@stigmer/server 3.14.0-dev.20260910084630

package/dist/domain/memory/controller.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Memory controller — ports pkg/domain/memory/controller (command + query
+ * sides): agent-proposed, user-confirmed facts the platform remembers
+ * about a person (decisions DD-004/DD-005/DD-006 of the
+ * preferences-and-memory project, stigmer/stigmer#293).
+ *
+ * A memory is system-generated: an agent proposes it (Phase 2 Stage 3's
+ * remember tool calls the create RPC), and it becomes recallable only
+ * after the person it is about confirms it. There is deliberately no
+ * apply RPC — nobody authors a memory manifest. The kind belongs to the
+ * Session/AgentExecution/Artifact family: records the platform creates
+ * that users inspect and manage.
+ *
+ * Field ownership (DD-004, provenance revised by the Stage 3 decision,
+ * owner-ratified 2026-08-22): spec.content is the subject's after capture
+ * (editable via update); spec.subject_identity_account_id is
+ * server-derived at create and immutable forever; spec.provenance is
+ * capture-path-supplied at create (the remember tool threads it; direct
+ * creates leave it empty; tool_call_id force-cleared in v1) and immutable
+ * forever after — attribution that can be edited is not attribution;
+ * status.lifecycle_state is written ONLY by create (initial proposed) and
+ * the confirm/reject commands. Updates graft metadata+spec+status.audit
+ * onto the live row and never touch the lifecycle — consent must not be
+ * rewritable through a spec edit.
+ *
+ * Consent posture (DD-005 D3): confirm/reject enforced at the control
+ * plane is the ENTIRE consent mechanism. Client-side approval flows are
+ * never trusted with retention — three shipped HITL bypasses are the
+ * recorded evidence (see DD-005).
+ *
+ * Caps (DD-006 D5): content length via protovalidate (500 chars); a
+ * 100-records-per-subject-per-org ceiling across ALL lifecycle states
+ * (proposed clutter counts, which pressures honest rejection), enforced
+ * at create with a visible FAILED_PRECONDITION — never silent eviction.
+ *
+ * Authorization posture (OSS): this edition is single-user and local, so
+ * handlers perform no authorization — a documented no-op, not a silent
+ * divergence. The subject is the empty-string sentinel (the OAuth grant
+ * store convention); enablement is the org flag alone (the user scope
+ * collapses — DD-002 D1). The cloud edition derives the subject from the
+ * calling credential, enforces the strict first-party-human gate, checks
+ * both memory_enabled flags, and gates every RPC through FGA (subject-only
+ * can_view/can_edit/can_delete).
+ *
+ * Memory is deliberately NOT search-indexed (privacy — subject-only
+ * content must not surface in org-visible search): no search-extractor,
+ * no IndexSearch/DeleteSearchIndex steps anywhere in this domain.
+ *
+ * Pipeline per RPC mirrors the Go step chains character-for-character.
+ * Proven by memory.conformance.test.ts (CONFORMANCE_TARGET=local) and
+ * __tests__/memory.test.ts.
+ */
+import type { ConnectRouter } from "@connectrpc/connect";
+import type { Logger } from "../../boot/logger.js";
+import type { Authorizer } from "../../extensions/authorizer.js";
+import type { RunnerCredentialProvider } from "../../runnerauth/runner-credential-provider.js";
+import type { ListReadScope } from "../../extensions/list-read-scope.js";
+import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
+import type { Store } from "../../store/interface.js";
+export interface MemoryControllerDeps {
+    readonly store: Store;
+    readonly logger: Logger;
+    /** The composed authorization seam — the Authorize step at position 1 of every chain calls it (O2, DD-007 §3). */
+    readonly authorizer: Authorizer;
+    /** The composed tuple-lifecycle driver — undefined = the shared steps no-op (C2). */
+    readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
+    /** The composed list read scope — list narrows through it; undefined = the OSS full scan (20260830.01). */
+    readonly listReadScope: ListReadScope | undefined;
+    /**
+     * The composed runner-credential provider — GuardMemoryCapture consults
+     * its authorizeMemoryCapture capability for the runner-credential
+     * eligibility arm (parity entry 20260830.05). The OSS default defines
+     * no capabilities, so the gate's behavior is unchanged with it.
+     */
+    readonly runnerCredentialProvider: RunnerCredentialProvider;
+}
+/** Registers both memory services on the router (routes stage). */
+export declare function registerMemoryServices(router: ConnectRouter, deps: MemoryControllerDeps): void;
+//# sourceMappingURL=controller.d.ts.map

package/dist/domain/memory/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/memory/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAgBzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAC/F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAiCjG,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAiBtD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kHAAkH;IAClH,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,qFAAqF;IACrF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC5E,2GAA2G;IAC3G,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;IAClD;;;;;OAKG;IACH,QAAQ,CAAC,wBAAwB,EAAE,wBAAwB,CAAC;CAC7D;AAED,mEAAmE;AACnE,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,oBAAoB,GACzB,IAAI,CAYN"}

package/dist/domain/memory/controller.js

@@ -0,0 +1,250 @@
+import { MemoryCommandController } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/command_pb";
+import { MemoryQueryController } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/query_pb";
+import { MemorySchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { MemoryLifecycleState } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/enum_pb";
+import { MemoryIdSchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/io_pb";
+import { apiResourceKindKey } from "../../pipeline/interceptors/apiresource.js";
+import { internalError } from "../../pipeline/errors.js";
+import { newPipeline } from "../../pipeline/pipeline.js";
+import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
+import { RequestContext } from "../../pipeline/request-context.js";
+import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import { newGuardMemoryCaptureStep } from "../../pipeline/steps/guard-memory-capture.js";
+import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
+import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
+import { newBuildUpdateStateStep } from "../../pipeline/steps/build-update-state.js";
+import { newCheckDuplicateStep } from "../../pipeline/steps/duplicate.js";
+import { newDeleteResourceStep, newExtractResourceIdStep, newLoadExistingForDeleteStep, } from "../../pipeline/steps/delete.js";
+import { EXISTING_RESOURCE_KEY, newLoadExistingStep, } from "../../pipeline/steps/load-existing.js";
+import { TARGET_RESOURCE_KEY, newLoadTargetStep, } from "../../pipeline/steps/load-target.js";
+import { newCleanupIamPoliciesStep, newCreateAuthorizationTuplesStep, } from "../../pipeline/steps/authorization-tuples.js";
+import { newPersistStep } from "../../pipeline/steps/persist.js";
+import { newResolveSlugStep } from "../../pipeline/steps/slug.js";
+import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
+import { newValidateVisibilityStep } from "../../pipeline/steps/validate-visibility.js";
+import { MEMORY_CONFIRM_REJECTED_MESSAGE, MEMORY_REJECT_CONFIRMED_MESSAGE, } from "./constants.js";
+import { LIST_RESULT_KEY, newCheckMemoryCapStep, newCheckMemoryEnablementStep, newInitializeMemoryLifecycleStep, newListMemoriesByOrgStep, newPersistMemoryUpdateStep, newResolveMemoryDefaultsStep, newTransitionMemoryLifecycleStep, newValidateMemoryUpdateStep, } from "./steps.js";
+/** Registers both memory services on the router (routes stage). */
+export function registerMemoryServices(router, deps) {
+    router.service(MemoryCommandController, {
+        create: (memory, ctx) => createMemory(deps, memory, ctx),
+        update: (memory, ctx) => update(deps, memory, ctx),
+        delete: (id, ctx) => deleteMemory(deps, id, ctx),
+        confirm: (id, ctx) => confirm(deps, id, ctx),
+        reject: (id, ctx) => reject(deps, id, ctx),
+    });
+    router.service(MemoryQueryController, {
+        get: (id, ctx) => get(deps, id, ctx),
+        list: (req, ctx) => list(deps, req, ctx),
+    });
+}
+function kindOf(ctx) {
+    return ctx.values.get(apiResourceKindKey);
+}
+/**
+ * Create — chain per Go buildCreatePipeline: a new memory in the proposed
+ * state (DD-005 D2). ResolveMemoryDefaults mints the id BEFORE
+ * BuildNewState so an unnamed record can default its name from its own
+ * identity; InitializeMemoryLifecycle runs AFTER BuildNewState so the
+ * status wipe cannot undo it.
+ *
+ * No search-index step: memory is not_search_indexed by design (privacy —
+ * content is subject-only and must not surface in org-visible search).
+ *
+ * Note: Unlike Stigmer Cloud, OSS excludes the strict
+ * first-party-human-operator gate and the caller's own memory_enabled
+ * check (no per-request user identity — the user scope collapses, DD-006
+ * D1) and creates no FGA tuples.
+ */
+async function createMemory(deps, memory, ctx) {
+    const reqCtx = new RequestContext(MemorySchema, memory, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("memory-create", deps.logger)
+        .addStep(newAuthorizeStep(MemoryCommandController.method.create, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newGuardMemoryCaptureStep(deps.runnerCredentialProvider))
+        .addStep(newValidateVisibilityStep())
+        .addStep(newResolveMemoryDefaultsStep())
+        .addStep(newCheckMemoryEnablementStep(deps.store))
+        .addStep(newCheckMemoryCapStep(deps.store))
+        .addStep(newResolveSlugStep())
+        .addStep(newCheckDuplicateStep(deps.store))
+        .addStep(newBuildNewStateStep())
+        .addStep(newGuardReservedLabelsStep(deps.authorizer))
+        .addStep(newInitializeMemoryLifecycleStep())
+        .addStep(newPersistStep(deps.store))
+        .addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle, deps.logger))
+        .build()
+        .execute(reqCtx);
+    return reqCtx.newState;
+}
+/**
+ * Update — chain per Go buildUpdatePipeline: edits the fact text only
+ * (DD-004: the content is the subject's; everything else on the record is
+ * not up for editing). The spec is replaced wholesale (declarative
+ * semantics), but only content may actually change: subject and
+ * provenance are immutable (validate step), and the consent lifecycle is
+ * protected by MECHANISM — PersistMemoryUpdate grafts
+ * metadata+spec+status.audit onto the LIVE row inside one atomic
+ * read-modify-write, so status.lifecycle_state stays exactly as its
+ * owners (create, confirm, reject) last wrote it, even against a
+ * concurrent confirm landing between this pipeline's load and persist.
+ *
+ * Note: Unlike Stigmer Cloud, OSS excludes the authorization step (cloud
+ * requires can_edit on the memory — FGA subject-only).
+ */
+async function update(deps, memory, ctx) {
+    const reqCtx = new RequestContext(MemorySchema, memory, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("memory-update", deps.logger)
+        .addStep(newAuthorizeStep(MemoryCommandController.method.update, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadExistingStep(deps.store))
+        .addStep(newValidateMemoryUpdateStep())
+        .addStep(newBuildUpdateStateStep())
+        .addStep(newGuardReservedLabelsStep(deps.authorizer))
+        .addStep(newPersistMemoryUpdateStep(deps.store))
+        .build()
+        .execute(reqCtx);
+    return reqCtx.newState;
+}
+/**
+ * Confirm — Go confirm.go: moves a proposed memory to confirmed — the
+ * consent act (DD-005 D3). From the next eligible execution on, the fact
+ * is recalled as background context.
+ *
+ * Confirming an already-confirmed memory is an idempotent no-op.
+ * Confirming a rejected memory is refused with FAILED_PRECONDITION: the
+ * rejection stands as an auditable decision — delete the record and let
+ * the agent propose again.
+ *
+ * This RPC and reject are the ONLY writers of status.lifecycle_state.
+ * Consent is enforced here, at the control plane — never delegated to
+ * client-side approval mechanisms (DD-005 D3 records the three shipped
+ * HITL bypasses that make any client-side gate untrustworthy for
+ * retention).
+ */
+async function confirm(deps, memoryId, ctx) {
+    return runTransition(deps, memoryId, ctx, "memory-confirm", MemoryCommandController.method.confirm, MemoryLifecycleState.lifecycle_state_confirmed, MEMORY_CONFIRM_REJECTED_MESSAGE);
+}
+/**
+ * Reject — Go reject.go: moves a proposed memory to rejected. A rejected
+ * memory is never recalled; the record is kept rather than deleted so the
+ * decision is auditable and an identical re-proposal is visible as such
+ * (DD-005).
+ *
+ * Rejecting an already-rejected memory is an idempotent no-op. Rejecting
+ * a confirmed memory is refused with FAILED_PRECONDITION: deleting a
+ * confirmed memory IS its revocation (DD-006) — a reject that pretended
+ * to revoke would leave a misleading audit record.
+ *
+ * Rejection is deliberately one click on every surface — expensive review
+ * teaches users to ignore the proposal queue (DD-005 D4).
+ */
+async function reject(deps, memoryId, ctx) {
+    return runTransition(deps, memoryId, ctx, "memory-reject", MemoryCommandController.method.reject, MemoryLifecycleState.lifecycle_state_rejected, MEMORY_REJECT_CONFIRMED_MESSAGE);
+}
+/**
+ * The shared confirm/reject pipeline — Go buildTransitionPipeline +
+ * runTransition: one contract with opposite verdicts (DD-005 D3),
+ * answering with the post-image row.
+ *
+ * Note: Unlike Stigmer Cloud, OSS excludes the authorization step (cloud
+ * requires can_edit on the memory — FGA subject-only, loading before
+ * authorizing so a missing memory answers NOT_FOUND, #224).
+ */
+async function runTransition(deps, memoryId, ctx, name, method, target, blockedMessage) {
+    const reqCtx = new RequestContext(MemoryIdSchema, memoryId, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline(name, deps.logger)
+        .addStep(newAuthorizeStep(method, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newExtractResourceIdStep())
+        .addStep(newLoadExistingForDeleteStep(deps.store, MemorySchema))
+        .addStep(newTransitionMemoryLifecycleStep(deps.store, target, blockedMessage))
+        .build()
+        .execute(reqCtx);
+    const transitioned = reqCtx.get(EXISTING_RESOURCE_KEY);
+    if (transitioned === undefined) {
+        throw internalError(new Error("transitioned memory not found in context"), "transitioned memory not found in context");
+    }
+    return transitioned;
+}
+/**
+ * Delete — Go delete.go: deletes a memory permanently, in ANY lifecycle
+ * state — the any-state guarantee is load-bearing for the trust story:
+ * "delete this one" must never be refused on lifecycle grounds (DD-004).
+ * Deleting a confirmed memory is how consent is revoked; past executions
+ * keep their immutable recalled_memories snapshots (DD-006 D6).
+ *
+ * No search-index cleanup: memory is not_search_indexed.
+ *
+ * Note: Unlike Stigmer Cloud, OSS excludes the authorization step (cloud
+ * requires can_delete on the memory — FGA subject-only).
+ *
+ * The deleted memory is returned for audit trail purposes (gRPC
+ * convention).
+ */
+async function deleteMemory(deps, memoryId, ctx) {
+    const reqCtx = new RequestContext(MemoryIdSchema, memoryId, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("memory-delete", deps.logger)
+        .addStep(newAuthorizeStep(MemoryCommandController.method.delete, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newExtractResourceIdStep())
+        .addStep(newLoadExistingForDeleteStep(deps.store, MemorySchema))
+        .addStep(newDeleteResourceStep(deps.store))
+        .addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle, deps.logger))
+        .build()
+        .execute(reqCtx);
+    const deleted = reqCtx.get(EXISTING_RESOURCE_KEY);
+    if (deleted === undefined) {
+        throw internalError(new Error("deleted memory not found in context"), "deleted memory not found in context");
+    }
+    return deleted;
+}
+/**
+ * Get — chain per Go buildGetPipeline (ExtractResourceId → LoadTarget).
+ *
+ * Note: Unlike Stigmer Cloud, OSS excludes the authorization step (cloud
+ * requires can_view — FGA subject-only: only the person a memory is about
+ * can read it).
+ */
+async function get(deps, memoryId, ctx) {
+    const reqCtx = new RequestContext(MemoryIdSchema, memoryId, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("memory-get", deps.logger)
+        .addStep(newAuthorizeStep(MemoryQueryController.method.get, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newExtractResourceIdStep())
+        .addStep(newLoadTargetStep(deps.store, MemorySchema))
+        .build()
+        .execute(reqCtx);
+    const target = reqCtx.get(TARGET_RESOURCE_KEY);
+    if (target === undefined) {
+        throw internalError(new Error("target memory not found in context"), "target memory not found in context");
+    }
+    return target;
+}
+/**
+ * List — Go list.go: memories in an organization, newest first. Ordering
+ * is chronological only; grouping pending proposals first is the
+ * console's presentation concern (DD-005 D4), deliberately not an RPC
+ * parameter at the kind's dozens-of-records scale.
+ *
+ * Note: Unlike Stigmer Cloud, OSS excludes:
+ *   - Authorization filtering (single user — every record is the
+ *     caller's; cloud filters to can_view via FGA, which resolves to the
+ *     subject)
+ *   - Pagination (returns all matching results)
+ */
+async function list(deps, req, ctx) {
+    const reqCtx = new RequestContext(MemoryQueryController.method.list.input, req, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("memory-list", deps.logger)
+        .addStep(newAuthorizeStep(MemoryQueryController.method.list, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newListMemoriesByOrgStep(deps.store, deps.listReadScope))
+        .build()
+        .execute(reqCtx);
+    const result = reqCtx.get(LIST_RESULT_KEY);
+    if (result === undefined) {
+        throw internalError(new Error("memory list not found in context"), "memory list not found in context");
+    }
+    return result;
+}
+//# sourceMappingURL=controller.js.map

package/dist/domain/memory/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/memory/controller.ts"],"names":[],"mappings":"AAuDA,OAAO,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AAClG,OAAO,EAAE,qBAAqB,EAAE,MAAM,uDAAuD,CAAC;AAC9F,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AAEnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AAapF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AAExF,OAAO,EACL,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,4BAA4B,EAC5B,gCAAgC,EAChC,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,YAAY,CAAC;AAoBpB,mEAAmE;AACnE,MAAM,UAAU,sBAAsB,CACpC,MAAqB,EACrB,IAA0B;IAE1B,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE;QACtC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC;QACxD,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC;QAClD,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QAChD,OAAO,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QAC5C,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;KAC3C,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE;QACpC,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,YAAY,CACzB,IAA0B,EAC1B,MAAc,EACd,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,YAAY,EACZ,MAAM,EACN,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAsB,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC;SACjE,OAAO,CACN,gBAAgB,CAAC,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CACzE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;SACjE,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,4BAA4B,EAAE,CAAC;SACvC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACjD,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,gCAAgC,EAAE,CAAC;SAC3C,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,MAAM,CACnB,IAA0B,EAC1B,MAAc,EACd,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,YAAY,EACZ,MAAM,EACN,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAsB,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC;SACjE,OAAO,CACN,gBAAgB,CAAC,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CACzE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,OAAO,CAAC,2BAA2B,EAAE,CAAC;SACtC,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC/C,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,OAAO,CACpB,IAA0B,EAC1B,QAAkB,EAClB,GAAmB;IAEnB,OAAO,aAAa,CAClB,IAAI,EACJ,QAAQ,EACR,GAAG,EACH,gBAAgB,EAChB,uBAAuB,CAAC,MAAM,CAAC,OAAO,EACtC,oBAAoB,CAAC,yBAAyB,EAC9C,+BAA+B,CAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,MAAM,CACnB,IAA0B,EAC1B,QAAkB,EAClB,GAAmB;IAEnB,OAAO,aAAa,CAClB,IAAI,EACJ,QAAQ,EACR,GAAG,EACH,eAAe,EACf,uBAAuB,CAAC,MAAM,CAAC,MAAM,EACrC,oBAAoB,CAAC,wBAAwB,EAC7C,+BAA+B,CAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,aAAa,CAC1B,IAA0B,EAC1B,QAAkB,EAClB,GAAmB,EACnB,IAAY,EACZ,MAAkB,EAClB,MAA4B,EAC5B,cAAsB;IAEtB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,cAAc,EACd,QAAQ,EACR,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAwB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;SACxD,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,wBAAwB,EAAE,CAAC;SACnC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;SAC/D,OAAO,CACN,gCAAgC,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC,CACrE;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACvD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,0CAA0C,CAAC,EACrD,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IACD,OAAO,YAAsB,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,YAAY,CACzB,IAA0B,EAC1B,QAAkB,EAClB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,cAAc,EACd,QAAQ,EACR,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAwB,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC;SACnE,OAAO,CACN,gBAAgB,CAAC,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CACzE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,wBAAwB,EAAE,CAAC;SACnC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;SAC/D,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,qCAAqC,CAAC,EAChD,qCAAqC,CACtC,CAAC;IACJ,CAAC;IACD,OAAO,OAAiB,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,GAAG,CAChB,IAA0B,EAC1B,QAAkB,EAClB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,cAAc,EACd,QAAQ,EACR,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAwB,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC;SAChE,OAAO,CACN,gBAAgB,CAAC,qBAAqB,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CACpE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,wBAAwB,EAAE,CAAC;SACnC,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;SACpD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,oCAAoC,CAAC,EAC/C,oCAAoC,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,MAAgB,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,IAAI,CACjB,IAA0B,EAC1B,GAAwB,EACxB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EACvC,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,aAAa,EACb,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,qBAAqB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CACrE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;SACjE,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,kCAAkC,CAAC,EAC7C,kCAAkC,CACnC,CAAC;IACJ,CAAC;IACD,OAAO,MAAoB,CAAC;AAC9B,CAAC"}

package/dist/domain/memory/steps.d.ts

@@ -0,0 +1,161 @@
+import { MemorySchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { MemoryLifecycleState } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/enum_pb";
+import type { MemoryIdSchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/io_pb";
+import type { ListMemoriesRequestSchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/io_pb";
+import type { PipelineStep } from "../../pipeline/pipeline.js";
+import type { ListReadScope } from "../../extensions/list-read-scope.js";
+import type { Store } from "../../store/interface.js";
+/** Context key for the list result — Go listResultKey. */
+export declare const LIST_RESULT_KEY = "listResult";
+/**
+ * ResolveMemoryDefaults — Go resolveMemoryDefaultsStep: prepares a memory
+ * for creation — the server claiming every field it owns, before anything
+ * persists:
+ *
+ *  1. Requires metadata.org — memory records are org-scoped (DD-004), so
+ *     the org can never be inferred.
+ *  2. Mints metadata.id here (not in BuildNewState) when absent, so an
+ *     unnamed record can default its name/slug from its own identity:
+ *     memories are id-addressed records (the remember tool sends content
+ *     only), and the platform's slug machinery requires a name. A
+ *     client-supplied name still wins — the default only fills absence.
+ *  3. Overwrites spec.subject_identity_account_id with the empty-string
+ *     sentinel — the OSS single-user subject (the OAuth grant store
+ *     convention). Server-derived, never client-supplied (DD-005 D2):
+ *     the cloud edition writes the caller's identity account here.
+ *  4. Stores spec.provenance as supplied (Stage 3 provenance decision,
+ *     owner-ratified 2026-08-22): the capture path — the remember tool
+ *     via the runner-synthesized attachment — threads the agent/session/
+ *     execution triple, and in OSS single-user local mode every caller
+ *     IS the trusted local operator, so supplied attribution is stored
+ *     rather than cleared. A direct create simply supplies none and the
+ *     field stays empty. tool_call_id is force-cleared: MCP cannot carry
+ *     the harness's tool-call identity in v1, so a supplied value could
+ *     only be an invention. The cloud edition is stricter — it accepts
+ *     the triple only from a session-sandbox credential and overrides
+ *     session/org with the token's own claims. Post-create the field is
+ *     immutable either way (ValidateMemoryUpdate): attribution that can
+ *     be edited is not attribution.
+ *  5. When GuardMemoryCapture admitted a session-scoped capture
+ *     credential (the composed provider's authorizeMemoryCapture
+ *     capability — parity entry 20260830.05), the token's PROVED claims
+ *     replace both edition defaults: the subject is the credential's
+ *     human ("the sub IS the human subject the session belongs to",
+ *     Java MemoryCreateHandler) and provenance.session_id is overridden
+ *     with the token's own session claim (server-proved beats
+ *     runner-reported). Absent the handoff, the OSS arms above apply
+ *     unchanged.
+ */
+export declare function newResolveMemoryDefaultsStep(): PipelineStep<typeof MemorySchema>;
+/**
+ * CheckMemoryEnablement — Go checkMemoryEnablementStep: enforces the
+ * org's memory_enabled switch at write time, FAIL-CLOSED (DD-005 D2): a
+ * write that cannot verify enablement refuses. This deliberately inverts
+ * the recall compose step's best-effort posture — an execution must start
+ * without its optional preferences, but a memory must never be stored
+ * without verified consent to store it.
+ *
+ * The runner-side remember-tool attachment is convenience, never
+ * authorization: "the label is not authorization; the server refuses"
+ * (the conversation-attachment doctrine, applied verbatim).
+ *
+ * OSS checks the org flag alone — the user scope collapses in single-user
+ * local mode (DD-006 D1). The cloud edition additionally requires the
+ * caller's own memory_enabled and the strict first-party-human gate.
+ *
+ * Reads the Organization row directly from the store, matching Go — no
+ * cross-domain client.
+ */
+export declare function newCheckMemoryEnablementStep(store: Store): PipelineStep<typeof MemorySchema>;
+/**
+ * CheckMemoryCap — Go checkMemoryCapStep: enforces the
+ * per-subject-per-org record ceiling at create (DD-006 D5). Counted
+ * across all lifecycle states. A full-scan count matches the store's
+ * local/OSS posture at the kind's dozens-of-records scale (the schedule
+ * list precedent); the cloud edition counts through an indexed
+ * repository query.
+ */
+export declare function newCheckMemoryCapStep(store: Store): PipelineStep<typeof MemorySchema>;
+/**
+ * InitializeMemoryLifecycle — Go initializeMemoryLifecycleStep: stamps
+ * the initial consent state after BuildNewState wiped client-provided
+ * status: every memory starts proposed (DD-005 D2) — nothing is
+ * recallable until the subject confirms. Runs after BuildNewState so the
+ * wipe cannot undo it and the audit block it set is preserved.
+ */
+export declare function newInitializeMemoryLifecycleStep(): PipelineStep<typeof MemorySchema>;
+/**
+ * ValidateMemoryUpdate — Go validateMemoryUpdateStep: enforces the
+ * memory's immutable identity on update (the Schedule agent_ref pattern):
+ *
+ *   - spec.subject_identity_account_id must not change: an editable
+ *     subject would re-aim the record at another person, silently
+ *     defeating the subject-only visibility model.
+ *   - spec.provenance must not change, byte for byte: provenance is
+ *     attribution, displayed beside the fact everywhere — attribution
+ *     that can be edited is not attribution (DD-004).
+ *
+ * Update replaces the spec wholesale (declarative semantics), so callers
+ * carry the loaded values — the generated toMemoryUpdateInput mapper does
+ * this by construction. metadata.slug/org immutability needs no step
+ * here: the generic BuildUpdateState preserves both. The lifecycle state
+ * is protected by MECHANISM, not validation: PersistMemoryUpdate grafts
+ * only metadata+spec+status.audit onto the live row.
+ *
+ * Runs after LoadExisting so the existing state is available.
+ */
+export declare function newValidateMemoryUpdateStep(): PipelineStep<typeof MemorySchema>;
+/**
+ * PersistMemoryUpdate — Go persistMemoryUpdateStep (update.go): persists
+ * an update as a graft of exactly what the request path owns —
+ * apiVersion/kind/metadata/spec plus the audit bump BuildUpdateState
+ * stamped — onto the LIVE row, inside one store.updateResource closure.
+ * NOT the generic Persist: memory status has other writers
+ * (confirm/reject), and a full-row save of the load-time snapshot could
+ * silently revert a consent decision made between this pipeline's load
+ * and its persist. The schedule domain's persistScheduleUpdateStep is the
+ * direct template (DD-015 D-C shape).
+ *
+ * The graft never resurrects a concurrently deleted row: updateResource
+ * answers not-found, relayed as NOT_FOUND — the delete won, honestly.
+ */
+export declare function newPersistMemoryUpdateStep(store: Store): PipelineStep<typeof MemorySchema>;
+/**
+ * TransitionMemoryLifecycle — Go transitionMemoryLifecycleStep: moves a
+ * memory's consent lifecycle to a target decided state in ONE
+ * store.updateResource closure on the freshly-read row — confirm and
+ * reject share this step because they are one contract with opposite
+ * verdicts (DD-005 D3).
+ *
+ * Transition matrix (see MemoryLifecycleState's doc):
+ *   - proposed (or unspecified, defensively) → target: written, with
+ *     state_changed_at and a StatusAudit bump.
+ *   - already the target → idempotent success, no write, no audit bump
+ *     (Go aborts the write by returning a sentinel error from the
+ *     closure; here the sentinel throw rolls the transaction back — the
+ *     same no-write property).
+ *   - the OPPOSITE decided state → FAILED_PRECONDITION with the
+ *     cross-edition copy: decisions do not flip — deletion is the way out
+ *     of confirmed (revocation) and out of rejected (making room for a
+ *     fresh proposal).
+ *
+ * The atomic closure is adopted from schedule's clearSchedulePauseStep:
+ * memory has no concurrent status writer yet in Stage 1, but Stage 2's
+ * recall reads and any future writer get the discipline for free, and a
+ * concurrent delete is already answered honestly (NOT_FOUND — the delete
+ * won).
+ *
+ * Answers with the post-image row: EXISTING_RESOURCE_KEY is set to the
+ * live row on both the transitioned and idempotent paths.
+ */
+export declare function newTransitionMemoryLifecycleStep(store: Store, target: MemoryLifecycleState, blockedMessage: string): PipelineStep<typeof MemoryIdSchema>;
+/**
+ * ListMemoriesByOrg — Go listMemoriesByOrgStep (list.go): loads all
+ * memories and filters by org, sorted by created_at descending (newest
+ * first) — the schedule list posture. Ordering is chronological only;
+ * grouping pending proposals first is the console's presentation concern
+ * (DD-005 D4), deliberately not an RPC parameter at the kind's
+ * dozens-of-records scale.
+ */
+export declare function newListMemoriesByOrgStep(store: Store, listReadScope: ListReadScope | undefined): PipelineStep<typeof ListMemoriesRequestSchema>;
+//# sourceMappingURL=steps.d.ts.map

package/dist/domain/memory/steps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/domain/memory/steps.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AAEnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAC5F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACzF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAapG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAWzE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAStD,0DAA0D;AAC1D,eAAO,MAAM,eAAe,eAAe,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,4BAA4B,IAAI,YAAY,CAC1D,OAAO,YAAY,CACpB,CAsDA;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,KAAK,GACX,YAAY,CAAC,OAAO,YAAY,CAAC,CA4BnC;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,KAAK,GACX,YAAY,CAAC,OAAO,YAAY,CAAC,CAmCnC;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,IAAI,YAAY,CAC9D,OAAO,YAAY,CACpB,CAaA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,2BAA2B,IAAI,YAAY,CACzD,OAAO,YAAY,CACpB,CAkCA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,KAAK,GACX,YAAY,CAAC,OAAO,YAAY,CAAC,CAyCnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,oBAAoB,EAC5B,cAAc,EAAE,MAAM,GACrB,YAAY,CAAC,OAAO,cAAc,CAAC,CA0ErC;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,KAAK,EACZ,aAAa,EAAE,aAAa,GAAG,SAAS,GACvC,YAAY,CAAC,OAAO,yBAAyB,CAAC,CAwDhD"}