@stigmer/server 3.14.0-dev.20260910084630

package/dist/query/activity/handler.d.ts

@@ -0,0 +1,84 @@
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import type { ListRecentActivityRequest, ListRecentActivityResponse } from "@stigmer/protos/ai/stigmer/activity/v1/io_pb";
+import { ExecutionPhase } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/enum_pb";
+import type { ApiResourceAudit } from "@stigmer/protos/ai/stigmer/commons/apiresource/status_pb";
+import type { Logger } from "../../boot/logger.js";
+import type { CallerIdentity } from "../../extensions/identity.js";
+import type { ListReadScope } from "../../extensions/list-read-scope.js";
+import type { Store } from "../../store/interface.js";
+/**
+ * defaultPageSize / maxPageSize mirror the cloud handler's
+ * DEFAULT_PAGE_SIZE / MAX_PAGE_SIZE — the page contract is part of the
+ * cross-edition behavior, not an implementation detail.
+ */
+export declare const DEFAULT_PAGE_SIZE = 30;
+export declare const MAX_PAGE_SIZE = 100;
+/**
+ * The platform-wide sentinel subject stamped on sessions created without
+ * a user-provided title (the SDK's PENDING_SUBJECT, the CLI's resume
+ * flow, the runner's call-agent, and this server's agent-execution create
+ * all use the same literal). The sidebar shows the friendlier placeholder
+ * until subject generation replaces the sentinel.
+ */
+export declare const AUTO_CREATED_SESSION_SUBJECT = "Auto-created session";
+export declare const UNTITLED_SESSION_SUBJECT = "Untitled session";
+export declare const UNTITLED_EXECUTION_SUBJECT = "Untitled execution";
+/**
+ * Marks a session as runtime-originated. Recents shows personal sessions
+ * only (cloud design decision 012): channel conversations, guest/share
+ * sessions, and schedule-triggered sessions are excluded for every caller
+ * — each runtime surface owns its own list. Keys match the cloud's
+ * RUNTIME_ORIGIN_LABELS exactly; share/guest are cloud-only today but
+ * excluded identically so a future OSS share surface cannot silently
+ * regress the recents policy.
+ */
+export declare const RUNTIME_ORIGIN_LABELS: readonly string[];
+/** Answers ActivityQueryController.listRecentActivity against the store. */
+export declare class ActivityHandler {
+    private readonly store;
+    private readonly logger;
+    private readonly listReadScope;
+    constructor(store: Store, logger: Logger, listReadScope: ListReadScope | undefined);
+    /**
+     * Go ListRecentActivity: load both kinds, project to sidebar entries,
+     * merge-sort newest-first, trim to the page. With a composed scope the
+     * per-kind loads narrow to the caller's authorized ids ∩ the request's
+     * org (blank = permission-bounded across orgs, the repo convention).
+     */
+    listRecentActivity(request: ListRecentActivityRequest, identity: CallerIdentity): Promise<ListRecentActivityResponse>;
+    /**
+     * Go loadSessions: every stored personal session projected to a recents
+     * entry; runtime-originated sessions excluded.
+     */
+    private loadSessions;
+    /** Go loadExecutions: every stored workflow execution projected. */
+    private loadExecutions;
+}
+/** Go normalizePageSize: ≤0 → default 30; >100 → cap 100. */
+export declare function normalizePageSize(requested: number): number;
+/**
+ * Go resolveSubject: missing subjects AND the auto-created sentinel map
+ * to the display placeholder — a just-created session shows "Untitled
+ * session" until subject generation writes a real title.
+ */
+export declare function resolveSubject(subject: string): string;
+/**
+ * Go resolvePhase: the lifecycle phase → the display token the console's
+ * status badge renders. Unspecified (and any future value this build
+ * does not know) reads as "unknown" — no badge.
+ */
+export declare function resolvePhase(phase: ExecutionPhase): string;
+/**
+ * Go extractUpdatedAt — the entry's sort key: statusAudit.updatedAt
+ * (bumped on meaningful status changes; heartbeats deliberately do NOT
+ * bump it) falling back to specAudit.createdAt for rows whose status
+ * audit was never stamped (older builds or external tooling; OSS creates
+ * always stamp both slots).
+ */
+export declare function extractUpdatedAt(audit: ApiResourceAudit | undefined): Timestamp;
+/**
+ * Go timestampAfter: a sorts strictly after b (newer first), comparing
+ * (seconds, nanos) exactly like the cloud's comparator.
+ */
+export declare function timestampAfter(a: Timestamp | undefined, b: Timestamp | undefined): boolean;
+//# sourceMappingURL=handler.d.ts.map

package/dist/query/activity/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/query/activity/handler.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAMxD,OAAO,KAAK,EACV,yBAAyB,EACzB,0BAA0B,EAE3B,MAAM,8CAA8C,CAAC;AAGtD,OAAO,EAAE,cAAc,EAAE,MAAM,iEAAiE,CAAC;AAEjG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AAGjG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,eAAO,MAAM,aAAa,MAAM,CAAC;AAEjC;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,yBAAyB,CAAC;AAEnE,eAAO,MAAM,wBAAwB,qBAAqB,CAAC;AAC3D,eAAO,MAAM,0BAA0B,uBAAuB,CAAC;AAE/D;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAKlD,CAAC;AAEF,4EAA4E;AAC5E,qBAAa,eAAe;IAExB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAFb,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,GAAG,SAAS;IAG3D;;;;;OAKG;IACG,kBAAkB,CACtB,OAAO,EAAE,yBAAyB,EAClC,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,0BAA0B,CAAC;IA8CtC;;;OAGG;YACW,YAAY;IAmC1B,oEAAoE;YACtD,cAAc;CAuC7B;AAkBD,6DAA6D;AAC7D,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAQ3D;AAcD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKtD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAmB1D;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,gBAAgB,GAAG,SAAS,GAClC,SAAS,CAUX;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,CAAC,EAAE,SAAS,GAAG,SAAS,EACxB,CAAC,EAAE,SAAS,GAAG,SAAS,GACvB,OAAO,CAOT"}

package/dist/query/activity/handler.js

@@ -0,0 +1,269 @@
+/**
+ * Recent-activity handler — ports pkg/query/activity/handler/handler.go:
+ * sessions and workflow executions merged into one time-sorted list for
+ * the console's Recents sidebar.
+ *
+ * This is the OSS twin of the cloud's ListRecentActivityHandler; the
+ * merge, ordering, projection, and filtering semantics are deliberately
+ * identical (stigmer#461). What differs is only what single-tenancy
+ * removes: with NO ListReadScope composed there is no id enumeration
+ * (the candidate set is every stored row) and the request's org is a
+ * no-op (a recents filter stricter than the per-kind lists it summarizes
+ * would hide locally-owned rows); load-all-then-sort-in-memory replaces
+ * per-kind SQL LIMIT windows (each kind's newest page_size rows are a
+ * superset of its contribution to the merged page — the identical final
+ * list; the full scan is this store's contract, the same pattern every
+ * OSS list handler uses). With a composed ListReadScope (20260830.01,
+ * census lane 22) both loads narrow to the caller's authorized ids ∩
+ * the request's org when non-blank — the Java handler's two
+ * listAuthorizedResourceIds calls and its findRecentByIdsAndOrg org arm.
+ *
+ * Proven by __tests__/handler.test.ts (Go's handler_test.go arms) and
+ * activity.conformance.test.ts on local.
+ */
+import { create, fromBinary } from "@bufbuild/protobuf";
+import { TimestampSchema } from "@bufbuild/protobuf/wkt";
+import { ListRecentActivityResponseSchema, RecentActivityEntrySchema, } from "@stigmer/protos/ai/stigmer/activity/v1/io_pb";
+import { SessionSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
+import { WorkflowExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
+import { ExecutionPhase } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/enum_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+/**
+ * defaultPageSize / maxPageSize mirror the cloud handler's
+ * DEFAULT_PAGE_SIZE / MAX_PAGE_SIZE — the page contract is part of the
+ * cross-edition behavior, not an implementation detail.
+ */
+export const DEFAULT_PAGE_SIZE = 30;
+export const MAX_PAGE_SIZE = 100;
+/**
+ * The platform-wide sentinel subject stamped on sessions created without
+ * a user-provided title (the SDK's PENDING_SUBJECT, the CLI's resume
+ * flow, the runner's call-agent, and this server's agent-execution create
+ * all use the same literal). The sidebar shows the friendlier placeholder
+ * until subject generation replaces the sentinel.
+ */
+export const AUTO_CREATED_SESSION_SUBJECT = "Auto-created session";
+export const UNTITLED_SESSION_SUBJECT = "Untitled session";
+export const UNTITLED_EXECUTION_SUBJECT = "Untitled execution";
+/**
+ * Marks a session as runtime-originated. Recents shows personal sessions
+ * only (cloud design decision 012): channel conversations, guest/share
+ * sessions, and schedule-triggered sessions are excluded for every caller
+ * — each runtime surface owns its own list. Keys match the cloud's
+ * RUNTIME_ORIGIN_LABELS exactly; share/guest are cloud-only today but
+ * excluded identically so a future OSS share surface cannot silently
+ * regress the recents policy.
+ */
+export const RUNTIME_ORIGIN_LABELS = [
+    "stigmer.ai/channel-id",
+    "stigmer.ai/share-id",
+    "stigmer.ai/guest-cookie-id",
+    "stigmer.ai/schedule-id",
+];
+/** Answers ActivityQueryController.listRecentActivity against the store. */
+export class ActivityHandler {
+    store;
+    logger;
+    listReadScope;
+    constructor(store, logger, listReadScope) {
+        this.store = store;
+        this.logger = logger;
+        this.listReadScope = listReadScope;
+    }
+    /**
+     * Go ListRecentActivity: load both kinds, project to sidebar entries,
+     * merge-sort newest-first, trim to the page. With a composed scope the
+     * per-kind loads narrow to the caller's authorized ids ∩ the request's
+     * org (blank = permission-bounded across orgs, the repo convention).
+     */
+    async listRecentActivity(request, identity) {
+        const pageSize = normalizePageSize(request.pageSize);
+        let sessionScope;
+        let executionScope;
+        if (this.listReadScope !== undefined) {
+            sessionScope = await this.listReadScope.authorizedResourceIds(identity, ApiResourceKind.session);
+            executionScope = await this.listReadScope.authorizedResourceIds(identity, ApiResourceKind.workflow_execution);
+        }
+        const sessions = await this.loadSessions(sessionScope, request.org);
+        const executions = await this.loadExecutions(executionScope, request.org);
+        // Sessions before executions, then a stable sort: entries with equal
+        // timestamps keep this insertion order — the same tie-break the
+        // cloud gets from java.util.List.sort's stability over the same load
+        // order (JS Array.prototype.sort is stable, matching Go's
+        // sort.SliceStable).
+        let entries = [...sessions, ...executions].sort((a, b) => {
+            if (timestampAfter(a.updatedAt, b.updatedAt)) {
+                return -1;
+            }
+            if (timestampAfter(b.updatedAt, a.updatedAt)) {
+                return 1;
+            }
+            return 0;
+        });
+        if (entries.length > pageSize) {
+            entries = entries.slice(0, pageSize);
+        }
+        this.logger.debug("Recent activity merged", {
+            entries: entries.length,
+            page_size: pageSize,
+        });
+        return create(ListRecentActivityResponseSchema, { entries });
+    }
+    /**
+     * Go loadSessions: every stored personal session projected to a recents
+     * entry; runtime-originated sessions excluded.
+     */
+    async loadSessions(authorizedIds, org) {
+        const rows = await this.store.listResources(ApiResourceKind.session);
+        const entries = [];
+        for (const row of rows) {
+            let session;
+            try {
+                session = fromBinary(SessionSchema, row);
+            }
+            catch {
+                this.logger.warn("Skipping undecodable session row in recent activity");
+                continue;
+            }
+            if (hasRuntimeOriginLabel(session.metadata)) {
+                continue;
+            }
+            if (authorizedIds !== undefined &&
+                !isVisibleUnderScope(authorizedIds, org, session.metadata)) {
+                continue;
+            }
+            entries.push(create(RecentActivityEntrySchema, {
+                id: session.metadata?.id ?? "",
+                type: "session",
+                subject: resolveSubject(session.spec?.subject ?? ""),
+                updatedAt: extractUpdatedAt(session.status?.audit),
+            }));
+        }
+        return entries;
+    }
+    /** Go loadExecutions: every stored workflow execution projected. */
+    async loadExecutions(authorizedIds, org) {
+        const rows = await this.store.listResources(ApiResourceKind.workflow_execution);
+        const entries = [];
+        for (const row of rows) {
+            let execution;
+            try {
+                execution = fromBinary(WorkflowExecutionSchema, row);
+            }
+            catch {
+                this.logger.warn("Skipping undecodable workflow execution row in recent activity");
+                continue;
+            }
+            if (authorizedIds !== undefined &&
+                !isVisibleUnderScope(authorizedIds, org, execution.metadata)) {
+                continue;
+            }
+            const name = execution.metadata?.name ?? "";
+            entries.push(create(RecentActivityEntrySchema, {
+                id: execution.metadata?.id ?? "",
+                type: "workflow_execution",
+                subject: name === "" ? UNTITLED_EXECUTION_SUBJECT : name,
+                updatedAt: extractUpdatedAt(execution.status?.audit),
+                status: resolvePhase(execution.status?.phase ?? ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED),
+            }));
+        }
+        return entries;
+    }
+}
+/**
+ * The scoped-visibility test both loads share when a scope is composed:
+ * the row's id must be authorized and, when the request names an org, the
+ * row must belong to it (the Java findRecentByIdsAndOrg arm).
+ */
+function isVisibleUnderScope(authorizedIds, org, metadata) {
+    if (!authorizedIds.has(metadata?.id ?? "")) {
+        return false;
+    }
+    return org === "" || (metadata?.org ?? "") === org;
+}
+/** Go normalizePageSize: ≤0 → default 30; >100 → cap 100. */
+export function normalizePageSize(requested) {
+    if (requested <= 0) {
+        return DEFAULT_PAGE_SIZE;
+    }
+    if (requested > MAX_PAGE_SIZE) {
+        return MAX_PAGE_SIZE;
+    }
+    return requested;
+}
+function hasRuntimeOriginLabel(metadata) {
+    const labels = metadata?.labels;
+    if (labels === undefined) {
+        return false;
+    }
+    // Object.hasOwn, not `in`: own keys only, matching Go's map lookup
+    // (the #17 least-privilege-filter precedent).
+    return RUNTIME_ORIGIN_LABELS.some((key) => Object.hasOwn(labels, key));
+}
+/**
+ * Go resolveSubject: missing subjects AND the auto-created sentinel map
+ * to the display placeholder — a just-created session shows "Untitled
+ * session" until subject generation writes a real title.
+ */
+export function resolveSubject(subject) {
+    if (subject === "" || subject === AUTO_CREATED_SESSION_SUBJECT) {
+        return UNTITLED_SESSION_SUBJECT;
+    }
+    return subject;
+}
+/**
+ * Go resolvePhase: the lifecycle phase → the display token the console's
+ * status badge renders. Unspecified (and any future value this build
+ * does not know) reads as "unknown" — no badge.
+ */
+export function resolvePhase(phase) {
+    switch (phase) {
+        case ExecutionPhase.EXECUTION_PENDING:
+            return "pending";
+        case ExecutionPhase.EXECUTION_IN_PROGRESS:
+            return "running";
+        case ExecutionPhase.EXECUTION_COMPLETED:
+            return "completed";
+        case ExecutionPhase.EXECUTION_FAILED:
+            return "failed";
+        case ExecutionPhase.EXECUTION_CANCELLED:
+            return "cancelled";
+        case ExecutionPhase.EXECUTION_TERMINATED:
+            return "terminated";
+        case ExecutionPhase.EXECUTION_PAUSED:
+            return "paused";
+        default:
+            return "unknown";
+    }
+}
+/**
+ * Go extractUpdatedAt — the entry's sort key: statusAudit.updatedAt
+ * (bumped on meaningful status changes; heartbeats deliberately do NOT
+ * bump it) falling back to specAudit.createdAt for rows whose status
+ * audit was never stamped (older builds or external tooling; OSS creates
+ * always stamp both slots).
+ */
+export function extractUpdatedAt(audit) {
+    const updatedAt = audit?.statusAudit?.updatedAt;
+    if (updatedAt !== undefined) {
+        return updatedAt;
+    }
+    const createdAt = audit?.specAudit?.createdAt;
+    if (createdAt !== undefined) {
+        return createdAt;
+    }
+    return create(TimestampSchema);
+}
+/**
+ * Go timestampAfter: a sorts strictly after b (newer first), comparing
+ * (seconds, nanos) exactly like the cloud's comparator.
+ */
+export function timestampAfter(a, b) {
+    const aSeconds = a?.seconds ?? 0n;
+    const bSeconds = b?.seconds ?? 0n;
+    if (aSeconds !== bSeconds) {
+        return aSeconds > bSeconds;
+    }
+    return (a?.nanos ?? 0) > (b?.nanos ?? 0);
+}
+//# sourceMappingURL=handler.js.map

package/dist/query/activity/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../../src/query/activity/handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGzD,OAAO,EACL,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,8CAA8C,CAAC;AAMtD,OAAO,EAAE,aAAa,EAAE,MAAM,sDAAsD,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,gEAAgE,CAAC;AACzG,OAAO,EAAE,cAAc,EAAE,MAAM,iEAAiE,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAStH;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AAEjC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,sBAAsB,CAAC;AAEnE,MAAM,CAAC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AAC3D,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,uBAAuB;IACvB,qBAAqB;IACrB,4BAA4B;IAC5B,wBAAwB;CACzB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,OAAO,eAAe;IAEP;IACA;IACA;IAHnB,YACmB,KAAY,EACZ,MAAc,EACd,aAAwC;QAFxC,UAAK,GAAL,KAAK,CAAO;QACZ,WAAM,GAAN,MAAM,CAAQ;QACd,kBAAa,GAAb,aAAa,CAA2B;IACxD,CAAC;IAEJ;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CACtB,OAAkC,EAClC,QAAwB;QAExB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAErD,IAAI,YAA6C,CAAC;QAClD,IAAI,cAA+C,CAAC;QACpD,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAC3D,QAAQ,EACR,eAAe,CAAC,OAAO,CACxB,CAAC;YACF,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAC7D,QAAQ,EACR,eAAe,CAAC,kBAAkB,CACnC,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAE1E,qEAAqE;QACrE,gEAAgE;QAChE,qEAAqE;QACrE,0DAA0D;QAC1D,qBAAqB;QACrB,IAAI,OAAO,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACvD,IAAI,cAAc,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7C,OAAO,CAAC,CAAC,CAAC;YACZ,CAAC;YACD,IAAI,cAAc,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7C,OAAO,CAAC,CAAC;YACX,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;YAC9B,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;YAC1C,OAAO,EAAE,OAAO,CAAC,MAAM;YACvB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC,gCAAgC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,YAAY,CACxB,aAA8C,EAC9C,GAAW;QAEX,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,OAAO,GAA0B,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,OAAO,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,GAAG,UAAU,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;gBACxE,SAAS;YACX,CAAC;YACD,IAAI,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5C,SAAS;YACX,CAAC;YACD,IACE,aAAa,KAAK,SAAS;gBAC3B,CAAC,mBAAmB,CAAC,aAAa,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,EAC1D,CAAC;gBACD,SAAS;YACX,CAAC;YACD,OAAO,CAAC,IAAI,CACV,MAAM,CAAC,yBAAyB,EAAE;gBAChC,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;gBAC9B,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC;gBACpD,SAAS,EAAE,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;aACnD,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,oEAAoE;IAC5D,KAAK,CAAC,cAAc,CAC1B,aAA8C,EAC9C,GAAW;QAEX,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CACzC,eAAe,CAAC,kBAAkB,CACnC,CAAC;QACF,MAAM,OAAO,GAA0B,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,SAAS,CAAC;YACd,IAAI,CAAC;gBACH,SAAS,GAAG,UAAU,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gEAAgE,CACjE,CAAC;gBACF,SAAS;YACX,CAAC;YACD,IACE,aAAa,KAAK,SAAS;gBAC3B,CAAC,mBAAmB,CAAC,aAAa,EAAE,GAAG,EAAE,SAAS,CAAC,QAAQ,CAAC,EAC5D,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;YAC5C,OAAO,CAAC,IAAI,CACV,MAAM,CAAC,yBAAyB,EAAE;gBAChC,EAAE,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;gBAChC,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI;gBACxD,SAAS,EAAE,gBAAgB,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC;gBACpD,MAAM,EAAE,YAAY,CAClB,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,cAAc,CAAC,2BAA2B,CACtE;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,aAAkC,EAClC,GAAW,EACX,QAAyC;IAEzC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC;AACrD,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,IAAI,SAAS,GAAG,aAAa,EAAE,CAAC;QAC9B,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAAyC;IAEzC,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,CAAC;IAChC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,mEAAmE;IACnE,8CAA8C;IAC9C,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,4BAA4B,EAAE,CAAC;QAC/D,OAAO,wBAAwB,CAAC;IAClC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAqB;IAChD,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,cAAc,CAAC,iBAAiB;YACnC,OAAO,SAAS,CAAC;QACnB,KAAK,cAAc,CAAC,qBAAqB;YACvC,OAAO,SAAS,CAAC;QACnB,KAAK,cAAc,CAAC,mBAAmB;YACrC,OAAO,WAAW,CAAC;QACrB,KAAK,cAAc,CAAC,gBAAgB;YAClC,OAAO,QAAQ,CAAC;QAClB,KAAK,cAAc,CAAC,mBAAmB;YACrC,OAAO,WAAW,CAAC;QACrB,KAAK,cAAc,CAAC,oBAAoB;YACtC,OAAO,YAAY,CAAC;QACtB,KAAK,cAAc,CAAC,gBAAgB;YAClC,OAAO,QAAQ,CAAC;QAClB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAmC;IAEnC,MAAM,SAAS,GAAG,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC;IAChD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;IAC9C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,CAAwB,EACxB,CAAwB;IAExB,MAAM,QAAQ,GAAG,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC;IAClC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,QAAQ,GAAG,QAAQ,CAAC;IAC7B,CAAC;IACD,OAAO,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/query/search/controller.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Search controller — ports
+ * pkg/query/search/controller/search_controller.go: the thin adapter
+ * between ConnectRPC and the SearchHandler, owning the error-to-status
+ * mapping.
+ *
+ * The mapping is Go's string-contains heuristic ported byte-for-byte
+ * (toGRPCError): handler texts containing "validation failed", "invalid",
+ * or "exceeds maximum" answer InvalidArgument CARRYING the wrapped text;
+ * everything else is sanitized to Internal "search failed"
+ * (stigmer/stigmer#478 — the raw error is server internals, logged here
+ * at the boundary, never on the wire). The conformance suite pins the
+ * codes only (ratified guard P2); the texts ride the parity register's
+ * protovalidate-es watch item.
+ *
+ * SearchService carries no api_resource_kind option and
+ * is_skip_authorization (cross-aggregate CQRS read) — the apiresource
+ * interceptor injects nothing and the auth slot is a pass-through, both
+ * verified; no interceptor changes ride this port.
+ *
+ * Proven by search.conformance.test.ts (CONFORMANCE_TARGET=local) and
+ * __tests__/handler.test.ts's mapping arms.
+ */
+import type { ConnectRouter } from "@connectrpc/connect";
+import type { Logger } from "../../boot/logger.js";
+import type { SearchHandler } from "./handler.js";
+export interface SearchControllerDeps {
+    readonly handler: SearchHandler;
+    readonly logger: Logger;
+}
+/** Registers the SearchService on the router (routes stage). */
+export declare function registerSearchServices(router: ConnectRouter, deps: SearchControllerDeps): void;
+//# sourceMappingURL=controller.d.ts.map

package/dist/query/search/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/query/search/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAKnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,gEAAgE;AAChE,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,oBAAoB,GACzB,IAAI,CAIN"}

package/dist/query/search/controller.js

@@ -0,0 +1,43 @@
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { SearchService } from "@stigmer/protos/ai/stigmer/search/v1/query_pb";
+import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
+import { internalError, invalidArgumentError } from "../../pipeline/errors.js";
+/** Registers the SearchService on the router (routes stage). */
+export function registerSearchServices(router, deps) {
+    router.service(SearchService, {
+        search: (request, ctx) => search(deps, request, callerIdentityOf(ctx)),
+    });
+}
+async function search(deps, request, identity) {
+    deps.logger.debug("SearchService.Search called", {
+        kinds: request.kinds.map((kind) => ApiResourceKind[kind] ?? String(kind)),
+        query: request.query,
+        org: request.org,
+        exclude_public: request.excludePublic,
+    });
+    try {
+        return await deps.handler.handle(request, identity);
+    }
+    catch (error) {
+        deps.logger.error("Search failed", {
+            error: error instanceof Error ? error.message : String(error),
+        });
+        throw toGrpcError(error);
+    }
+}
+/**
+ * Go toGRPCError: substring-match validation texts to InvalidArgument
+ * (carrying the wrapped text), default everything else to the sanitized
+ * Internal (#478) — the call site above has already logged the full
+ * error.
+ */
+function toGrpcError(error) {
+    const text = error instanceof Error ? error.message : String(error);
+    if (text.includes("validation failed") ||
+        text.includes("invalid") ||
+        text.includes("exceeds maximum")) {
+        return invalidArgumentError(text);
+    }
+    return internalError(error, "search failed");
+}
+//# sourceMappingURL=controller.js.map

package/dist/query/search/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/query/search/controller.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAC;AAQ9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAS/E,gEAAgE;AAChE,MAAM,UAAU,sBAAsB,CACpC,MAAqB,EACrB,IAA0B;IAE1B,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE;QAC5B,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;KACvE,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,IAA0B,EAC1B,OAAsB,EACtB,QAAwB;IAExB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE;QAC/C,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;QACzE,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,cAAc,EAAE,OAAO,CAAC,aAAa;KACtC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE;YACjC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QACH,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpE,IACE,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAChC,CAAC;QACD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,aAAa,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;AAC/C,CAAC"}

package/dist/query/search/criteria.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Search criteria value object — ports
+ * pkg/query/search/valueobject/search_criteria.go: validated, normalized,
+ * immutable search parameters and the three-mode contract (list / search /
+ * discover).
+ *
+ * The searchable-kind set is DERIVED from the proto kind_meta extension
+ * (not_search_indexed: false, tier != cloud_only) — Go's
+ * SearchIndexedKinds() posture since stigmer/stigmer#439, where hand-copied
+ * kind lists drifted from the proto and from each other. Go still carries a
+ * hand map (SearchableKinds) pinned to the derivation by an invariant test;
+ * here the derivation IS the set — parity by construction, one source. The
+ * registry unit test pins the registered extractors against this same
+ * derivation (the #439 invariant's TS home).
+ *
+ * kinds are kept VERBATIM from the request; filtering to the searchable set
+ * happens in effectiveKinds(). Keeping the raw request is what
+ * distinguishes "no kinds requested" (discover mode) from "kinds requested
+ * but none searchable" (empty result) — collapsing the two at construction
+ * made kind-targeted requests for non-searchable kinds silently degrade to
+ * discover mode and return every other kind's resources
+ * (stigmer/stigmer#440).
+ *
+ * Proven by __tests__/criteria.test.ts (Go's tables case-for-case) and
+ * search.conformance.test.ts on local.
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+/** Go DefaultPageSize. */
+export declare const DEFAULT_PAGE_SIZE = 20;
+/** Go MaxPageSize. */
+export declare const MAX_PAGE_SIZE = 100;
+/** Go MaxQueryLength (the proto's max_len twin; see newSearchCriteria). */
+export declare const MAX_QUERY_LENGTH = 500;
+/**
+ * Go SearchIndexedKinds(): every kind this edition's search read side
+ * serves — kind_meta declares it search-indexed and servable outside the
+ * cloud. Sorted ascending by enum value, exactly Go's sort. Kinds whose
+ * kind_meta cannot be read are skipped (Go's contract; the registry unit
+ * test separately fails on such a defect).
+ */
+export declare function searchIndexedKinds(): readonly ApiResourceKind[];
+/**
+ * Immutable, validated search parameters. Construct via newSearchCriteria.
+ */
+export declare class SearchCriteria {
+    private readonly requestedKinds;
+    private readonly queryText;
+    private readonly orgFilterValue;
+    private readonly excludePublicFlag;
+    private readonly crossOrgPublicFlag;
+    private readonly pageNumberValue;
+    private readonly pageSizeValue;
+    private constructor();
+    /**
+     * Go NewSearchCriteria: trims query and org, clamps pagination
+     * (num < 1 → 1; size < 1 → default 20; size > 100 → 100), keeps kinds
+     * verbatim. Throws on an over-length query — defensive twin of the
+     * proto's max_len 500, which the protovalidate interceptor answers
+     * first on the wire (Go carries the same unreachable guard).
+     *
+     * Trimming is goTrimSpace, NOT String.trim: hasQuery() decides
+     * list-vs-search mode from the trimmed query, and the two trim sets
+     * disagree on U+FEFF/U+0085 — a BOM-only query would read as list mode
+     * (return everything) where Go runs an empty-match search (the #8 BOM
+     * divergence class, caught again by this sub-project's parity panel).
+     */
+    static create(kinds: readonly ApiResourceKind[], query: string, orgFilter: string, excludePublic: boolean, crossOrgPublic: boolean, pageNumber: number, pageSize: number): SearchCriteria;
+    /** The requested kinds VERBATIM — including non-searchable ones. */
+    kinds(): readonly ApiResourceKind[];
+    query(): string;
+    orgFilter(): string;
+    excludePublic(): boolean;
+    crossOrgPublic(): boolean;
+    pageNumber(): number;
+    pageSize(): number;
+    /**
+     * Discover mode = NO kinds requested. A request naming only
+     * non-searchable kinds is NOT discover mode — it searches nothing.
+     */
+    isDiscoverMode(): boolean;
+    /** False = list mode (created_at ordering, score pinned 1.0). */
+    hasQuery(): boolean;
+    hasOrgFilter(): boolean;
+    /**
+     * Go EffectiveKinds: discover mode → all searchable kinds; otherwise
+     * the requested kinds filtered to the searchable set — silently
+     * dropping non-searchable ones (the forward-compatibility contract on
+     * SearchRequest.kinds). The result may be EMPTY: the caller answers
+     * emptiness, never a discover fallback (stigmer/stigmer#440).
+     */
+    effectiveKinds(): readonly ApiResourceKind[];
+    /** Zero-indexed row offset for the page (Go Offset). */
+    offset(): number;
+}
+//# sourceMappingURL=criteria.d.ts.map

package/dist/query/search/criteria.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"criteria.d.ts","sourceRoot":"","sources":["../../../src/query/search/criteria.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EACL,eAAe,EAGhB,MAAM,qFAAqF,CAAC;AAK7F,0BAA0B;AAC1B,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,sBAAsB;AACtB,eAAO,MAAM,aAAa,MAAM,CAAC;AACjC,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAKpC;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,SAAS,eAAe,EAAE,CAuB/D;AAUD;;GAEG;AACH,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAPhC,OAAO;IAUP;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,MAAM,CACX,KAAK,EAAE,SAAS,eAAe,EAAE,EACjC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,OAAO,EACtB,cAAc,EAAE,OAAO,EACvB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,cAAc;IAkBjB,oEAAoE;IACpE,KAAK,IAAI,SAAS,eAAe,EAAE;IAInC,KAAK,IAAI,MAAM;IAIf,SAAS,IAAI,MAAM;IAInB,aAAa,IAAI,OAAO;IAIxB,cAAc,IAAI,OAAO;IAIzB,UAAU,IAAI,MAAM;IAIpB,QAAQ,IAAI,MAAM;IAIlB;;;OAGG;IACH,cAAc,IAAI,OAAO;IAIzB,iEAAiE;IACjE,QAAQ,IAAI,OAAO;IAInB,YAAY,IAAI,OAAO;IAIvB;;;;;;OAMG;IACH,cAAc,IAAI,SAAS,eAAe,EAAE;IAQ5C,wDAAwD;IACxD,MAAM,IAAI,MAAM;CAGjB"}