@stigmer/server 3.14.0-dev.20260910084630

package/dist/pipeline/steps/shapes.d.ts

@@ -0,0 +1,43 @@
+import type { ReflectMessage } from "@bufbuild/protobuf/reflect";
+import type { DescField, DescMessage, Message } from "@bufbuild/protobuf";
+import type { ApiResourceMetadata } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
+/** Go HasMetadata: every API resource carries metadata of this one type. */
+export interface HasMetadataShape {
+    metadata?: ApiResourceMetadata;
+}
+/** Go HasValue / HasIdValue: ID-wrapper inputs (AgentId, OrganizationId, …). */
+export interface HasValueShape {
+    value: string;
+}
+/**
+ * The resource's metadata, or undefined when the message has none set.
+ * (Go's HasMetadata type assertion + GetMetadata nil-check collapsed.)
+ */
+export declare function metadataOf(msg: Message): ApiResourceMetadata | undefined;
+/** The ID-wrapper's value ("" when absent) — Go HasValue.GetValue(). */
+export declare function idValueOf(msg: Message): string;
+/** A message-typed field, statically narrowed so get()/set() type-check. */
+export type MessageDescField = Extract<DescField, {
+    fieldKind: "message";
+}>;
+/**
+ * Finds a singular message field by proto name with the narrowing TS needs
+ * to give ReflectMessage out of get() — the reflection idiom every helper
+ * in this library shares.
+ */
+export declare function messageFieldByName(msg: ReflectMessage, name: string): MessageDescField | undefined;
+/**
+ * The resource's status as a write-through reflection wrapper, or
+ * undefined when the message has no status FIELD or the field is unset —
+ * Go getStatusField.
+ */
+export declare function getStatusField(schema: DescMessage, msg: Message): ReflectMessage | undefined;
+/**
+ * The resource's status, created and attached when absent — Go
+ * getOrCreateStatusField. Returns undefined only when the message has no
+ * status field at all (a no-op for such kinds, as in Go).
+ */
+export declare function getOrCreateStatusField(schema: DescMessage, msg: Message): ReflectMessage | undefined;
+/** Whether the message's schema declares a status field — Go hasStatusField. */
+export declare function hasStatusField(schema: DescMessage): boolean;
+//# sourceMappingURL=shapes.d.ts.map

package/dist/pipeline/steps/shapes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shapes.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/shapes.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4DAA4D,CAAC;AAEtG,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,mBAAmB,GAAG,SAAS,CAExE;AAED,wEAAwE;AACxE,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAG9C;AAED,4EAA4E;AAC5E,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,EAAE;IAAE,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC,CAAC;AAE5E;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,GACX,gBAAgB,GAAG,SAAS,CAK9B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,OAAO,GACX,cAAc,GAAG,SAAS,CAO5B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,OAAO,GACX,cAAc,GAAG,SAAS,CAU5B;AAED,gFAAgF;AAChF,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAI3D"}

package/dist/pipeline/steps/shapes.js

@@ -0,0 +1,69 @@
+/**
+ * Resource shape access — ports steps/interfaces.go (HasMetadata,
+ * HasValue, the status reflection helpers).
+ *
+ * Where Go needed protoreflect to reach metadata/status generically (its
+ * generated types are concrete structs), protobuf-es messages are plain
+ * objects sharing the SAME generated ApiResourceMetadata type — structural
+ * access is the idiomatic equivalent, not a shortcut. Reflection remains
+ * only where a message must be CREATED generically (a kind-specific status
+ * message needs its schema, which only the resource's descriptor knows).
+ */
+import { reflect } from "@bufbuild/protobuf/reflect";
+/**
+ * The resource's metadata, or undefined when the message has none set.
+ * (Go's HasMetadata type assertion + GetMetadata nil-check collapsed.)
+ */
+export function metadataOf(msg) {
+    return msg.metadata;
+}
+/** The ID-wrapper's value ("" when absent) — Go HasValue.GetValue(). */
+export function idValueOf(msg) {
+    const value = msg.value;
+    return typeof value === "string" ? value : "";
+}
+/**
+ * Finds a singular message field by proto name with the narrowing TS needs
+ * to give ReflectMessage out of get() — the reflection idiom every helper
+ * in this library shares.
+ */
+export function messageFieldByName(msg, name) {
+    const field = msg.fields.find((f) => f.name === name);
+    return field !== undefined && field.fieldKind === "message"
+        ? field
+        : undefined;
+}
+/**
+ * The resource's status as a write-through reflection wrapper, or
+ * undefined when the message has no status FIELD or the field is unset —
+ * Go getStatusField.
+ */
+export function getStatusField(schema, msg) {
+    const root = reflect(schema, msg);
+    const field = messageFieldByName(root, "status");
+    if (field === undefined || !root.isSet(field)) {
+        return undefined;
+    }
+    return root.get(field);
+}
+/**
+ * The resource's status, created and attached when absent — Go
+ * getOrCreateStatusField. Returns undefined only when the message has no
+ * status field at all (a no-op for such kinds, as in Go).
+ */
+export function getOrCreateStatusField(schema, msg) {
+    const root = reflect(schema, msg);
+    const field = messageFieldByName(root, "status");
+    if (field === undefined) {
+        return undefined;
+    }
+    if (!root.isSet(field)) {
+        root.set(field, reflect(field.message));
+    }
+    return root.get(field);
+}
+/** Whether the message's schema declares a status field — Go hasStatusField. */
+export function hasStatusField(schema) {
+    return schema.fields.some((f) => f.name === "status" && f.fieldKind === "message");
+}
+//# sourceMappingURL=shapes.js.map

package/dist/pipeline/steps/shapes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shapes.js","sourceRoot":"","sources":["../../../src/pipeline/steps/shapes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAgBrD;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,OAAQ,GAAmC,CAAC,QAAQ,CAAC;AACvD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,MAAM,KAAK,GAAI,GAAyC,CAAC,KAAK,CAAC;IAC/D,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAKD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAmB,EACnB,IAAY;IAEZ,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QACzD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAmB,EACnB,GAAY;IAEZ,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAmB,EACnB,GAAY;IAEZ,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,cAAc,CAAC,MAAmB;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CACxD,CAAC;AACJ,CAAC"}

package/dist/pipeline/steps/slug.d.ts

@@ -0,0 +1,18 @@
+/**
+ * ResolveSlug — ports steps/slug.go. Derives a URL-safe slug from
+ * metadata.name; idempotent when the slug is already set. NO length
+ * truncation, deliberately: truncation created silent collisions between
+ * different names, and the generator matches the cloud Java
+ * ApiRequestResourceSlugGenerator so both editions derive identical slugs
+ * (dots are namespace separators → hyphens, e.g. "platform.sara" →
+ * "platform-sara").
+ */
+import type { DescMessage } from "@bufbuild/protobuf";
+import type { PipelineStep } from "../pipeline.js";
+export declare function newResolveSlugStep<Desc extends DescMessage>(): PipelineStep<Desc>;
+/**
+ * Go GenerateSlug: lowercase → spaces/dots to hyphens → strip
+ * non-[a-z0-9- ] → collapse hyphens → trim hyphens. No truncation.
+ */
+export declare function generateSlug(name: string): string;
+//# sourceMappingURL=slug.d.ts.map

package/dist/pipeline/steps/slug.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slug.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/slug.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAInD,wBAAgB,kBAAkB,CAAC,IAAI,SAAS,WAAW,KAAK,YAAY,CAAC,IAAI,CAAC,CAmBjF;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMjD"}

package/dist/pipeline/steps/slug.js

@@ -0,0 +1,34 @@
+import { internalError, invalidArgumentError } from "../errors.js";
+import { metadataOf } from "./shapes.js";
+export function newResolveSlugStep() {
+    return {
+        name: "ResolveSlug",
+        execute(ctx) {
+            const metadata = metadataOf(ctx.newState);
+            if (metadata === undefined) {
+                // A server-side programming error, not bad client input (Go).
+                throw internalError(new Error("resource metadata is nil"), "slug resolution");
+            }
+            if (metadata.slug !== "") {
+                return; // already set — idempotent
+            }
+            if (metadata.name === "") {
+                // Name and slug both empty IS bad client input.
+                throw invalidArgumentError("resource name is required");
+            }
+            metadata.slug = generateSlug(metadata.name);
+        },
+    };
+}
+/**
+ * Go GenerateSlug: lowercase → spaces/dots to hyphens → strip
+ * non-[a-z0-9- ] → collapse hyphens → trim hyphens. No truncation.
+ */
+export function generateSlug(name) {
+    let slug = name.toLowerCase();
+    slug = slug.replaceAll(" ", "-").replaceAll(".", "-");
+    slug = slug.replace(/[^a-z0-9\- ]/g, "");
+    slug = slug.replace(/-{2,}/g, "-");
+    return slug.replace(/^-+|-+$/g, "");
+}
+//# sourceMappingURL=slug.js.map

package/dist/pipeline/steps/slug.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slug.js","sourceRoot":"","sources":["../../../src/pipeline/steps/slug.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGnE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,OAAO,CAAC,GAAyB;YAC/B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,8DAA8D;gBAC9D,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACzB,OAAO,CAAC,2BAA2B;YACrC,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACzB,gDAAgD;gBAChD,MAAM,oBAAoB,CAAC,2BAA2B,CAAC,CAAC;YAC1D,CAAC;YACD,QAAQ,CAAC,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC9B,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACtD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IACzC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC"}

package/dist/pipeline/steps/validate-visibility.d.ts

@@ -0,0 +1,29 @@
+/**
+ * ValidateVisibility(+Update) — port steps/validate_visibility.go.
+ * Fail-fast rejection of visibility levels the kind does not support,
+ * BEFORE any state is built — cloud-identical INVALID_ARGUMENT copy, so
+ * clients see one contract across editions.
+ *
+ * Create-only by design: plain updates preserve stored visibility
+ * unconditionally (oss#573), so updateVisibility is the only other door
+ * and ValidateVisibilityUpdate guards it (placed AFTER the handler's load
+ * step to preserve cross-edition error precedence: unknown id + bad level
+ * = NOT_FOUND on both editions).
+ *
+ * Deliberate divergences from Cloud, ported as-is: no platform-anchor
+ * check (OSS has no IdentityProvider domain) and skill push is not wired
+ * (Cloud's push handler does not validate either) — do not "fix" these.
+ */
+import type { DescMessage } from "@bufbuild/protobuf";
+import { UpdateVisibilityInputSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import type { PipelineStep } from "../pipeline.js";
+export declare function newValidateVisibilityStep<Desc extends DescMessage>(): PipelineStep<Desc>;
+export declare function newValidateVisibilityUpdateStep(): PipelineStep<typeof UpdateVisibilityInputSchema>;
+/**
+ * Go RejectDefaultInstanceVisibilityUpdate: the canonical
+ * FAILED_PRECONDITION for a visibility update aimed at a system-managed
+ * default instance — the copy is cloud-identical and conformance-pinned;
+ * the PREDICATE lives in the instance controllers' own guard steps.
+ */
+export declare function rejectDefaultInstanceVisibilityUpdate(): never;
+//# sourceMappingURL=validate-visibility.d.ts.map

package/dist/pipeline/steps/validate-visibility.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-visibility.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/validate-visibility.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AAanG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAInD,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,KAAK,YAAY,CAAC,IAAI,CAAC,CAWxF;AAED,wBAAgB,+BAA+B,IAAI,YAAY,CAC7D,OAAO,2BAA2B,CACnC,CAOA;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,IAAI,KAAK,CAK7D"}

package/dist/pipeline/steps/validate-visibility.js

@@ -0,0 +1,52 @@
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import { supportedVisibilityLevels, supportsVisibility, } from "../apiresource-meta.js";
+import { failedPreconditionError, internalError, invalidArgumentError, } from "../errors.js";
+import { apiResourceKindName } from "../../store/proto-fields.js";
+import { metadataOf } from "./shapes.js";
+export function newValidateVisibilityStep() {
+    return {
+        name: "ValidateVisibility",
+        execute(ctx) {
+            const metadata = metadataOf(ctx.input);
+            if (metadata === undefined) {
+                return; // no metadata to validate — other steps own that failure
+            }
+            rejectUnsupportedVisibility(ctx.apiResourceKind, metadata.visibility);
+        },
+    };
+}
+export function newValidateVisibilityUpdateStep() {
+    return {
+        name: "ValidateVisibilityUpdate",
+        execute(ctx) {
+            rejectUnsupportedVisibility(ctx.apiResourceKind, ctx.input.visibility);
+        },
+    };
+}
+/**
+ * Go RejectDefaultInstanceVisibilityUpdate: the canonical
+ * FAILED_PRECONDITION for a visibility update aimed at a system-managed
+ * default instance — the copy is cloud-identical and conformance-pinned;
+ * the PREDICATE lives in the instance controllers' own guard steps.
+ */
+export function rejectDefaultInstanceVisibilityUpdate() {
+    throw failedPreconditionError("Default instances do not have their own visibility - access always follows " +
+        "the parent blueprint. Change the blueprint's visibility instead.");
+}
+/** Go rejectUnsupportedVisibility (the shared level check + copy). */
+function rejectUnsupportedVisibility(kind, visibility) {
+    let supported;
+    let levels;
+    try {
+        supported = supportsVisibility(kind, visibility);
+        levels = supportedVisibilityLevels(kind);
+    }
+    catch (error) {
+        throw internalError(error, "failed to resolve visibility config from kind");
+    }
+    if (supported) {
+        return;
+    }
+    throw invalidArgumentError(`${apiResourceKindName(kind)} resources cannot be set to ${ApiResourceVisibility[visibility]}. Supported visibility levels: ${levels}.`);
+}
+//# sourceMappingURL=validate-visibility.js.map

package/dist/pipeline/steps/validate-visibility.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-visibility.js","sourceRoot":"","sources":["../../../src/pipeline/steps/validate-visibility.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAI/F,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAGlE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,OAAO,CAAC,GAAyB;YAC/B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO,CAAC,yDAAyD;YACnE,CAAC;YACD,2BAA2B,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B;IAG7C,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,OAAO,CAAC,GAAuD;YAC7D,2BAA2B,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC;IACnD,MAAM,uBAAuB,CAC3B,6EAA6E;QAC3E,kEAAkE,CACrE,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,SAAS,2BAA2B,CAClC,IAAqB,EACrB,UAAiC;IAEjC,IAAI,SAAkB,CAAC;IACvB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACjD,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,+CAA+C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;IACT,CAAC;IACD,MAAM,oBAAoB,CACxB,GAAG,mBAAmB,CAAC,IAAI,CAAC,+BAA+B,qBAAqB,CAAC,UAAU,CAAC,kCAAkC,MAAM,GAAG,CACxI,CAAC;AACJ,CAAC"}

package/dist/pipeline/steps/validation.d.ts

@@ -0,0 +1,6 @@
+import type { DescMessage } from "@bufbuild/protobuf";
+import type { Validator } from "@bufbuild/protovalidate";
+import type { PipelineStep } from "../pipeline.js";
+export declare function validator(): Validator;
+export declare function newValidateProtoStep<Desc extends DescMessage>(): PipelineStep<Desc>;
+//# sourceMappingURL=validation.d.ts.map

package/dist/pipeline/steps/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/validation.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAOnD,wBAAgB,SAAS,IAAI,SAAS,CAKrC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,SAAS,WAAW,KAAK,YAAY,CAAC,IAAI,CAAC,CAmBnF"}

package/dist/pipeline/steps/validation.js

@@ -0,0 +1,35 @@
+/**
+ * ValidateProto — ports steps/validation.go. Redundant on the RPC path
+ * (the protovalidate interceptor already validated at the boundary) but
+ * deliberately retained: it is the ONLY validation on the direct-call path
+ * unit tests use, and the shared validator makes the overlap free.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { createValidator } from "@bufbuild/protovalidate";
+// Process-wide shared validator (Go SharedValidator): constraints compile
+// once, not per request.
+let sharedValidator;
+export function validator() {
+    if (sharedValidator === undefined) {
+        sharedValidator = createValidator();
+    }
+    return sharedValidator;
+}
+export function newValidateProtoStep() {
+    return {
+        name: "ValidateProto",
+        execute(ctx) {
+            const result = validator().validate(ctx.schema, ctx.input);
+            if (result.kind === "valid") {
+                return;
+            }
+            if (result.kind === "invalid") {
+                throw new ConnectError(result.error.message, Code.InvalidArgument);
+            }
+            // A rule that fails to compile/evaluate is a server defect, not bad
+            // input (same mapping as the transport interceptor).
+            throw new ConnectError(`validation could not run: ${result.error.message}`, Code.Internal);
+        },
+    };
+}
+//# sourceMappingURL=validation.js.map

package/dist/pipeline/steps/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../src/pipeline/steps/validation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAM1D,0EAA0E;AAC1E,yBAAyB;AACzB,IAAI,eAAsC,CAAC;AAE3C,MAAM,UAAU,SAAS;IACvB,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,eAAe,GAAG,eAAe,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,OAAO,CAAC,GAAyB;YAC/B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3D,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACrE,CAAC;YACD,oEAAoE;YACpE,qDAAqD;YACrD,MAAM,IAAI,YAAY,CACpB,6BAA6B,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACnD,IAAI,CAAC,QAAQ,CACd,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/pipeline/steps/visibility-gates.d.ts

@@ -0,0 +1,19 @@
+import type { DescMessage } from "@bufbuild/protobuf";
+import type { Authorizer } from "../../extensions/authorizer.js";
+import type { PipelineStep } from "../pipeline.js";
+/**
+ * The denial callers see at both doors (the Java policy copy verbatim).
+ * Deliberately not byte-pinned by the OSS conformance suite; the cloud
+ * gate itself is recorded via the clientPublicVisibilityWrites flag.
+ */
+export declare const PUBLIC_VISIBILITY_DENY_MESSAGE: string;
+/** The CREATE door: a new state declaring PUBLIC needs the operator grant. */
+export declare function newGuardPublicVisibilityStep<Desc extends DescMessage>(authorizer: Authorizer): PipelineStep<Desc>;
+/**
+ * The UPDATE door: escalation to PUBLIC (the stored level is anything
+ * else) needs the operator grant. Reads the loaded target from the
+ * chain's own context key (every updateVisibility chain stores it —
+ * the RecordVisibilityBeforeUpdate pattern).
+ */
+export declare function newAuthorizeVisibilityTransitionStep<Desc extends DescMessage>(targetKey: string, authorizer: Authorizer): PipelineStep<Desc>;
+//# sourceMappingURL=visibility-gates.d.ts.map

package/dist/pipeline/steps/visibility-gates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"visibility-gates.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/visibility-gates.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAOtD,OAAO,KAAK,EACV,UAAU,EAEX,MAAM,gCAAgC,CAAC;AAGxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAInD;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,QAEU,CAAC;AAEtD,8EAA8E;AAC9E,wBAAgB,4BAA4B,CAAC,IAAI,SAAS,WAAW,EACnE,UAAU,EAAE,UAAU,GACrB,YAAY,CAAC,IAAI,CAAC,CAgBpB;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAClD,IAAI,SAAS,WAAW,EACxB,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CA+B/D"}

package/dist/pipeline/steps/visibility-gates.js

@@ -0,0 +1,134 @@
+/**
+ * The PUBLIC-visibility operator gates — the two write doors a resource
+ * can become public through, both consulting the ONE composed Authorizer
+ * with the same platform-scoped check (the Java
+ * PublicVisibilityEscalationPolicy port; C2 Stage 3, 20260827.10).
+ *
+ * PUBLIC is the only level that crosses every org boundary (one flip
+ * lists a resource in every tenant's cross-org catalog), so entering it
+ * is a curation decision: the owner requests, the platform team grants.
+ * The answer is `can_set_public_visibility` on `platform:stigmer` — a
+ * named operator capability, never a bare operator lookup.
+ *
+ *   - GuardPublicVisibility: the CREATE door, in the create chains of
+ *     the kinds whose VisibilityConfig supports PUBLIC (agent, workflow,
+ *     mcp_server, agent_instance, workflow_instance). After
+ *     BuildNewState — it inspects the state that will persist — which
+ *     keeps the pinned INVALID_ARGUMENT level-support rejections (the
+ *     earlier ValidateVisibility) their precedence over this
+ *     PERMISSION_DENIED.
+ *   - AuthorizeVisibilityTransition: the UPDATE door, in every
+ *     updateVisibility chain after ValidateVisibilityUpdate (the pinned
+ *     FAILED_PRECONDITION default-instance rejection keeps precedence,
+ *     the Java ordering the conformance suite depends on). Gates only
+ *     the ESCALATION to public (stored level is anything else).
+ *
+ * Both run LAZILY — only requests that actually involve the PUBLIC level
+ * reach the Authorizer — and both pass for internal callers (server-side
+ * flows publish platform resources by design). The OSS permissive
+ * default allows, so the local posture keeps today's behavior
+ * byte-identically; the cloud's FGA Authorizer supplies the gate.
+ *
+ * DELIBERATE partial port, recorded owner-visibly (Stage-3 execution
+ * record): Java's transition step additionally lets operators WITHOUT
+ * resource can_edit publish and take down (its updateVisibility chains
+ * authorize post-load, transition-aware); this edition's position-1
+ * Authorize enforces can_edit on updateVisibility before any step here
+ * runs, so those operator-without-edit lanes require can_edit until the
+ * Stage-4 chain disposition addresses them. No conformance lane pins
+ * them.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { internalError } from "../errors.js";
+import { metadataOf } from "./shapes.js";
+/**
+ * The denial callers see at both doors (the Java policy copy verbatim).
+ * Deliberately not byte-pinned by the OSS conformance suite; the cloud
+ * gate itself is recorded via the clientPublicVisibilityWrites flag.
+ */
+export const PUBLIC_VISIBILITY_DENY_MESSAGE = "Public visibility is granted by the platform team. " +
+    "Ask a platform operator to publish this resource.";
+/** The CREATE door: a new state declaring PUBLIC needs the operator grant. */
+export function newGuardPublicVisibilityStep(authorizer) {
+    return {
+        name: "GuardPublicVisibility",
+        async execute(ctx) {
+            if (ctx.callerIdentity.callerClass === "internal") {
+                return;
+            }
+            if (metadataOf(ctx.newState)?.visibility !==
+                ApiResourceVisibility.visibility_public) {
+                return;
+            }
+            await requireOperatorMaySetPublic(authorizer, ctx.callerIdentity);
+        },
+    };
+}
+/**
+ * The UPDATE door: escalation to PUBLIC (the stored level is anything
+ * else) needs the operator grant. Reads the loaded target from the
+ * chain's own context key (every updateVisibility chain stores it —
+ * the RecordVisibilityBeforeUpdate pattern).
+ */
+export function newAuthorizeVisibilityTransitionStep(targetKey, authorizer) {
+    return {
+        name: "AuthorizeVisibilityTransition",
+        async execute(ctx) {
+            if (ctx.callerIdentity.callerClass === "internal") {
+                return;
+            }
+            const requested = ctx.input
+                .visibility;
+            if (requested !== ApiResourceVisibility.visibility_public) {
+                return;
+            }
+            const target = ctx.get(targetKey);
+            if (target === undefined) {
+                // Wiring error, not a user error: without the loaded target there
+                // is no stored level, and a gate that silently passes un-guards
+                // the boundary it exists to protect.
+                throw internalError(new Error("AuthorizeVisibilityTransition ran without a loaded target — step must be placed after the load step"), "visibility authorization requires the loaded resource");
+            }
+            const stored = metadataOf(target)?.visibility;
+            if (stored === ApiResourceVisibility.visibility_public) {
+                return; // Re-asserting a stored PUBLIC is not an escalation.
+            }
+            await requireOperatorMaySetPublic(authorizer, ctx.callerIdentity);
+        },
+    };
+}
+/** The single owner of "may this caller set public?" — both doors call it. */
+async function requireOperatorMaySetPublic(authorizer, caller) {
+    let decision;
+    try {
+        decision = await authorizer.authorize(caller, {
+            permission: IamPermission.can_set_public_visibility,
+            resourceKind: ApiResourceKind.platform,
+            resourceId: "stigmer",
+        });
+    }
+    catch (error) {
+        throw publicVisibilityCheckFailure(error);
+    }
+    switch (decision.kind) {
+        case "allow":
+            return;
+        case "deny":
+        case "not-found":
+            throw new ConnectError(PUBLIC_VISIBILITY_DENY_MESSAGE, Code.PermissionDenied);
+        case "unavailable":
+            throw publicVisibilityCheckFailure(decision.cause);
+        default: {
+            const exhaustive = decision;
+            throw publicVisibilityCheckFailure(new Error(`unknown decision ${JSON.stringify(exhaustive)}`));
+        }
+    }
+}
+/** Authorization infrastructure failure: fail closed, sanitized (#478). */
+function publicVisibilityCheckFailure(error) {
+    return internalError(error instanceof Error ? error : new Error(String(error)), "public-visibility authorization could not be completed");
+}
+//# sourceMappingURL=visibility-gates.js.map

package/dist/pipeline/steps/visibility-gates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"visibility-gates.js","sourceRoot":"","sources":["../../../src/pipeline/steps/visibility-gates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAO1E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GACzC,qDAAqD;IACrD,mDAAmD,CAAC;AAEtD,8EAA8E;AAC9E,MAAM,UAAU,4BAA4B,CAC1C,UAAsB;IAEtB,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,GAAG,CAAC,cAAc,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,IACE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,UAAU;gBACpC,qBAAqB,CAAC,iBAAiB,EACvC,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,2BAA2B,CAAC,UAAU,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oCAAoC,CAElD,SAAiB,EAAE,UAAsB;IACzC,OAAO;QACL,IAAI,EAAE,+BAA+B;QACrC,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,GAAG,CAAC,cAAc,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,MAAM,SAAS,GAAI,GAAG,CAAC,KAA0C;iBAC9D,UAAU,CAAC;YACd,IAAI,SAAS,KAAK,qBAAqB,CAAC,iBAAiB,EAAE,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,kEAAkE;gBAClE,gEAAgE;gBAChE,qCAAqC;gBACrC,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,qGAAqG,CACtG,EACD,uDAAuD,CACxD,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAA6B,CAAC,EAAE,UAAU,CAAC;YACrE,IAAI,MAAM,KAAK,qBAAqB,CAAC,iBAAiB,EAAE,CAAC;gBACvD,OAAO,CAAC,qDAAqD;YAC/D,CAAC;YACD,MAAM,2BAA2B,CAAC,UAAU,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,2BAA2B,CACxC,UAAsB,EACtB,MAAsB;IAEtB,IAAI,QAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE;YAC5C,UAAU,EAAE,aAAa,CAAC,yBAAyB;YACnD,YAAY,EAAE,eAAe,CAAC,QAAQ;YACtC,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO;QACT,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW;YACd,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,IAAI,CAAC,gBAAgB,CACtB,CAAC;QACJ,KAAK,aAAa;YAChB,MAAM,4BAA4B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,4BAA4B,CAChC,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,SAAS,4BAA4B,CAAC,KAAc;IAClD,OAAO,aAAa,CAClB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACzD,wDAAwD,CACzD,CAAC;AACJ,CAAC"}

package/dist/query/activity/controller.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Activity controller — ports
+ * pkg/query/activity/controller/activity_controller.go: the thin adapter
+ * between ConnectRPC and the activity handler, following the search
+ * controller's pattern.
+ *
+ * The handler's only failure mode is a storage read error — server
+ * internals that must stay off the wire (stigmer/stigmer#478); the full
+ * error is logged here at the boundary and the wire carries the sanitized
+ * Internal.
+ *
+ * ActivityQueryController carries no api_resource_kind option and
+ * is_skip_authorization (cross-aggregate CQRS read; single-tenant OSS has
+ * no authorization set to enumerate — stigmer#461).
+ *
+ * Proven by activity.conformance.test.ts (CONFORMANCE_TARGET=local)
+ * and __tests__/handler.test.ts.
+ */
+import type { ConnectRouter } from "@connectrpc/connect";
+import type { Logger } from "../../boot/logger.js";
+import type { ActivityHandler } from "./handler.js";
+export interface ActivityControllerDeps {
+    readonly handler: ActivityHandler;
+    readonly logger: Logger;
+}
+/** Registers the ActivityQueryController on the router (routes stage). */
+export declare function registerActivityServices(router: ConnectRouter, deps: ActivityControllerDeps): void;
+//# sourceMappingURL=controller.d.ts.map

package/dist/query/activity/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/query/activity/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAGnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,0EAA0E;AAC1E,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,sBAAsB,GAC3B,IAAI,CAgBN"}

package/dist/query/activity/controller.js

@@ -0,0 +1,20 @@
+import { ActivityQueryController } from "@stigmer/protos/ai/stigmer/activity/v1/query_pb";
+import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
+import { internalError } from "../../pipeline/errors.js";
+/** Registers the ActivityQueryController on the router (routes stage). */
+export function registerActivityServices(router, deps) {
+    router.service(ActivityQueryController, {
+        listRecentActivity: async (request, ctx) => {
+            try {
+                return await deps.handler.listRecentActivity(request, callerIdentityOf(ctx));
+            }
+            catch (error) {
+                deps.logger.error("ListRecentActivity failed", {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                throw internalError(error, "failed to list recent activity");
+            }
+        },
+    });
+}
+//# sourceMappingURL=controller.js.map

package/dist/query/activity/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/query/activity/controller.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAG1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAQzD,0EAA0E;AAC1E,MAAM,UAAU,wBAAwB,CACtC,MAAqB,EACrB,IAA4B;IAE5B,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE;QACtC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;YACzC,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAC1C,OAAO,EACP,gBAAgB,CAAC,GAAG,CAAC,CACtB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE;oBAC7C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,MAAM,aAAa,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}