@stigmer/server 3.14.0-dev.20260910084630

package/dist/domain/workflow/registry/model-registry-store.js

@@ -0,0 +1,196 @@
+import { DocumentModelCatalog } from "./document-catalog.js";
+/** Upstream refresh cadence (Go modelRegistryRefreshInterval, :34). */
+export const MODEL_REGISTRY_REFRESH_INTERVAL_MS = 60 * 60 * 1000;
+/** Per-fetch budget (Go fetch timeout, :35-39). */
+export const MODEL_REGISTRY_FETCH_TIMEOUT_MS = 30_000;
+/**
+ * Read cap on the upstream body (Go's 8<<20 limited reader). Go truncates
+ * the stream and lets the parse fail; here the size check rejects before
+ * parsing — same outcome (oversized document rejected, current kept).
+ */
+export const MODEL_REGISTRY_MAX_BYTES = 8 * 1024 * 1024;
+/** Hosted API path appended to the upstream origin (Go :20-32). */
+export const MODEL_REGISTRY_UPSTREAM_PATH = "/api/v1/public/model-registry";
+/**
+ * The registry pricing-variant key backing SERVICE_TIER_FAST (oss#357) —
+ * the one vocabulary shared by every consumer, defined beside the index it
+ * queries so the selectable key and the priced key can never drift.
+ */
+export const FAST_VARIANT_KEY = "fast";
+/**
+ * The registry capability key backing THINKING_MODE_ENABLED (oss#772) —
+ * defined beside the index it queries so the selectable key and the
+ * declared key can never drift.
+ */
+export const THINKING_CAPABILITY_KEY = "thinking";
+export class ModelRegistryStore {
+    currentCatalog;
+    refreshTimer;
+    failureLogged = false;
+    options;
+    constructor(options) {
+        // A broken bundled snapshot is a build defect, not a runtime condition:
+        // fail loud at construction rather than serving an empty registry
+        // (Go log.Fatal in Store()).
+        const catalog = DocumentModelCatalog.tryBuild(options.bundledDocument);
+        if (catalog === undefined) {
+            throw new Error("bundled model-registry snapshot is invalid or indexes no models");
+        }
+        this.currentCatalog = catalog;
+        this.options = options;
+    }
+    /** The served bytes; always complete and valid by construction. */
+    document() {
+        return this.currentCatalog.document();
+    }
+    /**
+     * Whether a model reference (canonical id or provider api id) is
+     * executable on the given harness.
+     */
+    isValidModel(harness, model) {
+        return this.currentCatalog.isValidModel(harness, model);
+    }
+    /** Whether the registry knows any models for a harness. */
+    hasHarness(harness) {
+        return this.currentCatalog.hasHarness(harness);
+    }
+    /**
+     * Whether the registry loaded at all — validation degrades to a no-op
+     * rather than rejecting everything when it did not.
+     */
+    hasAnyModels() {
+        return this.currentCatalog.hasAnyModels();
+    }
+    /**
+     * Whether a model reference is executable on AT LEAST ONE harness. The
+     * existence check for surfaces with no serving harness in this edition
+     * (agent channels): a pin no section knows is certainly a typo, while a
+     * pin valid anywhere may be right where the spec actually serves.
+     */
+    isValidModelOnAnyHarness(model) {
+        return this.currentCatalog.isValidModelOnAnyHarness(model);
+    }
+    /**
+     * The sorted, deduplicated canonical model ids across every harness
+     * section — the did-you-mean candidate pool for the any-harness
+     * existence check. Computed per call (refusal-path only).
+     */
+    canonicalModelsAcrossHarnesses() {
+        return this.currentCatalog.canonicalModelsAcrossHarnesses();
+    }
+    /**
+     * The sorted canonical model ids for a harness (deterministic
+     * did-you-mean suggestions — canonical ids are the documented form, so
+     * suggestions never surface provider api ids). Callers must not mutate.
+     */
+    canonicalModels(harness) {
+        return this.currentCatalog.canonicalModels(harness);
+    }
+    /**
+     * Whether a model reference prices the given variant key under ANY
+     * harness — the registry-backed capability check for
+     * ExecutionConfig.service_tier at execution create (oss#357), which is
+     * deliberately harness-free (it never resolves the session).
+     */
+    hasPricingVariant(model, variant) {
+        return this.currentCatalog.hasPricingVariant(model, variant);
+    }
+    /**
+     * Whether a model reference prices the given variant key under the given
+     * harness. The workflow validators use this form — the task config names
+     * its harness, so a fast variant priced only under another harness must
+     * not validate (it would execute as a silent no-op).
+     */
+    hasPricingVariantForHarness(harness, model, variant) {
+        return this.currentCatalog.hasPricingVariantForHarness(harness, model, variant);
+    }
+    /**
+     * The sorted canonical model ids that price the given variant key under
+     * any harness, for actionable refusal messages. Callers must not mutate.
+     */
+    canonicalModelsWithVariant(variant) {
+        return this.currentCatalog.canonicalModelsWithVariant(variant);
+    }
+    /**
+     * The sorted canonical model ids that price the given variant key under
+     * the given harness. Callers must not mutate.
+     */
+    canonicalModelsWithVariantForHarness(harness, variant) {
+        return this.currentCatalog.canonicalModelsWithVariantForHarness(harness, variant);
+    }
+    /**
+     * Whether a model reference declares the given capability key (e.g.
+     * "thinking") true under the given harness. Capability flags are
+     * harness-scoped facts (they describe what works through that serving
+     * path), so there is no any-harness form: THINKING_MODE_ENABLED validates
+     * against the cursor harness specifically — the only harness with a
+     * thinking translation in v1 (oss#772) — and native entries declaring the
+     * same capability stay unselectable until a native wire mapping exists.
+     */
+    hasCapabilityForHarness(harness, model, capability) {
+        return this.currentCatalog.hasCapabilityForHarness(harness, model, capability);
+    }
+    /**
+     * The sorted canonical model ids that declare the given capability key
+     * under the given harness, for actionable refusal messages.
+     */
+    canonicalModelsWithCapabilityForHarness(harness, capability) {
+        return this.currentCatalog.canonicalModelsWithCapabilityForHarness(harness, capability);
+    }
+    /** Immediate refresh, then hourly — Go's goroutine shape (:435-447). */
+    startRefresh() {
+        if (!this.options.refreshEnabled || this.refreshTimer !== undefined) {
+            return;
+        }
+        void this.refreshOnce();
+        this.refreshTimer = setInterval(() => {
+            void this.refreshOnce();
+        }, MODEL_REGISTRY_REFRESH_INTERVAL_MS);
+        this.refreshTimer.unref();
+    }
+    stopRefresh() {
+        if (this.refreshTimer !== undefined) {
+            clearInterval(this.refreshTimer);
+            this.refreshTimer = undefined;
+        }
+    }
+    /** Exposed for tests; production goes through startRefresh. */
+    async refreshOnce() {
+        const url = this.options.upstreamOrigin + MODEL_REGISTRY_UPSTREAM_PATH;
+        const fetchImpl = this.options.fetchImpl ?? fetch;
+        try {
+            const response = await fetchImpl(url, {
+                signal: AbortSignal.timeout(MODEL_REGISTRY_FETCH_TIMEOUT_MS),
+            });
+            if (!response.ok) {
+                throw new Error(`upstream answered ${response.status}`);
+            }
+            const body = await response.text();
+            if (Buffer.byteLength(body) > MODEL_REGISTRY_MAX_BYTES) {
+                throw new Error("upstream document exceeds the size cap");
+            }
+            const catalog = DocumentModelCatalog.tryBuild(body);
+            if (catalog === undefined) {
+                throw new Error("upstream document failed the sanity gate (no indexable models)");
+            }
+            // Document and indexes swap together — a reader never sees a
+            // document whose indexes describe a different registry.
+            this.currentCatalog = catalog;
+            this.failureLogged = false;
+        }
+        catch (error) {
+            const fields = {
+                url,
+                error: error instanceof Error ? error.message : String(error),
+            };
+            if (this.failureLogged) {
+                this.options.logger.debug("model-registry refresh failed; serving current document", fields);
+            }
+            else {
+                this.options.logger.warn("model-registry refresh failed; serving current document", fields);
+                this.failureLogged = true;
+            }
+        }
+    }
+}
+//# sourceMappingURL=model-registry-store.js.map

package/dist/domain/workflow/registry/model-registry-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-registry-store.js","sourceRoot":"","sources":["../../../../src/domain/workflow/registry/model-registry-store.ts"],"names":[],"mappings":"AAgCA,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAG7D,uEAAuE;AACvE,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjE,mDAAmD;AACnD,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC;AAEtD;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAExD,mEAAmE;AACnE,MAAM,CAAC,MAAM,4BAA4B,GAAG,+BAA+B,CAAC;AAE5E;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,UAAU,CAAC;AAYlD,MAAM,OAAO,kBAAkB;IACrB,cAAc,CAAuB;IACrC,YAAY,CAA6B;IACzC,aAAa,GAAG,KAAK,CAAC;IACb,OAAO,CAA4B;IAEpD,YAAY,OAAkC;QAC5C,wEAAwE;QACxE,kEAAkE;QAClE,6BAA6B;QAC7B,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACvE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;QAC9B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,mEAAmE;IACnE,QAAQ;QACN,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;IACxC,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,OAAe,EAAE,KAAa;QACzC,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,2DAA2D;IAC3D,UAAU,CAAC,OAAe;QACxB,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IAED;;;OAGG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,wBAAwB,CAAC,KAAa;QACpC,OAAO,IAAI,CAAC,cAAc,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;IAED;;;;OAIG;IACH,8BAA8B;QAC5B,OAAO,IAAI,CAAC,cAAc,CAAC,8BAA8B,EAAE,CAAC;IAC9D,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,OAAe;QAC7B,OAAO,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,KAAa,EAAE,OAAe;QAC9C,OAAO,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;OAKG;IACH,2BAA2B,CACzB,OAAe,EACf,KAAa,EACb,OAAe;QAEf,OAAO,IAAI,CAAC,cAAc,CAAC,2BAA2B,CACpD,OAAO,EACP,KAAK,EACL,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,0BAA0B,CAAC,OAAe;QACxC,OAAO,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC;IAED;;;OAGG;IACH,oCAAoC,CAClC,OAAe,EACf,OAAe;QAEf,OAAO,IAAI,CAAC,cAAc,CAAC,oCAAoC,CAC7D,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,uBAAuB,CACrB,OAAe,EACf,KAAa,EACb,UAAkB;QAElB,OAAO,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAChD,OAAO,EACP,KAAK,EACL,UAAU,CACX,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,uCAAuC,CACrC,OAAe,EACf,UAAkB;QAElB,OAAO,IAAI,CAAC,cAAc,CAAC,uCAAuC,CAChE,OAAO,EACP,UAAU,CACX,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,YAAY;QACV,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACpE,OAAO;QACT,CAAC;QACD,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;QACxB,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;YACnC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1B,CAAC,EAAE,kCAAkC,CAAC,CAAC;QACvC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,WAAW;QACT,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACpC,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACjC,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAChC,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,WAAW;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,GAAG,4BAA4B,CAAC;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;gBACpC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,+BAA+B,CAAC;aAC7D,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,wBAAwB,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;YACJ,CAAC;YACD,6DAA6D;YAC7D,wDAAwD;YACxD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;YAC9B,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG;gBACb,GAAG;gBACH,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC;YACF,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACvB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CACvB,yDAAyD,EACzD,MAAM,CACP,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CACtB,yDAAyD,EACzD,MAAM,CACP,CAAC;gBACF,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/domain/workflow/registry/pin-validation.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Model-pin existence validation and did-you-mean machinery — ports
+ * pkg/domain/workflow/registry/pin_validation.go. Lives beside the store it
+ * queries (the registry is the shared validation authority): workflow model
+ * validation consumes it now; the schedule (#22) and agentchannel (#12)
+ * pin-existence checks and agentexecution's tier/thinking validators (#17)
+ * consume the same functions later, so every pin error suggests
+ * identically.
+ *
+ * One deliberate signature delta from Go: Go's UnknownModelPinRefusal reads
+ * the process-global registry.Store(); this edition has no singletons (the
+ * composition root owns the store), so the store is the first parameter.
+ */
+import { Harness } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
+import type { ModelCatalogProvider } from "./model-catalog-provider.js";
+/**
+ * Harness section names as the registry document spells them. Exported so
+ * every consumer (workflow validation, schedule/channel pin validation)
+ * shares one vocabulary instead of re-declaring string literals.
+ */
+export declare const HARNESS_NAME_CURSOR = "cursor";
+export declare const HARNESS_NAME_NATIVE = "native";
+/**
+ * Maps the session harness enum to its registry section name. Unset
+ * resolves to native — this edition's platform default harness (the DD-015
+ * edition-honest posture: each edition judges pins against the harness ITS
+ * runs would actually use; the cloud edition resolves its own configured
+ * default).
+ */
+export declare function harnessName(h: Harness): string;
+/**
+ * This edition's one statement of the write-time model-pin EXISTENCE rule
+ * (oss#774): a pinned model_name that is not in the model registry is
+ * refused at apply/update, with a did-you-mean. Before this rule,
+ * model_name was the one profile knob that failed OPEN — a typo'd pin
+ * passed every write boundary and the cursor runner silently fell back to
+ * "default" (Auto), billing at Auto rates.
+ *
+ * `harness` names the registry section the pin's runs would use
+ * (harnessName of the surface's effective harness). Pass "" for surfaces
+ * with NO serving harness in this edition (agent channels — this edition
+ * stores their spec without a serving runtime): the pin then validates
+ * against EVERY harness section and is refused only when no section knows
+ * it, which catches the typo class without falsely refusing a model that
+ * is valid where the spec will actually serve.
+ *
+ * Deliberately WRITE-TIME ONLY — unlike the pin-PRESENCE rule, this is NOT
+ * evaluated at the run starter's fire-time backstop: upstream registry
+ * drift must never break a previously-valid schedule at its 3 AM fire.
+ *
+ * Degrades to a no-op ("") when the registry is empty or lacks the harness
+ * section — a build without a usable registry must not refuse every write
+ * (the hasAnyModels posture workflow validation established).
+ *
+ * Returns the refusal copy, or "" when the pin is valid (or unverifiable).
+ */
+export declare function unknownModelPinRefusal(store: ModelCatalogProvider, fieldPath: string, harness: string, model: string): string;
+/**
+ * Returns up to three model ids from the candidate list sorted by
+ * Levenshtein distance to the target, closest first (name-ascending on
+ * ties). Only candidates within the edit-distance cap are included — a
+ * far-off typo gets no misleading suggestion. Shared by workflow model
+ * validation and the pin-existence rule so every did-you-mean behaves
+ * identically.
+ */
+export declare function suggestSimilarModels(target: string, candidates: string[]): string[];
+//# sourceMappingURL=pin-validation.d.ts.map

package/dist/domain/workflow/registry/pin-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin-validation.d.ts","sourceRoot":"","sources":["../../../../src/domain/workflow/registry/pin-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,uDAAuD,CAAC;AAEhF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAExE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAC5C,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAK5C;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,CAK9C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,oBAAoB,EAC3B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,MAAM,CAoCR;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAAE,GACnB,MAAM,EAAE,CAmBV"}

package/dist/domain/workflow/registry/pin-validation.js

@@ -0,0 +1,151 @@
+/**
+ * Model-pin existence validation and did-you-mean machinery — ports
+ * pkg/domain/workflow/registry/pin_validation.go. Lives beside the store it
+ * queries (the registry is the shared validation authority): workflow model
+ * validation consumes it now; the schedule (#22) and agentchannel (#12)
+ * pin-existence checks and agentexecution's tier/thinking validators (#17)
+ * consume the same functions later, so every pin error suggests
+ * identically.
+ *
+ * One deliberate signature delta from Go: Go's UnknownModelPinRefusal reads
+ * the process-global registry.Store(); this edition has no singletons (the
+ * composition root owns the store), so the store is the first parameter.
+ */
+import { Harness } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
+/**
+ * Harness section names as the registry document spells them. Exported so
+ * every consumer (workflow validation, schedule/channel pin validation)
+ * shares one vocabulary instead of re-declaring string literals.
+ */
+export const HARNESS_NAME_CURSOR = "cursor";
+export const HARNESS_NAME_NATIVE = "native";
+const MAX_MODEL_SUGGESTIONS = 3;
+const MAX_MODEL_EDIT_DISTANCE = 5;
+/**
+ * Maps the session harness enum to its registry section name. Unset
+ * resolves to native — this edition's platform default harness (the DD-015
+ * edition-honest posture: each edition judges pins against the harness ITS
+ * runs would actually use; the cloud edition resolves its own configured
+ * default).
+ */
+export function harnessName(h) {
+    if (h === Harness.CURSOR) {
+        return HARNESS_NAME_CURSOR;
+    }
+    return HARNESS_NAME_NATIVE;
+}
+/**
+ * This edition's one statement of the write-time model-pin EXISTENCE rule
+ * (oss#774): a pinned model_name that is not in the model registry is
+ * refused at apply/update, with a did-you-mean. Before this rule,
+ * model_name was the one profile knob that failed OPEN — a typo'd pin
+ * passed every write boundary and the cursor runner silently fell back to
+ * "default" (Auto), billing at Auto rates.
+ *
+ * `harness` names the registry section the pin's runs would use
+ * (harnessName of the surface's effective harness). Pass "" for surfaces
+ * with NO serving harness in this edition (agent channels — this edition
+ * stores their spec without a serving runtime): the pin then validates
+ * against EVERY harness section and is refused only when no section knows
+ * it, which catches the typo class without falsely refusing a model that
+ * is valid where the spec will actually serve.
+ *
+ * Deliberately WRITE-TIME ONLY — unlike the pin-PRESENCE rule, this is NOT
+ * evaluated at the run starter's fire-time backstop: upstream registry
+ * drift must never break a previously-valid schedule at its 3 AM fire.
+ *
+ * Degrades to a no-op ("") when the registry is empty or lacks the harness
+ * section — a build without a usable registry must not refuse every write
+ * (the hasAnyModels posture workflow validation established).
+ *
+ * Returns the refusal copy, or "" when the pin is valid (or unverifiable).
+ */
+export function unknownModelPinRefusal(store, fieldPath, harness, model) {
+    model = model.trim();
+    if (model === "") {
+        return "";
+    }
+    if (!store.hasAnyModels()) {
+        return "";
+    }
+    let candidates;
+    if (harness === "") {
+        if (store.isValidModelOnAnyHarness(model)) {
+            return "";
+        }
+        candidates = store.canonicalModelsAcrossHarnesses();
+    }
+    else {
+        if (!store.hasHarness(harness)) {
+            return "";
+        }
+        if (store.isValidModel(harness, model)) {
+            return "";
+        }
+        candidates = store.canonicalModels(harness);
+    }
+    const scope = harness === "" ? "any harness" : `${harness} harness`;
+    let msg = `${fieldPath}: model '${model}' is not in the model registry (${scope})`;
+    const suggestions = suggestSimilarModels(model, candidates);
+    if (suggestions.length > 0) {
+        const quoted = suggestions.map((s) => `'${s}'`);
+        msg += `; did you mean ${quoted.join(", ")}?`;
+    }
+    return msg;
+}
+/**
+ * Returns up to three model ids from the candidate list sorted by
+ * Levenshtein distance to the target, closest first (name-ascending on
+ * ties). Only candidates within the edit-distance cap are included — a
+ * far-off typo gets no misleading suggestion. Shared by workflow model
+ * validation and the pin-existence rule so every did-you-mean behaves
+ * identically.
+ */
+export function suggestSimilarModels(target, candidates) {
+    const targetLower = target.toLowerCase();
+    const matches = [];
+    for (const name of candidates) {
+        const d = suggestionEditDistance(targetLower, name.toLowerCase());
+        if (d <= MAX_MODEL_EDIT_DISTANCE) {
+            matches.push({ name, dist: d });
+        }
+    }
+    matches.sort((a, b) => {
+        if (a.dist !== b.dist) {
+            return a.dist - b.dist;
+        }
+        return a.name < b.name ? -1 : a.name > b.name ? 1 : 0;
+    });
+    return matches.slice(0, MAX_MODEL_SUGGESTIONS).map((m) => m.name);
+}
+/**
+ * The standard two-row Levenshtein distance. Go compares bytes; this
+ * compares UTF-16 code units — identical for the ASCII model ids the
+ * registry carries.
+ */
+function suggestionEditDistance(a, b) {
+    if (a === b) {
+        return 0;
+    }
+    if (a.length === 0) {
+        return b.length;
+    }
+    if (b.length === 0) {
+        return a.length;
+    }
+    let prev = new Array(b.length + 1);
+    let curr = new Array(b.length + 1);
+    for (let j = 0; j <= b.length; j++) {
+        prev[j] = j;
+    }
+    for (let i = 1; i <= a.length; i++) {
+        curr[0] = i;
+        for (let j = 1; j <= b.length; j++) {
+            const cost = a.charCodeAt(i - 1) === b.charCodeAt(j - 1) ? 0 : 1;
+            curr[j] = Math.min(prev[j] + 1, curr[j - 1] + 1, prev[j - 1] + cost);
+        }
+        [prev, curr] = [curr, prev];
+    }
+    return prev[b.length];
+}
+//# sourceMappingURL=pin-validation.js.map

package/dist/domain/workflow/registry/pin-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin-validation.js","sourceRoot":"","sources":["../../../../src/domain/workflow/registry/pin-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,uDAAuD,CAAC;AAIhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAC5C,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAE5C,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAChC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAElC;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,CAAU;IACpC,IAAI,CAAC,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAA2B,EAC3B,SAAiB,EACjB,OAAe,EACf,KAAa;IAEb,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,UAAoB,CAAC;IACzB,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,IAAI,KAAK,CAAC,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,UAAU,GAAG,KAAK,CAAC,8BAA8B,EAAE,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,UAAU,GAAG,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,UAAU,CAAC;IACpE,IAAI,GAAG,GAAG,GAAG,SAAS,YAAY,KAAK,mCAAmC,KAAK,GAAG,CAAC;IAEnF,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC5D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,GAAG,IAAI,kBAAkB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAChD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,UAAoB;IAEpB,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,OAAO,GAA0C,EAAE,CAAC;IAE1D,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,sBAAsB,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,uBAAuB,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YACtB,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACzB,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,CAAS,EAAE,CAAS;IAClD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,CAAC,CAAC,MAAM,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,CAAC,CAAC,MAAM,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,GAAa,IAAI,KAAK,CAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrD,IAAI,IAAI,GAAa,IAAI,KAAK,CAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACvE,CAAC;QACD,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAE,CAAC;AACzB,CAAC"}

package/dist/domain/workflow/search-extractor.d.ts

@@ -0,0 +1,3 @@
+import type { SearchableExtractor } from "../../query/search/extractor.js";
+export declare const workflowSearchExtractor: SearchableExtractor;
+//# sourceMappingURL=search-extractor.d.ts.map

package/dist/domain/workflow/search-extractor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-extractor.d.ts","sourceRoot":"","sources":["../../../src/domain/workflow/search-extractor.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAE3E,eAAO,MAAM,uBAAuB,EAAE,mBA2CrC,CAAC"}

package/dist/domain/workflow/search-extractor.js

@@ -0,0 +1,44 @@
+import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import { buildSearchResult } from "../../query/search/extractor.js";
+export const workflowSearchExtractor = {
+    kind: ApiResourceKind.workflow,
+    schema: WorkflowSchema,
+    getSearchSummary(resource) {
+        // Go WorkflowExtractor.GetSearchSummary: spec.description.
+        const workflow = resource;
+        return workflow.spec?.description ?? "";
+    },
+    toSearchResult(resource, score) {
+        const workflow = resource;
+        return buildSearchResult({
+            kind: ApiResourceKind.workflow,
+            metadata: workflow.metadata,
+            summary: workflow.spec?.description ?? "",
+            score,
+            createdAt: workflow.status?.audit?.specAudit?.createdAt,
+            updatedAt: workflow.status?.audit?.specAudit?.updatedAt,
+        });
+    },
+    getSearchIndexEntry(resource) {
+        const workflow = resource;
+        const metadata = workflow.metadata;
+        if (metadata === undefined) {
+            return undefined;
+        }
+        return {
+            name: metadata.name,
+            // Go WorkflowExtractor.GetSearchSummary: spec.description.
+            description: workflow.spec?.description ?? "",
+            // Tags join space-separated — the index entry carries one tags
+            // string (Go extractor.JoinTags).
+            tags: metadata.tags.join(" "),
+            org: metadata.org,
+            // The enum NAME string, exactly Go's visibility.String().
+            visibility: ApiResourceVisibility[metadata.visibility] ?? "",
+            createdAt: Number(workflow.status?.audit?.specAudit?.createdAt?.seconds ?? 0n),
+        };
+    },
+};
+//# sourceMappingURL=search-extractor.js.map

package/dist/domain/workflow/search-extractor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-extractor.js","sourceRoot":"","sources":["../../../src/domain/workflow/search-extractor.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AAEvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAI/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAGpE,MAAM,CAAC,MAAM,uBAAuB,GAAwB;IAC1D,IAAI,EAAE,eAAe,CAAC,QAAQ;IAC9B,MAAM,EAAE,cAAc;IAEtB,gBAAgB,CAAC,QAAiB;QAChC,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,QAA+B,CAAC;QACjD,OAAO,QAAQ,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED,cAAc,CAAC,QAAiB,EAAE,KAAa;QAC7C,MAAM,QAAQ,GAAG,QAA+B,CAAC;QACjD,OAAO,iBAAiB,CAAC;YACvB,IAAI,EAAE,eAAe,CAAC,QAAQ;YAC9B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE;YACzC,KAAK;YACL,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;YACvD,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;SACxD,CAAC,CAAC;IACL,CAAC;IAED,mBAAmB,CAAC,QAAiB;QACnC,MAAM,QAAQ,GAAG,QAA+B,CAAC;QACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO;YACL,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,2DAA2D;YAC3D,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE;YAC7C,+DAA+D;YAC/D,kCAAkC;YAClC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7B,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,0DAA0D;YAC1D,UAAU,EAAE,qBAAqB,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE;YAC5D,SAAS,EAAE,MAAM,CACf,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,IAAI,EAAE,CAC5D;SACF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/domain/workflow/steps.d.ts

@@ -0,0 +1,72 @@
+import type { DescMessage } from "@bufbuild/protobuf";
+import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
+import type { WorkflowInstance } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/api_pb";
+import type { Logger } from "../../boot/logger.js";
+import type { PipelineStep } from "../../pipeline/pipeline.js";
+import type { CallerIdentity } from "../../extensions/identity.js";
+import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
+import type { Store } from "../../store/interface.js";
+import type { InProcessValidator } from "./validation/validator.js";
+type WorkflowDesc = typeof WorkflowSchema;
+export declare const SERVERLESS_VALIDATION_KEY = "serverless_validation";
+export declare const VERSION_HASH_KEY = "version_hash";
+export declare const VERSION_CHANGED_KEY = "version_changed";
+export declare const DEFAULT_INSTANCE_ID_KEY = "default_instance_id";
+export interface WorkflowInstanceCreator {
+    /**
+     * Creates AS THE ORIGINAL CALLER (C2 Stage 3, ruling R5 — the Java
+     * createAsCaller posture): the propagated identity gives the default
+     * instance real owner attribution under an enforcing Authorizer.
+     */
+    createAsCaller(instance: WorkflowInstance, caller: CallerIdentity): Promise<WorkflowInstance>;
+}
+/**
+ * Lazy provider for the workflow↔workflowinstance true cycle — resolved at
+ * call time, never at construction (the ratified DI story, D2 §2).
+ */
+export type WorkflowInstanceCreatorProvider = () => WorkflowInstanceCreator;
+export declare function newValidateWorkflowSpecStep(validator: InProcessValidator, logger: Logger): PipelineStep<WorkflowDesc>;
+export declare function newPopulateServerlessValidationStep(logger: Logger): PipelineStep<WorkflowDesc>;
+export declare function newPopulateServerlessValidationStepForUpdate(logger: Logger): PipelineStep<WorkflowDesc>;
+/** SHA-256 of the generated CNCF YAML, stashed under VERSION_HASH_KEY. */
+export declare function newComputeVersionHashStep(logger: Logger): PipelineStep<WorkflowDesc>;
+/**
+ * Compares the new hash against status.version_hash so downstream steps
+ * (audit, metadata) skip work when the spec hasn't actually changed
+ * (idempotent applies).
+ */
+export declare function newCheckVersionChangedStep(logger: Logger): PipelineStep<WorkflowDesc>;
+/**
+ * Writes the computed hash into status.version_hash and the
+ * metadata.version id/previous_version_id chain. On create: always. On
+ * update: only when VERSION_CHANGED_KEY is true.
+ */
+export declare function newPopulateVersionHashStep(isCreate: boolean): PipelineStep<WorkflowDesc>;
+/**
+ * Archives the workflow to the resource_audit table (version_steps.go
+ * saveVersionAuditStep). On create: always (the first version). On update:
+ * only when the version changed (idempotent).
+ *
+ * Rollback applies repoint, never duplicate (oss#341): when the caller
+ * re-applies a prior version's spec, the canonical rendering reproduces
+ * that version's hash, so the content is already archived. Versions are
+ * content-addressed identities — one content, one history entry — so the
+ * head simply repoints to the existing row (the hash chain was already set
+ * by PopulateVersionHash) and only the tag assignment still runs.
+ * Inserting again would give the tag single-holder UPDATE two targets. An
+ * unexpected lookup failure degrades to archiving anyway: a possible
+ * duplicate row beats a failed apply.
+ *
+ * On archive failure the version hash is stripped from the workflow so a
+ * set hash always resolves to an audit entry (the revert invariant);
+ * persistOnRevert re-persists when this step runs AFTER the final persist
+ * (the create path archives last so default_instance_id is captured; the
+ * update path has a Persist step following that flushes the revert).
+ */
+export declare function newSaveVersionAuditStep(store: Store, logger: Logger, isCreate: boolean, persistOnRevert: boolean): PipelineStep<WorkflowDesc>;
+export declare function truncateHash(hash: string): string;
+export declare function newCreateDefaultInstanceStep(creatorProvider: WorkflowInstanceCreatorProvider, logger: Logger): PipelineStep<WorkflowDesc>;
+export declare function newUpdateWorkflowStatusWithDefaultInstanceStep(store: Store, logger: Logger, authorizationLifecycle?: ResourceAuthorizationLifecycle): PipelineStep<WorkflowDesc>;
+export declare function newCascadeDeleteWorkflowInstancesStep<Desc extends DescMessage>(store: Store, logger: Logger): PipelineStep<Desc>;
+export {};
+//# sourceMappingURL=steps.d.ts.map

package/dist/domain/workflow/steps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/domain/workflow/steps.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AAOvF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+DAA+D,CAAC;AAGtG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAMnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAKjG,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,KAAK,YAAY,GAAG,OAAO,cAAc,CAAC;AAI1C,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AACjE,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAC/C,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AACrD,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAS7D,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,cAAc,CACZ,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,MAAM,+BAA+B,GAAG,MAAM,uBAAuB,CAAC;AAoB5E,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,kBAAkB,EAC7B,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,YAAY,CAAC,CAyE5B;AAYD,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,YAAY,CAAC,CAqB5B;AAED,wBAAgB,4CAA4C,CAC1D,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,YAAY,CAAC,CAyB5B;AAQD,0EAA0E;AAC1E,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,YAAY,CAAC,CAsB5B;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,YAAY,CAAC,CA0B5B;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,GAChB,YAAY,CAAC,YAAY,CAAC,CA0B5B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,OAAO,EACjB,eAAe,EAAE,OAAO,GACvB,YAAY,CAAC,YAAY,CAAC,CA0H5B;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAUD,wBAAgB,4BAA4B,CAC1C,eAAe,EAAE,+BAA+B,EAChD,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,YAAY,CAAC,CAmD5B;AAED,wBAAgB,8CAA8C,CAC5D,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,sBAAsB,CAAC,EAAE,8BAA8B,GACtD,YAAY,CAAC,YAAY,CAAC,CAmD5B;AA6BD,wBAAgB,qCAAqC,CAAC,IAAI,SAAS,WAAW,EAC5E,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CAiEpB"}