@stigmer/server 3.22.1-dev.20260922095755 → 3.22.1

package/dist/domain/workflow/agent-call-references.d.ts

@@ -1,54 +0,0 @@
-/**
- * ValidateAgentCallReferences — the second collector for the reference rule
- * (pipeline/steps/references.ts): a workflow's `agent_call` tasks name their
- * agent as a STRING, `"slug"` or `"org/slug"`, inside a `google.protobuf.Struct`
- * config the generic spec walker cannot see, so the rule would never meet
- * them. This step parses each task's config through the converter's own
- * strict decoder (`unmarshalTaskConfig`, the one reader of a task config),
- * walks nested control-flow tasks exactly as the constraint validator does,
- * turns every `agent` string into a reference with the workflow as parent,
- * and asks the rule's one function — same clauses, same copy. It lives in
- * the workflow domain and not inside `InProcessValidator` because the
- * validator is pure over the spec by design and a rule that reads the
- * target's row cannot be.
- *
- * The parser here is STRICT: exactly `slug` or `org/slug`, both segments
- * non-empty, anything else refused at write naming the task. Two lenient
- * readers of the same string exist downstream and disagree with each other
- * (the runner's `parseAgentReference` in activities/call-agent.ts splits on
- * the first `/` and drops a third segment; the CLI's `parseReference` in
- * client-apps/cli/src/resources/reference.ts refuses a leading slash);
- * refusing every malformed shape here means neither ever meets one. The
- * three cannot share code — the packages share only the protos — so the
- * execution conformance suite is where their agreement is proven.
- *
- * Runs after NormalizeReferences and ValidateReferences on the workflow
- * create and update chains, so the org the walk sees is the workflow's own
- * for a bare slug. Proven by __tests__/agent-call-references.test.ts and
- * the workflow conformance suite's reference arm.
- */
-import type { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
-import type { WorkflowSpec } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/spec_pb";
-import type { Store } from "../../store/interface.js";
-import type { PipelineStep } from "../../pipeline/pipeline.js";
-import type { SpecReference } from "../../pipeline/steps/references.js";
-/** The one sentence for an `agent` string that is neither `slug` nor `org/slug`. */
-export declare function malformedAgentReferenceMessage(taskName: string, agent: string): string;
-/**
- * `slug` or `org/slug` → the reference, with `org` empty for the bare form
- * (the caller fills the parent's). Returns undefined for any other shape.
- */
-export declare function parseAgentReference(agent: string): {
-    readonly org: string;
-    readonly slug: string;
-} | undefined;
-/**
- * Every `agent_call` task's agent as a reference, nested tasks included in
- * declaration order, the bare form resolved to `parentOrg`. Throws
- * INVALID_ARGUMENT on the first malformed string. A config that does not
- * decode is skipped: the spec validation step has already refused the
- * workflow for it, and this collector never double-reports.
- */
-export declare function collectAgentCallReferences(spec: WorkflowSpec | undefined, parentOrg: string): SpecReference[];
-export declare function newValidateAgentCallReferencesStep(store: Store): PipelineStep<typeof WorkflowSchema>;
-//# sourceMappingURL=agent-call-references.d.ts.map

package/dist/domain/workflow/agent-call-references.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-call-references.d.ts","sourceRoot":"","sources":["../../../src/domain/workflow/agent-call-references.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AAE5F,OAAO,KAAK,EACV,YAAY,EAEb,MAAM,wDAAwD,CAAC;AAIhE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE/D,OAAO,KAAK,EAEV,aAAa,EACd,MAAM,oCAAoC,CAAC;AAM5C,oFAAoF;AACpF,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,MAAM,CAER;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,GACZ;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAS7D;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,SAAS,EAAE,MAAM,GAChB,aAAa,EAAE,CAyCjB;AAED,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,KAAK,GACX,YAAY,CAAC,OAAO,cAAc,CAAC,CAyBrC"}

package/dist/domain/workflow/agent-call-references.js

@@ -1,97 +0,0 @@
-import { WorkflowTaskKind } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/enum_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { internalError, invalidArgumentError } from "../../pipeline/errors.js";
-import { checkReferences } from "../../pipeline/steps/references.js";
-import { metadataOf } from "../../pipeline/steps/shapes.js";
-import { unmarshalTaskConfig } from "./converter/unmarshal.js";
-import { nestedTasks } from "./validation/task-config-constraints.js";
-/** The one sentence for an `agent` string that is neither `slug` nor `org/slug`. */
-export function malformedAgentReferenceMessage(taskName, agent) {
-    return `task '${taskName}': agent '${agent}' is not a reference; write 'slug' for an agent of this organization or 'org/slug' for another organization's.`;
-}
-/**
- * `slug` or `org/slug` → the reference, with `org` empty for the bare form
- * (the caller fills the parent's). Returns undefined for any other shape.
- */
-export function parseAgentReference(agent) {
-    const parts = agent.split("/");
-    if (parts.length === 1) {
-        return parts[0] === "" ? undefined : { org: "", slug: parts[0] };
-    }
-    if (parts.length === 2 && parts[0] !== "" && parts[1] !== "") {
-        return { org: parts[0], slug: parts[1] };
-    }
-    return undefined;
-}
-/**
- * Every `agent_call` task's agent as a reference, nested tasks included in
- * declaration order, the bare form resolved to `parentOrg`. Throws
- * INVALID_ARGUMENT on the first malformed string. A config that does not
- * decode is skipped: the spec validation step has already refused the
- * workflow for it, and this collector never double-reports.
- */
-export function collectAgentCallReferences(spec, parentOrg) {
-    const refs = [];
-    if (spec === undefined) {
-        return refs;
-    }
-    const visit = (task) => {
-        if (task.taskConfig !== undefined) {
-            let config;
-            try {
-                config = unmarshalTaskConfig(task.kind, task.taskConfig);
-            }
-            catch {
-                config = undefined;
-            }
-            if (config !== undefined) {
-                if (task.kind === WorkflowTaskKind.agent_call) {
-                    const agent = config.agent;
-                    const parsed = parseAgentReference(agent);
-                    if (parsed === undefined) {
-                        throw invalidArgumentError(malformedAgentReferenceMessage(task.name, agent));
-                    }
-                    refs.push({
-                        kind: ApiResourceKind.agent,
-                        org: parsed.org === "" ? parentOrg : parsed.org,
-                        slug: parsed.slug,
-                    });
-                }
-                for (const nested of nestedTasks(config)) {
-                    visit(nested);
-                }
-            }
-        }
-        for (const compensate of task.compensate) {
-            visit(compensate);
-        }
-    };
-    for (const task of spec.tasks) {
-        visit(task);
-    }
-    return refs;
-}
-export function newValidateAgentCallReferencesStep(store) {
-    return {
-        name: "ValidateAgentCallReferences",
-        async execute(ctx) {
-            const metadata = metadataOf(ctx.newState);
-            if (metadata === undefined) {
-                throw internalError(new Error("resource metadata is nil"), "validate agent_call references");
-            }
-            const refs = collectAgentCallReferences(ctx.newState.spec, metadata.org);
-            if (refs.length === 0) {
-                return;
-            }
-            const parent = {
-                org: metadata.org,
-                visibility: metadata.visibility,
-            };
-            const refusal = await checkReferences(store, parent, refs);
-            if (refusal !== undefined) {
-                throw refusal;
-            }
-        },
-    };
-}
-//# sourceMappingURL=agent-call-references.js.map

package/dist/domain/workflow/agent-call-references.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-call-references.js","sourceRoot":"","sources":["../../../src/domain/workflow/agent-call-references.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wDAAwD,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAO/E,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AAEtE,oFAAoF;AACpF,MAAM,UAAU,8BAA8B,CAC5C,QAAgB,EAChB,KAAa;IAEb,OAAO,SAAS,QAAQ,aAAa,KAAK,gHAAgH,CAAC;AAC7J,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAa;IAEb,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7D,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,IAA8B,EAC9B,SAAiB;IAEjB,MAAM,IAAI,GAAoB,EAAE,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,IAAkB,EAAQ,EAAE;QACzC,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,SAAS,CAAC;YACrB,CAAC;YACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,CAAC,UAAU,EAAE,CAAC;oBAC9C,MAAM,KAAK,GAAI,MAA8B,CAAC,KAAK,CAAC;oBACpD,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;oBAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;wBACzB,MAAM,oBAAoB,CACxB,8BAA8B,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CACjD,CAAC;oBACJ,CAAC;oBACD,IAAI,CAAC,IAAI,CAAC;wBACR,IAAI,EAAE,eAAe,CAAC,KAAK;wBAC3B,GAAG,EAAE,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG;wBAC/C,IAAI,EAAE,MAAM,CAAC,IAAI;qBAClB,CAAC,CAAC;gBACL,CAAC;gBACD,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;oBACzC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,KAAK,CAAC,UAAU,CAAC,CAAC;QACpB,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,KAAY;IAEZ,OAAO;QACL,IAAI,EAAE,6BAA6B;QACnC,KAAK,CAAC,OAAO,CAAC,GAA0C;YACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,0BAA0B,CAAC,EACrC,gCAAgC,CACjC,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,0BAA0B,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;YACzE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAoB;gBAC9B,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,OAAO,CAAC;YAChB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/store/public-visibility-retired.d.ts

@@ -1,67 +0,0 @@
-/**
- * The one data migration both store drivers run when the public visibility
- * level is retired: every stored row that holds `visibility_public` is moved
- * to `visibility_org`, once, in place. The drivers own the SQL (which rows
- * to read, how to write them back, the transaction); this module owns what
- * is edition- and driver-neutral: WHICH kinds could hold the level and HOW
- * one row's bytes are moved.
- *
- * Why a migration and not a sweep. The migration chain is the one place
- * that runs exactly once per database, before any request is served. A
- * public row nobody can set again would otherwise stay readable by every
- * account on a self-hosted install forever, because the level's grant was
- * derived from the row itself; on the hosted edition the rows are moved
- * through the API before this release deploys (the tuple lifecycle is
- * row-driven, and only that path deletes the grant's stored tuple), so the
- * migration there finds none and is the safety net, never the mechanism.
- *
- * Why the kind table is frozen here and not read from the live kind
- * configuration. A migration is a statement about the store AS IT WAS when
- * the level was retired: the seven kinds whose VisibilityConfig declared
- * `supports_public` at that moment are the only kinds a public row can
- * exist under, and a later release that adds or removes a kind must not
- * change what this step does. The list is spelled out with its schemas, the
- * per-consumer kind-to-schema idiom the tree already uses; nothing here
- * reads `kind_meta`. The `kind` strings are the enum NAMES the drivers'
- * `kind` column holds (proto-fields.ts `apiResourceKindName`).
- *
- * Why decode and re-encode rather than patch bytes. `resources.data` is the
- * marshaled proto message; the level is one enum field on the metadata
- * message, and only a decode knows where it is. protobuf-es keeps unknown
- * fields through `fromBinary` and writes them back in `toBinary`, so a row
- * written by a newer or older release than this one loses nothing it
- * carried; every other field is re-encoded from the same values. A row this
- * step cannot decode is a fault that fails the whole transaction (the
- * driver's `applyInTransaction` rolls back and the boot stops): skipping it
- * would leave the one row the migration exists for readable by everyone,
- * silently.
- *
- * `resource_audit` is deliberately untouched: it is the version history,
- * and a snapshot that said "public" at the time is true history. The search
- * index is left to boot's rebuild, which re-derives it from the rows.
- */
-import type { DescMessage } from "@bufbuild/protobuf";
-import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
-/** One kind that could hold the public level, with the schema its rows decode through. */
-export interface PublicRowKind {
-    /** The enum NAME the drivers' `kind` column holds. */
-    readonly kind: string;
-    readonly schema: DescMessage;
-}
-/**
- * The seven kinds whose VisibilityConfig declared `supports_public` when the
- * level was retired — frozen (the module header). Order is the order the
- * drivers walk the kinds; it has no other meaning.
- */
-export declare const PUBLIC_ROW_KINDS_AT_RETIREMENT: ReadonlyArray<PublicRowKind>;
-/** The level every moved row takes: the widest level that stays inside the owning organization. */
-export declare const LEVEL_AFTER_RETIREMENT = ApiResourceVisibility.visibility_org;
-/**
- * The moved bytes of one row when it holds the public level, or undefined
- * when it does not (the driver then leaves the row's bytes exactly as they
- * are; a row with no metadata holds no level and is one of these). Throws
- * when the bytes do not decode as the kind's message: a row this migration
- * cannot read is a row it must not pass over (the module header).
- */
-export declare function movePublicRowToOrg(entry: PublicRowKind, data: Uint8Array): Uint8Array | undefined;
-//# sourceMappingURL=public-visibility-retired.d.ts.map

package/dist/store/public-visibility-retired.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"public-visibility-retired.d.ts","sourceRoot":"","sources":["../../src/store/public-visibility-retired.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAWtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAE/F,0FAA0F;AAC1F,MAAM,WAAW,aAAa;IAC5B,sDAAsD;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,EAAE,aAAa,CAAC,aAAa,CAQvE,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,sBAAsB,uCAAuC,CAAC;AAE3E;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,aAAa,EACpB,IAAI,EAAE,UAAU,GACf,UAAU,GAAG,SAAS,CA4BxB"}

package/dist/store/public-visibility-retired.js

@@ -1,55 +0,0 @@
-import { fromBinary, toBinary } from "@bufbuild/protobuf";
-import { reflect } from "@bufbuild/protobuf/reflect";
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { AgentInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/api_pb";
-import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
-import { PluginSchema } from "@stigmer/protos/ai/stigmer/agentic/plugin/v1/api_pb";
-import { SkillSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
-import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
-import { WorkflowInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/api_pb";
-import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
-/**
- * The seven kinds whose VisibilityConfig declared `supports_public` when the
- * level was retired — frozen (the module header). Order is the order the
- * drivers walk the kinds; it has no other meaning.
- */
-export const PUBLIC_ROW_KINDS_AT_RETIREMENT = [
-    { kind: "agent", schema: AgentSchema },
-    { kind: "skill", schema: SkillSchema },
-    { kind: "mcp_server", schema: McpServerSchema },
-    { kind: "agent_instance", schema: AgentInstanceSchema },
-    { kind: "workflow", schema: WorkflowSchema },
-    { kind: "workflow_instance", schema: WorkflowInstanceSchema },
-    { kind: "plugin", schema: PluginSchema },
-];
-/** The level every moved row takes: the widest level that stays inside the owning organization. */
-export const LEVEL_AFTER_RETIREMENT = ApiResourceVisibility.visibility_org;
-/**
- * The moved bytes of one row when it holds the public level, or undefined
- * when it does not (the driver then leaves the row's bytes exactly as they
- * are; a row with no metadata holds no level and is one of these). Throws
- * when the bytes do not decode as the kind's message: a row this migration
- * cannot read is a row it must not pass over (the module header).
- */
-export function movePublicRowToOrg(entry, data) {
-    const message = fromBinary(entry.schema, data);
-    const root = reflect(entry.schema, message);
-    const metadataField = root.fields.find((field) => field.name === "metadata");
-    if (metadataField === undefined || metadataField.fieldKind !== "message") {
-        throw new Error(`${entry.kind}: the schema declares no metadata message field`);
-    }
-    if (!root.isSet(metadataField)) {
-        return undefined;
-    }
-    const metadata = root.get(metadataField);
-    const visibilityField = metadata.fields.find((field) => field.name === "visibility");
-    if (visibilityField === undefined || visibilityField.fieldKind !== "enum") {
-        throw new Error(`${entry.kind}: the metadata message declares no visibility enum field`);
-    }
-    if (metadata.get(visibilityField) !== ApiResourceVisibility.visibility_public) {
-        return undefined;
-    }
-    metadata.set(visibilityField, LEVEL_AFTER_RETIREMENT);
-    return toBinary(entry.schema, message);
-}
-//# sourceMappingURL=public-visibility-retired.js.map

package/dist/store/public-visibility-retired.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"public-visibility-retired.js","sourceRoot":"","sources":["../../src/store/public-visibility-retired.ts"],"names":[],"mappings":"AA2CA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4DAA4D,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAS/F;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAiC;IAC1E,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE;IACtC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE;IACtC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE;IAC/C,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,mBAAmB,EAAE;IACvD,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE;IAC5C,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,sBAAsB,EAAE;IAC7D,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE;CACzC,CAAC;AAEF,mGAAmG;AACnG,MAAM,CAAC,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,cAAc,CAAC;AAE3E;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAoB,EACpB,IAAgB;IAEhB,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAC7E,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,IAAI,iDAAiD,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACzC,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAC1C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,CACvC,CAAC;IACF,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,IAAI,0DAA0D,CACxE,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,qBAAqB,CAAC,iBAAiB,EACzE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;IACtD,OAAO,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC"}

package/src/domain/workflow/__tests__/agent-call-references.test.ts

@@ -1,222 +0,0 @@
-/**
- * Pins the workflow domain's collector for the reference rule
- * (../agent-call-references.ts): the strict `slug` / `org/slug` parser and
- * its refusal copy, the walk over top-level, nested and compensate tasks
- * in declaration order with the bare form resolved to the workflow's
- * organization, a config that does not decode skipped rather than
- * double-reported, and the step over a real store answering the rule's
- * verdicts — a missing agent with the rule's copy, another organization's
- * org-visible agent with the one cross-organization sentence, a
- * platform-visible one admitted.
- */
-import { create } from "@bufbuild/protobuf";
-import { Code, ConnectError } from "@connectrpc/connect";
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
-
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
-import { WorkflowTaskKind } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/enum_pb";
-import type { WorkflowSpec } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/spec_pb";
-import { WorkflowSpecSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/spec_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
-
-import { RequestContext } from "../../../pipeline/request-context.js";
-import { testCallerIdentity } from "../../../pipeline/__tests__/support.js";
-import {
-  missingReferencesMessage,
-  notAvailableReferenceMessage,
-  referenceTargetKind,
-} from "../../../pipeline/steps/references.js";
-import type { SqliteStore } from "../../../store/sqlite/store.js";
-import { tempStore } from "../../../store/sqlite/__tests__/support.js";
-import {
-  collectAgentCallReferences,
-  malformedAgentReferenceMessage,
-  newValidateAgentCallReferencesStep,
-  parseAgentReference,
-} from "../agent-call-references.js";
-
-const V = ApiResourceVisibility;
-const AGENT = referenceTargetKind(ApiResourceKind.agent)!;
-
-function agentCall(name: string, agent: string) {
-  return {
-    name,
-    kind: WorkflowTaskKind.agent_call,
-    taskConfig: { agent, message: "do the thing" },
-  };
-}
-
-function specOf(tasks: ReadonlyArray<Record<string, unknown>>): WorkflowSpec {
-  return create(WorkflowSpecSchema, { tasks } as never);
-}
-
-describe("parseAgentReference", () => {
-  it("accepts `slug` and `org/slug` and nothing else", () => {
-    expect(parseAgentReference("reviewer")).toEqual({
-      org: "",
-      slug: "reviewer",
-    });
-    expect(parseAgentReference("acme/reviewer")).toEqual({
-      org: "acme",
-      slug: "reviewer",
-    });
-    for (const malformed of ["", "/reviewer", "acme/", "a/b/c", "//"]) {
-      expect(parseAgentReference(malformed), malformed).toBeUndefined();
-    }
-  });
-});
-
-describe("collectAgentCallReferences", () => {
-  it("collects top-level, nested and compensate agent_call tasks in declaration order, the bare form resolved to the workflow's organization", () => {
-    const spec = specOf([
-      agentCall("first", "reviewer"),
-      {
-        name: "loop",
-        kind: WorkflowTaskKind.for_each,
-        taskConfig: {
-          each: "item",
-          in: "${ .items }",
-          // A nested task inside the Struct is JSON: proto field names.
-          do: [
-            {
-              name: "inner",
-              kind: "agent_call",
-              task_config: { agent: "globex/summarizer", message: "sum" },
-            },
-          ],
-        },
-        compensate: [agentCall("undo", "cleaner")],
-      },
-      {
-        name: "pause",
-        kind: WorkflowTaskKind.wait,
-        taskConfig: { duration: {} },
-      },
-    ]);
-    expect(collectAgentCallReferences(spec, "acme")).toEqual([
-      { kind: ApiResourceKind.agent, org: "acme", slug: "reviewer" },
-      { kind: ApiResourceKind.agent, org: "globex", slug: "summarizer" },
-      { kind: ApiResourceKind.agent, org: "acme", slug: "cleaner" },
-    ]);
-  });
-
-  it("refuses a malformed agent string naming the task", () => {
-    const spec = specOf([agentCall("broken", "a/b/c")]);
-    expect(() => collectAgentCallReferences(spec, "acme")).toThrow(
-      malformedAgentReferenceMessage("broken", "a/b/c"),
-    );
-    let error: unknown;
-    try {
-      collectAgentCallReferences(spec, "acme");
-    } catch (e) {
-      error = e;
-    }
-    expect((error as ConnectError).code).toBe(Code.InvalidArgument);
-  });
-
-  it("skips a config that does not decode — the spec validation step has already refused it", () => {
-    const spec = specOf([
-      {
-        name: "odd",
-        kind: WorkflowTaskKind.agent_call,
-        taskConfig: { agent: "reviewer", not_a_field: true },
-      },
-    ]);
-    expect(collectAgentCallReferences(spec, "acme")).toEqual([]);
-    expect(collectAgentCallReferences(undefined, "acme")).toEqual([]);
-  });
-});
-
-describe("ValidateAgentCallReferences over a store", () => {
-  let store: SqliteStore;
-  let cleanup: () => Promise<void>;
-
-  beforeEach(() => {
-    const temp = tempStore();
-    store = temp.store;
-    cleanup = temp.cleanup;
-  });
-
-  afterEach(async () => {
-    await cleanup();
-  });
-
-  async function seedAgent(
-    id: string,
-    org: string,
-    slug: string,
-    visibility: ApiResourceVisibility,
-  ): Promise<void> {
-    await store.saveResource(
-      ApiResourceKind.agent,
-      id,
-      AgentSchema,
-      create(AgentSchema, {
-        apiVersion: "agentic.stigmer.ai/v1",
-        kind: "Agent",
-        metadata: { id, name: slug, slug, org, visibility },
-        spec: { instructions: "a conformant instruction body" },
-      }),
-    );
-  }
-
-  function workflowCalling(...agents: string[]) {
-    return create(WorkflowSchema, {
-      apiVersion: "agentic.stigmer.ai/v1",
-      kind: "Workflow",
-      metadata: { name: "Pipeline", org: "acme", visibility: V.visibility_org },
-      spec: specOf(agents.map((agent, i) => agentCall(`call_${i}`, agent))),
-    });
-  }
-
-  async function run(workflow: ReturnType<typeof workflowCalling>) {
-    const ctx = new RequestContext(
-      WorkflowSchema,
-      workflow,
-      testCallerIdentity(),
-      ApiResourceKind.workflow,
-    );
-    try {
-      await newValidateAgentCallReferencesStep(store).execute(ctx);
-      return undefined;
-    } catch (error) {
-      return error;
-    }
-  }
-
-  it("a missing agent is refused with the rule's copy; an existing one passes", async () => {
-    const error = await run(workflowCalling("reviewer"));
-    expect(error).toBeInstanceOf(ConnectError);
-    expect((error as ConnectError).code).toBe(Code.FailedPrecondition);
-    expect((error as ConnectError).rawMessage).toBe(
-      missingReferencesMessage(AGENT, [{ slug: "reviewer", org: "acme" }]),
-    );
-    await seedAgent("agt_1", "acme", "reviewer", V.visibility_org);
-    expect(await run(workflowCalling("reviewer"))).toBeUndefined();
-  });
-
-  it("another organization's agent is admitted only at platform visibility, with the one sentence otherwise", async () => {
-    await seedAgent("agt_shared", "globex", "shared", V.visibility_platform);
-    await seedAgent("agt_internal", "globex", "internal", V.visibility_org);
-    expect(await run(workflowCalling("globex/shared"))).toBeUndefined();
-    const error = await run(workflowCalling("globex/internal"));
-    expect((error as ConnectError).rawMessage).toBe(
-      notAvailableReferenceMessage(AGENT, {
-        kind: ApiResourceKind.agent,
-        org: "globex",
-        slug: "internal",
-      }),
-    );
-  });
-
-  it("the floor holds for the agent a workflow calls: an org-visible workflow may not call a private agent", async () => {
-    await seedAgent("agt_mine", "acme", "mine", V.visibility_private);
-    const error = await run(workflowCalling("mine"));
-    expect((error as ConnectError).code).toBe(Code.FailedPrecondition);
-    expect((error as ConnectError).rawMessage).toContain(
-      "referenced agent 'acme/mine' is visibility_private while this resource is visibility_org",
-    );
-  });
-});