@stigmer/server 3.14.0-dev.20260910084630

package/dist/domain/artifact/file-server.js

@@ -0,0 +1,173 @@
+/**
+ * The artifact HTTP file server — ports the local-download lane from Go
+ * pkg/server/server.go (artifactDownloadHandler + the boot block, lines
+ * 849–926): a second listener on 127.0.0.1:ARTIFACT_HTTP_PORT (default
+ * grpcPort+1), started only when artifact storage is LOCAL, serving
+ * GET /<key> as the exact bytes LocalArtifactStorage wrote. The lane
+ * dissolved into its owning domain per the ratified D4 decision — it is
+ * NOT a unified-port lane (Go runs it as a separate listener, and so does
+ * this port).
+ *
+ * Disposition contract (proven by the artifact suite's file-server block):
+ * a request carrying ?download=<name> (set by getSignedUrl) is served as a
+ * browser download named by that parameter — mirroring the R2 backend,
+ * which signs Content-Disposition into the presigned URL. Requests without
+ * the parameter are served INLINE with no disposition header.
+ *
+ * Two disclosed nuances versus Go's http.FileServer (neither pinned by the
+ * suite, both recorded in the PR):
+ *   - No Content-Type header: Go sniffs one (net/http DetectContentType);
+ *     porting the whole sniffing algorithm for an unpinned header is not
+ *     parity the register demands, and an absent header lets clients apply
+ *     the same sniffing themselves.
+ *   - No Range support: range requests are answered with the full body
+ *     (200), which HTTP permits; Go's ServeContent honors them.
+ */
+import { createReadStream } from "node:fs";
+import { stat } from "node:fs/promises";
+import http from "node:http";
+import path from "node:path";
+import { contentDispositionAttachment, LOCAL_DOWNLOAD_QUERY_PARAM } from "../../artifactstorage/artifact-storage.js";
+export function createArtifactFileServer(options) {
+    const { basePath, logger } = options;
+    const server = http.createServer((req, res) => {
+        void serveArtifact(basePath, req, res, logger);
+    });
+    return {
+        listen(port, host) {
+            return new Promise((resolve, reject) => {
+                server.once("error", reject);
+                // Loopback by DEFAULT, as Go bound "127.0.0.1:<port>": download
+                // URLs are minted for the local machine, never a network
+                // interface. The host became configurable (ARTIFACT_HTTP_HOST,
+                // DD-013) for containers, where 127.0.0.1 is unreachable from
+                // outside; the default preserves Go's posture byte-for-byte.
+                server.listen(port, host, () => {
+                    server.removeListener("error", reject);
+                    const address = server.address();
+                    const boundPort = address !== null && typeof address === "object" ? address.port : port;
+                    logger.info("artifact HTTP file server listening", {
+                        port: boundPort,
+                        dir: basePath,
+                    });
+                    resolve(boundPort);
+                });
+            });
+        },
+        shutdown() {
+            return new Promise((resolve) => {
+                server.close(() => resolve());
+                // In-flight downloads do not hold shutdown open (Go's file server
+                // is simply abandoned on exit; close() at least stops the listener).
+                server.closeAllConnections();
+            });
+        },
+    };
+}
+async function serveArtifact(basePath, req, res, logger) {
+    try {
+        if (req.method !== "GET" && req.method !== "HEAD") {
+            res.writeHead(405, { Allow: "GET, HEAD" });
+            res.end();
+            return;
+        }
+        const url = new URL(req.url ?? "/", "http://localhost");
+        let key;
+        try {
+            key = decodeURIComponent(url.pathname.replace(/^\/+/, ""));
+        }
+        catch {
+            // Malformed percent-escapes are a client error, not a server fault
+            // (Go's net/http rejects them before the file server runs).
+            res.writeHead(404);
+            res.end("404 page not found\n");
+            return;
+        }
+        // The same containment guard LocalArtifactStorage applies on writes: a
+        // crafted path must never escape the artifact root.
+        const root = path.resolve(basePath);
+        const filePath = path.resolve(root, key);
+        if (filePath !== root && !filePath.startsWith(root + path.sep)) {
+            res.writeHead(404);
+            res.end("404 page not found\n");
+            return;
+        }
+        let info;
+        try {
+            info = await stat(filePath);
+        }
+        catch {
+            res.writeHead(404);
+            res.end("404 page not found\n");
+            return;
+        }
+        if (!info.isFile()) {
+            res.writeHead(404);
+            res.end("404 page not found\n");
+            return;
+        }
+        const headers = {
+            "Content-Length": String(info.size),
+        };
+        // The download query parameter (set by getSignedUrl) rides the URL
+        // because the local lane has no presigning; applied here exactly as
+        // Go's artifactDownloadHandler does. Absent → inline, no header.
+        const downloadName = url.searchParams.get(LOCAL_DOWNLOAD_QUERY_PARAM) ?? "";
+        if (downloadName !== "") {
+            headers["Content-Disposition"] = contentDispositionAttachment(downloadName);
+        }
+        res.writeHead(200, headers);
+        if (req.method === "HEAD") {
+            res.end();
+            return;
+        }
+        const stream = createReadStream(filePath);
+        stream.on("error", (error) => {
+            logger.error("artifact file stream failed", {
+                key,
+                error: error.message,
+            });
+            res.destroy();
+        });
+        stream.pipe(res);
+    }
+    catch (error) {
+        logger.error("artifact file server request failed", {
+            error: error instanceof Error ? error.message : String(error),
+        });
+        if (!res.headersSent) {
+            res.writeHead(500);
+        }
+        res.end();
+    }
+}
+/**
+ * Go warnOnLegacyArtifactLayout: a one-line migration hint when a
+ * pre-#285 store layout is detected (base was a PARENT; artifacts lived at
+ * <base>/artifacts/<key>). Keys off the two subpaths only the OLD layout
+ * produces — <base>/artifacts/attachments and the doubled
+ * <base>/artifacts/artifacts — so it cannot false-positive on a healthy
+ * new-layout install.
+ */
+export async function warnOnLegacyArtifactLayout(basePath, logger) {
+    for (const sub of ["attachments", "artifacts"]) {
+        const legacy = path.join(basePath, "artifacts", sub);
+        try {
+            const info = await stat(legacy);
+            if (info.isDirectory()) {
+                logger.warn("Detected artifacts under a pre-#285 layout at <base>/artifacts/*. " +
+                    "The artifact root is now <base> itself. Move <base>/artifacts/* up into " +
+                    "<base> (or set ARTIFACT_LOCAL_BASE_PATH to the old <base>/artifacts) so " +
+                    "existing artifacts remain reachable.", {
+                    legacyDir: path.join(basePath, "artifacts"),
+                    artifactRoot: basePath,
+                });
+                return;
+            }
+        }
+        catch {
+            // Absent legacy path: the healthy case.
+        }
+    }
+}
+//# sourceMappingURL=file-server.js.map

package/dist/domain/artifact/file-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-server.js","sourceRoot":"","sources":["../../../src/domain/artifact/file-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAsBrH,MAAM,UAAU,wBAAwB,CACtC,OAAkC;IAElC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAErC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,KAAK,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,CAAC,IAAY,EAAE,IAAY;YAC/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC7B,gEAAgE;gBAChE,yDAAyD;gBACzD,+DAA+D;gBAC/D,8DAA8D;gBAC9D,6DAA6D;gBAC7D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;oBAC7B,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;oBACvC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjC,MAAM,SAAS,GACb,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;oBACxE,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;wBACjD,IAAI,EAAE,SAAS;wBACf,GAAG,EAAE,QAAQ;qBACd,CAAC,CAAC;oBACH,OAAO,CAAC,SAAS,CAAC,CAAC;gBACrB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QACD,QAAQ;YACN,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC7B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC9B,kEAAkE;gBAClE,qEAAqE;gBACrE,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC/B,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAgB,EAChB,GAAyB,EACzB,GAAwB,EACxB,MAAc;IAEd,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC3C,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,4DAA4D;YAC5D,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QAED,uEAAuE;QACvE,oDAAoD;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACnB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAA2B;YACtC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;SACpC,CAAC;QACF,mEAAmE;QACnE,oEAAoE;QACpE,iEAAiE;QACjE,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,EAAE,CAAC;QAC5E,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;YACxB,OAAO,CAAC,qBAAqB,CAAC,GAAG,4BAA4B,CAAC,YAAY,CAAC,CAAC;QAC9E,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3B,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE;gBAC1C,GAAG;gBACH,KAAK,EAAE,KAAK,CAAC,OAAO;aACrB,CAAC,CAAC;YACH,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE;YAClD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,QAAgB,EAChB,MAAc;IAEd,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YAChC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CACT,oEAAoE;oBAClE,0EAA0E;oBAC1E,0EAA0E;oBAC1E,sCAAsC,EACxC;oBACE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;oBAC3C,YAAY,EAAE,QAAQ;iBACvB,CACF,CAAC;gBACF,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/domain/channelapp/constants.d.ts

@@ -0,0 +1,45 @@
+/**
+ * ChannelApp domain constants — the byte-pinned wire copy shared with the
+ * Go server and the cloud edition. Every string here is asserted by the
+ * conformance suite or the cross-edition error contract; none is editable
+ * without an owner-ratified wire change.
+ */
+/**
+ * The sentinel the response path substitutes for secret values before they
+ * leave the server — Go channelapp RedactedMarker, equal to the
+ * platform-wide marker (environment/oauthapp here, the cloud edition's
+ * SecretEncryptionService.REDACTED_MARKER). A client sending it back on
+ * update means "keep the stored secret".
+ */
+export declare const REDACTED_MARKER = "***REDACTED***";
+/**
+ * InvalidArgument copy for client-supplied enc:v<N>: input (oss#395) — Go
+ * steps.go resolveSecret, byte-pinned. Unconditional: the prefix is
+ * server-reserved regardless of key state.
+ */
+export declare function plaintextRequiredMessage(fieldName: string): string;
+/**
+ * InvalidArgument copy for the redaction marker on create (nothing to
+ * preserve) — Go steps.go preserveExistingSecret, byte-pinned.
+ */
+export declare function markerOnCreateMessage(fieldName: string): string;
+/**
+ * InvalidArgument copy for the marker on an update whose stored field is
+ * empty — Go steps.go preserveExistingSecret, byte-pinned.
+ */
+export declare function noExistingSecretMessage(fieldName: string): string;
+/**
+ * InvalidArgument copy for a provider-arm change on update — Go steps.go
+ * validateProviderImmutableStep, byte-pinned. Deliberately a DIFFERENT
+ * code than agentchannel's provider rule (InvalidArgument here vs
+ * FailedPrecondition there) — a pinned cross-domain inconsistency both
+ * editions share; harmonization is a post-cutover wire change.
+ */
+export declare const PROVIDER_IMMUTABLE_MESSAGE = "the provider of a channel app cannot be changed";
+/**
+ * FailedPrecondition copy for deleting a ChannelApp still referenced by an
+ * AgentChannel — Go steps.go checkNoReferencingChannelsStep, byte-pinned.
+ * Names the referencing channel by metadata.name (not slug), as Go does.
+ */
+export declare function deleteBlockedByChannelMessage(org: string, slug: string, channelName: string): string;
+//# sourceMappingURL=constants.d.ts.map

package/dist/domain/channelapp/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/channelapp/constants.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,mBAAmB,CAAC;AAEhD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAKlE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,oDACY,CAAC;AAEpD;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,MAAM,CAER"}

package/dist/domain/channelapp/constants.js

@@ -0,0 +1,54 @@
+/**
+ * ChannelApp domain constants — the byte-pinned wire copy shared with the
+ * Go server and the cloud edition. Every string here is asserted by the
+ * conformance suite or the cross-edition error contract; none is editable
+ * without an owner-ratified wire change.
+ */
+/**
+ * The sentinel the response path substitutes for secret values before they
+ * leave the server — Go channelapp RedactedMarker, equal to the
+ * platform-wide marker (environment/oauthapp here, the cloud edition's
+ * SecretEncryptionService.REDACTED_MARKER). A client sending it back on
+ * update means "keep the stored secret".
+ */
+export const REDACTED_MARKER = "***REDACTED***";
+/**
+ * InvalidArgument copy for client-supplied enc:v<N>: input (oss#395) — Go
+ * steps.go resolveSecret, byte-pinned. Unconditional: the prefix is
+ * server-reserved regardless of key state.
+ */
+export function plaintextRequiredMessage(fieldName) {
+    return (`${fieldName} must be plaintext — values carrying the 'enc:' ` +
+        "encryption prefix are not accepted from clients");
+}
+/**
+ * InvalidArgument copy for the redaction marker on create (nothing to
+ * preserve) — Go steps.go preserveExistingSecret, byte-pinned.
+ */
+export function markerOnCreateMessage(fieldName) {
+    return `cannot use the redaction marker as ${fieldName} on create`;
+}
+/**
+ * InvalidArgument copy for the marker on an update whose stored field is
+ * empty — Go steps.go preserveExistingSecret, byte-pinned.
+ */
+export function noExistingSecretMessage(fieldName) {
+    return `cannot preserve ${fieldName}: no existing secret value found`;
+}
+/**
+ * InvalidArgument copy for a provider-arm change on update — Go steps.go
+ * validateProviderImmutableStep, byte-pinned. Deliberately a DIFFERENT
+ * code than agentchannel's provider rule (InvalidArgument here vs
+ * FailedPrecondition there) — a pinned cross-domain inconsistency both
+ * editions share; harmonization is a post-cutover wire change.
+ */
+export const PROVIDER_IMMUTABLE_MESSAGE = "the provider of a channel app cannot be changed";
+/**
+ * FailedPrecondition copy for deleting a ChannelApp still referenced by an
+ * AgentChannel — Go steps.go checkNoReferencingChannelsStep, byte-pinned.
+ * Names the referencing channel by metadata.name (not slug), as Go does.
+ */
+export function deleteBlockedByChannelMessage(org, slug, channelName) {
+    return `cannot delete ChannelApp '${org}/${slug}': referenced by agent channel '${channelName}'`;
+}
+//# sourceMappingURL=constants.js.map

package/dist/domain/channelapp/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/channelapp/constants.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,OAAO,CACL,GAAG,SAAS,kDAAkD;QAC9D,iDAAiD,CAClD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,OAAO,sCAAsC,SAAS,YAAY,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACvD,OAAO,mBAAmB,SAAS,kCAAkC,CAAC;AACxE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,iDAAiD,CAAC;AAEpD;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,GAAW,EACX,IAAY,EACZ,WAAmB;IAEnB,OAAO,6BAA6B,GAAG,IAAI,IAAI,mCAAmC,WAAW,GAAG,CAAC;AACnG,CAAC"}

package/dist/domain/channelapp/controller.d.ts

@@ -0,0 +1,41 @@
+/**
+ * ChannelApp controller — ports pkg/domain/channelapp/controller (command +
+ * query sides): the org-scoped holder of customer messaging-app credentials
+ * (Slack OAuth client + signing secret; WhatsApp app_secret / access_token /
+ * verify_token), referenced by AgentChannel spec.app_ref. The channel-domain
+ * sibling of OAuthApp: inline encrypted secrets (AES-256-GCM via the shared
+ * SecretService — the same instance Environment uses), ***REDACTED*** on
+ * every response surface, delete blocked while referenced.
+ *
+ * Pipeline per RPC mirrors the Go step chains character-for-character —
+ * notably create's ResolveSlug-before-ValidateProto order and the encrypt
+ * step's placement (before BuildNewState on create, after BuildUpdateState
+ * on update; see steps.ts). NOT search-indexed by design (the kind declares
+ * not_search_indexed — configuration reached through its parent surface,
+ * not a library artifact), so no index steps appear in any chain.
+ *
+ * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies, and
+ * Publish steps (single-user local posture); validation, secret handling,
+ * and the referential delete block are byte-compatible.
+ *
+ * Proven by channelapp.conformance.test.ts (CONFORMANCE_TARGET=local)
+ * and __tests__/channelapp.test.ts.
+ */
+import type { ConnectRouter } from "@connectrpc/connect";
+import type { Logger } from "../../boot/logger.js";
+import type { Authorizer } from "../../extensions/authorizer.js";
+import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
+import type { SecretService } from "../../encryption/encryption.js";
+import type { Store } from "../../store/interface.js";
+export interface ChannelAppControllerDeps {
+    readonly store: Store;
+    readonly logger: Logger;
+    /** The composed authorization seam — the Authorize step at position 1 of every chain calls it (O2, DD-007 §3). */
+    readonly authorizer: Authorizer;
+    /** The composed tuple-lifecycle driver — undefined = the shared steps no-op (C2). */
+    readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
+    readonly secretService: SecretService;
+}
+/** Registers both channelapp services on the router (routes stage). */
+export declare function registerChannelAppServices(router: ConnectRouter, deps: ChannelAppControllerDeps): void;
+//# sourceMappingURL=controller.d.ts.map

package/dist/domain/channelapp/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/channelapp/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAmBzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AACjG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAyCpE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAUtD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kHAAkH;IAClH,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,qFAAqF;IACrF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC5E,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;CACvC;AAED,uEAAuE;AACvE,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,wBAAwB,GAC7B,IAAI,CAYN"}

package/dist/domain/channelapp/controller.js

@@ -0,0 +1,237 @@
+import { create, fromBinary } from "@bufbuild/protobuf";
+import { ChannelAppSchema } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/api_pb";
+import { ChannelAppCommandController } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/command_pb";
+import { ChannelAppQueryController } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/query_pb";
+import { ChannelAppsSchema } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/io_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { apiResourceKindKey } from "../../pipeline/interceptors/apiresource.js";
+import { internalError } from "../../pipeline/errors.js";
+import { newPipeline } from "../../pipeline/pipeline.js";
+import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
+import { RequestContext } from "../../pipeline/request-context.js";
+import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
+import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
+import { newBuildUpdateStateStep } from "../../pipeline/steps/build-update-state.js";
+import { newCheckDuplicateStep } from "../../pipeline/steps/duplicate.js";
+import { RESOURCE_ID_KEY, newDeleteResourceStep, newLoadExistingForDeleteStep, } from "../../pipeline/steps/delete.js";
+import { compareCreatedAtDesc } from "../../pipeline/steps/helpers.js";
+import { EXISTING_RESOURCE_KEY, newLoadExistingStep, } from "../../pipeline/steps/load-existing.js";
+import { SHOULD_CREATE_KEY, newLoadForApplyStep, withResolvedApplyId, } from "../../pipeline/steps/load-for-apply.js";
+import { newLoadByReferenceStep } from "../../pipeline/steps/load-by-reference.js";
+import { TARGET_RESOURCE_KEY, newLoadTargetStep, } from "../../pipeline/steps/load-target.js";
+import { newCleanupIamPoliciesStep, newCreateAuthorizationTuplesStep, } from "../../pipeline/steps/authorization-tuples.js";
+import { newPersistStep } from "../../pipeline/steps/persist.js";
+import { newDestroySecretBackingStateStep } from "../../pipeline/steps/secret-cleanup.js";
+import { newResolveSlugStep } from "../../pipeline/steps/slug.js";
+import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
+import { newValidateVisibilityStep } from "../../pipeline/steps/validate-visibility.js";
+import { newCheckNoReferencingChannelsStep, newEncryptChannelAppSecretsForCreateStep, newEncryptChannelAppSecretsForUpdateStep, newValidateProviderImmutableStep, redactChannelApp, secretValuesOfChannelApp, } from "./steps.js";
+/** Registers both channelapp services on the router (routes stage). */
+export function registerChannelAppServices(router, deps) {
+    router.service(ChannelAppCommandController, {
+        apply: (app, ctx) => apply(deps, app, ctx),
+        create: (app, ctx) => createChannelApp(deps, app, ctx),
+        update: (app, ctx) => update(deps, app, ctx),
+        delete: (input, ctx) => deleteChannelApp(deps, input, ctx),
+    });
+    router.service(ChannelAppQueryController, {
+        get: (id, ctx) => get(deps, id, ctx),
+        getByReference: (ref, ctx) => getByReference(deps, ref, ctx),
+        listByOrg: (req, ctx) => listByOrg(deps, req, ctx),
+    });
+}
+function kindOf(ctx) {
+    return ctx.values.get(apiResourceKindKey);
+}
+/**
+ * Create — chain per Go buildCreatePipeline. ResolveSlug runs BEFORE
+ * ValidateProto (unique among the sharing/channel domains — Go's order,
+ * preserved); EncryptChannelAppSecrets runs before BuildNewState because
+ * BuildNewState clones state (the oauthapp ordering). The response is
+ * redacted; the store keeps ciphertext.
+ */
+async function createChannelApp(deps, app, ctx) {
+    const reqCtx = new RequestContext(ChannelAppSchema, app, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("channelapp-create", deps.logger)
+        .addStep(newAuthorizeStep(ChannelAppCommandController.method.create, deps.authorizer))
+        .addStep(newResolveSlugStep())
+        .addStep(newValidateProtoStep())
+        .addStep(newValidateVisibilityStep())
+        .addStep(newCheckDuplicateStep(deps.store))
+        .addStep(newEncryptChannelAppSecretsForCreateStep(deps.secretService, deps.logger))
+        .addStep(newBuildNewStateStep())
+        .addStep(newGuardReservedLabelsStep(deps.authorizer))
+        .addStep(newPersistStep(deps.store))
+        .addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle, deps.logger))
+        .build()
+        .execute(reqCtx);
+    redactChannelApp(reqCtx.newState);
+    return reqCtx.newState;
+}
+/**
+ * Update — chain per Go buildUpdatePipeline; EncryptChannelAppSecrets runs
+ * AFTER BuildUpdateState because BuildUpdateState replaces newState with
+ * the merged clone (the oauthapp ordering). The marker preserves the
+ * stored value PER FIELD — one request may rotate one secret while
+ * keeping the other.
+ */
+async function update(deps, app, ctx) {
+    const reqCtx = new RequestContext(ChannelAppSchema, app, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("channelapp-update", deps.logger)
+        .addStep(newAuthorizeStep(ChannelAppCommandController.method.update, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newResolveSlugStep())
+        .addStep(newLoadExistingStep(deps.store))
+        .addStep(newValidateProviderImmutableStep())
+        .addStep(newBuildUpdateStateStep())
+        .addStep(newGuardReservedLabelsStep(deps.authorizer))
+        .addStep(newEncryptChannelAppSecretsForUpdateStep(deps.secretService, deps.logger))
+        .addStep(newPersistStep(deps.store))
+        .build()
+        .execute(reqCtx);
+    redactChannelApp(reqCtx.newState);
+    return reqCtx.newState;
+}
+/**
+ * Apply — kubectl-style create-or-update (the OAuthApp apply shape): a
+ * minimal probe pipeline decides existence, then delegates to Create or
+ * Update with the ORIGINAL request message (Go delegates `app`, not the
+ * pipeline's clone — unlike agentshare/agentchannel, whose defaults live
+ * on the clone; channelapp's Update re-resolves the slug itself); the
+ * update arm carries the resolved id via withResolvedApplyId. Sending
+ * the marker for a secret field on an apply that resolves to update
+ * preserves the stored value; on an apply that resolves to create it is
+ * refused — there is nothing to preserve.
+ */
+async function apply(deps, app, ctx) {
+    const reqCtx = new RequestContext(ChannelAppSchema, app, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("channelapp-apply", deps.logger)
+        .addStep(newAuthorizeStep(ChannelAppCommandController.method.apply, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newResolveSlugStep())
+        .addStep(newLoadForApplyStep(deps.store))
+        .build()
+        .execute(reqCtx);
+    const shouldCreate = reqCtx.get(SHOULD_CREATE_KEY);
+    if (typeof shouldCreate !== "boolean") {
+        throw internalError(new Error("apply pipeline did not set shouldCreate flag"), "apply operation failed to determine create vs update");
+    }
+    return shouldCreate
+        ? createChannelApp(deps, app, ctx)
+        : update(deps, withResolvedApplyId(ChannelAppSchema, app, reqCtx), ctx);
+}
+/**
+ * Delete — blocked with FAILED_PRECONDITION while any AgentChannel
+ * references this app via spec.app_ref. The deleted ChannelApp is returned
+ * for audit purposes, redacted like every other response. The id is seeded
+ * manually because ApiResourceDeleteInput carries resource_id, not the
+ * `value` field ExtractResourceId expects (the oauthapp delete shape).
+ */
+async function deleteChannelApp(deps, input, ctx) {
+    const reqCtx = new RequestContext(ChannelAppCommandController.method.delete.input, input, callerIdentityOf(ctx), kindOf(ctx));
+    reqCtx.set(RESOURCE_ID_KEY, input.resourceId);
+    await newPipeline("channelapp-delete", deps.logger)
+        .addStep(newAuthorizeStep(ChannelAppCommandController.method.delete, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadExistingForDeleteStep(deps.store, ChannelAppSchema))
+        .addStep(newCheckNoReferencingChannelsStep(deps.store, deps.logger))
+        .addStep(newDeleteResourceStep(deps.store))
+        .addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle, deps.logger))
+        .addStep(newDestroySecretBackingStateStep(deps.secretService, deps.logger, secretValuesOfChannelApp))
+        .build()
+        .execute(reqCtx);
+    const deleted = reqCtx.get(EXISTING_RESOURCE_KEY);
+    if (deleted === undefined) {
+        throw internalError(new Error("deleted ChannelApp not found in context"), "deleted ChannelApp not found in context");
+    }
+    const app = deleted;
+    redactChannelApp(app);
+    return app;
+}
+/** Get — LoadTarget by id; the response is redacted. */
+async function get(deps, id, ctx) {
+    const reqCtx = new RequestContext(ChannelAppQueryController.method.get.input, id, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("channelapp-get", deps.logger)
+        .addStep(newAuthorizeStep(ChannelAppQueryController.method.get, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadTargetStep(deps.store, ChannelAppSchema))
+        .build()
+        .execute(reqCtx);
+    const app = reqCtx.get(TARGET_RESOURCE_KEY);
+    redactChannelApp(app);
+    return app;
+}
+/** GetByReference — org/slug lookup; the response is redacted. */
+async function getByReference(deps, ref, ctx) {
+    const reqCtx = new RequestContext(ChannelAppQueryController.method.getByReference.input, ref, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("channelapp-get-by-reference", deps.logger)
+        .addStep(newAuthorizeStep(ChannelAppQueryController.method.getByReference, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadByReferenceStep(deps.store, ChannelAppSchema))
+        .build()
+        .execute(reqCtx);
+    const app = reqCtx.get(TARGET_RESOURCE_KEY);
+    redactChannelApp(app);
+    return app;
+}
+const LIST_RESULT_KEY = "listResult";
+/**
+ * ListByOrg — all ChannelApps of an organization, newest-first, every
+ * entry redacted. No pagination — the set is small by nature (typically
+ * one app per provider per org), the OAuthApp listByOrg posture.
+ */
+async function listByOrg(deps, req, ctx) {
+    const reqCtx = new RequestContext(ChannelAppQueryController.method.listByOrg.input, req, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("channelapp-list-by-org", deps.logger)
+        .addStep(newAuthorizeStep(ChannelAppQueryController.method.listByOrg, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newListByOrgStep(deps.store, deps.logger))
+        .build()
+        .execute(reqCtx);
+    const result = reqCtx.get(LIST_RESULT_KEY);
+    if (result === undefined) {
+        throw internalError(new Error("ChannelApp list not found in context"), "ChannelApp list not found in context");
+    }
+    return result;
+}
+/**
+ * ListByOrg — Go list_by_org.go's domain step: full scan, malformed rows
+ * skipped with a warning, org equality filter, per-item redaction, sorted
+ * by spec-audit created_at descending (seconds then nanos; timestamped
+ * entries before untimestamped ones).
+ */
+function newListByOrgStep(store, logger) {
+    return {
+        name: "ListByOrg",
+        async execute(ctx) {
+            const org = ctx.input.org;
+            let rows;
+            try {
+                rows = await store.listResources(ApiResourceKind.channel_app);
+            }
+            catch (error) {
+                throw internalError(error, "failed to list ChannelApps");
+            }
+            const apps = [];
+            for (const bytes of rows) {
+                let app;
+                try {
+                    app = fromBinary(ChannelAppSchema, bytes);
+                }
+                catch {
+                    logger.warn("Failed to unmarshal ChannelApp, skipping");
+                    continue;
+                }
+                if ((app.metadata?.org ?? "") !== org) {
+                    continue;
+                }
+                redactChannelApp(app);
+                apps.push(app);
+            }
+            apps.sort((a, b) => compareCreatedAtDesc(a.status?.audit?.specAudit?.createdAt, b.status?.audit?.specAudit?.createdAt));
+            ctx.set(LIST_RESULT_KEY, create(ChannelAppsSchema, { entries: apps }));
+        },
+    };
+}
+//# sourceMappingURL=controller.js.map

package/dist/domain/channelapp/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/channelapp/controller.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yDAAyD,CAAC;AAE3F,OAAO,EAAE,2BAA2B,EAAE,MAAM,6DAA6D,CAAC;AAC1G,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,EAAE,iBAAiB,EAAE,MAAM,wDAAwD,CAAC;AAU3F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAMtH,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,gCAAgC,EAAE,MAAM,wCAAwC,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AAExF,OAAO,EACL,iCAAiC,EACjC,wCAAwC,EACxC,wCAAwC,EACxC,gCAAgC,EAChC,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AAYpB,uEAAuE;AACvE,MAAM,UAAU,0BAA0B,CACxC,MAAqB,EACrB,IAA8B;IAE9B,MAAM,CAAC,OAAO,CAAC,2BAA2B,EAAE;QAC1C,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC1C,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QACtD,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC5C,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KAC3D,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE;QACxC,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC5D,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;KACnD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,IAA8B,EAC9B,GAAe,EACf,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,gBAAgB,EAChB,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAA0B,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC;SACzE,OAAO,CACN,gBAAgB,CACd,2BAA2B,CAAC,MAAM,CAAC,MAAM,EACzC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,wCAAwC,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAC1E;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,MAAM,CACnB,IAA8B,EAC9B,GAAe,EACf,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,gBAAgB,EAChB,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAA0B,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC;SACzE,OAAO,CACN,gBAAgB,CACd,2BAA2B,CAAC,MAAM,CAAC,MAAM,EACzC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,OAAO,CAAC,gCAAgC,EAAE,CAAC;SAC3C,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CACN,wCAAwC,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAC1E;SACA,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,KAAK,CAClB,IAA8B,EAC9B,GAAe,EACf,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,gBAAgB,EAChB,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAA0B,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC;SACxE,OAAO,CACN,gBAAgB,CACd,2BAA2B,CAAC,MAAM,CAAC,KAAK,EACxC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,OAAO,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,8CAA8C,CAAC,EACzD,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,YAAY;QACjB,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAClC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB,CAAC,gBAAgB,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,IAA8B,EAC9B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,2BAA2B,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAC/C,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,WAAW,CACf,mBAAmB,EACnB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,2BAA2B,CAAC,MAAM,CAAC,MAAM,EACzC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;SACnE,OAAO,CAAC,iCAAiC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SACnE,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,OAAO,CACN,gCAAgC,CAG9B,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAC7D;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,yCAAyC,CAAC,EACpD,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,OAAqB,CAAC;IAClC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wDAAwD;AACxD,KAAK,UAAU,GAAG,CAChB,IAA8B,EAC9B,EAAiB,EACjB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,yBAAyB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAC1C,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,gBAAgB,EAChB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,yBAAyB,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CACxE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;SACxD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAe,CAAC;IAC1D,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kEAAkE;AAClE,KAAK,UAAU,cAAc,CAC3B,IAA8B,EAC9B,GAAyB,EACzB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,yBAAyB,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EACrD,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,6BAA6B,EAAE,IAAI,CAAC,MAAM,CAAC;SAC1C,OAAO,CACN,gBAAgB,CACd,yBAAyB,CAAC,MAAM,CAAC,cAAc,EAC/C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;SAC7D,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAe,CAAC;IAC1D,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC;;;;GAIG;AACH,KAAK,UAAU,SAAS,CACtB,IAA8B,EAC9B,GAA8B,EAC9B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,yBAAyB,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAChD,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,wBAAwB,EACxB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,yBAAyB,CAAC,MAAM,CAAC,SAAS,EAC1C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SAClD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,sCAAsC,CAAC,EACjD,sCAAsC,CACvC,CAAC;IACJ,CAAC;IACD,OAAO,MAAqB,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CACvB,KAAY,EACZ,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,KAAK,CAAC,OAAO,CACX,GAEC;YAED,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YAE1B,IAAI,IAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;YAChE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;YAC3D,CAAC;YAED,MAAM,IAAI,GAAiB,EAAE,CAAC;YAC9B,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;gBACzB,IAAI,GAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,GAAG,GAAG,UAAU,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBAC5C,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;oBACxD,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;oBACtC,SAAS;gBACX,CAAC;gBACD,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBACtB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACjB,oBAAoB,CAClB,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EACrC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CACtC,CACF,CAAC;YAEF,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,iBAAiB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC"}