctx,MCP_AUTH_LABEL))}function dropLabel(server){server.metadata!==void 0&&delete server.metadata.labels[MCP_AUTH_LABEL]}async function probe(url,spec,deps){let headers2=spec.serverType.case==="http"?spec.serverType.value.headers:{};try{let outcome=await probeEndpointAuth(url,headers2,{fetchImpl:deps.outboundFetch,timeoutMs:ENDPOINT_PROBE_TIMEOUT_MS,clientName:PROBE_CLIENT_NAME});return outcome.kind==="unreachable"&&deps.logger.debug("MCP endpoint probe got no answer; saving the spec as sent",{url,error:outcome.error}),outcome.kind==="oauth"?"oauth":"other"}catch(error2){return deps.logger.warn("MCP endpoint probe threw; saving the spec as sent",{url,error:error2 instanceof Error?error2.message:String(error2)}),"other"}}async function getOAuthGrantStatus(deps,input,identity2){if(input.resourceId==="")throw invalidArgumentError("resource_id is required");if(input.org==="")throw invalidArgumentError("org is required");await authorizeDirect(McpServerQueryController.method.getOAuthGrantStatus,deps.authorizer,identity2,input);let grant;try{grant=await deps.oauthGrants.find("",input.resourceId,input.org)}catch(error2){throw internalError(error2,"failed to look up OAuth grant")}return grant===void 0?create2(GetOAuthGrantStatusOutputSchema,{connected:!1,connectionHealth:OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_NO_GRANT}):create2(GetOAuthGrantStatusOutputSchema,{connected:!0,accessTokenExpiresAt:BigInt(grant.accessTokenExpiresAt),targetEnvVar:grant.accessTokenEnvVar,authMethod:grant.authMethod,connectionHealth:evaluateHealth(grant)})}function evaluateHealth(grant){return grant.accessTokenExpiresAt===0?OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_HEALTHY:Math.floor(Date.now()/1e3)<grant.accessTokenExpiresAt-REFRESH_EXPIRY_BUFFER_SECONDS?OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_HEALTHY:grant.refreshTokenEnvVar!==""?OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED_REFRESHABLE:OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED}var import_node_crypto24=require("node:crypto");var import_node_crypto23=require("node:crypto");function generatePkce(){let verifier=(0,import_node_crypto23.randomBytes)(32).toString("base64url"),challenge=(0,import_node_crypto23.createHash)("sha256").update(verifier).digest().toString("base64url");return{codeVerifier:verifier,codeChallenge:challenge}}var DISCOVERY_REQUEST_TIMEOUT_MS=1e4;async function discoverForResource(mcpUrl,fetchImpl){let resource=parseDiscoveryUrl(mcpUrl),deps={fetchImpl,timeoutMs:DISCOVERY_REQUEST_TIMEOUT_MS},resolved=await resolveAuthorizationServers(resource.href,void 0,deps),issuers=resolved.issuers.length>0?resolved.issuers:[resource.origin];return readIssuers(issuers,deps)}async function discoverAtIssuer(issuerUrl,fetchImpl){let issuer=parseDiscoveryUrl(issuerUrl);return readIssuers([issuer.href],{fetchImpl,timeoutMs:DISCOVERY_REQUEST_TIMEOUT_MS})}async function readIssuers(issuers,deps){let attempts=[];for(let issuer of issuers){let read3=await readAuthorizationServerMetadata(issuer,deps);if(attempts.push(...read3.attempts),read3.kind==="found"){let metadata=toAuthServerMetadata(read3.metadata);return validateMetadata(metadata,read3.metadata.metadataUrl),metadata}}throw discoveryFailure(issuers,attempts)}function toAuthServerMetadata(m3){return{issuer:m3.issuer,authorizationEndpoint:m3.authorizationEndpoint,tokenEndpoint:m3.tokenEndpoint,registrationEndpoint:m3.registrationEndpoint,scopesSupported:[...m3.scopesSupported],codeChallengeMethodsSupported:[...m3.codeChallengeMethodsSupported]}}function discoveryFailure(issuers,attempts){let firstIssuer=issuers[0]??"",named=firstDocumentFor(firstIssuer),attempt=attempts.find(a5=>a5.url===named)??attempts[0];if(attempt?.error!==void 0)return new Error(`discovery request to ${attempt.url} failed: ${attempt.error}`);if(attempt?.missing!==void 0)return new Error(`authorization server at ${attempt.url} is missing ${attempt.missing}`);let status=attempt?.status??0;return new Error(`authorization server discovery failed: ${named} returned HTTP ${status} (expected 200). This MCP server may not support the MCP Authorization specification`)}function firstDocumentFor(issuer){try{return authorizationServerMetadataUrls(new URL(issuer))[0]??issuer}catch{return issuer}}function parseDiscoveryUrl(serverUrl){let parsed;try{parsed=new URL(serverUrl)}catch(error2){throw new Error(`invalid server URL for discovery: ${error2 instanceof Error?error2.message:String(error2)}`)}let scheme=parsed.protocol.replace(/:$/,"");if(scheme!=="http"&&scheme!=="https")throw new Error(`invalid server URL for discovery: unsupported scheme "${scheme}": only http and https are supported`);if(parsed.host==="")throw new Error("invalid server URL for discovery: server URL has no host");return parsed}function validateMetadata(m3,sourceUrl){if(m3.authorizationEndpoint==="")throw new Error(`authorization server at ${sourceUrl} is missing authorization_endpoint`);if(m3.tokenEndpoint==="")throw new Error(`authorization server at ${sourceUrl} is missing token_endpoint`);if(m3.codeChallengeMethodsSupported.length>0&&!m3.codeChallengeMethodsSupported.includes("S256"))throw new Error(`authorization server at ${sourceUrl} does not support S256 PKCE (supports: [${m3.codeChallengeMethodsSupported.join(" ")}]). S256 is required by the MCP Authorization specification`)}var DCR_REQUEST_TIMEOUT_MS=15e3;async function registerClient(registrationEndpoint,redirectUri,clientName,fetchImpl){let requestBody=JSON.stringify({redirect_uris:[redirectUri],client_name:clientName,grant_types:["authorization_code"],response_types:["code"],token_endpoint_auth_method:"none"}),response;try{response=await fetchImpl(registrationEndpoint,{method:"POST",headers:{"Content-Type":"application/json",Accept:"application/json"},body:requestBody,signal:AbortSignal.timeout(DCR_REQUEST_TIMEOUT_MS)})}catch(error2){throw new Error(`DCR request to ${registrationEndpoint} failed: ${error2 instanceof Error?error2.message:String(error2)}`)}let body=await response.text();if(response.status!==201&&response.status!==200)throw new Error(`DCR at ${registrationEndpoint} returned HTTP ${response.status}: ${truncateBody(body)}`);let raw;try{raw=JSON.parse(body)}catch(error2){throw new Error(`failed to parse DCR response: ${error2 instanceof Error?error2.message:String(error2)}`)}if((raw.client_id??"")==="")throw new Error(`DCR response from ${registrationEndpoint} is missing client_id`);return{clientId:raw.client_id,clientSecret:raw.client_secret??"",clientName:raw.client_name??"",tokenEndpointAuthMethod:raw.token_endpoint_auth_method??""}}var PREFLIGHT_REQUEST_TIMEOUT_MS=4e3,PREFLIGHT_BODY_READ_CAP=4096;async function preflightAuthorize(authorizationUrl,fetchImpl){let response=await fetchImpl(authorizationUrl,{method:"GET",redirect:"manual",signal:AbortSignal.timeout(PREFLIGHT_REQUEST_TIMEOUT_MS)});if(response.status!==400){await response.text().catch(()=>"");return}let body=(await response.text()).slice(0,PREFLIGHT_BODY_READ_CAP);return{statusCode:response.status,vendorDetail:extractVendorDetail(body),bodySnippet:truncateBody(body)}}function extractVendorDetail(body){let parsed;try{parsed=JSON.parse(body)}catch{return""}return(parsed.error_description??"")!==""?parsed.error_description:parsed.error??""}async function initiateOAuthConnect(deps,input,identity2){if(deps.oauthRedirectUri==="")throw failedPreconditionError("OAuth Connect is not configured: STIGMER_OAUTH_REDIRECT_URI is not set");let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}await authorizeDirect(McpServerCommandController.method.initiateOAuthConnect,deps.authorizer,identity2,input);let auth=mcpServer.spec?.auth;if(auth===void 0)throw failedPreconditionError(`MCP server '${mcpServerId}' does not have an auth block configured`);let pkcePair=generatePkce(),stateParam=generateState(),oauthAppRef=auth.oauthAppRef,isDcr=oauthAppRef===void 0||oauthAppRef.slug==="",result=isDcr?await initiateDcr(deps,mcpServer,pkcePair,stateParam):await initiateVendorOAuth(deps,mcpServer,pkcePair,stateParam),authMethod=isDcr?"mcp_oauth":"vendor_oauth",pendingState={state:stateParam,codeVerifier:pkcePair.codeVerifier,clientId:result.clientId,clientSecret:result.clientSecret,tokenEndpoint:result.tokenEndpoint,mcpServerId,identityAccountId:"",targetEnvVar:auth.targetEnvVar,authMethod,tokenAuthMethod:result.tokenAuthMethod,redirectUri:deps.oauthRedirectUri,org:input.org,createdAt:0},sealed;try{sealed=await sealPendingOAuthState(deps.secretService,deps.logger,pendingState)}catch(error2){throw internalError(error2,"failed to encrypt OAuth handshake secrets")}try{await deps.pendingOAuthStates.save(sealed)}catch(error2){throw internalError(error2,"failed to save pending OAuth state")}return deps.logger.info("Initiated OAuth Connect flow",{mcp_server_id:mcpServerId,auth_method:authMethod,provider:result.providerName}),create2(InitiateOAuthConnectOutputSchema,{authorizationUrl:result.authorizationUrl,state:stateParam,scopes:result.scopes,providerName:result.providerName})}async function initiateDcr(deps,mcpServer,pkcePair,stateParam){let discoveryUrl2=mcpServer.spec?.auth?.discoveryUrl??"",serverType=mcpServer.spec?.serverType,resourceUrl=serverType?.case==="http"?serverType.value.url:"",serverUrl=discoveryUrl2!==""?discoveryUrl2:resourceUrl;if(serverUrl==="")throw failedPreconditionError(`DCR requires a discoverable URL. MCP server '${mcpServer.metadata?.id??""}' has no http.url and no auth.discovery_url. Set auth.discovery_url for stdio servers, oauth_app_ref for vendor OAuth, or switch to HTTP transport`);let metadata;try{metadata=discoveryUrl2!==""?await discoverAtIssuer(discoveryUrl2,deps.outboundFetch):await discoverForResource(resourceUrl,deps.outboundFetch)}catch(error2){throw failedPreconditionError(`OAuth authorization server discovery failed for ${serverUrl}: ${error2 instanceof Error?error2.message:String(error2)}`)}if(metadata.registrationEndpoint==="")throw failedPreconditionError(`MCP server at ${serverUrl} does not advertise a registration_endpoint for DCR: ${loginServerHost(metadata,serverUrl)} does not allow automatic client registration, so this server needs an OAuth app registered with the vendor and referenced from its definition (auth.oauth_app_ref)`);let clientName=`Stigmer (${mcpServer.metadata?.name??""})`,dcrResponse;try{dcrResponse=await registerClient(metadata.registrationEndpoint,deps.oauthRedirectUri,clientName,deps.outboundFetch)}catch(error2){throw failedPreconditionError(`DCR registration failed: ${error2 instanceof Error?error2.message:String(error2)}`)}let scopes=mcpServer.spec?.auth?.scopeHints??[];scopes.length===0&&metadata.scopesSupported.length>0&&(scopes=metadata.scopesSupported);let authUrl=buildAuthorizationUrl(metadata.authorizationEndpoint,dcrResponse.clientId,deps.oauthRedirectUri,pkcePair.codeChallenge,stateParam,scopes,"scope"),rejection;try{rejection=await preflightAuthorize(authUrl,deps.outboundFetch)}catch(probeError){deps.logger.debug("authorize pre-flight probe inconclusive; proceeding",{mcp_server_id:mcpServer.metadata?.id??"",error:probeError instanceof Error?probeError.message:String(probeError)})}if(rejection!==void 0)throw deps.logger.warn("authorization endpoint rejected the sign-in request pre-flight",{status_code:rejection.statusCode,mcp_server_id:mcpServer.metadata?.id??"",body_snippet:rejection.bodySnippet}),failedPreconditionError(dcrRejectionMessage(mcpServer.metadata?.name??"",deps.oauthRedirectUri,rejection));return{authorizationUrl:authUrl,providerName:mcpServer.metadata?.name??"",scopes,clientId:dcrResponse.clientId,clientSecret:"",tokenEndpoint:metadata.tokenEndpoint,tokenAuthMethod:""}}function loginServerHost(metadata,serverUrl){for(let candidate of[metadata.issuer,metadata.authorizationEndpoint,serverUrl])try{let host=new URL(candidate).host;if(host!=="")return host}catch{}return serverUrl}async function initiateVendorOAuth(deps,mcpServer,pkcePair,stateParam){let ref=mcpServer.spec?.auth?.oauthAppRef,oauthApp;try{oauthApp=await resolveOAuthAppRef(deps.store,ref,deps.logger)}catch(error2){throw internalError(error2,"failed to list oauth apps")}if(oauthApp===void 0)throw notFoundError("oauth_app",ref?.slug??"");let approvalStatus=oauthApp.spec?.vendorApprovalStatus;if(approvalStatus===VendorApprovalStatus.PENDING||approvalStatus===VendorApprovalStatus.REJECTED){let statusLabel=approvalStatus===VendorApprovalStatus.REJECTED?"rejected":"pending approval",alternative=mcpServer.spec?.auth?.oauthOnly?"This server only accepts OAuth sign-in; an org admin can configure your own OAuth app instead.":"Please enter a token manually instead.";throw failedPreconditionError(`OAuth sign-in is unavailable: the platform's OAuth app for '${oauthApp.spec?.provider??""}' is ${statusLabel} by the vendor. ${alternative}`)}let clientSecret=oauthApp.spec?.clientSecret??"";if(deps.secretService.isEncrypted(clientSecret))try{clientSecret=await deps.secretService.decrypt(clientSecret)}catch(error2){throw internalError(error2,"failed to decrypt OAuthApp client secret")}let scopes=oauthApp.spec?.scopes??[];return{authorizationUrl:buildAuthorizationUrl(oauthApp.spec?.authorizationUrl??"",oauthApp.spec?.clientId??"",deps.oauthRedirectUri,pkcePair.codeChallenge,stateParam,scopes,oauthApp.spec?.scopeParameterName??""),providerName:oauthApp.spec?.provider??"",scopes,clientId:oauthApp.spec?.clientId??"",clientSecret,tokenEndpoint:oauthApp.spec?.tokenUrl??"",tokenAuthMethod:tokenAuthMethodFromSpec(oauthApp.spec?.tokenEndpointAuthMethod??TokenEndpointAuthMethod.UNSPECIFIED)}}function buildAuthorizationUrl(authEndpoint,clientId,redirectUri,codeChallenge,state2,scopes,scopeParamName){let scopeParam=scopeParamName===""?"scope":scopeParamName,params=new URLSearchParams({response_type:"code",client_id:clientId,redirect_uri:redirectUri,code_challenge:codeChallenge,code_challenge_method:"S256",state:state2});scopes.length>0&&params.set(scopeParam,scopes.join(" ")),params.sort();let separator=authEndpoint.includes("?")?"&":"?";return authEndpoint+separator+params.toString()}function dcrRejectionMessage(providerName,redirectUri,rejection){let callbackHost=redirectUri;try{let parsed=new URL(redirectUri);parsed.host!==""&&(callbackHost=parsed.host)}catch{}let message6=`${providerName} rejected the sign-in request before showing a login page (HTTP ${rejection.statusCode}). The most common cause is a redirect-host allowlist: this deployment's OAuth callback host (${callbackHost}) is not on the provider's approved list. Self-hosted deployments with a localhost callback are typically unaffected.`;return rejection.vendorDetail!==""&&(message6+=" Provider detail: "+rejection.vendorDetail),message6}function generateState(){return(0,import_node_crypto24.randomBytes)(32).toString("base64url")}async function sealPendingOAuthState(secretService,logger2,state2){if(!secretService.isEnabled())return logger2.warn("Encryption disabled: pending OAuth state secrets will be stored in plaintext"),state2;let scope=EncryptionScope.forOrganization(state2.org),sealedVerifier;try{sealedVerifier=await secretService.encrypt(state2.codeVerifier,scope)}catch(error2){throw new Error(`failed to encrypt code_verifier: ${error2 instanceof Error?error2.message:String(error2)}`)}let sealedSecret=state2.clientSecret;if(state2.clientSecret!=="")try{sealedSecret=await secretService.encrypt(state2.clientSecret,scope)}catch(error2){throw new Error(`failed to encrypt client_secret: ${error2 instanceof Error?error2.message:String(error2)}`)}return{...state2,codeVerifier:sealedVerifier,clientSecret:sealedSecret}}var mcpServerSearchExtractor={kind:ApiResourceKind.mcp_server,schema:McpServerSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let mcpServer=resource;return buildSearchResult({kind:ApiResourceKind.mcp_server,metadata:mcpServer.metadata,summary:mcpServer.spec?.description??"",score,createdAt:mcpServer.status?.audit?.specAudit?.createdAt,updatedAt:mcpServer.status?.audit?.specAudit?.updatedAt,iconUrl:mcpServer.spec?.iconUrl??""})},getSearchIndexEntry(resource){let mcpServer=resource,metadata=mcpServer.metadata;if(metadata!==void 0)return{name:metadata.name,description:mcpServer.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(mcpServer.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var RUNNER_QUEUE_WARNING="no runner appears to be polling the task queue \u2014 the connect will wait for one to come up (start your local runner if it is not running)";async function startConnect(deps,input,identity2){let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");if(input.org==="")throw invalidArgumentError("org is required for connect");let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}await authorizeDirect(McpServerCommandController.method.startConnect,deps.authorizer,identity2,input);let engineState=deps.engineState();if(!engineState.connected)throw failedPreconditionError("connect is not available: Temporal not configured");let connectStatus=mcpServer.status?.connectStatus;if(connectStatus?.phase===ConnectPhase.connecting&&await engineState.engine.isConnectRunRunning(connectStatus.workflowId))return deps.logger.info("StartConnect attached to in-flight connect operation",{mcp_server_id:mcpServerId,workflow_id:connectStatus.workflowId}),mcpServer;let prepared=await prepareConnect(deps,mcpServer,input,identity2),warning2=await runnerQueueWarning(engineState.engine),run;try{run=await engineState.engine.startOrAttachConnect(mcpServerId,prepared.workflowInput,ASYNC_CONNECT_TIMEOUT.ms)}catch(error2){throw prepared.ecResourceId!==""&&await deleteConnectExecutionContext(deps,prepared.ecResourceId,prepared.executionId),deps.logger.error("Failed to start MCP connect workflow",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to start connect workflow")}if(run.attached){prepared.ecResourceId!==""&&await deleteConnectExecutionContext(deps,prepared.ecResourceId,prepared.executionId);try{return await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}}let persisted;try{persisted=await persistConnectStarting(deps.store,mcpServerId,run.workflowId,warning2)}catch(error2){throw detachSettle(deps,mcpServer,run,prepared),internalError(error2,"failed to record connect operation")}return detachSettle(deps,mcpServer,run,prepared),persisted}function detachSettle(deps,mcpServer,run,prepared){settleConnectAsync(deps,mcpServer,run,prepared.ecResourceId,prepared.executionId).catch(error2=>{deps.logger.warn("Async connect settle task failed unexpectedly",{mcp_server_id:mcpServer.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})})}async function settleConnectAsync(deps,mcpServer,run,ecResourceId,executionId){let mcpServerId=mcpServer.metadata?.id??"";try{let outcome=await run.result(ASYNC_CONNECT_TIMEOUT.ms+BEST_EFFORT_CONNECT_GET_BUFFER_MS);if(!outcome.ok){let failure=mapConnectFailure(deps.logger,mcpServer,run.workflowId,outcome.failure,ASYNC_CONNECT_TIMEOUT);await persistConnectFailure(deps.store,deps.logger,mcpServerId,failure);return}let persisted,toolApprovalCount;try{({persisted,toolApprovalCount}=await persistConnectResult(deps.store,mcpServerId,run.workflowId,outcome.output))}catch(error2){if(error2 instanceof ResourceNotFoundError){deps.logger.info("Skipping async connect persistence: MCP server deleted before connect completed",{mcp_server_id:mcpServerId});return}deps.logger.warn("Failed to persist async connect result",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}deps.logger.info("Async MCP server connect completed and stored",{workflow_id:run.workflowId,mcp_server_id:mcpServerId,tools:persisted.status?.discoveredCapabilities?.tools.length??0,resource_templates:persisted.status?.discoveredCapabilities?.resourceTemplates.length??0,tool_approvals:toolApprovalCount})}finally{ecResourceId!==""&&await deleteConnectExecutionContext(deps,ecResourceId,executionId)}}async function runnerQueueWarning(engine){let hasPollers=await engine.hasRunnerQueuePollers();return hasPollers===void 0||hasPollers?"":RUNNER_QUEUE_WARNING}function newValidateDefaultEnabledToolsStep(){return{name:"ValidateDefaultEnabledTools",execute(ctx){let mcpServer=ctx.newState,requested=mcpServer.spec?.defaultEnabledTools??[];if(requested.length===0)return;let caps=mcpServer.status?.discoveredCapabilities;if(caps===void 0)return;let classification=classify(caps,requested);if(isValidClassification(classification))return;let problems=[];throw classification.unknown.length>0&&problems.push(`default_enabled_tools names tool(s) this server does not expose: ${quoteJoin(classification.unknown)}`),classification.resourceTemplates.length>0&&problems.push(`default_enabled_tools names resource template(s): ${quoteJoin(classification.resourceTemplates)} \u2014 resource templates are read-only data endpoints, not callable tools, and must not appear in default_enabled_tools`),invalidArgumentError(`MCP server '${mcpServer.metadata?.slug??""}': ${problems.join("; ")}. Discovered tools: ${quoteJoin(toolNames(caps))}. If the server's toolset changed, run 'stigmer connect' on it to refresh discovered capabilities.`)}}}function newEnrichOAuthStatusStep(store,logger2){return{name:"EnrichOAuthStatus",async execute(ctx){let mcpServer=ctx.get(TARGET_RESOURCE_KEY);if(mcpServer===void 0)return;let ref=mcpServer.spec?.auth?.oauthAppRef;if((ref?.slug??"")==="")return;let oauthApp;try{oauthApp=await resolveOAuthAppRef(store,ref,logger2)}catch(error2){logger2.warn("OAuthApp lookup failed; returning MCP server without oauth_status enrichment",{mcpServerId:mcpServer.metadata?.id??"",oauthAppSlug:ref?.slug??"",error:error2 instanceof Error?error2.message:String(error2)});return}if(oauthApp===void 0){logger2.debug("OAuthApp not found for ref; skipping oauth_status enrichment",{mcpServerId:mcpServer.metadata?.id??"",oauthAppSlug:ref?.slug??""});return}let approvalStatus=oauthApp.spec?.vendorApprovalStatus??VendorApprovalStatus.UNSPECIFIED,docsUrl=oauthApp.spec?.vendorApprovalDocsUrl??"";approvalStatus===VendorApprovalStatus.UNSPECIFIED&&docsUrl===""||(mcpServer.status??=create2(McpServerStatusSchema,{}),mcpServer.status.oauthStatus=create2(OAuthStatusSchema,{vendorApprovalStatus:approvalStatus,vendorApprovalDocsUrl:docsUrl}))}}}function registerMcpServerServices(router,deps){router.service(McpServerCommandController,{apply:(server,ctx)=>apply11(deps,server,ctx),create:(server,ctx)=>createMcpServer(deps,server,ctx),update:(server,ctx)=>update14(deps,server,ctx),updateVisibility:(input,ctx)=>updateVisibility4(deps,input,ctx),delete:(input,ctx)=>deleteMcpServer(deps,input,ctx),connect:(input,ctx)=>connect(deps.connect,input,callerIdentityOf(ctx)),startConnect:(input,ctx)=>startConnect(deps.connect,input,callerIdentityOf(ctx)),initiateOAuthConnect:(input,ctx)=>initiateOAuthConnect(deps.connect,input,callerIdentityOf(ctx)),completeOAuthConnect:(input,ctx)=>completeOAuthConnect(deps.connect,input,callerIdentityOf(ctx)),disconnectOAuth:(input,ctx)=>disconnectOAuth(deps.connect,input,callerIdentityOf(ctx)),setOrgOAuthApp:()=>{throw orgOAuthAppUnimplemented("SetOrgOAuthApp")},deleteOrgOAuthApp:()=>{throw orgOAuthAppUnimplemented("DeleteOrgOAuthApp")}}),router.service(McpServerQueryController,{get:(id,ctx)=>get19(deps,id,ctx),getByReference:(ref,ctx)=>getByReference11(deps,ref,ctx),getOAuthGrantStatus:(input,ctx)=>getOAuthGrantStatus(deps.connect,input,callerIdentityOf(ctx)),getOrgOAuthApp:()=>{throw orgOAuthAppUnimplemented("GetOrgOAuthApp")}})}function orgOAuthAppUnimplemented(method){return new ConnectError(`method ${method} not implemented`,Code.Unimplemented)}function kindOf18(ctx){return ctx.values.get(apiResourceKindKey)}function endpointAuthDeps(deps){return{outboundFetch:deps.connect.outboundFetch,logger:deps.logger}}async function createMcpServer(deps,server,ctx){let reqCtx=new RequestContext(McpServerSchema,server,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("mcpserver-create",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newCompleteEndpointAuthStep(endpointAuthDeps(deps))).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,mcpServerSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update14(deps,server,ctx){let reqCtx=new RequestContext(McpServerSchema,server,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("mcpserver-update",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newGuardPluginManagedStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newCompleteEndpointAuthStep(endpointAuthDeps(deps))).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newValidateDefaultEnabledToolsStep()).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,mcpServerSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply11(deps,server,ctx){let reqCtx=new RequestContext(McpServerSchema,server,callerIdentityOf(ctx),kindOf18(ctx));await newPipeline("mcpserver-apply",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");let result=shouldCreate?await createMcpServer(deps,server,ctx):await update14(deps,withResolvedApplyId(McpServerSchema,server,reqCtx),ctx);return startBestEffortConnect(deps.connect,result).catch(error2=>{deps.logger.warn("Best-effort connect task failed unexpectedly",{mcp_server_id:result.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}),result}async function deleteMcpServer(deps,input,ctx){let reqCtx=new RequestContext(McpServerCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf18(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("mcpserver-delete",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,McpServerSchema)).addStep(newGuardPluginManagedStep(deps.store)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted mcp server not found in context"),"deleted mcp server not found in context");return deleted}var UPDATE_VISIBILITY_MCP_SERVER_KEY="updateVisibilityMcpServer";async function updateVisibility4(deps,input,ctx){let reqCtx=new RequestContext(McpServerCommandController.method.updateVisibility.input,input,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("mcpserver-update-visibility",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.updateVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadMcpServerForVisibilityUpdateStep(deps.store)).addStep(newGuardPluginManagedStep(deps.store,{existingKey:UPDATE_VISIBILITY_MCP_SERVER_KEY})).addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_MCP_SERVER_KEY)).addStep(newValidateVisibilityUpdateStep()).addStep(newSetMcpServerVisibilityStep()).addStep(newPersistMcpServerForVisibilityUpdateStep(deps.store)).addStep(newUpdateVisibilityTuplesStep(deps.authorizationLifecycle,UPDATE_VISIBILITY_MCP_SERVER_KEY)).addStep(newIndexMcpServerAfterVisibilityUpdateStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY)}function newLoadMcpServerForVisibilityUpdateStep(store){return{name:"LoadMcpServerForVisibilityUpdate",async execute(ctx){let input=ctx.input,mcpServer;try{mcpServer=await store.getResource(ctx.apiResourceKind,input.resourceId,McpServerSchema)}catch{throw notFoundError("mcp_server",input.resourceId)}ctx.set(UPDATE_VISIBILITY_MCP_SERVER_KEY,mcpServer)}}}function newSetMcpServerVisibilityStep(){return{name:"SetMcpServerVisibility",execute(ctx){let mcpServer=ctx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY);mcpServer.metadata!==void 0&&(mcpServer.metadata.visibility=ctx.input.visibility),setAuditFieldsForUpdate(McpServerSchema,mcpServer,"status_audit",ctx.callerIdentity)}}}function newPersistMcpServerForVisibilityUpdateStep(store){return{name:"PersistMcpServerForVisibilityUpdate",async execute(ctx){let mcpServer=ctx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY);try{await store.saveResource(ctx.apiResourceKind,mcpServer.metadata?.id??"",McpServerSchema,mcpServer)}catch(error2){throw internalError(error2,"failed to save mcp server")}}}}function newIndexMcpServerAfterVisibilityUpdateStep(store,logger2){return{name:"IndexMcpServerAfterVisibilityUpdate",async execute(ctx){let mcpServer=ctx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY),entry=mcpServerSearchExtractor.getSearchIndexEntry(mcpServer);if(entry===void 0){logger2.warn("IndexMcpServerAfterVisibilityUpdate: extractor returned nil, skipping",{id:mcpServer.metadata?.id??""});return}try{await store.upsertSearchIndex(ctx.apiResourceKind,mcpServer.metadata?.id??"",entry)}catch(error2){logger2.warn("IndexMcpServerAfterVisibilityUpdate: failed (best-effort)",{id:mcpServer.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}}}async function get19(deps,id,ctx){let reqCtx=new RequestContext(McpServerQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("mcpserver-get",deps.logger).addStep(newAuthorizeStep(McpServerQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,McpServerSchema)).addStep(newEnrichOAuthStatusStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByReference11(deps,ref,ctx){let reqCtx=new RequestContext(McpServerQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("mcpserver-get-by-reference",deps.logger).addStep(newAuthorizeStep(McpServerQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,McpServerSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(McpServerQueryController.method.get))).addStep(newEnrichOAuthStatusStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}function registerPlatformServices(router,deps){router.service(PlatformQueryController,{getServerInfo:()=>getServerInfo(deps),getLicenseStatus:()=>getLicenseStatus(deps),getRunnerBootstrapConfig:(_input,ctx)=>getRunnerBootstrapConfig(deps,ctx),getRunnerScopedToken:(input,ctx)=>getRunnerScopedToken(deps,input,ctx)})}function getServerInfo(deps){return create2(GetServerInfoOutputSchema,{edition:deps.edition,version:deps.version,authenticationRequired:deps.authenticationRequired})}async function getLicenseStatus(deps){let now=deps.now(),report=await deps.licenseStatus.status(now),output=create2(GetLicenseStatusOutputSchema,{state:report.state,checkedAt:timestampFromDate(now)});switch(report.state){case LicenseState.absent:return output;case LicenseState.invalid:return output.keyId=report.keyId,output;case LicenseState.valid:case LicenseState.expiring:case LicenseState.grace:case LicenseState.expired:return output.keyId=report.keyId,output.claims=report.claims,output;default:{let exhaustive=report;throw new Error(`unhandled license report: ${JSON.stringify(exhaustive)}`)}}}async function getRunnerBootstrapConfig(deps,ctx){let output=create2(GetRunnerBootstrapConfigOutputSchema,{temporalAddress:deps.temporalHostPort,temporalNamespace:deps.temporalNamespace}),bootstrapCredentials=deps.runnerAuthService.bootstrapCredentials?.bind(deps.runnerAuthService);if(bootstrapCredentials===void 0)return output;try{let credentials=await bootstrapCredentials(callerIdentityOf(ctx));credentials.accessToken!==void 0&&(output.runnerAccessToken=credentials.accessToken.token,output.tokenType="Bearer",output.runnerAccessTokenExpiresInSeconds=credentials.accessToken.expiresInSeconds),credentials.payloadKeys!==void 0&&(output.payloadEncryptionKey=credentials.payloadKeys.keyBase64,output.payloadEncryptionKeyId=credentials.payloadKeys.keyId,output.payloadEncryptionSecondaryKey=credentials.payloadKeys.secondaryKeyBase64??"",output.payloadEncryptionSecondaryKeyId=credentials.payloadKeys.secondaryKeyId??"")}catch(error2){deps.logger.warn("Bootstrap credentials unavailable \u2014 answering coordinates without them",{error:error2 instanceof Error?error2.message:String(error2)})}return output}async function getRunnerScopedToken(deps,input,ctx){let exchange=deps.runnerAuthService.exchangeScopedToken?.bind(deps.runnerAuthService);if(exchange!==void 0){let minted=await exchange(exchangeRequestOf(input),callerIdentityOf(ctx));return minted.minted?create2(GetRunnerScopedTokenOutputSchema,{runnerScopedToken:minted.token,tokenType:"Bearer",expiresInSeconds:minted.expiresInSeconds}):create2(GetRunnerScopedTokenOutputSchema)}let executionId;switch(input.scope.case){case"agentExecutionId":executionId=input.scope.value;break;case"workflowExecutionId":executionId=input.scope.value;break;case"poolClaim":case"renewal":case void 0:return create2(GetRunnerScopedTokenOutputSchema);default:{let exhaustive=input.scope;throw new Error(`unhandled scope arm: ${JSON.stringify(exhaustive)}`)}}if(executionId===""||!deps.runnerAuthService.isEnabled(TOKEN_TYPE_EXECUTION_SCOPED))return create2(GetRunnerScopedTokenOutputSchema);try{let minted=deps.runnerAuthService.mint(TOKEN_TYPE_EXECUTION_SCOPED,executionId,0);return create2(GetRunnerScopedTokenOutputSchema,{runnerScopedToken:minted.token,tokenType:"Bearer",expiresInSeconds:minted.ttlSeconds})}catch(error2){return deps.logger.warn("failed to mint runner scoped token \u2014 answering not-minted",{executionId,error:error2 instanceof Error?error2.message:String(error2)}),create2(GetRunnerScopedTokenOutputSchema)}}function exchangeRequestOf(input){switch(input.scope.case){case"agentExecutionId":return{arm:"agent-execution",executionId:input.scope.value};case"workflowExecutionId":return{arm:"workflow-execution",executionId:input.scope.value};case"poolClaim":return{arm:"pool-claim",sessionId:input.scope.value.sessionId};case"renewal":return{arm:"renewal"};case void 0:return{arm:"unset"};default:{let exhaustive=input.scope;throw new Error(`unhandled scope arm: ${JSON.stringify(exhaustive)}`)}}}var SERVER_VERSION="3.37.1";var file_ai_stigmer_agentic_session_v1_io=fileDesc("CiZhaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9pby5wcm90bxIdYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEiIgoJU2Vzc2lvbklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiIAoHQWdlbnRJZBIVCgV2YWx1ZRgBIAEoCUIGukgDyAEBInQKC1Nlc3Npb25MaXN0EhMKC3RvdGFsX3BhZ2VzGAEgASgFEjcKB2VudHJpZXMYAiADKAsyJi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uEhcKD25leHRfcGFnZV90b2tlbhgDIAEoCSJgChNMaXN0U2Vzc2lvbnNSZXF1ZXN0EhoKCXBhZ2Vfc2l6ZRgBIAEoBUIHukgEGgIoABISCgpwYWdlX3Rva2VuGAIgASgJEgwKBHRhZ3MYAyADKAkSCwoDb3JnGAQgASgJIncKIkxpc3RTZXNzaW9uc0J5QWdlbnRJbnN0YW5jZVJlcXVlc3QSIQoRYWdlbnRfaW5zdGFuY2VfaWQYASABKAlCBrpIA8gBARIaCglwYWdlX3NpemUYAiABKAVCB7pIBBoCKAASEgoKcGFnZV90b2tlbhgDIAEoCSJqChxMaXN0U2Vzc2lvbnNCeUNoYW5uZWxSZXF1ZXN0EhoKCmNoYW5uZWxfaWQYASABKAlCBrpIA8gBARIaCglwYWdlX3NpemUYAiABKAVCB7pIBBoCKAASEgoKcGFnZV90b2tlbhgDIAEoCSJCChtVcGRhdGVTZXNzaW9uU3ViamVjdFJlcXVlc3QSEgoCaWQYASABKAlCBrpIA8gBARIPCgdzdWJqZWN0GAIgASgJYgZwcm90bzM",[file_ai_stigmer_agentic_session_v1_api,file_buf_validate_validate]),SessionIdSchema=messageDesc2(file_ai_stigmer_agentic_session_v1_io,0);var SessionListSchema=messageDesc2(file_ai_stigmer_agentic_session_v1_io,2);var file_ai_stigmer_agentic_session_v1_command=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9jb21tYW5kLnByb3RvEh1haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MTLtBQoYU2Vzc2lvbkNvbW1hbmRDb250cm9sbGVyElcKBWFwcGx5EiYuYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuU2Vzc2lvbhomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24SpQEKBmNyZWF0ZRImLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24aJi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uIkvCuBhHCAgQHiIMbWV0YWRhdGEub3JnKjN1bmF1dGhvcml6ZWQgdG8gY3JlYXRlIHNlc3Npb24gaW4gdGhpcyBvcmdhbml6YXRpb24SjwEKBnVwZGF0ZRImLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24aJi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uIjXCuBgxCAIQKiILbWV0YWRhdGEuaWQqHnVuYXV0aG9yaXplZCB0byB1cGRhdGUgc2Vzc2lvbhKpAQoNdXBkYXRlU3ViamVjdBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlVwZGF0ZVNlc3Npb25TdWJqZWN0UmVxdWVzdBomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24iNMK4GDAIAhAqIgJpZComdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBzZXNzaW9uIHN1YmplY3QSiwEKBmRlbGV0ZRIoLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb25JZBomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24iL8K4GCsIAxAqIgV2YWx1ZSoedW5hdXRob3JpemVkIHRvIGRlbGV0ZSBzZXNzaW9uGgSg/ysqYgZwcm90bzM",[file_ai_stigmer_agentic_session_v1_api,file_ai_stigmer_agentic_session_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),SessionCommandController=serviceDesc(file_ai_stigmer_agentic_session_v1_command,0);var file_ai_stigmer_agentic_session_v1_query=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9xdWVyeS5wcm90bxIdYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEyoQQKFlNlc3Npb25RdWVyeUNvbnRyb2xsZXIShQEKA2dldBIoLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb25JZBomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24iLMK4GCgIARAqIgV2YWx1ZSobdW5hdXRob3JpemVkIHRvIGdldCBzZXNzaW9uEmwKBGxpc3QSMi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5MaXN0U2Vzc2lvbnNSZXF1ZXN0GiouYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuU2Vzc2lvbkxpc3QiBNC4GAESigEKE2xpc3RCeUFnZW50SW5zdGFuY2USQS5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5MaXN0U2Vzc2lvbnNCeUFnZW50SW5zdGFuY2VSZXF1ZXN0GiouYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuU2Vzc2lvbkxpc3QiBNC4GAESfgoNbGlzdEJ5Q2hhbm5lbBI7LmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLkxpc3RTZXNzaW9uc0J5Q2hhbm5lbFJlcXVlc3QaKi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uTGlzdCIE0LgYARoEoP8rKmIGcHJvdG8z",[file_ai_stigmer_agentic_session_v1_api,file_ai_stigmer_agentic_session_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),SessionQueryController=serviceDesc(file_ai_stigmer_agentic_session_v1_query,0);function runAgentInstanceDeniedMessage2(agentInstanceId){return`unauthorized to run agent instance '${agentInstanceId}'`}function sessionRunTarget(session){let agentInstanceId=session.spec?.agentInstanceId??"";if(agentInstanceId!=="")return{...RUN_GATE_CHECKS.agentInstance,resourceId:agentInstanceId,deniedMessage:runAgentInstanceDeniedMessage2(agentInstanceId)}}var sessionSearchExtractor={kind:ApiResourceKind.session,schema:SessionSchema,getSearchSummary(resource){return resource.spec?.subject??""},toSearchResult(resource,score){let session=resource;return buildSearchResult({kind:ApiResourceKind.session,metadata:session.metadata,summary:session.spec?.subject??"",score,createdAt:session.status?.audit?.specAudit?.createdAt,updatedAt:session.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let session=resource,metadata=session.metadata;if(metadata!==void 0)return{name:metadata.name,description:session.spec?.subject??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(session.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var SESSION_CHANNEL_ID_LABEL="stigmer.ai/channel-id",sessionListIndex=declareListIndex({kind:ApiResourceKind.session,schema:SessionSchema,revision:1,keys:{agent_instance:field2("spec.agent_instance_id"),channel:label(SESSION_CHANNEL_ID_LABEL)}});var LIST_RESULT_KEY8="listResult";function newValidateHarnessImmutabilityStep(){return{name:"ValidateHarnessImmutability",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)return;let existingSpec=existing.spec;if(existingSpec===void 0||existingSpec.harnessStateId==="")return;let inputSpec=ctx.input.spec;if(inputSpec===void 0)return;let existingHarness=existingSpec.harness,inputHarness=inputSpec.harness;if(existingHarness===Harness.UNSPECIFIED&&(existingHarness=Harness.NATIVE),inputHarness===Harness.UNSPECIFIED&&(inputHarness=Harness.NATIVE),inputHarness!==existingHarness)throw failedPreconditionError("session harness cannot be changed after the first execution \u2014 each harness owns its conversation state independently")}}}var EXECUTION_TARGET_GO_NAMES={[ExecutionTarget.UNSPECIFIED]:"EXECUTION_TARGET_UNSPECIFIED",[ExecutionTarget.LOCAL]:"EXECUTION_TARGET_LOCAL",[ExecutionTarget.CLOUD]:"EXECUTION_TARGET_CLOUD"};function newValidateExecutionTargetImmutabilityStep(temporalConfig){return{name:"ValidateExecutionTargetImmutability",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)return;let existingSpec=existing.spec;if(existingSpec===void 0||existingSpec.harnessStateId==="")return;let inputSpec=ctx.input.spec;if(inputSpec===void 0)return;let existingTarget=temporalConfig.resolveExecutionTarget(existingSpec.executionTarget),inputTarget=temporalConfig.resolveExecutionTarget(inputSpec.executionTarget);if(inputTarget!==existingTarget)throw failedPreconditionError(`session execution_target cannot be changed after the first execution (${EXECUTION_TARGET_GO_NAMES[existingTarget]} \u2192 ${EXECUTION_TARGET_GO_NAMES[inputTarget]}; unset resolves to the deployment default, ${temporalConfig.defaultExecutionTarget}) \u2014 workspace state may not be portable between local and cloud environments`)}}}function newRecordHarnessStateHistoryStep(){return{name:"RecordHarnessStateHistory",execute(ctx){let mergedSpec=ctx.newState.spec;if(mergedSpec===void 0)return;let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0||existing.spec===void 0)return;let existingSpec=existing.spec,history=[...existingSpec.harnessStateIdHistory],previousId=existingSpec.harnessStateId;previousId!==""&&previousId!==mergedSpec.harnessStateId&&!history.includes(previousId)&&history.push(previousId),mergedSpec.harnessStateIdHistory=history}}}function isActiveExecutionPhase(phase){switch(phase){case ExecutionPhase.EXECUTION_PENDING:case ExecutionPhase.EXECUTION_IN_PROGRESS:case ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL:case ExecutionPhase.EXECUTION_PAUSED:return!0;default:return!1}}async function listExecutionsBySession(store,logger2,sessionId){let rows;try{rows=await store.queryResources(agentExecutionListIndex,{anyKey:[{name:"session",value:sessionId}]})}catch(error2){throw internalError(error2,"failed to list agent executions")}let executions=[];for(let row of rows)try{executions.push(fromBinary2(AgentExecutionSchema,row.data))}catch(error2){logger2.warn("Failed to unmarshal execution, skipping",{error:error2 instanceof Error?error2.message:String(error2)})}return executions}function newRejectDeleteWithActiveExecutionsStep(store,logger2){return{name:"RejectDeleteWithActiveExecutions",async execute(ctx){let sessionId=requireSessionId(ctx),executions=await listExecutionsBySession(store,logger2,sessionId),activeCount=0;for(let execution of executions)isActiveExecutionPhase(execution.status?.phase??ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED)&&activeCount++;if(activeCount>0)throw failedPreconditionError(`session has ${activeCount} active execution(s); cancel them or wait for completion before deleting`)}}}function newCascadeDeleteAgentExecutionsStep(store,logger2){return{name:"CascadeDeleteAgentExecutions",async execute(ctx){let sessionId=requireSessionId(ctx),executions=await listExecutionsBySession(store,logger2,sessionId);if(executions.length!==0){for(let execution of executions){let executionId=execution.metadata?.id??"";try{await store.deleteResource(ApiResourceKind.agent_execution,executionId)}catch(error2){throw internalError(error2,`failed to cascade-delete execution ${executionId} of session ${sessionId}`)}try{await store.deleteSearchIndex(ApiResourceKind.agent_execution,executionId)}catch(error2){logger2.warn("CascadeDeleteAgentExecutions: failed to remove search index entry (best-effort)",{executionId,error:error2 instanceof Error?error2.message:String(error2)})}}logger2.info("Cascade-deleted executions of session",{sessionId,count:executions.length})}}}}function requireSessionId(ctx){let sessionId=ctx.get(RESOURCE_ID_KEY);if(typeof sessionId!="string"||sessionId==="")throw internalError(new Error("session id not found in context (ExtractResourceId must run first)"),"session id not found in context (ExtractResourceId must run first)");return sessionId}function newListAllSessionsStep(store,logger2,listReadScope){return{name:"ListAllSessions",async execute(ctx){let input=ctx.input,page=await readSessionPage(store,logger2,listReadScope,ctx.callerIdentity,ctx.input,{query:{org:input.org},fingerprint:{lane:"session.list",org:input.org,tags:input.tags}});ctx.set(LIST_RESULT_KEY8,page)}}}function newFilterByAgentInstanceStep(store,logger2,listReadScope){return{name:"FilterByAgentInstance",async execute(ctx){let agentInstanceId=ctx.input.agentInstanceId;if(agentInstanceId==="")throw invalidArgumentError("agent_instance_id is required");let page=await readSessionPage(store,logger2,listReadScope,ctx.callerIdentity,ctx.input,{query:{anyKey:[{name:"agent_instance",value:agentInstanceId}]},fingerprint:{lane:"session.listByAgentInstance",agentInstanceId}});ctx.set(LIST_RESULT_KEY8,page)}}}function newAuthorizeChannelAccessStep(authorizer){return newAuthorizeResolvedTargetStep(authorizer,({input})=>input.channelId===""?[]:[{permission:IamPermission.can_view,resourceKind:ApiResourceKind.agent_channel,resourceId:input.channelId,deniedMessage:"unauthorized to list channel conversations"}],"AuthorizeChannelAccess")}function newFilterByChannelStep(store,logger2,listReadScope){return{name:"FilterByChannel",async execute(ctx){let channelId=ctx.input.channelId;if(channelId==="")throw invalidArgumentError("channel_id is required");let page=await readSessionPage(store,logger2,listReadScope,ctx.callerIdentity,ctx.input,{query:{anyKey:[{name:"channel",value:channelId}]},fingerprint:{lane:"session.listByChannel",channelId}});ctx.set(LIST_RESULT_KEY8,page)}}}async function readSessionPage(store,logger2,listReadScope,caller,request,lane){let page=await readListPage({store,declaration:sessionListIndex,query:lane.query,request,fingerprint:listPageFingerprint(lane.fingerprint),decode:data=>{try{return fromBinary2(SessionSchema,data)}catch(error2){logger2.warn("Failed to unmarshal session, skipping",{error:error2 instanceof Error?error2.message:String(error2)});return}},scope:sessions=>restrictListByReadScope(listReadScope,caller,ApiResourceKind.session,sessions,""),failure:"failed to list sessions"});return create2(SessionListSchema,{entries:page.entries,nextPageToken:page.nextPageToken,totalPages:page.nextPageToken===""?1:0})}function registerSessionServices(router,deps){router.service(SessionCommandController,{apply:(session,ctx)=>apply12(deps,session,ctx),create:(session,ctx)=>createSession(deps,session,ctx),update:(session,ctx)=>update15(deps,session,ctx),updateSubject:(req,ctx)=>updateSubject(deps,req,callerIdentityOf(ctx)),delete:(id,ctx)=>deleteSession(deps,id,ctx)}),router.service(SessionQueryController,{get:(id,ctx)=>get20(deps,id,ctx),list:(req,ctx)=>list10(deps,req,ctx),listByAgentInstance:(req,ctx)=>listByAgentInstance(deps,req,ctx),listByChannel:(req,ctx)=>listByChannel(deps,req,ctx)})}function kindOf19(ctx){return ctx.values.get(apiResourceKindKey)}async function createSession(deps,session,ctx){let reqCtx=new RequestContext(SessionSchema,session,callerIdentityOf(ctx),kindOf19(ctx)),builder2=newPipeline("session-create",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.create,deps.authorizer)).addStep(newAuthorizeRunTargetStep(deps.authorizer,sessionRunTarget)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store));for(let step of stepsForSlot(deps.gateSteps,"session-create:pre-side-effect-gate"))builder2.addStep(step);return await builder2.addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,sessionSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update15(deps,session,ctx){let reqCtx=new RequestContext(SessionSchema,session,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-update",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateHarnessImmutabilityStep()).addStep(newValidateExecutionTargetImmutabilityStep(deps.temporalConfig)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newRecordHarnessStateHistoryStep()).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,sessionSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply12(deps,session,ctx){let reqCtx=new RequestContext(SessionSchema,session,callerIdentityOf(ctx),kindOf19(ctx));await newPipeline("session-apply",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createSession(deps,session,ctx):update15(deps,withResolvedApplyId(SessionSchema,session,reqCtx),ctx)}async function deleteSession(deps,sessionId,ctx){let reqCtx=new RequestContext(SessionCommandController.method.delete.input,sessionId,callerIdentityOf(ctx),kindOf19(ctx));await newPipeline("session-delete",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,SessionSchema)).addStep(newRejectDeleteWithActiveExecutionsStep(deps.store,deps.logger)).addStep(newCascadeDeleteAgentExecutionsStep(deps.store,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted session not found in context"),"deleted session not found in context");return await deprovisionSessionSandboxBestEffort(deps.sandboxLane,deps.logger,deleted.metadata?.id??""),deleted}async function updateSubject(deps,req,identity2){if(req.id==="")throw invalidArgumentError("id is required");let kind=ApiResourceKind.session,session;try{session=await deps.store.getResource(kind,req.id,SessionSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("session",req.id):internalError(error2,"failed to load session")}await authorizeDirect(SessionCommandController.method.updateSubject,deps.authorizer,identity2,req),session.spec===void 0&&(session.spec=create2(SessionSpecSchema,{})),session.spec.subject=req.subject,setAuditFieldsForUpdate(SessionSchema,session,"spec_audit",identity2);try{await deps.store.saveResource(kind,req.id,SessionSchema,session)}catch(error2){throw internalError(error2,"failed to persist session")}return await indexSessionSearch(deps,kind,session),session}async function indexSessionSearch(deps,kind,session){let entry=sessionSearchExtractor.getSearchIndexEntry(session);if(entry!==void 0)try{await deps.store.upsertSearchIndex(kind,session.metadata?.id??"",entry)}catch(error2){deps.logger.warn("UpdateSubject: failed to update search index (best-effort)",{id:session.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}async function get20(deps,id,ctx){let reqCtx=new RequestContext(SessionQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-get",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,SessionSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function list10(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-list",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListAllSessionsStep(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY8))}async function listByAgentInstance(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.listByAgentInstance.input,req,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-list-by-agent-instance",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.listByAgentInstance,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newFilterByAgentInstanceStep(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY8))}async function listByChannel(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.listByChannel.input,req,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-list-by-channel",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.listByChannel,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeChannelAccessStep(deps.authorizer)).addStep(newFilterByChannelStep(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY8))}function requireListResult2(result){if(result===void 0)throw internalError(new Error("session list not found in context"),"session list not found in context");return result}var file_ai_stigmer_agentic_plugin_v1_io=fileDesc("CiVhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL2lvLnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxIiEKCFBsdWdpbklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEi9wIKEVB1c2hQbHVnaW5SZXF1ZXN0EhMKA29yZxgBIAEoCUIGukgDyAEBEhAKCGFydGlmYWN0GAIgASgMEhsKE2FydGlmYWN0X3VwbG9hZF9yZWYYAyABKAkSUwoKdmlzaWJpbGl0eRgEIAEoDjI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVZpc2liaWxpdHlCCLpIBYIBAhABEg8KB21lc3NhZ2UYBSABKAk6twG6SLMBGrABCiNwdXNoX3BsdWdpbl9yZXF1ZXN0LmFydGlmYWN0X3NvdXJjZRJJZXhhY3RseSBvbmUgb2YgYXJ0aWZhY3QgKGlubGluZSBieXRlcykgb3IgYXJ0aWZhY3RfdXBsb2FkX3JlZiBtdXN0IGJlIHNldBo+KHRoaXMuYXJ0aWZhY3Quc2l6ZSgpID4gMCkgIT0gKHRoaXMuYXJ0aWZhY3RfdXBsb2FkX3JlZiAhPSAnJykiWAokQ3JlYXRlUGx1Z2luQXJ0aWZhY3RVcGxvYWRVcmxSZXF1ZXN0EhMKA29yZxgBIAEoCUIGukgDyAEBEhsKCnNpemVfYnl0ZXMYAiABKANCB7pIBCICIAAiWAoXUGx1Z2luQXJ0aWZhY3RVcGxvYWRVcmwSCwoDdXJsGAEgASgJEhsKE2FydGlmYWN0X3VwbG9hZF9yZWYYAiABKAkSEwoLdHRsX3NlY29uZHMYAyABKAUihQEKDFBsdWdpbk1lbWJlchJNCgRraW5kGAEgASgOMj8uYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5BcGlSZXNvdXJjZUtpbmQSCgoCaWQYAiABKAkSDAoEc2x1ZxgDIAEoCRIMCgRuYW1lGAQgASgJIlgKGUxpc3RQbHVnaW5NZW1iZXJzUmVzcG9uc2USOwoHbWVtYmVycxgBIAMoCzIqLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luTWVtYmVyImsKF0xpc3RQbHVnaW5WZXJzaW9uc0lucHV0EhMKA29yZxgBIAEoCUIGukgDyAEBEhQKBHNsdWcYAiABKAlCBrpIA8gBARISCgpwYWdlX3Rva2VuGAMgASgJEhEKCXBhZ2Vfc2l6ZRgEIAEoBSLtAQoSUGx1Z2luVmVyc2lvbkVudHJ5Eg4KBmRpZ2VzdBgBIAEoCRItCglwdXNoZWRfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEkgKCXB1c2hlZF9ieRgDIAEoCzI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0QWN0b3ISCwoDdGFnGAQgASgJEhIKCmlzX2N1cnJlbnQYBSABKAgSDwoHbWVzc2FnZRgGIAEoCRIcChRhcnRpZmFjdF9zdG9yYWdlX2tleRgHIAEoCSKOAQoaTGlzdFBsdWdpblZlcnNpb25zUmVzcG9uc2USQgoIdmVyc2lvbnMYASADKAsyMC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpblZlcnNpb25FbnRyeRIXCg9uZXh0X3BhZ2VfdG9rZW4YAiABKAkSEwoLdG90YWxfY291bnQYAyABKAViBnByb3RvMw",[file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_kind,file_ai_stigmer_commons_apiresource_enum,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate,file_google_protobuf_timestamp]);var PushPluginRequestSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,1);var PluginArtifactUploadUrlSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,3),PluginMemberSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,4),ListPluginMembersResponseSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,5);var PluginVersionEntrySchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,7),ListPluginVersionsResponseSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,8);var file_ai_stigmer_agentic_plugin_v1_command=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL2NvbW1hbmQucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEy2gUKF1BsdWdpbkNvbW1hbmRDb250cm9sbGVyEqEBCgRwdXNoEi8uYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QdXNoUGx1Z2luUmVxdWVzdBokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIkLCuBg+CCgQHiIDb3JnKjN1bmF1dGhvcml6ZWQgdG8gaW5zdGFsbCBwbHVnaW4gaW4gdGhpcyBvcmdhbml6YXRpb24S2AEKF2NyZWF0ZUFydGlmYWN0VXBsb2FkVXJsEkIuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5DcmVhdGVQbHVnaW5BcnRpZmFjdFVwbG9hZFVybFJlcXVlc3QaNS5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpbkFydGlmYWN0VXBsb2FkVXJsIkLCuBg+CCgQHiIDb3JnKjN1bmF1dGhvcml6ZWQgdG8gaW5zdGFsbCBwbHVnaW4gaW4gdGhpcyBvcmdhbml6YXRpb24SsAEKEHVwZGF0ZVZpc2liaWxpdHkSNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuVXBkYXRlVmlzaWJpbGl0eUlucHV0GiQuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW4iP8K4GDsIAhA6IgtyZXNvdXJjZV9pZCoodW5hdXRob3JpemVkIHRvIHVwZGF0ZSBwbHVnaW4gdmlzaWJpbGl0eRKGAQoGZGVsZXRlEiYuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5JZBokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIi7CuBgqCAMQOiIFdmFsdWUqHXVuYXV0aG9yaXplZCB0byBkZWxldGUgcGx1Z2luGgSg/ys6YgZwcm90bzM",[file_ai_stigmer_agentic_plugin_v1_api,file_ai_stigmer_agentic_plugin_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),PluginCommandController=serviceDesc(file_ai_stigmer_agentic_plugin_v1_command,0);var file_ai_stigmer_agentic_plugin_v1_query=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL3F1ZXJ5LnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxMsMEChVQbHVnaW5RdWVyeUNvbnRyb2xsZXISgAEKA2dldBImLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luSWQaJC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpbiIrwrgYJwgBEDoiBXZhbHVlKhp1bmF1dGhvcml6ZWQgdG8gZ2V0IHBsdWdpbhJyCg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIgTQuBgBEqQBCgtsaXN0TWVtYmVycxImLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luSWQaNy5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLkxpc3RQbHVnaW5NZW1iZXJzUmVzcG9uc2UiNMK4GDAIARA6IgV2YWx1ZSojdW5hdXRob3JpemVkIHRvIGxpc3QgcGx1Z2luIG1lbWJlcnMShQEKDGxpc3RWZXJzaW9ucxI1LmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuTGlzdFBsdWdpblZlcnNpb25zSW5wdXQaOC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLkxpc3RQbHVnaW5WZXJzaW9uc1Jlc3BvbnNlIgTQuBgBGgSg/ys6YgZwcm90bzM",[file_ai_stigmer_agentic_plugin_v1_api,file_ai_stigmer_agentic_plugin_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),PluginQueryController=serviceDesc(file_ai_stigmer_agentic_plugin_v1_query,0);var PLATFORM_ARCHIVE_LIMITS={maxFiles:1e4,maxUncompressedSize:524288e3,maxCompressionRatio:100};var import_node_fs8=__toESM(require("node:fs"),1),import_node_path11=__toESM(require("node:path"),1),import_promises6=require("node:stream/promises"),SlotUnknownError=class extends Error{constructor(){super("upload reference unknown or expired"),this.name="SlotUnknownError"}},SlotConsumedError=class extends Error{constructor(){super("upload reference already carries an upload"),this.name="SlotConsumedError"}},SizeMismatchError=class extends Error{constructor(received,declared){super(`upload size mismatch: received ${received} bytes, declared ${declared}`),this.name="SizeMismatchError"}},STAGED_FILE_NAME=/^[0-9a-f]+\.zip$/,UploadSlots=class{root;stagingPrefix;ttlMs;maxSize;slots=new Map;stagingDir;now;constructor(root5,stagingPrefix,ttlMs,maxSize,now=Date.now){this.root=root5,this.stagingPrefix=stagingPrefix,this.ttlMs=ttlMs,this.maxSize=maxSize,this.stagingDir=import_node_path11.default.join(root5,stagingPrefix),import_node_fs8.default.rmSync(this.stagingDir,{recursive:!0,force:!0}),import_node_fs8.default.mkdirSync(this.stagingDir,{recursive:!0,mode:448}),this.now=now}reserve(key,declaredSize){if(declaredSize<=0||declaredSize>this.maxSize)throw new Error(`declared size ${declaredSize} outside (0, ${this.maxSize}]`);if(this.stagePath(key),this.slots.has(key))throw new Error(`staging key ${key} is already reserved`);return this.sweep(),this.slots.set(key,{declaredSize,expiresAtMs:this.now()+this.ttlMs,uploaded:!1}),{ttlMs:this.ttlMs}}async receive(key,body){let slot=this.slots.get(key);if(slot===void 0||this.now()>slot.expiresAtMs)throw new SlotUnknownError;if(slot.uploaded)throw new SlotConsumedError;let declared=slot.declaredSize,filePath=this.stagePath(key),written=0;try{await import_node_fs8.default.promises.mkdir(import_node_path11.default.dirname(filePath),{recursive:!0,mode:448}),await(0,import_promises6.pipeline)(body,limitBytes(declared+1,n3=>{written+=n3}),import_node_fs8.default.createWriteStream(filePath,{flags:"w",mode:384}))}catch(error2){throw await import_node_fs8.default.promises.rm(filePath,{force:!0}),new Error(`failed to receive upload: ${error2 instanceof Error?error2.message:String(error2)}`)}if(written!==declared)throw await import_node_fs8.default.promises.rm(filePath,{force:!0}),new SizeMismatchError(written,declared);let current=this.slots.get(key);if(current===void 0||this.now()>current.expiresAtMs)throw await import_node_fs8.default.promises.rm(filePath,{force:!0}),new SlotUnknownError;current.uploaded=!0}sweep(){let nowMs=this.now();for(let[key,slot]of this.slots)nowMs>slot.expiresAtMs&&(this.slots.delete(key),import_node_fs8.default.rmSync(this.stagePath(key),{force:!0}))}stagePath(key){if(!key.startsWith(this.stagingPrefix))throw new Error(`staging key ${key} is outside ${this.stagingPrefix}`);let fileName=key.slice(this.stagingPrefix.length);if(!STAGED_FILE_NAME.test(fileName))throw new Error(`staging key ${key} does not name a staged archive`);return import_node_path11.default.join(this.root,key)}};function limitBytes(limit,onBytes){return async function*(source){let remaining=limit;for await(let chunk of source){if(remaining<=0)return;let slice=chunk.length<=remaining?chunk:chunk.subarray(0,remaining);remaining-=slice.length,onBytes(slice.length),yield slice}}}var ARTIFACT_BYTES_KEY="pushArtifactBytes";function newResolveArtifactSourceStep(staging,binding){return{name:"ResolveArtifactSource",async execute(ctx){let{artifact,artifactUploadRef}=binding.source(ctx.input);if(artifactUploadRef===""){ctx.set(ARTIFACT_BYTES_KEY,artifact);return}if(staging===void 0)throw failedPreconditionError(binding.laneNotConfigured);let data;try{data=await staging.consume(artifactUploadRef)}catch(error2){throw error2 instanceof SlotUnknownError?invalidArgumentError(`artifact_upload_ref not usable: ${error2.message} \u2014 request a new upload URL via createArtifactUploadUrl`):error2}ctx.set(ARTIFACT_BYTES_KEY,data)}}}function newArchiveCurrentVersionStep(store,logger2,binding){return{name:binding.stepName,async execute(ctx){let resource=ctx.get(binding.resourceKey),versionHash=binding.headHashOf(resource);if(versionHash==="")return;let tag2=binding.liveTagOf(resource),resourceId=metadataOf(resource)?.id??"",idField=`${binding.noun}Id`,alreadyArchived=!1;try{await store.getAuditByHash(ctx.apiResourceKind,resourceId,versionHash,binding.schema),alreadyArchived=!0}catch(error2){error2 instanceof AuditNotFoundError||logger2.warn(`Could not check for an existing archived ${binding.noun} version \u2014 archiving anyway`,{[idField]:resourceId,versionHash,error:error2 instanceof Error?error2.message:String(error2)})}if(!alreadyArchived)try{await store.saveAudit(ctx.apiResourceKind,resourceId,binding.schema,resource,versionHash,"")}catch(error2){logger2.error(`Failed to archive ${binding.noun} version \u2014 reverting the version hash to maintain the audit-resolvability invariant`,{[idField]:resourceId,versionHash,error:error2 instanceof Error?error2.message:String(error2)}),binding.clearHeadHash(resource);return}if(tag2!=="")try{await store.setAuditTag(ctx.apiResourceKind,resourceId,versionHash,tag2)}catch(error2){logger2.error(`Archived ${binding.noun} version but failed to assign its tag \u2014 clearing the live tag to stay consistent with the audit column`,{[idField]:resourceId,versionHash,tag:tag2,error:error2 instanceof Error?error2.message:String(error2)}),binding.clearLiveTag(resource)}alreadyArchived?logger2.info(`${capitalize(binding.noun)} version content already archived \u2014 repointed head without a new history row`,{[idField]:resourceId,versionHash,tag:tag2}):logger2.info(`Archived ${binding.noun} version to audit history`,{[idField]:resourceId,versionHash,tag:tag2})}}}function newDeleteVersionArchivesStep(store,logger2,binding){return{name:binding.stepName,async execute(ctx){let resourceId=ctx.get(RESOURCE_ID_KEY);if(typeof resourceId!="string")throw new Error("resource id not found in context (ExtractResourceIdStep must run first)");let idField=`${binding.noun}Id`;try{let deletedCount=await store.deleteAuditByResourceId(ctx.apiResourceKind,resourceId);deletedCount>0&&logger2.info(`Deleted archive records for ${binding.noun}`,{[idField]:resourceId,count:deletedCount})}catch(error2){logger2.warn(`failed to delete ${binding.noun} archives (best-effort)`,{[idField]:resourceId,error:error2 instanceof Error?error2.message:String(error2)})}}}}function capitalize(word){return word.charAt(0).toUpperCase()+word.slice(1)}var HASH_PATTERN=/^[a-f0-9]{64}$/;function isVersionHash(version){return HASH_PATTERN.test(version)}function newLoadByReferenceWithVersionStep(store,binding,stepName){return{name:stepName,async execute(ctx){let ref=ctx.input;if(ref.slug==="")throw invalidArgumentError("slug is required in reference");if(requireOrgForReference(ctx.apiResourceKind,ref.org),ref.kind!==ApiResourceKind.api_resource_kind_unknown&&ref.kind!==binding.kind)throw invalidArgumentError(`kind mismatch: expected ${ApiResourceKind[binding.kind]}, got ${ApiResourceKind[ref.kind]}`);let head;try{head=await findResourceBySlug(store,ctx.apiResourceKind,binding.schema,ref.slug,ref.org)}catch(error2){throw internalError(error2,`failed to list ${binding.noun}s`)}if(head===void 0)throw notFoundError(binding.noun,ref.slug);let version=ref.version.trim();if(version===""||version==="latest"){ctx.set(TARGET_RESOURCE_KEY,head);return}if(headMatchesVersion(binding,head,version)){ctx.set(TARGET_RESOURCE_KEY,head);return}let archived=await findAuditByVersion(store,ctx.apiResourceKind,binding.schema,idOf(head),version);if(archived===void 0)throw notFoundError(`${binding.noun} version`,`${ref.slug}:${version}`);ctx.set(TARGET_RESOURCE_KEY,archived)}}}function headMatchesVersion(binding,head,version){if(isVersionHash(version))return binding.headHashOf(head)===version;let liveTag=binding.liveTagOf(head);return liveTag!==""&&liveTag===version}async function findAuditByVersion(store,kind,schema2,resourceId,version){if(isVersionHash(version))try{return await store.getAuditByHash(kind,resourceId,version,schema2)}catch(error2){if(error2 instanceof AuditNotFoundError)return;throw internalError(error2,"failed to query audit by hash")}try{return await store.getAuditByTag(kind,resourceId,version,schema2)}catch(error2){if(error2 instanceof AuditNotFoundError)return;throw internalError(error2,"failed to query audit by tag")}}var DEFAULT_PAGE_SIZE=50,MAX_PAGE_SIZE=100,LIST_VERSIONS_RESOURCE_ID_KEY="listVersionsResourceId",LIST_VERSIONS_HEAD_HASH_KEY="listVersionsHeadHash",LIST_VERSIONS_RESPONSE_KEY="listVersionsResponse";function versionHistoryTarget(kind,deniedMessage,idKey=LIST_VERSIONS_RESOURCE_ID_KEY){return ctx=>{let resourceId=ctx.get(idKey);if(typeof resourceId!="string"||resourceId==="")throw new Error(`ListVersions: no resolved resource id under ${idKey}; the slug resolver must run first`);return[{permission:IamPermission.can_view,resourceKind:kind,resourceId,deniedMessage}]}}function newResolveBySlugForVersionsStep(store,binding,stepName){return{name:stepName,async execute(ctx){let req=binding.input(ctx.input),head;try{head=await findResourceBySlug(store,ctx.apiResourceKind,binding.schema,req.slug,req.org)}catch(error2){throw internalError(error2,`failed to search for ${binding.noun}`)}if(head===void 0)throw notFoundError(binding.noun,`${req.slug} (org: ${req.org})`);ctx.set(LIST_VERSIONS_RESOURCE_ID_KEY,idOf(head)),ctx.set(LIST_VERSIONS_HEAD_HASH_KEY,binding.headHashOf(head))}}}function newLoadAndMapVersionsStep(store,binding,stepName){return{name:stepName,async execute(ctx){let req=binding.input(ctx.input),resourceId=ctx.get(LIST_VERSIONS_RESOURCE_ID_KEY),records;try{records=await store.listAuditRecords(ctx.apiResourceKind,resourceId)}catch(error2){throw internalError(error2,"failed to load version history")}let headHash=ctx.get(LIST_VERSIONS_HEAD_HASH_KEY),currentMarked=!1,entries=[];for(let record2 of records){let snapshot;try{snapshot=fromBinary2(binding.schema,record2.data)}catch{continue}let isCurrent=!currentMarked&&headHash!==""&&binding.headHashOf(snapshot)===headHash;currentMarked=currentMarked||isCurrent,entries.push(binding.mapEntry(snapshot,isCurrent,record2.tag))}let pageSize=req.pageSize;pageSize<=0&&(pageSize=DEFAULT_PAGE_SIZE),pageSize>MAX_PAGE_SIZE&&(pageSize=MAX_PAGE_SIZE);let startIndex=0;req.pageToken!==""&&(startIndex=decodePageToken(req.pageToken));let pageEntries=[],nextPageToken="";if(startIndex<entries.length){let end=Math.min(startIndex+pageSize,entries.length);pageEntries=entries.slice(startIndex,end),end<entries.length&&(nextPageToken=Buffer.from(String(end)).toString("base64"))}ctx.set(LIST_VERSIONS_RESPONSE_KEY,binding.response(pageEntries,nextPageToken,entries.length))}}}function decodePageToken(token){let decoded=Buffer.from(token,"base64");if(decoded.toString("base64")!==token)throw invalidArgumentError("invalid page_token");let text2=decoded.toString("utf8"),index2=Number.parseInt(text2,10);if(!Number.isSafeInteger(index2)||String(index2)!==text2||index2<0)throw invalidArgumentError("invalid page_token");return index2}function idOf(resource){return metadataOf(resource)?.id??""}var PLUGIN_ARTIFACT_KEY_PREFIX="plugins/",VERSION_TAG_PATTERN=/^[a-zA-Z0-9._-]+$/,BUILT_IN_SUB_AGENT_NAMES=new Set(["explore","shell","general-purpose"]);var TRANSFER_LANE_NOT_CONFIGURED="plugin artifact transfer lane is not configured on this server",SERVER_WARNING_KINDS={componentIgnored:"component-ignored",memberAdopted:"member-adopted",modelHintUnresolved:"model-hint-unresolved",subAgentNameBuiltin:"sub-agent-name-builtin",versionNotTaggable:"version-not-taggable"};var MEMBER_KINDS=[{kind:ApiResourceKind.skill,schema:SkillSchema},{kind:ApiResourceKind.mcp_server,schema:McpServerSchema},{kind:ApiResourceKind.agent,schema:AgentSchema},{kind:ApiResourceKind.workflow,schema:WorkflowSchema}];function memberOf(kind,metadata){return{kind,id:metadata.id,slug:metadata.slug,name:metadata.name,version:metadata.labels[PLUGIN_VERSION_LABEL]??"",system:isSystemContent(metadata)}}async function findMembers(store,pluginId,org){let members=[];for(let{kind,schema:schema2}of MEMBER_KINDS){let raws=await store.findAllByLabel(kind,PLUGIN_LABEL,pluginId,schema2);for(let raw of raws){let metadata=metadataOf(fromBinary2(schema2,raw));metadata!==void 0&&metadata.org===org&&members.push(memberOf(kind,metadata))}}return members}async function slugHolder(store,planned,org){let entry=MEMBER_KINDS.find(candidate=>candidate.kind===planned.kind);if(entry===void 0)throw new Error(`kind ${ApiResourceKind[planned.kind]} is not a plugin member kind`);let existing=await findResourceBySlug(store,planned.kind,entry.schema,planned.slug,org),metadata=existing===void 0?void 0:metadataOf(existing);return metadata===void 0?{held:!1}:{held:!0,byPlugin:pluginIdOf(metadata),holder:memberOf(planned.kind,metadata)}}function judgeSlug(holder,planned,pluginId){return holder.held?holder.byPlugin===pluginId?{kind:"ours",holder:holder.holder}:holder.byPlugin!==void 0?{kind:"held-by-plugin",holder:holder.holder,pluginId:holder.byPlugin}:holder.holder.system&&planned.system?{kind:"adopt",holder:holder.holder}:{kind:"held-unmanaged",holder:holder.holder}:{kind:"free"}}function membersConverge(existing,planned,digest3){if(existing.length!==planned.length)return!1;let byKey=new Map(existing.map(member2=>[`${member2.kind}:${member2.slug}`,member2]));return planned.every(member2=>{let found=byKey.get(`${member2.kind}:${member2.slug}`);return found!==void 0&&found.version===digest3})}function droppedMembers(existing,planned){let keep=new Set(planned.map(member2=>`${member2.kind}:${member2.slug}`));return existing.filter(member2=>!keep.has(`${member2.kind}:${member2.slug}`))}var PLUGIN_DOCUMENT_LIMITS={manifest:262144,mcpConfig:262144,skillMd:1048576,subAgent:1048576,overlay:1048576,logo:1048576,marketplace:1048576},encoder5=new TextEncoder,decoder3=new TextDecoder("utf-8",{fatal:!1});function comparePaths(a5,b7){return a5<b7?-1:a5>b7?1:0}function decodeUtf8(bytes){let text2=decoder3.decode(bytes);return text2.charCodeAt(0)===65279?text2.slice(1):text2}function isContainedPath(path14){return path14===""||path14.startsWith("/")||path14.includes("\\")?!1:path14.split("/").every(segment=>segment!==""&&segment!=="."&&segment!=="..")}var GLOB_CHARACTERS=/[*?[\]{}]/;function resolveDeclaredPath(value){if(GLOB_CHARACTERS.test(value))return{ok:!1,kind:"path-glob-unsupported"};if(value==="."||value==="./")return{ok:!0,path:""};if(!value.startsWith("./"))return{ok:!1,kind:"path-not-relative"};let trimmed=value.slice(2).replace(/\/+$/,"");return trimmed===""?{ok:!0,path:""}:isContainedPath(trimmed)?{ok:!0,path:trimmed}:{ok:!1,kind:"path-escapes-root"}}function joinPath(dir,name){return dir===""?name:`${dir}/${name}`}function basename(path14){let slash=path14.lastIndexOf("/");return slash===-1?path14:path14.slice(slash+1)}function dirname(path14){let slash=path14.lastIndexOf("/");return slash===-1?"":path14.slice(0,slash)}var PluginFileIndex=class{files;byPath;constructor(files){this.files=files,this.byPath=new Map(files.entries.map(entry=>[entry.path,entry]))}has(path14){return this.byPath.has(path14)}entry(path14){return this.byPath.get(path14)}filesUnder(dir){if(dir==="")return this.files.entries.map(entry=>entry.path);let prefix=`${dir}/`;return this.files.entries.filter(entry=>entry.path.startsWith(prefix)).map(entry=>entry.path)}isDirectory(dir){if(dir==="")return this.files.entries.length>0;let prefix=`${dir}/`;return this.files.entries.some(entry=>entry.path.startsWith(prefix))}childDirectories(dir){let prefix=dir===""?"":`${dir}/`,names=new Set;for(let entry of this.files.entries){if(!entry.path.startsWith(prefix))continue;let rest=entry.path.slice(prefix.length),slash=rest.indexOf("/");slash!==-1&&names.add(rest.slice(0,slash))}return[...names].sort(comparePaths)}childFiles(dir){let prefix=dir===""?"":`${dir}/`,names=[];for(let entry of this.files.entries){if(!entry.path.startsWith(prefix))continue;let rest=entry.path.slice(prefix.length);rest.includes("/")||names.push(rest)}return names.sort(comparePaths)}};function readText(index2,path14,cls,findings){let bytes=readBytes(index2,path14,cls,findings);return bytes===void 0?void 0:decodeUtf8(bytes)}function readBytes(index2,path14,cls,findings){let limit=PLUGIN_DOCUMENT_LIMITS[cls],entry=index2.entry(path14);if(entry===void 0)throw new Error(`plugin file '${path14}' is not listed`);if(entry.size>limit){findings.error("document-too-large",{path:path14,subject:String(entry.size),detail:String(limit)});return}let bytes=index2.files.read(path14);if(bytes.length>limit){findings.error("document-too-large",{path:path14,subject:String(bytes.length),detail:String(limit)});return}return bytes}function parseJsonObject2(text2,path14,kind,findings){let value;try{value=JSON.parse(text2)}catch(error2){findings.error(kind,{path:path14,detail:error2 instanceof Error?error2.message:String(error2)});return}if(!isJsonObject2(value)){findings.error(kind,{path:path14,detail:"the document is not a JSON object"});return}return value}function isJsonObject2(value){return typeof value=="object"&&value!==null&&!Array.isArray(value)}function isStringArray(value){return Array.isArray(value)&&value.every(item=>typeof item=="string")}function isStringRecord(value){return isJsonObject2(value)&&Object.values(value).every(item=>typeof item=="string")}function describeValue(value){return typeof value=="string"?value:JSON.stringify(value)}function fields(object){return Object.entries(object)}function optionalString(object,field3,path14,findings){let value=object[field3];if(value!==void 0){if(typeof value!="string"){findings.error("manifest-field-type",{path:path14,subject:field3,detail:"a string"});return}return value}}function optionalStringArray(object,field3,path14,findings){let value=object[field3];if(value!==void 0){if(!isStringArray(value)){findings.error("manifest-field-type",{path:path14,subject:field3,detail:"an array of strings"});return}return value}}function stringOrStringArray(object,field3,path14,findings){let value=object[field3];if(value!==void 0){if(typeof value=="string")return[value];if(isStringArray(value))return value;findings.error("manifest-field-type",{path:path14,subject:field3,detail:"a string or an array of strings"})}}function warnUnknownFields(object,known,path14,findings){for(let[name]of fields(object))known.has(name)||findings.warn("manifest-field-unknown",{path:path14,subject:name})}function readIdentity(object,path14,findings){let identity2={},name=optionalString(object,"name",path14,findings);name!==void 0&&(identity2.name=name);let version=optionalString(object,"version",path14,findings);version!==void 0&&(identity2.version=version);let description=optionalString(object,"description",path14,findings);description!==void 0&&(identity2.description=description);let homepage=optionalString(object,"homepage",path14,findings);homepage!==void 0&&(identity2.homepage=homepage);let repository=optionalString(object,"repository",path14,findings);repository!==void 0&&(identity2.repository=repository);let license=optionalString(object,"license",path14,findings);license!==void 0&&(identity2.license=license);let keywords=optionalStringArray(object,"keywords",path14,findings);keywords!==void 0&&(identity2.keywords=keywords);let author=readAuthor(object,path14,findings);return author!==void 0&&(identity2.author=author),identity2}function readAuthor(object,path14,findings){let value=object.author;if(value===void 0)return;if(!isJsonObject2(value)){findings.error("manifest-field-type",{path:path14,subject:"author",detail:"an object"});return}let author={},name=optionalString(value,"name",path14,findings);name!==void 0&&(author.name=name);let email=optionalString(value,"email",path14,findings);email!==void 0&&(author.email=email);let url=optionalString(value,"url",path14,findings);return url!==void 0&&(author.url=url),author}function readDeclaredPaths(object,field3,path14,findings){let values=stringOrStringArray(object,field3,path14,findings);if(values===void 0)return;let declared=[];for(let value of values){let resolved=resolveDeclaredPath(value);if(!resolved.ok){findings.error(resolved.kind,{path:path14,subject:value});continue}declared.push({path:resolved.path,manifest:path14})}return declared}function readMcpSources(object,field3,path14,dialect,findings){let value=object[field3];if(value===void 0)return[];let items=Array.isArray(value)?value:[value],sources=[];for(let item of items)if(typeof item=="string"){let resolved=resolveDeclaredPath(item);if(!resolved.ok){findings.error(resolved.kind,{path:path14,subject:item});continue}sources.push({kind:"file",path:resolved.path,dialect,manifest:path14})}else isJsonObject2(item)?sources.push({kind:"inline",manifest:path14,servers:item,dialect}):findings.error("manifest-field-type",{path:path14,subject:field3,detail:"a path, an object, or an array of either"});return sources}var IGNORED_FIELD_KINDS={hooks:"hooks",rules:"rules",commands:"commands",workflows:"workflows",outputStyles:"output-styles",lspServers:"lsp-servers",channels:"channels",dependencies:"dependencies",defaultEnabled:"default-enabled",minClientVersions:"min-client-versions",logo:"logo",apps:"apps"};function ignoredFieldComponents(object,path14){let ignored=[];for(let[name,value]of fields(object)){let kind=IGNORED_FIELD_KINDS[name];if(kind!==void 0&&ignored.push({kind,path:`${path14}#${name}`}),name==="experimental"&&isJsonObject2(value))for(let[sub]of fields(value)){let subKind=EXPERIMENTAL_KINDS[sub];subKind!==void 0&&ignored.push({kind:subKind,path:`${path14}#experimental.${sub}`})}}return ignored}var EXPERIMENTAL_KINDS={themes:"themes",monitors:"monitors",evals:"evals"},STIGMER_EXTENSION_NAMESPACE="ai.stigmer",STIGMER_EXTENSION_FIELDS=new Set(["displayName","logo","category"]);function extensionComponents(object,path14,findings){let value=object.extensions;if(value===void 0)return[];if(!isJsonObject2(value))return findings.warn("manifest-extensions-invalid",{path:path14}),[];let ignored=[];for(let[namespace,content]of fields(value)){if(isJsonObject2(content)&&fields(content).length===0)continue;let at2=`${path14}#extensions.${namespace}`;if(namespace===STIGMER_EXTENSION_NAMESPACE&&isJsonObject2(content)){content.logo!==void 0&&ignored.push({kind:"logo",path:`${at2}.logo`}),fields(content).some(([name])=>!STIGMER_EXTENSION_FIELDS.has(name))&&ignored.push({kind:"extension",path:at2});continue}ignored.push({kind:"extension",path:at2})}return ignored}var CLAUDE_KNOWN_FIELDS=new Set(["name","version","description","author","homepage","repository","license","keywords","skills","commands","agents","workflows","hooks","mcpServers","outputStyles","lspServers","experimental","userConfig","channels","dependencies","defaultEnabled"]),CLAUDE_DEFAULT_MCP_CONFIG=".mcp.json";function readClaudeManifest(object,path14,findings){return readClaudeShapedManifest(object,path14,"claude",CLAUDE_KNOWN_FIELDS,findings)}function readClaudeShapedManifest(object,path14,dialect,known,findings){warnUnknownFields(object,known,path14,findings);let identity2=readIdentity(object,path14,findings),skillPaths=readDeclaredPaths(object,"skills",path14,findings)??[],agentPaths=readDeclaredPaths(object,"agents",path14,findings),declaredMcp=readMcpSources(object,"mcpServers",path14,dialect,findings),manifest={dialect,path:path14,identity:identity2,skillPaths,mcpConfigs:declaredMcp,ignored:ignoredFieldComponents(object,path14)};return agentPaths!==void 0&&(manifest.agentPaths=agentPaths),object.userConfig!==void 0&&(manifest.variables={dialect:"claude",value:object.userConfig,manifest:path14}),manifest}var KNOWN_FIELDS=new Set([...CLAUDE_KNOWN_FIELDS,"apps","interface"]);function readCodexManifest(object,path14,findings){return readClaudeShapedManifest(object,path14,"codex",KNOWN_FIELDS,findings)}var KNOWN_FIELDS2=new Set(["name","displayName","description","version","minClientVersions","author","publisher","homepage","repository","license","logo","keywords","category","tags","commands","agents","skills","rules","hooks","variables","mcpServers"]);function readCursorManifest(object,path14,findings){warnUnknownFields(object,KNOWN_FIELDS2,path14,findings);let identity2=readIdentity(object,path14,findings),skillPaths=readDeclaredPaths(object,"skills",path14,findings)??[],agentPaths=readDeclaredPaths(object,"agents",path14,findings),manifest={dialect:"cursor",path:path14,identity:identity2,skillPaths,mcpConfigs:readMcpSources(object,"mcpServers",path14,"cursor",findings),ignored:ignoredFieldComponents(object,path14)};return agentPaths!==void 0&&(manifest.agentPaths=agentPaths),object.variables!==void 0&&(manifest.variables={dialect:"cursor",value:object.variables,manifest:path14}),manifest}var AGENT_PLUGINS_MANIFEST_SCHEMA="https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",AGENT_PLUGINS_MCP_SCHEMA="https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",MANIFEST_LOCATIONS={"agent-plugins":"plugin.json",claude:".claude-plugin/plugin.json",cursor:".cursor-plugin/plugin.json",codex:".codex-plugin/plugin.json"},q3=value=>`'${value??""}'`,at=path14=>path14===void 0?"":` in ${q3(path14)}`,ERROR_MESSAGES={"no-manifest":()=>`no plugin manifest found: expected one of ${Object.values(MANIFEST_LOCATIONS).map(p3=>q3(p3)).join(", ")}`,"manifest-unreadable":c5=>`manifest ${q3(c5.path)} is not valid JSON: ${c5.detail??"parse error"}`,"manifest-schema-missing":c5=>`manifest ${q3(c5.path)} is missing the required '$schema' field; an Agent Plugins manifest declares ${q3(AGENT_PLUGINS_MANIFEST_SCHEMA)}`,"manifest-schema-unsupported":c5=>`manifest ${q3(c5.path)} declares an unsupported '$schema' ${q3(c5.detail)}; this reader supports ${q3(AGENT_PLUGINS_MANIFEST_SCHEMA)}`,"manifest-name-missing":c5=>`manifest ${q3(c5.path)} is missing the required 'name' field`,"manifest-name-invalid":c5=>`plugin name ${q3(c5.subject)}${at(c5.path)} is invalid: 1 to 64 characters of lowercase letters, digits, hyphens and periods, starting and ending alphanumeric, with no '--' or '..'`,"manifest-name-conflict":c5=>`manifests disagree on the plugin name: ${q3(c5.subject)} in ${q3(c5.path)} versus ${c5.detail??"another manifest"}`,"manifest-field-type":c5=>`field ${q3(c5.subject)}${at(c5.path)} has the wrong type: expected ${c5.detail??"a different type"}`,"path-not-relative":c5=>`path ${q3(c5.subject)}${at(c5.path)} must be plugin-relative and begin with './'`,"path-escapes-root":c5=>`path ${q3(c5.subject)}${at(c5.path)} escapes the plugin root`,"path-glob-unsupported":c5=>`path ${q3(c5.subject)}${at(c5.path)} is a glob pattern; declare directories and files by path`,"path-uncontained":c5=>`the reader listed a path outside the plugin root: ${q3(c5.path)}`,"document-too-large":c5=>`${q3(c5.path)} is ${c5.subject??"too many"} bytes, over the ${c5.detail??""}-byte limit for this kind of document`,"skill-frontmatter-missing":c5=>`${q3(c5.path)} must start with YAML frontmatter ('---')`,"skill-frontmatter-unclosed":c5=>`${q3(c5.path)} frontmatter is not closed (missing the closing '---')`,"skill-frontmatter-unreadable":c5=>`${q3(c5.path)} frontmatter is not valid YAML: ${c5.detail??"parse error"}`,"skill-name-invalid":c5=>`skill name ${q3(c5.subject)}${at(c5.path)} is invalid: lowercase letters, digits and hyphens, optionally dot-scoped, with every segment alphanumeric`,"skill-name-duplicate":c5=>`skill name ${q3(c5.subject)} appears more than once (again${at(c5.path)})`,"mcp-config-unreadable":c5=>`MCP configuration ${q3(c5.path)} is not valid JSON: ${c5.detail??"parse error"}`,"mcp-config-shape":c5=>`MCP configuration ${q3(c5.path)} must be an object with an 'mcpServers' object`,"mcp-config-schema-missing":c5=>`MCP configuration ${q3(c5.path)} is missing the required '$schema' field; an Agent Plugins configuration declares ${q3(AGENT_PLUGINS_MCP_SCHEMA)}`,"mcp-config-schema-unsupported":c5=>`MCP configuration ${q3(c5.path)} declares an unsupported '$schema' ${q3(c5.detail)}; this reader supports ${q3(AGENT_PLUGINS_MCP_SCHEMA)}`,"mcp-config-field-unknown":c5=>`MCP configuration ${q3(c5.path)} has an unexpected top-level field ${q3(c5.subject)}; only '$schema' and 'mcpServers' are allowed`,"mcp-server-shape":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} must be an object`,"mcp-server-type-missing":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} is missing the 'type' field the Agent Plugins format requires ('stdio', 'streamable-http' or 'sse')`,"mcp-server-transport-unknown":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has no 'type' and neither a 'command' nor a 'url' to infer it from`,"mcp-server-type-ambiguous":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} declares both 'command' and 'url'; a server is either stdio or HTTP`,"mcp-server-type-unknown":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an unknown 'type' ${q3(c5.detail)}; expected 'stdio', 'http', 'streamable-http' or 'sse'`,"mcp-server-field-unknown":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a field ${q3(c5.detail)} that its transport does not define`,"mcp-server-field-type":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} field ${q3(c5.detail)} has the wrong type`,"mcp-server-url-missing":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} is missing the 'url' its HTTP transport requires`,"mcp-server-url-invalid":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an invalid 'url' ${q3(c5.detail)}: expected an absolute HTTPS URL (HTTP only for localhost) with no user information or fragment`,"mcp-server-url-variable":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a variable in its 'url'; Stigmer sends the URL as written, so write the URL out and put variables in 'headers'`,"mcp-server-command-missing":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} is missing the 'command' its stdio transport requires`,"mcp-server-command-invalid":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a 'command' that is not a single executable name; put arguments in 'args'`,"mcp-server-command-relative":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} runs a command bundled in the plugin ${q3(c5.detail)}; Stigmer runs only commands on the runner's PATH (for example 'npx' or 'uvx')`,"mcp-server-plugin-root-reference":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} references the plugin's own files through ${q3(c5.detail)}; Stigmer does not mount plugin files into the runner`,"mcp-server-cwd-unsupported":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} sets a working directory; Stigmer does not mount plugin files, so a bundled directory cannot be reached`,"mcp-server-env-literal":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} sets environment variable ${q3(c5.detail)} to a literal value; Stigmer passes declared variables by name, so write ${q3(`${c5.detail??"KEY"}: "\${${c5.detail??"KEY"}}"`)} and declare the variable`,"mcp-server-env-rename":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} maps environment variable ${q3(c5.detail)} to a differently named variable; Stigmer passes declared variables by name, so use the same name on both sides`,"mcp-server-name-duplicate":c5=>`MCP server name ${q3(c5.subject)} appears more than once (again${at(c5.path)})`,"mcp-server-header-duplicate":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} declares header ${q3(c5.detail)} more than once (header names are case-insensitive)`,"mcp-server-header-invalid":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an invalid header name ${q3(c5.detail)}`,"sub-agent-frontmatter-unreadable":c5=>`${q3(c5.path)} frontmatter is not valid YAML: ${c5.detail??"parse error"}`,"sub-agent-instructions-short":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} has instructions under ${c5.detail??""} characters; the body of the file is the sub-agent's prompt`,"sub-agent-name-duplicate":c5=>`sub-agent name ${q3(c5.subject)} appears more than once (again${at(c5.path)})`,"variable-name-invalid":c5=>`variable name ${q3(c5.subject)}${at(c5.path)} is invalid: an environment variable name is letters, digits and underscores, not starting with a digit`,"overlay-server-unknown":c5=>`${q3(c5.path)} overlays MCP server ${q3(c5.subject)}, which the plugin does not declare`,"overlay-document-unknown":c5=>`${q3(c5.path)} is not a document Stigmer reads; the 'ai.stigmer/' folder holds 'agent.yaml', 'workflows/<name>.yaml' and 'mcp-servers/<server>.yaml'`},WARNING_MESSAGES={"manifest-field-unknown":c5=>`manifest ${q3(c5.path)} has an unknown field ${q3(c5.subject)}, ignored`,"manifest-extensions-invalid":c5=>`manifest ${q3(c5.path)} has an 'extensions' field that is not an object, ignored`,"path-missing":c5=>`path ${q3(c5.subject)} declared${at(c5.path)} does not exist in the plugin`,"skill-name-defaulted":c5=>`${q3(c5.path)} has no 'name' in its frontmatter; the skill is named after its directory, ${q3(c5.subject)}`,"skill-name-differs-from-directory":c5=>`skill ${q3(c5.subject)}${at(c5.path)} is named differently from its directory ${q3(c5.detail)}`,"skill-description-missing":c5=>`skill ${q3(c5.subject)}${at(c5.path)} has no 'description'`,"mcp-config-field-ignored":c5=>`MCP configuration ${q3(c5.path)} has a top-level field ${q3(c5.subject)} Stigmer does not read, ignored`,"mcp-server-sse-mapped":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} declares the legacy 'sse' transport; Stigmer connects over Streamable HTTP and falls back to SSE only when the server rejects it`,"mcp-server-field-ignored":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a field ${q3(c5.detail)} Stigmer does not read, ignored`,"mcp-server-auth-ignored":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an 'auth' block Stigmer does not read; OAuth for a server is declared in 'ai.stigmer/mcp-servers/${c5.subject??"<server>"}.yaml'`,"variable-inferred":c5=>`variable ${q3(c5.subject)} is referenced by MCP server ${q3(c5.detail)} but not declared; it is declared as a required secret`,"variable-unreferenced":c5=>`variable ${q3(c5.subject)}${at(c5.path)} is declared but no MCP server references it`,"variable-default-dropped":c5=>`variable ${q3(c5.subject)}${at(c5.path)} has a default value, which Stigmer does not carry; the user supplies the value`,"variable-type-narrowed":c5=>`variable ${q3(c5.subject)}${at(c5.path)} is typed ${q3(c5.detail)}; Stigmer variables are strings`,"variable-option-dropped":c5=>`variable ${q3(c5.subject)}${at(c5.path)} has a ${q3(c5.detail)} constraint, which Stigmer does not carry`,"sub-agent-name-defaulted":c5=>`${q3(c5.path)} has no 'name' in its frontmatter; the sub-agent is named after the file, ${q3(c5.subject)}`,"sub-agent-skill-unknown":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} asks for skill ${q3(c5.detail)}, which the plugin does not ship`,"sub-agent-model-unknown":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} names model ${q3(c5.detail)}, which Stigmer cannot map; the sub-agent runs on the session's model`,"sub-agent-field-ignored":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} has a field ${q3(c5.detail)} Stigmer does not read, ignored`};var FindingCollector=class{errorSentences;warningSentences;errors=[];warnings=[];constructor(errorSentences,warningSentences){this.errorSentences=errorSentences,this.warningSentences=warningSentences}error(kind,ctx={}){this.errors.push(compose(kind,ctx,this.errorSentences[kind](ctx)))}warn(kind,ctx={}){this.warnings.push(compose(kind,ctx,this.warningSentences[kind](ctx)))}},Findings=class extends FindingCollector{constructor(){super(ERROR_MESSAGES,WARNING_MESSAGES)}};function compose(kind,ctx,message6){return{kind,...ctx.path!==void 0&&{path:ctx.path},...ctx.subject!==void 0&&{subject:ctx.subject},...ctx.detail!==void 0&&{detail:ctx.detail},message:message6}}var KNOWN_FIELDS3=new Set(["$schema","name","version","description","author","homepage","repository","license","keywords","extensions"]);function readOpenManifest(object,path14,findings){let schema2=object.$schema;return schema2===void 0?findings.error("manifest-schema-missing",{path:path14}):schema2!==AGENT_PLUGINS_MANIFEST_SCHEMA&&findings.error("manifest-schema-unsupported",{path:path14,detail:describeValue(schema2)}),warnUnknownFields(object,KNOWN_FIELDS3,path14,findings),{dialect:"agent-plugins",path:path14,identity:readIdentity(object,path14,findings),skillPaths:[],mcpConfigs:[],ignored:extensionComponents(object,path14,findings)}}var OPEN_MCP_CONFIG="mcp.json",VENDOR_PRECEDENCE=["claude","cursor","codex"],MANIFEST_PRECEDENCE=["agent-plugins",...VENDOR_PRECEDENCE],NAME_MAX_LENGTH=64,NAME_PATTERN=/^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$/;function detectManifests(index2,findings){let manifests=[],present=dialect=>{let path14=MANIFEST_LOCATIONS[dialect];if(!index2.has(path14))return;let object=readManifestObject(index2,path14,findings),manifest=object===void 0?emptyManifest(dialect,path14):readDialect(dialect,object,path14,findings);return manifests.push(manifest),manifest},root5=present("agent-plugins"),vendors=VENDOR_PRECEDENCE.map(present).filter(m3=>m3!==void 0);if(manifests.length===0){findings.error("no-manifest");return}let identity2=root5??vendors[0];if(identity2===void 0)throw new Error("manifest set without an identity manifest");let ordered=[identity2,...manifests.filter(m3=>m3!==identity2)],name=resolveName(identity2,ordered,findings);return{dialect:identity2.dialect,manifests:ordered,name,readsAgents:vendors.length>0,mcpSources:resolveMcpSources(index2,root5,vendors)}}function readManifestObject(index2,path14,findings){let text2=readText(index2,path14,"manifest",findings);return text2===void 0?void 0:parseJsonObject2(text2,path14,"manifest-unreadable",findings)}function readDialect(dialect,object,path14,findings){switch(dialect){case"agent-plugins":return readOpenManifest(object,path14,findings);case"claude":return readClaudeManifest(object,path14,findings);case"cursor":return readCursorManifest(object,path14,findings);case"codex":return readCodexManifest(object,path14,findings);default:{let exhaustive=dialect;throw new Error(`unknown dialect ${String(exhaustive)}`)}}}function emptyManifest(dialect,path14){return{dialect,path:path14,identity:{},skillPaths:[],mcpConfigs:[],ignored:[]}}function resolveName(identity2,all,findings){let name=identity2.identity.name;if(name===void 0){if(findings.errors.some(f5=>f5.kind==="manifest-unreadable"&&f5.path===identity2.path))return;findings.error("manifest-name-missing",{path:identity2.path});return}let valid=!0;isValidPluginName(name)||(findings.error("manifest-name-invalid",{path:identity2.path,subject:name}),valid=!1);for(let other of all){if(other===identity2)continue;let otherName=other.identity.name;otherName!==void 0&&otherName!==name&&(findings.error("manifest-name-conflict",{path:identity2.path,subject:name,detail:`'${otherName}' in '${other.path}'`}),valid=!1)}return valid?name:void 0}function isValidPluginName(name){return name.length<=NAME_MAX_LENGTH&&NAME_PATTERN.test(name)&&!name.includes("--")&&!name.includes("..")}function resolveMcpSources(index2,root5,vendors){let sources=[];root5!==void 0&&index2.has(OPEN_MCP_CONFIG)&&sources.push({kind:"file",path:OPEN_MCP_CONFIG,dialect:"agent-plugins",manifest:root5.path});for(let vendor of vendors)vendor.mcpConfigs.length>0?sources.push(...vendor.mcpConfigs):vendor.dialect!=="cursor"&&index2.has(CLAUDE_DEFAULT_MCP_CONFIG)&&sources.push({kind:"file",path:CLAUDE_DEFAULT_MCP_CONFIG,dialect:vendor.dialect,manifest:vendor.path});let seen=new Set;return sources.filter(source=>source.kind==="inline"?!0:seen.has(source.path)?!1:(seen.add(source.path),!0))}var import_yaml=__toESM(require_dist2(),1);var SKILL_NAME_PATTERN=/^[a-z0-9]+([.-][a-z0-9]+)*$/;function extractFrontmatter(content){let lines=content.split(/\r?\n/);if(lines.length===0||lines[0]?.trim()!=="---")return{ok:!1,reason:"missing"};for(let i6=1;i6<lines.length;i6++)if(lines[i6]?.trim()==="---")return{ok:!0,yaml:lines.slice(1,i6).join(`
+`);return}let headers2={"Content-Length":String(info.size)},downloadName=url.searchParams.get(LOCAL_DOWNLOAD_QUERY_PARAM)??"";if(downloadName!==""&&(headers2["Content-Disposition"]=contentDispositionAttachment(downloadName)),res.writeHead(200,headers2),req.method==="HEAD"){res.end();return}let stream=(0,import_node_fs7.createReadStream)(filePath);stream.on("error",error2=>{logger2.error("artifact file stream failed",{key,error:error2.message}),res.destroy()}),stream.pipe(res)}catch(error2){logger2.error("artifact file server request failed",{error:error2 instanceof Error?error2.message:String(error2)}),res.headersSent||res.writeHead(500),res.end()}}async function warnOnLegacyArtifactLayout(basePath,logger2){for(let sub of["attachments","artifacts"]){let legacy=import_node_path10.default.join(basePath,"artifacts",sub);try{if((await(0,import_promises5.stat)(legacy)).isDirectory()){logger2.warn("Detected artifacts under a pre-#285 layout at <base>/artifacts/*. The artifact root is now <base> itself. Move <base>/artifacts/* up into <base> (or set ARTIFACT_LOCAL_BASE_PATH to the old <base>/artifacts) so existing artifacts remain reachable.",{legacyDir:import_node_path10.default.join(basePath,"artifacts"),artifactRoot:basePath});return}}catch{}}}var file_ai_stigmer_agentic_channelapp_v1_command=fileDesc("Ci5haS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9jb21tYW5kLnByb3RvEiBhaS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MTKOBQobQ2hhbm5lbEFwcENvbW1hbmRDb250cm9sbGVyEmMKBWFwcGx5EiwuYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEuQ2hhbm5lbEFwcBosLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAStQEKBmNyZWF0ZRIsLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAaLC5haS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MS5DaGFubmVsQXBwIk/CuBhLCB8QHiIMbWV0YWRhdGEub3JnKjd1bmF1dGhvcml6ZWQgdG8gY3JlYXRlIGNoYW5uZWwgYXBwIGluIHRoaXMgb3JnYW5pemF0aW9uEp8BCgZ1cGRhdGUSLC5haS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MS5DaGFubmVsQXBwGiwuYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEuQ2hhbm5lbEFwcCI5wrgYNQgCEDAiC21ldGFkYXRhLmlkKiJ1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGNoYW5uZWwgYXBwEqkBCgZkZWxldGUSNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VEZWxldGVJbnB1dBosLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAiOcK4GDUIAxAwIgtyZXNvdXJjZV9pZCoidW5hdXRob3JpemVkIHRvIGRlbGV0ZSBjaGFubmVsIGFwcBoEoP8rMGIGcHJvdG8z",[file_ai_stigmer_agentic_channelapp_v1_api,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ChannelAppCommandController=serviceDesc(file_ai_stigmer_agentic_channelapp_v1_command,0);var file_ai_stigmer_agentic_channelapp_v1_io=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9pby5wcm90bxIgYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEiTAoLQ2hhbm5lbEFwcHMSPQoHZW50cmllcxgBIAMoCzIsLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAiMQoZTGlzdENoYW5uZWxBcHBzQnlPcmdJbnB1dBIUCgNvcmcYASABKAlCB7pIBHICEAFiBnByb3RvMw",[file_ai_stigmer_agentic_channelapp_v1_api,file_buf_validate_validate]),ChannelAppsSchema=messageDesc2(file_ai_stigmer_agentic_channelapp_v1_io,0);var file_ai_stigmer_agentic_channelapp_v1_query=fileDesc("CixhaS9zdGlnbWVyL2FnZW50aWMvY2hhbm5lbGFwcC92MS9xdWVyeS5wcm90bxIgYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEy9gMKGUNoYW5uZWxBcHBRdWVyeUNvbnRyb2xsZXISlQEKA2dldBItLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUlkGiwuYWkuc3RpZ21lci5hZ2VudGljLmNoYW5uZWxhcHAudjEuQ2hhbm5lbEFwcCIxwrgYLQgBEDAiBXZhbHVlKiB1bmF1dGhvcml6ZWQgdG8gdmlldyBjaGFubmVsIGFwcBJ6Cg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRosLmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkNoYW5uZWxBcHAiBNC4GAESvgEKCWxpc3RCeU9yZxI7LmFpLnN0aWdtZXIuYWdlbnRpYy5jaGFubmVsYXBwLnYxLkxpc3RDaGFubmVsQXBwc0J5T3JnSW5wdXQaLS5haS5zdGlnbWVyLmFnZW50aWMuY2hhbm5lbGFwcC52MS5DaGFubmVsQXBwcyJFwrgYQQgBEB4iA29yZyo2dW5hdXRob3JpemVkIHRvIGxpc3QgY2hhbm5lbCBhcHBzIGluIHRoaXMgb3JnYW5pemF0aW9uGgSg/yswYgZwcm90bzM",[file_ai_stigmer_agentic_channelapp_v1_api,file_ai_stigmer_agentic_channelapp_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ChannelAppQueryController=serviceDesc(file_ai_stigmer_agentic_channelapp_v1_query,0);async function destroySecretBackingState(secretService,logger2,fields2,storedValues){for(let storedValue of storedValues)if(storedValue!=="")try{await secretService.delete(storedValue)}catch(error2){logger2.error("secret backing-state destruction failed after persist \u2014 external state may be orphaned",{...fields2,error:error2 instanceof Error?error2.message:String(error2)})}}function newDestroySecretBackingStateStep(secretService,logger2,extractSecretValues){return{name:"DestroySecretBackingState",async execute(ctx){let deleted=ctx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)return;let metadata=deleted.metadata;await destroySecretBackingState(secretService,logger2,{kind:getKindName(ctx.apiResourceKind),resourceId:metadata?.id??""},extractSecretValues(deleted))}}}var REDACTED_MARKER2="***REDACTED***";function plaintextRequiredMessage(fieldName){return`${fieldName} must be plaintext \u2014 values carrying the 'enc:' encryption prefix are not accepted from clients`}function markerOnCreateMessage(fieldName){return`cannot use the redaction marker as ${fieldName} on create`}function noExistingSecretMessage(fieldName){return`cannot preserve ${fieldName}: no existing secret value found`}var PROVIDER_IMMUTABLE_MESSAGE="the provider of a channel app cannot be changed";function deleteBlockedByChannelMessage(org,slug,channelName){return`cannot delete ChannelApp '${org}/${slug}': referenced by agent channel '${channelName}'`}function redactChannelApp(app){let provider=app.spec?.providerConfig;switch(provider?.case){case"slack":redactSlack(provider.value);return;case"whatsapp":redactWhatsApp(provider.value);return;case void 0:return;default:{let exhaustive=provider;throw new Error(`unhandled provider arm: ${String(exhaustive)}`)}}}function redactSlack(slack){slack.clientSecret!==""&&(slack.clientSecret=REDACTED_MARKER2),slack.signingSecret!==""&&(slack.signingSecret=REDACTED_MARKER2)}function redactWhatsApp(whatsapp){whatsapp.appSecret!==""&&(whatsapp.appSecret=REDACTED_MARKER2),whatsapp.accessToken!==""&&(whatsapp.accessToken=REDACTED_MARKER2),whatsapp.verifyToken!==""&&(whatsapp.verifyToken=REDACTED_MARKER2)}function secretValuesOfChannelApp(app){let provider=app.spec?.providerConfig;switch(provider?.case){case"slack":return[provider.value.clientSecret,provider.value.signingSecret];case"whatsapp":return[provider.value.appSecret,provider.value.accessToken,provider.value.verifyToken];case void 0:return[];default:{let exhaustive=provider;throw new Error(`unhandled provider arm: ${String(exhaustive)}`)}}}function newEncryptChannelAppSecretsForCreateStep(secretService,logger2){return newEncryptChannelAppSecretsStep(secretService,logger2,!0)}function newEncryptChannelAppSecretsForUpdateStep(secretService,logger2){return newEncryptChannelAppSecretsStep(secretService,logger2,!1)}function newEncryptChannelAppSecretsStep(secretService,logger2,isCreate){async function resolveSecret(ctx,fieldName,requestValue,readExisting){if(requestValue==="")return requestValue;if(requestValue===REDACTED_MARKER2)return preserveExistingSecret2(ctx,fieldName,readExisting);if(isCiphertextShaped(requestValue))throw invalidArgumentError(plaintextRequiredMessage(fieldName));if(!secretService.isEnabled())return logger2.warn(`Encryption disabled: ${fieldName} will be stored in plaintext`),requestValue;try{return await secretService.encrypt(requestValue,EncryptionScope.forOrganization(ctx.newState.metadata?.org??""))}catch(error2){throw internalError(error2,`failed to encrypt ${fieldName}`)}}function preserveExistingSecret2(ctx,fieldName,readExisting){if(isCreate)throw invalidArgumentError(markerOnCreateMessage(fieldName));let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing resource not loaded"),`cannot preserve ${fieldName}: existing resource not loaded`);let existingSecret=readExisting(existing);if(existingSecret==="")throw invalidArgumentError(noExistingSecretMessage(fieldName));return existingSecret}return{name:"EncryptChannelAppSecrets",async execute(ctx){let provider=ctx.newState.spec?.providerConfig;switch(provider?.case){case"slack":{let slack=provider.value;slack.clientSecret=await resolveSecret(ctx,"client_secret",slack.clientSecret,existing=>existing.spec?.providerConfig.case==="slack"?existing.spec.providerConfig.value.clientSecret:""),slack.signingSecret=await resolveSecret(ctx,"signing_secret",slack.signingSecret,existing=>existing.spec?.providerConfig.case==="slack"?existing.spec.providerConfig.value.signingSecret:"");return}case"whatsapp":{let whatsapp=provider.value;whatsapp.appSecret=await resolveSecret(ctx,"app_secret",whatsapp.appSecret,existing=>existing.spec?.providerConfig.case==="whatsapp"?existing.spec.providerConfig.value.appSecret:""),whatsapp.accessToken=await resolveSecret(ctx,"access_token",whatsapp.accessToken,existing=>existing.spec?.providerConfig.case==="whatsapp"?existing.spec.providerConfig.value.accessToken:""),whatsapp.verifyToken=await resolveSecret(ctx,"verify_token",whatsapp.verifyToken,existing=>existing.spec?.providerConfig.case==="whatsapp"?existing.spec.providerConfig.value.verifyToken:"");return}case void 0:return;default:{let exhaustive=provider;throw new Error(`unhandled provider arm: ${String(exhaustive)}`)}}}}}function newValidateProviderImmutableStep(){return{name:"ValidateProviderImmutable",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing channel app not found in context"),"existing channel app not found in context");let existingCase=existing.spec?.providerConfig.case,inputCase=ctx.input.spec?.providerConfig.case;if(existingCase!==inputCase)throw invalidArgumentError(PROVIDER_IMMUTABLE_MESSAGE)}}}function newCheckNoReferencingChannelsStep(store,logger2){return{name:"CheckNoReferencingChannels",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing ChannelApp not loaded in delete pipeline"),"existing ChannelApp not loaded in delete pipeline");let org=existing.metadata?.org??"",slug=existing.metadata?.slug??"",rows;try{rows=await store.listResources(ApiResourceKind.agent_channel)}catch(error2){throw internalError(error2,"failed to list agent channels for referential integrity check")}for(let bytes of rows){let channel;try{channel=fromBinary2(AgentChannelSchema,bytes)}catch{logger2.warn("Failed to unmarshal agent channel during referential integrity check, skipping");continue}let ref=channel.spec?.appRef;if(ref===void 0||ref.slug==="")continue;if((ref.org!==""?ref.org:channel.metadata?.org??"")===org&&ref.slug===slug)throw failedPreconditionError(deleteBlockedByChannelMessage(org,slug,channel.metadata?.name??""))}}}}function registerChannelAppServices(router,deps){router.service(ChannelAppCommandController,{apply:(app,ctx)=>apply6(deps,app,ctx),create:(app,ctx)=>createChannelApp(deps,app,ctx),update:(app,ctx)=>update9(deps,app,ctx),delete:(input,ctx)=>deleteChannelApp(deps,input,ctx)}),router.service(ChannelAppQueryController,{get:(id,ctx)=>get12(deps,id,ctx),getByReference:(ref,ctx)=>getByReference6(deps,ref,ctx),listByOrg:(req,ctx)=>listByOrg(deps,req,ctx)})}function kindOf11(ctx){return ctx.values.get(apiResourceKindKey)}async function createChannelApp(deps,app,ctx){let reqCtx=new RequestContext(ChannelAppSchema,app,callerIdentityOf(ctx),kindOf11(ctx));return await newPipeline("channelapp-create",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newEncryptChannelAppSecretsForCreateStep(deps.secretService,deps.logger)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),redactChannelApp(reqCtx.newState),reqCtx.newState}async function update9(deps,app,ctx){let reqCtx=new RequestContext(ChannelAppSchema,app,callerIdentityOf(ctx),kindOf11(ctx));return await newPipeline("channelapp-update",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateProviderImmutableStep()).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newEncryptChannelAppSecretsForUpdateStep(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).build().execute(reqCtx),redactChannelApp(reqCtx.newState),reqCtx.newState}async function apply6(deps,app,ctx){let reqCtx=new RequestContext(ChannelAppSchema,app,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-apply",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createChannelApp(deps,app,ctx):update9(deps,withResolvedApplyId(ChannelAppSchema,app,reqCtx),ctx)}async function deleteChannelApp(deps,input,ctx){let reqCtx=new RequestContext(ChannelAppCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf11(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("channelapp-delete",deps.logger).addStep(newAuthorizeStep(ChannelAppCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,ChannelAppSchema)).addStep(newCheckNoReferencingChannelsStep(deps.store,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDestroySecretBackingStateStep(deps.secretService,deps.logger,secretValuesOfChannelApp)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted ChannelApp not found in context"),"deleted ChannelApp not found in context");let app=deleted;return redactChannelApp(app),app}async function get12(deps,id,ctx){let reqCtx=new RequestContext(ChannelAppQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-get",deps.logger).addStep(newAuthorizeStep(ChannelAppQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,ChannelAppSchema)).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactChannelApp(app),app}async function getByReference6(deps,ref,ctx){let reqCtx=new RequestContext(ChannelAppQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-get-by-reference",deps.logger).addStep(newAuthorizeStep(ChannelAppQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,ChannelAppSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(ChannelAppQueryController.method.get))).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactChannelApp(app),app}var LIST_RESULT_KEY4="listResult";async function listByOrg(deps,req,ctx){let reqCtx=new RequestContext(ChannelAppQueryController.method.listByOrg.input,req,callerIdentityOf(ctx),kindOf11(ctx));await newPipeline("channelapp-list-by-org",deps.logger).addStep(newAuthorizeStep(ChannelAppQueryController.method.listByOrg,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgStep(deps.store,deps.logger)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY4);if(result===void 0)throw internalError(new Error("ChannelApp list not found in context"),"ChannelApp list not found in context");return result}function newListByOrgStep(store,logger2){return{name:"ListByOrg",async execute(ctx){let org=ctx.input.org,rows;try{rows=await store.listResources(ApiResourceKind.channel_app)}catch(error2){throw internalError(error2,"failed to list ChannelApps")}let apps=[];for(let bytes of rows){let app;try{app=fromBinary2(ChannelAppSchema,bytes)}catch{logger2.warn("Failed to unmarshal ChannelApp, skipping");continue}(app.metadata?.org??"")===org&&(redactChannelApp(app),apps.push(app))}apps.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(LIST_RESULT_KEY4,create2(ChannelAppsSchema,{entries:apps}))}}}var file_ai_stigmer_agentic_environment_v1_command=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvZW52aXJvbm1lbnQvdjEvY29tbWFuZC5wcm90bxIhYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxMoMKChxFbnZpcm9ubWVudENvbW1hbmRDb250cm9sbGVyEmcKBWFwcGx5Ei4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50Gi4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50ErkBCgZjcmVhdGUSLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiT8K4GEsIDBAeIgxtZXRhZGF0YS5vcmcqN3VuYXV0aG9yaXplZCB0byBjcmVhdGUgZW52aXJvbm1lbnQgaW4gdGhpcyBvcmdhbml6YXRpb24SowEKBnVwZGF0ZRIuLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudBouLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudCI5wrgYNQgCEDUiC21ldGFkYXRhLmlkKiJ1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGVudmlyb25tZW50Er8BChB1cGRhdGVWaXNpYmlsaXR5EjUuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLlVwZGF0ZVZpc2liaWxpdHlJbnB1dBouLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudCJEwrgYQAgCEDUiC3Jlc291cmNlX2lkKi11bmF1dGhvcml6ZWQgdG8gdXBkYXRlIGVudmlyb25tZW50IHZpc2liaWxpdHkSqwEKBmRlbGV0ZRI2LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZURlbGV0ZUlucHV0Gi4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50IjnCuBg1CAIQNSILcmVzb3VyY2VfaWQqInVuYXV0aG9yaXplZCB0byBkZWxldGUgZW52aXJvbm1lbnQSzwEKD3VwZGF0ZVZhcmlhYmxlcxJELmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5VcGRhdGVFbnZpcm9ubWVudFZhcmlhYmxlc1JlcXVlc3QaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiRsK4GEIIAhA1Ig5lbnZpcm9ubWVudF9pZCosdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBlbnZpcm9ubWVudCB2YXJpYWJsZXMSzwEKD3JlbW92ZVZhcmlhYmxlcxJELmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5SZW1vdmVFbnZpcm9ubWVudFZhcmlhYmxlc1JlcXVlc3QaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiRsK4GEIIAhA1Ig5lbnZpcm9ubWVudF9pZCosdW5hdXRob3JpemVkIHRvIHJlbW92ZSBlbnZpcm9ubWVudCB2YXJpYWJsZXMaBKD/KzViBnByb3RvMw",[file_ai_stigmer_agentic_environment_v1_api,file_ai_stigmer_agentic_environment_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),EnvironmentCommandController=serviceDesc(file_ai_stigmer_agentic_environment_v1_command,0);var file_ai_stigmer_agentic_environment_v1_query=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvZW52aXJvbm1lbnQvdjEvcXVlcnkucHJvdG8SIWFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MTKMBQoaRW52aXJvbm1lbnRRdWVyeUNvbnRyb2xsZXISlgEKA2dldBItLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUlkGi4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50IjDCuBgsCAEQNSIFdmFsdWUqH3VuYXV0aG9yaXplZCB0byBnZXQgZW52aXJvbm1lbnQSfAoOZ2V0QnlSZWZlcmVuY2USNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2UaLi5haS5zdGlnbWVyLmFnZW50aWMuZW52aXJvbm1lbnQudjEuRW52aXJvbm1lbnQiBNC4GAES0gEKDmdldFNlY3JldFZhbHVlEj4uYWkuc3RpZ21lci5hZ2VudGljLmVudmlyb25tZW50LnYxLkVudmlyb25tZW50U2VjcmV0VmFsdWVJbnB1dBozLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudFZhbHVlIkvCuBhHCBAQNSIOZW52aXJvbm1lbnRfaWQqMXVuYXV0aG9yaXplZCB0byByZWFkIHNlY3JldCB2YWx1ZXMgKGNyZWF0b3Itb25seSkSfAoEbGlzdBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5MaXN0RW52aXJvbm1lbnRzUmVxdWVzdBoyLmFpLnN0aWdtZXIuYWdlbnRpYy5lbnZpcm9ubWVudC52MS5FbnZpcm9ubWVudExpc3QiBNC4GAEaBKD/KzViBnByb3RvMw",[file_ai_stigmer_agentic_environment_v1_api,file_ai_stigmer_agentic_environment_v1_io,file_ai_stigmer_agentic_environment_v1_spec,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),EnvironmentQueryController=serviceDesc(file_ai_stigmer_agentic_environment_v1_query,0);function redactEnvironmentSecrets(env2){let data=env2?.spec?.data;if(data!==void 0)for(let value of Object.values(data))value.isSecret&&value.value!==""&&(value.value=REDACTED_MARKER)}function shareRestrictionReason(metadata){let labels=metadata?.labels??{};return labels[PERSONAL_LABEL_KEY]===PERSONAL_LABEL_VALUE?PERSONAL_SHARE_RESTRICTION:labels[MANAGED_LABEL_KEY]===MANAGED_LABEL_VALUE?MANAGED_SHARE_RESTRICTION:""}var environmentSearchExtractor={kind:ApiResourceKind.environment,schema:EnvironmentSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let env2=resource;return buildSearchResult({kind:ApiResourceKind.environment,metadata:env2.metadata,summary:env2.spec?.description??"",score,createdAt:env2.status?.audit?.specAudit?.createdAt,updatedAt:env2.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let env2=resource,metadata=env2.metadata;if(metadata!==void 0)return{name:metadata.name,description:env2.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(env2.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var SECRET_VALUE_KEY="secretValue",UPDATED_ENVIRONMENT_KEY="updatedEnvironment";function newPreserveRedactedSecretsStep(){return{name:"PreserveRedactedSecrets",execute(ctx){let data=ctx.newState.spec?.data;if(data===void 0||Object.keys(data).length===0)return;let existingData=ctx.get(EXISTING_RESOURCE_KEY)?.spec?.data??{};for(let[key,value]of Object.entries(data))if(value.isSecret){if(value.value===REDACTED_MARKER){let existingEntry=existingData[key];if(existingEntry!==void 0&&existingEntry.isSecret){data[key]=existingEntry;continue}throw invalidArgumentError(markerRejectionMessage(key))}if(isCiphertextShaped(value.value))throw invalidArgumentError(forgedCiphertextMessage(key))}}}}function newEncryptSecretValuesStep(secretService,logger2){return{name:"EncryptSecretValues",async execute(ctx){let env2=ctx.newState,data=env2.spec?.data;if(!(data===void 0||Object.keys(data).length===0)){if(!secretService.isEnabled()){hasNonEmptySecret(data)&&logger2.warn("Encryption disabled: environment secret values will be stored in plaintext",{environmentId:env2.metadata?.id??""});return}for(let[key,value]of Object.entries(data))if(!(!value.isSecret||value.value===""))try{value.value=await secretService.encrypt(value.value,EncryptionScope.forOrganization(env2.metadata?.org??""))}catch(error2){throw internalError(error2,`failed to encrypt secret value for variable '${key}'`)}}}}}function hasNonEmptySecret(data){return Object.values(data).some(v=>v.isSecret&&v.value!=="")}function newEnforcePersonalUniquenessStep(store){return{name:"EnforcePersonalEnvUniqueness",async execute(ctx){let metadata=ctx.newState.metadata;if(metadata===void 0||metadata.labels[PERSONAL_LABEL_KEY]!==PERSONAL_LABEL_VALUE)return;let existing;try{existing=await findResourceByLabelAndOrg(store,ctx.apiResourceKind,EnvironmentSchema,PERSONAL_LABEL_KEY,PERSONAL_LABEL_VALUE,metadata.org)}catch(error2){throw internalError(error2,"failed to check personal environment uniqueness")}if(existing!==void 0)throw new ConnectError(personalEnvironmentExistsMessage(existing.metadata?.id??""),Code.AlreadyExists)}}}function newLoadEnvironmentByIdStep(store){return{name:"LoadEnvironmentByID",async execute(ctx){let environmentId=ctx.input.environmentId;if(typeof environmentId!="string"||environmentId==="")throw invalidArgumentError("environment_id is required");let env2;try{env2=await store.getResource(ctx.apiResourceKind,environmentId,EnvironmentSchema)}catch{throw notFoundError("environment",environmentId)}ctx.set(TARGET_RESOURCE_KEY,env2)}}}function newExtractAndDecryptSingleKeyStep(secretService,logger2){return{name:"ExtractAndDecryptSingleKey",async execute(ctx){let key=ctx.input.key,env2=ctx.get(TARGET_RESOURCE_KEY);if(env2===void 0)throw internalError(new Error("targetResource missing or wrong type"),"environment not loaded in context");let envValue=env2.spec?.data[key];if(envValue===void 0)throw notFoundError("environment key",key);if(envValue.isSecret&&envValue.value!==""){let decrypted;try{decrypted=await secretService.decrypt(envValue.value)}catch(error2){throw logger2.error("Failed to decrypt secret value",{key,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to decrypt secret value")}ctx.set(SECRET_VALUE_KEY,create2(EnvironmentValueSchema,{value:decrypted,isSecret:!0,description:envValue.description}));return}ctx.set(SECRET_VALUE_KEY,envValue)}}}function newMergeVariablesAndPersistStep(store,secretService,logger2){return{name:"MergeVariablesAndPersist",async execute(ctx){let env2=ctx.get(TARGET_RESOURCE_KEY);if(env2===void 0)throw internalError(new Error("targetResource missing or wrong type"),"environment not loaded in context");env2.spec===void 0&&(env2.spec=create2(EnvironmentSpecSchema,{}));let incoming=ctx.input.variables;for(let[key,incomingValue]of Object.entries(incoming)){let value=incomingValue;if(value.isSecret&&value.value===REDACTED_MARKER){let existing=env2.spec.data[key];if(existing!==void 0&&existing.isSecret)continue;throw invalidArgumentError(markerRejectionMessage(key))}if(value.isSecret&&isCiphertextShaped(value.value))throw invalidArgumentError(forgedCiphertextMessage(key));if(value.isSecret&&value.value!=="")if(!secretService.isEnabled())logger2.warn("Encryption disabled: environment secret value will be stored in plaintext",{key});else{let encrypted;try{encrypted=await secretService.encrypt(value.value,EncryptionScope.forOrganization(env2.metadata?.org??""))}catch(error2){throw internalError(error2,`failed to encrypt secret value for variable '${key}'`)}value=create2(EnvironmentValueSchema,{value:encrypted,isSecret:!0,description:value.description})}env2.spec.data[key]=value}try{setAuditFieldsForUpdate(EnvironmentSchema,env2,"spec_audit",ctx.callerIdentity)}catch(error2){throw internalError(error2,"failed to set audit fields")}try{await store.saveResource(ctx.apiResourceKind,env2.metadata?.id??"",EnvironmentSchema,env2)}catch(error2){throw internalError(error2,"failed to persist environment after merging variables")}ctx.set(UPDATED_ENVIRONMENT_KEY,env2)}}}function newRemoveVariableKeysAndPersistStep(store,secretService,logger2){return{name:"RemoveVariableKeysAndPersist",async execute(ctx){let env2=ctx.get(TARGET_RESOURCE_KEY);if(env2===void 0)throw internalError(new Error("targetResource missing or wrong type"),"environment not loaded in context");let keys=ctx.input.keys,removedSecretValues=[];if(env2.spec?.data!==void 0)for(let key of keys){let removed=env2.spec.data[key];removed!==void 0&&removed.isSecret&&removedSecretValues.push(removed.value),delete env2.spec.data[key]}try{setAuditFieldsForUpdate(EnvironmentSchema,env2,"spec_audit",ctx.callerIdentity)}catch(error2){throw internalError(error2,"failed to set audit fields")}try{await store.saveResource(ctx.apiResourceKind,env2.metadata?.id??"",EnvironmentSchema,env2)}catch(error2){throw internalError(error2,"failed to persist environment after removing variables")}await destroySecretBackingState(secretService,logger2,{kind:"environment",resourceId:env2.metadata?.id??"",operation:"removeVariables"},removedSecretValues),ctx.set(UPDATED_ENVIRONMENT_KEY,env2)}}}function newDestroyDroppedEnvironmentSecretsStep(secretService,logger2){return{name:"DestroyDroppedEnvironmentSecrets",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY),oldData=existing?.spec?.data;if(oldData===void 0)return;let newData=ctx.newState.spec?.data??{},droppedSecretValues=Object.entries(oldData).filter(([key,value])=>value.isSecret&&newData[key]===void 0).map(([,value])=>value.value);await destroySecretBackingState(secretService,logger2,{kind:"environment",resourceId:existing?.metadata?.id??"",operation:"update"},droppedSecretValues)}}}function secretValuesOfEnvironment(env2){return Object.values(env2.spec?.data??{}).filter(value=>value.isSecret).map(value=>value.value)}function registerEnvironmentServices(router,deps){router.service(EnvironmentCommandController,{apply:(env2,ctx)=>apply7(deps,env2,ctx),create:(env2,ctx)=>createEnvironment(deps,env2,ctx),update:(env2,ctx)=>update10(deps,env2,ctx),updateVisibility:(input,ctx)=>updateVisibility3(deps,input,ctx),delete:(input,ctx)=>deleteEnvironment(deps,input,ctx),updateVariables:(req,ctx)=>updateVariables(deps,req,ctx),removeVariables:(req,ctx)=>removeVariables(deps,req,ctx)}),router.service(EnvironmentQueryController,{get:(id,ctx)=>get13(deps,id,ctx),getByReference:(ref,ctx)=>getByReference7(deps,ref,ctx),getSecretValue:(input,ctx)=>getSecretValue(deps,input,ctx),list:(req,ctx)=>list8(deps,req,ctx)})}function kindOf12(ctx){return ctx.values.get(apiResourceKindKey)}async function createEnvironment(deps,env2,ctx){let reqCtx=new RequestContext(EnvironmentSchema,env2,callerIdentityOf(ctx),kindOf12(ctx));return await newPipeline("environment-create",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newEnforcePersonalUniquenessStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPreserveRedactedSecretsStep()).addStep(newEncryptSecretValuesStep(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,environmentSearchExtractor,deps.logger)).build().execute(reqCtx),redactEnvironmentSecrets(reqCtx.newState),reqCtx.newState}async function update10(deps,env2,ctx){let reqCtx=new RequestContext(EnvironmentSchema,env2,callerIdentityOf(ctx),kindOf12(ctx));return await newPipeline("environment-update",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPreserveRedactedSecretsStep()).addStep(newEncryptSecretValuesStep(deps.secretService,deps.logger)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newDestroyDroppedEnvironmentSecretsStep(deps.secretService,deps.logger)).addStep(newIndexSearchStep(deps.store,environmentSearchExtractor,deps.logger)).build().execute(reqCtx),redactEnvironmentSecrets(reqCtx.newState),reqCtx.newState}async function apply7(deps,env2,ctx){let reqCtx=new RequestContext(EnvironmentSchema,env2,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-apply",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createEnvironment(deps,env2,ctx):update10(deps,withResolvedApplyId(EnvironmentSchema,env2,reqCtx),ctx)}async function deleteEnvironment(deps,input,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf12(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("environment-delete",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,EnvironmentSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDestroySecretBackingStateStep(deps.secretService,deps.logger,secretValuesOfEnvironment)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted environment not found in context"),"deleted environment not found in context");let env2=deleted;return redactEnvironmentSecrets(env2),env2}var UPDATE_VISIBILITY_ENVIRONMENT_KEY="updateVisibilityEnvironment";async function updateVisibility3(deps,input,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.updateVisibility.input,input,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-update-visibility",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.updateVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentForVisibilityUpdateStep(deps.store)).addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_ENVIRONMENT_KEY)).addStep(newValidateVisibilityUpdateStep()).addStep(newValidateEnvironmentShareRestrictionStep()).addStep(newSetEnvironmentVisibilityStep()).addStep(newPersistEnvironmentForVisibilityUpdateStep(deps.store)).addStep(newUpdateVisibilityTuplesStep(deps.authorizationLifecycle,UPDATE_VISIBILITY_ENVIRONMENT_KEY)).addStep(newIndexEnvironmentAfterVisibilityUpdateStep(deps.store,deps.logger)).build().execute(reqCtx);let env2=reqCtx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY);return redactEnvironmentSecrets(env2),env2}function newLoadEnvironmentForVisibilityUpdateStep(store){return{name:"LoadEnvironmentForVisibilityUpdate",async execute(ctx){let input=ctx.input,env2;try{env2=await store.getResource(ctx.apiResourceKind,input.resourceId,EnvironmentSchema)}catch{throw notFoundError("environment",input.resourceId)}ctx.set(UPDATE_VISIBILITY_ENVIRONMENT_KEY,env2)}}}function newValidateEnvironmentShareRestrictionStep(){return{name:"ValidateEnvironmentShareRestriction",execute(ctx){if(ctx.input.visibility!==ApiResourceVisibility.visibility_org)return;let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY),reason=shareRestrictionReason(env2.metadata);if(reason!=="")throw failedPreconditionError(reason)}}}function newSetEnvironmentVisibilityStep(){return{name:"SetVisibility",execute(ctx){let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY);env2.metadata!==void 0&&(env2.metadata.visibility=ctx.input.visibility),setAuditFieldsForUpdate(EnvironmentSchema,env2,"status_audit",ctx.callerIdentity)}}}function newPersistEnvironmentForVisibilityUpdateStep(store){return{name:"PersistEnvironmentForVisibilityUpdate",async execute(ctx){let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY);try{await store.saveResource(ctx.apiResourceKind,env2.metadata?.id??"",EnvironmentSchema,env2)}catch(error2){throw internalError(error2,"failed to save environment")}}}}function newIndexEnvironmentAfterVisibilityUpdateStep(store,logger2){return{name:"IndexEnvironmentAfterVisibilityUpdate",async execute(ctx){let env2=ctx.get(UPDATE_VISIBILITY_ENVIRONMENT_KEY),entry=environmentSearchExtractor.getSearchIndexEntry(env2);if(entry===void 0){logger2.warn("IndexEnvironmentAfterVisibilityUpdate: extractor returned nil, skipping",{id:env2.metadata?.id??""});return}try{await store.upsertSearchIndex(ctx.apiResourceKind,env2.metadata?.id??"",entry)}catch(error2){logger2.warn("IndexEnvironmentAfterVisibilityUpdate: failed (best-effort)",{id:env2.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}}}async function updateVariables(deps,req,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.updateVariables.input,req,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-update-variables",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.updateVariables,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentByIdStep(deps.store)).addStep(newMergeVariablesAndPersistStep(deps.store,deps.secretService,deps.logger)).build().execute(reqCtx);let updated=reqCtx.get(UPDATED_ENVIRONMENT_KEY);return redactEnvironmentSecrets(updated),updated}async function removeVariables(deps,req,ctx){let reqCtx=new RequestContext(EnvironmentCommandController.method.removeVariables.input,req,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-remove-variables",deps.logger).addStep(newAuthorizeStep(EnvironmentCommandController.method.removeVariables,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentByIdStep(deps.store)).addStep(newRemoveVariableKeysAndPersistStep(deps.store,deps.secretService,deps.logger)).build().execute(reqCtx);let updated=reqCtx.get(UPDATED_ENVIRONMENT_KEY);return redactEnvironmentSecrets(updated),updated}async function get13(deps,id,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-get",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,EnvironmentSchema)).build().execute(reqCtx);let env2=reqCtx.get(TARGET_RESOURCE_KEY);return redactEnvironmentSecrets(env2),env2}async function getByReference7(deps,ref,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-get-by-reference",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,EnvironmentSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(EnvironmentQueryController.method.get))).build().execute(reqCtx);let env2=reqCtx.get(TARGET_RESOURCE_KEY);return redactEnvironmentSecrets(env2),env2}async function getSecretValue(deps,input,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.getSecretValue.input,input,callerIdentityOf(ctx),kindOf12(ctx));return await newPipeline("environment-get-secret-value",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.getSecretValue,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadEnvironmentByIdStep(deps.store)).addStep(newExtractAndDecryptSingleKeyStep(deps.secretService,deps.logger)).build().execute(reqCtx),reqCtx.get(SECRET_VALUE_KEY)}var LIST_RESULT_KEY5="listResult";async function list8(deps,req,ctx){let reqCtx=new RequestContext(EnvironmentQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf12(ctx));await newPipeline("environment-list",deps.logger).addStep(newAuthorizeStep(EnvironmentQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgAndLabelsStep5(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY5);if(result===void 0)throw internalError(new Error("environment list not found in context"),"environment list not found in context");return result}function newListByOrgAndLabelsStep5(store,listReadScope){return{name:"ListByOrgAndLabels",async execute(ctx){let{org,labels:filterLabels}=ctx.input,rows;try{rows=await store.listResources(ctx.apiResourceKind)}catch(error2){throw internalError(error2,"failed to list environments")}let decoded=[];for(let bytes of rows)try{decoded.push(fromBinary2(EnvironmentSchema,bytes))}catch{continue}let requested=decoded.filter(env2=>(env2.metadata?.org??"")===org&&matchesAllLabels(env2.metadata?.labels??{},filterLabels)),environments=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.environment,requested,"");for(let env2 of environments)redactEnvironmentSecrets(env2);environments.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(LIST_RESULT_KEY5,create2(EnvironmentListSchema,{totalCount:environments.length,items:environments}))}}}var file_ai_stigmer_agentic_executioncontext_v1_command=fileDesc("CjRhaS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9jb21tYW5kLnByb3RvEiZhaS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MTLpAwohRXhlY3V0aW9uQ29udGV4dENvbW1hbmRDb250cm9sbGVyEnsKBWFwcGx5EjguYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEuRXhlY3V0aW9uQ29udGV4dBo4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQSggEKBmNyZWF0ZRI4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQaOC5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25Db250ZXh0IgTQuBgBErsBCgZkZWxldGUSNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VEZWxldGVJbnB1dBo4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQiP8K4GDsIAhA2IgtyZXNvdXJjZV9pZCoodW5hdXRob3JpemVkIHRvIGRlbGV0ZSBleGVjdXRpb24gY29udGV4dBoEoP8rNmIGcHJvdG8z",[file_ai_stigmer_agentic_executioncontext_v1_api,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ExecutionContextCommandController=serviceDesc(file_ai_stigmer_agentic_executioncontext_v1_command,0);var file_ai_stigmer_agentic_executioncontext_v1_io=fileDesc("Ci9haS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9pby5wcm90bxImYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEiKwoSRXhlY3V0aW9uQ29udGV4dElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiQQogRXhlY3V0aW9uQ29udGV4dEV4ZWN1dGlvbklkSW5wdXQSHQoMZXhlY3V0aW9uX2lkGAEgASgJQge6SARyAhABYgZwcm90bzM",[file_buf_validate_validate]);var file_ai_stigmer_agentic_executioncontext_v1_query=fileDesc("CjJhaS9zdGlnbWVyL2FnZW50aWMvZXhlY3V0aW9uY29udGV4dC92MS9xdWVyeS5wcm90bxImYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEyhQQKH0V4ZWN1dGlvbkNvbnRleHRRdWVyeUNvbnRyb2xsZXISswEKA2dldBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHRJZBo4LmFpLnN0aWdtZXIuYWdlbnRpYy5leGVjdXRpb25jb250ZXh0LnYxLkV4ZWN1dGlvbkNvbnRleHQiNsK4GDIIARA2IgV2YWx1ZSoldW5hdXRob3JpemVkIHRvIGdldCBleGVjdXRpb24gY29udGV4dBKGAQoOZ2V0QnlSZWZlcmVuY2USNC5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VSZWZlcmVuY2UaOC5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25Db250ZXh0IgTQuBgBEpwBChBnZXRCeUV4ZWN1dGlvbklkEkguYWkuc3RpZ21lci5hZ2VudGljLmV4ZWN1dGlvbmNvbnRleHQudjEuRXhlY3V0aW9uQ29udGV4dEV4ZWN1dGlvbklkSW5wdXQaOC5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25Db250ZXh0IgTQuBgBGgSg/ys2YgZwcm90bzM",[file_ai_stigmer_agentic_executioncontext_v1_api,file_ai_stigmer_agentic_executioncontext_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),ExecutionContextQueryController=serviceDesc(file_ai_stigmer_agentic_executioncontext_v1_query,0);function redactExecutionContextSecrets(ec2){let data=ec2?.spec?.data;if(data!==void 0)for(let value of Object.values(data))value.isSecret&&value.value!==""&&(value.value=REDACTED_MARKER)}var import_node_crypto18=require("node:crypto"),CONNECT_EXECUTION_ID_PREFIX="connect-";function newConnectExecutionId(mcpServerId){return`${CONNECT_EXECUTION_ID_PREFIX}${mcpServerId}-${(0,import_node_crypto18.randomUUID)().slice(0,8)}`}function isConnectExecutionId(executionId){return executionId.startsWith(CONNECT_EXECUTION_ID_PREFIX)}function isTerminalWorkflowExecutionPhase(phase){switch(phase){case ExecutionPhase2.EXECUTION_COMPLETED:case ExecutionPhase2.EXECUTION_FAILED:case ExecutionPhase2.EXECUTION_CANCELLED:case ExecutionPhase2.EXECUTION_TERMINATED:return!0;default:return!1}}var RUNNER_VERIFIER_NAME="runner",RUNNER_CREDENTIAL_INVALID_MESSAGE="runner credential is not valid on this server",RUNNER_CREDENTIAL_NOT_LIVE_MESSAGE="runner credential names a run that is over or belongs to nobody this server recognizes",RUN_CREDENTIAL_NOT_RUNS_PERSON_MESSAGE="a run credential is minted only for the person whose run it is",WORKFLOW_LINEAGE_BINDING_MISMATCH_MESSAGE="workflow lineage label names a workflow execution this runner credential is not bound to",MEMORY_CAPTURE_ORG_MISMATCH_MESSAGE="memory capture is scoped to the session's organization";function boundExecutionKindOf(executionId){switch(kindByIdPrefix(executionId)){case ApiResourceKind.agent_execution:return"agent-execution";case ApiResourceKind.workflow_execution:return"workflow-execution";default:return isConnectExecutionId(executionId)?"mcp-connect":void 0}}function bindsARun(kind){switch(kind){case"agent-execution":case"workflow-execution":return!0;case"mcp-connect":return!1;default:{let exhaustive=kind;throw new Error(`unknown bound execution kind ${String(exhaustive)}`)}}}async function loadBoundExecution(store,executionId,now=Date.now()){let kind=boundExecutionKindOf(executionId);if(kind!==void 0)switch(kind){case"agent-execution":{let row=await getRow(store,ApiResourceKind.agent_execution,executionId,AgentExecutionSchema);return row===void 0?void 0:{kind,executionId,org:row.metadata?.org??"",createdBy:creatorStampOf(AgentExecutionSchema,row),sessionId:row.spec?.sessionId??"",live:isLive(row.status!==void 0&&isTerminalExecutionPhase(row.status.phase),row.status?.completedAt??"",now)}}case"workflow-execution":{let row=await getRow(store,ApiResourceKind.workflow_execution,executionId,WorkflowExecutionSchema);return row===void 0?void 0:{kind,executionId,org:row.metadata?.org??"",createdBy:creatorStampOf(WorkflowExecutionSchema,row),sessionId:"",live:isLive(row.status!==void 0&&isTerminalWorkflowExecutionPhase(row.status.phase),row.status?.completedAt??"",now)}}case"mcp-connect":{let row=await getExecutionContextRow(store,executionId);return row===void 0?void 0:{kind,executionId,org:row.metadata?.org??"",createdBy:creatorStampOf(ExecutionContextSchema,row),sessionId:"",live:!0}}default:{let exhaustive=kind;throw new Error(`unknown bound execution kind ${String(exhaustive)}`)}}}function isLive(terminal,completedAt,now){if(!terminal)return!0;let finishedAt=Date.parse(completedAt);return Number.isNaN(finishedAt)?!1:now-finishedAt<6e5}function creatorStampOf(schema2,row){return auditOf(schema2,row)?.specAudit?.createdBy?.id??""}async function getRow(store,kind,id,schema2){try{return await store.getResource(kind,id,schema2)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}async function getExecutionContextRow(store,executionId){try{return await store.findByField(ApiResourceKind.execution_context,"spec.executionId",executionId,ExecutionContextSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}function ciphertextShapedMessage(key){return`value for '${key}' looks like stored ciphertext (enc:v<N>: prefix); supply the plaintext value`}var ENCRYPT_BATCH_FAILURE_MESSAGE="failed to encrypt secret values";function encryptionKeyMissingMessage(executionId,key){return`execution context for ${executionId} holds encrypted secret '${key}' but no encryption key is configured`}async function resolveValuesForCaller(deps,ctx,ec2){if(await runnerMayDecrypt(deps,ctx,ec2)){await decryptSecretValues(deps,ec2);return}redactExecutionContextSecrets(ec2)}async function runnerMayDecrypt(deps,ctx,ec2){let authorizeRead=deps.runnerAuthService.authorizeExecutionContextRead?.bind(deps.runnerAuthService);if(authorizeRead!==void 0){let token2=bearerToken(ctx);if(token2==="")return!1;try{return await authorizeRead(token2,ec2.spec?.executionId??"")}catch(error2){return deps.logger.warn("ExecutionContext read authorization failed \u2014 redacting secrets",{error:error2 instanceof Error?error2.message:String(error2)}),!1}}let token=bearerToken(ctx),executionId=verifyRunnerToken(deps,token,ec2);return executionId===void 0?!1:!isClockedToken(token)&&!await runIsLive(deps,executionId)?(deps.logger.debug("Run credential presented for a run that is over - redacting execution context secrets",{executionId}),!1):(deps.logger.debug("Scope-bound runner token presented - decrypting execution context secrets",{executionId}),!0)}function verifyRunnerToken(deps,token,ec2){if(token==="")return;let tokenExecutionId;try{tokenExecutionId=deps.runnerAuthService.verify(TOKEN_TYPE_EXECUTION_SCOPED,token)}catch{deps.logger.debug("Presented runner token failed verification - redacting execution context secrets");return}if(tokenExecutionId!==(ec2.spec?.executionId??"")){deps.logger.warn("Runner token is not scope-bound to this execution context - redacting secrets",{tokenExecutionId,executionId:ec2.spec?.executionId??""});return}return tokenExecutionId}async function runIsLive(deps,executionId){try{let execution=await loadBoundExecution(deps.store,executionId);return execution!==void 0&&bindsARun(execution.kind)&&execution.live}catch(error2){throw internalError(error2,"failed to load the run credential's execution")}}function bearerToken(ctx){return parseBearerToken(ctx.requestHeader.get("authorization")??"")}async function decryptSecretValues(deps,ec2){let executionId=ec2.spec?.executionId??"",data=ec2.spec?.data??{};for(let[key,value]of Object.entries(data))if(!(!value.isSecret||!deps.secretService.isEncrypted(value.value)))try{value.value=await deps.secretService.decrypt(value.value)}catch(error2){if(error2 instanceof EncryptionUnavailableError)throw internalError(error2,encryptionKeyMissingMessage(executionId,key));deps.logger.warn("Undecryptable ciphertext in execution context \u2014 dropping this value from the runner read",{key,executionId,error:error2 instanceof Error?error2.message:String(error2)}),delete data[key]}}var executionContextSearchExtractor={kind:ApiResourceKind.execution_context,schema:ExecutionContextSchema,getSearchSummary(){return""},toSearchResult(resource,score){let ec2=resource;return buildSearchResult({kind:ApiResourceKind.execution_context,metadata:ec2.metadata,summary:"",score,createdAt:ec2.status?.audit?.specAudit?.createdAt,updatedAt:ec2.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let ec2=resource,metadata=ec2.metadata;if(metadata!==void 0)return{name:metadata.name,description:"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(ec2.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};function newRejectCiphertextShapedStep(){return{name:"RejectCiphertextShapedValues",execute(ctx){let data=ctx.input.spec?.data??{};for(let[key,value]of Object.entries(data))if(isCiphertextShaped(value.value))throw invalidArgumentError(ciphertextShapedMessage(key))}}}function newEncryptSecretValuesStep2(secretService,logger2){return{name:"EncryptSecretValues",async execute(ctx){let ec2=ctx.newState,data=ec2.spec?.data;if(data===void 0||Object.keys(data).length===0)return;if(!secretService.isEnabled()){hasNonEmptySecret2(data)&&logger2.warn("Encryption disabled: execution context secret values will be stored in plaintext",{executionId:ec2.spec?.executionId??""});return}let toSeal=new Map;for(let[key,value]of Object.entries(data))!value.isSecret||value.value===""||toSeal.set(key,value.value);if(toSeal.size===0)return;let sealed;try{sealed=await secretService.encryptAllAtMostV2(toSeal,EncryptionScope.forOrganization(ec2.metadata?.org??""))}catch(error2){throw internalError(error2,ENCRYPT_BATCH_FAILURE_MESSAGE)}for(let[key,value]of Object.entries(data)){let sealedValue=sealed.get(key);sealedValue!==void 0&&(value.value=sealedValue)}}}}function hasNonEmptySecret2(data){return Object.values(data).some(v=>v.isSecret&&v.value!=="")}function newLoadByExecutionIdStep(store){return{name:"LoadByExecutionId",async execute(ctx){let input=ctx.input;if(input.executionId==="")throw invalidArgumentError("execution_id is required");let executionContext;try{executionContext=await store.findByField(ctx.apiResourceKind,"spec.executionId",input.executionId,ExecutionContextSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("execution_context",`execution_id=${input.executionId}`):internalError(error2,"failed to query execution context")}ctx.set(TARGET_RESOURCE_KEY,executionContext)}}}function newAuthorizeExecutionContextCreateStep(authorizer){return{name:"AuthorizeCreate",async execute(ctx){let caller=ctx.callerIdentity;if(isServerComposedRequest(caller))return;let decision;try{decision=await authorizer.authorize(caller,{permission:IamPermission.can_create_execution_in,resourceKind:ApiResourceKind.organization,resourceId:ctx.newState.metadata?.org??""})}catch(error2){throw internalError(error2 instanceof Error?error2:new Error(String(error2)),"execution-context create authorization could not be completed")}switch(decision.kind){case"allow":return;case"deny":case"not-found":throw new ConnectError("unauthorized to create execution context in this organization",Code.PermissionDenied);case"unavailable":throw internalError(decision.cause,"execution-context create authorization could not be completed");default:{let exhaustive=decision;throw internalError(new Error(`unknown decision ${JSON.stringify(exhaustive)}`),"execution-context create authorization could not be completed")}}}}}function registerExecutionContextServices(router,deps){router.service(ExecutionContextCommandController,{apply:(ec2,ctx)=>apply8(deps,ec2,ctx),create:(ec2,ctx)=>createExecutionContext(deps,ec2,ctx),delete:(input,ctx)=>deleteExecutionContext(deps,input,ctx)}),router.service(ExecutionContextQueryController,{get:(id,ctx)=>get14(deps,id,ctx),getByReference:(ref,ctx)=>getByReference8(deps,ref,ctx),getByExecutionId:(input,ctx)=>getByExecutionId(deps,input,ctx)})}function kindOf13(ctx){return ctx.values.get(apiResourceKindKey)}async function createExecutionContext(deps,ec2,ctx){let reqCtx=new RequestContext(ExecutionContextSchema,ec2,callerIdentityOf(ctx),kindOf13(ctx));return await newPipeline("execution-context-create",deps.logger).addStep(newAuthorizeStep(ExecutionContextCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeExecutionContextCreateStep(deps.authorizer)).addStep(newValidateVisibilityStep()).addStep(newRejectCiphertextShapedStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newEncryptSecretValuesStep2(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,executionContextSearchExtractor,deps.logger)).build().execute(reqCtx),redactExecutionContextSecrets(reqCtx.newState),reqCtx.newState}async function apply8(deps,ec2,ctx){let reqCtx=new RequestContext(ExecutionContextSchema,ec2,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-apply",deps.logger).addStep(newAuthorizeStep(ExecutionContextCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");if(shouldCreate)return createExecutionContext(deps,ec2,ctx);throw deps.logger.warn("ExecutionContext already exists - UPDATE not supported",{slug:ec2.metadata?.name??"",id:ec2.metadata?.id??""}),alreadyExistsError("ExecutionContext",ec2.metadata?.name??"")}async function deleteExecutionContext(deps,input,ctx){let reqCtx=new RequestContext(ExecutionContextCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf13(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("execution-context-delete",deps.logger).addStep(newAuthorizeStep(ExecutionContextCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,ExecutionContextSchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted execution context not found in context"),"deleted execution context not found in context");let ec2=deleted;return redactExecutionContextSecrets(ec2),ec2}async function get14(deps,id,ctx){let reqCtx=new RequestContext(ExecutionContextQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-get",deps.logger).addStep(newAuthorizeStep(ExecutionContextQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,ExecutionContextSchema)).build().execute(reqCtx);let ec2=reqCtx.get(TARGET_RESOURCE_KEY);return redactExecutionContextSecrets(ec2),ec2}async function getByReference8(deps,ref,ctx){let reqCtx=new RequestContext(ExecutionContextQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-get-by-reference",deps.logger).addStep(newAuthorizeStep(ExecutionContextQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,ExecutionContextSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(ExecutionContextQueryController.method.get))).build().execute(reqCtx);let ec2=reqCtx.get(TARGET_RESOURCE_KEY);return redactExecutionContextSecrets(ec2),ec2}async function getByExecutionId(deps,input,ctx){let reqCtx=new RequestContext(ExecutionContextQueryController.method.getByExecutionId.input,input,callerIdentityOf(ctx),kindOf13(ctx));await newPipeline("execution-context-get-by-execution-id",deps.logger).addStep(newAuthorizeStep(ExecutionContextQueryController.method.getByExecutionId,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByExecutionIdStep(deps.store)).build().execute(reqCtx);let ec2=reqCtx.get(TARGET_RESOURCE_KEY);return await resolveValuesForCaller(deps,ctx,ec2),ec2}var import_node_crypto19=require("node:crypto");var file_ai_stigmer_platform_github_v1_service=fileDesc("CithaS9zdGlnbWVyL3BsYXRmb3JtL2dpdGh1Yi92MS9zZXJ2aWNlLnByb3RvEh1haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MSI8ChtHZXRPQXV0aEF1dGhvcml6ZVVybFJlcXVlc3QSHQoMcmVkaXJlY3RfdXJpGAEgASgJQge6SARyAhABIkQKHEdldE9BdXRoQXV0aG9yaXplVXJsUmVzcG9uc2USFQoNYXV0aG9yaXplX3VybBgBIAEoCRINCgVzdGF0ZRgCIAEoCSJoChhFeGNoYW5nZU9BdXRoQ29kZVJlcXVlc3QSFQoEY29kZRgBIAEoCUIHukgEcgIQARIWCgVzdGF0ZRgCIAEoCUIHukgEcgIQARIdCgxyZWRpcmVjdF91cmkYAyABKAlCB7pIBHICEAEiVAoZRXhjaGFuZ2VPQXV0aENvZGVSZXNwb25zZRIUCgxhY2Nlc3NfdG9rZW4YASABKAkSEgoKdG9rZW5fdHlwZRgCIAEoCRINCgVzY29wZRgDIAEoCTK2AgoNR2l0SHViU2VydmljZRKVAQoUZ2V0T0F1dGhBdXRob3JpemVVcmwSOi5haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MS5HZXRPQXV0aEF1dGhvcml6ZVVybFJlcXVlc3QaOy5haS5zdGlnbWVyLnBsYXRmb3JtLmdpdGh1Yi52MS5HZXRPQXV0aEF1dGhvcml6ZVVybFJlc3BvbnNlIgTQuBgBEowBChFleGNoYW5nZU9BdXRoQ29kZRI3LmFpLnN0aWdtZXIucGxhdGZvcm0uZ2l0aHViLnYxLkV4Y2hhbmdlT0F1dGhDb2RlUmVxdWVzdBo4LmFpLnN0aWdtZXIucGxhdGZvcm0uZ2l0aHViLnYxLkV4Y2hhbmdlT0F1dGhDb2RlUmVzcG9uc2UiBNC4GAFiBnByb3RvMw",[file_ai_stigmer_commons_rpc_method_options,file_buf_validate_validate]);var GetOAuthAuthorizeUrlResponseSchema=messageDesc2(file_ai_stigmer_platform_github_v1_service,1);var ExchangeOAuthCodeResponseSchema=messageDesc2(file_ai_stigmer_platform_github_v1_service,3),GitHubService=serviceDesc(file_ai_stigmer_platform_github_v1_service,0);var GITHUB_AUTHORIZE_URL="https://github.com/login/oauth/authorize",GITHUB_TOKEN_URL="https://github.com/login/oauth/access_token",OAUTH_SCOPES="repo,read:user",HTTP_TIMEOUT_MS=1e4;function registerGitHubServices(router,deps){router.service(GitHubService,{getOAuthAuthorizeUrl:req=>getOAuthAuthorizeUrl(deps,req),exchangeOAuthCode:req=>exchangeOAuthCode(deps,req)})}function getOAuthAuthorizeUrl(deps,req){if(deps.clientId==="")throw failedPreconditionError("GitHub OAuth is not configured (STIGMER_GITHUB_CLIENT_ID not set)");let state2;try{state2=(0,import_node_crypto19.randomBytes)(16).toString("hex")}catch(error2){throw deps.logger.error("failed to generate OAuth state",{error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to generate OAuth state")}let authorizeUrl=GITHUB_AUTHORIZE_URL+"?"+goUrlValuesEncode({client_id:deps.clientId,redirect_uri:req.redirectUri,scope:OAUTH_SCOPES,state:state2});return create2(GetOAuthAuthorizeUrlResponseSchema,{authorizeUrl,state:state2})}async function exchangeOAuthCode(deps,req){if(deps.clientId===""||deps.clientSecret==="")throw failedPreconditionError("GitHub OAuth is not configured");let body=goUrlValuesEncode({client_id:deps.clientId,client_secret:deps.clientSecret,code:req.code,redirect_uri:req.redirectUri}),fetchImpl=deps.fetchImpl??fetch,response;try{response=await fetchImpl(GITHUB_TOKEN_URL,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body,signal:AbortSignal.timeout(HTTP_TIMEOUT_MS)})}catch(error2){throw deps.logger.error("GitHub token exchange failed",{error:error2 instanceof Error?error2.message:String(error2)}),unavailableError("failed to reach GitHub for token exchange")}let raw;try{raw=await response.text()}catch(error2){throw deps.logger.error("failed to read GitHub token response",{error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to read GitHub response")}let tokenResponse;try{tokenResponse=JSON.parse(raw)}catch(error2){throw deps.logger.error("failed to parse GitHub token response",{error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to parse GitHub response")}if(tokenResponse.error!==void 0&&tokenResponse.error!=="")throw deps.logger.warn("GitHub OAuth error",{error:tokenResponse.error,description:tokenResponse.error_description??""}),invalidArgumentError(`GitHub OAuth error: ${tokenResponse.error_description??""}`);return create2(ExchangeOAuthCodeResponseSchema,{accessToken:tokenResponse.access_token??"",tokenType:tokenResponse.token_type??"",scope:tokenResponse.scope??""})}var file_ai_stigmer_agentic_memory_v1_io=fileDesc("CiVhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2lvLnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxIiEKCE1lbW9yeUlkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiYAoTTGlzdE1lbW9yaWVzUmVxdWVzdBIUCgNvcmcYASABKAlCB7pIBHICEAESMwoJcGFnZV9pbmZvGAIgASgLMiAuYWkuc3RpZ21lci5jb21tb25zLnJwYy5QYWdlSW5mbyJWCgpNZW1vcnlMaXN0EhMKC3RvdGFsX2NvdW50GAEgASgFEjMKBWl0ZW1zGAIgAygLMiQuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnliBnByb3RvMw",[file_ai_stigmer_agentic_memory_v1_api,file_ai_stigmer_commons_rpc_pagination,file_buf_validate_validate]),MemoryIdSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_io,0);var MemoryListSchema=messageDesc2(file_ai_stigmer_agentic_memory_v1_io,2);var file_ai_stigmer_agentic_memory_v1_command=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL2NvbW1hbmQucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEypQUKF01lbW9yeUNvbW1hbmRDb250cm9sbGVyEloKBmNyZWF0ZRIkLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5GiQuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnkiBNC4GAESigEKBnVwZGF0ZRIkLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5GiQuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnkiNMK4GDAIAhA5IgttZXRhZGF0YS5pZCoddW5hdXRob3JpemVkIHRvIHVwZGF0ZSBtZW1vcnkShgEKBmRlbGV0ZRImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIuwrgYKggDEDkiBXZhbHVlKh11bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG1lbW9yeRKIAQoHY29uZmlybRImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIvwrgYKwgCEDkiBXZhbHVlKh51bmF1dGhvcml6ZWQgdG8gY29uZmlybSBtZW1vcnkShgEKBnJlamVjdBImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIuwrgYKggCEDkiBXZhbHVlKh11bmF1dGhvcml6ZWQgdG8gcmVqZWN0IG1lbW9yeRoEoP8rOWIGcHJvdG8z",[file_ai_stigmer_agentic_memory_v1_api,file_ai_stigmer_agentic_memory_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),MemoryCommandController=serviceDesc(file_ai_stigmer_agentic_memory_v1_command,0);var file_ai_stigmer_agentic_memory_v1_query=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvbWVtb3J5L3YxL3F1ZXJ5LnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxMosCChVNZW1vcnlRdWVyeUNvbnRyb2xsZXISgAEKA2dldBImLmFpLnN0aWdtZXIuYWdlbnRpYy5tZW1vcnkudjEuTWVtb3J5SWQaJC5haS5zdGlnbWVyLmFnZW50aWMubWVtb3J5LnYxLk1lbW9yeSIrwrgYJwgBEDkiBXZhbHVlKhp1bmF1dGhvcml6ZWQgdG8gZ2V0IG1lbW9yeRJpCgRsaXN0EjEuYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5MaXN0TWVtb3JpZXNSZXF1ZXN0GiguYWkuc3RpZ21lci5hZ2VudGljLm1lbW9yeS52MS5NZW1vcnlMaXN0IgTQuBgBGgSg/ys5YgZwcm90bzM",[file_ai_stigmer_agentic_memory_v1_api,file_ai_stigmer_agentic_memory_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),MemoryQueryController=serviceDesc(file_ai_stigmer_agentic_memory_v1_query,0);var PLATFORM_CLIENT_KIND_NAME="PlatformClient",SYSTEM_SHARE_CLIENT_SLUG="system-share-client",RESERVED_PLATFORM_CLIENT_SLUGS=new Set([SYSTEM_SHARE_CLIENT_SLUG]),USER_TOKEN_CLAIMS={subject:"sub",externalUserId:"ext_user_id",email:"email",name:"name",org:"org",platformClientId:"platform_client_id"},BEARER_TOKEN_TYPE="Bearer";function reservedSlugMessage(slug){return`The slug '${slug}' is reserved for the platform's system-managed resources and cannot be used. If you did not provide a slug explicitly, it was derived from the resource name \u2014 choose a different name or provide an explicit slug.`}function systemManagedMessage(verb){return`This platform client is system-managed and cannot be ${verb}`}function referenceNotFoundMessage(org,slug){return`PlatformClient '${org}/${slug}' not found`}var INVALID_CLIENT_CREDENTIALS_MESSAGE="Invalid client_id or client_secret",EXPIRED_CLIENT_SECRET_MESSAGE="PlatformClient secret has expired. Rotating the secret does not extend it; the client's owner must set a later expires_at or set never_expires.";function organizationMismatchMessage(owningOrg){return`org_id must be empty or the PlatformClient's owning organization ('${owningOrg}'); cross-organization minting is not supported`}function noAccountMessage(externalUserId,org){return`User '${externalUserId}' has no Stigmer account in organization '${org}'. Enable auto_provision_accounts on the PlatformClient or create the account first.`}var OWNER_AUTO_GRANT_MESSAGE="auto_grant_role cannot be 'owner'; organization ownership must be assigned explicitly.",PROVISIONING_FAILED_MESSAGE="Account provisioning failed. No partial account was left behind; the request is safe to retry.";function blankSubjectPartMessage(part){return`${part} must not be null or blank`}function subjectSeparatorMessage(part,value){return`${part} must not contain the separator character '|': ${value}`}function foreignAccountMessage(externalUserId,org){return`User '${externalUserId}' in organization '${org}' resolves to an account no platform client provisioned \u2014 refusing to mint a token for it`}var MINTING_REQUIRES_AUTHENTICATION_MESSAGE="mintUserToken requires a server that authenticates its callers: this server trusts every request, so nothing would verify the token \u2014 configure an identity provider (STIGMER_OIDC_ISSUER) to enable PlatformClient token minting",MINTING_DISABLED_MESSAGE="mintUserToken is disabled: this server's platform-token key ring holds no signing key",GUEST_MINT_UNIMPLEMENTED_MESSAGE="PlatformClientTokenController.mintGuestToken is not implemented: guest tokens for shared agents are served by the Cloud edition",TOKEN_NAMES_NO_CLIENT_MESSAGE="platform token names no platform client",DELETED_CLIENT_MESSAGE="The platform client that minted this token has been deleted, so the token is no longer accepted. Mint a new user token from an active platform client.";function originRefusalMessage(origin){return`Request origin '${origin}' is not in this platform client's allowed_origins. Add it to the PlatformClient's allowed_origins to permit browser requests from this origin.`}var import_node_crypto20=require("node:crypto"),PLATFORM_TOKEN_ISSUER="stigmer",TOKEN_TYPE_CLAIM="token_type",ENVELOPE_CLAIMS=new Set(["iss","iat","exp","jti","aud"]),PLATFORM_TOKEN_REFUSAL_MESSAGES={signature:"platform token signature verification failed",expired:"platform token is expired",audience:"platform token was minted for another environment",subject:"platform token carries no subject"};function signPlatformToken(ring,claims,options={}){for(let name of Object.keys(claims))if(ENVELOPE_CLAIMS.has(name))throw new Error(`platform-token claim '${name}' belongs to the envelope and cannot be set by a lane`);let ttlSeconds=options.ttlSeconds??ring.ttlSeconds;if(!Number.isInteger(ttlSeconds)||ttlSeconds<=0)throw new Error(`platform-token lifetime must be a positive integer number of seconds, got ${ttlSeconds}`);let issuedAt=Math.floor((options.now??new Date).getTime()/1e3),expiresAtSeconds=issuedAt+ttlSeconds,header={alg:"RS256",typ:"JWT",kid:ring.signer.kid},payload={iss:PLATFORM_TOKEN_ISSUER,iat:issuedAt,exp:expiresAtSeconds,jti:(0,import_node_crypto20.randomUUID)(),...ring.audience!==""?{aud:ring.audience}:{},...claims},signingInput=`${base64UrlJson(header)}.${base64UrlJson(payload)}`,signature=(0,import_node_crypto20.sign)("sha256",Buffer.from(signingInput),ring.signer.key);return{token:`${signingInput}.${signature.toString("base64url")}`,expiresAt:new Date(expiresAtSeconds*1e3)}}function verifyPlatformToken(ring,token,now=new Date){let decoded=decode2(token);if(decoded===void 0||decoded.payload.iss!==PLATFORM_TOKEN_ISSUER)return{outcome:"foreign"};let signingInput=Buffer.from(`${decoded.encodedHeader}.${decoded.encodedPayload}`);if(!ring.verificationKeys.some(key=>(0,import_node_crypto20.verify)("sha256",signingInput,key,decoded.signature)))return{outcome:"refused",refusal:"signature"};let exp=decoded.payload.exp;if(typeof exp!="number"||exp*1e3<=now.getTime())return{outcome:"refused",refusal:"expired"};let aud=decoded.payload.aud;if(ring.audience!==""&&aud!==void 0&&!audienceMatches(aud,ring.audience))return{outcome:"refused",refusal:"audience"};let sub=decoded.payload.sub;return typeof sub!="string"||sub===""?{outcome:"refused",refusal:"subject"}:{outcome:"verified",token:{subject:sub,tokenType:stringClaim(decoded.payload,TOKEN_TYPE_CLAIM),payload:decoded.payload}}}function platformTokenRefusalError(refusal2){return new ConnectError(PLATFORM_TOKEN_REFUSAL_MESSAGES[refusal2],Code.Unauthenticated)}function decodeVerifiedPlatformTokenPayload(token){let decoded=decode2(token);return decoded!==void 0&&decoded.payload.iss===PLATFORM_TOKEN_ISSUER?decoded.payload:void 0}function stringClaim(payload,name){let value=payload[name];return typeof value=="string"&&value!==""?value:void 0}function decode2(token){let parts=token.split(".");if(parts.length!==3)return;let[encodedHeader="",encodedPayload="",encodedSignature=""]=parts,header=parseJsonObject(encodedHeader),payload=parseJsonObject(encodedPayload);if(!(header===void 0||payload===void 0))return{encodedHeader,encodedPayload,payload,signature:Buffer.from(encodedSignature,"base64url")}}function parseJsonObject(segment){try{let value=JSON.parse(Buffer.from(segment,"base64url").toString("utf8"));return typeof value=="object"&&value!==null&&!Array.isArray(value)?value:void 0}catch{return}}function audienceMatches(aud,expected){return typeof aud=="string"?aud===expected:Array.isArray(aud)&&aud.includes(expected)}function base64UrlJson(value){return Buffer.from(JSON.stringify(value)).toString("base64url")}var MEMORY_CAPTURE_CALLER_MESSAGE="memory can only be captured for a first-party human operator",MEMORY_CAPTURE_CREDENTIAL_KEY="memoryCaptureCredential";function newGuardMemoryCaptureStep(provider){return{name:"GuardMemoryCapture",async execute(ctx){let caller=ctx.callerIdentity;if(isServerComposedRequest(caller))return;let decide=provider?.authorizeMemoryCapture;if(decide!==void 0){let org=metadataOf(ctx.newState)?.org??"",decision=await decide.call(provider,caller,org);switch(decision.verdict){case"admit":ctx.set(MEMORY_CAPTURE_CREDENTIAL_KEY,{subjectIdentityAccountId:decision.subjectIdentityAccountId,provedSessionId:decision.provedSessionId});return;case"refuse":throw new ConnectError(MEMORY_CAPTURE_CALLER_MESSAGE,Code.PermissionDenied);case"no-opinion":break;default:{let exhaustive=decision;throw new Error(`unknown memory capture decision ${JSON.stringify(exhaustive)}`)}}}if(caller.callerClass==="machine"||carriesPlatformClientClaim(caller.rawToken))throw new ConnectError(MEMORY_CAPTURE_CALLER_MESSAGE,Code.PermissionDenied)}}}function memoryCaptureCredentialOf(ctx){let payload=ctx.get(MEMORY_CAPTURE_CREDENTIAL_KEY);if(typeof payload=="object"&&payload!==null&&"subjectIdentityAccountId"in payload&&"provedSessionId"in payload)return payload}function carriesPlatformClientClaim(rawToken){let payload=decodeVerifiedPlatformTokenPayload(rawToken);return payload!==void 0&&stringClaim(payload,USER_TOKEN_CLAIMS.platformClientId)!==void 0}var MEMORY_FULL_MESSAGE="memory is full \u2014 review and delete existing memories";function memoryDisabledMessage(org){return`memory is not enabled for organization ${org} \u2014 an organization admin can enable it in organization preferences`}var MEMORY_CONFIRM_REJECTED_MESSAGE="memory was rejected \u2014 delete it and let the agent propose it again",MEMORY_REJECT_CONFIRMED_MESSAGE="memory was confirmed \u2014 delete it to stop it from being recalled",MEMORY_SUBJECT_IMMUTABLE_MESSAGE="spec.subject_identity_account_id is immutable \u2014 it is derived from the capturing credential at create",MEMORY_PROVENANCE_IMMUTABLE_MESSAGE="spec.provenance is immutable \u2014 it records where the fact came from";var LIST_RESULT_KEY6="listResult";function newResolveMemoryDefaultsStep(){return{name:"ResolveMemoryDefaults",execute(ctx){let memory=ctx.newState,metadata=memory.metadata;if((metadata?.org??"")==="")throw invalidArgumentError("metadata.org is required for a memory");if(metadata===void 0)throw internalError(new Error("metadata is nil"),"metadata is nil");metadata.id===""&&(metadata.id=generateId("mem")),metadata.name===""&&metadata.slug===""&&(metadata.name=metadata.id);let spec=memory.spec;if(spec===void 0)throw internalError(new Error("memory spec is nil"),"memory spec is nil");let captureCredential=memoryCaptureCredentialOf(ctx);spec.subjectIdentityAccountId=captureCredential?.subjectIdentityAccountId??"",spec.provenance!==void 0&&(spec.provenance.toolCallId=""),captureCredential!==void 0&&(spec.provenance===void 0&&(spec.provenance=create2(MemoryProvenanceSchema,{})),spec.provenance.sessionId=captureCredential.provedSessionId)}}}var MEMORY_CREATE_DENIED_MESSAGE="unauthorized to capture memory in this organization";function resolveMemoryCreateTargets(ctx){return isServerComposedRequest(ctx.callerIdentity)?[]:[{permission:IamPermission.can_create_session,resourceKind:ApiResourceKind.organization,resourceId:ctx.newState.metadata?.org??"",deniedMessage:MEMORY_CREATE_DENIED_MESSAGE}]}function newCheckMemoryEnablementStep(store){return{name:"CheckMemoryEnablement",async execute(ctx){let orgID=ctx.newState.metadata?.org??"",org;try{org=await store.getResource(ApiResourceKind.organization,orgID,OrganizationSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("Organization",orgID):internalError(error2,"failed to load organization for memory enablement check")}if(org.spec?.preferences?.memoryEnabled!==!0)throw failedPreconditionError(memoryDisabledMessage(orgID))}}}function newCheckMemoryCapStep(store){return{name:"CheckMemoryCap",async execute(ctx){let newState=ctx.newState,org=newState.metadata?.org??"",subject=newState.spec?.subjectIdentityAccountId??"",rows;try{rows=await store.listResources(ApiResourceKind.memory)}catch(error2){throw internalError(error2,"failed to count memories for cap check")}let count=0;for(let bytes of rows){let existing=unmarshalMemory(bytes);existing!==void 0&&(existing.metadata?.org??"")===org&&(existing.spec?.subjectIdentityAccountId??"")===subject&&count++}if(count>=100)throw failedPreconditionError(MEMORY_FULL_MESSAGE)}}}function newInitializeMemoryLifecycleStep(){return{name:"InitializeMemoryLifecycle",execute(ctx){let memory=ctx.newState;memory.status===void 0&&(memory.status=create2(MemoryStatusSchema,{})),memory.status.lifecycleState=MemoryLifecycleState.lifecycle_state_proposed,memory.status.stateChangedAt=timestampNow()}}}function newValidateMemoryUpdateStep(){return{name:"ValidateMemoryUpdate",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing memory not found in context"),"existing memory not found in context");let newState=ctx.newState;if((newState.spec?.subjectIdentityAccountId??"")!==(existing.spec?.subjectIdentityAccountId??""))throw failedPreconditionError(MEMORY_SUBJECT_IMMUTABLE_MESSAGE);let newProvenance=newState.spec?.provenance,existingProvenance=existing.spec?.provenance;if(!(newProvenance===void 0||existingProvenance===void 0?newProvenance===existingProvenance:equals(MemoryProvenanceSchema,newProvenance,existingProvenance)))throw failedPreconditionError(MEMORY_PROVENANCE_IMMUTABLE_MESSAGE)}}}function newPersistMemoryUpdateStep(store){return{name:"PersistMemoryUpdate",async execute(ctx){let newState=ctx.newState,memoryId=newState.metadata?.id??"",live;try{live=await store.updateResource(ApiResourceKind.memory,memoryId,MemorySchema,row=>{row.apiVersion=newState.apiVersion,row.kind=newState.kind,row.metadata=newState.metadata,row.spec=newState.spec,newState.status?.audit!==void 0&&(row.status===void 0&&(row.status=create2(MemoryStatusSchema,{})),row.status.audit=newState.status.audit)})}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("Memory",memoryId):internalError(error2,"failed to persist memory update")}ctx.setNewState(live)}}}function newTransitionMemoryLifecycleStep(store,target,blockedMessage){return{name:"TransitionMemoryLifecycle",async execute(ctx){let memoryId=ctx.get(EXISTING_RESOURCE_KEY).metadata?.id??"",transitionNoOp=new Error("memory already in target state"),blocked,live;try{live=await store.updateResource(ApiResourceKind.memory,memoryId,MemorySchema,row=>{live=row;let current=row.status?.lifecycleState??MemoryLifecycleState.lifecycle_state_unspecified;if(current===target)throw transitionNoOp;if(current!==MemoryLifecycleState.lifecycle_state_proposed&&current!==MemoryLifecycleState.lifecycle_state_unspecified)throw blocked=failedPreconditionError(blockedMessage),blocked;row.status===void 0&&(row.status=create2(MemoryStatusSchema,{})),row.status.lifecycleState=target,row.status.stateChangedAt=timestampNow(),setAuditFieldsForUpdate(MemorySchema,row,"status_audit",ctx.callerIdentity)})}catch(error2){if(error2!==transitionNoOp)throw blocked!==void 0&&error2===blocked?blocked:error2 instanceof ResourceNotFoundError?notFoundError("Memory",memoryId):internalError(error2,"failed to transition memory lifecycle")}if(live===void 0)throw internalError(new Error("transition closure did not observe the row"),"failed to transition memory lifecycle");ctx.set(EXISTING_RESOURCE_KEY,live)}}}function newListMemoriesByOrgStep(store,listReadScope){return{name:"ListMemoriesByOrg",async execute(ctx){let org=ctx.input.org,rows;try{rows=await store.listResources(ApiResourceKind.memory)}catch(error2){throw internalError(error2,"failed to list memories")}let decoded=[];for(let bytes of rows){let memory=unmarshalMemory(bytes);memory!==void 0&&decoded.push(memory)}let memories=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.memory,decoded.filter(memory=>(memory.metadata?.org??"")===org),"");memories.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),ctx.set(LIST_RESULT_KEY6,create2(MemoryListSchema,{totalCount:memories.length,items:memories}))}}}function unmarshalMemory(data){try{return fromBinary2(MemorySchema,data)}catch{return}}function registerMemoryServices(router,deps){router.service(MemoryCommandController,{create:(memory,ctx)=>createMemory(deps,memory,ctx),update:(memory,ctx)=>update11(deps,memory,ctx),delete:(id,ctx)=>deleteMemory(deps,id,ctx),confirm:(id,ctx)=>confirm(deps,id,ctx),reject:(id,ctx)=>reject(deps,id,ctx)}),router.service(MemoryQueryController,{get:(id,ctx)=>get15(deps,id,ctx),list:(req,ctx)=>list9(deps,req,ctx)})}function kindOf14(ctx){return ctx.values.get(apiResourceKindKey)}async function createMemory(deps,memory,ctx){let reqCtx=new RequestContext(MemorySchema,memory,callerIdentityOf(ctx),kindOf14(ctx));return await newPipeline("memory-create",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newGuardMemoryCaptureStep(deps.runnerCredentialProvider)).addStep(newValidateVisibilityStep()).addStep(newResolveMemoryDefaultsStep()).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,resolveMemoryCreateTargets)).addStep(newCheckMemoryEnablementStep(deps.store)).addStep(newCheckMemoryCapStep(deps.store)).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newInitializeMemoryLifecycleStep()).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update11(deps,memory,ctx){let reqCtx=new RequestContext(MemorySchema,memory,callerIdentityOf(ctx),kindOf14(ctx));return await newPipeline("memory-update",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateMemoryUpdateStep()).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistMemoryUpdateStep(deps.store)).build().execute(reqCtx),reqCtx.newState}async function confirm(deps,memoryId,ctx){return runTransition(deps,memoryId,ctx,"memory-confirm",MemoryCommandController.method.confirm,MemoryLifecycleState.lifecycle_state_confirmed,MEMORY_CONFIRM_REJECTED_MESSAGE)}async function reject(deps,memoryId,ctx){return runTransition(deps,memoryId,ctx,"memory-reject",MemoryCommandController.method.reject,MemoryLifecycleState.lifecycle_state_rejected,MEMORY_REJECT_CONFIRMED_MESSAGE)}async function runTransition(deps,memoryId,ctx,name,method,target,blockedMessage){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline(name,deps.logger).addStep(newAuthorizeStep(method,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,MemorySchema)).addStep(newTransitionMemoryLifecycleStep(deps.store,target,blockedMessage)).build().execute(reqCtx);let transitioned=reqCtx.get(EXISTING_RESOURCE_KEY);if(transitioned===void 0)throw internalError(new Error("transitioned memory not found in context"),"transitioned memory not found in context");return transitioned}async function deleteMemory(deps,memoryId,ctx){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline("memory-delete",deps.logger).addStep(newAuthorizeStep(MemoryCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,MemorySchema)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted memory not found in context"),"deleted memory not found in context");return deleted}async function get15(deps,memoryId,ctx){let reqCtx=new RequestContext(MemoryIdSchema,memoryId,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline("memory-get",deps.logger).addStep(newAuthorizeStep(MemoryQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadTargetStep(deps.store,MemorySchema)).build().execute(reqCtx);let target=reqCtx.get(TARGET_RESOURCE_KEY);if(target===void 0)throw internalError(new Error("target memory not found in context"),"target memory not found in context");return target}async function list9(deps,req,ctx){let reqCtx=new RequestContext(MemoryQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf14(ctx));await newPipeline("memory-list",deps.logger).addStep(newAuthorizeStep(MemoryQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListMemoriesByOrgStep(deps.store,deps.listReadScope)).build().execute(reqCtx);let result=reqCtx.get(LIST_RESULT_KEY6);if(result===void 0)throw internalError(new Error("memory list not found in context"),"memory list not found in context");return result}var file_ai_stigmer_iam_oauthapp_v1_command=fileDesc("CihhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9jb21tYW5kLnByb3RvEhphaS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MTLOBAoZT0F1dGhBcHBDb21tYW5kQ29udHJvbGxlchJTCgVhcHBseRIkLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwGiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHASowEKBmNyZWF0ZRIkLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwGiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHAiTcK4GEkIFxAeIgxtZXRhZGF0YS5vcmcqNXVuYXV0aG9yaXplZCB0byBjcmVhdGUgb2F1dGggYXBwIGluIHRoaXMgb3JnYW5pemF0aW9uEo0BCgZ1cGRhdGUSJC5haS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MS5PQXV0aEFwcBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIjfCuBgzCAIQFiILbWV0YWRhdGEuaWQqIHVuYXV0aG9yaXplZCB0byB1cGRhdGUgb2F1dGggYXBwEp8BCgZkZWxldGUSNi5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VEZWxldGVJbnB1dBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIjfCuBgzCAMQFiILcmVzb3VyY2VfaWQqIHVuYXV0aG9yaXplZCB0byBkZWxldGUgb2F1dGggYXBwGgSg/ysWYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_oauthapp_v1_api]),OAuthAppCommandController=serviceDesc(file_ai_stigmer_iam_oauthapp_v1_command,0);var file_ai_stigmer_iam_oauthapp_v1_io=fileDesc("CiNhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9pby5wcm90bxIaYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEiJgoKT0F1dGhBcHBJZBIYCgV2YWx1ZRgBIAEoCUIJukgGcgQQARhAIkIKCU9BdXRoQXBwcxI1CgdlbnRyaWVzGAEgAygLMiQuYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEuT0F1dGhBcHAiLwoXTGlzdE9BdXRoQXBwc0J5T3JnSW5wdXQSFAoDb3JnGAEgASgJQge6SARyAhABYgZwcm90bzM",[file_ai_stigmer_iam_oauthapp_v1_api,file_buf_validate_validate]);var OAuthAppsSchema=messageDesc2(file_ai_stigmer_iam_oauthapp_v1_io,1);var file_ai_stigmer_iam_oauthapp_v1_query=fileDesc("CiZhaS9zdGlnbWVyL2lhbS9vYXV0aGFwcC92MS9xdWVyeS5wcm90bxIaYWkuc3RpZ21lci5pYW0ub2F1dGhhcHAudjEy0AMKF09BdXRoQXBwUXVlcnlDb250cm9sbGVyEosBCgNnZXQSLS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VJZBokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIi/CuBgrCAEQFiIFdmFsdWUqHnVuYXV0aG9yaXplZCB0byB2aWV3IG9hdXRoIGFwcBJyCg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRokLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwIgTQuBgBEqwBCglsaXN0QnlPcmcSMy5haS5zdGlnbWVyLmlhbS5vYXV0aGFwcC52MS5MaXN0T0F1dGhBcHBzQnlPcmdJbnB1dBolLmFpLnN0aWdtZXIuaWFtLm9hdXRoYXBwLnYxLk9BdXRoQXBwcyJDwrgYPwgBEB4iA29yZyo0dW5hdXRob3JpemVkIHRvIGxpc3Qgb2F1dGggYXBwcyBpbiB0aGlzIG9yZ2FuaXphdGlvbhoEoP8rFmIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_oauthapp_v1_api,file_ai_stigmer_iam_oauthapp_v1_io]),OAuthAppQueryController=serviceDesc(file_ai_stigmer_iam_oauthapp_v1_query,0);var REDACTED_MARKER3="***REDACTED***",MARKER_ON_CREATE_MESSAGE="cannot use the redaction marker as client_secret on create",PRESERVE_NO_EXISTING_SECRET_MESSAGE="cannot preserve client_secret: no existing secret value found",CIPHERTEXT_SHAPED_SECRET_MESSAGE="client_secret must be plaintext \u2014 values carrying the 'enc:' encryption prefix are not accepted from clients";function deleteBlockedByMcpServerMessage(org,slug,mcpServerName){return`cannot delete OAuthApp '${org}/${slug}': referenced by MCP server '${mcpServerName}'`}async function resolveOAuthAppRef(store,ref,logger2){let slug=ref?.slug??"";if(slug==="")return;let rows=await store.listResources(ApiResourceKind.oauth_app),slugMatches=[];for(let data of rows){let app;try{app=fromBinary2(OAuthAppSchema,data)}catch{continue}if((app.metadata?.slug??"")!==slug)continue;let refOrg=ref?.org??"";if(refOrg!==""&&app.metadata?.org===refOrg)return app;slugMatches.push(app)}if(slugMatches.length!==0){if(slugMatches.length===1)return slugMatches[0];logger2.warn("oauth_app_ref is ambiguous (slug exists in several orgs, none matching the ref); refusing to pick \u2014 pin the ref's org to resolve",{oauthAppSlug:slug,refOrg:ref?.org??"",candidateOrgs:slugMatches.map(app=>app.metadata?.org??"")})}}function redactOAuthApp(app){app.spec!==void 0&&app.spec.clientSecret!==""&&(app.spec.clientSecret=REDACTED_MARKER3)}function newEncryptClientSecretForCreateStep(secretService,logger2){return newEncryptClientSecretStep(secretService,logger2,!0)}function newEncryptClientSecretForUpdateStep(secretService,logger2){return newEncryptClientSecretStep(secretService,logger2,!1)}function newEncryptClientSecretStep(secretService,logger2,isCreate){return{name:"EncryptClientSecret",async execute(ctx){let app=ctx.newState;if(app.spec===void 0)return;let clientSecret=app.spec.clientSecret;if(clientSecret!==""){if(clientSecret===REDACTED_MARKER3){preserveExistingSecret(ctx,app,isCreate,logger2);return}if(isCiphertextShaped(clientSecret))throw invalidArgumentError(CIPHERTEXT_SHAPED_SECRET_MESSAGE);if(!secretService.isEnabled()){logger2.warn("encryption disabled: client_secret will be stored in plaintext");return}try{app.spec.clientSecret=await secretService.encrypt(clientSecret,EncryptionScope.forOrganization(app.metadata?.org??""))}catch(error2){throw internalError(error2,"failed to encrypt client_secret")}}}}}function preserveExistingSecret(ctx,app,isCreate,logger2){if(isCreate)throw invalidArgumentError(MARKER_ON_CREATE_MESSAGE);let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing resource not loaded"),"cannot preserve client_secret: existing resource not loaded");let existingSecret=existing.spec?.clientSecret??"";if(existingSecret==="")throw invalidArgumentError(PRESERVE_NO_EXISTING_SECRET_MESSAGE);app.spec!==void 0&&(app.spec.clientSecret=existingSecret),logger2.debug("preserved existing encrypted client_secret",{oauthAppId:app.metadata?.id??""})}function newCheckNoReferencingMcpServersStep(store,logger2){return{name:"CheckNoReferencingMcpServers",async execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)throw internalError(new Error("existing OAuthApp missing from pipeline context"),"existing OAuthApp not loaded in delete pipeline");let resources;try{resources=await store.listResources(ApiResourceKind.mcp_server)}catch(error2){throw internalError(error2,"failed to list MCP servers for referential integrity check")}for(let data of resources){let mcp;try{mcp=fromBinary2(McpServerSchema,data)}catch(error2){logger2.warn("failed to unmarshal MCP server during referential integrity check, skipping",{error:error2 instanceof Error?error2.message:String(error2)});continue}let ref=mcp.spec?.auth?.oauthAppRef;if(ref===void 0)continue;let resolved;try{resolved=await resolveOAuthAppRef(store,ref,logger2)}catch(error2){throw internalError(error2,"failed to resolve oauth_app_ref during referential integrity check")}if(resolved!==void 0&&(resolved.metadata?.id??"")===(existing.metadata?.id??""))throw failedPreconditionError(deleteBlockedByMcpServerMessage(existing.metadata?.org??"",existing.metadata?.slug??"",mcp.metadata?.name??""))}}}}function registerOAuthAppServices(router,deps){router.service(OAuthAppCommandController,{apply:(app,ctx)=>apply9(deps,app,ctx),create:(app,ctx)=>createOAuthApp(deps,app,ctx),update:(app,ctx)=>update12(deps,app,ctx),delete:(input,ctx)=>deleteOAuthApp(deps,input,ctx)}),router.service(OAuthAppQueryController,{get:(id,ctx)=>get16(deps,id,ctx),getByReference:(ref,ctx)=>getByReference9(deps,ref,ctx),listByOrg:(req,ctx)=>listByOrg2(deps,req,ctx)})}function kindOf15(ctx){return ctx.values.get(apiResourceKindKey)}async function createOAuthApp(deps,app,ctx){let reqCtx=new RequestContext(OAuthAppSchema,app,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-create",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newEncryptClientSecretForCreateStep(deps.secretService,deps.logger)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx);let result=reqCtx.newState;return redactOAuthApp(result),result}async function update12(deps,app,ctx){let reqCtx=new RequestContext(OAuthAppSchema,app,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-update",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newEncryptClientSecretForUpdateStep(deps.secretService,deps.logger)).addStep(newPersistStep(deps.store)).build().execute(reqCtx);let result=reqCtx.newState;return redactOAuthApp(result),result}async function apply9(deps,app,ctx){let reqCtx=new RequestContext(OAuthAppSchema,app,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-apply",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createOAuthApp(deps,app,ctx):update12(deps,withResolvedApplyId(OAuthAppSchema,app,reqCtx),ctx)}async function deleteOAuthApp(deps,input,ctx){let reqCtx=new RequestContext(OAuthAppCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf15(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("oauthapp-delete",deps.logger).addStep(newAuthorizeStep(OAuthAppCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,OAuthAppSchema)).addStep(newCheckNoReferencingMcpServersStep(deps.store,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDestroySecretBackingStateStep(deps.secretService,deps.logger,app2=>app2.spec===void 0?[]:[app2.spec.clientSecret])).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted OAuthApp not found in context"),"deleted OAuthApp not found in context");let app=deleted;return redactOAuthApp(app),app}async function get16(deps,id,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-get",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,OAuthAppSchema)).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactOAuthApp(app),app}async function getByReference9(deps,ref,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-get-by-reference",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,OAuthAppSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(OAuthAppQueryController.method.get))).build().execute(reqCtx);let app=reqCtx.get(TARGET_RESOURCE_KEY);return redactOAuthApp(app),app}var LIST_RESULT_KEY7="listResult";async function listByOrg2(deps,req,ctx){let reqCtx=new RequestContext(OAuthAppQueryController.method.listByOrg.input,req,callerIdentityOf(ctx),kindOf15(ctx));await newPipeline("oauthapp-list-by-org",deps.logger).addStep(newAuthorizeStep(OAuthAppQueryController.method.listByOrg,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListByOrgStep2(deps.store,deps.listReadScope,deps.logger)).build().execute(reqCtx);let list12=reqCtx.get(LIST_RESULT_KEY7);if(list12===void 0)throw internalError(new Error("list result missing from pipeline context"),"OAuthApp list not found in context");return list12}function newListByOrgStep2(store,listReadScope,logger2){return{name:"ListByOrg",async execute(ctx){let org=ctx.input.org,resources;try{resources=await store.listResources(ApiResourceKind.oauth_app)}catch(error2){throw internalError(error2,"failed to list OAuthApps")}let requested=[];for(let data of resources){let app;try{app=fromBinary2(OAuthAppSchema,data)}catch(error2){logger2.warn("failed to unmarshal OAuthApp, skipping",{error:error2 instanceof Error?error2.message:String(error2)});continue}(app.metadata?.org??"")===org&&requested.push(app)}let apps=await restrictListByReadScope(listReadScope,ctx.callerIdentity,ApiResourceKind.oauth_app,requested,"");for(let app of apps)redactOAuthApp(app);apps.sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)),logger2.info("listed OAuthApps by organization",{org,matchCount:apps.length}),ctx.set(LIST_RESULT_KEY7,create2(OAuthAppsSchema,{entries:apps}))}}}var file_ai_stigmer_iam_platformclient_v1_io=fileDesc("CilhaS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS9pby5wcm90bxIgYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEiLAoQUGxhdGZvcm1DbGllbnRJZBIYCgV2YWx1ZRgBIAEoCUIJukgGcgQQARhAIlQKD1BsYXRmb3JtQ2xpZW50cxJBCgdlbnRyaWVzGAEgAygLMjAuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuUGxhdGZvcm1DbGllbnQiNQodTGlzdFBsYXRmb3JtQ2xpZW50c0J5T3JnSW5wdXQSFAoDb3JnGAEgASgJQge6SARyAhABIoABChxQbGF0Zm9ybUNsaWVudENyZWF0ZVJlc3BvbnNlEkkKD3BsYXRmb3JtX2NsaWVudBgBIAEoCzIwLmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLlBsYXRmb3JtQ2xpZW50EhUKDWNsaWVudF9zZWNyZXQYAiABKAliBnByb3RvMw",[file_ai_stigmer_iam_platformclient_v1_api,file_buf_validate_validate]);var PlatformClientsSchema=messageDesc2(file_ai_stigmer_iam_platformclient_v1_io,1);var PlatformClientCreateResponseSchema=messageDesc2(file_ai_stigmer_iam_platformclient_v1_io,3);var file_ai_stigmer_iam_platformclient_v1_command=fileDesc("Ci5haS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS9jb21tYW5kLnByb3RvEiBhaS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MTKgBgofUGxhdGZvcm1DbGllbnRDb21tYW5kQ29udHJvbGxlchLPAQoGY3JlYXRlEjAuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuUGxhdGZvcm1DbGllbnQaPi5haS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MS5QbGF0Zm9ybUNsaWVudENyZWF0ZVJlc3BvbnNlIlPCuBhPCBgQHiIMbWV0YWRhdGEub3JnKjt1bmF1dGhvcml6ZWQgdG8gY3JlYXRlIHBsYXRmb3JtIGNsaWVudCBpbiB0aGlzIG9yZ2FuaXphdGlvbhKrAQoGdXBkYXRlEjAuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuUGxhdGZvcm1DbGllbnQaMC5haS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MS5QbGF0Zm9ybUNsaWVudCI9wrgYOQgCEBciC21ldGFkYXRhLmlkKiZ1bmF1dGhvcml6ZWQgdG8gdXBkYXRlIHBsYXRmb3JtIGNsaWVudBKxAQoGZGVsZXRlEjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlRGVsZXRlSW5wdXQaMC5haS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MS5QbGF0Zm9ybUNsaWVudCI9wrgYOQgDEBciC3Jlc291cmNlX2lkKiZ1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIHBsYXRmb3JtIGNsaWVudBLCAQoMcm90YXRlU2VjcmV0EjIuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuUGxhdGZvcm1DbGllbnRJZBo+LmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLlBsYXRmb3JtQ2xpZW50Q3JlYXRlUmVzcG9uc2UiPsK4GDoIAhAXIgV2YWx1ZSotdW5hdXRob3JpemVkIHRvIHJvdGF0ZSBwbGF0Zm9ybSBjbGllbnQgc2VjcmV0GgSg/ysXYgZwcm90bzM",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_platformclient_v1_api,file_ai_stigmer_iam_platformclient_v1_io]),PlatformClientCommandController=serviceDesc(file_ai_stigmer_iam_platformclient_v1_command,0);var file_ai_stigmer_iam_platformclient_v1_query=fileDesc("CixhaS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS9xdWVyeS5wcm90bxIgYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEykgQKHVBsYXRmb3JtQ2xpZW50UXVlcnlDb250cm9sbGVyEp0BCgNnZXQSLS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuQXBpUmVzb3VyY2VJZBowLmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLlBsYXRmb3JtQ2xpZW50IjXCuBgxCAEQFyIFdmFsdWUqJHVuYXV0aG9yaXplZCB0byB2aWV3IHBsYXRmb3JtIGNsaWVudBJ+Cg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRowLmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLlBsYXRmb3JtQ2xpZW50IgTQuBgBEsoBCglsaXN0QnlPcmcSPy5haS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MS5MaXN0UGxhdGZvcm1DbGllbnRzQnlPcmdJbnB1dBoxLmFpLnN0aWdtZXIuaWFtLnBsYXRmb3JtY2xpZW50LnYxLlBsYXRmb3JtQ2xpZW50cyJJwrgYRQgBEB4iA29yZyo6dW5hdXRob3JpemVkIHRvIGxpc3QgcGxhdGZvcm0gY2xpZW50cyBpbiB0aGlzIG9yZ2FuaXphdGlvbhoEoP8rF2IGcHJvdG8z",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_iam_platformclient_v1_api,file_ai_stigmer_iam_platformclient_v1_io]),PlatformClientQueryController=serviceDesc(file_ai_stigmer_iam_platformclient_v1_query,0);var import_node_crypto21=require("node:crypto"),CLIENT_ID_PREFIX="stgm_cid_",CLIENT_SECRET_PREFIX="stgm_cs_",CLIENT_ID_BYTES=32,CLIENT_SECRET_BYTES=48,SECRET_FINGERPRINT_LENGTH=6;function generateClientId(){return CLIENT_ID_PREFIX+(0,import_node_crypto21.randomBytes)(CLIENT_ID_BYTES).toString("base64url")}function generateClientSecret(){return CLIENT_SECRET_PREFIX+(0,import_node_crypto21.randomBytes)(CLIENT_SECRET_BYTES).toString("base64url")}function hashClientSecret(secret){return(0,import_node_crypto21.createHash)("sha256").update(secret,"utf8").digest("base64url")}function secretFingerprint(secret){return secret.length<=SECRET_FINGERPRINT_LENGTH?secret:secret.slice(-SECRET_FINGERPRINT_LENGTH)}function secretMatchesHash(secret,storedHash){if(storedHash==="")return!1;let presented=Buffer.from(hashClientSecret(secret),"utf8"),stored=Buffer.from(storedHash,"utf8");return presented.length===stored.length&&(0,import_node_crypto21.timingSafeEqual)(presented,stored)}var DuplicatePlatformClientError=class extends Error{constructor(message6,options){super(message6,options),this.name="DuplicatePlatformClientError"}};var CLIENT_SECRET_PLAINTEXT_KEY="platformClientSecretPlaintext";function redactPlatformClient(client){return client.spec!==void 0&&(client.spec.clientSecretHash=""),client}function parkedClientSecret(ctx){let secret=ctx.get(CLIENT_SECRET_PLAINTEXT_KEY);if(typeof secret!="string"||secret==="")throw internalError(new Error("no client secret parked \u2014 a credential step must run first"),"platform client credentials");return secret}function newRefuseReservedSlugStep(){return{name:"RefuseReservedSlug",execute(ctx){let slug=metadataOf(ctx.newState)?.slug??"";if(RESERVED_PLATFORM_CLIENT_SLUGS.has(slug))throw invalidArgumentError(reservedSlugMessage(slug))}}}function newCheckDuplicateStep3(clients){return{name:"CheckDuplicate",async execute(ctx){let metadata=requireMetadata2(ctx,"duplicate check"),existing=await clients.findByOrgAndSlug(metadata.org,metadata.slug);if(existing!==void 0)throw alreadyExistsError(PLATFORM_CLIENT_KIND_NAME,`slug '${metadata.slug}' in org '${metadata.org}' (id: ${existing.metadata?.id??""})`)}}}function newGenerateClientCredentialsStep(){return{name:"GenerateClientCredentials",execute(ctx){let spec=specOf3(ctx.newState),secret=generateClientSecret();spec.clientId=generateClientId(),spec.clientSecretHash=hashClientSecret(secret),spec.secretFingerprint=secretFingerprint(secret),ctx.set(CLIENT_SECRET_PLAINTEXT_KEY,secret)}}}function newPersistNewClientStep(clients){return{name:"Persist",async execute(ctx){try{await clients.save(ctx.newState)}catch(error2){if(error2 instanceof DuplicatePlatformClientError){let metadata=requireMetadata2(ctx,"persist");throw alreadyExistsError(PLATFORM_CLIENT_KIND_NAME,`slug '${metadata.slug}' in org '${metadata.org}'`)}throw internalError(error2,"failed to save platform client")}}}}function newLoadExistingClientStep(clients){return{name:"LoadExisting",async execute(ctx){let metadata=requireMetadata2(ctx,"load existing"),existing;if(metadata.id!==""){if(existing=await clients.findById(metadata.id),existing===void 0)throw notFoundError(PLATFORM_CLIENT_KIND_NAME,metadata.id)}else if(metadata.slug!==""){if(existing=await clients.findByOrgAndSlug(metadata.org,metadata.slug),existing===void 0)throw notFoundError(PLATFORM_CLIENT_KIND_NAME,metadata.slug);metadata.id=existing.metadata?.id??""}else throw invalidArgumentError("resource id or slug is required for update");ctx.set(EXISTING_RESOURCE_KEY,existing)}}}function newPreserveClientCredentialsStep(){return{name:"PreserveClientCredentials",execute(ctx){let existing=storedClientOf(ctx,EXISTING_RESOURCE_KEY),spec=specOf3(ctx.newState);spec.clientId=existing.spec?.clientId??"",spec.clientSecretHash=existing.spec?.clientSecretHash??"",spec.secretFingerprint=existing.spec?.secretFingerprint??""}}}function newPersistUpdatedClientStep(clients){return{name:"Persist",async execute(ctx){try{await clients.update(ctx.newState)}catch(error2){throw internalError(error2,"failed to save platform client")}}}}function newRefuseSystemManagedStep(verb,key){return{name:"RefuseSystemManaged",execute(ctx){if(storedClientOf(ctx,key).metadata?.labels[SYSTEM_MANAGED_LABEL]===RESERVED_LABEL_TRUE)throw failedPreconditionError(systemManagedMessage(verb))}}}function newLoadTargetClientStep(clients){return{name:"LoadTarget",async execute(ctx){let id=idValueOf(ctx.input);if(id==="")throw invalidArgumentError("resource id is required");ctx.set(TARGET_RESOURCE_KEY,await readClient(clients,id))}}}function newLoadClientByReferenceStep(clients){return{name:"LoadByReference",async execute(ctx){let ref=ctx.input;if(ref.slug==="")throw invalidArgumentError("slug is required in reference");if(ref.kind!==ApiResourceKind.api_resource_kind_unknown&&ref.kind!==ApiResourceKind.platform_client)throw invalidArgumentError(`kind mismatch: expected platform_client, got ${ApiResourceKind[ref.kind]??String(ref.kind)}`);requireOrgForReference(ApiResourceKind.platform_client,ref.org);let client=await clients.findByOrgAndSlug(ref.org,ref.slug);if(client===void 0)throw new ConnectError(referenceNotFoundMessage(ref.org,ref.slug),Code.NotFound);ctx.set(TARGET_RESOURCE_KEY,client)}}}function newRotateClientCredentialsStep(){return{name:"RotateClientCredentials",execute(ctx){let client=storedClientOf(ctx,TARGET_RESOURCE_KEY),spec=specOf3(client),secret=generateClientSecret();spec.clientSecretHash=hashClientSecret(secret),spec.secretFingerprint=secretFingerprint(secret),updateAuditFields(PlatformClientSchema,client,client,ctx.callerIdentity),ctx.set(CLIENT_SECRET_PLAINTEXT_KEY,secret)}}}function newPersistTargetClientStep(clients){return{name:"Persist",async execute(ctx){try{await clients.update(storedClientOf(ctx,TARGET_RESOURCE_KEY))}catch(error2){throw internalError(error2,"failed to save platform client")}}}}function newLoadExistingClientForDeleteStep(clients){return{name:"LoadExistingForDelete",async execute(ctx){ctx.set(EXISTING_RESOURCE_KEY,await readClient(clients,requireResourceId3(ctx)))}}}function newDeleteClientStep(clients){return{name:"DeleteResource",async execute(ctx){try{await clients.deleteById(requireResourceId3(ctx))}catch(error2){throw internalError(error2,"failed to delete platform client")}}}}async function readClient(clients,id){let client=await clients.findById(id);if(client===void 0)throw notFoundError(PLATFORM_CLIENT_KIND_NAME,id);return client}function storedClientOf(ctx,key){let client=ctx.get(key);if(client===void 0)throw internalError(new Error(`no platform client under '${key}' \u2014 its load step must run first`),"platform client chain ordering");return client}function requireMetadata2(ctx,operation2){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("platform client metadata is nil"),operation2);return metadata}function specOf3(client){return client.spec===void 0&&(client.spec=create2(PlatformClientSpecSchema)),client.spec}function requireResourceId3(ctx){let id=ctx.get(RESOURCE_ID_KEY);if(typeof id!="string"||id==="")throw internalError(new Error("resource id not found in context (the delete handler sets it)"),"platform client delete ordering");return id}function registerPlatformClientServices(router,deps){router.service(PlatformClientCommandController,{create:(client,ctx)=>createClient2(deps,client,ctx),update:(client,ctx)=>updateClient(deps,client,ctx),delete:(input,ctx)=>deleteClient(deps,input,ctx),rotateSecret:(id,ctx)=>rotateSecret(deps,id,ctx)}),router.service(PlatformClientQueryController,{get:(id,ctx)=>get17(deps,id,ctx),getByReference:(ref,ctx)=>getByReference10(deps,ref,ctx),listByOrg:(input,ctx)=>listByOrg3(deps,input,ctx)})}function kindOf16(ctx){return ctx.values.get(apiResourceKindKey)}async function createClient2(deps,client,ctx){let reqCtx=new RequestContext(PlatformClientSchema,client,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("platformclient-create",deps.logger).addStep(newAuthorizeStep(PlatformClientCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newRefuseReservedSlugStep()).addStep(newCheckDuplicateStep3(deps.clients)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newGenerateClientCredentialsStep()).addStep(newPersistNewClientStep(deps.clients)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),create2(PlatformClientCreateResponseSchema,{platformClient:redactPlatformClient(reqCtx.newState),clientSecret:parkedClientSecret(reqCtx)})}async function updateClient(deps,client,ctx){let reqCtx=new RequestContext(PlatformClientSchema,client,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("platformclient-update",deps.logger).addStep(newAuthorizeStep(PlatformClientCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingClientStep(deps.clients)).addStep(newRefuseSystemManagedStep("updated",EXISTING_RESOURCE_KEY)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPreserveClientCredentialsStep()).addStep(newPersistUpdatedClientStep(deps.clients)).build().execute(reqCtx),redactPlatformClient(reqCtx.newState)}async function deleteClient(deps,input,ctx){let reqCtx=new RequestContext(PlatformClientCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf16(ctx));return reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("platformclient-delete",deps.logger).addStep(newAuthorizeStep(PlatformClientCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingClientForDeleteStep(deps.clients)).addStep(newRefuseSystemManagedStep("deleted",EXISTING_RESOURCE_KEY)).addStep(newDeleteClientStep(deps.clients)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).build().execute(reqCtx),redactPlatformClient(storedClientOf(reqCtx,EXISTING_RESOURCE_KEY))}async function rotateSecret(deps,id,ctx){let reqCtx=new RequestContext(PlatformClientCommandController.method.rotateSecret.input,id,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("platformclient-rotate-secret",deps.logger).addStep(newAuthorizeStep(PlatformClientCommandController.method.rotateSecret,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetClientStep(deps.clients)).addStep(newRefuseSystemManagedStep("rotated",TARGET_RESOURCE_KEY)).addStep(newRotateClientCredentialsStep()).addStep(newPersistTargetClientStep(deps.clients)).build().execute(reqCtx),create2(PlatformClientCreateResponseSchema,{platformClient:redactPlatformClient(storedClientOf(reqCtx,TARGET_RESOURCE_KEY)),clientSecret:parkedClientSecret(reqCtx)})}async function get17(deps,id,ctx){let reqCtx=new RequestContext(PlatformClientQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("platformclient-get",deps.logger).addStep(newAuthorizeStep(PlatformClientQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetClientStep(deps.clients)).build().execute(reqCtx),redactPlatformClient(storedClientOf(reqCtx,TARGET_RESOURCE_KEY))}async function getByReference10(deps,ref,ctx){let reqCtx=new RequestContext(PlatformClientQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf16(ctx));return await newPipeline("platformclient-get-by-reference",deps.logger).addStep(newAuthorizeStep(PlatformClientQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadClientByReferenceStep(deps.clients)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(PlatformClientQueryController.method.get))).build().execute(reqCtx),redactPlatformClient(storedClientOf(reqCtx,TARGET_RESOURCE_KEY))}async function listByOrg3(deps,input,ctx){let caller=callerIdentityOf(ctx),reqCtx=new RequestContext(PlatformClientQueryController.method.listByOrg.input,input,caller,kindOf16(ctx));await newPipeline("platformclient-list-by-org",deps.logger).addStep(newAuthorizeStep(PlatformClientQueryController.method.listByOrg,deps.authorizer)).addStep(newValidateProtoStep()).build().execute(reqCtx);let candidates;try{candidates=await deps.clients.findByOrg(input.org)}catch(error2){throw internalError(error2,"failed to list platform clients")}let entries=[...await restrictListByReadScope(deps.listReadScope,caller,ApiResourceKind.platform_client,candidates,input.org)].sort((a5,b7)=>compareCreatedAtDesc(a5.status?.audit?.specAudit?.createdAt,b7.status?.audit?.specAudit?.createdAt)).map(redactPlatformClient);return create2(PlatformClientsSchema,{entries})}var OPAQUE_ORIGIN="null";function newPlatformClientOriginGuard(deps){return{name:"platform-client-origin",async guard(caller,method,headers2){let origin=headers2.get("origin")??"";if(origin.trim()==="")return;let platformClientId=mintingClientOf(caller);if(platformClientId===void 0)return;let procedure=`/${method.parent.typeName}/${method.name}`,client=await deps.clients.findById(platformClientId);if(client===void 0)throw new ConnectError(DELETED_CLIENT_MESSAGE,Code.Unauthenticated);if(!originAllowed(origin,client.spec?.allowedOrigins??[]))throw deps.logger.warn("origin refusal: origin not in allowed_origins",{procedure,platformClientId,origin}),new ConnectError(originRefusalMessage(origin),Code.PermissionDenied)}}}function mintingClientOf(caller){let payload=decodeVerifiedPlatformTokenPayload(caller.rawToken);if(!(payload===void 0||stringClaim(payload,TOKEN_TYPE_CLAIM)!==void 0))return stringClaim(payload,USER_TOKEN_CLAIMS.platformClientId)}function originAllowed(origin,allowed){if(allowed.length===0)return!0;if(origin===OPAQUE_ORIGIN)return!1;let presented=origin.toLowerCase();return allowed.some(entry=>entry.toLowerCase()===presented)}var KIND5=ApiResourceKind.platform_client;function newResourcePlatformClientStore(store){async function readById(id){try{return await store.getResource(KIND5,id,PlatformClientSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}async function readByClientId(clientId){if(clientId!=="")try{return await store.findByField(KIND5,"spec.clientId",clientId,PlatformClientSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}}async function listOrg(org){let clients=[];for(let data of await store.listResources(KIND5)){let client;try{client=fromBinary2(PlatformClientSchema,data)}catch{continue}(client.metadata?.org??"")===org&&clients.push(client)}return clients}async function readByOrgAndSlug(org,slug){if(!(org===""||slug===""))return(await listOrg(org)).find(client=>(client.metadata?.slug??"")===slug)}return{async save(client){let id=client.metadata?.id??"",org=client.metadata?.org??"",slug=client.metadata?.slug??"";if(await readById(id)!==void 0)throw new DuplicatePlatformClientError(`platform client '${id}' already exists`);if(await readByOrgAndSlug(org,slug)!==void 0)throw new DuplicatePlatformClientError(`platform client '${org}/${slug}' already exists`);if(await readByClientId(client.spec?.clientId??"")!==void 0)throw new DuplicatePlatformClientError("a platform client already holds this client_id");await store.saveResource(KIND5,id,PlatformClientSchema,client)},async update(client){let id=client.metadata?.id??"";await readById(id)!==void 0&&await store.saveResource(KIND5,id,PlatformClientSchema,client)},async modifyById(id,modify){try{return await store.updateResource(KIND5,id,PlatformClientSchema,modify)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw error2}},async deleteById(id){await store.deleteResource(KIND5,id)},findById:readById,findByClientId:readByClientId,findByOrgAndSlug:readByOrgAndSlug,findByOrg:listOrg}}var file_ai_stigmer_iam_platformclient_v1_token=fileDesc("CixhaS9zdGlnbWVyL2lhbS9wbGF0Zm9ybWNsaWVudC92MS90b2tlbi5wcm90bxIgYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEiugEKFE1pbnRVc2VyVG9rZW5SZXF1ZXN0EhoKCWNsaWVudF9pZBgBIAEoCUIHukgEcgIQARIeCg1jbGllbnRfc2VjcmV0GAIgASgJQge6SARyAhABEhsKB3VzZXJfaWQYAyABKAlCCrpIB3IFEAEYgAISHAoKdXNlcl9lbWFpbBgEIAEoCUIIukgFcgMYwAISGwoJdXNlcl9uYW1lGAUgASgJQgi6SAVyAxiAAhIOCgZvcmdfaWQYBiABKAkiVQoVTWludFVzZXJUb2tlblJlc3BvbnNlEhQKDGFjY2Vzc190b2tlbhgBIAEoCRISCgp0b2tlbl90eXBlGAIgASgJEhIKCmV4cGlyZXNfaW4YAyABKAUiyQMKFU1pbnRHdWVzdFRva2VuUmVxdWVzdBIUCgNvcmcYASABKAlCB7pIBHICEAESFQoEc2x1ZxgCIAEoCUIHukgEcgIQARIXCg9ndWVzdF9jb29raWVfaWQYAyABKAkSywIKDGVtYmVkX29yaWdpbhgEIAEoCUK0ArpIsAK6AawCChNlbWJlZF9vcmlnaW4uZm9ybWF0EndlbWJlZF9vcmlnaW4gbXVzdCBiZSBlbXB0eSwgIm51bGwiLCBvciBhbiBleGFjdCB3ZWIgb3JpZ2luIGxpa2UgaHR0cHM6Ly9leGFtcGxlLmNvbSAobm8gcGF0aCwgcXVlcnksIG9yIHRyYWlsaW5nIHNsYXNoKRqbAXRoaXMgPT0gJycgfHwgdGhpcyA9PSAnbnVsbCcgfHwgdGhpcy5tYXRjaGVzKCdeaHR0cHM/Oi8vW0EtWmEtejAtOV0oW0EtWmEtejAtOS1dKltBLVphLXowLTldKT8oXFwuW0EtWmEtejAtOV0oW0EtWmEtejAtOS1dKltBLVphLXowLTldKT8pKig6WzAtOV17MSw1fSk/JCcpEhwKCmxpbmtfdG9rZW4YBSABKAlCCLpIBXIDGIABIm8KFk1pbnRHdWVzdFRva2VuUmVzcG9uc2USFAoMYWNjZXNzX3Rva2VuGAEgASgJEhIKCnRva2VuX3R5cGUYAiABKAkSEgoKZXhwaXJlc19pbhgDIAEoBRIXCg9ndWVzdF9jb29raWVfaWQYBCABKAkytAIKHVBsYXRmb3JtQ2xpZW50VG9rZW5Db250cm9sbGVyEoYBCg1taW50VXNlclRva2VuEjYuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuTWludFVzZXJUb2tlblJlcXVlc3QaNy5haS5zdGlnbWVyLmlhbS5wbGF0Zm9ybWNsaWVudC52MS5NaW50VXNlclRva2VuUmVzcG9uc2UiBMi4GAESiQEKDm1pbnRHdWVzdFRva2VuEjcuYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuTWludEd1ZXN0VG9rZW5SZXF1ZXN0GjguYWkuc3RpZ21lci5pYW0ucGxhdGZvcm1jbGllbnQudjEuTWludEd1ZXN0VG9rZW5SZXNwb25zZSIEyLgYAWIGcHJvdG8z",[file_ai_stigmer_commons_rpc_method_options,file_buf_validate_validate]);var MintUserTokenResponseSchema=messageDesc2(file_ai_stigmer_iam_platformclient_v1_token,1);var PlatformClientTokenController=serviceDesc(file_ai_stigmer_iam_platformclient_v1_token,0);var import_node_crypto22=require("node:crypto");var PLATFORM_TOKEN_KEY_ENV_VAR="STIGMER_PLATFORM_TOKEN_KEY",PLATFORM_TOKEN_KEY_FILE_NAME="platform-token.key",DEFAULT_PLATFORM_TOKEN_TTL_SECONDS=900,MIN_RSA_MODULUS_BITS=2048;function canSign(ring){return ring.signer!==void 0}function resolvePlatformTokenKeys(input){if(input.requireAuthentication){if(input.supplied!==void 0)return input.supplied;if(input.edition!==ServerEdition.oss)throw new Error(`the ${ServerEdition[input.edition]} edition requires authentication but registers no platform-token key ring \u2014 register drivers.platformTokenKeys; only open source generates its own key`);return openSourcePlatformTokenKeyRing(input.options)}}function openSourcePlatformTokenKeyRing(options={}){let privateKey=getOrCreateKey(RSA_PRIVATE_KEY,PLATFORM_TOKEN_KEY_ENV_VAR,PLATFORM_TOKEN_KEY_FILE_NAME,options);return{signer:{key:privateKey,kid:kidOf(privateKey)},verificationKeys:[(0,import_node_crypto22.createPublicKey)(privateKey)],audience:"",ttlSeconds:DEFAULT_PLATFORM_TOKEN_TTL_SECONDS}}var RSA_PRIVATE_KEY={fromEnv(envVar,decoded){let key=parseKey2(()=>(0,import_node_crypto22.createPrivateKey)(decoded.toString("utf8")),envVar);return requireRsa(key,envVar)},fromFile(content){try{let key=(0,import_node_crypto22.createPrivateKey)(content.toString("utf8"));return isUsableRsa(key)?key:void 0}catch{return}},generate(){return(0,import_node_crypto22.generateKeyPairSync)("rsa",{modulusLength:MIN_RSA_MODULUS_BITS}).privateKey},toFile(key){return Buffer.from(key.export({format:"pem",type:"pkcs8"}))}};function kidOf(key){let publicKey=key.type==="private"?(0,import_node_crypto22.createPublicKey)(key):key;return(0,import_node_crypto22.createHash)("sha256").update(spkiOf(publicKey)).digest("base64url").slice(0,16)}function spkiOf(publicKey){return publicKey.export({format:"der",type:"spki"})}function parseKey2(parse5,what){try{return parse5()}catch(error2){throw new Error(`${what} is not a readable PEM key: ${error2 instanceof Error?error2.message:String(error2)}`)}}function requireRsa(key,what){if(!isUsableRsa(key))throw new Error(`${what} must be an RSA key of at least ${MIN_RSA_MODULUS_BITS} bits`);return key}function isUsableRsa(key){return key.asymmetricKeyType==="rsa"&&(key.asymmetricKeyDetails?.modulusLength??0)>=MIN_RSA_MODULUS_BITS}var SUBJECT_SEPARATOR="|",DEFAULT_AUTO_GRANT_ROLE=IamRole.viewer;async function mintUserToken(deps,request){let keys=deps.keys;if(keys===void 0)throw new ConnectError(MINTING_REQUIRES_AUTHENTICATION_MESSAGE,Code.FailedPrecondition);if(!canSign(keys))throw new ConnectError(MINTING_DISABLED_MESSAGE,Code.FailedPrecondition);let client=await authenticateClient(deps,request),owningOrg=client.metadata?.org??"";if(request.orgId!==""&&request.orgId!==owningOrg)throw new ConnectError(organizationMismatchMessage(owningOrg),Code.InvalidArgument);let user={externalUserId:request.userId,email:request.userEmail,name:request.userName},accountId=await resolveOrProvisionAccount(deps,client,owningOrg,user),now=deps.now(),signed=signPlatformToken(keys,{[USER_TOKEN_CLAIMS.subject]:accountId,[USER_TOKEN_CLAIMS.externalUserId]:user.externalUserId,[USER_TOKEN_CLAIMS.email]:user.email,[USER_TOKEN_CLAIMS.name]:user.name,[USER_TOKEN_CLAIMS.org]:owningOrg,[USER_TOKEN_CLAIMS.platformClientId]:client.metadata?.id??""},{now});return await recordClientUse(deps,client,now),create2(MintUserTokenResponseSchema,{accessToken:signed.token,tokenType:BEARER_TOKEN_TYPE,expiresIn:keys.ttlSeconds})}async function authenticateClient(deps,request){let client;try{client=await deps.clients.findByClientId(request.clientId)}catch(error2){throw internalError(error2,"failed to authenticate platform client")}if(client===void 0||!secretMatchesHash(request.clientSecret,client.spec?.clientSecretHash??""))throw new ConnectError(INVALID_CLIENT_CREDENTIALS_MESSAGE,Code.Unauthenticated);let spec=client.spec;if(spec?.neverExpires!==!0&&spec?.expiresAt!==void 0&&deps.now().getTime()>timestampDate(spec.expiresAt).getTime())throw new ConnectError(EXPIRED_CLIENT_SECRET_MESSAGE,Code.FailedPrecondition);return client}function recordClientUse(deps,client,now){let id=client.metadata?.id??"";return recordCredentialUse({credential:"platform client",id,lastUsedAt:client.status?.lastUsedAt,now,logger:deps.logger,write:stamp2=>deps.clients.modifyById(id,live=>{live.status??=create2(PlatformClientStatusSchema),stamp2(live.status)})})}async function resolveOrProvisionAccount(deps,client,org,user){let idpId=platformClientSubject(org,user.externalUserId),existing=await findAccount(deps,idpId);if(existing!==void 0)return platformClientAccountId(existing,user,org);let spec=client.spec;if(spec?.autoProvisionAccounts!==!0)throw new ConnectError(noAccountMessage(user.externalUserId,org),Code.FailedPrecondition);let input=accountInput(idpId,org,user),actor=serverActingFor(client.metadata?.id??"");spec.autoGrantOnOrg&&await grantAutoRole(deps,client,org,accountIdFor(idpId),actor);try{return(await deps.createAccount(input,actor)).metadata?.id??""}catch(error2){let winner=await resolveCreateRace(error2,()=>deps.accounts.findByIdpId(idpId));return platformClientAccountId(winner,user,org)}}async function findAccount(deps,idpId){try{return await deps.accounts.findByIdpId(idpId)}catch(error2){throw internalError(error2,"failed to resolve platform client user")}}function platformClientAccountId(account2,user,org){if(account2.spec?.provisioningMode!==IdentityAccountProvisioningMode.platform_client)throw new ConnectError(foreignAccountMessage(user.externalUserId,org),Code.FailedPrecondition);return account2.metadata?.id??""}function accountInput(idpId,org,user){let input={name:user.email!==""?user.email:user.externalUserId,spec:create2(IdentityAccountSpecSchema,{idpId,email:user.email,...splitName(user.name,user.email)}),provisioning:{mode:"platform_client",org}},result=validator().validate(IdentityAccountSchema,create2(IdentityAccountSchema,{apiVersion:"iam.stigmer.ai/v1",kind:"IdentityAccount",metadata:{name:input.name,org},spec:input.spec}));if(result.kind==="invalid")throw new ConnectError(result.error.message,Code.InvalidArgument);if(result.kind==="error")throw new ConnectError(`validation could not run: ${result.error.message}`,Code.Internal);return input}async function grantAutoRole(deps,client,org,accountId,actor){let configured=client.spec?.autoGrantRole??IamRole.iam_role_unspecified;if(configured===IamRole.owner)throw new ConnectError(OWNER_AUTO_GRANT_MESSAGE,Code.InvalidArgument);let role=configured===IamRole.iam_role_unspecified?DEFAULT_AUTO_GRANT_ROLE:configured;try{await deps.grantPath.grant(organizationRole(accountId,role,org),actor)}catch(error2){throw deps.logger.error("platform client auto-grant failed; nothing was provisioned",{accountId,platformClientId:client.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)}),new ConnectError(PROVISIONING_FAILED_MESSAGE,Code.Internal)}}function platformClientSubject(org,externalUserId){return requireSubjectPart("org",org),requireSubjectPart("externalUserId",externalUserId),`${PLATFORM_CLIENT_SUBJECT_PREFIX}${org}${SUBJECT_SEPARATOR}${externalUserId}`}function requireSubjectPart(part,value){if(value.trim()==="")throw new ConnectError(blankSubjectPartMessage(part),Code.InvalidArgument);if(value.includes(SUBJECT_SEPARATOR))throw new ConnectError(subjectSeparatorMessage(part,value),Code.InvalidArgument)}function splitName(name,email){if(name!==""){let space=name.indexOf(" ");return space>0?{firstName:name.slice(0,space),lastName:name.slice(space+1)}:{firstName:name,lastName:""}}let at2=email.indexOf("@");return{firstName:at2>=0?email.slice(0,at2):email,lastName:""}}function registerPlatformClientTokenService(router,deps){router.service(PlatformClientTokenController,{mintUserToken:request=>mintUserToken(deps.mint,request),mintGuestToken:(request,ctx)=>{if(deps.guestTokenMinting===void 0)throw new ConnectError(GUEST_MINT_UNIMPLEMENTED_MESSAGE,Code.Unimplemented);return deps.guestTokenMinting.mintGuestToken(request,ctx.requestHeader)}})}function newPlatformClientTokenVerifier(deps){return{name:"platform-client",async verify(token){let result=verifyPlatformToken(deps.keys,token,deps.now?.());switch(result.outcome){case"foreign":return null;case"refused":throw platformTokenRefusalError(result.refusal);case"verified":break;default:{let exhaustive=result;throw new Error(`unknown verification ${JSON.stringify(exhaustive)}`)}}let verified=result.token;if(verified.tokenType!==void 0)return null;let platformClientId=stringClaim(verified.payload,USER_TOKEN_CLAIMS.platformClientId);if(platformClientId===void 0)throw new ConnectError(TOKEN_NAMES_NO_CLIENT_MESSAGE,Code.Unauthenticated);if(await deps.clients.findById(platformClientId)===void 0)throw new ConnectError(DELETED_CLIENT_MESSAGE,Code.Unauthenticated);let email=stringClaim(verified.payload,USER_TOKEN_CLAIMS.email),displayName=stringClaim(verified.payload,USER_TOKEN_CLAIMS.name);return{identityId:verified.subject,callerClass:"user",issuer:PLATFORM_TOKEN_ISSUER,rawToken:token,...email!==void 0?{email}:{},...displayName!==void 0?{displayName}:{},platformClientId}}}}var file_ai_stigmer_tenancy_organization_v1_io=fileDesc("CithaS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL2lvLnByb3RvEiJhaS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxIlIKDU9yZ2FuaXphdGlvbnMSQQoHZW50cmllcxgBIAMoCzIwLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uImoKEE9yZ2FuaXphdGlvbkxpc3QSEwoLdG90YWxfcGFnZXMYASABKAUSQQoHZW50cmllcxgCIAMoCzIwLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uIioKDk9yZ2FuaXphdGlvbklkEhgKBXZhbHVlGAEgASgJQgm6SAZyBBABGEAimwEKGk9yZ2FuaXphdGlvbkV4dGVybmFsTG9va3VwElsKFWlkZW50aXR5X3Byb3ZpZGVyX3JlZhgBIAEoCzI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZUIGukgDyAEBEiAKD2V4dGVybmFsX29yZ19pZBgCIAEoCUIHukgEcgIQAWIGcHJvdG8z",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_tenancy_organization_v1_api,file_buf_validate_validate]),OrganizationsSchema=messageDesc2(file_ai_stigmer_tenancy_organization_v1_io,0),OrganizationListSchema=messageDesc2(file_ai_stigmer_tenancy_organization_v1_io,1);var file_ai_stigmer_tenancy_organization_v1_command=fileDesc("CjBhaS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL2NvbW1hbmQucHJvdG8SImFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEy2AQKHU9yZ2FuaXphdGlvbkNvbW1hbmRDb250cm9sbGVyEmsKBWFwcGx5EjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24aMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhJyCgZjcmVhdGUSMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhowLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uIgTQuBgBEqgBCgZ1cGRhdGUSMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbhowLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uIjrCuBg2CAIQHiILbWV0YWRhdGEuaWQqI3VuYXV0aG9yaXplZCB0byB1cGRhdGUgb3JnYW5pemF0aW9uEqQBCgZkZWxldGUSMi5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbklkGjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24iNMK4GDAIAxAeIgV2YWx1ZSojdW5hdXRob3JpemVkIHRvIGRlbGV0ZSBvcmdhbml6YXRpb24aBKD/Kx5iBnByb3RvMw",[file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_tenancy_organization_v1_api,file_ai_stigmer_tenancy_organization_v1_io]),OrganizationCommandController=serviceDesc(file_ai_stigmer_tenancy_organization_v1_command,0);var file_ai_stigmer_tenancy_organization_v1_query=fileDesc("Ci5haS9zdGlnbWVyL3RlbmFuY3kvb3JnYW5pemF0aW9uL3YxL3F1ZXJ5LnByb3RvEiJhaS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxMrkEChtPcmdhbml6YXRpb25RdWVyeUNvbnRyb2xsZXISnwEKA2dldBIyLmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uSWQaMC5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbiIywrgYLggBEB4iBXZhbHVlKiF1bmF1dGhvcml6ZWQgdG8gdmlldyBvcmdhbml6YXRpb24SewoEZmluZBI3LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5GaW5kQXBpUmVzb3VyY2VzUmVxdWVzdBo0LmFpLnN0aWdtZXIudGVuYW5jeS5vcmdhbml6YXRpb24udjEuT3JnYW5pemF0aW9uTGlzdCIE0LgYARJmChNmaW5kTXlPcmdhbml6YXRpb25zEhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5GjEuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb25zIgTQuBgBEowBChJnZXRCeUV4dGVybmFsT3JnSWQSPi5haS5zdGlnbWVyLnRlbmFuY3kub3JnYW5pemF0aW9uLnYxLk9yZ2FuaXphdGlvbkV4dGVybmFsTG9va3VwGjAuYWkuc3RpZ21lci50ZW5hbmN5Lm9yZ2FuaXphdGlvbi52MS5Pcmdhbml6YXRpb24iBNC4GAEaBKD/Kx5iBnByb3RvMw",[file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options,file_ai_stigmer_tenancy_organization_v1_api,file_ai_stigmer_tenancy_organization_v1_io,file_google_protobuf_empty]),OrganizationQueryController=serviceDesc(file_ai_stigmer_tenancy_organization_v1_query,0);var organizationSearchExtractor={kind:ApiResourceKind.organization,schema:OrganizationSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let org=resource;return buildSearchResult({kind:ApiResourceKind.organization,metadata:org.metadata,summary:org.spec?.description??"",score,createdAt:org.status?.audit?.specAudit?.createdAt,updatedAt:org.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let org=resource,metadata=org.metadata;if(metadata!==void 0)return{name:metadata.name,description:org.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(org.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};function newCheckOrgDuplicateStep(store){return{name:"CheckDuplicate",async execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("organization metadata is nil"),"duplicate check");if(metadata.slug==="")throw internalError(new Error("organization slug is empty"),"duplicate check");try{await store.getResource(ctx.apiResourceKind,metadata.slug,OrganizationSchema)}catch(error2){if(error2 instanceof ResourceNotFoundError)return;throw internalError(error2,"failed to check for duplicate organization")}throw alreadyExistsError("Organization",`slug '${metadata.slug}'`)}}}function newCopySlugToIdStep(){return{name:"CopySlugToId",execute(ctx){let metadata=metadataOf(ctx.newState);if(metadata===void 0)throw internalError(new Error("organization metadata is nil"),"copy slug to id");if(metadata.slug==="")throw internalError(new Error("organization slug is empty"),"copy slug to id");metadata.id=metadata.slug}}}function newRevokeOrganizationPoliciesStep(grantPath){return{name:"RevokeOrganizationPolicies",async execute(ctx){let id=ctx.get(EXISTING_RESOURCE_KEY)?.metadata?.id??"";if(id==="")throw internalError(new Error("organization delete reached RevokeOrganizationPolicies without its loaded row"),"failed to remove the organization's access policies");try{await grantPath.cleanupResource(create2(ApiResourceRefSchema,{kind:ApiResourceKind[ApiResourceKind.organization],id}))}catch(error2){throw internalError(error2,"failed to remove the organization's access policies")}}}}function registerOrganizationServices(router,deps){router.service(OrganizationCommandController,{apply:(org,ctx)=>apply10(deps,org,ctx),create:(org,ctx)=>createOrganization(deps,org,ctx),update:(org,ctx)=>update13(deps,org,ctx),delete:(orgId,ctx)=>deleteOrganization(deps,orgId,ctx)});let externalLookup=deps.organizationDirectory?.lookupExternalOrganization?.bind(deps.organizationDirectory);router.service(OrganizationQueryController,{get:(orgId,ctx)=>get18(deps,orgId,ctx),find:(req,ctx)=>find(deps,req,ctx),findMyOrganizations:(_,ctx)=>findMyOrganizations(deps,ctx),...externalLookup===void 0?{}:{getByExternalOrgId:(lookup3,ctx)=>getByExternalOrgId(deps,externalLookup,lookup3,ctx)}})}function kindOf17(ctx){return ctx.values.get(apiResourceKindKey)}async function createOrganization(deps,org,ctx){let reqCtx=new RequestContext(OrganizationSchema,org,callerIdentityOf(ctx),kindOf17(ctx)),builder2=newPipeline("organization-create",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.create,deps.authorizer)).addStep(newResolveSlugStep()).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newCheckOrgDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newCopySlugToIdStep());for(let step of stepsForSlot(deps.gateSteps,"org-create:pre-side-effect-gate"))builder2.addStep(step);builder2.addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger));for(let step of stepsForSlot(deps.gateSteps,"org-create:post-persist"))builder2.addStep(step);return await builder2.addStep(newIndexSearchStep(deps.store,organizationSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update13(deps,org,ctx){let reqCtx=new RequestContext(OrganizationSchema,org,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("organization-update",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,organizationSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply10(deps,org,ctx){let reqCtx=new RequestContext(OrganizationSchema,org,callerIdentityOf(ctx),kindOf17(ctx));await newPipeline("organization-apply",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createOrganization(deps,org,ctx):update13(deps,withResolvedApplyId(OrganizationSchema,org,reqCtx),ctx)}async function deleteOrganization(deps,orgId,ctx){let reqCtx=new RequestContext(OrganizationCommandController.method.delete.input,orgId,callerIdentityOf(ctx),kindOf17(ctx)),builder2=newPipeline("organization-delete",deps.logger).addStep(newAuthorizeStep(OrganizationCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,OrganizationSchema));for(let step of stepsForSlot(deps.gateSteps,"org-delete:pre-delete"))builder2.addStep(step);await builder2.addStep(newRevokeOrganizationPoliciesStep(deps.grantPath)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted organization not found in context"),"delete operation lost its loaded resource");return deleted}async function get18(deps,orgId,ctx){let reqCtx=new RequestContext(OrganizationQueryController.method.get.input,orgId,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("organization-get",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,OrganizationSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}var FIND_RESULT_KEY="findResult";async function find(deps,req,ctx){if(deps.organizationDirectory?.refusesEnumeration===!0)throw new ConnectError("ai.stigmer.tenancy.organization.v1.OrganizationQueryController.find is not implemented",Code.Unimplemented);let reqCtx=new RequestContext(OrganizationQueryController.method.find.input,req,callerIdentityOf(ctx),kindOf17(ctx));return await newPipeline("organization-find",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.find,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListAllOrganizationsStep(deps.store)).build().execute(reqCtx),reqCtx.get(FIND_RESULT_KEY)}function newListAllOrganizationsStep(store){return{name:"ListAllOrganizations",async execute(ctx){let data;try{data=await store.listResources(ctx.apiResourceKind)}catch(error2){throw internalError(error2,"failed to list organizations")}let orgs=[];for(let bytes of data)try{orgs.push(fromBinary2(OrganizationSchema,bytes))}catch{continue}let req=ctx.input,pageSize=req.pageSize,pageNumber=req.pageNumber;req.page!==void 0&&(req.page.size>0&&(pageSize=req.page.size),req.page.num>0&&(pageNumber=req.page.num)),pageSize<=0&&(pageSize=20),pageSize>100&&(pageSize=100),pageNumber<=0&&(pageNumber=1);let totalPages=Math.ceil(orgs.length/pageSize),start=(pageNumber-1)*pageSize,entries=start>=orgs.length?[]:orgs.slice(start,start+pageSize);ctx.set(FIND_RESULT_KEY,create2(OrganizationListSchema,{totalPages,entries}))}}}async function findMyOrganizations(deps,ctx){let directory=deps.organizationDirectory;if(directory!==void 0){let authorized=await directory.listMyOrganizationIds(callerIdentityOf(ctx));if(authorized!=="all"){let entries2=[];for(let id of authorized)try{entries2.push(await deps.store.getResource(ApiResourceKind.organization,id,OrganizationSchema))}catch(error2){if(error2 instanceof ResourceNotFoundError)continue;throw internalError(error2,"failed to list organizations")}return create2(OrganizationsSchema,{entries:entries2})}}let data;try{data=await deps.store.listResources(ApiResourceKind.organization)}catch(error2){throw internalError(error2,"failed to list organizations")}let entries=[];for(let bytes of data)try{entries.push(fromBinary2(OrganizationSchema,bytes))}catch{continue}return create2(OrganizationsSchema,{entries})}async function getByExternalOrgId(deps,lookup3,input,ctx){let reqCtx=new RequestContext(OrganizationQueryController.method.getByExternalOrgId.input,input,callerIdentityOf(ctx),kindOf17(ctx));if(await newPipeline("organization-get-by-external-org-id",deps.logger).addStep(newAuthorizeStep(OrganizationQueryController.method.getByExternalOrgId,deps.authorizer)).addStep(newValidateProtoStep()).build().execute(reqCtx),input.externalOrgId==="")throw invalidArgumentError("external_org_id is required");let found=await lookup3({org:input.identityProviderRef?.org??"",slug:input.identityProviderRef?.slug??""},input.externalOrgId);if(found.kind==="no-identity-provider")throw notFoundError("Organization",input.externalOrgId);await authorizeResolvedResource(deps.authorizer,reqCtx.callerIdentity,{permission:IamPermission.can_view,resourceKind:ApiResourceKind.identity_provider,resourceId:found.identityProviderId},EXTERNAL_LOOKUP_DENIED_MESSAGE);let orgId=found.organizationId;if(orgId===void 0)throw notFoundError("Organization",input.externalOrgId);try{return await deps.store.getResource(ApiResourceKind.organization,orgId,OrganizationSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("Organization",input.externalOrgId):internalError(error2,"failed to load organization")}}var EXTERNAL_LOOKUP_DENIED_MESSAGE="unauthorized to view identity provider";var file_ai_stigmer_agentic_mcpserver_v1_io=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL2lvLnByb3RvEh9haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxIiQKC01jcFNlcnZlcklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiggIKDENvbm5lY3RJbnB1dBIdCg1tY3Bfc2VydmVyX2lkGAEgASgJQga6SAPIAQESUgoLcnVudGltZV9lbnYYAiADKAsyPS5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkNvbm5lY3RJbnB1dC5SdW50aW1lRW52RW50cnkSFAoDb3JnGAMgASgJQge6SARyAhABGmkKD1J1bnRpbWVFbnZFbnRyeRILCgNrZXkYASABKAkSRQoFdmFsdWUYAiABKAsyNi5haS5zdGlnbWVyLmFnZW50aWMuZXhlY3V0aW9uY29udGV4dC52MS5FeGVjdXRpb25WYWx1ZToCOAEiUAoZSW5pdGlhdGVPQXV0aENvbm5lY3RJbnB1dBIdCg1tY3Bfc2VydmVyX2lkGAEgASgJQga6SAPIAQESFAoDb3JnGAIgASgJQge6SARyAhABIm0KGkluaXRpYXRlT0F1dGhDb25uZWN0T3V0cHV0EhkKEWF1dGhvcml6YXRpb25fdXJsGAEgASgJEg0KBXN0YXRlGAIgASgJEg4KBnNjb3BlcxgDIAMoCRIVCg1wcm92aWRlcl9uYW1lGAQgASgJIncKGUNvbXBsZXRlT0F1dGhDb25uZWN0SW5wdXQSHQoNbWNwX3NlcnZlcl9pZBgBIAEoCUIGukgDyAEBEiMKEmF1dGhvcml6YXRpb25fY29kZRgCIAEoCUIHukgEcgIQARIWCgVzdGF0ZRgDIAEoCUIHukgEcgIQASJkChpDb21wbGV0ZU9BdXRoQ29ubmVjdE91dHB1dBIRCgljb25uZWN0ZWQYASABKAgSFgoOdGFyZ2V0X2Vudl92YXIYAiABKAkSGwoTdG9rZW5fbGlmZXRpbWVfaGludBgDIAEoCSJNChhHZXRPQXV0aEdyYW50U3RhdHVzSW5wdXQSGwoLcmVzb3VyY2VfaWQYASABKAlCBrpIA8gBARIUCgNvcmcYAiABKAlCB7pIBHICEAEizwEKGUdldE9BdXRoR3JhbnRTdGF0dXNPdXRwdXQSEQoJY29ubmVjdGVkGAEgASgIEh8KF2FjY2Vzc190b2tlbl9leHBpcmVzX2F0GAIgASgDEhYKDnRhcmdldF9lbnZfdmFyGAMgASgJEhMKC2F1dGhfbWV0aG9kGAQgASgJElEKEWNvbm5lY3Rpb25faGVhbHRoGAUgASgOMjYuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5PQXV0aENvbm5lY3Rpb25IZWFsdGgiSQoURGlzY29ubmVjdE9BdXRoSW5wdXQSGwoLcmVzb3VyY2VfaWQYASABKAlCBrpIA8gBARIUCgNvcmcYAiABKAlCB7pIBHICEAEiLQoVRGlzY29ubmVjdE9BdXRoT3V0cHV0EhQKDGRpc2Nvbm5lY3RlZBgBIAEoCCKEAQoTU2V0T3JnT0F1dGhBcHBJbnB1dBIbCgtyZXNvdXJjZV9pZBgBIAEoCUIGukgDyAEBEhQKA29yZxgCIAEoCUIHukgEcgIQARIaCgljbGllbnRfaWQYAyABKAlCB7pIBHICEAESHgoNY2xpZW50X3NlY3JldBgEIAEoCUIHukgEcgIQASIsChRTZXRPcmdPQXV0aEFwcE91dHB1dBIUCgxvYXV0aF9hcHBfaWQYASABKAkiSAoTR2V0T3JnT0F1dGhBcHBJbnB1dBIbCgtyZXNvdXJjZV9pZBgBIAEoCUIGukgDyAEBEhQKA29yZxgCIAEoCUIHukgEcgIQASJVChRHZXRPcmdPQXV0aEFwcE91dHB1dBIUCgxoYXNfb3ZlcnJpZGUYASABKAgSFAoMb2F1dGhfYXBwX2lkGAIgASgJEhEKCWNsaWVudF9pZBgDIAEoCSJLChZEZWxldGVPcmdPQXV0aEFwcElucHV0EhsKC3Jlc291cmNlX2lkGAEgASgJQga6SAPIAQESFAoDb3JnGAIgASgJQge6SARyAhABIioKF0RlbGV0ZU9yZ09BdXRoQXBwT3V0cHV0Eg8KB2RlbGV0ZWQYASABKAgq7QEKFU9BdXRoQ29ubmVjdGlvbkhlYWx0aBInCiNPQVVUSF9DT05ORUNUSU9OX0hFQUxUSF9VTlNQRUNJRklFRBAAEiMKH09BVVRIX0NPTk5FQ1RJT05fSEVBTFRIX0hFQUxUSFkQARIpCiVPQVVUSF9DT05ORUNUSU9OX0hFQUxUSF9UT0tFTl9FWFBJUkVEEAISNQoxT0FVVEhfQ09OTkVDVElPTl9IRUFMVEhfVE9LRU5fRVhQSVJFRF9SRUZSRVNIQUJMRRADEiQKIE9BVVRIX0NPTk5FQ1RJT05fSEVBTFRIX05PX0dSQU5UEARiBnByb3RvMw",[file_ai_stigmer_agentic_executioncontext_v1_spec,file_buf_validate_validate]);var InitiateOAuthConnectOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,3);var CompleteOAuthConnectOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,5);var GetOAuthGrantStatusOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,7);var DisconnectOAuthOutputSchema=messageDesc2(file_ai_stigmer_agentic_mcpserver_v1_io,9);var OAuthConnectionHealth;(function(OAuthConnectionHealth2){OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_UNSPECIFIED=0]="OAUTH_CONNECTION_HEALTH_UNSPECIFIED",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_HEALTHY=1]="OAUTH_CONNECTION_HEALTH_HEALTHY",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED=2]="OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED_REFRESHABLE=3]="OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED_REFRESHABLE",OAuthConnectionHealth2[OAuthConnectionHealth2.OAUTH_CONNECTION_HEALTH_NO_GRANT=4]="OAUTH_CONNECTION_HEALTH_NO_GRANT"})(OAuthConnectionHealth||(OAuthConnectionHealth={}));var file_ai_stigmer_agentic_mcpserver_v1_command=fileDesc("Ci1haS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL2NvbW1hbmQucHJvdG8SH2FpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEynREKGk1jcFNlcnZlckNvbW1hbmRDb250cm9sbGVyEl8KBWFwcGx5EiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchKwAQoGY3JlYXRlEiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciJOwrgYSggrEB4iDG1ldGFkYXRhLm9yZyo2dW5hdXRob3JpemVkIHRvIGNyZWF0ZSBtY3Agc2VydmVyIGluIHRoaXMgb3JnYW5pemF0aW9uEpoBCgZ1cGRhdGUSKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlchoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIjjCuBg0CAIQLCILbWV0YWRhdGEuaWQqIXVuYXV0aG9yaXplZCB0byB1cGRhdGUgbWNwIHNlcnZlchKmAQoGZGVsZXRlEjYuYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLkFwaVJlc291cmNlRGVsZXRlSW5wdXQaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciI4wrgYNAgDECwiC3Jlc291cmNlX2lkKiF1bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG1jcCBzZXJ2ZXISugEKEHVwZGF0ZVZpc2liaWxpdHkSNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuVXBkYXRlVmlzaWJpbGl0eUlucHV0GiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIiQ8K4GD8IAhAsIgtyZXNvdXJjZV9pZCosdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBtY3Agc2VydmVyIHZpc2liaWxpdHkSpAEKB2Nvbm5lY3QSLS5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkNvbm5lY3RJbnB1dBoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIj7CuBg6CBYQLCINbWNwX3NlcnZlcl9pZColdW5hdXRob3JpemVkIHRvIGNvbm5lY3QgdG8gbWNwIHNlcnZlchKpAQoMc3RhcnRDb25uZWN0Ei0uYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Db25uZWN0SW5wdXQaKi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLk1jcFNlcnZlciI+wrgYOggWECwiDW1jcF9zZXJ2ZXJfaWQqJXVuYXV0aG9yaXplZCB0byBjb25uZWN0IHRvIG1jcCBzZXJ2ZXIS3wEKFGluaXRpYXRlT0F1dGhDb25uZWN0EjouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Jbml0aWF0ZU9BdXRoQ29ubmVjdElucHV0GjsuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5Jbml0aWF0ZU9BdXRoQ29ubmVjdE91dHB1dCJOwrgYSggWECwiDW1jcF9zZXJ2ZXJfaWQqNXVuYXV0aG9yaXplZCB0byBpbml0aWF0ZSBvYXV0aCBjb25uZWN0IGZvciBtY3Agc2VydmVyEt8BChRjb21wbGV0ZU9BdXRoQ29ubmVjdBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuQ29tcGxldGVPQXV0aENvbm5lY3RJbnB1dBo7LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuQ29tcGxldGVPQXV0aENvbm5lY3RPdXRwdXQiTsK4GEoIFhAsIg1tY3Bfc2VydmVyX2lkKjV1bmF1dGhvcml6ZWQgdG8gY29tcGxldGUgb2F1dGggY29ubmVjdCBmb3IgbWNwIHNlcnZlchLIAQoPZGlzY29ubmVjdE9BdXRoEjUuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5EaXNjb25uZWN0T0F1dGhJbnB1dBo2LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuRGlzY29ubmVjdE9BdXRoT3V0cHV0IkbCuBhCCBYQLCILcmVzb3VyY2VfaWQqL3VuYXV0aG9yaXplZCB0byBkaXNjb25uZWN0IG9hdXRoIGZvciBtY3Agc2VydmVyErgBCg5zZXRPcmdPQXV0aEFwcBI0LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuU2V0T3JnT0F1dGhBcHBJbnB1dBo1LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuU2V0T3JnT0F1dGhBcHBPdXRwdXQiOcK4GDUIFxAeIgNvcmcqKnVuYXV0aG9yaXplZCB0byBzZXQgb3JnIG9hdXRoIGFwcCBvdmVycmlkZRLEAQoRZGVsZXRlT3JnT0F1dGhBcHASNy5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkRlbGV0ZU9yZ09BdXRoQXBwSW5wdXQaOC5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkRlbGV0ZU9yZ09BdXRoQXBwT3V0cHV0IjzCuBg4CBcQHiIDb3JnKi11bmF1dGhvcml6ZWQgdG8gZGVsZXRlIG9yZyBvYXV0aCBhcHAgb3ZlcnJpZGUaBKD/KyxiBnByb3RvMw",[file_ai_stigmer_agentic_mcpserver_v1_api,file_ai_stigmer_agentic_mcpserver_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),McpServerCommandController=serviceDesc(file_ai_stigmer_agentic_mcpserver_v1_command,0);var file_ai_stigmer_agentic_mcpserver_v1_query=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvbWNwc2VydmVyL3YxL3F1ZXJ5LnByb3RvEh9haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxMssFChhNY3BTZXJ2ZXJRdWVyeUNvbnRyb2xsZXISkgEKA2dldBItLmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUlkGiouYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5NY3BTZXJ2ZXIiMMK4GCwIARAsIgV2YWx1ZSofdW5hdXRob3JpemVkIHRvIHZpZXcgbWNwIHNlcnZlchJ4Cg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRoqLmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuTWNwU2VydmVyIgTQuBgBEtUBChNnZXRPQXV0aEdyYW50U3RhdHVzEjkuYWkuc3RpZ21lci5hZ2VudGljLm1jcHNlcnZlci52MS5HZXRPQXV0aEdyYW50U3RhdHVzSW5wdXQaOi5haS5zdGlnbWVyLmFnZW50aWMubWNwc2VydmVyLnYxLkdldE9BdXRoR3JhbnRTdGF0dXNPdXRwdXQiR8K4GEMIARAsIgtyZXNvdXJjZV9pZCowdW5hdXRob3JpemVkIHRvIHZpZXcgb2F1dGggc3RhdHVzIGZvciBtY3Agc2VydmVyEsEBCg5nZXRPcmdPQXV0aEFwcBI0LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuR2V0T3JnT0F1dGhBcHBJbnB1dBo1LmFpLnN0aWdtZXIuYWdlbnRpYy5tY3BzZXJ2ZXIudjEuR2V0T3JnT0F1dGhBcHBPdXRwdXQiQsK4GD4IARAsIgtyZXNvdXJjZV9pZCordW5hdXRob3JpemVkIHRvIHZpZXcgb3JnIG9hdXRoIGFwcCBvdmVycmlkZRoEoP8rLGIGcHJvdG8z",[file_ai_stigmer_agentic_mcpserver_v1_api,file_ai_stigmer_agentic_mcpserver_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),McpServerQueryController=serviceDesc(file_ai_stigmer_agentic_mcpserver_v1_query,0);async function completeOAuthConnect(deps,input,identity2){let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");let stateParam=input.state;if(stateParam==="")throw invalidArgumentError("state is required");let code=input.authorizationCode;if(code==="")throw invalidArgumentError("authorization_code is required");let pendingState;try{pendingState=await deps.pendingOAuthStates.getAndDelete(stateParam)}catch(error2){throw internalError(error2,"failed to load pending OAuth state")}if(pendingState===void 0)throw failedPreconditionError("no pending OAuth state found for the given state parameter (expired or already used)");if(pendingState.mcpServerId!==mcpServerId)throw failedPreconditionError("state parameter does not match the requested mcp_server_id");await authorizeDirect(McpServerCommandController.method.completeOAuthConnect,deps.authorizer,identity2,input,{resourceId:pendingState.mcpServerId});try{pendingState=await unsealPendingOAuthState(deps.secretService,pendingState)}catch(error2){throw deps.logger.error("Failed to decrypt pending OAuth state secrets",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to decrypt OAuth handshake secrets \u2014 please retry the connect flow")}let tokenResponse;try{tokenResponse=await exchangeCode(pendingState.tokenEndpoint,code,pendingState.redirectUri,pendingState.codeVerifier,pendingState.clientId,pendingState.clientSecret,pendingState.tokenAuthMethod,deps.outboundFetch)}catch(error2){throw unavailableError(`token exchange failed: ${error2 instanceof Error?error2.message:String(error2)}`)}let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}let org=pendingState.org;org===""&&(org=mcpServer.metadata?.org??"");let managedEnvId=await resolveOrCreateManagedEnvironment(deps,pendingState.identityAccountId,mcpServerId,org,mcpServer.metadata?.name??"",identity2),tokenVars={[pendingState.targetEnvVar]:create2(EnvironmentValueSchema,{value:tokenResponse.accessToken,isSecret:!0})},refreshTokenEnvVar=`${pendingState.targetEnvVar}_REFRESH_TOKEN`;tokenResponse.refreshToken!==""&&(tokenVars[refreshTokenEnvVar]=create2(EnvironmentValueSchema,{value:tokenResponse.refreshToken,isSecret:!0}));try{await deps.managedEnv.updateSecrets(managedEnvId,tokenVars)}catch(error2){throw internalError(error2,"failed to store OAuth tokens in managed environment")}let expiresAt=0;tokenResponse.expiresIn>0&&(expiresAt=Math.floor(Date.now()/1e3)+tokenResponse.expiresIn);try{await deps.oauthGrants.upsert({identityAccountId:pendingState.identityAccountId,resourceId:mcpServerId,resourceKind:"mcp_server",orgId:org,accessTokenExpiresAt:expiresAt,clientId:pendingState.clientId,authMethod:pendingState.authMethod,tokenEndpoint:pendingState.tokenEndpoint,accessTokenEnvVar:pendingState.targetEnvVar,refreshTokenEnvVar,environmentId:managedEnvId,createdAt:0,updatedAt:0})}catch(error2){throw internalError(error2,"failed to create OAuth grant record")}let auth=mcpServer.spec?.auth;return deps.logger.info("OAuth Connect completed: tokens stored in managed environment",{mcp_server_id:mcpServerId,auth_method:pendingState.authMethod,target_env_var:pendingState.targetEnvVar,managed_env_id:managedEnvId,expires_at:expiresAt,has_refresh_token:tokenResponse.refreshToken!==""}),create2(CompleteOAuthConnectOutputSchema,{connected:!0,targetEnvVar:pendingState.targetEnvVar,tokenLifetimeHint:auth?.tokenLifetimeHint??""})}async function unsealPendingOAuthState(secretService,state2){let verifier;try{verifier=await secretService.decrypt(state2.codeVerifier)}catch(error2){throw new Error(`failed to decrypt code_verifier: ${error2 instanceof Error?error2.message:String(error2)}`)}let secret;try{secret=await secretService.decrypt(state2.clientSecret)}catch(error2){throw new Error(`failed to decrypt client_secret: ${error2 instanceof Error?error2.message:String(error2)}`)}return{...state2,codeVerifier:verifier,clientSecret:secret}}async function resolveOrCreateManagedEnvironment(deps,identityAccountId,mcpServerId,org,mcpServerName,caller){let existingGrant;try{existingGrant=await deps.oauthGrants.find(identityAccountId,mcpServerId,org)}catch(error2){deps.logger.warn("Failed to look up existing OAuth grant (non-fatal, will create new managed env)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}if(existingGrant!==void 0&&existingGrant.environmentId!=="")return deps.logger.info("Reusing existing managed environment for OAuth re-connect",{mcp_server_id:mcpServerId,environment_id:existingGrant.environmentId}),existingGrant.environmentId;let envName=`OAuth: ${mcpServerName}`;try{return await deps.managedEnv.createManagedEnvironment(envName,org,caller)}catch(error2){throw internalError(error2,"failed to create managed environment for OAuth tokens")}}function convertToDiscoveredCapabilities(output){let capabilities=create2(DiscoveredCapabilitiesSchema,{lastDiscoveredAt:timestampNow()});for(let t of output.tools??[]){let tool=create2(DiscoveredToolSchema,{name:t.name??"",description:t.description??""});t.input_schema!==void 0&&(tool.inputSchema=t.input_schema),capabilities.tools.push(tool)}for(let rt of output.resource_templates??[])capabilities.resourceTemplates.push(create2(DiscoveredResourceTemplateSchema,{uriTemplate:rt.uri_template??"",name:rt.name??"",description:rt.description??"",mimeType:rt.mime_type??""}));return capabilities}function convertToToolApprovals(output){let approvals=[];for(let a5 of output.tool_approvals??[])a5.requires_approval!==!0||(a5.tool_name??"")===""||approvals.push(create2(ToolApprovalPolicySchema,{toolName:a5.tool_name,message:a5.message??"",fromDestructiveHint:a5.from_destructive_hint??!1}));return approvals}function setToolApprovalsFromConnect(status,output){let approvals=convertToToolApprovals(output);return approvals.length>0&&(status.toolApprovals=approvals),approvals.length}function settleConnectStatus(mcpStatus,workflowId,failure){let cs=mcpStatus.connectStatus;if(cs===void 0&&(cs=create2(ConnectStatusSchema),mcpStatus.connectStatus=cs),cs.workflowId=workflowId,cs.finishedAt=timestampNow(),cs.warning="",failure===void 0){cs.phase=ConnectPhase.succeeded,cs.failureCode="",cs.failureMessage="";return}cs.phase=ConnectPhase.failed,cs.failureCode=grpcCodeName(failure.code),cs.failureMessage=failure.rawMessage}async function persistConnectResult(store,mcpServerId,workflowId,output){let toolApprovalCount=0;return{persisted:await store.updateResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema,mcpServer=>{mcpServer.status===void 0&&(mcpServer.status=create2(McpServerStatusSchema)),mcpServer.status.discoveredCapabilities=convertToDiscoveredCapabilities(output),toolApprovalCount=setToolApprovalsFromConnect(mcpServer.status,output),settleConnectStatus(mcpServer.status,workflowId,void 0)}),toolApprovalCount}}async function persistConnectStarting(store,mcpServerId,workflowId,warning2){return store.updateResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema,mcpServer=>{mcpServer.status===void 0&&(mcpServer.status=create2(McpServerStatusSchema)),mcpServer.status.connectStatus=create2(ConnectStatusSchema,{phase:ConnectPhase.connecting,workflowId,startedAt:timestampNow(),warning:warning2})})}async function persistConnectFailure(store,logger2,mcpServerId,failure){try{await store.updateResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema,mcpServer=>{mcpServer.status===void 0&&(mcpServer.status=create2(McpServerStatusSchema)),settleConnectStatus(mcpServer.status,mcpServer.status.connectStatus?.workflowId??"",failure)})}catch(error2){if(error2 instanceof ResourceNotFoundError){logger2.info("Skipping connect failure persistence: MCP server deleted before connect settled",{mcp_server_id:mcpServerId});return}logger2.warn("Failed to record connect failure on connect_status (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}}var CONNECT_TIMEOUT={ms:42e4,goLabel:"7m0s"},ASYNC_CONNECT_TIMEOUT={ms:3600*1e3,goLabel:"1h0m0s"},BEST_EFFORT_CONNECT_GET_BUFFER_MS=15e3;async function connect(deps,input,identity2){let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");if(input.org==="")throw invalidArgumentError("org is required for connect");let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}await authorizeDirect(McpServerCommandController.method.connect,deps.authorizer,identity2,input);let engineState=deps.engineState();if(!engineState.connected)throw failedPreconditionError("connect is not available: Temporal not configured");let prepared=await prepareConnect(deps,mcpServer,input,identity2);try{let run;try{run=await engineState.engine.startOrAttachConnect(mcpServerId,prepared.workflowInput,CONNECT_TIMEOUT.ms)}catch(error2){throw deps.logger.error("Failed to start MCP connect workflow",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to start connect workflow")}if(!run.attached)try{await persistConnectStarting(deps.store,mcpServerId,run.workflowId,"")}catch(error2){deps.logger.warn("Failed to record CONNECTING on connect_status (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}let outcome=await run.result(CONNECT_TIMEOUT.ms+BEST_EFFORT_CONNECT_GET_BUFFER_MS);if(!outcome.ok){let failure=mapConnectFailure(deps.logger,mcpServer,run.workflowId,outcome.failure,CONNECT_TIMEOUT);throw await persistConnectFailure(deps.store,deps.logger,mcpServerId,failure),failure}let persisted,toolApprovalCount;try{({persisted,toolApprovalCount}=await persistConnectResult(deps.store,mcpServerId,run.workflowId,outcome.output))}catch(error2){throw internalError(error2,"failed to save mcp server after connect")}return deps.logger.info("MCP server connect completed and stored",{mcp_server_id:mcpServerId,tools:persisted.status?.discoveredCapabilities?.tools.length??0,resource_templates:persisted.status?.discoveredCapabilities?.resourceTemplates.length??0,tool_approvals:toolApprovalCount}),persisted}finally{prepared.ecResourceId!==""&&await deleteConnectExecutionContext(deps,prepared.ecResourceId,prepared.executionId)}}async function prepareConnect(deps,mcpServer,input,identity2){let mcpServerId=mcpServer.metadata?.id??"",callerOrg=input.org;Object.keys(input.runtimeEnv).length===0&&await refreshOAuthTokenIfNeeded(deps,mcpServer,callerOrg);let executionId=newConnectExecutionId(mcpServerId),ecResourceId=await createConnectExecutionContext(deps,mcpServer,executionId,callerOrg,input.runtimeEnv,identity2),workflowInput={mcp_server_id:mcpServerId,...ecResourceId!==""?{execution_context_id:executionId}:{}};if(ecResourceId!==""&&deps.runnerAuth.isEnabled(TOKEN_TYPE_EXECUTION_SCOPED))try{let minted=deps.runnerAuth.mint(TOKEN_TYPE_EXECUTION_SCOPED,executionId,0);return{workflowInput:{...workflowInput,execution_context_token:minted.token},ecResourceId,executionId}}catch(error2){deps.logger.warn("Failed to mint connect EC token \u2014 discovery will read redacted credentials",{execution_id:executionId,error:error2 instanceof Error?error2.message:String(error2)})}return{workflowInput,ecResourceId,executionId}}async function createConnectExecutionContext(deps,mcpServer,executionId,callerOrg,runtimeEnv,caller){let ecData;if(Object.keys(runtimeEnv).length>0)ecData=runtimeEnv,deps.logger.info("Using runtime_env for connect ExecutionContext (one-time use)",{execution_id:executionId,runtime_env_count:Object.keys(runtimeEnv).length});else{let envDecls=mcpServer.spec?.env??{};if(Object.keys(envDecls).length===0)return deps.logger.debug("MCP server has no env declarations \u2014 skipping ExecutionContext creation",{execution_id:executionId}),"";let mcpServerId=mcpServer.metadata?.id??"",{oauthVars,remainingDecls}=await resolveOAuthVarsFromManagedEnv(deps,mcpServerId,callerOrg,envDecls),personalVars={};Object.keys(remainingDecls).length>0&&(personalVars=await resolveFromPersonalEnvironment(deps,callerOrg,remainingDecls)),ecData={...personalVars,...oauthVars},deps.logger.info("Resolved env vars for connect ExecutionContext",{execution_id:executionId,oauth_count:Object.keys(oauthVars).length,personal_count:Object.keys(personalVars).length})}if(Object.keys(ecData).length===0)return"";let created;try{created=await deps.executionContext.create(create2(ExecutionContextSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"ExecutionContext",metadata:{name:`exec-ctx-${executionId}`,org:callerOrg},spec:{executionId,data:ecData}}),caller)}catch(error2){throw internalError(error2,"failed to create connect ExecutionContext")}let resourceId=created.metadata?.id??"";return deps.logger.info("Created ephemeral ExecutionContext for MCP connect",{execution_context_id:resourceId,execution_id:executionId,data_entries:Object.keys(ecData).length}),resourceId}async function resolveOAuthVarsFromManagedEnv(deps,mcpServerId,org,envDecls){let grant;try{grant=await deps.oauthGrants.find("",mcpServerId,org)}catch{return{oauthVars:{},remainingDecls:envDecls}}if(grant===void 0||grant.environmentId==="")return{oauthVars:{},remainingDecls:envDecls};let oauthKey=grant.accessTokenEnvVar;if(!(oauthKey in envDecls))return{oauthVars:{},remainingDecls:envDecls};let tokenValue="";try{tokenValue=await deps.managedEnv.readSecretValue(grant.environmentId,oauthKey)}catch(error2){return deps.logger.warn("Failed to read OAuth token from managed environment \u2014 falling back to personal env",{mcp_server_id:mcpServerId,oauth_key:oauthKey,managed_env_id:grant.environmentId,error:error2 instanceof Error?error2.message:String(error2)}),{oauthVars:{},remainingDecls:envDecls}}if(tokenValue==="")return deps.logger.warn("Failed to read OAuth token from managed environment \u2014 falling back to personal env",{mcp_server_id:mcpServerId,oauth_key:oauthKey,managed_env_id:grant.environmentId}),{oauthVars:{},remainingDecls:envDecls};let remainingDecls={};for(let[k5,v]of Object.entries(envDecls))k5!==oauthKey&&(remainingDecls[k5]=v);return deps.logger.debug("Resolved OAuth token from managed environment",{mcp_server_id:mcpServerId,oauth_key:oauthKey,managed_env_id:grant.environmentId}),{oauthVars:{[oauthKey]:create2(ExecutionValueSchema,{value:tokenValue,isSecret:!0})},remainingDecls}}async function resolveFromPersonalEnvironment(deps,org,envDecls){let resolution=await resolveDeclaredFromPersonalEnvironment(deps.environmentReader,deps.logger,org,envDecls);if(resolution.kind==="no-personal-environment"){let requiredKeys=Object.entries(envDecls).filter(([,decl])=>!decl.optional).map(([key])=>key);if(requiredKeys.length===0)return{};throw failedPreconditionError(`personal environment not found for org '${org}'; save required credentials first: [${requiredKeys.join(" ")}]`)}if(resolution.missing.length>0)throw failedPreconditionError(`missing required credentials in personal environment: [${resolution.missing.join(" ")}]`);return{...resolution.values}}async function deleteConnectExecutionContext(deps,resourceId,executionId){try{await deps.executionContext.delete({resourceId})}catch(error2){deps.logger.warn("Failed to delete connect ExecutionContext (non-fatal)",{resource_id:resourceId,execution_id:executionId,error:error2 instanceof Error?error2.message:String(error2)});return}deps.logger.debug("Deleted ephemeral connect ExecutionContext",{resource_id:resourceId,execution_id:executionId})}function mapConnectFailure(logger2,mcpServer,workflowId,failure,budget){let mcpServerId=mcpServer.metadata?.id??"";switch(logger2.error("MCP connect workflow failed",{workflow_id:workflowId,mcp_server_id:mcpServerId,failure_kind:failure.kind}),failure.kind){case"application":return failedPreconditionError(buildConnectFailureMessage(mcpServer,failure.message));case"timeout":return new ConnectError(`connect did not complete within the ${budget.goLabel} budget for MCP server '${mcpServerId}' \u2014 if this repeats, check that your runner is running and healthy`,Code.DeadlineExceeded);case"service-not-found":return unavailableError(`connect service temporarily unavailable for MCP server '${mcpServerId}'`);case"other":return new ConnectError(buildConnectFailureMessage(mcpServer,failure.message),Code.Internal);default:{let exhaustive=failure;throw new Error(`unhandled connect failure ${String(exhaustive)}`)}}}function buildConnectFailureMessage(mcpServer,cause){let name=mcpServer.metadata?.name??"";if(cause.includes("requires OAuth"))return cause;if(mcpServer.spec?.serverType.case==="stdio"){let slug=mcpServer.metadata?.slug??"";return`connect failed for MCP server '${name}': ${cause}. This is a stdio server launched by your local runner \u2014 verify the command is installed and its arguments and environment variables are correct. Preview discovery locally with: stigmer connect mcp-server ${slug} --dry-run`}return`connect failed for MCP server '${name}': ${cause}. Check that the server URL is reachable and your credentials are valid.`}async function refreshOAuthTokenIfNeeded(deps,mcpServer,callerOrg){if(mcpServer.spec?.auth===void 0)return;let mcpServerId=mcpServer.metadata?.id??"",grant;try{grant=await deps.oauthGrants.find("",mcpServerId,callerOrg)}catch(error2){deps.logger.warn("Failed to load OAuth grant for pre-flight check (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}if(grant===void 0)return;if(grant.environmentId===""){deps.logger.warn("OAuth grant has no managed environment ID \u2014 user must re-authenticate via OAuth Connect",{mcp_server_id:mcpServerId});return}let refreshTokenValue;try{refreshTokenValue=await deps.managedEnv.readSecretValue(grant.environmentId,grant.refreshTokenEnvVar)}catch(error2){deps.logger.debug("No refresh token found in managed environment (may not be OAuth-connected)",{mcp_server_id:mcpServerId,refresh_token_var:grant.refreshTokenEnvVar,managed_env_id:grant.environmentId,error:error2 instanceof Error?error2.message:String(error2)});return}let clientSecret="",tokenAuthMethod="";if(grant.authMethod==="vendor_oauth")try{({clientSecret,tokenAuthMethod}=await loadOAuthAppClientCredentials(deps,mcpServer))}catch(error2){deps.logger.warn("Failed to load OAuthApp client secret for refresh",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}let result;try{result=await refreshTokenIfExpired(grant,refreshTokenValue,clientSecret,tokenAuthMethod,deps.logger,deps.outboundFetch)}catch(error2){throw failedPreconditionError(error2 instanceof Error?error2.message:String(error2))}if(!result.refreshed)return;let tokenVars={[grant.accessTokenEnvVar]:create2(EnvironmentValueSchema,{value:result.newAccessToken,isSecret:!0})};result.newRefreshToken!==refreshTokenValue&&(tokenVars[grant.refreshTokenEnvVar]=create2(EnvironmentValueSchema,{value:result.newRefreshToken,isSecret:!0}));try{await deps.managedEnv.updateSecrets(grant.environmentId,tokenVars)}catch(error2){throw internalError(error2,"failed to update refreshed tokens in managed environment")}try{await deps.oauthGrants.upsert({...grant,accessTokenExpiresAt:result.newExpiresAt})}catch(error2){deps.logger.warn("Failed to update OAuth grant after refresh (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}}async function loadOAuthAppClientCredentials(deps,mcpServer){let ref=mcpServer.spec?.auth?.oauthAppRef;if(ref===void 0||ref.slug==="")return{clientSecret:"",tokenAuthMethod:""};let app;try{app=await resolveOAuthAppRef(deps.store,ref,deps.logger)}catch(error2){throw new Error(`failed to list oauth apps: ${error2 instanceof Error?error2.message:String(error2)}`)}if(app===void 0)throw new Error(`OAuthApp '${ref.slug}' not found`);let tokenAuthMethod=tokenAuthMethodFromSpec(app.spec?.tokenEndpointAuthMethod??TokenEndpointAuthMethod.UNSPECIFIED),secret=app.spec?.clientSecret??"";return deps.secretService.isEncrypted(secret)&&(secret=await deps.secretService.decrypt(secret)),{clientSecret:secret,tokenAuthMethod}}function tokenAuthMethodFromSpec(method){return method===TokenEndpointAuthMethod.CLIENT_SECRET_POST?TOKEN_AUTH_METHOD_POST:TOKEN_AUTH_METHOD_BASIC}async function startBestEffortConnect(deps,mcpServer){let engineState=deps.engineState();if(!engineState.connected)return;let envKeys=Object.keys(mcpServer.spec?.env??{}).length;if(envKeys>0){deps.logger.debug("Skipping best-effort auto-connect: MCP server has env declarations (requires manual connect)",{mcp_server_id:mcpServer.metadata?.id??"",env_keys:envKeys});return}let mcpServerId=mcpServer.metadata?.id??"",run;try{run=await engineState.engine.startOrAttachConnect(mcpServerId,{mcp_server_id:mcpServerId},CONNECT_TIMEOUT.ms)}catch(error2){deps.logger.warn("Failed to start best-effort connect workflow (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}if(!run.attached)try{await persistConnectStarting(deps.store,mcpServerId,run.workflowId,"")}catch(error2){deps.logger.warn("Failed to record CONNECTING for best-effort connect (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)})}let outcome=await run.result(CONNECT_TIMEOUT.ms+BEST_EFFORT_CONNECT_GET_BUFFER_MS);if(!outcome.ok){let failure=mapConnectFailure(deps.logger,mcpServer,run.workflowId,outcome.failure,CONNECT_TIMEOUT);await persistConnectFailure(deps.store,deps.logger,mcpServerId,failure);return}let persisted,toolApprovalCount;try{({persisted,toolApprovalCount}=await persistConnectResult(deps.store,mcpServerId,run.workflowId,outcome.output))}catch(error2){if(error2 instanceof ResourceNotFoundError){deps.logger.info("Skipping best-effort connect persistence: MCP server deleted before connect completed",{mcp_server_id:mcpServerId});return}deps.logger.warn("Failed to persist best-effort connect result (non-fatal)",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}deps.logger.info("Best-effort auto-connect completed and stored",{workflow_id:run.workflowId,mcp_server_id:mcpServerId,tools:persisted.status?.discoveredCapabilities?.tools.length??0,resource_templates:persisted.status?.discoveredCapabilities?.resourceTemplates.length??0,tool_approvals:toolApprovalCount})}async function disconnectOAuth(deps,input,identity2){let resourceId=input.resourceId;if(resourceId==="")throw invalidArgumentError("resource_id is required");let org=input.org;if(org==="")throw invalidArgumentError("org is required");await authorizeDirect(McpServerCommandController.method.disconnectOAuth,deps.authorizer,identity2,input);let grant;try{grant=await deps.oauthGrants.find("",resourceId,org)}catch(error2){throw internalError(error2,"failed to look up OAuth grant")}if(grant===void 0)return deps.logger.debug("No OAuth grant to disconnect",{resource_id:resourceId,org}),create2(DisconnectOAuthOutputSchema,{disconnected:!1});let envId=grant.environmentId;if(envId!=="")try{await deps.managedEnv.deleteManagedEnvironment(envId)}catch(error2){deps.logger.warn("Failed to delete managed environment \u2014 may already be deleted",{resource_id:resourceId,environment_id:envId,error:error2 instanceof Error?error2.message:String(error2)})}try{await deps.oauthGrants.delete("",resourceId,org)}catch(error2){throw internalError(error2,"failed to delete OAuth grant")}return deps.logger.info("OAuth connection disconnected",{resource_id:resourceId,org,env_deleted:envId!==""}),create2(DisconnectOAuthOutputSchema,{disconnected:!0})}function isOAuthChallenge(wwwAuthenticate){let value=wwwAuthenticate.toLowerCase();return value.includes("bearer")?value.includes("oauth")||value.includes("resource_metadata"):!1}function parseResourceMetadataUrl(wwwAuthenticate){return/resource_metadata="([^"]+)"/i.exec(wwwAuthenticate)?.[1]}function protectedResourceMetadataUrls(resource){let bare=`${resource.origin}/.well-known/oauth-protected-resource`,path14=resource.pathname.replace(/\/+$/,"");return path14===""?[bare]:[`${bare}${path14}`,bare]}function authorizationServerMetadataUrls(issuer){let path14=issuer.pathname.replace(/\/+$/,""),urls=[...path14===""?[]:[`${issuer.origin}/.well-known/oauth-authorization-server${path14}`],`${issuer.origin}/.well-known/oauth-authorization-server`,...path14===""?[]:[`${issuer.origin}${path14}/.well-known/openid-configuration`],`${issuer.origin}/.well-known/openid-configuration`];return[...new Set(urls)]}async function resolveAuthorizationServers(resourceUrl,pointer,deps){let attempts=[],candidates=pointer!==void 0?[pointer]:protectedResourceMetadataUrls(new URL(resourceUrl));for(let candidate of candidates){let read3=await readJson(candidate,deps,attempts);if(read3===void 0)continue;let issuers=readStringArray(read3,"authorization_servers");if(issuers.length>0)return{issuers,attempts}}return{issuers:[],attempts}}async function readAuthorizationServerMetadata(issuer,deps){let attempts=[],parsed;try{parsed=new URL(issuer)}catch{return{kind:"not-found",attempts}}for(let metadataUrl of authorizationServerMetadataUrls(parsed)){let document2=await readJson(metadataUrl,deps,attempts);if(document2===void 0)continue;let authorizationEndpoint=readString(document2,"authorization_endpoint"),tokenEndpoint=readString(document2,"token_endpoint");if(authorizationEndpoint===""||tokenEndpoint===""){let last=attempts.pop();last!==void 0&&attempts.push({...last,missing:authorizationEndpoint===""?"authorization_endpoint":"token_endpoint"});continue}return{kind:"found",attempts,metadata:{metadataUrl,issuer:readString(document2,"issuer"),authorizationEndpoint,tokenEndpoint,registrationEndpoint:readString(document2,"registration_endpoint"),scopesSupported:readStringArray(document2,"scopes_supported"),codeChallengeMethodsSupported:readStringArray(document2,"code_challenge_methods_supported")}}}return{kind:"not-found",attempts}}async function readJson(url,deps,attempts){let response;try{response=await deps.fetchImpl(url,{method:"GET",headers:{Accept:"application/json"},signal:AbortSignal.timeout(deps.timeoutMs)})}catch(error2){attempts.push({url,error:error2 instanceof Error?error2.message:String(error2)});return}if(attempts.push({url,status:response.status}),response.status!==200){await response.body?.cancel().catch(()=>{});return}try{let parsed=await response.json();return isRecord(parsed)?parsed:void 0}catch{return}}function readString(record2,key){let value=record2[key];return typeof value=="string"?value:""}function readStringArray(record2,key){let list12=record2[key];return Array.isArray(list12)?list12.filter(item=>typeof item=="string"):[]}function isRecord(value){return typeof value=="object"&&value!==null&&!Array.isArray(value)}var MCP_PROTOCOL_VERSION="2025-06-18";function baseHeaders(headers2){return{"Content-Type":"application/json",Accept:"application/json, text/event-stream","MCP-Protocol-Version":MCP_PROTOCOL_VERSION,...headers2??{}}}function initializeRequest(clientName,headers2){return{method:"POST",headers:baseHeaders(headers2),body:JSON.stringify({jsonrpc:"2.0",id:1,method:"initialize",params:{protocolVersion:MCP_PROTOCOL_VERSION,capabilities:{},clientInfo:{name:clientName,version:"0"}}})}}async function probeEndpointAuth(url,headers2,deps){let request=initializeRequest(deps.clientName,headers2),response;try{response=await deps.fetchImpl(url,{method:request.method,headers:{...request.headers},body:request.body,signal:AbortSignal.timeout(deps.timeoutMs)})}catch(error2){return{kind:"unreachable",error:describeError(error2)}}if(await response.body?.cancel().catch(()=>{}),response.status===401){let challenge=response.headers.get("www-authenticate")??"";return isOAuthChallenge(challenge)?{kind:"oauth",challenge,resourceMetadataUrl:parseResourceMetadataUrl(challenge)}:{kind:"challenge-not-oauth",challenge}}return response.status>=200&&response.status<300?{kind:"accepted",status:response.status}:{kind:"http-other",status:response.status}}function describeError(error2){return error2 instanceof Error?`${error2.name}: ${error2.message}`:String(error2)}var ENDPOINT_PROBE_TIMEOUT_MS=3e3,PROBE_CLIENT_NAME="stigmer-server",ACCESS_TOKEN_VAR_SUFFIX="_ACCESS_TOKEN",AUTHORIZATION_HEADER="authorization";function newCompleteEndpointAuthStep(deps){return{name:"CompleteEndpointAuth",async execute(ctx){let server=ctx.newState,spec=server.spec;if(spec===void 0)return;applyTokenPathDefault(spec,server.metadata?.slug??"");let existing=ctx.get(EXISTING_RESOURCE_KEY),derived=existing!==void 0?derivedCompletionOf(existing):void 0,url=authorShapeUrl(spec);if(url===void 0){derived!==void 0&&echoesDerived(spec,derived)?stamp(ctx,server):dropLabel(server);return}if(derived!==void 0&&derived.url===url){applyCompletion(spec,derived.variable,derived.description),stamp(ctx,server);return}if(await probe(url,spec,deps)!=="oauth"){dropLabel(server);return}let variable=accessTokenVariable(server.metadata?.slug??"");applyCompletion(spec,variable,tokenDescription(server.metadata?.slug??"")),stamp(ctx,server)}}}function authorShapeUrl(spec){if(spec.serverType.case==="http"&&spec.auth===void 0&&!(Object.keys(spec.env).length>0)){for(let[name,value]of Object.entries(spec.serverType.value.headers))if(name.toLowerCase()===AUTHORIZATION_HEADER||value.includes("${"))return;return spec.serverType.value.url}}function derivedCompletionOf(existing){if(existing.metadata?.labels[MCP_AUTH_LABEL]!==MCP_AUTH_ENDPOINT)return;let spec=existing.spec;if(spec===void 0||spec.serverType.case!=="http")return;let variable=spec.auth?.targetEnvVar??"";if(variable!=="")return{url:spec.serverType.value.url,variable,description:spec.env[variable]?.description??""}}function echoesDerived(spec,derived){if(spec.serverType.case!=="http"||spec.serverType.value.url!==derived.url)return!1;let auth=spec.auth;if(auth===void 0||auth.targetEnvVar!==derived.variable||!auth.oauthOnly||(auth.oauthAppRef?.slug??"")!==""||auth.discoveryUrl!==""||auth.scopeHints.length>0||auth.tokenLifetimeHint!=="")return!1;let envKeys=Object.keys(spec.env);if(envKeys.length!==1||envKeys[0]!==derived.variable)return!1;let declaration=spec.env[derived.variable];if(declaration===void 0||!declaration.isSecret||declaration.optional)return!1;let headers2=Object.entries(spec.serverType.value.headers),authorization=headers2.filter(([name])=>name.toLowerCase()===AUTHORIZATION_HEADER);return authorization.length!==1||authorization[0]?.[1]!==bearerHeader(derived.variable)?!1:headers2.every(([name,value])=>name.toLowerCase()===AUTHORIZATION_HEADER||!value.includes("${"))}function applyCompletion(spec,variable,description){spec.auth=create2(McpServerAuthSchema,{targetEnvVar:variable,oauthOnly:!0}),spec.env[variable]=create2(EnvVarDeclarationSchema,{isSecret:!0,optional:!1,description}),applyTokenPathDefault(spec,"")}function applyTokenPathDefault(spec,slug){let variable=spec.auth?.targetEnvVar??"";if(variable===""||(spec.env[variable]===void 0&&(spec.env[variable]=create2(EnvVarDeclarationSchema,{isSecret:!0,optional:!1,description:tokenDescription(slug)})),spec.serverType.case!=="http"))return;let headers2=spec.serverType.value.headers,reference=`\${${variable}}`;Object.values(headers2).some(value=>value.includes(reference))||(headers2.Authorization=bearerHeader(variable))}function bearerHeader(variable){return`Bearer \${${variable}}`}function accessTokenVariable(slug){let stem=slug.toUpperCase().replace(/[^A-Z0-9]+/g,"_").replace(/^_+|_+$/g,"");return`${stem===""?"MCP":stem}${ACCESS_TOKEN_VAR_SUFFIX}`}function tokenDescription(slug){return`OAuth access token for the '${slug}' MCP server; Sign in fills it`}function stamp(ctx,server){server.metadata!==void 0&&(server.metadata.labels[MCP_AUTH_LABEL]=MCP_AUTH_ENDPOINT,recordServerStampedReservedLabels(ctx,MCP_AUTH_LABEL))}function dropLabel(server){server.metadata!==void 0&&delete server.metadata.labels[MCP_AUTH_LABEL]}async function probe(url,spec,deps){let headers2=spec.serverType.case==="http"?spec.serverType.value.headers:{};try{let outcome=await probeEndpointAuth(url,headers2,{fetchImpl:deps.outboundFetch,timeoutMs:ENDPOINT_PROBE_TIMEOUT_MS,clientName:PROBE_CLIENT_NAME});return outcome.kind==="unreachable"&&deps.logger.debug("MCP endpoint probe got no answer; saving the spec as sent",{url,error:outcome.error}),outcome.kind==="oauth"?"oauth":"other"}catch(error2){return deps.logger.warn("MCP endpoint probe threw; saving the spec as sent",{url,error:error2 instanceof Error?error2.message:String(error2)}),"other"}}async function getOAuthGrantStatus(deps,input,identity2){if(input.resourceId==="")throw invalidArgumentError("resource_id is required");if(input.org==="")throw invalidArgumentError("org is required");await authorizeDirect(McpServerQueryController.method.getOAuthGrantStatus,deps.authorizer,identity2,input);let grant;try{grant=await deps.oauthGrants.find("",input.resourceId,input.org)}catch(error2){throw internalError(error2,"failed to look up OAuth grant")}return grant===void 0?create2(GetOAuthGrantStatusOutputSchema,{connected:!1,connectionHealth:OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_NO_GRANT}):create2(GetOAuthGrantStatusOutputSchema,{connected:!0,accessTokenExpiresAt:BigInt(grant.accessTokenExpiresAt),targetEnvVar:grant.accessTokenEnvVar,authMethod:grant.authMethod,connectionHealth:evaluateHealth(grant)})}function evaluateHealth(grant){return grant.accessTokenExpiresAt===0?OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_HEALTHY:Math.floor(Date.now()/1e3)<grant.accessTokenExpiresAt-REFRESH_EXPIRY_BUFFER_SECONDS?OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_HEALTHY:grant.refreshTokenEnvVar!==""?OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED_REFRESHABLE:OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED}var import_node_crypto24=require("node:crypto");var import_node_crypto23=require("node:crypto");function generatePkce(){let verifier=(0,import_node_crypto23.randomBytes)(32).toString("base64url"),challenge=(0,import_node_crypto23.createHash)("sha256").update(verifier).digest().toString("base64url");return{codeVerifier:verifier,codeChallenge:challenge}}var DISCOVERY_REQUEST_TIMEOUT_MS=1e4;async function discoverForResource(mcpUrl,fetchImpl){let resource=parseDiscoveryUrl(mcpUrl),deps={fetchImpl,timeoutMs:DISCOVERY_REQUEST_TIMEOUT_MS},resolved=await resolveAuthorizationServers(resource.href,void 0,deps),issuers=resolved.issuers.length>0?resolved.issuers:[resource.origin];return readIssuers(issuers,deps)}async function discoverAtIssuer(issuerUrl,fetchImpl){let issuer=parseDiscoveryUrl(issuerUrl);return readIssuers([issuer.href],{fetchImpl,timeoutMs:DISCOVERY_REQUEST_TIMEOUT_MS})}async function readIssuers(issuers,deps){let attempts=[];for(let issuer of issuers){let read3=await readAuthorizationServerMetadata(issuer,deps);if(attempts.push(...read3.attempts),read3.kind==="found"){let metadata=toAuthServerMetadata(read3.metadata);return validateMetadata(metadata,read3.metadata.metadataUrl),metadata}}throw discoveryFailure(issuers,attempts)}function toAuthServerMetadata(m3){return{issuer:m3.issuer,authorizationEndpoint:m3.authorizationEndpoint,tokenEndpoint:m3.tokenEndpoint,registrationEndpoint:m3.registrationEndpoint,scopesSupported:[...m3.scopesSupported],codeChallengeMethodsSupported:[...m3.codeChallengeMethodsSupported]}}function discoveryFailure(issuers,attempts){let firstIssuer=issuers[0]??"",named=firstDocumentFor(firstIssuer),attempt=attempts.find(a5=>a5.url===named)??attempts[0];if(attempt?.error!==void 0)return new Error(`discovery request to ${attempt.url} failed: ${attempt.error}`);if(attempt?.missing!==void 0)return new Error(`authorization server at ${attempt.url} is missing ${attempt.missing}`);let status=attempt?.status??0;return new Error(`authorization server discovery failed: ${named} returned HTTP ${status} (expected 200). This MCP server may not support the MCP Authorization specification`)}function firstDocumentFor(issuer){try{return authorizationServerMetadataUrls(new URL(issuer))[0]??issuer}catch{return issuer}}function parseDiscoveryUrl(serverUrl){let parsed;try{parsed=new URL(serverUrl)}catch(error2){throw new Error(`invalid server URL for discovery: ${error2 instanceof Error?error2.message:String(error2)}`)}let scheme=parsed.protocol.replace(/:$/,"");if(scheme!=="http"&&scheme!=="https")throw new Error(`invalid server URL for discovery: unsupported scheme "${scheme}": only http and https are supported`);if(parsed.host==="")throw new Error("invalid server URL for discovery: server URL has no host");return parsed}function validateMetadata(m3,sourceUrl){if(m3.authorizationEndpoint==="")throw new Error(`authorization server at ${sourceUrl} is missing authorization_endpoint`);if(m3.tokenEndpoint==="")throw new Error(`authorization server at ${sourceUrl} is missing token_endpoint`);if(m3.codeChallengeMethodsSupported.length>0&&!m3.codeChallengeMethodsSupported.includes("S256"))throw new Error(`authorization server at ${sourceUrl} does not support S256 PKCE (supports: [${m3.codeChallengeMethodsSupported.join(" ")}]). S256 is required by the MCP Authorization specification`)}var DCR_REQUEST_TIMEOUT_MS=15e3;async function registerClient(registrationEndpoint,redirectUri,clientName,fetchImpl){let requestBody=JSON.stringify({redirect_uris:[redirectUri],client_name:clientName,grant_types:["authorization_code"],response_types:["code"],token_endpoint_auth_method:"none"}),response;try{response=await fetchImpl(registrationEndpoint,{method:"POST",headers:{"Content-Type":"application/json",Accept:"application/json"},body:requestBody,signal:AbortSignal.timeout(DCR_REQUEST_TIMEOUT_MS)})}catch(error2){throw new Error(`DCR request to ${registrationEndpoint} failed: ${error2 instanceof Error?error2.message:String(error2)}`)}let body=await response.text();if(response.status!==201&&response.status!==200)throw new Error(`DCR at ${registrationEndpoint} returned HTTP ${response.status}: ${truncateBody(body)}`);let raw;try{raw=JSON.parse(body)}catch(error2){throw new Error(`failed to parse DCR response: ${error2 instanceof Error?error2.message:String(error2)}`)}if((raw.client_id??"")==="")throw new Error(`DCR response from ${registrationEndpoint} is missing client_id`);return{clientId:raw.client_id,clientSecret:raw.client_secret??"",clientName:raw.client_name??"",tokenEndpointAuthMethod:raw.token_endpoint_auth_method??""}}var PREFLIGHT_REQUEST_TIMEOUT_MS=4e3,PREFLIGHT_BODY_READ_CAP=4096;async function preflightAuthorize(authorizationUrl,fetchImpl){let response=await fetchImpl(authorizationUrl,{method:"GET",redirect:"manual",signal:AbortSignal.timeout(PREFLIGHT_REQUEST_TIMEOUT_MS)});if(response.status!==400){await response.text().catch(()=>"");return}let body=(await response.text()).slice(0,PREFLIGHT_BODY_READ_CAP);return{statusCode:response.status,vendorDetail:extractVendorDetail(body),bodySnippet:truncateBody(body)}}function extractVendorDetail(body){let parsed;try{parsed=JSON.parse(body)}catch{return""}return(parsed.error_description??"")!==""?parsed.error_description:parsed.error??""}async function initiateOAuthConnect(deps,input,identity2){if(deps.oauthRedirectUri==="")throw failedPreconditionError("OAuth Connect is not configured: STIGMER_OAUTH_REDIRECT_URI is not set");let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}await authorizeDirect(McpServerCommandController.method.initiateOAuthConnect,deps.authorizer,identity2,input);let auth=mcpServer.spec?.auth;if(auth===void 0)throw failedPreconditionError(`MCP server '${mcpServerId}' does not have an auth block configured`);let pkcePair=generatePkce(),stateParam=generateState(),oauthAppRef=auth.oauthAppRef,isDcr=oauthAppRef===void 0||oauthAppRef.slug==="",result=isDcr?await initiateDcr(deps,mcpServer,pkcePair,stateParam):await initiateVendorOAuth(deps,mcpServer,pkcePair,stateParam),authMethod=isDcr?"mcp_oauth":"vendor_oauth",pendingState={state:stateParam,codeVerifier:pkcePair.codeVerifier,clientId:result.clientId,clientSecret:result.clientSecret,tokenEndpoint:result.tokenEndpoint,mcpServerId,identityAccountId:"",targetEnvVar:auth.targetEnvVar,authMethod,tokenAuthMethod:result.tokenAuthMethod,redirectUri:deps.oauthRedirectUri,org:input.org,createdAt:0},sealed;try{sealed=await sealPendingOAuthState(deps.secretService,deps.logger,pendingState)}catch(error2){throw internalError(error2,"failed to encrypt OAuth handshake secrets")}try{await deps.pendingOAuthStates.save(sealed)}catch(error2){throw internalError(error2,"failed to save pending OAuth state")}return deps.logger.info("Initiated OAuth Connect flow",{mcp_server_id:mcpServerId,auth_method:authMethod,provider:result.providerName}),create2(InitiateOAuthConnectOutputSchema,{authorizationUrl:result.authorizationUrl,state:stateParam,scopes:result.scopes,providerName:result.providerName})}async function initiateDcr(deps,mcpServer,pkcePair,stateParam){let discoveryUrl2=mcpServer.spec?.auth?.discoveryUrl??"",serverType=mcpServer.spec?.serverType,resourceUrl=serverType?.case==="http"?serverType.value.url:"",serverUrl=discoveryUrl2!==""?discoveryUrl2:resourceUrl;if(serverUrl==="")throw failedPreconditionError(`DCR requires a discoverable URL. MCP server '${mcpServer.metadata?.id??""}' has no http.url and no auth.discovery_url. Set auth.discovery_url for stdio servers, oauth_app_ref for vendor OAuth, or switch to HTTP transport`);let metadata;try{metadata=discoveryUrl2!==""?await discoverAtIssuer(discoveryUrl2,deps.outboundFetch):await discoverForResource(resourceUrl,deps.outboundFetch)}catch(error2){throw failedPreconditionError(`OAuth authorization server discovery failed for ${serverUrl}: ${error2 instanceof Error?error2.message:String(error2)}`)}if(metadata.registrationEndpoint==="")throw failedPreconditionError(`MCP server at ${serverUrl} does not advertise a registration_endpoint for DCR: ${loginServerHost(metadata,serverUrl)} does not allow automatic client registration, so this server needs an OAuth app registered with the vendor and referenced from its definition (auth.oauth_app_ref)`);let clientName=`Stigmer (${mcpServer.metadata?.name??""})`,dcrResponse;try{dcrResponse=await registerClient(metadata.registrationEndpoint,deps.oauthRedirectUri,clientName,deps.outboundFetch)}catch(error2){throw failedPreconditionError(`DCR registration failed: ${error2 instanceof Error?error2.message:String(error2)}`)}let scopes=mcpServer.spec?.auth?.scopeHints??[];scopes.length===0&&metadata.scopesSupported.length>0&&(scopes=metadata.scopesSupported);let authUrl=buildAuthorizationUrl(metadata.authorizationEndpoint,dcrResponse.clientId,deps.oauthRedirectUri,pkcePair.codeChallenge,stateParam,scopes,"scope"),rejection;try{rejection=await preflightAuthorize(authUrl,deps.outboundFetch)}catch(probeError){deps.logger.debug("authorize pre-flight probe inconclusive; proceeding",{mcp_server_id:mcpServer.metadata?.id??"",error:probeError instanceof Error?probeError.message:String(probeError)})}if(rejection!==void 0)throw deps.logger.warn("authorization endpoint rejected the sign-in request pre-flight",{status_code:rejection.statusCode,mcp_server_id:mcpServer.metadata?.id??"",body_snippet:rejection.bodySnippet}),failedPreconditionError(dcrRejectionMessage(mcpServer.metadata?.name??"",deps.oauthRedirectUri,rejection));return{authorizationUrl:authUrl,providerName:mcpServer.metadata?.name??"",scopes,clientId:dcrResponse.clientId,clientSecret:"",tokenEndpoint:metadata.tokenEndpoint,tokenAuthMethod:""}}function loginServerHost(metadata,serverUrl){for(let candidate of[metadata.issuer,metadata.authorizationEndpoint,serverUrl])try{let host=new URL(candidate).host;if(host!=="")return host}catch{}return serverUrl}async function initiateVendorOAuth(deps,mcpServer,pkcePair,stateParam){let ref=mcpServer.spec?.auth?.oauthAppRef,oauthApp;try{oauthApp=await resolveOAuthAppRef(deps.store,ref,deps.logger)}catch(error2){throw internalError(error2,"failed to list oauth apps")}if(oauthApp===void 0)throw notFoundError("oauth_app",ref?.slug??"");let approvalStatus=oauthApp.spec?.vendorApprovalStatus;if(approvalStatus===VendorApprovalStatus.PENDING||approvalStatus===VendorApprovalStatus.REJECTED){let statusLabel=approvalStatus===VendorApprovalStatus.REJECTED?"rejected":"pending approval",alternative=mcpServer.spec?.auth?.oauthOnly?"This server only accepts OAuth sign-in; an org admin can configure your own OAuth app instead.":"Please enter a token manually instead.";throw failedPreconditionError(`OAuth sign-in is unavailable: the platform's OAuth app for '${oauthApp.spec?.provider??""}' is ${statusLabel} by the vendor. ${alternative}`)}let clientSecret=oauthApp.spec?.clientSecret??"";if(deps.secretService.isEncrypted(clientSecret))try{clientSecret=await deps.secretService.decrypt(clientSecret)}catch(error2){throw internalError(error2,"failed to decrypt OAuthApp client secret")}let scopes=oauthApp.spec?.scopes??[];return{authorizationUrl:buildAuthorizationUrl(oauthApp.spec?.authorizationUrl??"",oauthApp.spec?.clientId??"",deps.oauthRedirectUri,pkcePair.codeChallenge,stateParam,scopes,oauthApp.spec?.scopeParameterName??""),providerName:oauthApp.spec?.provider??"",scopes,clientId:oauthApp.spec?.clientId??"",clientSecret,tokenEndpoint:oauthApp.spec?.tokenUrl??"",tokenAuthMethod:tokenAuthMethodFromSpec(oauthApp.spec?.tokenEndpointAuthMethod??TokenEndpointAuthMethod.UNSPECIFIED)}}function buildAuthorizationUrl(authEndpoint,clientId,redirectUri,codeChallenge,state2,scopes,scopeParamName){let scopeParam=scopeParamName===""?"scope":scopeParamName,params=new URLSearchParams({response_type:"code",client_id:clientId,redirect_uri:redirectUri,code_challenge:codeChallenge,code_challenge_method:"S256",state:state2});scopes.length>0&&params.set(scopeParam,scopes.join(" ")),params.sort();let separator=authEndpoint.includes("?")?"&":"?";return authEndpoint+separator+params.toString()}function dcrRejectionMessage(providerName,redirectUri,rejection){let callbackHost=redirectUri;try{let parsed=new URL(redirectUri);parsed.host!==""&&(callbackHost=parsed.host)}catch{}let message6=`${providerName} rejected the sign-in request before showing a login page (HTTP ${rejection.statusCode}). The most common cause is a redirect-host allowlist: this deployment's OAuth callback host (${callbackHost}) is not on the provider's approved list. Self-hosted deployments with a localhost callback are typically unaffected.`;return rejection.vendorDetail!==""&&(message6+=" Provider detail: "+rejection.vendorDetail),message6}function generateState(){return(0,import_node_crypto24.randomBytes)(32).toString("base64url")}async function sealPendingOAuthState(secretService,logger2,state2){if(!secretService.isEnabled())return logger2.warn("Encryption disabled: pending OAuth state secrets will be stored in plaintext"),state2;let scope=EncryptionScope.forOrganization(state2.org),sealedVerifier;try{sealedVerifier=await secretService.encrypt(state2.codeVerifier,scope)}catch(error2){throw new Error(`failed to encrypt code_verifier: ${error2 instanceof Error?error2.message:String(error2)}`)}let sealedSecret=state2.clientSecret;if(state2.clientSecret!=="")try{sealedSecret=await secretService.encrypt(state2.clientSecret,scope)}catch(error2){throw new Error(`failed to encrypt client_secret: ${error2 instanceof Error?error2.message:String(error2)}`)}return{...state2,codeVerifier:sealedVerifier,clientSecret:sealedSecret}}var mcpServerSearchExtractor={kind:ApiResourceKind.mcp_server,schema:McpServerSchema,getSearchSummary(resource){return resource.spec?.description??""},toSearchResult(resource,score){let mcpServer=resource;return buildSearchResult({kind:ApiResourceKind.mcp_server,metadata:mcpServer.metadata,summary:mcpServer.spec?.description??"",score,createdAt:mcpServer.status?.audit?.specAudit?.createdAt,updatedAt:mcpServer.status?.audit?.specAudit?.updatedAt,iconUrl:mcpServer.spec?.iconUrl??""})},getSearchIndexEntry(resource){let mcpServer=resource,metadata=mcpServer.metadata;if(metadata!==void 0)return{name:metadata.name,description:mcpServer.spec?.description??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(mcpServer.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var RUNNER_QUEUE_WARNING="no runner appears to be polling the task queue \u2014 the connect will wait for one to come up (start your local runner if it is not running)";async function startConnect(deps,input,identity2){let mcpServerId=input.mcpServerId;if(mcpServerId==="")throw invalidArgumentError("mcp_server_id is required");if(input.org==="")throw invalidArgumentError("org is required for connect");let mcpServer;try{mcpServer=await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}await authorizeDirect(McpServerCommandController.method.startConnect,deps.authorizer,identity2,input);let engineState=deps.engineState();if(!engineState.connected)throw failedPreconditionError("connect is not available: Temporal not configured");let connectStatus=mcpServer.status?.connectStatus;if(connectStatus?.phase===ConnectPhase.connecting&&await engineState.engine.isConnectRunRunning(connectStatus.workflowId))return deps.logger.info("StartConnect attached to in-flight connect operation",{mcp_server_id:mcpServerId,workflow_id:connectStatus.workflowId}),mcpServer;let prepared=await prepareConnect(deps,mcpServer,input,identity2),warning2=await runnerQueueWarning(engineState.engine),run;try{run=await engineState.engine.startOrAttachConnect(mcpServerId,prepared.workflowInput,ASYNC_CONNECT_TIMEOUT.ms)}catch(error2){throw prepared.ecResourceId!==""&&await deleteConnectExecutionContext(deps,prepared.ecResourceId,prepared.executionId),deps.logger.error("Failed to start MCP connect workflow",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)}),internalError(error2,"failed to start connect workflow")}if(run.attached){prepared.ecResourceId!==""&&await deleteConnectExecutionContext(deps,prepared.ecResourceId,prepared.executionId);try{return await deps.store.getResource(ApiResourceKind.mcp_server,mcpServerId,McpServerSchema)}catch{throw notFoundError("mcp_server",mcpServerId)}}let persisted;try{persisted=await persistConnectStarting(deps.store,mcpServerId,run.workflowId,warning2)}catch(error2){throw detachSettle(deps,mcpServer,run,prepared),internalError(error2,"failed to record connect operation")}return detachSettle(deps,mcpServer,run,prepared),persisted}function detachSettle(deps,mcpServer,run,prepared){settleConnectAsync(deps,mcpServer,run,prepared.ecResourceId,prepared.executionId).catch(error2=>{deps.logger.warn("Async connect settle task failed unexpectedly",{mcp_server_id:mcpServer.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})})}async function settleConnectAsync(deps,mcpServer,run,ecResourceId,executionId){let mcpServerId=mcpServer.metadata?.id??"";try{let outcome=await run.result(ASYNC_CONNECT_TIMEOUT.ms+BEST_EFFORT_CONNECT_GET_BUFFER_MS);if(!outcome.ok){let failure=mapConnectFailure(deps.logger,mcpServer,run.workflowId,outcome.failure,ASYNC_CONNECT_TIMEOUT);await persistConnectFailure(deps.store,deps.logger,mcpServerId,failure);return}let persisted,toolApprovalCount;try{({persisted,toolApprovalCount}=await persistConnectResult(deps.store,mcpServerId,run.workflowId,outcome.output))}catch(error2){if(error2 instanceof ResourceNotFoundError){deps.logger.info("Skipping async connect persistence: MCP server deleted before connect completed",{mcp_server_id:mcpServerId});return}deps.logger.warn("Failed to persist async connect result",{mcp_server_id:mcpServerId,error:error2 instanceof Error?error2.message:String(error2)});return}deps.logger.info("Async MCP server connect completed and stored",{workflow_id:run.workflowId,mcp_server_id:mcpServerId,tools:persisted.status?.discoveredCapabilities?.tools.length??0,resource_templates:persisted.status?.discoveredCapabilities?.resourceTemplates.length??0,tool_approvals:toolApprovalCount})}finally{ecResourceId!==""&&await deleteConnectExecutionContext(deps,ecResourceId,executionId)}}async function runnerQueueWarning(engine){let hasPollers=await engine.hasRunnerQueuePollers();return hasPollers===void 0||hasPollers?"":RUNNER_QUEUE_WARNING}function newValidateDefaultEnabledToolsStep(){return{name:"ValidateDefaultEnabledTools",execute(ctx){let mcpServer=ctx.newState,requested=mcpServer.spec?.defaultEnabledTools??[];if(requested.length===0)return;let caps=mcpServer.status?.discoveredCapabilities;if(caps===void 0)return;let classification=classify(caps,requested);if(isValidClassification(classification))return;let problems=[];throw classification.unknown.length>0&&problems.push(`default_enabled_tools names tool(s) this server does not expose: ${quoteJoin(classification.unknown)}`),classification.resourceTemplates.length>0&&problems.push(`default_enabled_tools names resource template(s): ${quoteJoin(classification.resourceTemplates)} \u2014 resource templates are read-only data endpoints, not callable tools, and must not appear in default_enabled_tools`),invalidArgumentError(`MCP server '${mcpServer.metadata?.slug??""}': ${problems.join("; ")}. Discovered tools: ${quoteJoin(toolNames(caps))}. If the server's toolset changed, run 'stigmer connect' on it to refresh discovered capabilities.`)}}}function newEnrichOAuthStatusStep(store,logger2){return{name:"EnrichOAuthStatus",async execute(ctx){let mcpServer=ctx.get(TARGET_RESOURCE_KEY);if(mcpServer===void 0)return;let ref=mcpServer.spec?.auth?.oauthAppRef;if((ref?.slug??"")==="")return;let oauthApp;try{oauthApp=await resolveOAuthAppRef(store,ref,logger2)}catch(error2){logger2.warn("OAuthApp lookup failed; returning MCP server without oauth_status enrichment",{mcpServerId:mcpServer.metadata?.id??"",oauthAppSlug:ref?.slug??"",error:error2 instanceof Error?error2.message:String(error2)});return}if(oauthApp===void 0){logger2.debug("OAuthApp not found for ref; skipping oauth_status enrichment",{mcpServerId:mcpServer.metadata?.id??"",oauthAppSlug:ref?.slug??""});return}let approvalStatus=oauthApp.spec?.vendorApprovalStatus??VendorApprovalStatus.UNSPECIFIED,docsUrl=oauthApp.spec?.vendorApprovalDocsUrl??"";approvalStatus===VendorApprovalStatus.UNSPECIFIED&&docsUrl===""||(mcpServer.status??=create2(McpServerStatusSchema,{}),mcpServer.status.oauthStatus=create2(OAuthStatusSchema,{vendorApprovalStatus:approvalStatus,vendorApprovalDocsUrl:docsUrl}))}}}function registerMcpServerServices(router,deps){router.service(McpServerCommandController,{apply:(server,ctx)=>apply11(deps,server,ctx),create:(server,ctx)=>createMcpServer(deps,server,ctx),update:(server,ctx)=>update14(deps,server,ctx),updateVisibility:(input,ctx)=>updateVisibility4(deps,input,ctx),delete:(input,ctx)=>deleteMcpServer(deps,input,ctx),connect:(input,ctx)=>connect(deps.connect,input,callerIdentityOf(ctx)),startConnect:(input,ctx)=>startConnect(deps.connect,input,callerIdentityOf(ctx)),initiateOAuthConnect:(input,ctx)=>initiateOAuthConnect(deps.connect,input,callerIdentityOf(ctx)),completeOAuthConnect:(input,ctx)=>completeOAuthConnect(deps.connect,input,callerIdentityOf(ctx)),disconnectOAuth:(input,ctx)=>disconnectOAuth(deps.connect,input,callerIdentityOf(ctx)),setOrgOAuthApp:()=>{throw orgOAuthAppUnimplemented("SetOrgOAuthApp")},deleteOrgOAuthApp:()=>{throw orgOAuthAppUnimplemented("DeleteOrgOAuthApp")}}),router.service(McpServerQueryController,{get:(id,ctx)=>get19(deps,id,ctx),getByReference:(ref,ctx)=>getByReference11(deps,ref,ctx),getOAuthGrantStatus:(input,ctx)=>getOAuthGrantStatus(deps.connect,input,callerIdentityOf(ctx)),getOrgOAuthApp:()=>{throw orgOAuthAppUnimplemented("GetOrgOAuthApp")}})}function orgOAuthAppUnimplemented(method){return new ConnectError(`method ${method} not implemented`,Code.Unimplemented)}function kindOf18(ctx){return ctx.values.get(apiResourceKindKey)}function endpointAuthDeps(deps){return{outboundFetch:deps.connect.outboundFetch,logger:deps.logger}}async function createMcpServer(deps,server,ctx){let reqCtx=new RequestContext(McpServerSchema,server,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("mcpserver-create",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.create,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newCompleteEndpointAuthStep(endpointAuthDeps(deps))).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,mcpServerSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update14(deps,server,ctx){let reqCtx=new RequestContext(McpServerSchema,server,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("mcpserver-update",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newGuardPluginManagedStep(deps.store)).addStep(newBuildUpdateStateStep()).addStep(newCompleteEndpointAuthStep(endpointAuthDeps(deps))).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newValidateDefaultEnabledToolsStep()).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store)).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,mcpServerSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply11(deps,server,ctx){let reqCtx=new RequestContext(McpServerSchema,server,callerIdentityOf(ctx),kindOf18(ctx));await newPipeline("mcpserver-apply",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");let result=shouldCreate?await createMcpServer(deps,server,ctx):await update14(deps,withResolvedApplyId(McpServerSchema,server,reqCtx),ctx);return startBestEffortConnect(deps.connect,result).catch(error2=>{deps.logger.warn("Best-effort connect task failed unexpectedly",{mcp_server_id:result.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}),result}async function deleteMcpServer(deps,input,ctx){let reqCtx=new RequestContext(McpServerCommandController.method.delete.input,input,callerIdentityOf(ctx),kindOf18(ctx));reqCtx.set(RESOURCE_ID_KEY,input.resourceId),await newPipeline("mcpserver-delete",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadExistingForDeleteStep(deps.store,McpServerSchema)).addStep(newGuardPluginManagedStep(deps.store)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted mcp server not found in context"),"deleted mcp server not found in context");return deleted}var UPDATE_VISIBILITY_MCP_SERVER_KEY="updateVisibilityMcpServer";async function updateVisibility4(deps,input,ctx){let reqCtx=new RequestContext(McpServerCommandController.method.updateVisibility.input,input,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("mcpserver-update-visibility",deps.logger).addStep(newAuthorizeStep(McpServerCommandController.method.updateVisibility,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadMcpServerForVisibilityUpdateStep(deps.store)).addStep(newGuardPluginManagedStep(deps.store,{existingKey:UPDATE_VISIBILITY_MCP_SERVER_KEY})).addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_MCP_SERVER_KEY)).addStep(newValidateVisibilityUpdateStep()).addStep(newSetMcpServerVisibilityStep()).addStep(newPersistMcpServerForVisibilityUpdateStep(deps.store)).addStep(newUpdateVisibilityTuplesStep(deps.authorizationLifecycle,UPDATE_VISIBILITY_MCP_SERVER_KEY)).addStep(newIndexMcpServerAfterVisibilityUpdateStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY)}function newLoadMcpServerForVisibilityUpdateStep(store){return{name:"LoadMcpServerForVisibilityUpdate",async execute(ctx){let input=ctx.input,mcpServer;try{mcpServer=await store.getResource(ctx.apiResourceKind,input.resourceId,McpServerSchema)}catch{throw notFoundError("mcp_server",input.resourceId)}ctx.set(UPDATE_VISIBILITY_MCP_SERVER_KEY,mcpServer)}}}function newSetMcpServerVisibilityStep(){return{name:"SetMcpServerVisibility",execute(ctx){let mcpServer=ctx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY);mcpServer.metadata!==void 0&&(mcpServer.metadata.visibility=ctx.input.visibility),setAuditFieldsForUpdate(McpServerSchema,mcpServer,"status_audit",ctx.callerIdentity)}}}function newPersistMcpServerForVisibilityUpdateStep(store){return{name:"PersistMcpServerForVisibilityUpdate",async execute(ctx){let mcpServer=ctx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY);try{await store.saveResource(ctx.apiResourceKind,mcpServer.metadata?.id??"",McpServerSchema,mcpServer)}catch(error2){throw internalError(error2,"failed to save mcp server")}}}}function newIndexMcpServerAfterVisibilityUpdateStep(store,logger2){return{name:"IndexMcpServerAfterVisibilityUpdate",async execute(ctx){let mcpServer=ctx.get(UPDATE_VISIBILITY_MCP_SERVER_KEY),entry=mcpServerSearchExtractor.getSearchIndexEntry(mcpServer);if(entry===void 0){logger2.warn("IndexMcpServerAfterVisibilityUpdate: extractor returned nil, skipping",{id:mcpServer.metadata?.id??""});return}try{await store.upsertSearchIndex(ctx.apiResourceKind,mcpServer.metadata?.id??"",entry)}catch(error2){logger2.warn("IndexMcpServerAfterVisibilityUpdate: failed (best-effort)",{id:mcpServer.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}}}async function get19(deps,id,ctx){let reqCtx=new RequestContext(McpServerQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("mcpserver-get",deps.logger).addStep(newAuthorizeStep(McpServerQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,McpServerSchema)).addStep(newEnrichOAuthStatusStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function getByReference11(deps,ref,ctx){let reqCtx=new RequestContext(McpServerQueryController.method.getByReference.input,ref,callerIdentityOf(ctx),kindOf18(ctx));return await newPipeline("mcpserver-get-by-reference",deps.logger).addStep(newAuthorizeStep(McpServerQueryController.method.getByReference,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadByReferenceStep(deps.store,McpServerSchema)).addStep(newAuthorizeResolvedTargetStep(deps.authorizer,loadedTargetAsMethod(McpServerQueryController.method.get))).addStep(newEnrichOAuthStatusStep(deps.store,deps.logger)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}function registerPlatformServices(router,deps){router.service(PlatformQueryController,{getServerInfo:()=>getServerInfo(deps),getLicenseStatus:()=>getLicenseStatus(deps),getRunnerBootstrapConfig:(_input,ctx)=>getRunnerBootstrapConfig(deps,ctx),getRunnerScopedToken:(input,ctx)=>getRunnerScopedToken(deps,input,ctx)})}function getServerInfo(deps){return create2(GetServerInfoOutputSchema,{edition:deps.edition,version:deps.version,authenticationRequired:deps.authenticationRequired})}async function getLicenseStatus(deps){let now=deps.now(),report=await deps.licenseStatus.status(now),output=create2(GetLicenseStatusOutputSchema,{state:report.state,checkedAt:timestampFromDate(now)});switch(report.state){case LicenseState.absent:return output;case LicenseState.invalid:return output.keyId=report.keyId,output;case LicenseState.valid:case LicenseState.expiring:case LicenseState.grace:case LicenseState.expired:return output.keyId=report.keyId,output.claims=report.claims,output;default:{let exhaustive=report;throw new Error(`unhandled license report: ${JSON.stringify(exhaustive)}`)}}}async function getRunnerBootstrapConfig(deps,ctx){let output=create2(GetRunnerBootstrapConfigOutputSchema,{temporalAddress:deps.temporalHostPort,temporalNamespace:deps.temporalNamespace}),bootstrapCredentials=deps.runnerAuthService.bootstrapCredentials?.bind(deps.runnerAuthService);if(bootstrapCredentials===void 0)return output;try{let credentials=await bootstrapCredentials(callerIdentityOf(ctx));credentials.accessToken!==void 0&&(output.runnerAccessToken=credentials.accessToken.token,output.tokenType="Bearer",output.runnerAccessTokenExpiresInSeconds=credentials.accessToken.expiresInSeconds),credentials.payloadKeys!==void 0&&(output.payloadEncryptionKey=credentials.payloadKeys.keyBase64,output.payloadEncryptionKeyId=credentials.payloadKeys.keyId,output.payloadEncryptionSecondaryKey=credentials.payloadKeys.secondaryKeyBase64??"",output.payloadEncryptionSecondaryKeyId=credentials.payloadKeys.secondaryKeyId??"")}catch(error2){deps.logger.warn("Bootstrap credentials unavailable \u2014 answering coordinates without them",{error:error2 instanceof Error?error2.message:String(error2)})}return output}async function getRunnerScopedToken(deps,input,ctx){let exchange=deps.runnerAuthService.exchangeScopedToken?.bind(deps.runnerAuthService);if(exchange!==void 0){let minted=await exchange(exchangeRequestOf(input),callerIdentityOf(ctx));return minted.minted?create2(GetRunnerScopedTokenOutputSchema,{runnerScopedToken:minted.token,tokenType:"Bearer",expiresInSeconds:minted.expiresInSeconds}):create2(GetRunnerScopedTokenOutputSchema)}let executionId;switch(input.scope.case){case"agentExecutionId":executionId=input.scope.value;break;case"workflowExecutionId":executionId=input.scope.value;break;case"poolClaim":case"renewal":case void 0:return create2(GetRunnerScopedTokenOutputSchema);default:{let exhaustive=input.scope;throw new Error(`unhandled scope arm: ${JSON.stringify(exhaustive)}`)}}if(executionId===""||!deps.runnerAuthService.isEnabled(TOKEN_TYPE_EXECUTION_SCOPED))return create2(GetRunnerScopedTokenOutputSchema);try{let minted=deps.runnerAuthService.mint(TOKEN_TYPE_EXECUTION_SCOPED,executionId,0);return create2(GetRunnerScopedTokenOutputSchema,{runnerScopedToken:minted.token,tokenType:"Bearer",expiresInSeconds:minted.ttlSeconds})}catch(error2){return deps.logger.warn("failed to mint runner scoped token \u2014 answering not-minted",{executionId,error:error2 instanceof Error?error2.message:String(error2)}),create2(GetRunnerScopedTokenOutputSchema)}}function exchangeRequestOf(input){switch(input.scope.case){case"agentExecutionId":return{arm:"agent-execution",executionId:input.scope.value};case"workflowExecutionId":return{arm:"workflow-execution",executionId:input.scope.value};case"poolClaim":return{arm:"pool-claim",sessionId:input.scope.value.sessionId};case"renewal":return{arm:"renewal"};case void 0:return{arm:"unset"};default:{let exhaustive=input.scope;throw new Error(`unhandled scope arm: ${JSON.stringify(exhaustive)}`)}}}var SERVER_VERSION="3.38.0";var file_ai_stigmer_agentic_session_v1_io=fileDesc("CiZhaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9pby5wcm90bxIdYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEiIgoJU2Vzc2lvbklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEiIAoHQWdlbnRJZBIVCgV2YWx1ZRgBIAEoCUIGukgDyAEBInQKC1Nlc3Npb25MaXN0EhMKC3RvdGFsX3BhZ2VzGAEgASgFEjcKB2VudHJpZXMYAiADKAsyJi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uEhcKD25leHRfcGFnZV90b2tlbhgDIAEoCSJgChNMaXN0U2Vzc2lvbnNSZXF1ZXN0EhoKCXBhZ2Vfc2l6ZRgBIAEoBUIHukgEGgIoABISCgpwYWdlX3Rva2VuGAIgASgJEgwKBHRhZ3MYAyADKAkSCwoDb3JnGAQgASgJIncKIkxpc3RTZXNzaW9uc0J5QWdlbnRJbnN0YW5jZVJlcXVlc3QSIQoRYWdlbnRfaW5zdGFuY2VfaWQYASABKAlCBrpIA8gBARIaCglwYWdlX3NpemUYAiABKAVCB7pIBBoCKAASEgoKcGFnZV90b2tlbhgDIAEoCSJqChxMaXN0U2Vzc2lvbnNCeUNoYW5uZWxSZXF1ZXN0EhoKCmNoYW5uZWxfaWQYASABKAlCBrpIA8gBARIaCglwYWdlX3NpemUYAiABKAVCB7pIBBoCKAASEgoKcGFnZV90b2tlbhgDIAEoCSJCChtVcGRhdGVTZXNzaW9uU3ViamVjdFJlcXVlc3QSEgoCaWQYASABKAlCBrpIA8gBARIPCgdzdWJqZWN0GAIgASgJYgZwcm90bzM",[file_ai_stigmer_agentic_session_v1_api,file_buf_validate_validate]),SessionIdSchema=messageDesc2(file_ai_stigmer_agentic_session_v1_io,0);var SessionListSchema=messageDesc2(file_ai_stigmer_agentic_session_v1_io,2);var file_ai_stigmer_agentic_session_v1_command=fileDesc("CithaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9jb21tYW5kLnByb3RvEh1haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MTLtBQoYU2Vzc2lvbkNvbW1hbmRDb250cm9sbGVyElcKBWFwcGx5EiYuYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuU2Vzc2lvbhomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24SpQEKBmNyZWF0ZRImLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24aJi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uIkvCuBhHCAgQHiIMbWV0YWRhdGEub3JnKjN1bmF1dGhvcml6ZWQgdG8gY3JlYXRlIHNlc3Npb24gaW4gdGhpcyBvcmdhbml6YXRpb24SjwEKBnVwZGF0ZRImLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24aJi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uIjXCuBgxCAIQKiILbWV0YWRhdGEuaWQqHnVuYXV0aG9yaXplZCB0byB1cGRhdGUgc2Vzc2lvbhKpAQoNdXBkYXRlU3ViamVjdBI6LmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlVwZGF0ZVNlc3Npb25TdWJqZWN0UmVxdWVzdBomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24iNMK4GDAIAhAqIgJpZComdW5hdXRob3JpemVkIHRvIHVwZGF0ZSBzZXNzaW9uIHN1YmplY3QSiwEKBmRlbGV0ZRIoLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb25JZBomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24iL8K4GCsIAxAqIgV2YWx1ZSoedW5hdXRob3JpemVkIHRvIGRlbGV0ZSBzZXNzaW9uGgSg/ysqYgZwcm90bzM",[file_ai_stigmer_agentic_session_v1_api,file_ai_stigmer_agentic_session_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),SessionCommandController=serviceDesc(file_ai_stigmer_agentic_session_v1_command,0);var file_ai_stigmer_agentic_session_v1_query=fileDesc("CilhaS9zdGlnbWVyL2FnZW50aWMvc2Vzc2lvbi92MS9xdWVyeS5wcm90bxIdYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEyoQQKFlNlc3Npb25RdWVyeUNvbnRyb2xsZXIShQEKA2dldBIoLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb25JZBomLmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLlNlc3Npb24iLMK4GCgIARAqIgV2YWx1ZSobdW5hdXRob3JpemVkIHRvIGdldCBzZXNzaW9uEmwKBGxpc3QSMi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5MaXN0U2Vzc2lvbnNSZXF1ZXN0GiouYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuU2Vzc2lvbkxpc3QiBNC4GAESigEKE2xpc3RCeUFnZW50SW5zdGFuY2USQS5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5MaXN0U2Vzc2lvbnNCeUFnZW50SW5zdGFuY2VSZXF1ZXN0GiouYWkuc3RpZ21lci5hZ2VudGljLnNlc3Npb24udjEuU2Vzc2lvbkxpc3QiBNC4GAESfgoNbGlzdEJ5Q2hhbm5lbBI7LmFpLnN0aWdtZXIuYWdlbnRpYy5zZXNzaW9uLnYxLkxpc3RTZXNzaW9uc0J5Q2hhbm5lbFJlcXVlc3QaKi5haS5zdGlnbWVyLmFnZW50aWMuc2Vzc2lvbi52MS5TZXNzaW9uTGlzdCIE0LgYARoEoP8rKmIGcHJvdG8z",[file_ai_stigmer_agentic_session_v1_api,file_ai_stigmer_agentic_session_v1_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),SessionQueryController=serviceDesc(file_ai_stigmer_agentic_session_v1_query,0);function runAgentInstanceDeniedMessage2(agentInstanceId){return`unauthorized to run agent instance '${agentInstanceId}'`}function sessionRunTarget(session){let agentInstanceId=session.spec?.agentInstanceId??"";if(agentInstanceId!=="")return{...RUN_GATE_CHECKS.agentInstance,resourceId:agentInstanceId,deniedMessage:runAgentInstanceDeniedMessage2(agentInstanceId)}}var sessionSearchExtractor={kind:ApiResourceKind.session,schema:SessionSchema,getSearchSummary(resource){return resource.spec?.subject??""},toSearchResult(resource,score){let session=resource;return buildSearchResult({kind:ApiResourceKind.session,metadata:session.metadata,summary:session.spec?.subject??"",score,createdAt:session.status?.audit?.specAudit?.createdAt,updatedAt:session.status?.audit?.specAudit?.updatedAt})},getSearchIndexEntry(resource){let session=resource,metadata=session.metadata;if(metadata!==void 0)return{name:metadata.name,description:session.spec?.subject??"",tags:metadata.tags.join(" "),org:metadata.org,visibility:ApiResourceVisibility[metadata.visibility]??"",createdAt:Number(session.status?.audit?.specAudit?.createdAt?.seconds??0n)}}};var SESSION_CHANNEL_ID_LABEL="stigmer.ai/channel-id",sessionListIndex=declareListIndex({kind:ApiResourceKind.session,schema:SessionSchema,revision:1,keys:{agent_instance:field2("spec.agent_instance_id"),channel:label(SESSION_CHANNEL_ID_LABEL)}});var LIST_RESULT_KEY8="listResult";function newValidateHarnessImmutabilityStep(){return{name:"ValidateHarnessImmutability",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)return;let existingSpec=existing.spec;if(existingSpec===void 0||existingSpec.harnessStateId==="")return;let inputSpec=ctx.input.spec;if(inputSpec===void 0)return;let existingHarness=existingSpec.harness,inputHarness=inputSpec.harness;if(existingHarness===Harness.UNSPECIFIED&&(existingHarness=Harness.NATIVE),inputHarness===Harness.UNSPECIFIED&&(inputHarness=Harness.NATIVE),inputHarness!==existingHarness)throw failedPreconditionError("session harness cannot be changed after the first execution \u2014 each harness owns its conversation state independently")}}}var EXECUTION_TARGET_GO_NAMES={[ExecutionTarget.UNSPECIFIED]:"EXECUTION_TARGET_UNSPECIFIED",[ExecutionTarget.LOCAL]:"EXECUTION_TARGET_LOCAL",[ExecutionTarget.CLOUD]:"EXECUTION_TARGET_CLOUD"};function newValidateExecutionTargetImmutabilityStep(temporalConfig){return{name:"ValidateExecutionTargetImmutability",execute(ctx){let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0)return;let existingSpec=existing.spec;if(existingSpec===void 0||existingSpec.harnessStateId==="")return;let inputSpec=ctx.input.spec;if(inputSpec===void 0)return;let existingTarget=temporalConfig.resolveExecutionTarget(existingSpec.executionTarget),inputTarget=temporalConfig.resolveExecutionTarget(inputSpec.executionTarget);if(inputTarget!==existingTarget)throw failedPreconditionError(`session execution_target cannot be changed after the first execution (${EXECUTION_TARGET_GO_NAMES[existingTarget]} \u2192 ${EXECUTION_TARGET_GO_NAMES[inputTarget]}; unset resolves to the deployment default, ${temporalConfig.defaultExecutionTarget}) \u2014 workspace state may not be portable between local and cloud environments`)}}}function newRecordHarnessStateHistoryStep(){return{name:"RecordHarnessStateHistory",execute(ctx){let mergedSpec=ctx.newState.spec;if(mergedSpec===void 0)return;let existing=ctx.get(EXISTING_RESOURCE_KEY);if(existing===void 0||existing.spec===void 0)return;let existingSpec=existing.spec,history=[...existingSpec.harnessStateIdHistory],previousId=existingSpec.harnessStateId;previousId!==""&&previousId!==mergedSpec.harnessStateId&&!history.includes(previousId)&&history.push(previousId),mergedSpec.harnessStateIdHistory=history}}}function isActiveExecutionPhase(phase){switch(phase){case ExecutionPhase.EXECUTION_PENDING:case ExecutionPhase.EXECUTION_IN_PROGRESS:case ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL:case ExecutionPhase.EXECUTION_PAUSED:return!0;default:return!1}}async function listExecutionsBySession(store,logger2,sessionId){let rows;try{rows=await store.queryResources(agentExecutionListIndex,{anyKey:[{name:"session",value:sessionId}]})}catch(error2){throw internalError(error2,"failed to list agent executions")}let executions=[];for(let row of rows)try{executions.push(fromBinary2(AgentExecutionSchema,row.data))}catch(error2){logger2.warn("Failed to unmarshal execution, skipping",{error:error2 instanceof Error?error2.message:String(error2)})}return executions}function newRejectDeleteWithActiveExecutionsStep(store,logger2){return{name:"RejectDeleteWithActiveExecutions",async execute(ctx){let sessionId=requireSessionId(ctx),executions=await listExecutionsBySession(store,logger2,sessionId),activeCount=0;for(let execution of executions)isActiveExecutionPhase(execution.status?.phase??ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED)&&activeCount++;if(activeCount>0)throw failedPreconditionError(`session has ${activeCount} active execution(s); cancel them or wait for completion before deleting`)}}}function newCascadeDeleteAgentExecutionsStep(store,logger2){return{name:"CascadeDeleteAgentExecutions",async execute(ctx){let sessionId=requireSessionId(ctx),executions=await listExecutionsBySession(store,logger2,sessionId);if(executions.length!==0){for(let execution of executions){let executionId=execution.metadata?.id??"";try{await store.deleteResource(ApiResourceKind.agent_execution,executionId)}catch(error2){throw internalError(error2,`failed to cascade-delete execution ${executionId} of session ${sessionId}`)}try{await store.deleteSearchIndex(ApiResourceKind.agent_execution,executionId)}catch(error2){logger2.warn("CascadeDeleteAgentExecutions: failed to remove search index entry (best-effort)",{executionId,error:error2 instanceof Error?error2.message:String(error2)})}}logger2.info("Cascade-deleted executions of session",{sessionId,count:executions.length})}}}}function requireSessionId(ctx){let sessionId=ctx.get(RESOURCE_ID_KEY);if(typeof sessionId!="string"||sessionId==="")throw internalError(new Error("session id not found in context (ExtractResourceId must run first)"),"session id not found in context (ExtractResourceId must run first)");return sessionId}function newListAllSessionsStep(store,logger2,listReadScope){return{name:"ListAllSessions",async execute(ctx){let input=ctx.input,page=await readSessionPage(store,logger2,listReadScope,ctx.callerIdentity,ctx.input,{query:{org:input.org},fingerprint:{lane:"session.list",org:input.org,tags:input.tags}});ctx.set(LIST_RESULT_KEY8,page)}}}function newFilterByAgentInstanceStep(store,logger2,listReadScope){return{name:"FilterByAgentInstance",async execute(ctx){let agentInstanceId=ctx.input.agentInstanceId;if(agentInstanceId==="")throw invalidArgumentError("agent_instance_id is required");let page=await readSessionPage(store,logger2,listReadScope,ctx.callerIdentity,ctx.input,{query:{anyKey:[{name:"agent_instance",value:agentInstanceId}]},fingerprint:{lane:"session.listByAgentInstance",agentInstanceId}});ctx.set(LIST_RESULT_KEY8,page)}}}function newAuthorizeChannelAccessStep(authorizer){return newAuthorizeResolvedTargetStep(authorizer,({input})=>input.channelId===""?[]:[{permission:IamPermission.can_view,resourceKind:ApiResourceKind.agent_channel,resourceId:input.channelId,deniedMessage:"unauthorized to list channel conversations"}],"AuthorizeChannelAccess")}function newFilterByChannelStep(store,logger2,listReadScope){return{name:"FilterByChannel",async execute(ctx){let channelId=ctx.input.channelId;if(channelId==="")throw invalidArgumentError("channel_id is required");let page=await readSessionPage(store,logger2,listReadScope,ctx.callerIdentity,ctx.input,{query:{anyKey:[{name:"channel",value:channelId}]},fingerprint:{lane:"session.listByChannel",channelId}});ctx.set(LIST_RESULT_KEY8,page)}}}async function readSessionPage(store,logger2,listReadScope,caller,request,lane){let page=await readListPage({store,declaration:sessionListIndex,query:lane.query,request,fingerprint:listPageFingerprint(lane.fingerprint),decode:data=>{try{return fromBinary2(SessionSchema,data)}catch(error2){logger2.warn("Failed to unmarshal session, skipping",{error:error2 instanceof Error?error2.message:String(error2)});return}},scope:sessions=>restrictListByReadScope(listReadScope,caller,ApiResourceKind.session,sessions,""),failure:"failed to list sessions"});return create2(SessionListSchema,{entries:page.entries,nextPageToken:page.nextPageToken,totalPages:page.nextPageToken===""?1:0})}function registerSessionServices(router,deps){router.service(SessionCommandController,{apply:(session,ctx)=>apply12(deps,session,ctx),create:(session,ctx)=>createSession(deps,session,ctx),update:(session,ctx)=>update15(deps,session,ctx),updateSubject:(req,ctx)=>updateSubject(deps,req,callerIdentityOf(ctx)),delete:(id,ctx)=>deleteSession(deps,id,ctx)}),router.service(SessionQueryController,{get:(id,ctx)=>get20(deps,id,ctx),list:(req,ctx)=>list10(deps,req,ctx),listByAgentInstance:(req,ctx)=>listByAgentInstance(deps,req,ctx),listByChannel:(req,ctx)=>listByChannel(deps,req,ctx)})}function kindOf19(ctx){return ctx.values.get(apiResourceKindKey)}async function createSession(deps,session,ctx){let reqCtx=new RequestContext(SessionSchema,session,callerIdentityOf(ctx),kindOf19(ctx)),builder2=newPipeline("session-create",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.create,deps.authorizer)).addStep(newAuthorizeRunTargetStep(deps.authorizer,sessionRunTarget)).addStep(newValidateProtoStep()).addStep(newValidateVisibilityStep()).addStep(newResolveSlugStep()).addStep(newCheckDuplicateStep(deps.store)).addStep(newBuildNewStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newNormalizeReferencesStep()).addStep(newValidateReferencesStep(deps.store));for(let step of stepsForSlot(deps.gateSteps,"session-create:pre-side-effect-gate"))builder2.addStep(step);return await builder2.addStep(newPersistStep(deps.store)).addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle,deps.logger)).addStep(newIndexSearchStep(deps.store,sessionSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function update15(deps,session,ctx){let reqCtx=new RequestContext(SessionSchema,session,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-update",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.update,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadExistingStep(deps.store)).addStep(newValidateHarnessImmutabilityStep()).addStep(newValidateExecutionTargetImmutabilityStep(deps.temporalConfig)).addStep(newBuildUpdateStateStep()).addStep(newGuardReservedLabelsStep(deps.authorizer)).addStep(newRecordHarnessStateHistoryStep()).addStep(newPersistStep(deps.store)).addStep(newIndexSearchStep(deps.store,sessionSearchExtractor,deps.logger)).build().execute(reqCtx),reqCtx.newState}async function apply12(deps,session,ctx){let reqCtx=new RequestContext(SessionSchema,session,callerIdentityOf(ctx),kindOf19(ctx));await newPipeline("session-apply",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.apply,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newResolveSlugStep()).addStep(newLoadForApplyStep(deps.store)).build().execute(reqCtx);let shouldCreate=reqCtx.get(SHOULD_CREATE_KEY);if(typeof shouldCreate!="boolean")throw internalError(new Error("apply pipeline did not set shouldCreate flag"),"apply operation failed to determine create vs update");return shouldCreate?createSession(deps,session,ctx):update15(deps,withResolvedApplyId(SessionSchema,session,reqCtx),ctx)}async function deleteSession(deps,sessionId,ctx){let reqCtx=new RequestContext(SessionCommandController.method.delete.input,sessionId,callerIdentityOf(ctx),kindOf19(ctx));await newPipeline("session-delete",deps.logger).addStep(newAuthorizeStep(SessionCommandController.method.delete,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newExtractResourceIdStep()).addStep(newLoadExistingForDeleteStep(deps.store,SessionSchema)).addStep(newRejectDeleteWithActiveExecutionsStep(deps.store,deps.logger)).addStep(newCascadeDeleteAgentExecutionsStep(deps.store,deps.logger)).addStep(newDeleteResourceStep(deps.store)).addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle,deps.logger)).addStep(newDeleteSearchIndexStep(deps.store,deps.logger)).build().execute(reqCtx);let deleted=reqCtx.get(EXISTING_RESOURCE_KEY);if(deleted===void 0)throw internalError(new Error("deleted session not found in context"),"deleted session not found in context");return await deprovisionSessionSandboxBestEffort(deps.sandboxLane,deps.logger,deleted.metadata?.id??""),deleted}async function updateSubject(deps,req,identity2){if(req.id==="")throw invalidArgumentError("id is required");let kind=ApiResourceKind.session,session;try{session=await deps.store.getResource(kind,req.id,SessionSchema)}catch(error2){throw error2 instanceof ResourceNotFoundError?notFoundError("session",req.id):internalError(error2,"failed to load session")}await authorizeDirect(SessionCommandController.method.updateSubject,deps.authorizer,identity2,req),session.spec===void 0&&(session.spec=create2(SessionSpecSchema,{})),session.spec.subject=req.subject,setAuditFieldsForUpdate(SessionSchema,session,"spec_audit",identity2);try{await deps.store.saveResource(kind,req.id,SessionSchema,session)}catch(error2){throw internalError(error2,"failed to persist session")}return await indexSessionSearch(deps,kind,session),session}async function indexSessionSearch(deps,kind,session){let entry=sessionSearchExtractor.getSearchIndexEntry(session);if(entry!==void 0)try{await deps.store.upsertSearchIndex(kind,session.metadata?.id??"",entry)}catch(error2){deps.logger.warn("UpdateSubject: failed to update search index (best-effort)",{id:session.metadata?.id??"",error:error2 instanceof Error?error2.message:String(error2)})}}async function get20(deps,id,ctx){let reqCtx=new RequestContext(SessionQueryController.method.get.input,id,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-get",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.get,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newLoadTargetStep(deps.store,SessionSchema)).build().execute(reqCtx),reqCtx.get(TARGET_RESOURCE_KEY)}async function list10(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.list.input,req,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-list",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.list,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newListAllSessionsStep(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY8))}async function listByAgentInstance(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.listByAgentInstance.input,req,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-list-by-agent-instance",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.listByAgentInstance,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newFilterByAgentInstanceStep(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY8))}async function listByChannel(deps,req,ctx){let reqCtx=new RequestContext(SessionQueryController.method.listByChannel.input,req,callerIdentityOf(ctx),kindOf19(ctx));return await newPipeline("session-list-by-channel",deps.logger).addStep(newAuthorizeStep(SessionQueryController.method.listByChannel,deps.authorizer)).addStep(newValidateProtoStep()).addStep(newAuthorizeChannelAccessStep(deps.authorizer)).addStep(newFilterByChannelStep(deps.store,deps.logger,deps.listReadScope)).build().execute(reqCtx),requireListResult2(reqCtx.get(LIST_RESULT_KEY8))}function requireListResult2(result){if(result===void 0)throw internalError(new Error("session list not found in context"),"session list not found in context");return result}var file_ai_stigmer_agentic_plugin_v1_io=fileDesc("CiVhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL2lvLnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxIiEKCFBsdWdpbklkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEi9wIKEVB1c2hQbHVnaW5SZXF1ZXN0EhMKA29yZxgBIAEoCUIGukgDyAEBEhAKCGFydGlmYWN0GAIgASgMEhsKE2FydGlmYWN0X3VwbG9hZF9yZWYYAyABKAkSUwoKdmlzaWJpbGl0eRgEIAEoDjI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVZpc2liaWxpdHlCCLpIBYIBAhABEg8KB21lc3NhZ2UYBSABKAk6twG6SLMBGrABCiNwdXNoX3BsdWdpbl9yZXF1ZXN0LmFydGlmYWN0X3NvdXJjZRJJZXhhY3RseSBvbmUgb2YgYXJ0aWZhY3QgKGlubGluZSBieXRlcykgb3IgYXJ0aWZhY3RfdXBsb2FkX3JlZiBtdXN0IGJlIHNldBo+KHRoaXMuYXJ0aWZhY3Quc2l6ZSgpID4gMCkgIT0gKHRoaXMuYXJ0aWZhY3RfdXBsb2FkX3JlZiAhPSAnJykiWAokQ3JlYXRlUGx1Z2luQXJ0aWZhY3RVcGxvYWRVcmxSZXF1ZXN0EhMKA29yZxgBIAEoCUIGukgDyAEBEhsKCnNpemVfYnl0ZXMYAiABKANCB7pIBCICIAAiWAoXUGx1Z2luQXJ0aWZhY3RVcGxvYWRVcmwSCwoDdXJsGAEgASgJEhsKE2FydGlmYWN0X3VwbG9hZF9yZWYYAiABKAkSEwoLdHRsX3NlY29uZHMYAyABKAUihQEKDFBsdWdpbk1lbWJlchJNCgRraW5kGAEgASgOMj8uYWkuc3RpZ21lci5jb21tb25zLmFwaXJlc291cmNlLmFwaXJlc291cmNla2luZC5BcGlSZXNvdXJjZUtpbmQSCgoCaWQYAiABKAkSDAoEc2x1ZxgDIAEoCRIMCgRuYW1lGAQgASgJIlgKGUxpc3RQbHVnaW5NZW1iZXJzUmVzcG9uc2USOwoHbWVtYmVycxgBIAMoCzIqLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luTWVtYmVyImsKF0xpc3RQbHVnaW5WZXJzaW9uc0lucHV0EhMKA29yZxgBIAEoCUIGukgDyAEBEhQKBHNsdWcYAiABKAlCBrpIA8gBARISCgpwYWdlX3Rva2VuGAMgASgJEhEKCXBhZ2Vfc2l6ZRgEIAEoBSLtAQoSUGx1Z2luVmVyc2lvbkVudHJ5Eg4KBmRpZ2VzdBgBIAEoCRItCglwdXNoZWRfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEkgKCXB1c2hlZF9ieRgDIAEoCzI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0QWN0b3ISCwoDdGFnGAQgASgJEhIKCmlzX2N1cnJlbnQYBSABKAgSDwoHbWVzc2FnZRgGIAEoCRIcChRhcnRpZmFjdF9zdG9yYWdlX2tleRgHIAEoCSKOAQoaTGlzdFBsdWdpblZlcnNpb25zUmVzcG9uc2USQgoIdmVyc2lvbnMYASADKAsyMC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpblZlcnNpb25FbnRyeRIXCg9uZXh0X3BhZ2VfdG9rZW4YAiABKAkSEwoLdG90YWxfY291bnQYAyABKAViBnByb3RvMw",[file_ai_stigmer_commons_apiresource_apiresourcekind_api_resource_kind,file_ai_stigmer_commons_apiresource_enum,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate,file_google_protobuf_timestamp]);var PushPluginRequestSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,1);var PluginArtifactUploadUrlSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,3),PluginMemberSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,4),ListPluginMembersResponseSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,5);var PluginVersionEntrySchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,7),ListPluginVersionsResponseSchema=messageDesc2(file_ai_stigmer_agentic_plugin_v1_io,8);var file_ai_stigmer_agentic_plugin_v1_command=fileDesc("CiphaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL2NvbW1hbmQucHJvdG8SHGFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEy2gUKF1BsdWdpbkNvbW1hbmRDb250cm9sbGVyEqEBCgRwdXNoEi8uYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QdXNoUGx1Z2luUmVxdWVzdBokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIkLCuBg+CCgQHiIDb3JnKjN1bmF1dGhvcml6ZWQgdG8gaW5zdGFsbCBwbHVnaW4gaW4gdGhpcyBvcmdhbml6YXRpb24S2AEKF2NyZWF0ZUFydGlmYWN0VXBsb2FkVXJsEkIuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5DcmVhdGVQbHVnaW5BcnRpZmFjdFVwbG9hZFVybFJlcXVlc3QaNS5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpbkFydGlmYWN0VXBsb2FkVXJsIkLCuBg+CCgQHiIDb3JnKjN1bmF1dGhvcml6ZWQgdG8gaW5zdGFsbCBwbHVnaW4gaW4gdGhpcyBvcmdhbml6YXRpb24SsAEKEHVwZGF0ZVZpc2liaWxpdHkSNS5haS5zdGlnbWVyLmNvbW1vbnMuYXBpcmVzb3VyY2UuVXBkYXRlVmlzaWJpbGl0eUlucHV0GiQuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW4iP8K4GDsIAhA6IgtyZXNvdXJjZV9pZCoodW5hdXRob3JpemVkIHRvIHVwZGF0ZSBwbHVnaW4gdmlzaWJpbGl0eRKGAQoGZGVsZXRlEiYuYWkuc3RpZ21lci5hZ2VudGljLnBsdWdpbi52MS5QbHVnaW5JZBokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIi7CuBgqCAMQOiIFdmFsdWUqHXVuYXV0aG9yaXplZCB0byBkZWxldGUgcGx1Z2luGgSg/ys6YgZwcm90bzM",[file_ai_stigmer_agentic_plugin_v1_api,file_ai_stigmer_agentic_plugin_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),PluginCommandController=serviceDesc(file_ai_stigmer_agentic_plugin_v1_command,0);var file_ai_stigmer_agentic_plugin_v1_query=fileDesc("CihhaS9zdGlnbWVyL2FnZW50aWMvcGx1Z2luL3YxL3F1ZXJ5LnByb3RvEhxhaS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxMsMEChVQbHVnaW5RdWVyeUNvbnRyb2xsZXISgAEKA2dldBImLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luSWQaJC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLlBsdWdpbiIrwrgYJwgBEDoiBXZhbHVlKhp1bmF1dGhvcml6ZWQgdG8gZ2V0IHBsdWdpbhJyCg5nZXRCeVJlZmVyZW5jZRI0LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZVJlZmVyZW5jZRokLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luIgTQuBgBEqQBCgtsaXN0TWVtYmVycxImLmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuUGx1Z2luSWQaNy5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLkxpc3RQbHVnaW5NZW1iZXJzUmVzcG9uc2UiNMK4GDAIARA6IgV2YWx1ZSojdW5hdXRob3JpemVkIHRvIGxpc3QgcGx1Z2luIG1lbWJlcnMShQEKDGxpc3RWZXJzaW9ucxI1LmFpLnN0aWdtZXIuYWdlbnRpYy5wbHVnaW4udjEuTGlzdFBsdWdpblZlcnNpb25zSW5wdXQaOC5haS5zdGlnbWVyLmFnZW50aWMucGx1Z2luLnYxLkxpc3RQbHVnaW5WZXJzaW9uc1Jlc3BvbnNlIgTQuBgBGgSg/ys6YgZwcm90bzM",[file_ai_stigmer_agentic_plugin_v1_api,file_ai_stigmer_agentic_plugin_v1_io,file_ai_stigmer_commons_apiresource_io,file_ai_stigmer_commons_apiresource_rpc_service_options,file_ai_stigmer_commons_rpc_method_options]),PluginQueryController=serviceDesc(file_ai_stigmer_agentic_plugin_v1_query,0);var PLATFORM_ARCHIVE_LIMITS={maxFiles:1e4,maxUncompressedSize:524288e3,maxCompressionRatio:100};var import_node_fs8=__toESM(require("node:fs"),1),import_node_path11=__toESM(require("node:path"),1),import_promises6=require("node:stream/promises"),SlotUnknownError=class extends Error{constructor(){super("upload reference unknown or expired"),this.name="SlotUnknownError"}},SlotConsumedError=class extends Error{constructor(){super("upload reference already carries an upload"),this.name="SlotConsumedError"}},SizeMismatchError=class extends Error{constructor(received,declared){super(`upload size mismatch: received ${received} bytes, declared ${declared}`),this.name="SizeMismatchError"}},STAGED_FILE_NAME=/^[0-9a-f]+\.zip$/,UploadSlots=class{root;stagingPrefix;ttlMs;maxSize;slots=new Map;stagingDir;now;constructor(root5,stagingPrefix,ttlMs,maxSize,now=Date.now){this.root=root5,this.stagingPrefix=stagingPrefix,this.ttlMs=ttlMs,this.maxSize=maxSize,this.stagingDir=import_node_path11.default.join(root5,stagingPrefix),import_node_fs8.default.rmSync(this.stagingDir,{recursive:!0,force:!0}),import_node_fs8.default.mkdirSync(this.stagingDir,{recursive:!0,mode:448}),this.now=now}reserve(key,declaredSize){if(declaredSize<=0||declaredSize>this.maxSize)throw new Error(`declared size ${declaredSize} outside (0, ${this.maxSize}]`);if(this.stagePath(key),this.slots.has(key))throw new Error(`staging key ${key} is already reserved`);return this.sweep(),this.slots.set(key,{declaredSize,expiresAtMs:this.now()+this.ttlMs,uploaded:!1}),{ttlMs:this.ttlMs}}async receive(key,body){let slot=this.slots.get(key);if(slot===void 0||this.now()>slot.expiresAtMs)throw new SlotUnknownError;if(slot.uploaded)throw new SlotConsumedError;let declared=slot.declaredSize,filePath=this.stagePath(key),written=0;try{await import_node_fs8.default.promises.mkdir(import_node_path11.default.dirname(filePath),{recursive:!0,mode:448}),await(0,import_promises6.pipeline)(body,limitBytes(declared+1,n3=>{written+=n3}),import_node_fs8.default.createWriteStream(filePath,{flags:"w",mode:384}))}catch(error2){throw await import_node_fs8.default.promises.rm(filePath,{force:!0}),new Error(`failed to receive upload: ${error2 instanceof Error?error2.message:String(error2)}`)}if(written!==declared)throw await import_node_fs8.default.promises.rm(filePath,{force:!0}),new SizeMismatchError(written,declared);let current=this.slots.get(key);if(current===void 0||this.now()>current.expiresAtMs)throw await import_node_fs8.default.promises.rm(filePath,{force:!0}),new SlotUnknownError;current.uploaded=!0}sweep(){let nowMs=this.now();for(let[key,slot]of this.slots)nowMs>slot.expiresAtMs&&(this.slots.delete(key),import_node_fs8.default.rmSync(this.stagePath(key),{force:!0}))}stagePath(key){if(!key.startsWith(this.stagingPrefix))throw new Error(`staging key ${key} is outside ${this.stagingPrefix}`);let fileName=key.slice(this.stagingPrefix.length);if(!STAGED_FILE_NAME.test(fileName))throw new Error(`staging key ${key} does not name a staged archive`);return import_node_path11.default.join(this.root,key)}};function limitBytes(limit,onBytes){return async function*(source){let remaining=limit;for await(let chunk of source){if(remaining<=0)return;let slice=chunk.length<=remaining?chunk:chunk.subarray(0,remaining);remaining-=slice.length,onBytes(slice.length),yield slice}}}var ARTIFACT_BYTES_KEY="pushArtifactBytes";function newResolveArtifactSourceStep(staging,binding){return{name:"ResolveArtifactSource",async execute(ctx){let{artifact,artifactUploadRef}=binding.source(ctx.input);if(artifactUploadRef===""){ctx.set(ARTIFACT_BYTES_KEY,artifact);return}if(staging===void 0)throw failedPreconditionError(binding.laneNotConfigured);let data;try{data=await staging.consume(artifactUploadRef)}catch(error2){throw error2 instanceof SlotUnknownError?invalidArgumentError(`artifact_upload_ref not usable: ${error2.message} \u2014 request a new upload URL via createArtifactUploadUrl`):error2}ctx.set(ARTIFACT_BYTES_KEY,data)}}}function newArchiveCurrentVersionStep(store,logger2,binding){return{name:binding.stepName,async execute(ctx){let resource=ctx.get(binding.resourceKey),versionHash=binding.headHashOf(resource);if(versionHash==="")return;let tag2=binding.liveTagOf(resource),resourceId=metadataOf(resource)?.id??"",idField=`${binding.noun}Id`,alreadyArchived=!1;try{await store.getAuditByHash(ctx.apiResourceKind,resourceId,versionHash,binding.schema),alreadyArchived=!0}catch(error2){error2 instanceof AuditNotFoundError||logger2.warn(`Could not check for an existing archived ${binding.noun} version \u2014 archiving anyway`,{[idField]:resourceId,versionHash,error:error2 instanceof Error?error2.message:String(error2)})}if(!alreadyArchived)try{await store.saveAudit(ctx.apiResourceKind,resourceId,binding.schema,resource,versionHash,"")}catch(error2){logger2.error(`Failed to archive ${binding.noun} version \u2014 reverting the version hash to maintain the audit-resolvability invariant`,{[idField]:resourceId,versionHash,error:error2 instanceof Error?error2.message:String(error2)}),binding.clearHeadHash(resource);return}if(tag2!=="")try{await store.setAuditTag(ctx.apiResourceKind,resourceId,versionHash,tag2)}catch(error2){logger2.error(`Archived ${binding.noun} version but failed to assign its tag \u2014 clearing the live tag to stay consistent with the audit column`,{[idField]:resourceId,versionHash,tag:tag2,error:error2 instanceof Error?error2.message:String(error2)}),binding.clearLiveTag(resource)}alreadyArchived?logger2.info(`${capitalize(binding.noun)} version content already archived \u2014 repointed head without a new history row`,{[idField]:resourceId,versionHash,tag:tag2}):logger2.info(`Archived ${binding.noun} version to audit history`,{[idField]:resourceId,versionHash,tag:tag2})}}}function newDeleteVersionArchivesStep(store,logger2,binding){return{name:binding.stepName,async execute(ctx){let resourceId=ctx.get(RESOURCE_ID_KEY);if(typeof resourceId!="string")throw new Error("resource id not found in context (ExtractResourceIdStep must run first)");let idField=`${binding.noun}Id`;try{let deletedCount=await store.deleteAuditByResourceId(ctx.apiResourceKind,resourceId);deletedCount>0&&logger2.info(`Deleted archive records for ${binding.noun}`,{[idField]:resourceId,count:deletedCount})}catch(error2){logger2.warn(`failed to delete ${binding.noun} archives (best-effort)`,{[idField]:resourceId,error:error2 instanceof Error?error2.message:String(error2)})}}}}function capitalize(word){return word.charAt(0).toUpperCase()+word.slice(1)}var HASH_PATTERN=/^[a-f0-9]{64}$/;function isVersionHash(version){return HASH_PATTERN.test(version)}function newLoadByReferenceWithVersionStep(store,binding,stepName){return{name:stepName,async execute(ctx){let ref=ctx.input;if(ref.slug==="")throw invalidArgumentError("slug is required in reference");if(requireOrgForReference(ctx.apiResourceKind,ref.org),ref.kind!==ApiResourceKind.api_resource_kind_unknown&&ref.kind!==binding.kind)throw invalidArgumentError(`kind mismatch: expected ${ApiResourceKind[binding.kind]}, got ${ApiResourceKind[ref.kind]}`);let head;try{head=await findResourceBySlug(store,ctx.apiResourceKind,binding.schema,ref.slug,ref.org)}catch(error2){throw internalError(error2,`failed to list ${binding.noun}s`)}if(head===void 0)throw notFoundError(binding.noun,ref.slug);let version=ref.version.trim();if(version===""||version==="latest"){ctx.set(TARGET_RESOURCE_KEY,head);return}if(headMatchesVersion(binding,head,version)){ctx.set(TARGET_RESOURCE_KEY,head);return}let archived=await findAuditByVersion(store,ctx.apiResourceKind,binding.schema,idOf(head),version);if(archived===void 0)throw notFoundError(`${binding.noun} version`,`${ref.slug}:${version}`);ctx.set(TARGET_RESOURCE_KEY,archived)}}}function headMatchesVersion(binding,head,version){if(isVersionHash(version))return binding.headHashOf(head)===version;let liveTag=binding.liveTagOf(head);return liveTag!==""&&liveTag===version}async function findAuditByVersion(store,kind,schema2,resourceId,version){if(isVersionHash(version))try{return await store.getAuditByHash(kind,resourceId,version,schema2)}catch(error2){if(error2 instanceof AuditNotFoundError)return;throw internalError(error2,"failed to query audit by hash")}try{return await store.getAuditByTag(kind,resourceId,version,schema2)}catch(error2){if(error2 instanceof AuditNotFoundError)return;throw internalError(error2,"failed to query audit by tag")}}var DEFAULT_PAGE_SIZE=50,MAX_PAGE_SIZE=100,LIST_VERSIONS_RESOURCE_ID_KEY="listVersionsResourceId",LIST_VERSIONS_HEAD_HASH_KEY="listVersionsHeadHash",LIST_VERSIONS_RESPONSE_KEY="listVersionsResponse";function versionHistoryTarget(kind,deniedMessage,idKey=LIST_VERSIONS_RESOURCE_ID_KEY){return ctx=>{let resourceId=ctx.get(idKey);if(typeof resourceId!="string"||resourceId==="")throw new Error(`ListVersions: no resolved resource id under ${idKey}; the slug resolver must run first`);return[{permission:IamPermission.can_view,resourceKind:kind,resourceId,deniedMessage}]}}function newResolveBySlugForVersionsStep(store,binding,stepName){return{name:stepName,async execute(ctx){let req=binding.input(ctx.input),head;try{head=await findResourceBySlug(store,ctx.apiResourceKind,binding.schema,req.slug,req.org)}catch(error2){throw internalError(error2,`failed to search for ${binding.noun}`)}if(head===void 0)throw notFoundError(binding.noun,`${req.slug} (org: ${req.org})`);ctx.set(LIST_VERSIONS_RESOURCE_ID_KEY,idOf(head)),ctx.set(LIST_VERSIONS_HEAD_HASH_KEY,binding.headHashOf(head))}}}function newLoadAndMapVersionsStep(store,binding,stepName){return{name:stepName,async execute(ctx){let req=binding.input(ctx.input),resourceId=ctx.get(LIST_VERSIONS_RESOURCE_ID_KEY),records;try{records=await store.listAuditRecords(ctx.apiResourceKind,resourceId)}catch(error2){throw internalError(error2,"failed to load version history")}let headHash=ctx.get(LIST_VERSIONS_HEAD_HASH_KEY),currentMarked=!1,entries=[];for(let record2 of records){let snapshot;try{snapshot=fromBinary2(binding.schema,record2.data)}catch{continue}let isCurrent=!currentMarked&&headHash!==""&&binding.headHashOf(snapshot)===headHash;currentMarked=currentMarked||isCurrent,entries.push(binding.mapEntry(snapshot,isCurrent,record2.tag))}let pageSize=req.pageSize;pageSize<=0&&(pageSize=DEFAULT_PAGE_SIZE),pageSize>MAX_PAGE_SIZE&&(pageSize=MAX_PAGE_SIZE);let startIndex=0;req.pageToken!==""&&(startIndex=decodePageToken(req.pageToken));let pageEntries=[],nextPageToken="";if(startIndex<entries.length){let end=Math.min(startIndex+pageSize,entries.length);pageEntries=entries.slice(startIndex,end),end<entries.length&&(nextPageToken=Buffer.from(String(end)).toString("base64"))}ctx.set(LIST_VERSIONS_RESPONSE_KEY,binding.response(pageEntries,nextPageToken,entries.length))}}}function decodePageToken(token){let decoded=Buffer.from(token,"base64");if(decoded.toString("base64")!==token)throw invalidArgumentError("invalid page_token");let text2=decoded.toString("utf8"),index2=Number.parseInt(text2,10);if(!Number.isSafeInteger(index2)||String(index2)!==text2||index2<0)throw invalidArgumentError("invalid page_token");return index2}function idOf(resource){return metadataOf(resource)?.id??""}var PLUGIN_ARTIFACT_KEY_PREFIX="plugins/",VERSION_TAG_PATTERN=/^[a-zA-Z0-9._-]+$/,BUILT_IN_SUB_AGENT_NAMES=new Set(["explore","shell","general-purpose"]);var TRANSFER_LANE_NOT_CONFIGURED="plugin artifact transfer lane is not configured on this server",SERVER_WARNING_KINDS={componentIgnored:"component-ignored",memberAdopted:"member-adopted",modelHintUnresolved:"model-hint-unresolved",subAgentNameBuiltin:"sub-agent-name-builtin",versionNotTaggable:"version-not-taggable"};var MEMBER_KINDS=[{kind:ApiResourceKind.skill,schema:SkillSchema},{kind:ApiResourceKind.mcp_server,schema:McpServerSchema},{kind:ApiResourceKind.agent,schema:AgentSchema},{kind:ApiResourceKind.workflow,schema:WorkflowSchema}];function memberOf(kind,metadata){return{kind,id:metadata.id,slug:metadata.slug,name:metadata.name,version:metadata.labels[PLUGIN_VERSION_LABEL]??"",system:isSystemContent(metadata)}}async function findMembers(store,pluginId,org){let members=[];for(let{kind,schema:schema2}of MEMBER_KINDS){let raws=await store.findAllByLabel(kind,PLUGIN_LABEL,pluginId,schema2);for(let raw of raws){let metadata=metadataOf(fromBinary2(schema2,raw));metadata!==void 0&&metadata.org===org&&members.push(memberOf(kind,metadata))}}return members}async function slugHolder(store,planned,org){let entry=MEMBER_KINDS.find(candidate=>candidate.kind===planned.kind);if(entry===void 0)throw new Error(`kind ${ApiResourceKind[planned.kind]} is not a plugin member kind`);let existing=await findResourceBySlug(store,planned.kind,entry.schema,planned.slug,org),metadata=existing===void 0?void 0:metadataOf(existing);return metadata===void 0?{held:!1}:{held:!0,byPlugin:pluginIdOf(metadata),holder:memberOf(planned.kind,metadata)}}function judgeSlug(holder,planned,pluginId){return holder.held?holder.byPlugin===pluginId?{kind:"ours",holder:holder.holder}:holder.byPlugin!==void 0?{kind:"held-by-plugin",holder:holder.holder,pluginId:holder.byPlugin}:holder.holder.system&&planned.system?{kind:"adopt",holder:holder.holder}:{kind:"held-unmanaged",holder:holder.holder}:{kind:"free"}}function membersConverge(existing,planned,digest3){if(existing.length!==planned.length)return!1;let byKey=new Map(existing.map(member2=>[`${member2.kind}:${member2.slug}`,member2]));return planned.every(member2=>{let found=byKey.get(`${member2.kind}:${member2.slug}`);return found!==void 0&&found.version===digest3})}function droppedMembers(existing,planned){let keep=new Set(planned.map(member2=>`${member2.kind}:${member2.slug}`));return existing.filter(member2=>!keep.has(`${member2.kind}:${member2.slug}`))}var PLUGIN_DOCUMENT_LIMITS={manifest:262144,mcpConfig:262144,skillMd:1048576,subAgent:1048576,overlay:1048576,logo:1048576,marketplace:1048576},encoder5=new TextEncoder,decoder3=new TextDecoder("utf-8",{fatal:!1});function comparePaths(a5,b7){return a5<b7?-1:a5>b7?1:0}function decodeUtf8(bytes){let text2=decoder3.decode(bytes);return text2.charCodeAt(0)===65279?text2.slice(1):text2}function isContainedPath(path14){return path14===""||path14.startsWith("/")||path14.includes("\\")?!1:path14.split("/").every(segment=>segment!==""&&segment!=="."&&segment!=="..")}var GLOB_CHARACTERS=/[*?[\]{}]/;function resolveDeclaredPath(value){if(GLOB_CHARACTERS.test(value))return{ok:!1,kind:"path-glob-unsupported"};if(value==="."||value==="./")return{ok:!0,path:""};if(!value.startsWith("./"))return{ok:!1,kind:"path-not-relative"};let trimmed=value.slice(2).replace(/\/+$/,"");return trimmed===""?{ok:!0,path:""}:isContainedPath(trimmed)?{ok:!0,path:trimmed}:{ok:!1,kind:"path-escapes-root"}}function joinPath(dir,name){return dir===""?name:`${dir}/${name}`}function basename(path14){let slash=path14.lastIndexOf("/");return slash===-1?path14:path14.slice(slash+1)}function dirname(path14){let slash=path14.lastIndexOf("/");return slash===-1?"":path14.slice(0,slash)}var PluginFileIndex=class{files;byPath;constructor(files){this.files=files,this.byPath=new Map(files.entries.map(entry=>[entry.path,entry]))}has(path14){return this.byPath.has(path14)}entry(path14){return this.byPath.get(path14)}filesUnder(dir){if(dir==="")return this.files.entries.map(entry=>entry.path);let prefix=`${dir}/`;return this.files.entries.filter(entry=>entry.path.startsWith(prefix)).map(entry=>entry.path)}isDirectory(dir){if(dir==="")return this.files.entries.length>0;let prefix=`${dir}/`;return this.files.entries.some(entry=>entry.path.startsWith(prefix))}childDirectories(dir){let prefix=dir===""?"":`${dir}/`,names=new Set;for(let entry of this.files.entries){if(!entry.path.startsWith(prefix))continue;let rest=entry.path.slice(prefix.length),slash=rest.indexOf("/");slash!==-1&&names.add(rest.slice(0,slash))}return[...names].sort(comparePaths)}childFiles(dir){let prefix=dir===""?"":`${dir}/`,names=[];for(let entry of this.files.entries){if(!entry.path.startsWith(prefix))continue;let rest=entry.path.slice(prefix.length);rest.includes("/")||names.push(rest)}return names.sort(comparePaths)}};function readText(index2,path14,cls,findings){let bytes=readBytes(index2,path14,cls,findings);return bytes===void 0?void 0:decodeUtf8(bytes)}function readBytes(index2,path14,cls,findings){let limit=PLUGIN_DOCUMENT_LIMITS[cls],entry=index2.entry(path14);if(entry===void 0)throw new Error(`plugin file '${path14}' is not listed`);if(entry.size>limit){findings.error("document-too-large",{path:path14,subject:String(entry.size),detail:String(limit)});return}let bytes=index2.files.read(path14);if(bytes.length>limit){findings.error("document-too-large",{path:path14,subject:String(bytes.length),detail:String(limit)});return}return bytes}function parseJsonObject2(text2,path14,kind,findings){let value;try{value=JSON.parse(text2)}catch(error2){findings.error(kind,{path:path14,detail:error2 instanceof Error?error2.message:String(error2)});return}if(!isJsonObject2(value)){findings.error(kind,{path:path14,detail:"the document is not a JSON object"});return}return value}function isJsonObject2(value){return typeof value=="object"&&value!==null&&!Array.isArray(value)}function isStringArray(value){return Array.isArray(value)&&value.every(item=>typeof item=="string")}function isStringRecord(value){return isJsonObject2(value)&&Object.values(value).every(item=>typeof item=="string")}function describeValue(value){return typeof value=="string"?value:JSON.stringify(value)}function fields(object){return Object.entries(object)}function optionalString(object,field3,path14,findings){let value=object[field3];if(value!==void 0){if(typeof value!="string"){findings.error("manifest-field-type",{path:path14,subject:field3,detail:"a string"});return}return value}}function optionalStringArray(object,field3,path14,findings){let value=object[field3];if(value!==void 0){if(!isStringArray(value)){findings.error("manifest-field-type",{path:path14,subject:field3,detail:"an array of strings"});return}return value}}function stringOrStringArray(object,field3,path14,findings){let value=object[field3];if(value!==void 0){if(typeof value=="string")return[value];if(isStringArray(value))return value;findings.error("manifest-field-type",{path:path14,subject:field3,detail:"a string or an array of strings"})}}function warnUnknownFields(object,known,path14,findings){for(let[name]of fields(object))known.has(name)||findings.warn("manifest-field-unknown",{path:path14,subject:name})}function readIdentity(object,path14,findings){let identity2={},name=optionalString(object,"name",path14,findings);name!==void 0&&(identity2.name=name);let version=optionalString(object,"version",path14,findings);version!==void 0&&(identity2.version=version);let description=optionalString(object,"description",path14,findings);description!==void 0&&(identity2.description=description);let homepage=optionalString(object,"homepage",path14,findings);homepage!==void 0&&(identity2.homepage=homepage);let repository=optionalString(object,"repository",path14,findings);repository!==void 0&&(identity2.repository=repository);let license=optionalString(object,"license",path14,findings);license!==void 0&&(identity2.license=license);let keywords=optionalStringArray(object,"keywords",path14,findings);keywords!==void 0&&(identity2.keywords=keywords);let author=readAuthor(object,path14,findings);return author!==void 0&&(identity2.author=author),identity2}function readAuthor(object,path14,findings){let value=object.author;if(value===void 0)return;if(!isJsonObject2(value)){findings.error("manifest-field-type",{path:path14,subject:"author",detail:"an object"});return}let author={},name=optionalString(value,"name",path14,findings);name!==void 0&&(author.name=name);let email=optionalString(value,"email",path14,findings);email!==void 0&&(author.email=email);let url=optionalString(value,"url",path14,findings);return url!==void 0&&(author.url=url),author}function readDeclaredPaths(object,field3,path14,findings){let values=stringOrStringArray(object,field3,path14,findings);if(values===void 0)return;let declared=[];for(let value of values){let resolved=resolveDeclaredPath(value);if(!resolved.ok){findings.error(resolved.kind,{path:path14,subject:value});continue}declared.push({path:resolved.path,manifest:path14})}return declared}function readMcpSources(object,field3,path14,dialect,findings){let value=object[field3];if(value===void 0)return[];let items=Array.isArray(value)?value:[value],sources=[];for(let item of items)if(typeof item=="string"){let resolved=resolveDeclaredPath(item);if(!resolved.ok){findings.error(resolved.kind,{path:path14,subject:item});continue}sources.push({kind:"file",path:resolved.path,dialect,manifest:path14})}else isJsonObject2(item)?sources.push({kind:"inline",manifest:path14,servers:item,dialect}):findings.error("manifest-field-type",{path:path14,subject:field3,detail:"a path, an object, or an array of either"});return sources}var IGNORED_FIELD_KINDS={hooks:"hooks",rules:"rules",commands:"commands",workflows:"workflows",outputStyles:"output-styles",lspServers:"lsp-servers",channels:"channels",dependencies:"dependencies",defaultEnabled:"default-enabled",minClientVersions:"min-client-versions",logo:"logo",apps:"apps"};function ignoredFieldComponents(object,path14){let ignored=[];for(let[name,value]of fields(object)){let kind=IGNORED_FIELD_KINDS[name];if(kind!==void 0&&ignored.push({kind,path:`${path14}#${name}`}),name==="experimental"&&isJsonObject2(value))for(let[sub]of fields(value)){let subKind=EXPERIMENTAL_KINDS[sub];subKind!==void 0&&ignored.push({kind:subKind,path:`${path14}#experimental.${sub}`})}}return ignored}var EXPERIMENTAL_KINDS={themes:"themes",monitors:"monitors",evals:"evals"},STIGMER_EXTENSION_NAMESPACE="ai.stigmer",STIGMER_EXTENSION_FIELDS=new Set(["displayName","logo","category"]);function extensionComponents(object,path14,findings){let value=object.extensions;if(value===void 0)return[];if(!isJsonObject2(value))return findings.warn("manifest-extensions-invalid",{path:path14}),[];let ignored=[];for(let[namespace,content]of fields(value)){if(isJsonObject2(content)&&fields(content).length===0)continue;let at2=`${path14}#extensions.${namespace}`;if(namespace===STIGMER_EXTENSION_NAMESPACE&&isJsonObject2(content)){content.logo!==void 0&&ignored.push({kind:"logo",path:`${at2}.logo`}),fields(content).some(([name])=>!STIGMER_EXTENSION_FIELDS.has(name))&&ignored.push({kind:"extension",path:at2});continue}ignored.push({kind:"extension",path:at2})}return ignored}var CLAUDE_KNOWN_FIELDS=new Set(["name","version","description","author","homepage","repository","license","keywords","skills","commands","agents","workflows","hooks","mcpServers","outputStyles","lspServers","experimental","userConfig","channels","dependencies","defaultEnabled"]),CLAUDE_DEFAULT_MCP_CONFIG=".mcp.json";function readClaudeManifest(object,path14,findings){return readClaudeShapedManifest(object,path14,"claude",CLAUDE_KNOWN_FIELDS,findings)}function readClaudeShapedManifest(object,path14,dialect,known,findings){warnUnknownFields(object,known,path14,findings);let identity2=readIdentity(object,path14,findings),skillPaths=readDeclaredPaths(object,"skills",path14,findings)??[],agentPaths=readDeclaredPaths(object,"agents",path14,findings),declaredMcp=readMcpSources(object,"mcpServers",path14,dialect,findings),manifest={dialect,path:path14,identity:identity2,skillPaths,mcpConfigs:declaredMcp,ignored:ignoredFieldComponents(object,path14)};return agentPaths!==void 0&&(manifest.agentPaths=agentPaths),object.userConfig!==void 0&&(manifest.variables={dialect:"claude",value:object.userConfig,manifest:path14}),manifest}var KNOWN_FIELDS=new Set([...CLAUDE_KNOWN_FIELDS,"apps","interface"]);function readCodexManifest(object,path14,findings){return readClaudeShapedManifest(object,path14,"codex",KNOWN_FIELDS,findings)}var KNOWN_FIELDS2=new Set(["name","displayName","description","version","minClientVersions","author","publisher","homepage","repository","license","logo","keywords","category","tags","commands","agents","skills","rules","hooks","variables","mcpServers"]);function readCursorManifest(object,path14,findings){warnUnknownFields(object,KNOWN_FIELDS2,path14,findings);let identity2=readIdentity(object,path14,findings),skillPaths=readDeclaredPaths(object,"skills",path14,findings)??[],agentPaths=readDeclaredPaths(object,"agents",path14,findings),manifest={dialect:"cursor",path:path14,identity:identity2,skillPaths,mcpConfigs:readMcpSources(object,"mcpServers",path14,"cursor",findings),ignored:ignoredFieldComponents(object,path14)};return agentPaths!==void 0&&(manifest.agentPaths=agentPaths),object.variables!==void 0&&(manifest.variables={dialect:"cursor",value:object.variables,manifest:path14}),manifest}var AGENT_PLUGINS_MANIFEST_SCHEMA="https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",AGENT_PLUGINS_MCP_SCHEMA="https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",MANIFEST_LOCATIONS={"agent-plugins":"plugin.json",claude:".claude-plugin/plugin.json",cursor:".cursor-plugin/plugin.json",codex:".codex-plugin/plugin.json"},q3=value=>`'${value??""}'`,at=path14=>path14===void 0?"":` in ${q3(path14)}`,ERROR_MESSAGES={"no-manifest":()=>`no plugin manifest found: expected one of ${Object.values(MANIFEST_LOCATIONS).map(p3=>q3(p3)).join(", ")}`,"manifest-unreadable":c5=>`manifest ${q3(c5.path)} is not valid JSON: ${c5.detail??"parse error"}`,"manifest-schema-missing":c5=>`manifest ${q3(c5.path)} is missing the required '$schema' field; an Agent Plugins manifest declares ${q3(AGENT_PLUGINS_MANIFEST_SCHEMA)}`,"manifest-schema-unsupported":c5=>`manifest ${q3(c5.path)} declares an unsupported '$schema' ${q3(c5.detail)}; this reader supports ${q3(AGENT_PLUGINS_MANIFEST_SCHEMA)}`,"manifest-name-missing":c5=>`manifest ${q3(c5.path)} is missing the required 'name' field`,"manifest-name-invalid":c5=>`plugin name ${q3(c5.subject)}${at(c5.path)} is invalid: 1 to 64 characters of lowercase letters, digits, hyphens and periods, starting and ending alphanumeric, with no '--' or '..'`,"manifest-name-conflict":c5=>`manifests disagree on the plugin name: ${q3(c5.subject)} in ${q3(c5.path)} versus ${c5.detail??"another manifest"}`,"manifest-field-type":c5=>`field ${q3(c5.subject)}${at(c5.path)} has the wrong type: expected ${c5.detail??"a different type"}`,"path-not-relative":c5=>`path ${q3(c5.subject)}${at(c5.path)} must be plugin-relative and begin with './'`,"path-escapes-root":c5=>`path ${q3(c5.subject)}${at(c5.path)} escapes the plugin root`,"path-glob-unsupported":c5=>`path ${q3(c5.subject)}${at(c5.path)} is a glob pattern; declare directories and files by path`,"path-uncontained":c5=>`the reader listed a path outside the plugin root: ${q3(c5.path)}`,"document-too-large":c5=>`${q3(c5.path)} is ${c5.subject??"too many"} bytes, over the ${c5.detail??""}-byte limit for this kind of document`,"skill-frontmatter-missing":c5=>`${q3(c5.path)} must start with YAML frontmatter ('---')`,"skill-frontmatter-unclosed":c5=>`${q3(c5.path)} frontmatter is not closed (missing the closing '---')`,"skill-frontmatter-unreadable":c5=>`${q3(c5.path)} frontmatter is not valid YAML: ${c5.detail??"parse error"}`,"skill-name-invalid":c5=>`skill name ${q3(c5.subject)}${at(c5.path)} is invalid: lowercase letters, digits and hyphens, optionally dot-scoped, with every segment alphanumeric`,"skill-name-duplicate":c5=>`skill name ${q3(c5.subject)} appears more than once (again${at(c5.path)})`,"mcp-config-unreadable":c5=>`MCP configuration ${q3(c5.path)} is not valid JSON: ${c5.detail??"parse error"}`,"mcp-config-shape":c5=>`MCP configuration ${q3(c5.path)} must be an object with an 'mcpServers' object`,"mcp-config-schema-missing":c5=>`MCP configuration ${q3(c5.path)} is missing the required '$schema' field; an Agent Plugins configuration declares ${q3(AGENT_PLUGINS_MCP_SCHEMA)}`,"mcp-config-schema-unsupported":c5=>`MCP configuration ${q3(c5.path)} declares an unsupported '$schema' ${q3(c5.detail)}; this reader supports ${q3(AGENT_PLUGINS_MCP_SCHEMA)}`,"mcp-config-field-unknown":c5=>`MCP configuration ${q3(c5.path)} has an unexpected top-level field ${q3(c5.subject)}; only '$schema' and 'mcpServers' are allowed`,"mcp-server-shape":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} must be an object`,"mcp-server-type-missing":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} is missing the 'type' field the Agent Plugins format requires ('stdio', 'streamable-http' or 'sse')`,"mcp-server-transport-unknown":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has no 'type' and neither a 'command' nor a 'url' to infer it from`,"mcp-server-type-ambiguous":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} declares both 'command' and 'url'; a server is either stdio or HTTP`,"mcp-server-type-unknown":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an unknown 'type' ${q3(c5.detail)}; expected 'stdio', 'http', 'streamable-http' or 'sse'`,"mcp-server-field-unknown":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a field ${q3(c5.detail)} that its transport does not define`,"mcp-server-field-type":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} field ${q3(c5.detail)} has the wrong type`,"mcp-server-url-missing":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} is missing the 'url' its HTTP transport requires`,"mcp-server-url-invalid":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an invalid 'url' ${q3(c5.detail)}: expected an absolute HTTPS URL (HTTP only for localhost) with no user information or fragment`,"mcp-server-url-variable":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a variable in its 'url'; Stigmer sends the URL as written, so write the URL out and put variables in 'headers'`,"mcp-server-command-missing":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} is missing the 'command' its stdio transport requires`,"mcp-server-command-invalid":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a 'command' that is not a single executable name; put arguments in 'args'`,"mcp-server-command-relative":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} runs a command bundled in the plugin ${q3(c5.detail)}; Stigmer runs only commands on the runner's PATH (for example 'npx' or 'uvx')`,"mcp-server-plugin-root-reference":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} references the plugin's own files through ${q3(c5.detail)}; Stigmer does not mount plugin files into the runner`,"mcp-server-cwd-unsupported":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} sets a working directory; Stigmer does not mount plugin files, so a bundled directory cannot be reached`,"mcp-server-env-literal":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} sets environment variable ${q3(c5.detail)} to a literal value; Stigmer passes declared variables by name, so write ${q3(`${c5.detail??"KEY"}: "\${${c5.detail??"KEY"}}"`)} and declare the variable`,"mcp-server-env-rename":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} maps environment variable ${q3(c5.detail)} to a differently named variable; Stigmer passes declared variables by name, so use the same name on both sides`,"mcp-server-name-duplicate":c5=>`MCP server name ${q3(c5.subject)} appears more than once (again${at(c5.path)})`,"mcp-server-header-duplicate":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} declares header ${q3(c5.detail)} more than once (header names are case-insensitive)`,"mcp-server-header-invalid":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an invalid header name ${q3(c5.detail)}`,"sub-agent-frontmatter-unreadable":c5=>`${q3(c5.path)} frontmatter is not valid YAML: ${c5.detail??"parse error"}`,"sub-agent-instructions-short":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} has instructions under ${c5.detail??""} characters; the body of the file is the sub-agent's prompt`,"sub-agent-name-duplicate":c5=>`sub-agent name ${q3(c5.subject)} appears more than once (again${at(c5.path)})`,"variable-name-invalid":c5=>`variable name ${q3(c5.subject)}${at(c5.path)} is invalid: an environment variable name is letters, digits and underscores, not starting with a digit`,"overlay-server-unknown":c5=>`${q3(c5.path)} overlays MCP server ${q3(c5.subject)}, which the plugin does not declare`,"overlay-document-unknown":c5=>`${q3(c5.path)} is not a document Stigmer reads; the 'ai.stigmer/' folder holds 'agent.yaml', 'workflows/<name>.yaml' and 'mcp-servers/<server>.yaml'`},WARNING_MESSAGES={"manifest-field-unknown":c5=>`manifest ${q3(c5.path)} has an unknown field ${q3(c5.subject)}, ignored`,"manifest-extensions-invalid":c5=>`manifest ${q3(c5.path)} has an 'extensions' field that is not an object, ignored`,"path-missing":c5=>`path ${q3(c5.subject)} declared${at(c5.path)} does not exist in the plugin`,"skill-name-defaulted":c5=>`${q3(c5.path)} has no 'name' in its frontmatter; the skill is named after its directory, ${q3(c5.subject)}`,"skill-name-differs-from-directory":c5=>`skill ${q3(c5.subject)}${at(c5.path)} is named differently from its directory ${q3(c5.detail)}`,"skill-description-missing":c5=>`skill ${q3(c5.subject)}${at(c5.path)} has no 'description'`,"mcp-config-field-ignored":c5=>`MCP configuration ${q3(c5.path)} has a top-level field ${q3(c5.subject)} Stigmer does not read, ignored`,"mcp-server-sse-mapped":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} declares the legacy 'sse' transport; Stigmer connects over Streamable HTTP and falls back to SSE only when the server rejects it`,"mcp-server-field-ignored":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has a field ${q3(c5.detail)} Stigmer does not read, ignored`,"mcp-server-auth-ignored":c5=>`MCP server ${q3(c5.subject)}${at(c5.path)} has an 'auth' block Stigmer does not read; OAuth for a server is declared in 'ai.stigmer/mcp-servers/${c5.subject??"<server>"}.yaml'`,"variable-inferred":c5=>`variable ${q3(c5.subject)} is referenced by MCP server ${q3(c5.detail)} but not declared; it is declared as a required secret`,"variable-unreferenced":c5=>`variable ${q3(c5.subject)}${at(c5.path)} is declared but no MCP server references it`,"variable-default-dropped":c5=>`variable ${q3(c5.subject)}${at(c5.path)} has a default value, which Stigmer does not carry; the user supplies the value`,"variable-type-narrowed":c5=>`variable ${q3(c5.subject)}${at(c5.path)} is typed ${q3(c5.detail)}; Stigmer variables are strings`,"variable-option-dropped":c5=>`variable ${q3(c5.subject)}${at(c5.path)} has a ${q3(c5.detail)} constraint, which Stigmer does not carry`,"sub-agent-name-defaulted":c5=>`${q3(c5.path)} has no 'name' in its frontmatter; the sub-agent is named after the file, ${q3(c5.subject)}`,"sub-agent-skill-unknown":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} asks for skill ${q3(c5.detail)}, which the plugin does not ship`,"sub-agent-model-unknown":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} names model ${q3(c5.detail)}, which Stigmer cannot map; the sub-agent runs on the session's model`,"sub-agent-field-ignored":c5=>`sub-agent ${q3(c5.subject)}${at(c5.path)} has a field ${q3(c5.detail)} Stigmer does not read, ignored`};var FindingCollector=class{errorSentences;warningSentences;errors=[];warnings=[];constructor(errorSentences,warningSentences){this.errorSentences=errorSentences,this.warningSentences=warningSentences}error(kind,ctx={}){this.errors.push(compose(kind,ctx,this.errorSentences[kind](ctx)))}warn(kind,ctx={}){this.warnings.push(compose(kind,ctx,this.warningSentences[kind](ctx)))}},Findings=class extends FindingCollector{constructor(){super(ERROR_MESSAGES,WARNING_MESSAGES)}};function compose(kind,ctx,message6){return{kind,...ctx.path!==void 0&&{path:ctx.path},...ctx.subject!==void 0&&{subject:ctx.subject},...ctx.detail!==void 0&&{detail:ctx.detail},message:message6}}var KNOWN_FIELDS3=new Set(["$schema","name","version","description","author","homepage","repository","license","keywords","extensions"]);function readOpenManifest(object,path14,findings){let schema2=object.$schema;return schema2===void 0?findings.error("manifest-schema-missing",{path:path14}):schema2!==AGENT_PLUGINS_MANIFEST_SCHEMA&&findings.error("manifest-schema-unsupported",{path:path14,detail:describeValue(schema2)}),warnUnknownFields(object,KNOWN_FIELDS3,path14,findings),{dialect:"agent-plugins",path:path14,identity:readIdentity(object,path14,findings),skillPaths:[],mcpConfigs:[],ignored:extensionComponents(object,path14,findings)}}var OPEN_MCP_CONFIG="mcp.json",VENDOR_PRECEDENCE=["claude","cursor","codex"],MANIFEST_PRECEDENCE=["agent-plugins",...VENDOR_PRECEDENCE],NAME_MAX_LENGTH=64,NAME_PATTERN=/^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$/;function detectManifests(index2,findings){let manifests=[],present=dialect=>{let path14=MANIFEST_LOCATIONS[dialect];if(!index2.has(path14))return;let object=readManifestObject(index2,path14,findings),manifest=object===void 0?emptyManifest(dialect,path14):readDialect(dialect,object,path14,findings);return manifests.push(manifest),manifest},root5=present("agent-plugins"),vendors=VENDOR_PRECEDENCE.map(present).filter(m3=>m3!==void 0);if(manifests.length===0){findings.error("no-manifest");return}let identity2=root5??vendors[0];if(identity2===void 0)throw new Error("manifest set without an identity manifest");let ordered=[identity2,...manifests.filter(m3=>m3!==identity2)],name=resolveName(identity2,ordered,findings);return{dialect:identity2.dialect,manifests:ordered,name,readsAgents:vendors.length>0,mcpSources:resolveMcpSources(index2,root5,vendors)}}function readManifestObject(index2,path14,findings){let text2=readText(index2,path14,"manifest",findings);return text2===void 0?void 0:parseJsonObject2(text2,path14,"manifest-unreadable",findings)}function readDialect(dialect,object,path14,findings){switch(dialect){case"agent-plugins":return readOpenManifest(object,path14,findings);case"claude":return readClaudeManifest(object,path14,findings);case"cursor":return readCursorManifest(object,path14,findings);case"codex":return readCodexManifest(object,path14,findings);default:{let exhaustive=dialect;throw new Error(`unknown dialect ${String(exhaustive)}`)}}}function emptyManifest(dialect,path14){return{dialect,path:path14,identity:{},skillPaths:[],mcpConfigs:[],ignored:[]}}function resolveName(identity2,all,findings){let name=identity2.identity.name;if(name===void 0){if(findings.errors.some(f5=>f5.kind==="manifest-unreadable"&&f5.path===identity2.path))return;findings.error("manifest-name-missing",{path:identity2.path});return}let valid=!0;isValidPluginName(name)||(findings.error("manifest-name-invalid",{path:identity2.path,subject:name}),valid=!1);for(let other of all){if(other===identity2)continue;let otherName=other.identity.name;otherName!==void 0&&otherName!==name&&(findings.error("manifest-name-conflict",{path:identity2.path,subject:name,detail:`'${otherName}' in '${other.path}'`}),valid=!1)}return valid?name:void 0}function isValidPluginName(name){return name.length<=NAME_MAX_LENGTH&&NAME_PATTERN.test(name)&&!name.includes("--")&&!name.includes("..")}function resolveMcpSources(index2,root5,vendors){let sources=[];root5!==void 0&&index2.has(OPEN_MCP_CONFIG)&&sources.push({kind:"file",path:OPEN_MCP_CONFIG,dialect:"agent-plugins",manifest:root5.path});for(let vendor of vendors)vendor.mcpConfigs.length>0?sources.push(...vendor.mcpConfigs):vendor.dialect!=="cursor"&&index2.has(CLAUDE_DEFAULT_MCP_CONFIG)&&sources.push({kind:"file",path:CLAUDE_DEFAULT_MCP_CONFIG,dialect:vendor.dialect,manifest:vendor.path});let seen=new Set;return sources.filter(source=>source.kind==="inline"?!0:seen.has(source.path)?!1:(seen.add(source.path),!0))}var import_yaml=__toESM(require_dist2(),1);var SKILL_NAME_PATTERN=/^[a-z0-9]+([.-][a-z0-9]+)*$/;function extractFrontmatter(content){let lines=content.split(/\r?\n/);if(lines.length===0||lines[0]?.trim()!=="---")return{ok:!1,reason:"missing"};for(let i6=1;i6<lines.length;i6++)if(lines[i6]?.trim()==="---")return{ok:!0,yaml:lines.slice(1,i6).join(`
 `),body:lines.slice(i6+1).join(`
 `)};return{ok:!1,reason:"unclosed"}}function parseFrontmatter(yaml2){let value;try{value=(0,import_yaml.parse)(yaml2)}catch(error2){return{ok:!1,detail:error2 instanceof Error?error2.message:String(error2)}}return value==null?{ok:!0,fields:{}}:isJsonObject2(value)?{ok:!0,fields:value}:{ok:!1,detail:"the frontmatter is not a mapping"}}var DEFAULT_AGENTS_DIR="agents",SUB_AGENT_INSTRUCTIONS_MIN=10,READ_FIELDS=new Set(["name","description","model","skills"]);function normaliseSubAgents(index2,set2,skills,findings){if(!set2.readsAgents)return[];let skillNames=new Set(skills.map(skill=>skill.name)),agents=[],seen=new Set;for(let path14 of discoverAgentFiles(index2,set2,findings)){let agent=readSubAgent(index2,path14,skillNames,findings);if(agent!==void 0){if(seen.has(agent.name)){findings.error("sub-agent-name-duplicate",{subject:agent.name,path:path14});continue}seen.add(agent.name),agents.push(agent)}}return agents}function discoverAgentFiles(index2,set2,findings){let files=new Set,addMarkdownUnder=dir=>{for(let name of index2.childFiles(dir))name.endsWith(".md")&&files.add(joinPath(dir,name))},declared=set2.manifests.flatMap(m3=>m3.agentPaths??[]);set2.manifests.every(m3=>m3.agentPaths===void 0)&&addMarkdownUnder(DEFAULT_AGENTS_DIR);for(let{path:path14,manifest}of declared)path14!==""&&index2.has(path14)&&path14.endsWith(".md")?files.add(path14):index2.isDirectory(path14)?addMarkdownUnder(path14):findings.warn("path-missing",{path:manifest,subject:path14===""?".":`./${path14}`});return[...files].sort(comparePaths)}function readSubAgent(index2,path14,skillNames,findings){let text2=readText(index2,path14,"subAgent",findings);if(text2===void 0)return;let extracted=extractFrontmatter(text2),fieldsMap={},body=text2;if(extracted.ok){let parsed=parseFrontmatter(extracted.yaml);if(!parsed.ok){findings.error("sub-agent-frontmatter-unreadable",{path:path14,detail:parsed.detail});return}fieldsMap=parsed.fields,body=extracted.body}else if(extracted.reason==="unclosed"){findings.error("sub-agent-frontmatter-unreadable",{path:path14,detail:"the frontmatter is not closed (missing the closing '---')"});return}let stem=basename(path14).replace(/\.md$/,""),name;typeof fieldsMap.name=="string"&&fieldsMap.name!==""?name=fieldsMap.name:(name=stem,findings.warn("sub-agent-name-defaulted",{path:path14,subject:name}));let instructions=body.trim();if(instructions.length<SUB_AGENT_INSTRUCTIONS_MIN){findings.error("sub-agent-instructions-short",{path:path14,subject:name,detail:String(SUB_AGENT_INSTRUCTIONS_MIN)});return}let description=fieldsMap.description,requested=fieldsMap.skills,matchedSkills=[];if(Array.isArray(requested))for(let skill of requested)typeof skill=="string"&&(skillNames.has(skill)?matchedSkills.push(skill):findings.warn("sub-agent-skill-unknown",{path:path14,subject:name,detail:skill}));let modelHint,model=fieldsMap.model;typeof model=="string"&&model.trim()!==""&&(modelHint=classifyModel(model),modelHint.alias==="unknown"&&findings.warn("sub-agent-model-unknown",{path:path14,subject:name,detail:model}));for(let field3 of Object.keys(fieldsMap))READ_FIELDS.has(field3)||findings.warn("sub-agent-field-ignored",{path:path14,subject:name,detail:field3});return{name,...typeof description=="string"&&description!==""&&{description},instructions,skillNames:matchedSkills,...modelHint!==void 0&&{modelHint},path:path14}}function classifyModel(raw){let value=raw.trim().toLowerCase(),alias=value==="inherit"?"inherit":value==="fast"?"fast":value.includes("haiku")?"haiku":value.includes("sonnet")?"sonnet":value.includes("opus")?"opus":"unknown";return{raw,alias}}var PLACEHOLDER_PATTERN=/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,VARIABLE_NAME_PATTERN=/^[A-Za-z_][A-Za-z0-9_]*$/,USER_CONFIG_PATTERN=/\$\{user_config\.([A-Za-z_][A-Za-z0-9_]*)\}/g,PLUGIN_ROOT_PLACEHOLDERS=new Set(["${PLUGIN_ROOT}","${PLUGIN_DATA}","${CLAUDE_PLUGIN_ROOT}","${CLAUDE_PLUGIN_DATA}","${CLAUDE_PROJECT_DIR}","${CURSOR_PLUGIN_ROOT}"]),PLUGIN_ROOT_ENV_NAMES=new Set(["PLUGIN_ROOT","PLUGIN_DATA"]);function rewriteUserConfig(value){return value.replace(USER_CONFIG_PATTERN,(_match,key)=>`\${${key}}`)}function findPluginRootPlaceholder(value){for(let placeholder of PLUGIN_ROOT_PLACEHOLDERS)if(value.includes(placeholder))return placeholder}function referencedVariables(value){let names=[];for(let match of value.matchAll(PLACEHOLDER_PATTERN)){let name=match[1];name!==void 0&&!names.includes(name)&&names.push(name)}return names}function singlePlaceholderName(value){return/^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$/.exec(value)?.[1]}var IGNORED_DIRECTORIES={rules:"rules",hooks:"hooks",commands:"commands",canvases:"canvases",workflows:"workflows","output-styles":"output-styles",themes:"themes",monitors:"monitors",bin:"bin",assets:"assets",evals:"evals"},IGNORED_FILES={".lsp.json":"lsp-servers","settings.json":"settings",".app.json":"apps"};function ignoredOnDisk(index2,readsAgents){let ignored=[];for(let dir of index2.childDirectories("")){let kind=IGNORED_DIRECTORIES[dir];kind!==void 0&&ignored.push({kind,path:`${dir}/`}),dir==="agents"&&!readsAgents&&ignored.push({kind:"agents",path:`${dir}/`})}for(let file of index2.childFiles("")){let kind=IGNORED_FILES[file];kind!==void 0&&ignored.push({kind,path:file})}return ignored}function dedupeIgnored(lists){let seen=new Set,out=[];for(let list12 of lists)for(let component of list12){let key=`${component.kind}\0${component.path}`;seen.has(key)||(seen.add(key),out.push(component))}return out}var OPEN_CONFIG_FIELDS=new Set(["$schema","mcpServers"]),OPEN_STDIO_FIELDS=new Set(["type","command","args","env","cwd"]),OPEN_HTTP_FIELDS=new Set(["type","url","headers"]),VENDOR_STDIO_FIELDS=new Set(["type","command","args","env","cwd"]),VENDOR_HTTP_FIELDS=new Set(["type","url","headers"]),HEADER_NAME_PATTERN=/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;function normaliseMcpServers(index2,sources,findings){let servers=[],seen=new Set,refused=0;for(let source of sources){let entries=readSource(index2,source,findings);if(entries===void 0){refused++;continue}for(let[name,raw]of fields(entries.servers)){if(seen.has(name)){findings.error("mcp-server-name-duplicate",{subject:name,path:entries.path}),refused++;continue}seen.add(name);let server=readServer(name,raw,entries.path,source.dialect==="agent-plugins",findings);server!==void 0?servers.push(server):refused++}}return{servers,refused,declaredNames:seen}}function readSource(index2,source,findings){let open=source.dialect==="agent-plugins";if(source.kind==="inline"){let wrapped=isJsonObject2(source.servers)?source.servers.mcpServers:void 0,servers2=isJsonObject2(wrapped)?wrapped:source.servers;if(!isJsonObject2(servers2)){findings.error("mcp-config-shape",{path:source.manifest});return}return{path:source.manifest,servers:servers2}}if(!index2.has(source.path)){findings.warn("path-missing",{path:source.manifest,subject:`./${source.path}`});return}let text2=readText(index2,source.path,"mcpConfig",findings);if(text2===void 0)return;let object=parseJsonObject2(text2,source.path,"mcp-config-unreadable",findings);if(object===void 0)return;if(open){let schema2=object.$schema;schema2===void 0?findings.error("mcp-config-schema-missing",{path:source.path}):schema2!==AGENT_PLUGINS_MCP_SCHEMA&&findings.error("mcp-config-schema-unsupported",{path:source.path,detail:describeValue(schema2)})}for(let[name]of fields(object))OPEN_CONFIG_FIELDS.has(name)||(open?findings.error("mcp-config-field-unknown",{path:source.path,subject:name}):findings.warn("mcp-config-field-ignored",{path:source.path,subject:name}));let servers=object.mcpServers;if(!isJsonObject2(servers)){findings.error("mcp-config-shape",{path:source.path});return}return{path:source.path,servers}}function readServer(name,raw,path14,open,findings){let ctx={subject:name,path:path14};if(!isJsonObject2(raw)){findings.error("mcp-server-shape",ctx);return}let transport=resolveTransport(raw,ctx,open,findings);if(transport===void 0)return;let known=transport==="stdio"?open?OPEN_STDIO_FIELDS:VENDOR_STDIO_FIELDS:open?OPEN_HTTP_FIELDS:VENDOR_HTTP_FIELDS,references=new Set,valid=!0;for(let[field3,value]of fields(raw))if(!known.has(field3))if(open)findings.error("mcp-server-field-unknown",{...ctx,detail:field3}),valid=!1;else if(field3==="auth"){findings.warn("mcp-server-auth-ignored",ctx);for(let text2 of stringsWithin(value))collectReferences(text2,references)}else findings.warn("mcp-server-field-ignored",{...ctx,detail:field3});if(valid)return transport==="stdio"?readStdio(name,raw,ctx,references,findings):readHttp(name,raw,ctx,references,findings)}function resolveTransport(raw,ctx,open,findings){let type2=raw.type;if(type2!==void 0&&typeof type2!="string"){findings.error("mcp-server-field-type",{...ctx,detail:"type"});return}if(type2===void 0){if(open){findings.error("mcp-server-type-missing",ctx);return}let hasCommand=raw.command!==void 0,hasUrl=raw.url!==void 0;if(hasCommand&&hasUrl){findings.error("mcp-server-type-ambiguous",ctx);return}if(hasCommand)return"stdio";if(hasUrl)return"http";findings.error("mcp-server-transport-unknown",ctx);return}switch(type2){case"stdio":return"stdio";case"streamable-http":return"http";case"http":if(open){findings.error("mcp-server-type-unknown",{...ctx,detail:type2});return}return"http";case"sse":return findings.warn("mcp-server-sse-mapped",ctx),"http";default:findings.error("mcp-server-type-unknown",{...ctx,detail:type2});return}}function readStdio(name,raw,ctx,references,findings){let valid=!0,fail=()=>{valid=!1},command5=raw.command;if(command5===void 0)findings.error("mcp-server-command-missing",ctx),fail();else if(typeof command5!="string")findings.error("mcp-server-field-type",{...ctx,detail:"command"}),fail();else{let root5=findPluginRootPlaceholder(command5);root5!==void 0?(findings.error("mcp-server-plugin-root-reference",{...ctx,detail:root5}),fail()):command5.startsWith("./")?(findings.error("mcp-server-command-relative",{...ctx,detail:command5}),fail()):(command5===""||/\s/.test(command5)||command5.includes("/"))&&(findings.error("mcp-server-command-invalid",ctx),fail())}let args=[],rawArgs=raw.args;if(rawArgs!==void 0)if(!isStringArray(rawArgs))findings.error("mcp-server-field-type",{...ctx,detail:"args"}),fail();else for(let arg of rawArgs){let rewritten=rewriteUserConfig(arg),root5=findPluginRootPlaceholder(rewritten);if(root5!==void 0){findings.error("mcp-server-plugin-root-reference",{...ctx,detail:root5}),fail();continue}collectReferences(rewritten,references),args.push(rewritten)}let rawEnv=raw.env;if(rawEnv!==void 0)if(!isStringRecord(rawEnv))findings.error("mcp-server-field-type",{...ctx,detail:"env"}),fail();else for(let[key,value]of Object.entries(rawEnv)){if(PLUGIN_ROOT_ENV_NAMES.has(key)){findings.error("mcp-server-plugin-root-reference",{...ctx,detail:key}),fail();continue}if(!VARIABLE_NAME_PATTERN.test(key)){findings.error("variable-name-invalid",{subject:key,path:ctx.path}),fail();continue}let rewritten=rewriteUserConfig(value),root5=findPluginRootPlaceholder(rewritten);if(root5!==void 0){findings.error("mcp-server-plugin-root-reference",{...ctx,detail:root5}),fail();continue}let referenced=singlePlaceholderName(rewritten);referenced===void 0?(findings.error("mcp-server-env-literal",{...ctx,detail:key}),fail()):referenced!==key?(findings.error("mcp-server-env-rename",{...ctx,detail:key}),fail()):references.add(key)}if(raw.cwd!==void 0&&(findings.error("mcp-server-cwd-unsupported",ctx),fail()),!(!valid||typeof command5!="string"))return{name,transport:"stdio",command:command5,args,env:[...references].sort()}}function readHttp(name,raw,ctx,references,findings){let valid=!0,fail=()=>{valid=!1},url,rawUrl=raw.url;if(rawUrl===void 0)findings.error("mcp-server-url-missing",ctx),fail();else if(typeof rawUrl!="string")findings.error("mcp-server-field-type",{...ctx,detail:"url"}),fail();else{url=rewriteUserConfig(rawUrl);let root5=findPluginRootPlaceholder(url);root5!==void 0?(findings.error("mcp-server-plugin-root-reference",{...ctx,detail:root5}),fail()):referencedVariables(url).length>0?(findings.error("mcp-server-url-variable",ctx),fail()):isAcceptableServerUrl(url)||(findings.error("mcp-server-url-invalid",{...ctx,detail:url}),fail())}let headers2=[],rawHeaders=raw.headers;if(rawHeaders!==void 0)if(!isStringRecord(rawHeaders))findings.error("mcp-server-field-type",{...ctx,detail:"headers"}),fail();else{let lowered=new Set;for(let[header,value]of Object.entries(rawHeaders)){if(!HEADER_NAME_PATTERN.test(header)){findings.error("mcp-server-header-invalid",{...ctx,detail:header}),fail();continue}let key=header.toLowerCase();if(lowered.has(key)){findings.error("mcp-server-header-duplicate",{...ctx,detail:header}),fail();continue}lowered.add(key);let rewritten=rewriteUserConfig(value),root5=findPluginRootPlaceholder(rewritten);if(root5!==void 0){findings.error("mcp-server-plugin-root-reference",{...ctx,detail:root5}),fail();continue}collectReferences(rewritten,references),headers2.push([header,rewritten])}}if(!(!valid||url===void 0))return{name,transport:"http",url,headers:Object.fromEntries(headers2),env:[...references].sort()}}function isAcceptableServerUrl(value){let url;try{url=new URL(value)}catch{return!1}return url.username!==""||url.password!==""||url.hash!==""?!1:url.protocol==="https:"?!0:url.protocol!=="http:"?!1:isLoopbackHost(url.hostname)}function isLoopbackHost(hostname){return hostname==="localhost"||hostname==="[::1]"||hostname==="::1"?!0:/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(hostname)}function collectReferences(text2,into){for(let name of referencedVariables(text2))into.add(name)}function stringsWithin(value){return typeof value=="string"?[rewriteUserConfig(value)]:Array.isArray(value)?value.flatMap(stringsWithin):isJsonObject2(value)?Object.values(value).flatMap(stringsWithin):[]}var OVERLAY_DIR="ai.stigmer",AGENT_DOCUMENT=`${OVERLAY_DIR}/agent.yaml`,WORKFLOWS_DIR=`${OVERLAY_DIR}/workflows`,MCP_SERVERS_DIR=`${OVERLAY_DIR}/mcp-servers`;function normaliseOverlay(index2,serverNames,findings){let overlay={workflows:[],mcpServers:[]},workflows=[],mcpServers=[];for(let path14 of index2.filesUnder(OVERLAY_DIR)){if(path14===AGENT_DOCUMENT){let bytes=readBytes(index2,path14,"overlay",findings);bytes!==void 0&&(overlay.agent={path:path14,bytes});continue}let name=yamlStem(path14);if(name!==void 0&&dirname(path14)===WORKFLOWS_DIR){let bytes=readBytes(index2,path14,"overlay",findings);bytes!==void 0&&workflows.push({path:path14,bytes,name});continue}if(name!==void 0&&dirname(path14)===MCP_SERVERS_DIR){if(!serverNames.has(name)){findings.error("overlay-server-unknown",{path:path14,subject:name});continue}let bytes=readBytes(index2,path14,"overlay",findings);bytes!==void 0&&mcpServers.push({path:path14,bytes,server:name});continue}findings.error("overlay-document-unknown",{path:path14})}return overlay.workflows=workflows,overlay.mcpServers=mcpServers,overlay}function yamlStem(path14){let name=basename(path14);return name.endsWith(".yaml")&&name.length>5?name.slice(0,-5):void 0}var SKILL_FILE="SKILL.md",DEFAULT_SKILLS_DIR="skills";function normaliseSkills(index2,set2,findings){let skills=[],seenNames=new Map;for(let dir of discoverSkillDirs(index2,set2,findings)){let skill=readSkill(index2,dir,set2,findings);if(skill===void 0)continue;if(seenNames.get(skill.name)!==void 0){findings.error("skill-name-duplicate",{subject:skill.name,path:joinPath(dir,SKILL_FILE)});continue}seenNames.set(skill.name,dir),skills.push(skill)}return skills}function discoverSkillDirs(index2,set2,findings){let dirs=new Set,addSkillsUnder=parent=>{for(let child of index2.childDirectories(parent)){let dir=joinPath(parent,child);index2.has(joinPath(dir,SKILL_FILE))&&dirs.add(dir)}};addSkillsUnder(DEFAULT_SKILLS_DIR);let declared=set2.manifests.flatMap(m3=>m3.skillPaths);for(let{path:path14,manifest}of declared)index2.has(joinPath(path14,SKILL_FILE))?dirs.add(path14):index2.isDirectory(path14)?addSkillsUnder(path14):findings.warn("path-missing",{path:manifest,subject:path14===""?".":`./${path14}`});return declared.length===0&&!index2.isDirectory(DEFAULT_SKILLS_DIR)&&index2.has(SKILL_FILE)&&dirs.add(""),[...dirs].sort(comparePaths)}function readSkill(index2,dir,set2,findings){let path14=joinPath(dir,SKILL_FILE),text2=readText(index2,path14,"skillMd",findings);if(text2===void 0)return;let extracted=extractFrontmatter(text2);if(!extracted.ok){findings.error(extracted.reason==="missing"?"skill-frontmatter-missing":"skill-frontmatter-unclosed",{path:path14});return}let parsed=parseFrontmatter(extracted.yaml);if(!parsed.ok){findings.error("skill-frontmatter-unreadable",{path:path14,detail:parsed.detail});return}let directoryName=dir===""?set2.name??"skill":basename(dir),name;if(typeof parsed.fields.name=="string"&&parsed.fields.name!==""?name=parsed.fields.name:(name=directoryName,findings.warn("skill-name-defaulted",{path:path14,subject:name})),!SKILL_NAME_PATTERN.test(name)){findings.error("skill-name-invalid",{path:path14,subject:name});return}dir!==""&&name!==directoryName&&findings.warn("skill-name-differs-from-directory",{path:path14,subject:name,detail:directoryName});let description=parsed.fields.description;return(typeof description!="string"||description==="")&&findings.warn("skill-description-missing",{path:path14,subject:name}),{name,...typeof description=="string"&&description!==""&&{description},dir,files:index2.filesUnder(dir)}}function normaliseVariables(set2,servers,findings){let declared=new Map,declaredIn=new Map;for(let manifest of set2.manifests){let declaration=manifest.variables;if(declaration===void 0)continue;let variables=declaration.dialect==="cursor"?readCursorVariables(declaration.value,declaration.manifest,findings):readClaudeVariables(declaration.value,declaration.manifest,findings);for(let variable of variables)declared.has(variable.name)||(declared.set(variable.name,variable),declaredIn.set(variable.name,declaration.manifest))}let referencedBy=new Map;for(let server of servers.servers)for(let name of server.env)referencedBy.has(name)||referencedBy.set(name,server.name);if(servers.refused===0)for(let[name,variable]of declared)referencedBy.has(name)||findings.warn("variable-unreferenced",{subject:variable.name,path:declaredIn.get(name)});let inferred=[];for(let[name,server]of[...referencedBy].sort(([a5],[b7])=>a5<b7?-1:a5>b7?1:0))declared.has(name)||(findings.warn("variable-inferred",{subject:name,detail:server}),inferred.push({name,isSecret:!0,optional:!1,declaredBy:"inferred"}));return[...declared.values(),...inferred]}function readCursorVariables(value,manifest,findings){if(!isJsonObject2(value)||value.type!=="object")return findings.error("manifest-field-type",{path:manifest,subject:"variables",detail:"a JSON Schema object with type 'object'"}),[];let properties=value.properties??{};if(!isJsonObject2(properties))return findings.error("manifest-field-type",{path:manifest,subject:"variables.properties",detail:"an object"}),[];let required=value.required??[];if(!isStringArray(required))return findings.error("manifest-field-type",{path:manifest,subject:"variables.required",detail:"an array of strings"}),[];let variables=[];for(let[name,schema2]of fields(properties)){if(!VARIABLE_NAME_PATTERN.test(name)){findings.error("variable-name-invalid",{subject:name,path:manifest});continue}let property=isJsonObject2(schema2)?schema2:{},type2=property.type;type2!==void 0&&type2!=="string"&&findings.warn("variable-type-narrowed",{subject:name,path:manifest,detail:describeValue(type2)}),property.default!==void 0&&findings.warn("variable-default-dropped",{subject:name,path:manifest}),property.enum!==void 0&&findings.warn("variable-option-dropped",{subject:name,path:manifest,detail:"enum"});let description=describe(property);variables.push({name,...description!==void 0&&{description},isSecret:!0,optional:!required.includes(name),declaredBy:"cursor"})}return variables}function readClaudeVariables(value,manifest,findings){if(!isJsonObject2(value))return findings.error("manifest-field-type",{path:manifest,subject:"userConfig",detail:"an object"}),[];let variables=[];for(let[name,entry]of fields(value)){if(!VARIABLE_NAME_PATTERN.test(name)){findings.error("variable-name-invalid",{subject:name,path:manifest});continue}if(!isJsonObject2(entry)){findings.error("manifest-field-type",{path:manifest,subject:`userConfig.${name}`,detail:"an object"});continue}let type2=entry.type;type2!==void 0&&type2!=="string"&&findings.warn("variable-type-narrowed",{subject:name,path:manifest,detail:describeValue(type2)}),entry.default!==void 0&&findings.warn("variable-default-dropped",{subject:name,path:manifest});for(let option of["options","multiple","min","max"])entry[option]!==void 0&&findings.warn("variable-option-dropped",{subject:name,path:manifest,detail:option});let description=describe(entry);variables.push({name,...description!==void 0&&{description},isSecret:entry.sensitive===!0,optional:entry.required!==!0,declaredBy:"claude"})}return variables}function describe(entry){let parts=[entry.title,entry.description].filter(part=>typeof part=="string"&&part!=="");return parts.length===0?void 0:parts.join(": ")}function readPluginPackage(files){let findings=new Findings;for(let entry of files.entries)isContainedPath(entry.path)||findings.error("path-uncontained",{path:entry.path});let index2=new PluginFileIndex(files),set2=detectManifests(index2,findings);if(set2===void 0)return{ok:!1,errors:findings.errors,warnings:findings.warnings};let skills=normaliseSkills(index2,set2,findings),servers=normaliseMcpServers(index2,set2.mcpSources,findings),mcpServers=servers.servers,variables=normaliseVariables(set2,servers,findings),subAgents=normaliseSubAgents(index2,set2,skills,findings),overlay=normaliseOverlay(index2,servers.declaredNames,findings),ignored=dedupeIgnored([ignoredOnDisk(index2,set2.readsAgents),...set2.manifests.map(m3=>m3.ignored)]);if(findings.errors.length>0||set2.name===void 0)return{ok:!1,errors:findings.errors,warnings:findings.warnings};let identity2=set2.manifests[0]?.identity??{};return{ok:!0,plugin:{name:set2.name,...identity2.version!==void 0&&{version:identity2.version},...identity2.description!==void 0&&{description:identity2.description},...identity2.author!==void 0&&{author:identity2.author},...identity2.homepage!==void 0&&{homepage:identity2.homepage},...identity2.repository!==void 0&&{repository:identity2.repository},...identity2.license!==void 0&&{license:identity2.license},keywords:identity2.keywords??[],dialect:set2.dialect,manifestsFound:set2.manifests.map(m3=>m3.path),skills,mcpServers,subAgents,variables,overlay,ignored},warnings:findings.warnings}}var import_node_zlib=require("node:zlib");function parseZipStructure(data){let view=new DataView(data.buffer,data.byteOffset,data.byteLength),eocd=findEndOfCentralDirectory(data,view),entries=[],offset=eocd.centralDirectoryOffset;for(let i6=0;i6<eocd.entryCount;i6++){if(offset+46>data.length||view.getUint32(offset,!0)!==33639248)throw new Error(`invalid central directory record at offset ${offset}`);let versionMadeBy=view.getUint16(offset+4,!0),compressionMethod=view.getUint16(offset+10,!0),crc323=view.getUint32(offset+16,!0),compressedSize=view.getUint32(offset+20,!0),uncompressedSize=view.getUint32(offset+24,!0),fileNameLength=view.getUint16(offset+28,!0),extraFieldLength=view.getUint16(offset+30,!0),commentLength=view.getUint16(offset+32,!0),externalAttributes=view.getUint32(offset+38,!0),localHeaderOffset=view.getUint32(offset+42,!0),fileName=new TextDecoder().decode(data.subarray(offset+46,offset+46+fileNameLength)),dataStart=payloadStart(data,view,localHeaderOffset,fileName);if(dataStart+compressedSize>data.length)throw new Error(`entry "${fileName}" payload runs past end of archive`);entries.push({name:fileName,isDirectory:fileName.endsWith("/"),compressionMethod,uncompressedSize,compressedSize,crc32:crc323,versionMadeBy,externalAttributes,compressedData:data.subarray(dataStart,dataStart+compressedSize)}),offset+=46+fileNameLength+extraFieldLength+commentLength}return entries}function findEndOfCentralDirectory(data,view){let scanFloor=Math.max(0,data.length-22-65535);for(let pos=data.length-22;pos>=scanFloor;pos--){if(view.getUint32(pos,!0)!==101010256)continue;let entryCount=view.getUint16(pos+10,!0),centralDirectorySize=view.getUint32(pos+12,!0),centralDirectoryOffset=view.getUint32(pos+16,!0),directoryEndsAtRecord=centralDirectoryOffset+centralDirectorySize<=pos,directoryLooksReal=entryCount===0||centralDirectoryOffset+4<=data.length&&view.getUint32(centralDirectoryOffset,!0)===33639248;if(directoryEndsAtRecord&&directoryLooksReal)return{centralDirectoryOffset,entryCount}}throw new Error("no end-of-central-directory record found")}var CRC_TABLE=(()=>{let table2=new Uint32Array(256);for(let n3=0;n3<256;n3++){let c5=n3;for(let bit=0;bit<8;bit++)c5=c5>>>1^3988292384&-(c5&1);table2[n3]=c5}return table2})();function crc322(data){let crc2=4294967295;for(let i6=0;i6<data.length;i6++)crc2=crc2>>>8^CRC_TABLE[(crc2^data[i6])&255];return(crc2^4294967295)>>>0}function payloadStart(data,view,localHeaderOffset,fileName){if(localHeaderOffset+30>data.length||view.getUint32(localHeaderOffset,!0)!==67324752)throw new Error(`entry "${fileName}" has no local file header at offset ${localHeaderOffset}`);let localNameLength=view.getUint16(localHeaderOffset+26,!0),localExtraLength=view.getUint16(localHeaderOffset+28,!0);return localHeaderOffset+30+localNameLength+localExtraLength}var METHOD_STORED=0,METHOD_DEFLATED=8,InflateError=class extends Error{kind;detail;constructor(kind,detail){super(`${kind}: ${detail}`),this.kind=kind,this.detail=detail,this.name="InflateError"}};function inflateEntry(entry,maxSize){let content;switch(entry.compressionMethod){case METHOD_STORED:content=entry.compressedData;break;case METHOD_DEFLATED:try{content=new Uint8Array((0,import_node_zlib.inflateRawSync)(entry.compressedData,{maxOutputLength:maxSize+1}))}catch(error2){throw isOutputLengthError(error2)?new InflateError("too-large",`output exceeds ${maxSize} bytes`):new InflateError("read-failed",error2 instanceof Error?error2.message:String(error2))}break;default:throw new InflateError("unsupported-method","zip: unsupported compression algorithm")}if(content.length>maxSize)throw new InflateError("too-large",`output exceeds ${maxSize} bytes`);if(crc322(content)!==entry.crc32)throw new InflateError("checksum","zip: checksum error");return content}function isOutputLengthError(error2){return error2 instanceof Error&&("code"in error2&&error2.code==="ERR_BUFFER_TOO_LARGE"||error2.message.includes("maxOutputLength"))}var import_node_crypto25=require("node:crypto");function sanitizePath(input){let sanitized=sanitizeCore(input);return input.length>0&&(input.endsWith("/")||input.endsWith("\\"))&&sanitized.length>0?`${sanitized}/`:sanitized}function sanitizeCore(input){let segments=`/${input.replaceAll("\\","/")}`.split("/"),resolved=[];for(let segment of segments)if(!(segment===""||segment===".")){if(segment===".."){resolved.pop();continue}resolved.push(segment)}return resolved.join("/")}var WINDOWS_SHORT_FILENAME_PATTERN=/~\d+\.?/;function hasWindowsShortFilenames(input){return input.replaceAll("\\","/").split("/").some(part=>WINDOWS_SHORT_FILENAME_PATTERN.test(part))}var CREATOR_UNIX=3,CREATOR_MACOSX=19,S_IFMT=61440,S_IFBLK=24576,S_IFCHR=8192,S_IFIFO=4096,S_IFLNK=40960,S_IFSOCK=49152;function entryTypeBits(entry){let creator=entry.versionMadeBy>>8;if(creator!==CREATOR_UNIX&&creator!==CREATOR_MACOSX)return{isSymlink:!1,isSpecial:!1};let fileType=entry.externalAttributes>>>16&65535&S_IFMT;return{isSymlink:fileType===S_IFLNK,isSpecial:fileType===S_IFBLK||fileType===S_IFCHR||fileType===S_IFIFO||fileType===S_IFSOCK}}function applyEntryPrefilter(entries){let symlinks=new Set,result=[];for(let entry of entries){let name=sanitizePath(entry.name);if(hasWindowsShortFilenames(name))continue;let shadowKey=trimTrailingSlash(sanitizePath(name)).toLowerCase(),parts=shadowKey.split("/"),traversal=!1;for(let i6=1;i6<=parts.length;i6++)if(symlinks.has(parts.slice(0,i6).join("/"))){traversal=!0;break}if(traversal)continue;let typeBits=entryTypeBits(entry);typeBits.isSymlink&&symlinks.add(shadowKey),!typeBits.isSpecial&&result.push({name,entry})}return result}function trimTrailingSlash(path14){return path14.endsWith("/")?path14.slice(0,-1):path14}function openArchive(bytes,maxZipSize=104857600){if(bytes.length>maxZipSize)throw new Error(`ZIP file too large: ${bytes.length} bytes (max: ${maxZipSize})`);let hash=calculateHash(bytes),entries;try{entries=parseZipStructure(bytes)}catch{throw new Error("invalid ZIP file: zip: not a valid zip file")}return{hash,entries:applyEntryPrefilter(entries)}}function validateArchiveStructure(entries,limits,onEntry){if(entries.length===0)throw new Error("ZIP file is empty");if(entries.length>limits.maxFiles)throw new Error(`too many files in ZIP: ${entries.length} (max: ${limits.maxFiles})`);let totalUncompressedSize=0;for(let{name,entry}of entries){onEntry?.(name);for(let ch of name){let codePoint=ch.codePointAt(0);if(codePoint<32||codePoint===127)throw new Error(`invalid character in filename: ${name}`)}if(totalUncompressedSize+=entry.uncompressedSize,totalUncompressedSize>limits.maxUncompressedSize)throw new Error(`total uncompressed size too large: ${totalUncompressedSize} bytes (max: ${limits.maxUncompressedSize})`);if(entry.compressedSize>0){let ratio=Math.floor(entry.uncompressedSize/entry.compressedSize);if(ratio>limits.maxCompressionRatio)throw new Error(`suspicious compression ratio in ${name}: ${ratio}:1 (max: ${limits.maxCompressionRatio}:1)`)}}}function calculateHash(data){return(0,import_node_crypto25.createHash)("sha256").update(data).digest("hex")}function openPluginArchive(bytes){let{hash,entries}=openArchive(bytes,104857600);validateArchiveStructure(entries,PLATFORM_ARCHIVE_LIMITS);let byPath=new Map;for(let prefiltered of entries){let{name}=prefiltered;name.endsWith("/")||!isContainedPath(name)||byPath.has(name)||byPath.set(name,prefiltered)}let files={entries:[...byPath.values()].map(({name,entry})=>({path:name,size:entry.uncompressedSize})).sort((a5,b7)=>comparePaths(a5.path,b7.path)),read(path14){let prefiltered=byPath.get(path14);if(prefiltered===void 0)throw new Error(`plugin file '${path14}' is not listed`);try{return inflateEntry(prefiltered.entry,prefiltered.entry.uncompressedSize)}catch(error2){throw error2 instanceof InflateError?new Error(`failed to read '${path14}' from the plugin archive: ${error2.detail}`):error2}}};return{digest:hash,files}}function memberLabels(identity2){return{[PLUGIN_LABEL]:identity2.id,[PLUGIN_VERSION_LABEL]:identity2.digest}}function memberMetadata(identity2,member2,authored){let metadata=authored===void 0?create2(ApiResourceMetadataSchema,{}):authored;return metadata.org=identity2.org,metadata.name=member2.name,metadata.slug=member2.slug,metadata.id="",identity2.visibility!==ApiResourceVisibility.api_resource_visibility_unspecified&&(metadata.visibility=identity2.visibility),metadata.labels={...metadata.labels,...memberLabels(identity2)},metadata}var McpServerOverlayError=class extends Error{constructor(server,reason){super(`overlay for MCP server '${server}': ${reason}`),this.name="McpServerOverlayError"}};function mcpServerSlugOf(server){return generateSlug(server.name)}function planMcpServers(plugin2,overlays,identity2){let env2=declaredVariables(plugin2);return plugin2.mcpServers.map(server=>{let overlay=overlays.get(server.name),spec=create2(McpServerSpecSchema,{description:plugin2.description??"",env:Object.fromEntries(server.env.map(name=>[name,env2.get(name)??inferredSecret()]))});switch(server.transport){case"http":spec.serverType={case:"http",value:create2(HttpServerConfigSchema,{url:server.url,headers:{...server.headers}})};break;case"stdio":spec.serverType={case:"stdio",value:create2(StdioServerConfigSchema,{command:server.command,args:[...server.args]})};break;default:{let exhaustive=server;throw new Error(`unknown transport ${JSON.stringify(exhaustive)}`)}}overlay!==void 0&&layerOverlay(server.name,spec,overlay);let slug=mcpServerSlugOf(server);return{name:server.name,slug,resource:create2(McpServerSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"McpServer",metadata:memberMetadata(identity2,{name:server.name,slug},overlay?.metadata),spec})}})}function declaredVariables(plugin2){return new Map(plugin2.variables.map(variable=>[variable.name,create2(EnvVarDeclarationSchema,{isSecret:variable.isSecret,description:variable.description??"",optional:variable.optional})]))}function inferredSecret(){return create2(EnvVarDeclarationSchema,{isSecret:!0,optional:!1})}function layerOverlay(serverName,spec,overlay){let authored=overlay.spec;if(authored!==void 0){if(authored.serverType.case!==void 0)throw new McpServerOverlayError(serverName,"the transport (http or stdio) lives in mcp.json, where every client reads it; the overlay may not redefine it");if(Object.keys(authored.env).length>0)throw new McpServerOverlayError(serverName,"variables are declared where mcp.json references them (the plugin's variables or userConfig); the overlay may not declare env");authored.description!==""&&(spec.description=authored.description),authored.iconUrl!==""&&(spec.iconUrl=authored.iconUrl),authored.tags.length>0&&(spec.tags=[...authored.tags]),authored.defaultEnabledTools.length>0&&(spec.defaultEnabledTools=[...authored.defaultEnabledTools]),authored.pinnedToolApprovals.length>0&&(spec.pinnedToolApprovals=[...authored.pinnedToolApprovals]),authored.repositoryUrl!==""&&(spec.repositoryUrl=authored.repositoryUrl),authored.auth!==void 0&&(spec.auth=authored.auth)}}function renderDefaultAgentInstructions(plugin2){let lines=[],description=plugin2.description?.trim()??"";if(lines.push(description===""?`You are ${plugin2.name}, an agent installed from the ${plugin2.name} plugin.`:`You are ${plugin2.name}: ${description}`),plugin2.skills.length>0){lines.push(""),lines.push("Your skills:");for(let skill of plugin2.skills){let summary=skill.description?.trim()??"";lines.push(summary===""?`- ${skill.name}`:`- ${skill.name}: ${summary}`)}}if(plugin2.mcpServers.length>0){lines.push(""),lines.push("Your tools come from these MCP servers:");for(let server of plugin2.mcpServers)lines.push(`- ${server.name}`)}return lines.push(""),lines.push("Before acting on a task a skill covers, read that skill and follow it. Use the tools your servers provide rather than guessing at their results. When you finish, state what you did and what you could not do."),lines.join(`
 `)}var file_ai_stigmer_agentic_skill_v1_io=fileDesc("CiRhaS9zdGlnbWVyL2FnZW50aWMvc2tpbGwvdjEvaW8ucHJvdG8SG2FpLnN0aWdtZXIuYWdlbnRpYy5za2lsbC52MSIgCgdTa2lsbElkEhUKBXZhbHVlGAEgASgJQga6SAPIAQEijgQKEFB1c2hTa2lsbFJlcXVlc3QSEwoDb3JnGAEgASgJQga6SAPIAQESEAoIYXJ0aWZhY3QYAiABKAwSKAoDdGFnGAMgASgJQhu6SBhyFjIUXiR8XlthLXpBLVowLTkuXy1dKyQSQgoOZ2l0X3Byb3ZlbmFuY2UYBCABKAsyKi5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuR2l0UHJvdmVuYW5jZRIPCgdtZXNzYWdlGAYgASgJEhsKE2FydGlmYWN0X3VwbG9hZF9yZWYYByABKAkSSQoGbGFiZWxzGAggAygLMjkuYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxLlB1c2hTa2lsbFJlcXVlc3QuTGFiZWxzRW50cnkaLQoLTGFiZWxzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ATq2AbpIsgEarwEKInB1c2hfc2tpbGxfcmVxdWVzdC5hcnRpZmFjdF9zb3VyY2USSWV4YWN0bHkgb25lIG9mIGFydGlmYWN0IChpbmxpbmUgYnl0ZXMpIG9yIGFydGlmYWN0X3VwbG9hZF9yZWYgbXVzdCBiZSBzZXQaPih0aGlzLmFydGlmYWN0LnNpemUoKSA+IDApICE9ICh0aGlzLmFydGlmYWN0X3VwbG9hZF9yZWYgIT0gJycpSgQIBRAGIlcKI0NyZWF0ZVNraWxsQXJ0aWZhY3RVcGxvYWRVcmxSZXF1ZXN0EhMKA29yZxgBIAEoCUIGukgDyAEBEhsKCnNpemVfYnl0ZXMYAiABKANCB7pIBCICIAAiVwoWU2tpbGxBcnRpZmFjdFVwbG9hZFVybBILCgN1cmwYASABKAkSGwoTYXJ0aWZhY3RfdXBsb2FkX3JlZhgCIAEoCRITCgt0dGxfc2Vjb25kcxgDIAEoBSJQChhTa2lsbEFydGlmYWN0RG93bmxvYWRVcmwSCwoDdXJsGAEgASgJEhMKC3R0bF9zZWNvbmRzGAIgASgFEhIKCnNpemVfYnl0ZXMYAyABKAMiowEKJVB1c2hTa2lsbEZyb21FeGVjdXRpb25BcnRpZmFjdFJlcXVlc3QSEwoDb3JnGAEgASgJQga6SAPIAQESHQoMZXhlY3V0aW9uX2lkGAIgASgJQge6SARyAhABEhwKC3N0b3JhZ2Vfa2V5GAMgASgJQge6SARyAhABEigKA3RhZxgEIAEoCUIbukgYchYyFF4kfF5bYS16QS1aMC05Ll8tXSskIjoKEkdldEFydGlmYWN0UmVxdWVzdBIkChRhcnRpZmFjdF9zdG9yYWdlX2tleRgBIAEoCUIGukgDyAEBIicKE0dldEFydGlmYWN0UmVzcG9uc2USEAoIYXJ0aWZhY3QYASABKAwiagoWTGlzdFNraWxsVmVyc2lvbnNJbnB1dBITCgNvcmcYASABKAlCBrpIA8gBARIUCgRzbHVnGAIgASgJQga6SAPIAQESEgoKcGFnZV90b2tlbhgDIAEoCRIRCglwYWdlX3NpemUYBCABKAUitgIKEVNraWxsVmVyc2lvbkVudHJ5EhQKDHZlcnNpb25faGFzaBgBIAEoCRItCglwdXNoZWRfYXQYAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEkgKCXB1c2hlZF9ieRgDIAEoCzI1LmFpLnN0aWdtZXIuY29tbW9ucy5hcGlyZXNvdXJjZS5BcGlSZXNvdXJjZUF1ZGl0QWN0b3ISCwoDdGFnGAQgASgJEhIKCmlzX2N1cnJlbnQYBSABKAgSQgoOZ2l0X3Byb3ZlbmFuY2UYBiABKAsyKi5haS5zdGlnbWVyLmFnZW50aWMuc2tpbGwudjEuR2l0UHJvdmVuYW5jZRIPCgdtZXNzYWdlGAcgASgJEhwKFGFydGlmYWN0X3N0b3JhZ2Vfa2V5GAggASgJIosBChlMaXN0U2tpbGxWZXJzaW9uc1Jlc3BvbnNlEkAKCHZlcnNpb25zGAEgAygLMi4uYWkuc3RpZ21lci5hZ2VudGljLnNraWxsLnYxLlNraWxsVmVyc2lvbkVudHJ5EhcKD25leHRfcGFnZV90b2tlbhgCIAEoCRITCgt0b3RhbF9jb3VudBgDIAEoBWIGcHJvdG8z",[file_ai_stigmer_agentic_skill_v1_status,file_ai_stigmer_commons_apiresource_status,file_buf_validate_validate,file_google_protobuf_timestamp]),SkillIdSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,0),PushSkillRequestSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,1);var SkillArtifactUploadUrlSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,3),SkillArtifactDownloadUrlSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,4);var GetArtifactResponseSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,7);var SkillVersionEntrySchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,9),ListSkillVersionsResponseSchema=messageDesc2(file_ai_stigmer_agentic_skill_v1_io,10);var DETERMINISTIC_ZIP_MTIME=new Date(1980,0,1),DEFLATE_LEVEL=6;function writeArchive(files){let sorted=[...files].sort((a5,b7)=>a5.path<b7.path?-1:a5.path>b7.path?1:0),tree={};for(let file of sorted){if(file.path in tree)throw new Error(`archive path '${file.path}' listed twice`);tree[file.path]=file.bytes}return zipSync(tree,{level:DEFLATE_LEVEL,mtime:DETERMINISTIC_ZIP_MTIME})}function skillSlugOf(skill){return generateSlug(skill.name)}function planSkills(plugin2,files,identity2,tag2,message6){return plugin2.skills.map(skill=>{let prefix=skill.dir===""?"":`${skill.dir}/`,archive=writeArchive(skill.files.map(path14=>({path:path14.startsWith(prefix)?path14.slice(prefix.length):path14,bytes:files.read(path14)})));return{name:skill.name,slug:skillSlugOf(skill),request:create2(PushSkillRequestSchema,{org:identity2.org,artifact:archive,tag:tag2,message:message6,labels:memberLabels(identity2)})}})}function carriesAgent(plugin2){return plugin2.skills.length>0||plugin2.subAgents.length>0||plugin2.overlay.agent!==void 0}function planAgent(plugin2,overlayAgent,mcpServers,identity2,warnings){if(!carriesAgent(plugin2))return;let member2={name:identity2.name,slug:identity2.slug};if(overlayAgent!==void 0)return{...member2,resource:create2(AgentSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"Agent",metadata:memberMetadata(identity2,member2,overlayAgent.metadata),spec:overlayAgent.spec})};let serverSlugs=plugin2.mcpServers.map(mcpServerSlugOf),skillSlugByName=new Map(plugin2.skills.map(skill=>[skill.name,skillSlugOf(skill)])),spec=create2(AgentSpecSchema,{description:plugin2.description??"",instructions:renderDefaultAgentInstructions(plugin2),env:toolVariables(mcpServers),skillRefs:[...skillSlugByName.values()].map(slug=>create2(ApiResourceReferenceSchema,{org:identity2.org,kind:ApiResourceKind.skill,slug})),mcpServerUsages:serverSlugs.map(slug=>create2(McpServerUsageSchema,{mcpServerRef:create2(ApiResourceReferenceSchema,{org:identity2.org,kind:ApiResourceKind.mcp_server,slug})})),subAgents:plugin2.subAgents.map(subAgent=>planSubAgent(subAgent,identity2,serverSlugs,skillSlugByName,warnings))});return{...member2,resource:create2(AgentSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"Agent",metadata:memberMetadata(identity2,member2),spec})}}function toolVariables(mcpServers){let declarations={};for(let server of mcpServers){let spec=server.resource.spec;if(spec===void 0)continue;let oauthTarget=spec.auth?.targetEnvVar??"";for(let[name,declaration]of Object.entries(spec.env))name===oauthTarget||name in declarations||(declarations[name]=declaration)}return declarations}function planSubAgent(subAgent,identity2,serverSlugs,skillSlugByName,warnings){BUILT_IN_SUB_AGENT_NAMES.has(subAgent.name)&&warnings.push(create2(PluginWarningSchema,{kind:SERVER_WARNING_KINDS.subAgentNameBuiltin,path:subAgent.path,message:`sub-agent '${subAgent.name}' shares its name with a built-in sub-agent; the runner warns and runs the plugin's`}));let hint=subAgent.modelHint;return hint!==void 0&&hint.alias!=="inherit"&&hint.alias!=="unknown"&&warnings.push(create2(PluginWarningSchema,{kind:SERVER_WARNING_KINDS.modelHintUnresolved,path:subAgent.path,message:`sub-agent '${subAgent.name}' names model '${hint.raw}'; Stigmer does not pin a model from a plugin, so it runs on the session's model`})),create2(SubAgentSchema,{name:subAgent.name,description:subAgent.description??"",instructions:subAgent.instructions,mcpAccess:serverSlugs.map(slug=>create2(McpAccessSchema,{mcpServer:slug})),skillRefs:subAgent.skillNames.flatMap(name=>{let slug=skillSlugByName.get(name);return slug===void 0?[]:[create2(ApiResourceReferenceSchema,{org:identity2.org,kind:ApiResourceKind.skill,slug})]})})}function workflowSlugOf(name){return generateSlug(name)}function planWorkflows(overlays,identity2){return overlays.map(({name,resource})=>{let slug=workflowSlugOf(name);return{name,slug,resource:create2(WorkflowSchema,{apiVersion:"agentic.stigmer.ai/v1",kind:"Workflow",metadata:memberMetadata(identity2,{name,slug},resource.metadata),spec:resource.spec})}})}function versionTag(version,warnings){return version===void 0||version===""?"":VERSION_TAG_PATTERN.test(version)?version:(warnings.push(create2(PluginWarningSchema,{kind:SERVER_WARNING_KINDS.versionNotTaggable,message:`version '${version}' cannot be a tag (letters, digits, '.', '_' and '-' only); this version is reachable by its digest but not by name`})),"")}function planMaterialization(plugin2,files,overlays,identity2,message6){let warnings=[];for(let ignored of plugin2.ignored)warnings.push(create2(PluginWarningSchema,{kind:SERVER_WARNING_KINDS.componentIgnored,path:ignored.path,message:`${ignored.kind} at '${ignored.path}' is not installed; Stigmer reads skills, MCP servers, sub-agents and the ai.stigmer/ overlay`}));let tag2=versionTag(plugin2.version,warnings),skills=planSkills(plugin2,files,identity2,tag2,message6),mcpServers=planMcpServers(plugin2,new Map(overlays.mcpServers.map(document2=>[document2.server,document2.resource])),identity2),agent=planAgent(plugin2,overlays.agent?.resource,mcpServers,identity2,warnings),workflows=planWorkflows(overlays.workflows,identity2),members=[...skills.map(skill=>({kind:ApiResourceKind.skill,slug:skill.slug,name:skill.name,system:skill.request.labels[SYSTEM_LABEL]===RESERVED_LABEL_TRUE})),...mcpServers.map(server=>({kind:ApiResourceKind.mcp_server,slug:server.slug,name:server.name,system:isSystemContent(server.resource.metadata)})),...agent===void 0?[]:[{kind:ApiResourceKind.agent,slug:agent.slug,name:agent.name,system:isSystemContent(agent.resource.metadata)}],...workflows.map(workflow=>({kind:ApiResourceKind.workflow,slug:workflow.slug,name:workflow.name,system:isSystemContent(workflow.resource.metadata)}))];return{skills,mcpServers,agent,workflows,members,tag:tag2,warnings}}function getDefaultExportFromCjs(x2){return x2&&x2.__esModule&&Object.prototype.hasOwnProperty.call(x2,"default")?x2.default:x2}var jsYaml={},loader={},common={},hasRequiredCommon;function requireCommon(){if(hasRequiredCommon)return common;hasRequiredCommon=1;function isNothing(subject){return typeof subject>"u"||subject===null}function isObject4(subject){return typeof subject=="object"&&subject!==null}function toArray(sequence){return Array.isArray(sequence)?sequence:isNothing(sequence)?[]:[sequence]}function extend(target,source){if(source){let sourceKeys=Object.keys(source);for(let index2=0,length=sourceKeys.length;index2<length;index2+=1){let key=sourceKeys[index2];target[key]=source[key]}}return target}function repeat(string,count){let result="";for(let cycle=0;cycle<count;cycle+=1)result+=string;return result}function isNegativeZero(number){return number===0&&Number.NEGATIVE_INFINITY===1/number}return common.isNothing=isNothing,common.isObject=isObject4,common.toArray=toArray,common.repeat=repeat,common.isNegativeZero=isNegativeZero,common.extend=extend,common}var exception,hasRequiredException;function requireException(){if(hasRequiredException)return exception;hasRequiredException=1;function formatError2(exception2,compact){let where="",message6=exception2.reason||"(unknown reason)";return exception2.mark?(exception2.mark.name&&(where+='in "'+exception2.mark.name+'" '),where+="("+(exception2.mark.line+1)+":"+(exception2.mark.column+1)+")",!compact&&exception2.mark.snippet&&(where+=`
@@ -1521,7 +1521,7 @@ Headers: `+JSON.stringify(headers2)),this.code=code,this.body=body,this.headers=
 \r
 SM\r
 \r
-`,"latin1");function createProtocolDemuxServer(targets){return(0,import_node_net4.createServer)({noDelay:!0},socket=>{routeByPreface(socket,targets)})}function routeByPreface(socket,targets){let peeked=[],peekedLength=0,cleanup=()=>{socket.removeListener("data",onData),socket.removeListener("error",onPeekError),socket.removeListener("close",cleanup)},onPeekError=()=>{cleanup(),socket.destroy()},onData=chunk=>{peeked.push(chunk),peekedLength+=chunk.length;let seen=Buffer.concat(peeked,Math.min(peekedLength,HTTP2_CONNECTION_PREFACE.length)),comparable=seen.subarray(0,Math.min(seen.length,HTTP2_CONNECTION_PREFACE.length));if(!HTTP2_CONNECTION_PREFACE.subarray(0,comparable.length).equals(comparable)){handoffHttp1();return}if(peekedLength>=HTTP2_CONNECTION_PREFACE.length){handoffHttp2();return}};function handoffHttp1(){cleanup(),socket.pause(),socket.unshift(Buffer.concat(peeked,peekedLength)),targets.http1.emit("connection",socket),socket.resume()}function handoffHttp2(){cleanup(),socket.pause();let replay=createReplayDuplex(socket,Buffer.concat(peeked,peekedLength));targets.http2.emit("connection",replay)}socket.on("data",onData),socket.on("error",onPeekError),socket.on("close",cleanup)}function createReplayDuplex(socket,head){let replay=new import_node_stream13.Duplex({read(){socket.resume()},write(chunk,encoding,callback){socket.write(chunk,encoding,callback)},final(callback){socket.end(callback)},destroy(error2,callback){socket.destroy(),callback(error2)}});return socket.on("data",chunk=>{replay.push(chunk)||socket.pause()}),socket.on("end",()=>{replay.push(null)}),socket.on("error",error2=>{replay.destroy(error2)}),replay.push(head),replay}function createUnifiedPortServer(options){let rpcHandler=connectNodeAdapter({routes:options.routes,interceptors:options.interceptors,readMaxBytes:10485760,writeMaxBytes:10485760}),laneRouter=(request,response)=>{let path14=(request.url??"").split("?",1)[0]??"";if(path14===TASK_KIND_REGISTRY_PATH){options.taskKindRegistryLane(request,response);return}if(path14===MODEL_REGISTRY_PATH){options.modelRegistryLane(request,response);return}if(options.skillTransferLane!==void 0&&path14.startsWith(SKILL_ARTIFACTS_PATH_PREFIX)){options.skillTransferLane(request,response);return}if(options.consoleLane!==void 0&&consoleLaneEligible(request)){options.consoleLane(request,response);return}if(isRpcPreflight(request)){handleRpcPreflight(request,response);return}applyRpcCorsHeaders(request,response),rpcHandler(request,response)},http1=(0,import_node_http4.createServer)(laneRouter),http22=(0,import_node_http22.createServer)(laneRouter),liveSessions=new Set;http22.on("session",session=>{liveSessions.add(session),session.on("close",()=>liveSessions.delete(session)),armKeepalivePings(session,options.logger)}),http22.on("sessionError",error2=>{options.logger.debug("http2 session error",{error:String(error2)})});let demux=createProtocolDemuxServer({http1,http2:http22}),liveSockets=new Set;return demux.on("connection",socket=>{liveSockets.add(socket),socket.on("close",()=>liveSockets.delete(socket))}),{listen(port,host="0.0.0.0"){return new Promise((resolve,reject2)=>{demux.once("error",reject2),demux.listen(port,host,()=>{let address=demux.address();if(address===null||typeof address=="string"){reject2(new Error("unified port bound without a TCP address"));return}resolve(address.port)})})},async shutdown(){let closed=new Promise(resolve=>demux.close(()=>resolve()));http1.close(),http1.closeIdleConnections(),http22.close();for(let session of liveSessions)session.close();await Promise.race([closed.then(()=>!0),new Promise(resolve=>setTimeout(()=>resolve(!1),1e4).unref())])||options.logger.warn("shutdown drain budget exhausted; destroying remaining connections",{remaining:liveSockets.size});for(let socket of liveSockets)socket.destroy();await closed}}}function armKeepalivePings(session,logger2){let interval=setInterval(()=>{let acked=!1,deadline=setTimeout(()=>{!acked&&!session.destroyed&&(logger2.debug("closing http2 session: keepalive ping unacknowledged"),session.destroy())},5e3);deadline.unref();try{session.ping(()=>{acked=!0,clearTimeout(deadline)})}catch{clearTimeout(deadline),session.destroyed||session.destroy()}},15e3);interval.unref(),session.on("close",()=>clearInterval(interval))}function registerExtensionServicesUnshadowed(router,registrations){let servedBy=new Map(router.handlers.map(handler=>[handler.requestPath,"the core"]));for(let{unit,register}of registrations){let before=router.handlers.length;register(router);for(let handler of router.handlers.slice(before)){let server=servedBy.get(handler.requestPath);if(server!==void 0)throw new Error(`extension '${unit}' registers ${handler.requestPath}, which ${server} already serves \u2014 a route is never registered twice; an edition changes a core domain's behaviour through its driver points`);servedBy.set(handler.requestPath,`extension '${unit}'`)}}}function createInProcessClients(routes,logger2){let transport=createRouterTransport(routes,{router:{interceptors:buildInterceptorChain(logger2,createInProcessCallerInterceptor())}}),agentInstanceCommand=createClient(AgentInstanceCommandController,transport),agentInstanceQuery=createClient(AgentInstanceQueryController,transport),agentQuery=createClient(AgentQueryController,transport),sessionCommand=createClient(SessionCommandController,transport),sessionQuery=createClient(SessionQueryController,transport),environmentCommand=createClient(EnvironmentCommandController,transport),environmentQuery=createClient(EnvironmentQueryController,transport),executionContextCommand=createClient(ExecutionContextCommandController,transport),workflowInstanceCommand=createClient(WorkflowInstanceCommandController,transport),workflowInstanceQuery=createClient(WorkflowInstanceQueryController,transport),workflowQuery=createClient(WorkflowQueryController,transport),agentExecutionCommand=createClient(AgentExecutionCommandController,transport),agentCommand=createClient(AgentCommandController,transport),workflowCommand=createClient(WorkflowCommandController,transport),mcpServerCommand=createClient(McpServerCommandController,transport),skillCommand=createClient(SkillCommandController,transport),asCaller=caller=>({headers:{[IN_PROCESS_CALLER_HEADER]:encodeInProcessCaller(caller)}}),clients={agentInstanceApplier:{applyAsCaller:(instance,caller)=>agentInstanceCommand.apply(instance,asCaller(caller))},parentAgentLoader:{get:agentId=>agentQuery.get(create2(AgentIdSchema,{value:agentId}))},workflowInstanceCreator:{createAsCaller:(instance,caller)=>workflowInstanceCommand.create(instance,asCaller(caller))},parentWorkflowLoader:{get:workflowId=>workflowQuery.get(create2(WorkflowIdSchema,{value:workflowId}))},executionAgentLoader:{get:agentId=>agentQuery.get(create2(AgentIdSchema,{value:agentId}))},executionAgentInstanceLoader:{get:instanceId=>agentInstanceQuery.get(create2(AgentInstanceIdSchema,{value:instanceId}))},executionAgentInstanceCreator:{createAsCaller:(instance,caller)=>agentInstanceCommand.create(instance,asCaller(caller))},executionSessionLoader:{get:sessionId=>sessionQuery.get(create2(SessionIdSchema,{value:sessionId}))},executionSessionCreator:{createAsCaller:(session,caller)=>sessionCommand.create(session,asCaller(caller))},executionEnvironmentReader:{list:request=>environmentQuery.list(request),getSecretValue:input=>environmentQuery.getSecretValue(input),updateVariables:request=>environmentCommand.updateVariables(request),create:(environment,caller)=>environmentCommand.create(environment,caller===void 0?void 0:asCaller(caller)),delete:input=>environmentCommand.delete(input)},executionContextCreator:{create:ec2=>executionContextCommand.create(ec2)},connectExecutionContextClient:{create:(ec2,caller)=>executionContextCommand.create(ec2,asCaller(caller)),delete:input=>executionContextCommand.delete(input)},workflowExecutionInstanceCreator:{createAsCaller:(instance,caller)=>workflowInstanceCommand.create(instance,asCaller(caller))},workflowExecutionInstanceLoader:{get:instanceId=>workflowInstanceQuery.get(create2(WorkflowInstanceIdSchema,{value:instanceId}))},workflowExecutionContextCreator:{create:ec2=>executionContextCommand.create(ec2)},workflowExecutionApprovalForwarder:{submitApproval:input=>agentExecutionCommand.submitApproval(input)},workflowExecutionFileDecisionForwarder:{submitFileDecision:input=>agentExecutionCommand.submitFileDecision(input)},scheduleExecutionCreator:{create:(execution,fireCaller)=>agentExecutionCommand.create(execution,fireCaller===void 0?void 0:asCaller(fireCaller))},executionStatusWriter:{updateStatus:input=>agentExecutionCommand.updateStatus(input)},pluginMaterializer:{pushSkill:(request,caller)=>skillCommand.push(request,asCaller(caller)),applyMcpServer:(server,caller)=>mcpServerCommand.apply(server,asCaller(caller)),applyAgent:(agent,caller)=>agentCommand.apply(agent,asCaller(caller)),applyWorkflow:(workflow,caller)=>workflowCommand.apply(workflow,asCaller(caller)),updateVisibility:(kind,resourceId,visibility,caller)=>updateVisibilityByKind(kind,resourceId,visibility,asCaller(caller)),deleteByKind:(kind,resourceId,caller)=>deleteByKind(kind,resourceId,asCaller(caller))}};async function deleteByKind(kind,resourceId,options){switch(kind){case ApiResourceKind.agent:await agentCommand.delete(create2(AgentIdSchema,{value:resourceId}),options);return;case ApiResourceKind.workflow:await workflowCommand.delete(create2(WorkflowIdSchema,{value:resourceId}),options);return;case ApiResourceKind.mcp_server:await mcpServerCommand.delete(create2(ApiResourceDeleteInputSchema,{resourceId}),options);return;case ApiResourceKind.skill:await skillCommand.delete(create2(SkillIdSchema,{value:resourceId}),options);return;default:throw new Error(`unsupported resource kind for delete: ${ApiResourceKind[kind]??String(kind)}`)}}async function updateVisibilityByKind(kind,resourceId,visibility,options){let input=create2(UpdateVisibilityInputSchema,{resourceId,visibility});switch(kind){case ApiResourceKind.agent:await agentCommand.updateVisibility(input,options);return;case ApiResourceKind.workflow:await workflowCommand.updateVisibility(input,options);return;case ApiResourceKind.mcp_server:await mcpServerCommand.updateVisibility(input,options);return;case ApiResourceKind.skill:await skillCommand.updateVisibility(input,options);return;default:throw new Error(`unsupported resource kind for updateVisibility: ${ApiResourceKind[kind]??String(kind)}`)}}return{clients,transport}}var LIST_INDEXES=[agentExecutionListIndex,artifactListIndex,iamPolicyListIndex,sessionListIndex,workflowExecutionListIndex];async function composeServer(options){let{config:config2,logger:logger2}=options,extensions=resolveExtensions(options.extensions);extensions.unitNames.length>0&&logger2.info("extension units composed",{units:extensions.unitNames.join(", ")});let store,storeOptions={listIndexes:LIST_INDEXES};config2.databaseUrl!==""?(store=await PostgresStore.open(config2.databaseUrl,logger2,storeOptions),logger2.info("storage driver selected",{driver:"postgres"})):(store=SqliteStore.open(config2.dbPath,logger2,storeOptions),logger2.info("storage driver selected",{driver:"sqlite",dbPath:config2.dbPath}));let authEnabled=config2.oidcIssuer!=="",requireAuthentication=authEnabled||extensions.requireAuthentication!==void 0,authorizationPosture=authorizationPostureOf({unitAuthorizer:extensions.authorizer!==void 0,requireAuthentication}),builtInAuthorization=authorizationPosture!=="unit-authorizer";if(authorizationPosture==="built-in"&&extensions.edition!==ServerEdition.oss)throw new Error(`the composition serves edition '${ServerEdition[extensions.edition]}' under the require-authentication posture but registers no Authorizer \u2014 the built-in authorizer enforces the open-source kinds only; register an Authorizer or serve the open-source edition`);let identityAccounts=extensions.drivers.identityAccountStore??newResourceIdentityAccountStore(store),iamPolicies=extensions.drivers.iamPolicyStore??newResourceIamPolicyStore(store),platformClients=extensions.drivers.platformClientStore??newResourcePlatformClientStore(store),iamPolicyGrantPath=newIamPolicyGrantPath({policies:iamPolicies,lifecycle:extensions.drivers.resourceAuthorizationLifecycle,logger:logger2}),authorizationLifecycle=extensions.drivers.resourceAuthorizationLifecycle,roleLifecycle=authorizationLifecycle??(builtInAuthorization?newBuiltInRoleLifecycle({grantPath:iamPolicyGrantPath,accounts:identityAccounts}):void 0),operatorIdentity=operatorIdentitySnapshot(),membership=builtInAuthorization?newMembershipRules({grantPath:iamPolicyGrantPath,policies:iamPolicies,store,operatorEmail:operatorIdentity.email}):void 0,runnerAuthService=RunnerAuthService.fromEnv(),runnerCredentials=extensions.drivers.runnerCredentialProvider??(authorizationPosture==="built-in"?newBuiltInRunnerCredentialProvider({service:runnerAuthService,store,accounts:identityAccounts}):newExecutionScopedRunnerCredentialProvider(runnerAuthService)),authorizer=extensions.authorizer??(authorizationPosture==="built-in"?newLaneAdmittedAuthorizer(newBuiltInAuthorizer({store,policies:iamPolicies,accounts:identityAccounts,edition:extensions.edition,logger:logger2}),caller=>isWorkflowBoundRunner(runnerAuthService,caller)):newPermissiveSingleTeamAuthorizer()),organizationDirectory=extensions.drivers.organizationDirectory??(authorizationPosture==="built-in"?newBuiltInOrganizationDirectory({store,policies:iamPolicies,accounts:identityAccounts}):void 0),scheduleFireCaller=extensions.drivers.scheduleFireCaller??(authorizationPosture==="built-in"?newBuiltInScheduleFireCaller({store,accounts:identityAccounts}):void 0),listReadScope=extensions.drivers.listReadScope??(authorizationPosture==="built-in"?newBuiltInListReadScope({store,policies:iamPolicies,accounts:identityAccounts,logger:logger2}):void 0);logger2.info("authorization posture resolved",{posture:authorizationPosture,authorizer:extensions.authorizer!==void 0?"extension":authorizationPosture==="built-in"?"built-in":"permissive",listReadScope:extensions.drivers.listReadScope!==void 0?"extension":authorizationPosture==="built-in"?"built-in":"none"});let identityAccountPath={accounts:identityAccounts,logger:logger2,authorizer,authorizationLifecycle:roleLifecycle},createIdentityAccount=newCreateAccountPath(identityAccountPath,ApiResourceKind.identity_account),issuerDiscovery=newIssuerDiscovery(),identityAccountProvisioner=newDirectAccountProvisioner({accounts:identityAccounts,createAccount:createIdentityAccount,userInfo:newOidcUserInfoClient(issuerDiscovery)});if(!requireAuthentication){let operator=await ensureOperatorAccount({accounts:identityAccounts,createAccount:createIdentityAccount},operatorIdentity);logger2.info("trusted-local operator account ensured",{accountId:operator.metadata?.id??""}),membership!==void 0&&(await membership.ensureOperatorOwnership(operator),logger2.info("trusted-local operator ownership ensured",{accountId:operator.metadata?.id??""}))}authorizationPosture==="built-in"&&membership!==void 0&&(await membership.ensureRolesForExistingAccounts(),logger2.info("built-in posture role reconciliation ensured"));let v1Key;try{v1Key=getOrCreateNamedKey(ENCRYPTION_KEY_ENV_VAR,ENCRYPTION_KEY_FILE_NAME)}catch(error2){logger2.warn("Failed to initialize encryption - secret values will be stored in plaintext",{error:error2 instanceof Error?error2.message:String(error2)}),v1Key=void 0}let secretCodecs=new Map([[V1_VERSION,new StaticKeySecretCodec(v1Key)],...extensions.drivers.secretCodecs]),writeVersionValue=process.env[ENCRYPTION_WRITE_VERSION_ENV_VAR]??"",secretService=SecretService.withCodecs({codecs:secretCodecs,writeVersion:writeVersionValue===""?DEFAULT_WRITE_VERSION:writeVersionValue});logger2.info("secret encryption configured",{writeVersion:writeVersionValue===""?DEFAULT_WRITE_VERSION:writeVersionValue,registeredCodecs:[...secretCodecs.keys()].sort()});let platformTokenKeys=resolvePlatformTokenKeys({requireAuthentication,supplied:extensions.drivers.platformTokenKeys,edition:extensions.edition});logger2.info("platform-token keys resolved",{source:platformTokenKeys===void 0?"none (no authentication posture)":extensions.drivers.platformTokenKeys!==void 0?"extension":"open-source ladder",signing:platformTokenKeys?.signer!==void 0});let temporalConfig=newConfigFromEnv(),workflowExecutionTemporalConfig=newWorkflowExecutionConfigFromEnv(),sandboxProvisioner=newSandboxProvisioner(config2.sandboxProvisionerType,{config:{backendEndpoint:config2.sandboxBackendEndpoint,temporalAddress:config2.sandboxTemporalAddress,temporalNamespace:config2.temporalNamespace,temporalConnectionEnv:temporalConnectionEnv(config2.temporalConnection),runnerImage:config2.sandboxRunnerImage,runnerCommand:config2.sandboxRunnerCommand,kubernetesNamespace:config2.sandboxKubernetesNamespace},logger:logger2},builtInSandboxProvisionerFactories(),extensions.drivers.sandboxProvisionerDrivers);if(sandboxProvisioner!==void 0&&temporalConfig.activityRouting!==ROUTING_SESSION&&workflowExecutionTemporalConfig.workflowActivityRouting!==WORKFLOW_ROUTING_EXECUTION)throw new Error(`SANDBOX_PROVISIONER_TYPE='${config2.sandboxProvisionerType}' requires a per-queue routing mode \u2014 set STIGMER_ACTIVITY_ROUTING=session and/or STIGMER_WORKFLOW_ACTIVITY_ROUTING=execution (a provisioner no dispatch can reach must fail loudly, not sit dark)`);let sandboxLane=newSandboxLane(sandboxProvisioner,runnerCredentials);sandboxLane.enabled&&logger2.info("sandbox provisioner composed",{type:config2.sandboxProvisionerType});let workflowSandboxTerminalObserver=newWorkflowSandboxTerminalObserver(sandboxLane,logger2),healthState=new HealthState,modelCatalog,ossModelRegistryStore;extensions.drivers.modelCatalogProvider!==void 0?modelCatalog=extensions.drivers.modelCatalogProvider:(ossModelRegistryStore=new ModelRegistryStore({bundledDocument:bundledModelRegistryDocument(),upstreamOrigin:config2.modelRegistryUpstream,refreshEnabled:config2.modelRegistryRefreshEnabled,logger:logger2,fetchImpl:options.fetchImpl}),modelCatalog=ossModelRegistryStore);let registryLanes=createRegistryLanes({taskKindRegistryDocument:bundledTaskKindRegistryDocument(),modelRegistryStore:modelCatalog}),workflowValidator=new InProcessValidator(modelCatalog,logger2),agentExecutionStreamBroker=new StreamBroker(logger2),workflowExecutionStreamBroker=new StreamBroker2(logger2),scheduleTemporalConfig=newScheduleConfigFromEnv(),scheduleClientProvider=()=>temporalManager.getClient(),scheduleArtifact=new ScheduleArtifact(scheduleTemporalConfig),scheduleSyncer=new ScheduleSyncer(scheduleClientProvider,store,scheduleArtifact,logger2),scheduleRunStarter=new RunStarter({store,config:scheduleTemporalConfig,executions:{create:(execution,fireCaller)=>requireInProcess().scheduleExecutionCreator.create(execution,fireCaller)},fireCallerMint:scheduleFireCaller,logger:logger2}),scheduleReconciler=new ScheduleReconciler(scheduleClientProvider,store,scheduleSyncer,scheduleTemporalConfig,logger2),temporalManager=new TemporalManager({hostPort:config2.temporalHostPort,namespace:config2.temporalNamespace,connection:config2.temporalConnection,logger:logger2,payloadCodecs:loadServerPayloadCodecs(runnerCredentials.resolvePayloadKey?.bind(runnerCredentials)),workerFactories:[newAgentExecutionWorkerFactory({store,logger:logger2,statusWriter:()=>requireInProcess().executionStatusWriter,temporalConfig}),newWorkflowExecutionWorkerFactory({store,logger:logger2,broker:workflowExecutionStreamBroker,temporalConfig:workflowExecutionTemporalConfig,sandboxTerminalObserver:workflowSandboxTerminalObserver}),newScheduleWorkerFactory({store,config:scheduleTemporalConfig,syncer:scheduleSyncer,runStarter:scheduleRunStarter,logger:logger2}),...extensions.workers]}),executionEngineState=newExecutionEngineStateProvider({manager:temporalManager,config:temporalConfig,store,runnerCredentials,logger:logger2}),workflowExecutionEngineState=newWorkflowExecutionEngineStateProvider({manager:temporalManager,config:workflowExecutionTemporalConfig,runnerCredentials,logger:logger2}),artifactStorage=newArtifactStorage({type:config2.artifactStorageType,localBasePath:config2.artifactLocalBasePath,localServeUrl:config2.artifactLocalServeUrl,r2Bucket:config2.r2Bucket,r2Endpoint:config2.r2Endpoint,r2AccessKeyId:config2.r2AccessKeyId,r2SecretAccessKey:config2.r2SecretAccessKey,r2Region:config2.r2Region},extensions.drivers.artifactStorageDrivers),artifactFileServer=config2.artifactStorageType==="local"?createArtifactFileServer({basePath:config2.artifactLocalBasePath,logger:logger2}):void 0,skillUploadSlots=new UploadSlots(config2.storagePath,STAGING_KEY_PREFIX,DEFAULT_SLOT_TTL_MS,104857600),skillType=config2.skillArtifactStorageType===""?"local":config2.skillArtifactStorageType,skillStorageDriver=skillType==="local"?((0,import_node_fs16.mkdirSync)(import_node_path18.default.join(config2.storagePath,"skills"),{recursive:!0,mode:493}),new LocalArtifactStorage(config2.storagePath,transferServeUrl(config2.skillTransferBaseUrl),{reserve:(key,declaredSizeBytes)=>{let{ttlMs}=skillUploadSlots.reserve(key,declaredSizeBytes);return{url:uploadUrl(config2.skillTransferBaseUrl,uploadRefOf(key)),ttlMs}}})):newArtifactStorage({type:skillType,localBasePath:config2.storagePath,localServeUrl:"",r2Bucket:config2.r2Bucket,r2Endpoint:config2.r2Endpoint,r2AccessKeyId:config2.r2AccessKeyId,r2SecretAccessKey:config2.r2SecretAccessKey,r2Region:config2.r2Region},extensions.drivers.artifactStorageDrivers),skillArtifactStorage=newSkillArtifactStorage(skillStorageDriver),pluginArtifactStorage=newContentAddressedArchiveStore(skillStorageDriver,PLUGIN_ARTIFACT_KEY_PREFIX),skillArchiveStaging=newArchiveStaging(skillStorageDriver,logger2),skillTransferLane=newSkillTransferLane(skillUploadSlots,skillArtifactStorage,logger2),transferOrigin=assessSkillTransferOrigin({baseUrl:config2.skillTransferBaseUrl,relaysThroughServer:skillType==="local",requireAuthentication});transferOrigin.kind==="loopback-hosted"&&logger2.warn("skill artifact transfer lane mints capability URLs on the server's own loopback while the server requires authentication; pushes above the gRPC message cap and sandbox skill downloads will fail \u2014 set SKILL_TRANSFER_BASE_URL to the origin callers reach this server on",{baseUrl:transferOrigin.baseUrl});let consoleAssets=resolveConsoleAssets(config2.consoleDir,logger2);consoleAssets!==void 0?logger2.info("web console serving from unified port",{dir:consoleAssets.root,files:consoleAssets.fileCount}):logger2.debug("no web console export bundled; console lane disabled");let consoleSignIn=authEnabled?{posture:"oidc",issuer:config2.oidcIssuer,audience:config2.oidcAudience,consoleClientId:config2.oidcConsoleClientId}:{posture:"trusted-local"};consoleAssets!==void 0&&consoleSignIn.posture==="oidc"&&consoleSignIn.consoleClientId===""&&logger2.warn("STIGMER_OIDC_ISSUER is set but STIGMER_OIDC_CONSOLE_CLIENT_ID is not \u2014 the web console this server serves cannot sign in; register a public PKCE client for the console at the issuer and set it");let consoleLane=consoleAssets!==void 0?createConsoleLane({assets:consoleAssets,signIn:consoleSignIn,logger:logger2}):void 0,searchRegistry=newSearchableResourceRegistry();searchRegistry.validateExpectedKinds(logger2);let searchQueryStore=new SqliteSearchQueryStore(store,searchRegistry,logger2),searchHandler=new SearchHandler(searchQueryStore,logger2,listReadScope),activityHandler=new ActivityHandler(store,logger2,listReadScope),environmentResolution=new RuntimeResolutionService(store,secretService,logger2),managedEnvService=new ManagedEnvironmentService({getSecretValue:input=>requireInProcess().executionEnvironmentReader.getSecretValue(input),updateVariables:request=>requireInProcess().executionEnvironmentReader.updateVariables(request),create:(environment,caller)=>requireInProcess().executionEnvironmentReader.create(environment,caller),delete:input=>requireInProcess().executionEnvironmentReader.delete(input)},logger2),mcpServerEngineState=newMcpServerEngineStateProvider({manager:temporalManager,config:temporalConfig,logger:logger2}),oauthRedirect=resolveOAuthRedirectUri({configured:config2.oauthRedirectUri,servesConsole:consoleAssets!==void 0,port:options.portOverride??config2.grpcPort});switch(oauthRedirect.kind){case"configured":break;case"derived":logger2.info("STIGMER_OAUTH_REDIRECT_URI is not set \u2014 deriving the served console's callback for MCP server OAuth Connect",{redirectUri:oauthRedirect.uri});break;case"absent":logger2.warn("STIGMER_OAUTH_REDIRECT_URI is not set \u2014 OAuth Connect flows for MCP servers are unavailable (initiateOAuthConnect will refuse)");break;default:{let exhaustive=oauthRedirect;throw new Error(String(exhaustive))}}let oauthRedirectUri=oauthRedirect.kind==="absent"?"":oauthRedirect.uri,outboundFetch=guardedFetch(extensions.drivers.outboundEgress??relaxedEgressPolicy(),{fetchImpl:options.fetchImpl??fetch,lookup:nodeLookup()}),inProcess;function requireInProcess(){if(inProcess===void 0)throw new Error("in-process clients not wired (boot ordering bug)");return inProcess}let routes=router=>{registerHealthService(router,healthState),registerOrganizationServices(router,{store,logger:logger2,authorizer,gateSteps:extensions.gateSteps,authorizationLifecycle:roleLifecycle,organizationDirectory}),registerApiKeyServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope}),registerIdentityAccountServices(router,{...identityAccountPath,provisioner:identityAccountProvisioner,federation:extensions.drivers.identityFederation,gateSteps:extensions.gateSteps,membership}),registerIamPolicyServices(router,{grantPath:iamPolicyGrantPath,policies:iamPolicies,accounts:identityAccounts,authorizer,grantScope:extensions.drivers.policyGrantScope??newOrganizationOnlyGrantScope(),queries:extensions.drivers.authorizationQueries,principalDisplay:extensions.drivers.principalDisplay,gateSteps:extensions.gateSteps,edition:extensions.edition,logger:logger2}),registerEnvironmentServices(router,{store,logger:logger2,authorizer,secretService,authorizationLifecycle,listReadScope}),registerOAuthAppServices(router,{store,secretService,logger:logger2,authorizer,authorizationLifecycle,listReadScope}),registerPlatformClientServices(router,{clients:platformClients,store,logger:logger2,authorizer,authorizationLifecycle,listReadScope}),registerPlatformClientTokenService(router,{mint:{clients:platformClients,accounts:identityAccounts,createAccount:createIdentityAccount,grantPath:iamPolicyGrantPath,keys:platformTokenKeys,logger:logger2,now:()=>new Date},guestTokenMinting:extensions.drivers.guestTokenMinting}),registerExecutionContextServices(router,{store,logger:logger2,authorizer,secretService,runnerAuthService:runnerCredentials,authorizationLifecycle}),registerAgentServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,agentInstanceApplier:()=>requireInProcess().agentInstanceApplier}),registerAgentInstanceServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,parentAgentLoader:()=>requireInProcess().parentAgentLoader,listReadScope}),registerSessionServices(router,{store,logger:logger2,authorizer,temporalConfig,gateSteps:extensions.gateSteps,sandboxLane,authorizationLifecycle,listReadScope}),registerAgentShareServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope}),registerAgentChannelServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope,modelRegistry:modelCatalog,channelRuntime:extensions.drivers.channelRuntime}),registerChannelMessageServices(router,extensions.drivers.channelRuntime),registerChannelConversationServices(router,extensions.drivers.channelRuntime),registerChannelAppServices(router,{store,logger:logger2,authorizer,secretService,authorizationLifecycle}),registerScheduleServices(router,{store,logger:logger2,authorizer,modelRegistry:modelCatalog,clock:()=>scheduleSyncer,runner:()=>scheduleRunStarter,authorizationLifecycle,listReadScope}),registerMemoryServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope,runnerCredentialProvider:runnerCredentials}),registerAgentExecutionServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope,runnerCredentialProvider:runnerCredentials,broker:agentExecutionStreamBroker,engineState:executionEngineState,modelRegistry:modelCatalog,artifactStorage,gateSteps:extensions.gateSteps,statusObservers:extensions.statusObservers,responseDecorators:extensions.responseDecorators,sandboxLane,temporalConfig,agentLoader:()=>requireInProcess().executionAgentLoader,agentInstanceCreator:()=>requireInProcess().executionAgentInstanceCreator,sessionCreator:()=>requireInProcess().executionSessionCreator,executionContextBuilder:{store,logger:logger2,agentLoader:()=>requireInProcess().executionAgentLoader,agentInstanceLoader:()=>requireInProcess().executionAgentInstanceLoader,sessionLoader:()=>requireInProcess().executionSessionLoader,environmentReader:()=>requireInProcess().executionEnvironmentReader,environmentResolution,executionContextCreator:()=>requireInProcess().executionContextCreator,managedEnvService,platformClients,fetchImpl:asFetch(outboundFetch)}}),registerWorkflowServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,validator:workflowValidator,workflowInstanceCreator:()=>requireInProcess().workflowInstanceCreator}),registerWorkflowInstanceServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,parentWorkflowLoader:()=>requireInProcess().parentWorkflowLoader,listReadScope}),registerWorkflowExecutionServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope,gateSteps:extensions.gateSteps,engineState:workflowExecutionEngineState,broker:workflowExecutionStreamBroker,sandboxLane,temporalConfig:workflowExecutionTemporalConfig,sandboxTerminalObserver:workflowSandboxTerminalObserver,workflowInstanceCreator:()=>requireInProcess().workflowExecutionInstanceCreator,approvalForwarder:()=>requireInProcess().workflowExecutionApprovalForwarder,fileDecisionForwarder:()=>requireInProcess().workflowExecutionFileDecisionForwarder,executionContextBuilder:{store,logger:logger2,workflowInstanceLoader:()=>requireInProcess().workflowExecutionInstanceLoader,environmentResolution,executionContextCreator:()=>requireInProcess().workflowExecutionContextCreator}}),registerMcpServerServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,connect:{store,logger:logger2,authorizer,engineState:mcpServerEngineState,environmentReader:{list:request=>requireInProcess().executionEnvironmentReader.list(request),getSecretValue:input=>requireInProcess().executionEnvironmentReader.getSecretValue(input)},executionContext:{create:(ec2,caller)=>requireInProcess().connectExecutionContextClient.create(ec2,caller),delete:input=>requireInProcess().connectExecutionContextClient.delete(input)},runnerAuth:runnerCredentials,managedEnv:managedEnvService,oauthGrants:store.oauthGrants,pendingOAuthStates:store.pendingOAuthStates,secretService,oauthRedirectUri,outboundFetch}}),registerSkillServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,artifactStorage:skillArtifactStorage,executionArtifactStorage:artifactStorage,staging:skillArchiveStaging}),registerPluginServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,artifactStorage:pluginArtifactStorage,materializerProvider:()=>requireInProcess().pluginMaterializer,staging:skillArchiveStaging}),registerArtifactServices(router,{store,artifactStorage,logger:logger2,authorizer}),registerSearchServices(router,{handler:searchHandler,logger:logger2}),registerActivityServices(router,{handler:activityHandler,logger:logger2}),registerGitHubServices(router,{clientId:config2.gitHubOAuthClientId,clientSecret:config2.gitHubOAuthClientSecret,logger:logger2,fetchImpl:options.fetchImpl}),registerPlatformServices(router,{temporalHostPort:config2.temporalHostPort,temporalNamespace:config2.temporalNamespace,runnerAuthService:runnerCredentials,edition:extensions.edition,version:options.version??SERVER_VERSION,authenticationRequired:requireAuthentication,licenseStatus:extensions.drivers.licenseStatus??ABSENT_LICENSE_STATUS,now:()=>new Date,logger:logger2}),registerExtensionServicesUnshadowed(router,extensions.services)},inProcessWiring=createInProcessClients(routes,logger2);inProcess=inProcessWiring.clients;let identityVerifiers=[...requireAuthentication?[newApiKeyIdentityVerifier({store,accounts:identityAccounts,logger:logger2,now:()=>new Date})]:[],...platformTokenKeys!==void 0?[newPlatformClientTokenVerifier({keys:platformTokenKeys,clients:platformClients})]:[],...authorizationPosture==="built-in"?[newRunnerSubjectIdentityVerifier({store,accounts:identityAccounts,credentials:runnerCredentials})]:[],...authEnabled?[newOidcIdentityVerifier({issuer:config2.oidcIssuer,audience:config2.oidcAudience,accounts:identityAccounts,discovery:issuerDiscovery})]:[],...extensions.identityVerifiers];if(extensions.requireAuthentication!==void 0&&extensions.identityVerifiers.length===0)throw new Error(`extension '${extensions.requireAuthentication.declaredBy}' declares the require-authentication posture, but registers no identity verifier of its own \u2014 the OSS API-key lane alone cannot admit the first caller (nobody could mint a key), so every non-public request would be refused; register a verifier or omit the declaration`);let postureSources=[...authEnabled?["oidc-issuer"]:[],...extensions.requireAuthentication!==void 0?[`extension '${extensions.requireAuthentication.declaredBy}'`]:[]],callerGuards=[...platformTokenKeys!==void 0?[newPlatformClientOriginGuard({clients:platformClients,logger:logger2})]:[],...extensions.callerGuards];logger2.info("authentication posture resolved",{posture:requireAuthentication?"required":"trusted-local",source:postureSources.length>0?postureSources.join(" + "):"none",verifiers:identityVerifiers.map(v=>v.name).join(", ")});let server=createUnifiedPortServer({logger:logger2,routes,interceptors:buildInterceptorChain(logger2,createVerifierChainInterceptor(identityVerifiers,callerGuards,logger2,requireAuthentication),{errorBoundary:createErrorBoundaryInterceptor(logger2,extensions.drivers.visitorErrorPolicy),requestMetrics:createRequestMetricsInterceptor()}),taskKindRegistryLane:registryLanes.taskKindRegistryLane,modelRegistryLane:registryLanes.modelRegistryLane,skillTransferLane,consoleLane});return{healthState,store,secrets:secretService,temporalManager,runnerAuthService,agentExecutionStreamBroker,workflowExecutionStreamBroker,inProcessTransport:inProcessWiring.transport,identityVerifiers,routes,async start(){await temporalManager.initialConnect()&&await temporalManager.startWorkers(),temporalManager.startHealthMonitor();let kickScheduleReconcile=scheduleReconciler.startReconciliation();temporalManager.addReconnectHook(kickScheduleReconcile),await artifactStorage.health();try{let indexed=await searchQueryStore.rebuildIndex();logger2.info("Search index rebuilt at startup",{indexed})}catch(error2){logger2.warn("Failed to rebuild search index at startup",{error:error2 instanceof Error?error2.message:String(error2)})}await initRpcMetrics(),logger2.info("request metrics",{posture:await metricsExportPosture(),instruments:"stigmer.grpc.request.count, stigmer.grpc.request.duration"}),healthState.setOverall(HealthCheckResponse_ServingStatus.SERVING),ossModelRegistryStore?.startRefresh();let port=await server.listen(options.portOverride??config2.grpcPort,options.host);if(logger2.info("stigmer-server listening",{port}),artifactFileServer!==void 0){await warnOnLegacyArtifactLayout(config2.artifactLocalBasePath,logger2);try{await artifactFileServer.listen(config2.artifactHttpPort,config2.artifactHttpHost)}catch(error2){logger2.error("Artifact HTTP file server failed",{error:error2 instanceof Error?error2.message:String(error2)})}}return port},async shutdown(){healthState.setOverall(HealthCheckResponse_ServingStatus.NOT_SERVING),ossModelRegistryStore?.stopRefresh(),await artifactFileServer?.shutdown(),await scheduleReconciler.stop(),await temporalManager.close(),await server.shutdown(),await store.close(),logger2.info("stigmer-server stopped")}}}var LEVEL_RANK={debug:10,info:20,warn:30,error:40};function createLogger(options){let threshold=LEVEL_RANK[options.level]??LEVEL_RANK.info,write2=options.write??(line=>process.stderr.write(line+`
+`,"latin1");function createProtocolDemuxServer(targets){return(0,import_node_net4.createServer)({noDelay:!0},socket=>{routeByPreface(socket,targets)})}function routeByPreface(socket,targets){let peeked=[],peekedLength=0,cleanup=()=>{socket.removeListener("data",onData),socket.removeListener("error",onPeekError),socket.removeListener("close",cleanup)},onPeekError=()=>{cleanup(),socket.destroy()},onData=chunk=>{peeked.push(chunk),peekedLength+=chunk.length;let seen=Buffer.concat(peeked,Math.min(peekedLength,HTTP2_CONNECTION_PREFACE.length)),comparable=seen.subarray(0,Math.min(seen.length,HTTP2_CONNECTION_PREFACE.length));if(!HTTP2_CONNECTION_PREFACE.subarray(0,comparable.length).equals(comparable)){handoffHttp1();return}if(peekedLength>=HTTP2_CONNECTION_PREFACE.length){handoffHttp2();return}};function handoffHttp1(){cleanup(),socket.pause(),socket.unshift(Buffer.concat(peeked,peekedLength)),targets.http1.emit("connection",socket),socket.resume()}function handoffHttp2(){cleanup(),socket.pause();let replay=createReplayDuplex(socket,Buffer.concat(peeked,peekedLength));targets.http2.emit("connection",replay)}socket.on("data",onData),socket.on("error",onPeekError),socket.on("close",cleanup)}function createReplayDuplex(socket,head){let replay=new import_node_stream13.Duplex({read(){socket.resume()},write(chunk,encoding,callback){socket.write(chunk,encoding,callback)},final(callback){socket.end(callback)},destroy(error2,callback){socket.destroy(),callback(error2)}});return socket.on("data",chunk=>{replay.push(chunk)||socket.pause()}),socket.on("end",()=>{replay.push(null)}),socket.on("error",error2=>{replay.destroy(error2)}),replay.push(head),replay}function createUnifiedPortServer(options){let rpcHandler=connectNodeAdapter({routes:options.routes,interceptors:options.interceptors,readMaxBytes:10485760,writeMaxBytes:10485760}),laneRouter=(request,response)=>{let path14=(request.url??"").split("?",1)[0]??"";if(path14===TASK_KIND_REGISTRY_PATH){options.taskKindRegistryLane(request,response);return}if(path14===MODEL_REGISTRY_PATH){options.modelRegistryLane(request,response);return}if(options.skillTransferLane!==void 0&&path14.startsWith(SKILL_ARTIFACTS_PATH_PREFIX)){options.skillTransferLane(request,response);return}if(options.consoleLane!==void 0&&consoleLaneEligible(request)){options.consoleLane(request,response);return}if(isRpcPreflight(request)){handleRpcPreflight(request,response);return}applyRpcCorsHeaders(request,response),rpcHandler(request,response)},http1=(0,import_node_http4.createServer)(laneRouter),http22=(0,import_node_http22.createServer)(laneRouter),liveSessions=new Set;http22.on("session",session=>{liveSessions.add(session),session.on("close",()=>liveSessions.delete(session)),armKeepalivePings(session,options.logger)}),http22.on("sessionError",error2=>{options.logger.debug("http2 session error",{error:String(error2)})});let demux=createProtocolDemuxServer({http1,http2:http22}),liveSockets=new Set;return demux.on("connection",socket=>{liveSockets.add(socket),socket.on("close",()=>liveSockets.delete(socket))}),{listen(port,host="0.0.0.0"){return new Promise((resolve,reject2)=>{demux.once("error",reject2),demux.listen(port,host,()=>{let address=demux.address();if(address===null||typeof address=="string"){reject2(new Error("unified port bound without a TCP address"));return}resolve(address.port)})})},async shutdown(){let closed=new Promise(resolve=>demux.close(()=>resolve()));http1.close(),http1.closeIdleConnections(),http22.close();for(let session of liveSessions)session.close();await Promise.race([closed.then(()=>!0),new Promise(resolve=>setTimeout(()=>resolve(!1),1e4).unref())])||options.logger.warn("shutdown drain budget exhausted; destroying remaining connections",{remaining:liveSockets.size});for(let socket of liveSockets)socket.destroy();await closed}}}function armKeepalivePings(session,logger2){let interval=setInterval(()=>{let acked=!1,deadline=setTimeout(()=>{!acked&&!session.destroyed&&(logger2.debug("closing http2 session: keepalive ping unacknowledged"),session.destroy())},5e3);deadline.unref();try{session.ping(()=>{acked=!0,clearTimeout(deadline)})}catch{clearTimeout(deadline),session.destroyed||session.destroy()}},15e3);interval.unref(),session.on("close",()=>clearInterval(interval))}function registerExtensionServicesUnshadowed(router,registrations){let servedBy=new Map(router.handlers.map(handler=>[handler.requestPath,"the core"]));for(let{unit,register}of registrations){let before=router.handlers.length;register(router);for(let handler of router.handlers.slice(before)){let server=servedBy.get(handler.requestPath);if(server!==void 0)throw new Error(`extension '${unit}' registers ${handler.requestPath}, which ${server} already serves \u2014 a route is never registered twice; an edition changes a core domain's behaviour through its driver points`);servedBy.set(handler.requestPath,`extension '${unit}'`)}}}function createInProcessClients(routes,logger2){let transport=createRouterTransport(routes,{router:{interceptors:buildInterceptorChain(logger2,createInProcessCallerInterceptor())}}),agentInstanceCommand=createClient(AgentInstanceCommandController,transport),agentInstanceQuery=createClient(AgentInstanceQueryController,transport),agentQuery=createClient(AgentQueryController,transport),sessionCommand=createClient(SessionCommandController,transport),sessionQuery=createClient(SessionQueryController,transport),environmentCommand=createClient(EnvironmentCommandController,transport),environmentQuery=createClient(EnvironmentQueryController,transport),executionContextCommand=createClient(ExecutionContextCommandController,transport),workflowInstanceCommand=createClient(WorkflowInstanceCommandController,transport),workflowInstanceQuery=createClient(WorkflowInstanceQueryController,transport),workflowQuery=createClient(WorkflowQueryController,transport),agentExecutionCommand=createClient(AgentExecutionCommandController,transport),agentCommand=createClient(AgentCommandController,transport),workflowCommand=createClient(WorkflowCommandController,transport),mcpServerCommand=createClient(McpServerCommandController,transport),skillCommand=createClient(SkillCommandController,transport),asCaller=caller=>({headers:{[IN_PROCESS_CALLER_HEADER]:encodeInProcessCaller(caller)}}),clients={agentInstanceApplier:{applyAsCaller:(instance,caller)=>agentInstanceCommand.apply(instance,asCaller(caller))},parentAgentLoader:{get:agentId=>agentQuery.get(create2(AgentIdSchema,{value:agentId}))},workflowInstanceCreator:{createAsCaller:(instance,caller)=>workflowInstanceCommand.create(instance,asCaller(caller))},parentWorkflowLoader:{get:workflowId=>workflowQuery.get(create2(WorkflowIdSchema,{value:workflowId}))},executionAgentLoader:{get:agentId=>agentQuery.get(create2(AgentIdSchema,{value:agentId}))},executionAgentInstanceLoader:{get:instanceId=>agentInstanceQuery.get(create2(AgentInstanceIdSchema,{value:instanceId}))},executionAgentInstanceCreator:{createAsCaller:(instance,caller)=>agentInstanceCommand.create(instance,asCaller(caller))},executionSessionLoader:{get:sessionId=>sessionQuery.get(create2(SessionIdSchema,{value:sessionId}))},executionSessionCreator:{createAsCaller:(session,caller)=>sessionCommand.create(session,asCaller(caller))},executionEnvironmentReader:{list:request=>environmentQuery.list(request),getSecretValue:input=>environmentQuery.getSecretValue(input),updateVariables:request=>environmentCommand.updateVariables(request),create:(environment,caller)=>environmentCommand.create(environment,caller===void 0?void 0:asCaller(caller)),delete:input=>environmentCommand.delete(input)},executionContextCreator:{create:ec2=>executionContextCommand.create(ec2)},connectExecutionContextClient:{create:(ec2,caller)=>executionContextCommand.create(ec2,asCaller(caller)),delete:input=>executionContextCommand.delete(input)},workflowExecutionInstanceCreator:{createAsCaller:(instance,caller)=>workflowInstanceCommand.create(instance,asCaller(caller))},workflowExecutionInstanceLoader:{get:instanceId=>workflowInstanceQuery.get(create2(WorkflowInstanceIdSchema,{value:instanceId}))},workflowExecutionContextCreator:{create:ec2=>executionContextCommand.create(ec2)},workflowExecutionApprovalForwarder:{submitApproval:input=>agentExecutionCommand.submitApproval(input)},workflowExecutionFileDecisionForwarder:{submitFileDecision:input=>agentExecutionCommand.submitFileDecision(input)},scheduleExecutionCreator:{create:(execution,fireCaller)=>agentExecutionCommand.create(execution,fireCaller===void 0?void 0:asCaller(fireCaller))},executionStatusWriter:{updateStatus:input=>agentExecutionCommand.updateStatus(input)},pluginMaterializer:{pushSkill:(request,caller)=>skillCommand.push(request,asCaller(caller)),applyMcpServer:(server,caller)=>mcpServerCommand.apply(server,asCaller(caller)),applyAgent:(agent,caller)=>agentCommand.apply(agent,asCaller(caller)),applyWorkflow:(workflow,caller)=>workflowCommand.apply(workflow,asCaller(caller)),updateVisibility:(kind,resourceId,visibility,caller)=>updateVisibilityByKind(kind,resourceId,visibility,asCaller(caller)),deleteByKind:(kind,resourceId,caller)=>deleteByKind(kind,resourceId,asCaller(caller))}};async function deleteByKind(kind,resourceId,options){switch(kind){case ApiResourceKind.agent:await agentCommand.delete(create2(AgentIdSchema,{value:resourceId}),options);return;case ApiResourceKind.workflow:await workflowCommand.delete(create2(WorkflowIdSchema,{value:resourceId}),options);return;case ApiResourceKind.mcp_server:await mcpServerCommand.delete(create2(ApiResourceDeleteInputSchema,{resourceId}),options);return;case ApiResourceKind.skill:await skillCommand.delete(create2(SkillIdSchema,{value:resourceId}),options);return;default:throw new Error(`unsupported resource kind for delete: ${ApiResourceKind[kind]??String(kind)}`)}}async function updateVisibilityByKind(kind,resourceId,visibility,options){let input=create2(UpdateVisibilityInputSchema,{resourceId,visibility});switch(kind){case ApiResourceKind.agent:await agentCommand.updateVisibility(input,options);return;case ApiResourceKind.workflow:await workflowCommand.updateVisibility(input,options);return;case ApiResourceKind.mcp_server:await mcpServerCommand.updateVisibility(input,options);return;case ApiResourceKind.skill:await skillCommand.updateVisibility(input,options);return;default:throw new Error(`unsupported resource kind for updateVisibility: ${ApiResourceKind[kind]??String(kind)}`)}}return{clients,transport}}var LIST_INDEXES=[agentExecutionListIndex,artifactListIndex,iamPolicyListIndex,sessionListIndex,workflowExecutionListIndex];async function composeServer(options){let{config:config2,logger:logger2}=options,extensions=resolveExtensions(options.extensions);extensions.unitNames.length>0&&logger2.info("extension units composed",{units:extensions.unitNames.join(", ")});let store,storeOptions={listIndexes:LIST_INDEXES};config2.databaseUrl!==""?(store=await PostgresStore.open(config2.databaseUrl,logger2,storeOptions),logger2.info("storage driver selected",{driver:"postgres"})):(store=SqliteStore.open(config2.dbPath,logger2,storeOptions),logger2.info("storage driver selected",{driver:"sqlite",dbPath:config2.dbPath}));let authEnabled=config2.oidcIssuer!=="",requireAuthentication=authEnabled||extensions.requireAuthentication!==void 0,authorizationPosture=authorizationPostureOf({unitAuthorizer:extensions.authorizer!==void 0,requireAuthentication}),builtInAuthorization=authorizationPosture!=="unit-authorizer";if(authorizationPosture==="built-in"&&extensions.edition!==ServerEdition.oss)throw new Error(`the composition serves edition '${ServerEdition[extensions.edition]}' under the require-authentication posture but registers no Authorizer \u2014 the built-in authorizer enforces the open-source kinds only; register an Authorizer or serve the open-source edition`);let identityAccounts=extensions.drivers.identityAccountStore??newResourceIdentityAccountStore(store),iamPolicies=extensions.drivers.iamPolicyStore??newResourceIamPolicyStore(store),platformClients=extensions.drivers.platformClientStore??newResourcePlatformClientStore(store),iamPolicyGrantPath=newIamPolicyGrantPath({policies:iamPolicies,lifecycle:extensions.drivers.resourceAuthorizationLifecycle,logger:logger2}),authorizationLifecycle=extensions.drivers.resourceAuthorizationLifecycle,roleLifecycle=authorizationLifecycle??(builtInAuthorization?newBuiltInRoleLifecycle({grantPath:iamPolicyGrantPath,accounts:identityAccounts}):void 0),operatorIdentity=operatorIdentitySnapshot(),membership=builtInAuthorization?newMembershipRules({grantPath:iamPolicyGrantPath,policies:iamPolicies,store,operatorEmail:operatorIdentity.email}):void 0,runnerAuthService=RunnerAuthService.fromEnv(),runnerCredentials=extensions.drivers.runnerCredentialProvider??(authorizationPosture==="built-in"?newBuiltInRunnerCredentialProvider({service:runnerAuthService,store,accounts:identityAccounts}):newExecutionScopedRunnerCredentialProvider(runnerAuthService)),authorizer=extensions.authorizer??(authorizationPosture==="built-in"?newLaneAdmittedAuthorizer(newBuiltInAuthorizer({store,policies:iamPolicies,accounts:identityAccounts,edition:extensions.edition,logger:logger2}),caller=>isWorkflowBoundRunner(runnerAuthService,caller)):newPermissiveSingleTeamAuthorizer()),organizationDirectory=extensions.drivers.organizationDirectory??(authorizationPosture==="built-in"?newBuiltInOrganizationDirectory({store,policies:iamPolicies,accounts:identityAccounts}):void 0),scheduleFireCaller=extensions.drivers.scheduleFireCaller??(authorizationPosture==="built-in"?newBuiltInScheduleFireCaller({store,accounts:identityAccounts}):void 0),listReadScope=extensions.drivers.listReadScope??(authorizationPosture==="built-in"?newBuiltInListReadScope({store,policies:iamPolicies,accounts:identityAccounts,logger:logger2}):void 0);logger2.info("authorization posture resolved",{posture:authorizationPosture,authorizer:extensions.authorizer!==void 0?"extension":authorizationPosture==="built-in"?"built-in":"permissive",listReadScope:extensions.drivers.listReadScope!==void 0?"extension":authorizationPosture==="built-in"?"built-in":"none"});let identityAccountPath={accounts:identityAccounts,logger:logger2,authorizer,authorizationLifecycle:roleLifecycle},createIdentityAccount=newCreateAccountPath(identityAccountPath,ApiResourceKind.identity_account),issuerDiscovery=newIssuerDiscovery(),identityAccountProvisioner=newDirectAccountProvisioner({accounts:identityAccounts,createAccount:createIdentityAccount,userInfo:newOidcUserInfoClient(issuerDiscovery)});if(!requireAuthentication){let operator=await ensureOperatorAccount({accounts:identityAccounts,createAccount:createIdentityAccount},operatorIdentity);logger2.info("trusted-local operator account ensured",{accountId:operator.metadata?.id??""}),membership!==void 0&&(await membership.ensureOperatorOwnership(operator),logger2.info("trusted-local operator ownership ensured",{accountId:operator.metadata?.id??""}))}authorizationPosture==="built-in"&&membership!==void 0&&(await membership.ensureRolesForExistingAccounts(),logger2.info("built-in posture role reconciliation ensured"));let v1Key;try{v1Key=getOrCreateNamedKey(ENCRYPTION_KEY_ENV_VAR,ENCRYPTION_KEY_FILE_NAME)}catch(error2){logger2.warn("Failed to initialize encryption - secret values will be stored in plaintext",{error:error2 instanceof Error?error2.message:String(error2)}),v1Key=void 0}let secretCodecs=new Map([[V1_VERSION,new StaticKeySecretCodec(v1Key)],...extensions.drivers.secretCodecs]),writeVersionValue=process.env[ENCRYPTION_WRITE_VERSION_ENV_VAR]??"",secretService=SecretService.withCodecs({codecs:secretCodecs,writeVersion:writeVersionValue===""?DEFAULT_WRITE_VERSION:writeVersionValue});logger2.info("secret encryption configured",{writeVersion:writeVersionValue===""?DEFAULT_WRITE_VERSION:writeVersionValue,registeredCodecs:[...secretCodecs.keys()].sort()});let platformTokenKeys=resolvePlatformTokenKeys({requireAuthentication,supplied:extensions.drivers.platformTokenKeys,edition:extensions.edition});logger2.info("platform-token keys resolved",{source:platformTokenKeys===void 0?"none (no authentication posture)":extensions.drivers.platformTokenKeys!==void 0?"extension":"open-source ladder",signing:platformTokenKeys?.signer!==void 0});let temporalConfig=newConfigFromEnv(),workflowExecutionTemporalConfig=newWorkflowExecutionConfigFromEnv(),sandboxProvisioner=newSandboxProvisioner(config2.sandboxProvisionerType,{config:{backendEndpoint:config2.sandboxBackendEndpoint,temporalAddress:config2.sandboxTemporalAddress,temporalNamespace:config2.temporalNamespace,temporalConnectionEnv:temporalConnectionEnv(config2.temporalConnection),runnerImage:config2.sandboxRunnerImage,runnerCommand:config2.sandboxRunnerCommand,kubernetesNamespace:config2.sandboxKubernetesNamespace},logger:logger2},builtInSandboxProvisionerFactories(),extensions.drivers.sandboxProvisionerDrivers);if(sandboxProvisioner!==void 0&&temporalConfig.activityRouting!==ROUTING_SESSION&&workflowExecutionTemporalConfig.workflowActivityRouting!==WORKFLOW_ROUTING_EXECUTION)throw new Error(`SANDBOX_PROVISIONER_TYPE='${config2.sandboxProvisionerType}' requires a per-queue routing mode \u2014 set STIGMER_ACTIVITY_ROUTING=session and/or STIGMER_WORKFLOW_ACTIVITY_ROUTING=execution (a provisioner no dispatch can reach must fail loudly, not sit dark)`);let sandboxLane=newSandboxLane(sandboxProvisioner,runnerCredentials);sandboxLane.enabled&&logger2.info("sandbox provisioner composed",{type:config2.sandboxProvisionerType});let workflowSandboxTerminalObserver=newWorkflowSandboxTerminalObserver(sandboxLane,logger2),healthState=new HealthState,modelCatalog,ossModelRegistryStore;extensions.drivers.modelCatalogProvider!==void 0?modelCatalog=extensions.drivers.modelCatalogProvider:(ossModelRegistryStore=new ModelRegistryStore({bundledDocument:bundledModelRegistryDocument(),upstreamOrigin:config2.modelRegistryUpstream,refreshEnabled:config2.modelRegistryRefreshEnabled,logger:logger2,fetchImpl:options.fetchImpl}),modelCatalog=ossModelRegistryStore);let registryLanes=createRegistryLanes({taskKindRegistryDocument:bundledTaskKindRegistryDocument(),modelRegistryStore:modelCatalog}),workflowValidator=new InProcessValidator(modelCatalog,logger2),agentExecutionStreamBroker=new StreamBroker(logger2),workflowExecutionStreamBroker=new StreamBroker2(logger2),scheduleTemporalConfig=newScheduleConfigFromEnv(),scheduleClientProvider=()=>temporalManager.getClient(),scheduleArtifact=new ScheduleArtifact(scheduleTemporalConfig),scheduleSyncer=new ScheduleSyncer(scheduleClientProvider,store,scheduleArtifact,logger2),scheduleRunStarter=new RunStarter({store,config:scheduleTemporalConfig,executions:{create:(execution,fireCaller)=>requireInProcess().scheduleExecutionCreator.create(execution,fireCaller)},fireCallerMint:scheduleFireCaller,logger:logger2}),scheduleReconciler=new ScheduleReconciler(scheduleClientProvider,store,scheduleSyncer,scheduleTemporalConfig,logger2),temporalManager=new TemporalManager({hostPort:config2.temporalHostPort,namespace:config2.temporalNamespace,connection:config2.temporalConnection,logger:logger2,payloadCodecs:loadServerPayloadCodecs(runnerCredentials.resolvePayloadKey?.bind(runnerCredentials)),workerFactories:[newAgentExecutionWorkerFactory({store,logger:logger2,statusWriter:()=>requireInProcess().executionStatusWriter,temporalConfig}),newWorkflowExecutionWorkerFactory({store,logger:logger2,broker:workflowExecutionStreamBroker,temporalConfig:workflowExecutionTemporalConfig,sandboxTerminalObserver:workflowSandboxTerminalObserver}),newScheduleWorkerFactory({store,config:scheduleTemporalConfig,syncer:scheduleSyncer,runStarter:scheduleRunStarter,logger:logger2}),...extensions.workers]}),executionEngineState=newExecutionEngineStateProvider({manager:temporalManager,config:temporalConfig,store,runnerCredentials,logger:logger2}),workflowExecutionEngineState=newWorkflowExecutionEngineStateProvider({manager:temporalManager,config:workflowExecutionTemporalConfig,runnerCredentials,logger:logger2}),artifactStorage=newArtifactStorage({type:config2.artifactStorageType,localBasePath:config2.artifactLocalBasePath,localServeUrl:config2.artifactLocalServeUrl,r2Bucket:config2.r2Bucket,r2Endpoint:config2.r2Endpoint,r2AccessKeyId:config2.r2AccessKeyId,r2SecretAccessKey:config2.r2SecretAccessKey,r2Region:config2.r2Region},extensions.drivers.artifactStorageDrivers),artifactFileServer=config2.artifactStorageType==="local"?createArtifactFileServer({basePath:config2.artifactLocalBasePath,logger:logger2}):void 0,skillUploadSlots=new UploadSlots(config2.storagePath,STAGING_KEY_PREFIX,DEFAULT_SLOT_TTL_MS,104857600),skillType=config2.skillArtifactStorageType===""?"local":config2.skillArtifactStorageType,skillStorageDriver=skillType==="local"?((0,import_node_fs16.mkdirSync)(import_node_path18.default.join(config2.storagePath,"skills"),{recursive:!0,mode:493}),new LocalArtifactStorage(config2.storagePath,transferServeUrl(config2.skillTransferBaseUrl),{reserve:(key,declaredSizeBytes)=>{let{ttlMs}=skillUploadSlots.reserve(key,declaredSizeBytes);return{url:uploadUrl(config2.skillTransferBaseUrl,uploadRefOf(key)),ttlMs}}})):newArtifactStorage({type:skillType,localBasePath:config2.storagePath,localServeUrl:"",r2Bucket:config2.r2Bucket,r2Endpoint:config2.r2Endpoint,r2AccessKeyId:config2.r2AccessKeyId,r2SecretAccessKey:config2.r2SecretAccessKey,r2Region:config2.r2Region},extensions.drivers.artifactStorageDrivers),skillArtifactStorage=newSkillArtifactStorage(skillStorageDriver),pluginArtifactStorage=newContentAddressedArchiveStore(skillStorageDriver,PLUGIN_ARTIFACT_KEY_PREFIX),skillArchiveStaging=newArchiveStaging(skillStorageDriver,logger2),skillTransferLane=newSkillTransferLane(skillUploadSlots,skillArtifactStorage,logger2),transferOrigin=assessSkillTransferOrigin({baseUrl:config2.skillTransferBaseUrl,relaysThroughServer:skillType==="local",requireAuthentication});transferOrigin.kind==="loopback-hosted"&&logger2.warn("skill artifact transfer lane mints capability URLs on the server's own loopback while the server requires authentication; pushes above the gRPC message cap and sandbox skill downloads will fail \u2014 set SKILL_TRANSFER_BASE_URL to the origin callers reach this server on",{baseUrl:transferOrigin.baseUrl});let consoleAssets=resolveConsoleAssets(config2.consoleDir,logger2);consoleAssets!==void 0?logger2.info("web console serving from unified port",{dir:consoleAssets.root,files:consoleAssets.fileCount}):logger2.debug("no web console export bundled; console lane disabled");let consoleSignIn=authEnabled?{posture:"oidc",issuer:config2.oidcIssuer,audience:config2.oidcAudience,consoleClientId:config2.oidcConsoleClientId}:{posture:"trusted-local"};consoleAssets!==void 0&&consoleSignIn.posture==="oidc"&&consoleSignIn.consoleClientId===""&&logger2.warn("STIGMER_OIDC_ISSUER is set but STIGMER_OIDC_CONSOLE_CLIENT_ID is not \u2014 the web console this server serves cannot sign in; register a public PKCE client for the console at the issuer and set it");let consoleLane=consoleAssets!==void 0?createConsoleLane({assets:consoleAssets,signIn:consoleSignIn,logger:logger2}):void 0,searchRegistry=newSearchableResourceRegistry();searchRegistry.validateExpectedKinds(logger2);let searchQueryStore=new SqliteSearchQueryStore(store,searchRegistry,logger2),searchHandler=new SearchHandler(searchQueryStore,logger2,listReadScope),activityHandler=new ActivityHandler(store,logger2,listReadScope),environmentResolution=new RuntimeResolutionService(store,secretService,logger2),managedEnvService=new ManagedEnvironmentService({getSecretValue:input=>requireInProcess().executionEnvironmentReader.getSecretValue(input),updateVariables:request=>requireInProcess().executionEnvironmentReader.updateVariables(request),create:(environment,caller)=>requireInProcess().executionEnvironmentReader.create(environment,caller),delete:input=>requireInProcess().executionEnvironmentReader.delete(input)},logger2),mcpServerEngineState=newMcpServerEngineStateProvider({manager:temporalManager,config:temporalConfig,logger:logger2}),oauthRedirect=resolveOAuthRedirectUri({configured:config2.oauthRedirectUri,servesConsole:consoleAssets!==void 0,port:options.portOverride??config2.grpcPort});switch(oauthRedirect.kind){case"configured":break;case"derived":logger2.info("STIGMER_OAUTH_REDIRECT_URI is not set \u2014 deriving the served console's callback for MCP server OAuth Connect",{redirectUri:oauthRedirect.uri});break;case"absent":logger2.warn("STIGMER_OAUTH_REDIRECT_URI is not set \u2014 OAuth Connect flows for MCP servers are unavailable (initiateOAuthConnect will refuse)");break;default:{let exhaustive=oauthRedirect;throw new Error(String(exhaustive))}}let oauthRedirectUri=oauthRedirect.kind==="absent"?"":oauthRedirect.uri,outboundFetch=guardedFetch(extensions.drivers.outboundEgress??relaxedEgressPolicy(),{fetchImpl:options.fetchImpl??fetch,lookup:nodeLookup()}),inProcess;function requireInProcess(){if(inProcess===void 0)throw new Error("in-process clients not wired (boot ordering bug)");return inProcess}let routes=router=>{registerHealthService(router,healthState),registerOrganizationServices(router,{store,logger:logger2,authorizer,gateSteps:extensions.gateSteps,grantPath:iamPolicyGrantPath,authorizationLifecycle:roleLifecycle,organizationDirectory}),registerApiKeyServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope}),registerIdentityAccountServices(router,{...identityAccountPath,provisioner:identityAccountProvisioner,federation:extensions.drivers.identityFederation,gateSteps:extensions.gateSteps,membership}),registerIamPolicyServices(router,{grantPath:iamPolicyGrantPath,policies:iamPolicies,accounts:identityAccounts,authorizer,grantScope:extensions.drivers.policyGrantScope??newOrganizationOnlyGrantScope(),queries:extensions.drivers.authorizationQueries,principalDisplay:extensions.drivers.principalDisplay,gateSteps:extensions.gateSteps,edition:extensions.edition,logger:logger2}),registerEnvironmentServices(router,{store,logger:logger2,authorizer,secretService,authorizationLifecycle,listReadScope}),registerOAuthAppServices(router,{store,secretService,logger:logger2,authorizer,authorizationLifecycle,listReadScope}),registerPlatformClientServices(router,{clients:platformClients,store,logger:logger2,authorizer,authorizationLifecycle,listReadScope}),registerPlatformClientTokenService(router,{mint:{clients:platformClients,accounts:identityAccounts,createAccount:createIdentityAccount,grantPath:iamPolicyGrantPath,keys:platformTokenKeys,logger:logger2,now:()=>new Date},guestTokenMinting:extensions.drivers.guestTokenMinting}),registerExecutionContextServices(router,{store,logger:logger2,authorizer,secretService,runnerAuthService:runnerCredentials,authorizationLifecycle}),registerAgentServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,agentInstanceApplier:()=>requireInProcess().agentInstanceApplier}),registerAgentInstanceServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,parentAgentLoader:()=>requireInProcess().parentAgentLoader,listReadScope}),registerSessionServices(router,{store,logger:logger2,authorizer,temporalConfig,gateSteps:extensions.gateSteps,sandboxLane,authorizationLifecycle,listReadScope}),registerAgentShareServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope}),registerAgentChannelServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope,modelRegistry:modelCatalog,channelRuntime:extensions.drivers.channelRuntime}),registerChannelMessageServices(router,extensions.drivers.channelRuntime),registerChannelConversationServices(router,extensions.drivers.channelRuntime),registerChannelAppServices(router,{store,logger:logger2,authorizer,secretService,authorizationLifecycle}),registerScheduleServices(router,{store,logger:logger2,authorizer,modelRegistry:modelCatalog,clock:()=>scheduleSyncer,runner:()=>scheduleRunStarter,authorizationLifecycle,listReadScope}),registerMemoryServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope,runnerCredentialProvider:runnerCredentials}),registerAgentExecutionServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope,runnerCredentialProvider:runnerCredentials,broker:agentExecutionStreamBroker,engineState:executionEngineState,modelRegistry:modelCatalog,artifactStorage,gateSteps:extensions.gateSteps,statusObservers:extensions.statusObservers,responseDecorators:extensions.responseDecorators,sandboxLane,temporalConfig,agentLoader:()=>requireInProcess().executionAgentLoader,agentInstanceCreator:()=>requireInProcess().executionAgentInstanceCreator,sessionCreator:()=>requireInProcess().executionSessionCreator,executionContextBuilder:{store,logger:logger2,agentLoader:()=>requireInProcess().executionAgentLoader,agentInstanceLoader:()=>requireInProcess().executionAgentInstanceLoader,sessionLoader:()=>requireInProcess().executionSessionLoader,environmentReader:()=>requireInProcess().executionEnvironmentReader,environmentResolution,executionContextCreator:()=>requireInProcess().executionContextCreator,managedEnvService,platformClients,fetchImpl:asFetch(outboundFetch)}}),registerWorkflowServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,validator:workflowValidator,workflowInstanceCreator:()=>requireInProcess().workflowInstanceCreator}),registerWorkflowInstanceServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,parentWorkflowLoader:()=>requireInProcess().parentWorkflowLoader,listReadScope}),registerWorkflowExecutionServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,listReadScope,gateSteps:extensions.gateSteps,engineState:workflowExecutionEngineState,broker:workflowExecutionStreamBroker,sandboxLane,temporalConfig:workflowExecutionTemporalConfig,sandboxTerminalObserver:workflowSandboxTerminalObserver,workflowInstanceCreator:()=>requireInProcess().workflowExecutionInstanceCreator,approvalForwarder:()=>requireInProcess().workflowExecutionApprovalForwarder,fileDecisionForwarder:()=>requireInProcess().workflowExecutionFileDecisionForwarder,executionContextBuilder:{store,logger:logger2,workflowInstanceLoader:()=>requireInProcess().workflowExecutionInstanceLoader,environmentResolution,executionContextCreator:()=>requireInProcess().workflowExecutionContextCreator}}),registerMcpServerServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,connect:{store,logger:logger2,authorizer,engineState:mcpServerEngineState,environmentReader:{list:request=>requireInProcess().executionEnvironmentReader.list(request),getSecretValue:input=>requireInProcess().executionEnvironmentReader.getSecretValue(input)},executionContext:{create:(ec2,caller)=>requireInProcess().connectExecutionContextClient.create(ec2,caller),delete:input=>requireInProcess().connectExecutionContextClient.delete(input)},runnerAuth:runnerCredentials,managedEnv:managedEnvService,oauthGrants:store.oauthGrants,pendingOAuthStates:store.pendingOAuthStates,secretService,oauthRedirectUri,outboundFetch}}),registerSkillServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,artifactStorage:skillArtifactStorage,executionArtifactStorage:artifactStorage,staging:skillArchiveStaging}),registerPluginServices(router,{store,logger:logger2,authorizer,authorizationLifecycle,artifactStorage:pluginArtifactStorage,materializerProvider:()=>requireInProcess().pluginMaterializer,staging:skillArchiveStaging}),registerArtifactServices(router,{store,artifactStorage,logger:logger2,authorizer}),registerSearchServices(router,{handler:searchHandler,logger:logger2}),registerActivityServices(router,{handler:activityHandler,logger:logger2}),registerGitHubServices(router,{clientId:config2.gitHubOAuthClientId,clientSecret:config2.gitHubOAuthClientSecret,logger:logger2,fetchImpl:options.fetchImpl}),registerPlatformServices(router,{temporalHostPort:config2.temporalHostPort,temporalNamespace:config2.temporalNamespace,runnerAuthService:runnerCredentials,edition:extensions.edition,version:options.version??SERVER_VERSION,authenticationRequired:requireAuthentication,licenseStatus:extensions.drivers.licenseStatus??ABSENT_LICENSE_STATUS,now:()=>new Date,logger:logger2}),registerExtensionServicesUnshadowed(router,extensions.services)},inProcessWiring=createInProcessClients(routes,logger2);inProcess=inProcessWiring.clients;let identityVerifiers=[...requireAuthentication?[newApiKeyIdentityVerifier({store,accounts:identityAccounts,logger:logger2,now:()=>new Date})]:[],...platformTokenKeys!==void 0?[newPlatformClientTokenVerifier({keys:platformTokenKeys,clients:platformClients})]:[],...authorizationPosture==="built-in"?[newRunnerSubjectIdentityVerifier({store,accounts:identityAccounts,credentials:runnerCredentials})]:[],...authEnabled?[newOidcIdentityVerifier({issuer:config2.oidcIssuer,audience:config2.oidcAudience,accounts:identityAccounts,discovery:issuerDiscovery})]:[],...extensions.identityVerifiers];if(extensions.requireAuthentication!==void 0&&extensions.identityVerifiers.length===0)throw new Error(`extension '${extensions.requireAuthentication.declaredBy}' declares the require-authentication posture, but registers no identity verifier of its own \u2014 the OSS API-key lane alone cannot admit the first caller (nobody could mint a key), so every non-public request would be refused; register a verifier or omit the declaration`);let postureSources=[...authEnabled?["oidc-issuer"]:[],...extensions.requireAuthentication!==void 0?[`extension '${extensions.requireAuthentication.declaredBy}'`]:[]],callerGuards=[...platformTokenKeys!==void 0?[newPlatformClientOriginGuard({clients:platformClients,logger:logger2})]:[],...extensions.callerGuards];logger2.info("authentication posture resolved",{posture:requireAuthentication?"required":"trusted-local",source:postureSources.length>0?postureSources.join(" + "):"none",verifiers:identityVerifiers.map(v=>v.name).join(", ")});let server=createUnifiedPortServer({logger:logger2,routes,interceptors:buildInterceptorChain(logger2,createVerifierChainInterceptor(identityVerifiers,callerGuards,logger2,requireAuthentication),{errorBoundary:createErrorBoundaryInterceptor(logger2,extensions.drivers.visitorErrorPolicy),requestMetrics:createRequestMetricsInterceptor()}),taskKindRegistryLane:registryLanes.taskKindRegistryLane,modelRegistryLane:registryLanes.modelRegistryLane,skillTransferLane,consoleLane});return{healthState,store,secrets:secretService,temporalManager,runnerAuthService,agentExecutionStreamBroker,workflowExecutionStreamBroker,inProcessTransport:inProcessWiring.transport,identityVerifiers,routes,async start(){await temporalManager.initialConnect()&&await temporalManager.startWorkers(),temporalManager.startHealthMonitor();let kickScheduleReconcile=scheduleReconciler.startReconciliation();temporalManager.addReconnectHook(kickScheduleReconcile),await artifactStorage.health();try{let indexed=await searchQueryStore.rebuildIndex();logger2.info("Search index rebuilt at startup",{indexed})}catch(error2){logger2.warn("Failed to rebuild search index at startup",{error:error2 instanceof Error?error2.message:String(error2)})}await initRpcMetrics(),logger2.info("request metrics",{posture:await metricsExportPosture(),instruments:"stigmer.grpc.request.count, stigmer.grpc.request.duration"}),healthState.setOverall(HealthCheckResponse_ServingStatus.SERVING),ossModelRegistryStore?.startRefresh();let port=await server.listen(options.portOverride??config2.grpcPort,options.host);if(logger2.info("stigmer-server listening",{port}),artifactFileServer!==void 0){await warnOnLegacyArtifactLayout(config2.artifactLocalBasePath,logger2);try{await artifactFileServer.listen(config2.artifactHttpPort,config2.artifactHttpHost)}catch(error2){logger2.error("Artifact HTTP file server failed",{error:error2 instanceof Error?error2.message:String(error2)})}}return port},async shutdown(){healthState.setOverall(HealthCheckResponse_ServingStatus.NOT_SERVING),ossModelRegistryStore?.stopRefresh(),await artifactFileServer?.shutdown(),await scheduleReconciler.stop(),await temporalManager.close(),await server.shutdown(),await store.close(),logger2.info("stigmer-server stopped")}}}var LEVEL_RANK={debug:10,info:20,warn:30,error:40};function createLogger(options){let threshold=LEVEL_RANK[options.level]??LEVEL_RANK.info,write2=options.write??(line=>process.stderr.write(line+`
 `)),sink=options.sink,emit=(level,message6,fields2)=>{if(LEVEL_RANK[level]<threshold)return;let time2=new Date;if(options.pretty){let suffix=fields2===void 0||Object.keys(fields2).length===0?"":" "+JSON.stringify(fields2);write2(`${time2.toISOString()} ${level.toUpperCase().padEnd(5)} ${message6}${suffix}`)}else write2(JSON.stringify({level,time:time2.toISOString(),message:message6,...fields2}));sink?.({level,time:time2,message:message6,fields:fields2})};return{debug:(message6,fields2)=>emit("debug",message6,fields2),info:(message6,fields2)=>emit("info",message6,fields2),warn:(message6,fields2)=>emit("warn",message6,fields2),error:(message6,fields2)=>emit("error",message6,fields2)}}async function main(){let config2=loadConfig(),logger2=createLogger({level:config2.logLevel,pretty:config2.env==="local"});setOperatorIdentity(config2.operatorEmail,config2.operatorName);let server=await composeServer({config:config2,logger:logger2}),shuttingDown=!1,shutdown=signal3=>{shuttingDown||(shuttingDown=!0,logger2.info("shutting down",{signal:signal3}),server.shutdown().then(()=>process.exit(0)).catch(error2=>{logger2.error("shutdown failed",{error:String(error2)}),process.exit(1)}))};process.on("SIGTERM",()=>shutdown("SIGTERM")),process.on("SIGINT",()=>shutdown("SIGINT"));try{await server.start()}catch(error2){logger2.error("boot failed",{error:error2 instanceof Error?error2.message:String(error2)}),process.exit(1)}}main().catch(error2=>{console.error("boot failed:",error2 instanceof Error?error2.message:String(error2)),process.exit(1)});
 /*! Bundled license information: