@stigmer/server 3.20.0 → 3.22.0

package/dist/domain/workflowinstance/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/workflowinstance/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAwBzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAwDjG,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAQtD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAE/D,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kHAAkH;IAClH,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,qFAAqF;IACrF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC5E;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,EAAE,4BAA4B,CAAC;IAC5D,oHAAoH;IACpH,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;CACnD;AAED,6EAA6E;AAC7E,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,8BAA8B,GACnC,IAAI,CAeN"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/workflowinstance/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAwBzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AA4DjG,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAStD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAE/D,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kHAAkH;IAClH,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,qFAAqF;IACrF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC5E;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,EAAE,4BAA4B,CAAC;IAC5D,oHAAoH;IACpH,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;CACnD;AAED,6EAA6E;AAC7E,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,8BAA8B,GACnC,IAAI,CAeN"}

package/dist/domain/workflowinstance/controller.js

@@ -12,6 +12,7 @@ import { newPipeline } from "../../pipeline/pipeline.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import { RequestContext } from "../../pipeline/request-context.js";
 import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import { loadedTargetAsMethod, newAuthorizeResolvedTargetStep, } from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
 import { newAuthorizeVisibilityTransitionStep, newGuardPublicVisibilityStep, } from "../../pipeline/steps/visibility-gates.js";
 import { newBuildNewStateStep, setAuditFieldsForUpdate, } from "../../pipeline/steps/defaults.js";
@@ -30,7 +31,7 @@ import { newResolveSlugStep } from "../../pipeline/steps/slug.js";
 import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
 import { newValidateVisibilityStep, newValidateVisibilityUpdateStep, } from "../../pipeline/steps/validate-visibility.js";
 import { workflowInstanceSearchExtractor } from "./search-extractor.js";
-import { newLoadParentWorkflowStep, newRejectDefaultWorkflowInstanceVisibilityUpdateStep, newValidateInstanceUpdateStep, newValidateSameOrgBusinessRuleStep, } from "./steps.js";
+import { newLoadParentWorkflowStep, newRejectDefaultWorkflowInstanceVisibilityUpdateStep, newValidateInstanceUpdateStep, newValidateSameOrgBusinessRuleStep, resolveWorkflowInstanceCreateTargets, } from "./steps.js";
 /** Registers both workflowinstance services on the router (routes stage). */
 export function registerWorkflowInstanceServices(router, deps) {
     router.service(WorkflowInstanceCommandController, {
@@ -62,6 +63,9 @@ async function createInstance(deps, instance, ctx) {
         .addStep(newValidateVisibilityStep())
         .addStep(newResolveSlugStep())
         .addStep(newLoadParentWorkflowStep(deps.parentWorkflowLoader, deps.logger))
+        // Before the same-org rule, whose refusal names the parent's organization
+        // (steps.ts, resolveWorkflowInstanceCreateTargets).
+        .addStep(newAuthorizeResolvedTargetStep(deps.authorizer, resolveWorkflowInstanceCreateTargets))
         .addStep(newValidateSameOrgBusinessRuleStep(deps.logger))
         .addStep(newCheckDuplicateStep(deps.store))
         .addStep(newBuildNewStateStep())
@@ -306,6 +310,7 @@ async function getByReference(deps, ref, ctx) {
         .addStep(newAuthorizeStep(WorkflowInstanceQueryController.method.getByReference, deps.authorizer))
         .addStep(newValidateProtoStep())
         .addStep(newLoadByReferenceStep(deps.store, WorkflowInstanceSchema))
+        .addStep(newAuthorizeResolvedTargetStep(deps.authorizer, loadedTargetAsMethod(WorkflowInstanceQueryController.method.get)))
         .build()
         .execute(reqCtx);
     return reqCtx.get(TARGET_RESOURCE_KEY);

package/dist/domain/workflowinstance/controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/workflowinstance/controller.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AAEvG,OAAO,EAAE,iCAAiC,EAAE,MAAM,mEAAmE,CAAC;AACtH,OAAO,EAAE,+BAA+B,EAAE,MAAM,iEAAiE,CAAC;AAKlH,OAAO,EAAE,0BAA0B,EAAE,MAAM,gEAAgE,CAAC;AAC5G,OAAO,EAAE,0BAA0B,EAAE,MAAM,8DAA8D,CAAC;AAK1G,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAStH,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EACL,oCAAoC,EACpC,4BAA4B,GAC7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,mCAAmC,EACnC,6BAA6B,GAC9B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EACL,yBAAyB,EACzB,+BAA+B,GAChC,MAAM,6CAA6C,CAAC;AAErD,OAAO,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EACL,yBAAyB,EACzB,oDAAoD,EACpD,6BAA6B,EAC7B,kCAAkC,GACnC,MAAM,YAAY,CAAC;AAmBpB,6EAA6E;AAC7E,MAAM,UAAU,gCAAgC,CAC9C,MAAqB,EACrB,IAAoC;IAEpC,MAAM,CAAC,OAAO,CAAC,iCAAiC,EAAE;QAChD,KAAK,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC;QACpD,MAAM,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC;QAC9D,MAAM,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC;QACtD,gBAAgB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACpE,yBAAyB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxC,yBAAyB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC7C,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;KACnD,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,+BAA+B,EAAE;QAC9C,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC5D,aAAa,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;KAC3D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,2DAA2D;AAC3D,KAAK,UAAU,cAAc,CAC3B,IAAoC,EACpC,QAA0B,EAC1B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,sBAAsB,EACtB,QAAQ,EACR,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,0BAA0B,EAC1B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,iCAAiC,CAAC,MAAM,CAAC,MAAM,EAC/C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SAC1E,OAAO,CAAC,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;SACxD,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACtD,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,0BAA0B,EAAE,CAAC;SACrC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,OAAO,CACN,kBAAkB,CAChB,IAAI,CAAC,KAAK,EACV,+BAA+B,EAC/B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,MAAM,CACnB,IAAoC,EACpC,QAA0B,EAC1B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,sBAAsB,EACtB,QAAQ,EACR,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,0BAA0B,EAC1B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,iCAAiC,CAAC,MAAM,CAAC,MAAM,EAC/C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,OAAO,CAAC,6BAA6B,EAAE,CAAC;SACxC,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,0BAA0B,EAAE,CAAC;SACrC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,kBAAkB,CAChB,IAAI,CAAC,KAAK,EACV,+BAA+B,EAC/B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,KAAK,CAClB,IAAoC,EACpC,QAA0B,EAC1B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,sBAAsB,EACtB,QAAQ,EACR,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,yBAAyB,EACzB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,iCAAiC,CAAC,MAAM,CAAC,KAAK,EAC9C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,OAAO,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,8CAA8C,CAAC,EACzD,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,YAAY;QACjB,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC;QACrC,CAAC,CAAC,MAAM,CACJ,IAAI,EACJ,mBAAmB,CAAC,sBAAsB,EAAE,QAAQ,EAAE,MAAM,CAAC,EAC7D,GAAG,CACJ,CAAC;AACR,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAC3B,IAAoC,EACpC,UAA8B,EAC9B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,iCAAiC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EACrD,UAAU,EACV,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,0BAA0B,EAAE,IAAI,CAAC,MAAM,CAAC;SACvC,OAAO,CACN,gBAAgB,CACd,iCAAiC,CAAC,MAAM,CAAC,MAAM,EAC/C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,wBAAwB,EAAE,CAAC;SACnC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;SACzE,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SAC1D,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,gDAAgD,CAAC,EAC3D,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,OAAO,OAA2B,CAAC;AACrC,CAAC;AAED,8EAA8E;AAC9E,yEAAyE;AACzE,sEAAsE;AACtE,yEAAyE;AACzE,sBAAsB;AACtB,8EAA8E;AAE9E,MAAM,8BAA8B,GAAG,0BAA0B,CAAC;AAKlE,KAAK,UAAU,gBAAgB,CAC7B,IAAoC,EACpC,KAA4B,EAC5B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,iCAAiC,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAC/D,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,qCAAqC,EACrC,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,iCAAiC,CAAC,MAAM,CAAC,gBAAgB,EACzD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CACN,mBAAmB,CACjB,IAAI,CAAC,KAAK,EACV,8BAA8B,EAC9B,iCAAiC,EACjC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAC1B,CACF;SACA,OAAO,CACN,mCAAmC,CAAC,8BAA8B,CAAC,CACpE;SACA,OAAO,CACN,oDAAoD,CAClD,IAAI,CAAC,KAAK,EACV,8BAA8B,CAC/B,CACF;SACA,OAAO,CAAC,+BAA+B,EAAE,CAAC;SAC1C,OAAO,CACN,oCAAoC,CAClC,8BAA8B,EAC9B,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,4BAA4B,EAAE,CAAC;SACvC,OAAO,CACN,sBAAsB,CACpB,IAAI,CAAC,KAAK,EACV,8BAA8B,EAC9B,oCAAoC,CACrC,CACF;SACA,OAAO,CACN,6BAA6B,CAC3B,IAAI,CAAC,sBAAsB,EAC3B,8BAA8B,CAC/B,CACF;SACA,OAAO,CACN,oBAAoB,CAClB,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,MAAM,EACX,8BAA8B,EAC9B,oCAAoC,CACrC,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,OAAO,MAAM,CAAC,GAAG,CAAC,8BAA8B,CAAqB,CAAC;AACxE,CAAC;AAED,sEAAsE;AACtE,SAAS,4BAA4B;IACnC,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,OAAO,CAAC,GAAyC;YAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;YACxB,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CACtB,8BAA8B,CACX,CAAC;YAEtB,QAAQ,CAAC,QAAS,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;YAEjD,IAAI,CAAC;gBACH,uBAAuB,CACrB,sBAAsB,EACtB,QAAQ,EACR,cAAc,EACd,GAAG,CAAC,cAAc,CACnB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxF,CAAC;YACJ,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,sEAAsE;AACtE,+DAA+D;AAC/D,yEAAyE;AACzE,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,wCAAwC,GAC5C,mCAAmC,CAAC;AAKtC,KAAK,UAAU,yBAAyB,CACtC,IAAoC,EACpC,KAAqC,EACrC,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,iCAAiC,CAAC,MAAM,CAAC,yBAAyB,CAAC,KAAK,EACxE,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,+CAA+C,EAC/C,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,iCAAiC,CAAC,MAAM,CAAC,yBAAyB,EAClE,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CACN,mBAAmB,CACjB,IAAI,CAAC,KAAK,EACV,wCAAwC,EACxC,0CAA0C,EAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAC1B,CACF;SACA,OAAO,CAAC,qCAAqC,EAAE,CAAC;SAChD,OAAO,CACN,sBAAsB,CACpB,IAAI,CAAC,KAAK,EACV,wCAAwC,EACxC,6CAA6C,CAC9C,CACF;SACA,OAAO,CACN,oBAAoB,CAClB,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,MAAM,EACX,wCAAwC,EACxC,6CAA6C,CAC9C,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,OAAO,MAAM,CAAC,GAAG,CACf,wCAAwC,CACrB,CAAC;AACxB,CAAC;AAED,4EAA4E;AAC5E,SAAS,qCAAqC;IAC5C,OAAO;QACL,IAAI,EAAE,gCAAgC;QACtC,OAAO,CAAC,GAAkD;YACxD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;YACxB,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CACtB,wCAAwC,CACrB,CAAC;YAEtB,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC,mBAAmB,CAAC;YAE9D,IAAI,CAAC;gBACH,uBAAuB,CACrB,sBAAsB,EACtB,QAAQ,EACR,cAAc,EACd,GAAG,CAAC,cAAc,CACnB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxF,CAAC;YACJ,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,wCAAwC,EAAE,QAAQ,CAAC,CAAC;QAC9D,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,oEAAoE;AACpE,uEAAuE;AACvE,wEAAwE;AACxE,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,KAAY,EACZ,WAAmB,EACnB,QAAgB,EAChB,YAAmD;IAEnD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,QAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAChC,eAAe,CAAC,iBAAiB,EACjC,UAAU,EACV,sBAAsB,CACvB,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,aAAa,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;YACvD,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACjC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAY,EACZ,WAAmB,EACnB,QAAgB;IAEhB,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAqB,CAAC;YAC1D,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,YAAY,CACtB,eAAe,CAAC,iBAAiB,EACjC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAC3B,sBAAsB,EACtB,QAAQ,CACT,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,kCAAkC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,oBAAoB,CAC3B,KAAY,EACZ,MAAc,EACd,WAAmB,EACnB,QAAgB;IAEhB,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAqB,CAAC;YAC1D,MAAM,KAAK,GACT,+BAA+B,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YAChE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,oCAAoC,EAAE;oBAC3D,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;iBAChC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,iBAAiB,CAC3B,eAAe,CAAC,iBAAiB,EACjC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAC3B,KAAK,CACN,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,wBAAwB,EAAE;oBAC/C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBAC7D,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;iBAChC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,KAAK,UAAU,GAAG,CAChB,IAAoC,EACpC,UAA8B,EAC9B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,+BAA+B,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAChD,UAAU,EACV,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,uBAAuB,EACvB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,+BAA+B,CAAC,MAAM,CAAC,GAAG,EAC1C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;SAC9D,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAqB,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,IAAoC,EACpC,GAAyB,EACzB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,+BAA+B,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EAC3D,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,oCAAoC,EAAE,IAAI,CAAC,MAAM,CAAC;SACjD,OAAO,CACN,gBAAgB,CACd,+BAA+B,CAAC,MAAM,CAAC,cAAc,EACrD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;SACnE,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAqB,CAAC;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAK5D,KAAK,UAAU,aAAa,CAC1B,IAAoC,EACpC,OAA8C,EAC9C,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,+BAA+B,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAC1D,OAAO,EACP,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,mCAAmC,EACnC,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,+BAA+B,CAAC,MAAM,CAAC,aAAa,EACpD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;SAC3E,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAA4B,CAAC;AACtC,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAY,EACZ,MAAc,EACd,aAAwC;IAExC,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,OAAO,CAAC,GAAsC;YAClD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC;YAC1B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YAEtC,IAAI,IAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE;oBAChD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBAC7D,UAAU;iBACX,CAAC,CAAC;gBACH,MAAM,aAAa,CAAC,KAAK,EAAE,mCAAmC,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,OAAO,GAAuB,EAAE,CAAC;YACvC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC,CAAC;gBACzD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,iDAAiD,EAAE;wBAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;YACH,CAAC;YACD,oEAAoE;YACpE,+DAA+D;YAC/D,2DAA2D;YAC3D,6CAA6C;YAC7C,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,aAAa,EACb,GAAG,CAAC,cAAc,EAClB,eAAe,CAAC,iBAAiB,EACjC,OAAO,CAAC,MAAM,CACZ,CAAC,QAAQ,EAAE,EAAE,CACX,QAAQ,CAAC,IAAI,EAAE,UAAU,KAAK,UAAU;gBACxC,CAAC,OAAO,CAAC,GAAG,KAAK,EAAE,IAAI,QAAQ,CAAC,QAAQ,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CACjE,EACD,EAAE,CACH,CAAC;YAEF,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;gBACnD,UAAU;gBACV,KAAK,EAAE,QAAQ,CAAC,MAAM;aACvB,CAAC,CAAC;YAEH,GAAG,CAAC,GAAG,CACL,0BAA0B,EAC1B,MAAM,CAAC,0BAA0B,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAC1D,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/workflowinstance/controller.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AAEvG,OAAO,EAAE,iCAAiC,EAAE,MAAM,mEAAmE,CAAC;AACtH,OAAO,EAAE,+BAA+B,EAAE,MAAM,iEAAiE,CAAC;AAKlH,OAAO,EAAE,0BAA0B,EAAE,MAAM,gEAAgE,CAAC;AAC5G,OAAO,EAAE,0BAA0B,EAAE,MAAM,8DAA8D,CAAC;AAK1G,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAStH,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,8BAA8B,GAC/B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EACL,oCAAoC,EACpC,4BAA4B,GAC7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,mCAAmC,EACnC,6BAA6B,GAC9B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EACL,yBAAyB,EACzB,+BAA+B,GAChC,MAAM,6CAA6C,CAAC;AAErD,OAAO,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EACL,yBAAyB,EACzB,oDAAoD,EACpD,6BAA6B,EAC7B,kCAAkC,EAClC,oCAAoC,GACrC,MAAM,YAAY,CAAC;AAmBpB,6EAA6E;AAC7E,MAAM,UAAU,gCAAgC,CAC9C,MAAqB,EACrB,IAAoC;IAEpC,MAAM,CAAC,OAAO,CAAC,iCAAiC,EAAE;QAChD,KAAK,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC;QACpD,MAAM,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC;QAC9D,MAAM,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC;QACtD,gBAAgB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACpE,yBAAyB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxC,yBAAyB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QAC7C,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;KACnD,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,+BAA+B,EAAE;QAC9C,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC5D,aAAa,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;KAC3D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,2DAA2D;AAC3D,KAAK,UAAU,cAAc,CAC3B,IAAoC,EACpC,QAA0B,EAC1B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,sBAAsB,EACtB,QAAQ,EACR,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,0BAA0B,EAC1B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,iCAAiC,CAAC,MAAM,CAAC,MAAM,EAC/C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3E,0EAA0E;QAC1E,oDAAoD;SACnD,OAAO,CACN,8BAA8B,CAC5B,IAAI,CAAC,UAAU,EACf,oCAAoC,CACrC,CACF;SACA,OAAO,CAAC,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;SACxD,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACtD,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,0BAA0B,EAAE,CAAC;SACrC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,OAAO,CACN,kBAAkB,CAChB,IAAI,CAAC,KAAK,EACV,+BAA+B,EAC/B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,MAAM,CACnB,IAAoC,EACpC,QAA0B,EAC1B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,sBAAsB,EACtB,QAAQ,EACR,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,0BAA0B,EAC1B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,iCAAiC,CAAC,MAAM,CAAC,MAAM,EAC/C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,OAAO,CAAC,6BAA6B,EAAE,CAAC;SACxC,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,0BAA0B,EAAE,CAAC;SACrC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,kBAAkB,CAChB,IAAI,CAAC,KAAK,EACV,+BAA+B,EAC/B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,KAAK,CAClB,IAAoC,EACpC,QAA0B,EAC1B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,sBAAsB,EACtB,QAAQ,EACR,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,yBAAyB,EACzB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,iCAAiC,CAAC,MAAM,CAAC,KAAK,EAC9C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,OAAO,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,8CAA8C,CAAC,EACzD,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,YAAY;QACjB,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC;QACrC,CAAC,CAAC,MAAM,CACJ,IAAI,EACJ,mBAAmB,CAAC,sBAAsB,EAAE,QAAQ,EAAE,MAAM,CAAC,EAC7D,GAAG,CACJ,CAAC;AACR,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAC3B,IAAoC,EACpC,UAA8B,EAC9B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,iCAAiC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EACrD,UAAU,EACV,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,0BAA0B,EAAE,IAAI,CAAC,MAAM,CAAC;SACvC,OAAO,CACN,gBAAgB,CACd,iCAAiC,CAAC,MAAM,CAAC,MAAM,EAC/C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,wBAAwB,EAAE,CAAC;SACnC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;SACzE,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SAC1D,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,gDAAgD,CAAC,EAC3D,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,OAAO,OAA2B,CAAC;AACrC,CAAC;AAED,8EAA8E;AAC9E,yEAAyE;AACzE,sEAAsE;AACtE,yEAAyE;AACzE,sBAAsB;AACtB,8EAA8E;AAE9E,MAAM,8BAA8B,GAAG,0BAA0B,CAAC;AAKlE,KAAK,UAAU,gBAAgB,CAC7B,IAAoC,EACpC,KAA4B,EAC5B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,iCAAiC,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAC/D,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,qCAAqC,EACrC,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,iCAAiC,CAAC,MAAM,CAAC,gBAAgB,EACzD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CACN,mBAAmB,CACjB,IAAI,CAAC,KAAK,EACV,8BAA8B,EAC9B,iCAAiC,EACjC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAC1B,CACF;SACA,OAAO,CACN,mCAAmC,CAAC,8BAA8B,CAAC,CACpE;SACA,OAAO,CACN,oDAAoD,CAClD,IAAI,CAAC,KAAK,EACV,8BAA8B,CAC/B,CACF;SACA,OAAO,CAAC,+BAA+B,EAAE,CAAC;SAC1C,OAAO,CACN,oCAAoC,CAClC,8BAA8B,EAC9B,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,4BAA4B,EAAE,CAAC;SACvC,OAAO,CACN,sBAAsB,CACpB,IAAI,CAAC,KAAK,EACV,8BAA8B,EAC9B,oCAAoC,CACrC,CACF;SACA,OAAO,CACN,6BAA6B,CAC3B,IAAI,CAAC,sBAAsB,EAC3B,8BAA8B,CAC/B,CACF;SACA,OAAO,CACN,oBAAoB,CAClB,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,MAAM,EACX,8BAA8B,EAC9B,oCAAoC,CACrC,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,OAAO,MAAM,CAAC,GAAG,CAAC,8BAA8B,CAAqB,CAAC;AACxE,CAAC;AAED,sEAAsE;AACtE,SAAS,4BAA4B;IACnC,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,OAAO,CAAC,GAAyC;YAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;YACxB,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CACtB,8BAA8B,CACX,CAAC;YAEtB,QAAQ,CAAC,QAAS,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;YAEjD,IAAI,CAAC;gBACH,uBAAuB,CACrB,sBAAsB,EACtB,QAAQ,EACR,cAAc,EACd,GAAG,CAAC,cAAc,CACnB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxF,CAAC;YACJ,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,sEAAsE;AACtE,+DAA+D;AAC/D,yEAAyE;AACzE,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,wCAAwC,GAC5C,mCAAmC,CAAC;AAKtC,KAAK,UAAU,yBAAyB,CACtC,IAAoC,EACpC,KAAqC,EACrC,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,iCAAiC,CAAC,MAAM,CAAC,yBAAyB,CAAC,KAAK,EACxE,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,+CAA+C,EAC/C,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,iCAAiC,CAAC,MAAM,CAAC,yBAAyB,EAClE,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CACN,mBAAmB,CACjB,IAAI,CAAC,KAAK,EACV,wCAAwC,EACxC,0CAA0C,EAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAC1B,CACF;SACA,OAAO,CAAC,qCAAqC,EAAE,CAAC;SAChD,OAAO,CACN,sBAAsB,CACpB,IAAI,CAAC,KAAK,EACV,wCAAwC,EACxC,6CAA6C,CAC9C,CACF;SACA,OAAO,CACN,oBAAoB,CAClB,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,MAAM,EACX,wCAAwC,EACxC,6CAA6C,CAC9C,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,OAAO,MAAM,CAAC,GAAG,CACf,wCAAwC,CACrB,CAAC;AACxB,CAAC;AAED,4EAA4E;AAC5E,SAAS,qCAAqC;IAC5C,OAAO;QACL,IAAI,EAAE,gCAAgC;QACtC,OAAO,CAAC,GAAkD;YACxD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;YACxB,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CACtB,wCAAwC,CACrB,CAAC;YAEtB,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC,mBAAmB,CAAC;YAE9D,IAAI,CAAC;gBACH,uBAAuB,CACrB,sBAAsB,EACtB,QAAQ,EACR,cAAc,EACd,GAAG,CAAC,cAAc,CACnB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxF,CAAC;YACJ,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,wCAAwC,EAAE,QAAQ,CAAC,CAAC;QAC9D,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,oEAAoE;AACpE,uEAAuE;AACvE,wEAAwE;AACxE,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,KAAY,EACZ,WAAmB,EACnB,QAAgB,EAChB,YAAmD;IAEnD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,QAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAChC,eAAe,CAAC,iBAAiB,EACjC,UAAU,EACV,sBAAsB,CACvB,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,aAAa,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;YACvD,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACjC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAY,EACZ,WAAmB,EACnB,QAAgB;IAEhB,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAqB,CAAC;YAC1D,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,YAAY,CACtB,eAAe,CAAC,iBAAiB,EACjC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAC3B,sBAAsB,EACtB,QAAQ,CACT,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,kCAAkC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,oBAAoB,CAC3B,KAAY,EACZ,MAAc,EACd,WAAmB,EACnB,QAAgB;IAEhB,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAqB,CAAC;YAC1D,MAAM,KAAK,GACT,+BAA+B,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YAChE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,oCAAoC,EAAE;oBAC3D,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;iBAChC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,iBAAiB,CAC3B,eAAe,CAAC,iBAAiB,EACjC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAC3B,KAAK,CACN,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,wBAAwB,EAAE;oBAC/C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBAC7D,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;iBAChC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,KAAK,UAAU,GAAG,CAChB,IAAoC,EACpC,UAA8B,EAC9B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,+BAA+B,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAChD,UAAU,EACV,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,uBAAuB,EACvB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,+BAA+B,CAAC,MAAM,CAAC,GAAG,EAC1C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;SAC9D,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAqB,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,IAAoC,EACpC,GAAyB,EACzB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,+BAA+B,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EAC3D,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,oCAAoC,EAAE,IAAI,CAAC,MAAM,CAAC;SACjD,OAAO,CACN,gBAAgB,CACd,+BAA+B,CAAC,MAAM,CAAC,cAAc,EACrD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;SACnE,OAAO,CACN,8BAA8B,CAC5B,IAAI,CAAC,UAAU,EACf,oBAAoB,CAAC,+BAA+B,CAAC,MAAM,CAAC,GAAG,CAAC,CACjE,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAqB,CAAC;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAK5D,KAAK,UAAU,aAAa,CAC1B,IAAoC,EACpC,OAA8C,EAC9C,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,+BAA+B,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAC1D,OAAO,EACP,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,mCAAmC,EACnC,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,+BAA+B,CAAC,MAAM,CAAC,aAAa,EACpD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;SAC3E,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAA4B,CAAC;AACtC,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAY,EACZ,MAAc,EACd,aAAwC;IAExC,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,OAAO,CAAC,GAAsC;YAClD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC;YAC1B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YAEtC,IAAI,IAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE;oBAChD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBAC7D,UAAU;iBACX,CAAC,CAAC;gBACH,MAAM,aAAa,CAAC,KAAK,EAAE,mCAAmC,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,OAAO,GAAuB,EAAE,CAAC;YACvC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC,CAAC;gBACzD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,iDAAiD,EAAE;wBAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;YACH,CAAC;YACD,oEAAoE;YACpE,+DAA+D;YAC/D,2DAA2D;YAC3D,6CAA6C;YAC7C,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,aAAa,EACb,GAAG,CAAC,cAAc,EAClB,eAAe,CAAC,iBAAiB,EACjC,OAAO,CAAC,MAAM,CACZ,CAAC,QAAQ,EAAE,EAAE,CACX,QAAQ,CAAC,IAAI,EAAE,UAAU,KAAK,UAAU;gBACxC,CAAC,OAAO,CAAC,GAAG,KAAK,EAAE,IAAI,QAAQ,CAAC,QAAQ,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CACjE,EACD,EAAE,CACH,CAAC;YAEF,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;gBACnD,UAAU;gBACV,KAAK,EAAE,QAAQ,CAAC,MAAM;aACvB,CAAC,CAAC;YAEH,GAAG,CAAC,GAAG,CACL,0BAA0B,EAC1B,MAAM,CAAC,0BAA0B,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAC1D,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/workflowinstance/steps.d.ts

@@ -3,6 +3,8 @@ import type { Workflow } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/ap
 import { WorkflowInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/api_pb";
 import type { Logger } from "../../boot/logger.js";
 import type { PipelineStep } from "../../pipeline/pipeline.js";
+import type { RequestContext } from "../../pipeline/request-context.js";
+import type { AuthorizationTarget } from "../../pipeline/steps/authorize.js";
 import type { Store } from "../../store/interface.js";
 type InstanceDesc = typeof WorkflowInstanceSchema;
 /** Context key for the loaded parent workflow (Go ParentWorkflowKey). */
@@ -19,6 +21,24 @@ export type ParentWorkflowLoaderProvider = () => ParentWorkflowLoader;
  * (capital-W copy is the wire contract).
  */
 export declare function newLoadParentWorkflowStep(loaderProvider: ParentWorkflowLoaderProvider, logger: Logger): PipelineStep<InstanceDesc>;
+/** The deny copy of the parent's bar, the Java WorkflowInstanceCreateHandler's. */
+export declare const WORKFLOW_INSTANCE_PARENT_DENIED_MESSAGE = "You don't have permission to create instances of this workflow";
+/**
+ * The create lane's authorization question, for AuthorizeResolvedTarget
+ * after LoadParentWorkflow and BEFORE ValidateSameOrgBusinessRule (whose
+ * refusal names the parent's organization, which a refused caller should
+ * not learn). The RPC is is_skip_authorization because its target is the
+ * PARENT, loaded from spec.workflow_id, not a request field.
+ *
+ * One question: may the caller run this workflow (can_execute on the
+ * parent, the relation the run gate asks; the same-org rule already binds
+ * the instance's organization to the workflow's, so there is no separate
+ * organization bar). A DEFAULT instance asks nothing, for the reason its
+ * agent twin gives (agentinstance/steps.ts): it is the workflow's row,
+ * composed by the server for the run's human, keyed on the in-process
+ * origin, the reserved label and the parent's organization together.
+ */
+export declare function resolveWorkflowInstanceCreateTargets(ctx: RequestContext<InstanceDesc>): ReadonlyArray<AuthorizationTarget>;
 /**
  * ValidateSameOrgBusinessRule — create.go: instances must live in the same
  * organization as the parent workflow; cross-org instances could leak

package/dist/domain/workflowinstance/steps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/domain/workflowinstance/steps.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uDAAuD,CAAC;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AAIvG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAQnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAK/D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,KAAK,YAAY,GAAG,OAAO,sBAAsB,CAAC;AAElD,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAQrD,MAAM,WAAW,oBAAoB;IACnC,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC5C;AAED,wDAAwD;AACxD,MAAM,MAAM,4BAA4B,GAAG,MAAM,oBAAoB,CAAC;AAEtE;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,cAAc,EAAE,4BAA4B,EAC5C,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,YAAY,CAAC,CAsB5B;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,YAAY,CAAC,CA4B5B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,IAAI,YAAY,CAAC,YAAY,CAAC,CAqB1E;AAED;;;;;;;;;GASG;AACH,wBAAgB,oDAAoD,CAClE,IAAI,SAAS,WAAW,EACxB,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAmCvD"}
+{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/domain/workflowinstance/steps.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uDAAuD,CAAC;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AAKvG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AASnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAI7E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,KAAK,YAAY,GAAG,OAAO,sBAAsB,CAAC;AAElD,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAQrD,MAAM,WAAW,oBAAoB;IACnC,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC5C;AAED,wDAAwD;AACxD,MAAM,MAAM,4BAA4B,GAAG,MAAM,oBAAoB,CAAC;AAEtE;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,cAAc,EAAE,4BAA4B,EAC5C,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,YAAY,CAAC,CAuB5B;AAED,mFAAmF;AACnF,eAAO,MAAM,uCAAuC,mEACc,CAAC;AAEnE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oCAAoC,CAClD,GAAG,EAAE,cAAc,CAAC,YAAY,CAAC,GAChC,aAAa,CAAC,mBAAmB,CAAC,CAqBpC;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,YAAY,CAAC,CA4B5B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,IAAI,YAAY,CAAC,YAAY,CAAC,CAqB1E;AAED;;;;;;;;;GASG;AACH,wBAAgB,oDAAoD,CAClE,IAAI,SAAS,WAAW,EACxB,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAmCvD"}

package/dist/domain/workflowinstance/steps.js

@@ -11,6 +11,8 @@
 import { ConnectError } from "@connectrpc/connect";
 import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { isServerComposedRequest } from "../../extensions/identity.js";
 import { isDefaultInstance } from "../../pipeline/apiresource-labels.js";
 import { failedPreconditionError, internalError, invalidArgumentError, notFoundError, } from "../../pipeline/errors.js";
 import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
@@ -45,6 +47,43 @@ export function newLoadParentWorkflowStep(loaderProvider, logger) {
         },
     };
 }
+/** The deny copy of the parent's bar, the Java WorkflowInstanceCreateHandler's. */
+export const WORKFLOW_INSTANCE_PARENT_DENIED_MESSAGE = "You don't have permission to create instances of this workflow";
+/**
+ * The create lane's authorization question, for AuthorizeResolvedTarget
+ * after LoadParentWorkflow and BEFORE ValidateSameOrgBusinessRule (whose
+ * refusal names the parent's organization, which a refused caller should
+ * not learn). The RPC is is_skip_authorization because its target is the
+ * PARENT, loaded from spec.workflow_id, not a request field.
+ *
+ * One question: may the caller run this workflow (can_execute on the
+ * parent, the relation the run gate asks; the same-org rule already binds
+ * the instance's organization to the workflow's, so there is no separate
+ * organization bar). A DEFAULT instance asks nothing, for the reason its
+ * agent twin gives (agentinstance/steps.ts): it is the workflow's row,
+ * composed by the server for the run's human, keyed on the in-process
+ * origin, the reserved label and the parent's organization together.
+ */
+export function resolveWorkflowInstanceCreateTargets(ctx) {
+    const parent = ctx.get(PARENT_WORKFLOW_KEY);
+    if (parent === undefined) {
+        throw new Error("parent workflow not found in context");
+    }
+    const metadata = ctx.newState.metadata;
+    if (isDefaultInstance(metadata) &&
+        isServerComposedRequest(ctx.callerIdentity) &&
+        (metadata?.org ?? "") === (parent.metadata?.org ?? "")) {
+        return [];
+    }
+    return [
+        {
+            permission: IamPermission.can_execute,
+            resourceKind: ApiResourceKind.workflow,
+            resourceId: parent.metadata?.id ?? "",
+            deniedMessage: WORKFLOW_INSTANCE_PARENT_DENIED_MESSAGE,
+        },
+    ];
+}
 /**
  * ValidateSameOrgBusinessRule — create.go: instances must live in the same
  * organization as the parent workflow; cross-org instances could leak

package/dist/domain/workflowinstance/steps.js.map

@@ -1 +1 @@
-{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/workflowinstance/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGnD,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AAIvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,qCAAqC,EAAE,MAAM,6CAA6C,CAAC;AACpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAKjE,yEAAyE;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAerD;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,cAA4C,EAC5C,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAiC;YAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC;YAEpD,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YAEvD,IAAI,MAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;oBACvC,KAAK,EAAE,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBACvE,UAAU;iBACX,CAAC,CAAC;gBACH,MAAM,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAC9C,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kCAAkC,CAChD,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,6BAA6B;QACnC,OAAO,CAAC,GAAiC;YACvC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAyB,CAAC;YACpE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;YACnD,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;YAE/C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CACT,8EAA8E,EAC9E;oBACE,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;oBACrC,WAAW;oBACX,WAAW,EAAE,SAAS;iBACvB,CACF,CAAC;gBACF,MAAM,oBAAoB,CACxB,kEAAkE;oBAChE,4BAA4B,WAAW,8BAA8B,SAAS,IAAI,CACrF,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,6BAA6B;IAC3C,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,OAAO,CAAC,GAAiC;YACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAEjC,CAAC;YACd,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,iDAAiD,CAAC,EAC5D,iDAAiD,CAClD,CAAC;YACJ,CAAC;YAED,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,KAAK,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC;gBAC7D,MAAM,uBAAuB,CAC3B,yDAAyD,QAAQ,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,uDAAuD,CAChJ,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oDAAoD,CAElE,KAAY,EAAE,WAAmB;IACjC,OAAO;QACL,IAAI,EAAE,uCAAuC;QAC7C,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAqB,CAAC;YAE1D,IAAI,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzC,qCAAqC,EAAE,CAAC;YAC1C,CAAC;YAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC;YACjD,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;gBACpB,OAAO;YACT,CAAC;YACD,IAAI,MAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAC9B,eAAe,CAAC,QAAQ,EACxB,QAAQ,EACR,cAAc,CACf,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,OAAO;gBACT,CAAC;gBACD,MAAM,aAAa,CACjB,KAAK,EACL,2DAA2D,CAC5D,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,EAAE,iBAAiB,KAAK,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC;gBAC/D,qCAAqC,EAAE,CAAC;YAC1C,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/workflowinstance/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGnD,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AAIvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAG1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,qCAAqC,EAAE,MAAM,6CAA6C,CAAC;AACpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAKjE,yEAAyE;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAerD;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,cAA4C,EAC5C,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAiC;YAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC;YAEpD,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YAEvD,IAAI,MAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;oBACvC,KAAK,EACH,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBAClE,UAAU;iBACX,CAAC,CAAC;gBACH,MAAM,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAC9C,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,MAAM,uCAAuC,GAClD,gEAAgE,CAAC;AAEnE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oCAAoC,CAClD,GAAiC;IAEjC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAyB,CAAC;IACpE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACvC,IACE,iBAAiB,CAAC,QAAQ,CAAC;QAC3B,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC;QAC3C,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,EACtD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL;YACE,UAAU,EAAE,aAAa,CAAC,WAAW;YACrC,YAAY,EAAE,eAAe,CAAC,QAAQ;YACtC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;YACrC,aAAa,EAAE,uCAAuC;SACvD;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kCAAkC,CAChD,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,6BAA6B;QACnC,OAAO,CAAC,GAAiC;YACvC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAyB,CAAC;YACpE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;YACnD,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;YAE/C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CACT,8EAA8E,EAC9E;oBACE,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;oBACrC,WAAW;oBACX,WAAW,EAAE,SAAS;iBACvB,CACF,CAAC;gBACF,MAAM,oBAAoB,CACxB,kEAAkE;oBAChE,4BAA4B,WAAW,8BAA8B,SAAS,IAAI,CACrF,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,6BAA6B;IAC3C,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,OAAO,CAAC,GAAiC;YACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAEjC,CAAC;YACd,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,iDAAiD,CAAC,EAC5D,iDAAiD,CAClD,CAAC;YACJ,CAAC;YAED,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,KAAK,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC;gBAC7D,MAAM,uBAAuB,CAC3B,yDAAyD,QAAQ,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,uDAAuD,CAChJ,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oDAAoD,CAElE,KAAY,EAAE,WAAmB;IACjC,OAAO;QACL,IAAI,EAAE,uCAAuC;QAC7C,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAqB,CAAC;YAE1D,IAAI,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzC,qCAAqC,EAAE,CAAC;YAC1C,CAAC;YAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC;YACjD,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;gBACpB,OAAO;YACT,CAAC;YACD,IAAI,MAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAC9B,eAAe,CAAC,QAAQ,EACxB,QAAQ,EACR,cAAc,CACf,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,OAAO;gBACT,CAAC;gBACD,MAAM,aAAa,CACjB,KAAK,EACL,2DAA2D,CAC5D,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,EAAE,iBAAiB,KAAK,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC;gBAC/D,qCAAqC,EAAE,CAAC;YAC1C,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/extensions/identity.d.ts

@@ -102,4 +102,23 @@ export interface IdentityVerifier {
  * rule is load-bearing in open source.
  */
 export declare function isPlatformPipelineCaller(caller: CallerIdentity): boolean;
+/**
+ * Whether the request `caller` arrived on was composed by the server's own
+ * code rather than presented on the wire: the `internal` class (the server
+ * acting as itself) or ANY identity that entered through the in-process
+ * transport (a propagated person the server is building a request for,
+ * such as the default-instance self-heal that creates as the run's human
+ * for attribution). The serving chassis strips the propagation header, so
+ * the wire cannot claim this.
+ *
+ * This is the trust arm the label guard, the memory-capture gate and the
+ * execution-context create check share: what a server-composed request
+ * carries was decided by the service code that built it, and the
+ * entry-point request already passed its own gate. It is NARROWER than
+ * `isPlatformPipelineCaller`: a wire `machine` account is one of the
+ * platform's pipelines but its request is still the wire's, so a step
+ * that trusts server-composed state (a reserved label, a default
+ * instance's provenance) must key on this predicate and never on that one.
+ */
+export declare function isServerComposedRequest(caller: CallerIdentity): boolean;
 //# sourceMappingURL=identity.d.ts.map

package/dist/extensions/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/extensions/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,SAAS,GACT,QAAQ,GACR,UAAU,GACV,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,YAAY,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;CACvD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAMxE"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/extensions/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,SAAS,GACT,QAAQ,GACR,UAAU,GACV,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,YAAY,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;CACvD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAExE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAEvE"}

package/dist/extensions/identity.js

@@ -26,8 +26,27 @@
  * rule is load-bearing in open source.
  */
 export function isPlatformPipelineCaller(caller) {
-    return (caller.callerClass === "machine" ||
-        caller.callerClass === "internal" ||
-        caller.origin === "in-process");
+    return caller.callerClass === "machine" || isServerComposedRequest(caller);
+}
+/**
+ * Whether the request `caller` arrived on was composed by the server's own
+ * code rather than presented on the wire: the `internal` class (the server
+ * acting as itself) or ANY identity that entered through the in-process
+ * transport (a propagated person the server is building a request for,
+ * such as the default-instance self-heal that creates as the run's human
+ * for attribution). The serving chassis strips the propagation header, so
+ * the wire cannot claim this.
+ *
+ * This is the trust arm the label guard, the memory-capture gate and the
+ * execution-context create check share: what a server-composed request
+ * carries was decided by the service code that built it, and the
+ * entry-point request already passed its own gate. It is NARROWER than
+ * `isPlatformPipelineCaller`: a wire `machine` account is one of the
+ * platform's pipelines but its request is still the wire's, so a step
+ * that trusts server-composed state (a reserved label, a default
+ * instance's provenance) must key on this predicate and never on that one.
+ */
+export function isServerComposedRequest(caller) {
+    return caller.callerClass === "internal" || caller.origin === "in-process";
 }
 //# sourceMappingURL=identity.js.map

package/dist/extensions/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/extensions/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAuFH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAsB;IAC7D,OAAO,CACL,MAAM,CAAC,WAAW,KAAK,SAAS;QAChC,MAAM,CAAC,WAAW,KAAK,UAAU;QACjC,MAAM,CAAC,MAAM,KAAK,YAAY,CAC/B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/extensions/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAuFH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAsB;IAC7D,OAAO,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAsB;IAC5D,OAAO,MAAM,CAAC,WAAW,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,CAAC;AAC7E,CAAC"}

package/dist/extensions/list-read-scope.d.ts

@@ -48,11 +48,27 @@
  *     authorization-backend outage surfaces as the pipeline's sanitized
  *     INTERNAL, exactly the Java baseline (DD-007: unavailable is never
  *     softened).
- *   - The scope receives whatever identity the call carries, including
- *     the in-process `internal` class — the driver owns that arm's
- *     semantics (the Java baseline propagates the original caller
- *     through in-process calls, so a composed driver normally never
- *     sees `internal` on these lanes).
+ *   - THE `internal` CLASS IS ANSWERED HERE, NEVER OFFERED TO
+ *     `restrictListEntries`. The server acting as itself over the
+ *     in-process transport (boot/inprocess.ts mints the class; nothing
+ *     else can) is the server's own trust domain, on list lanes exactly
+ *     as on the Authorize step, which returns for the class before any
+ *     Authorizer is asked (pipeline/steps/authorize.ts). The helper
+ *     below returns the org-narrowed rows for that class before the
+ *     scope is consulted. The rule is class-only, like the step's: a
+ *     caller PROPAGATED through the in-process header keeps its own
+ *     class and stays scoped. Why here and not in a driver: a driver
+ *     answering "every offered id" for the class must be written once
+ *     per edition and is a silent short list the day one edition
+ *     forgets (stigmer#1207: a composed driver scoped the class and
+ *     every server-internal list read came back empty — the
+ *     personal-environment reads at execution-context creation and MCP
+ *     connect in this repository, and a composition's own in-process
+ *     readers of a session's executions).
+ *     The enumeration verb is a wire caller's verb: no in-process edge
+ *     reaches `authorizedResourceIds`, and only a scanning driver can
+ *     say "all", so that verb's internal arm stays the driver's and is
+ *     stated in its doc below.
  *   - THE SCOPE IS THE LAST PER-ROW PREDICATE IN A LANE (stigmer-cloud
  *     20260913.04 T02, Q-LB-11). Every request predicate a lane applies
  *     — the request's org, a phase, labels, a parent id, filter criteria
@@ -143,6 +159,13 @@ export interface ListReadScope {
      * answer — consumers map it to their lane's empty shape without
      * touching the store. A scope may throw on a kind it was never ruled
      * to serve (a consumer bug by contract).
+     *
+     * The `internal` class CAN reach this verb (no helper stands between a
+     * consumer and it), and the driver owns that arm: a scanning driver
+     * answers every id of the kind, an engine-backed one answers what its
+     * engine holds for the class. No in-process edge reaches an
+     * enumeration lane today, so the two answers have never met a caller;
+     * a consumer that adds one reads this line first.
      */
     authorizedResourceIds(caller: CallerIdentity, kind: ApiResourceKind): Promise<ReadonlySet<string>>;
     /**
@@ -150,6 +173,12 @@ export interface ListReadScope {
      * baseline: the authorized-ids intersection plus the guest
      * cookie-label rule where the lane carries it). The result must be a
      * subset of the offered ids — a scope only narrows.
+     *
+     * `caller` is never the `internal` class: `restrictListByReadScope`,
+     * the one consumption idiom, answers that class before any driver is
+     * asked (the header's contract line). A driver that is offered it has
+     * been reached around the idiom and should refuse loudly rather than
+     * evaluate the server as a person (the built-in driver does).
      */
     restrictListEntries(caller: CallerIdentity, kind: ApiResourceKind, entries: ReadonlyArray<ListEntryMeta>): Promise<ReadonlySet<string>>;
 }
@@ -187,8 +216,13 @@ export interface ScopedListResource {
  *     permission-bounded across orgs, verified per lane in the entry's
  *     census — lanes Java does not org-narrow pass ""), then to the kept
  *     ids. The same set either way (both are per-row predicates); the
- *     order is the header's second-to-last contract line: the scope sees
- *     the org's rows, not the kind's;
+ *     order is the header's contract line: the scope sees the org's
+ *     rows, not the kind's;
+ *   - scope composed, caller `internal` → the org-narrowed rows, the
+ *     scope never asked and no candidate built (the header's contract
+ *     line). The org predicate is the REQUEST's, not the caller's, so
+ *     the server's own read of a cross-org lane still honours the org
+ *     it asked for; only the caller predicate is skipped;
  *   - every candidate carries the row's authorization facts, and the
  *     candidates of a kind whose authorization is its parent's name that
  *     parent again as `authorizationParent` — one of the facts' parent

package/dist/extensions/list-read-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-read-scope.d.ts","sourceRoot":"","sources":["../../src/extensions/list-read-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8GG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAC3H,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AAUjG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EACtB,MAAM,6BAA6B,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,WAAW,aAAc,SAAQ,qBAAqB;IAC1D,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD;;;;;;;;;OASG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;CACnD;AAED,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,qBAAqB,CACnB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhC;;;;;OAKG;IACH,mBAAmB,CACjB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,GACpC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE;QACT,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,UAAU,CAAC,EAAE,qBAAqB,CAAC;KACpC,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,gBAAgB,CAAA;KAAE,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,uBAAuB,CAAC,CAAC,SAAS,kBAAkB,EACxE,KAAK,EAAE,aAAa,GAAG,SAAS,EAChC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,EACrB,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,EAC3B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,EAAE,CAAC,CAqBd"}
+{"version":3,"file":"list-read-scope.d.ts","sourceRoot":"","sources":["../../src/extensions/list-read-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8HG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAC3H,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AAUjG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EACtB,MAAM,6BAA6B,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,WAAW,aAAc,SAAQ,qBAAqB;IAC1D,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD;;;;;;;;;OASG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;CACnD;AAED,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;;;;;OAaG;IACH,qBAAqB,CACnB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhC;;;;;;;;;;;OAWG;IACH,mBAAmB,CACjB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,GACpC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE;QACT,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,UAAU,CAAC,EAAE,qBAAqB,CAAC;KACpC,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,gBAAgB,CAAA;KAAE,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,uBAAuB,CAAC,CAAC,SAAS,kBAAkB,EACxE,KAAK,EAAE,aAAa,GAAG,SAAS,EAChC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,EACrB,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,EAC3B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,EAAE,CAAC,CA2Bd"}

package/dist/extensions/list-read-scope.js

@@ -19,8 +19,13 @@ import { rowAuthorizationFactsOf } from "../pipeline/steps/authorization-facts.j
  *     permission-bounded across orgs, verified per lane in the entry's
  *     census — lanes Java does not org-narrow pass ""), then to the kept
  *     ids. The same set either way (both are per-row predicates); the
- *     order is the header's second-to-last contract line: the scope sees
- *     the org's rows, not the kind's;
+ *     order is the header's contract line: the scope sees the org's
+ *     rows, not the kind's;
+ *   - scope composed, caller `internal` → the org-narrowed rows, the
+ *     scope never asked and no candidate built (the header's contract
+ *     line). The org predicate is the REQUEST's, not the caller's, so
+ *     the server's own read of a cross-org lane still honours the org
+ *     it asked for; only the caller predicate is skipped;
  *   - every candidate carries the row's authorization facts, and the
  *     candidates of a kind whose authorization is its parent's name that
  *     parent again as `authorizationParent` — one of the facts' parent
@@ -34,6 +39,12 @@ export async function restrictListByReadScope(scope, caller, kind, resources, re
     const offered = requestOrg === ""
         ? resources
         : resources.filter((resource) => resource.metadata?.org === requestOrg);
+    // The server acting as itself: the trust-domain rule of the Authorize
+    // step, applied to a list answer — the caller predicate is skipped, the
+    // request's org predicate above is not (the header's contract line).
+    if (caller.callerClass === "internal") {
+        return [...offered];
+    }
     const parentOf = authorizationParentReader(kind);
     const entries = offered.map((resource) => {
         const entry = {

package/dist/extensions/list-read-scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-read-scope.js","sourceRoot":"","sources":["../../src/extensions/list-read-scope.ts"],"names":[],"mappings":"AAmHA,sEAAsE;AACtE,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,sBAAsB;AACtB,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AA4EnF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAgC,EAChC,MAAsB,EACtB,IAAqB,EACrB,SAA2B,EAC3B,UAAkB;IAElB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,OAAO,GACX,UAAU,KAAK,EAAE;QACf,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,OAAO,GAAoB,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACxD,MAAM,KAAK,GAAkB;YAC3B,GAAG,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC1C,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE;SACxC,CAAC;QACF,MAAM,mBAAmB,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACxD,OAAO,mBAAmB,KAAK,SAAS;YACtC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,yBAAyB,CAChC,IAAqB;IAIrB,MAAM,MAAM,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,WAAW,EAAE,EAAE,CACrB,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;AAClE,CAAC"}
+{"version":3,"file":"list-read-scope.js","sourceRoot":"","sources":["../../src/extensions/list-read-scope.ts"],"names":[],"mappings":"AAmIA,sEAAsE;AACtE,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,sBAAsB;AACtB,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAyFnF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAgC,EAChC,MAAsB,EACtB,IAAqB,EACrB,SAA2B,EAC3B,UAAkB;IAElB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,OAAO,GACX,UAAU,KAAK,EAAE;QACf,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC;IAC5E,sEAAsE;IACtE,wEAAwE;IACxE,qEAAqE;IACrE,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACtC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,OAAO,GAAoB,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACxD,MAAM,KAAK,GAAkB;YAC3B,GAAG,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC1C,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE;SACxC,CAAC;QACF,MAAM,mBAAmB,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACxD,OAAO,mBAAmB,KAAK,SAAS;YACtC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,yBAAyB,CAChC,IAAqB;IAIrB,MAAM,MAAM,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,WAAW,EAAE,EAAE,CACrB,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;AAClE,CAAC"}

package/dist/pipeline/apiresource-labels.d.ts

@@ -22,8 +22,8 @@
 import type { ApiResourceMetadata } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
 /**
  * The platform-reserved label key namespace. Keys under this prefix carry
- * platform semantics (default-agent resolution, personal-environment
- * uniqueness, default-instance marking) and are written by the server —
+ * platform semantics (personal-environment uniqueness, default-instance
+ * marking, plugin membership and lineage) and are written by the server —
  * never introduced by ordinary client requests on the cloud edition.
  */
 export declare const RESERVED_LABEL_PREFIX = "stigmer.ai/";

package/dist/pipeline/apiresource-labels.js

@@ -1,7 +1,7 @@
 /**
  * The platform-reserved label key namespace. Keys under this prefix carry
- * platform semantics (default-agent resolution, personal-environment
- * uniqueness, default-instance marking) and are written by the server —
+ * platform semantics (personal-environment uniqueness, default-instance
+ * marking, plugin membership and lineage) and are written by the server —
  * never introduced by ordinary client requests on the cloud edition.
  */
 export const RESERVED_LABEL_PREFIX = "stigmer.ai/";

package/dist/pipeline/errors.d.ts

@@ -47,8 +47,8 @@ export declare function grpcCodeName(code: Code): string;
  * errors.As branch keeps the INNER code but rewrites the message to the
  * full wrapped text — and the inner client error's Error() renders as
  * `rpc error: code = <CodeName> desc = <message>`. Byte-parity with Go on
- * the two arms that hit this (agent create's CreateDefaultInstance,
- * session create's ResolveDefaultAgentInstance). The transport-formatting
+ * the arms that hit this (agent create's CreateDefaultInstance, agent
+ * execution create's default-instance and session bootstrap). The transport-formatting
  * leak is filed as stigmer/stigmer#852 for a both-editions post-cutover
  * fix; until then this shim IS the wire contract.
  *

package/dist/pipeline/errors.js

@@ -87,8 +87,8 @@ export function grpcCodeName(code) {
  * errors.As branch keeps the INNER code but rewrites the message to the
  * full wrapped text — and the inner client error's Error() renders as
  * `rpc error: code = <CodeName> desc = <message>`. Byte-parity with Go on
- * the two arms that hit this (agent create's CreateDefaultInstance,
- * session create's ResolveDefaultAgentInstance). The transport-formatting
+ * the arms that hit this (agent create's CreateDefaultInstance, agent
+ * execution create's default-instance and session bootstrap). The transport-formatting
  * leak is filed as stigmer/stigmer#852 for a both-editions post-cutover
  * fix; until then this shim IS the wire contract.
  *

package/dist/pipeline/steps/authorize-resolved-target.d.ts

@@ -0,0 +1,88 @@
+/**
+ * AuthorizeResolvedTarget — the ONE mid-chain authorization step: the
+ * question a lane can only ask once its chain has loaded something the
+ * position-1 annotation could not key on.
+ *
+ * The `Authorize` step resolves its target from the REQUEST (a field path
+ * over the input), so it cannot serve two shapes of lane, and both are
+ * `is_skip_authorization` on the wire for that reason alone:
+ *
+ *   - a read by reference: the request carries an org and a slug, the
+ *     target is the row the loader finds, and the question is exactly the
+ *     one the kind's `get` asks by id — `can_view` on that row, with the
+ *     `get` annotation's byte-pinned copy. `loadedTargetAsMethod(get)` is
+ *     that resolver: it reads the row under TARGET_RESOURCE_KEY and asks the
+ *     sibling `get` descriptor's annotation about its id, so the two lanes
+ *     cannot drift (one annotation owns the permission and the copy; a
+ *     `get` that is itself a skip makes the reference read a skip too).
+ *   - a parent-gated create: the request names a parent (an agent to
+ *     schedule, share, channel-bind or instantiate; a workflow to
+ *     instantiate), the domain's resolve step loads and stashes it, and the
+ *     question is the caller's standing on that parent (or on the row's
+ *     organization), with the copy the lane has always answered.
+ *
+ * The step owns nothing but the position and the evaluation: a PURE
+ * resolver over the request context names the questions (kind, id,
+ * permission, copy), in the order the lane asks them; the first refusal
+ * answers. The evaluation is `authorizeTarget` (authorize.ts): allow
+ * proceeds, deny is PERMISSION_DENIED with the copy, not-found is NOT_FOUND
+ * as the load-first chain would answer, unavailable is INTERNAL, and the
+ * `internal` class alone is exempt — the annotation's skip arms do not
+ * apply, because the caller IS the enforcement the annotation opted out of.
+ *
+ * Two contracts a resolver keeps. It returns an EMPTY list only for an arm
+ * the lane has modelled as "nothing to ask" (a default instance the server
+ * composed for the run's human, whose access already follows the parent);
+ * an absent stash, a parent the chain guaranteed and did not deliver, is a
+ * chain invariant broken and the resolver THROWS, so a mis-ordered chain
+ * fails loudly instead of silently reopening the lane. And it names the
+ * questions in the anti-probing order: the organization's bar before the
+ * parent's where both are asked, so an outsider learns nothing about the
+ * parent's grants from which copy came back.
+ *
+ * Position: immediately after the step that loads what the resolver reads,
+ * before the duplicate check, before any engine or store side effect, and
+ * before any step whose refusal would reveal the loaded row (a same-org
+ * rule that names the parent's organization, an enrichment that reads the
+ * row's connections).
+ *
+ * The step's name is the shared vocabulary for every NEW lane. The lanes
+ * that carried a hand-written copy of this body before it existed keep
+ * their frozen names through `stepName` — the version ladder's own
+ * precedent (LoadSkillByReference and LoadPluginByReference are one
+ * factory) — because a step name is never renamed.
+ *
+ * Sibling: `AuthorizeRunTarget` runs the same evaluation over the record
+ * being built (`ctx.newState`) and carries the run-gate doctrine an
+ * edition's lane admission keys on; this step reads what the chain LOADED
+ * and carries no doctrine of its own.
+ */
+import type { DescMessage, DescMethod } from "@bufbuild/protobuf";
+import type { ApiResourceReferenceSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import type { Authorizer } from "../../extensions/authorizer.js";
+import type { PipelineStep } from "../pipeline.js";
+import type { RequestContext } from "../request-context.js";
+import { type AuthorizationTarget } from "./authorize.js";
+/** The step's shared name; a folded lane passes its own frozen name instead. */
+export declare const AUTHORIZE_RESOLVED_TARGET_STEP = "AuthorizeResolvedTarget";
+/**
+ * Names the questions a lane asks, in order, over the request context after
+ * its chain has loaded the target. Pure: no store, no clock, no side effect.
+ * Empty means the lane has nothing to ask on this request; an invariant the
+ * chain broke (an absent stash) is a throw, never an empty list.
+ */
+export type ResolvedTargetResolver<Desc extends DescMessage> = (ctx: RequestContext<Desc>) => ReadonlyArray<AuthorizationTarget>;
+export declare function newAuthorizeResolvedTargetStep<Desc extends DescMessage>(authorizer: Authorizer, resolve: ResolvedTargetResolver<Desc>, stepName?: string): PipelineStep<Desc>;
+/** The request shape every `getByReference` lane runs on. */
+export type GetByReferenceDesc = typeof ApiResourceReferenceSchema;
+/**
+ * The reads' resolver: the row the loader stashed under TARGET_RESOURCE_KEY,
+ * authorized exactly as `get` would authorize it by id. The `get`
+ * descriptor's annotation supplies the kind, the permission and the copy;
+ * the loaded row's id is the target override (a reference has no `value`
+ * field for the annotation's path to read). A `get` that is public, skip
+ * or unannotated makes this a no-op — the reference read is never stricter
+ * than the read by id, and never laxer.
+ */
+export declare function loadedTargetAsMethod(get: DescMethod): ResolvedTargetResolver<GetByReferenceDesc>;
+//# sourceMappingURL=authorize-resolved-target.d.ts.map

package/dist/pipeline/steps/authorize-resolved-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-resolved-target.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/authorize-resolved-target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAW,MAAM,oBAAoB,CAAC;AAE3E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sDAAsD,CAAC;AAEvG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAG5D,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AAExB,gFAAgF;AAChF,eAAO,MAAM,8BAA8B,4BAA4B,CAAC;AAExE;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,CAAC,IAAI,SAAS,WAAW,IAAI,CAC7D,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,KACtB,aAAa,CAAC,mBAAmB,CAAC,CAAC;AAExC,wBAAgB,8BAA8B,CAAC,IAAI,SAAS,WAAW,EACrE,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,sBAAsB,CAAC,IAAI,CAAC,EACrC,QAAQ,GAAE,MAAuC,GAChD,YAAY,CAAC,IAAI,CAAC,CASpB;AAED,6DAA6D;AAC7D,MAAM,MAAM,kBAAkB,GAAG,OAAO,0BAA0B,CAAC;AAEnE;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,UAAU,GACd,sBAAsB,CAAC,kBAAkB,CAAC,CAY5C"}

package/dist/pipeline/steps/authorize-resolved-target.js

@@ -0,0 +1,36 @@
+import { metadataOf } from "./shapes.js";
+import { TARGET_RESOURCE_KEY } from "./load-target.js";
+import { authorizeTarget, resolveAnnotatedCheck, } from "./authorize.js";
+/** The step's shared name; a folded lane passes its own frozen name instead. */
+export const AUTHORIZE_RESOLVED_TARGET_STEP = "AuthorizeResolvedTarget";
+export function newAuthorizeResolvedTargetStep(authorizer, resolve, stepName = AUTHORIZE_RESOLVED_TARGET_STEP) {
+    return {
+        name: stepName,
+        async execute(ctx) {
+            for (const target of resolve(ctx)) {
+                await authorizeTarget(authorizer, ctx.callerIdentity, target);
+            }
+        },
+    };
+}
+/**
+ * The reads' resolver: the row the loader stashed under TARGET_RESOURCE_KEY,
+ * authorized exactly as `get` would authorize it by id. The `get`
+ * descriptor's annotation supplies the kind, the permission and the copy;
+ * the loaded row's id is the target override (a reference has no `value`
+ * field for the annotation's path to read). A `get` that is public, skip
+ * or unannotated makes this a no-op — the reference read is never stricter
+ * than the read by id, and never laxer.
+ */
+export function loadedTargetAsMethod(get) {
+    return (ctx) => {
+        const loaded = ctx.get(TARGET_RESOURCE_KEY);
+        const id = loaded === undefined ? undefined : metadataOf(loaded)?.id;
+        if (id === undefined) {
+            throw new Error(`${AUTHORIZE_RESOLVED_TARGET_STEP}: no loaded target with metadata under ${TARGET_RESOURCE_KEY}; the loader must run first`);
+        }
+        const target = resolveAnnotatedCheck(get, ctx.input, { resourceId: id });
+        return target === undefined ? [] : [target];
+    };
+}
+//# sourceMappingURL=authorize-resolved-target.js.map