@stigmer/server 3.22.1-dev.20260922095755 → 3.22.1

package/src/domain/workflow/agent-call-references.ts

@@ -1,157 +0,0 @@
-/**
- * ValidateAgentCallReferences — the second collector for the reference rule
- * (pipeline/steps/references.ts): a workflow's `agent_call` tasks name their
- * agent as a STRING, `"slug"` or `"org/slug"`, inside a `google.protobuf.Struct`
- * config the generic spec walker cannot see, so the rule would never meet
- * them. This step parses each task's config through the converter's own
- * strict decoder (`unmarshalTaskConfig`, the one reader of a task config),
- * walks nested control-flow tasks exactly as the constraint validator does,
- * turns every `agent` string into a reference with the workflow as parent,
- * and asks the rule's one function — same clauses, same copy. It lives in
- * the workflow domain and not inside `InProcessValidator` because the
- * validator is pure over the spec by design and a rule that reads the
- * target's row cannot be.
- *
- * The parser here is STRICT: exactly `slug` or `org/slug`, both segments
- * non-empty, anything else refused at write naming the task. Two lenient
- * readers of the same string exist downstream and disagree with each other
- * (the runner's `parseAgentReference` in activities/call-agent.ts splits on
- * the first `/` and drops a third segment; the CLI's `parseReference` in
- * client-apps/cli/src/resources/reference.ts refuses a leading slash);
- * refusing every malformed shape here means neither ever meets one. The
- * three cannot share code — the packages share only the protos — so the
- * execution conformance suite is where their agreement is proven.
- *
- * Runs after NormalizeReferences and ValidateReferences on the workflow
- * create and update chains, so the org the walk sees is the workflow's own
- * for a bare slug. Proven by __tests__/agent-call-references.test.ts and
- * the workflow conformance suite's reference arm.
- */
-import type { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
-import type { AgentCallTaskConfig } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/agent_call_pb";
-import type {
-  WorkflowSpec,
-  WorkflowTask,
-} from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/spec_pb";
-import { WorkflowTaskKind } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/enum_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import type { Store } from "../../store/interface.js";
-import { internalError, invalidArgumentError } from "../../pipeline/errors.js";
-import type { PipelineStep } from "../../pipeline/pipeline.js";
-import type { RequestContext } from "../../pipeline/request-context.js";
-import type {
-  ReferenceParent,
-  SpecReference,
-} from "../../pipeline/steps/references.js";
-import { checkReferences } from "../../pipeline/steps/references.js";
-import { metadataOf } from "../../pipeline/steps/shapes.js";
-import { unmarshalTaskConfig } from "./converter/unmarshal.js";
-import { nestedTasks } from "./validation/task-config-constraints.js";
-
-/** The one sentence for an `agent` string that is neither `slug` nor `org/slug`. */
-export function malformedAgentReferenceMessage(
-  taskName: string,
-  agent: string,
-): string {
-  return `task '${taskName}': agent '${agent}' is not a reference; write 'slug' for an agent of this organization or 'org/slug' for another organization's.`;
-}
-
-/**
- * `slug` or `org/slug` → the reference, with `org` empty for the bare form
- * (the caller fills the parent's). Returns undefined for any other shape.
- */
-export function parseAgentReference(
-  agent: string,
-): { readonly org: string; readonly slug: string } | undefined {
-  const parts = agent.split("/");
-  if (parts.length === 1) {
-    return parts[0] === "" ? undefined : { org: "", slug: parts[0]! };
-  }
-  if (parts.length === 2 && parts[0] !== "" && parts[1] !== "") {
-    return { org: parts[0]!, slug: parts[1]! };
-  }
-  return undefined;
-}
-
-/**
- * Every `agent_call` task's agent as a reference, nested tasks included in
- * declaration order, the bare form resolved to `parentOrg`. Throws
- * INVALID_ARGUMENT on the first malformed string. A config that does not
- * decode is skipped: the spec validation step has already refused the
- * workflow for it, and this collector never double-reports.
- */
-export function collectAgentCallReferences(
-  spec: WorkflowSpec | undefined,
-  parentOrg: string,
-): SpecReference[] {
-  const refs: SpecReference[] = [];
-  if (spec === undefined) {
-    return refs;
-  }
-  const visit = (task: WorkflowTask): void => {
-    if (task.taskConfig !== undefined) {
-      let config;
-      try {
-        config = unmarshalTaskConfig(task.kind, task.taskConfig);
-      } catch {
-        config = undefined;
-      }
-      if (config !== undefined) {
-        if (task.kind === WorkflowTaskKind.agent_call) {
-          const agent = (config as AgentCallTaskConfig).agent;
-          const parsed = parseAgentReference(agent);
-          if (parsed === undefined) {
-            throw invalidArgumentError(
-              malformedAgentReferenceMessage(task.name, agent),
-            );
-          }
-          refs.push({
-            kind: ApiResourceKind.agent,
-            org: parsed.org === "" ? parentOrg : parsed.org,
-            slug: parsed.slug,
-          });
-        }
-        for (const nested of nestedTasks(config)) {
-          visit(nested);
-        }
-      }
-    }
-    for (const compensate of task.compensate) {
-      visit(compensate);
-    }
-  };
-  for (const task of spec.tasks) {
-    visit(task);
-  }
-  return refs;
-}
-
-export function newValidateAgentCallReferencesStep(
-  store: Store,
-): PipelineStep<typeof WorkflowSchema> {
-  return {
-    name: "ValidateAgentCallReferences",
-    async execute(ctx: RequestContext<typeof WorkflowSchema>): Promise<void> {
-      const metadata = metadataOf(ctx.newState);
-      if (metadata === undefined) {
-        throw internalError(
-          new Error("resource metadata is nil"),
-          "validate agent_call references",
-        );
-      }
-      const refs = collectAgentCallReferences(ctx.newState.spec, metadata.org);
-      if (refs.length === 0) {
-        return;
-      }
-      const parent: ReferenceParent = {
-        org: metadata.org,
-        visibility: metadata.visibility,
-      };
-      const refusal = await checkReferences(store, parent, refs);
-      if (refusal !== undefined) {
-        throw refusal;
-      }
-    },
-  };
-}

package/src/pipeline/__tests__/supports-visibility.test.ts

@@ -1,112 +0,0 @@
-/**
- * Pins `supportsVisibility` and `supportedVisibilityLevels`
- * (pipeline/apiresource-meta.ts), the one predicate behind the
- * ValidateVisibility doors on every create and updateVisibility chain.
- *
- * The retired public level is the reason this file exists: no kind config
- * declares it any more, so the predicate cannot read a flag for it and must
- * answer from its own text. The first test walks EVERY kind that has
- * `kind_meta` and asserts the level is refused; the door is one function,
- * and this is the pin that it holds for kinds nobody thought to try. The
- * rest of the file pins the levels that remain against the proto's
- * declarations for the kinds whose configs differ (a blueprint, an
- * instance, an org-only kind, a kind with no config), and the copy fragment
- * both editions build the INVALID_ARGUMENT sentence from.
- */
-import { describe, expect, it } from "vitest";
-
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
-
-import {
-  getKindMeta,
-  supportedVisibilityLevels,
-  supportsVisibility,
-} from "../apiresource-meta.js";
-
-const V = ApiResourceVisibility;
-
-/** Every enum member that carries kind_meta (the unknown kind does not). */
-const KINDS_WITH_META: ApiResourceKind[] = Object.values(ApiResourceKind)
-  .filter((value): value is ApiResourceKind => typeof value === "number")
-  .filter((kind) => {
-    try {
-      getKindMeta(kind);
-      return true;
-    } catch {
-      return false;
-    }
-  });
-
-describe("supportsVisibility", () => {
-  it("refuses the retired public level for every kind", () => {
-    expect(KINDS_WITH_META.length).toBeGreaterThan(20);
-    for (const kind of KINDS_WITH_META) {
-      expect(supportsVisibility(kind, V.visibility_public)).toBe(false);
-    }
-  });
-
-  it("private and unspecified are supported by every kind", () => {
-    for (const kind of KINDS_WITH_META) {
-      expect(supportsVisibility(kind, V.visibility_private)).toBe(true);
-      expect(
-        supportsVisibility(kind, V.api_resource_visibility_unspecified),
-      ).toBe(true);
-    }
-  });
-
-  it("a blueprint kind holds org and platform", () => {
-    expect(supportsVisibility(ApiResourceKind.agent, V.visibility_org)).toBe(
-      true,
-    );
-    expect(
-      supportsVisibility(ApiResourceKind.agent, V.visibility_platform),
-    ).toBe(true);
-  });
-
-  it("an instance kind holds org but never platform (tenant isolation)", () => {
-    expect(
-      supportsVisibility(ApiResourceKind.agent_instance, V.visibility_org),
-    ).toBe(true);
-    expect(
-      supportsVisibility(ApiResourceKind.agent_instance, V.visibility_platform),
-    ).toBe(false);
-  });
-
-  it("an org-only kind holds org alone (environment: secrets never cross the org)", () => {
-    expect(
-      supportsVisibility(ApiResourceKind.environment, V.visibility_org),
-    ).toBe(true);
-    expect(
-      supportsVisibility(ApiResourceKind.environment, V.visibility_platform),
-    ).toBe(false);
-  });
-
-  it("a kind with no visibility config is private-only", () => {
-    expect(supportsVisibility(ApiResourceKind.session, V.visibility_org)).toBe(
-      false,
-    );
-    expect(
-      supportsVisibility(ApiResourceKind.session, V.visibility_platform),
-    ).toBe(false);
-  });
-});
-
-describe("supportedVisibilityLevels (the copy fragment)", () => {
-  it("names the levels that remain, private first, never the retired one", () => {
-    expect(supportedVisibilityLevels(ApiResourceKind.agent)).toBe(
-      "visibility_private, visibility_org, visibility_platform",
-    );
-    expect(supportedVisibilityLevels(ApiResourceKind.agent_instance)).toBe(
-      "visibility_private, visibility_org",
-    );
-    expect(supportedVisibilityLevels(ApiResourceKind.session)).toBe(
-      "visibility_private",
-    );
-    for (const kind of KINDS_WITH_META) {
-      expect(supportedVisibilityLevels(kind)).not.toContain(
-        "visibility_public",
-      );
-    }
-  });
-});