@stigmer/server 3.22.1-dev.20260922095755 → 3.22.1

package/dist/pipeline/steps/references.js

@@ -1,254 +1,10 @@
-import { fromBinary, getOption, hasOption } from "@bufbuild/protobuf";
 import { reflect } from "@bufbuild/protobuf/reflect";
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { ChannelAppSchema } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/api_pb";
-import { EnvironmentSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
 import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
-import { SkillSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
-import { reference_kind } from "@stigmer/protos/ai/stigmer/commons/apiresource/field_options_pb";
-import { OAuthAppSchema } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
-import { failedPreconditionError, internalError, invalidArgumentError, } from "../errors.js";
+import { failedPreconditionError, internalError } from "../errors.js";
+import { findResourceBySlug } from "./helpers.js";
 import { messageFieldByName, metadataOf } from "./shapes.js";
 const API_RESOURCE_REFERENCE_TYPE = "ai.stigmer.commons.apiresource.ApiResourceReference";
-export const REFERENCE_TARGET_KINDS = [
-    {
-        kind: ApiResourceKind.skill,
-        schema: SkillSchema,
-        readByRun: true,
-        label: "skill(s)",
-        listHint: "stigmer list skills",
-    },
-    {
-        kind: ApiResourceKind.mcp_server,
-        schema: McpServerSchema,
-        readByRun: true,
-        label: "MCP server(s)",
-        listHint: "stigmer get mcp-servers",
-    },
-    {
-        kind: ApiResourceKind.agent,
-        schema: AgentSchema,
-        readByRun: true,
-        label: "agent(s)",
-        listHint: "stigmer list agents",
-    },
-    {
-        kind: ApiResourceKind.environment,
-        schema: EnvironmentSchema,
-        readByRun: false,
-        label: "environment(s)",
-        listHint: "stigmer list environments",
-    },
-    {
-        kind: ApiResourceKind.channel_app,
-        schema: ChannelAppSchema,
-        readByRun: false,
-        label: "channel app(s)",
-        listHint: "stigmer list channel-app",
-    },
-    {
-        kind: ApiResourceKind.oauth_app,
-        schema: OAuthAppSchema,
-        readByRun: false,
-        label: "OAuth app(s)",
-        listHint: undefined,
-    },
-];
-export function referenceTargetKind(kind) {
-    return REFERENCE_TARGET_KINDS.find((entry) => entry.kind === kind);
-}
-/**
- * Loads the rows the given references could name: one `listResources` per
- * distinct kind, decoded once, indexed by (org, slug). A row that does not
- * decode is skipped as the slug helpers skip it — it is not a row a
- * reference can reach. A reference whose kind is not in the table is a
- * contract the pin test has not admitted yet and is an internal fault.
- */
-export async function loadReferenceTargets(store, refs) {
-    const byKind = new Map();
-    for (const kind of new Set(refs.map((ref) => ref.kind))) {
-        const entry = referenceTargetKind(kind);
-        if (entry === undefined) {
-            throw internalError(new Error(`kind ${ApiResourceKind[kind] ?? kind} is not a reference target`), "reference rule table has no entry for the referenced kind");
-        }
-        const index = new Map();
-        for (const data of await store.listResources(kind)) {
-            let metadata;
-            try {
-                metadata = metadataOf(fromBinary(entry.schema, data));
-            }
-            catch {
-                continue;
-            }
-            if (metadata === undefined || metadata.slug === "") {
-                continue;
-            }
-            index.set(targetKey(metadata.org, metadata.slug), metadata.visibility);
-        }
-        byKind.set(kind, index);
-    }
-    return {
-        visibilityOf(ref) {
-            return byKind.get(ref.kind)?.get(targetKey(ref.org, ref.slug));
-        },
-    };
-}
-function targetKey(org, slug) {
-    return `${org}/${slug}`;
-}
-/** The three clauses of the module header, for one reference. */
-export function checkReference(targets, parent, ref) {
-    if (ref.org === "") {
-        return { kind: "no-org" };
-    }
-    const target = targets.visibilityOf(ref);
-    if (ref.org !== parent.org) {
-        return target === ApiResourceVisibility.visibility_platform
-            ? { kind: "ok" }
-            : { kind: "not-available" };
-    }
-    if (target === undefined) {
-        return { kind: "missing" };
-    }
-    const entry = referenceTargetKind(ref.kind);
-    if (entry?.readByRun === true &&
-        visibilityRank(target) < visibilityRank(parent.visibility)) {
-        return { kind: "below-floor", targetVisibility: target };
-    }
-    return { kind: "ok" };
-}
-/**
- * The order the floor compares on: private < org < platform, an unset
- * level reading as private (the level a row with no config holds). The
- * retired public level is unreachable here — refused at every door and
- * moved off every stored row by the store migration — so meeting it is a
- * fault, not a rank.
- */
-function visibilityRank(level) {
-    switch (level) {
-        case ApiResourceVisibility.api_resource_visibility_unspecified:
-        case ApiResourceVisibility.visibility_private:
-            return 0;
-        case ApiResourceVisibility.visibility_org:
-            return 1;
-        case ApiResourceVisibility.visibility_platform:
-            return 2;
-        case ApiResourceVisibility.visibility_public:
-            throw new Error("the retired public level has no rank");
-        default: {
-            const exhaustive = level;
-            throw new Error(`unknown visibility level: ${String(exhaustive)}`);
-        }
-    }
-}
-// ---------------------------------------------------------------------------
-// The copy.
-// ---------------------------------------------------------------------------
-/** Clause (i)'s sentence. */
-export function noOrgReferenceMessage(entry, slug) {
-    return `referenced ${entry.label} '${slug}' names no organization; a reference is 'org/slug', or 'slug' for a resource of this organization.`;
-}
-/**
- * Clause (ii)'s sentence for the targets not found, one per kind. The MCP
- * server form is the wire contract that predates the rule; the others are
- * its siblings.
- */
-export function missingReferencesMessage(entry, handles) {
-    const list = handles.map((h) => `'${h.slug}' (org: ${h.org})`).join(", ");
-    const hint = entry.listHint === undefined
-        ? ""
-        : ` Use '${entry.listHint}' to list available ${plural(entry)}.`;
-    return `referenced ${entry.label} not found: ${list}. Verify the slug and org are correct.${hint}`;
-}
-/** Clause (ii)'s floor sentence: the dependency and its level, against the resource's. */
-export function belowFloorMessage(entry, ref, targetVisibility, parentVisibility) {
-    return `referenced ${singular(entry)} '${ref.org}/${ref.slug}' is ${levelWord(targetVisibility)} while this resource is ${levelWord(parentVisibility)}; a resource may not be more visible than the ${plural(entry)} it runs with. Widen the referenced resource's visibility or narrow this one.`;
-}
-/** The level as the copy names it: an unset level reads as private, which is how every reader treats it. */
-function levelWord(level) {
-    return level === ApiResourceVisibility.api_resource_visibility_unspecified
-        ? ApiResourceVisibility[ApiResourceVisibility.visibility_private]
-        : ApiResourceVisibility[level];
-}
-/** Clause (iii)'s one sentence — the same whether the target is missing or not platform-visible. */
-export function notAvailableReferenceMessage(entry, ref) {
-    return `referenced ${singular(entry)} '${ref.org}/${ref.slug}' is not available to this organization; another organization's resource can be referenced only when that organization shares it at platform visibility.`;
-}
-/** "MCP server(s)" → "MCP server" and "MCP servers": the label's two readings. */
-function singular(entry) {
-    return entry.label.replace("(s)", "");
-}
-function plural(entry) {
-    return entry.label.replace("(s)", "s");
-}
-/**
- * The refusal for a set of verdicts, or undefined when every one is ok.
- * Missing same-organization targets are grouped per kind into one sentence
- * (the contract's shape); every other refusal is its own sentence; the
- * sentences are joined in the order the references were read. A no-org
- * reference is malformed input (INVALID_ARGUMENT); everything else is a
- * precondition the store does not meet (FAILED_PRECONDITION), the code the
- * MCP-server contract already answers.
- */
-export function referenceRefusal(parent, verdicts) {
-    // Missing same-organization targets, grouped per kind in the order the
-    // first of each kind was read.
-    const missingByKind = new Map();
-    for (const { ref, verdict } of verdicts) {
-        if (verdict.kind === "missing") {
-            const held = missingByKind.get(ref.kind);
-            if (held === undefined) {
-                missingByKind.set(ref.kind, [ref]);
-            }
-            else {
-                held.push(ref);
-            }
-        }
-    }
-    const sentences = [];
-    const groupedKindsSaid = new Set();
-    let malformed = false;
-    for (const { ref, verdict } of verdicts) {
-        const entry = referenceTargetKind(ref.kind);
-        if (entry === undefined) {
-            continue;
-        }
-        switch (verdict.kind) {
-            case "ok":
-                break;
-            case "no-org":
-                malformed = true;
-                sentences.push(noOrgReferenceMessage(entry, ref.slug));
-                break;
-            case "missing":
-                if (!groupedKindsSaid.has(ref.kind)) {
-                    groupedKindsSaid.add(ref.kind);
-                    sentences.push(missingReferencesMessage(entry, missingByKind.get(ref.kind) ?? []));
-                }
-                break;
-            case "below-floor":
-                sentences.push(belowFloorMessage(entry, ref, verdict.targetVisibility, parent.visibility));
-                break;
-            case "not-available":
-                sentences.push(notAvailableReferenceMessage(entry, ref));
-                break;
-            default: {
-                const exhaustive = verdict;
-                throw new Error(`unknown verdict: ${JSON.stringify(exhaustive)}`);
-            }
-        }
-    }
-    if (sentences.length === 0) {
-        return undefined;
-    }
-    const text = sentences.join(" ");
-    return malformed ? invalidArgumentError(text) : failedPreconditionError(text);
-}
-// ---------------------------------------------------------------------------
-// The steps.
-// ---------------------------------------------------------------------------
 export function newNormalizeReferencesStep() {
     return {
         name: "NormalizeReferences",
@@ -257,8 +13,8 @@ export function newNormalizeReferencesStep() {
             if (metadata === undefined) {
                 throw internalError(new Error("resource metadata is nil"), "normalize references");
             }
-            // No org to resolve from — skip silently; the rule's first clause
-            // refuses a reference left without one.
+            // No org to resolve from — skip silently; required-org validation is
+            // the validation step's responsibility, not this one's.
             if (metadata.org === "") {
                 return;
             }
@@ -275,115 +31,58 @@ export function newValidateReferencesStep(store) {
     return {
         name: "ValidateReferences",
         async execute(ctx) {
-            const metadata = metadataOf(ctx.newState);
-            if (metadata === undefined) {
-                throw internalError(new Error("resource metadata is nil"), "validate references");
-            }
-            const refs = collectSpecReferences(ctx.schema, ctx.newState).filter((ref) => ref.slug !== "");
-            if (refs.length === 0) {
-                return;
-            }
-            const parent = {
-                org: metadata.org,
-                visibility: metadata.visibility,
-            };
-            const refusal = await checkReferences(store, parent, refs);
-            if (refusal !== undefined) {
-                throw refusal;
-            }
-        },
-    };
-}
-/** The rule over a collected list: load once, check each, render the refusal. */
-export async function checkReferences(store, parent, refs) {
-    const targets = await loadReferenceTargets(store, refs);
-    return referenceRefusal(parent, refs.map((ref) => ({ ref, verdict: checkReference(targets, parent, ref) })));
-}
-/**
- * The floor's second door (the module header): on an updateVisibility chain,
- * after the loaded row is on the context under `targetKey` and after
- * ValidateVisibilityUpdate, refuses raising the level while a run-read
- * reference the row carries would end below it.
- */
-export function newGuardReferenceFloorOnEscalationStep(store, targetKey, collectors) {
-    return {
-        name: "GuardReferenceFloorOnEscalation",
-        async execute(ctx) {
-            const row = ctx.get(targetKey);
-            if (row === undefined) {
-                // Wiring error, not a user error: a guard that silently passes
-                // un-guards the boundary it exists to protect.
-                throw internalError(new Error("GuardReferenceFloorOnEscalation ran without a loaded target — the step must follow the load step"), "reference floor requires the loaded resource");
-            }
-            const metadata = metadataOf(row);
-            if (metadata === undefined) {
-                throw internalError(new Error("resource metadata is nil"), "reference floor requires the loaded resource");
-            }
-            const requested = ctx.input.visibility;
-            if (visibilityRank(requested) <= visibilityRank(metadata.visibility)) {
-                return;
-            }
-            const refs = collectors
-                .flatMap((collect) => collect(row))
-                .filter((ref) => ref.slug !== "");
-            if (refs.length === 0) {
-                return;
+            const refs = [];
+            forEachSpecReference(ctx.schema, ctx.newState, (ref) => {
+                refs.push({
+                    kind: numberField(ref, "kind"),
+                    slug: stringField(ref, "slug"),
+                    org: stringField(ref, "org"),
+                });
+            });
+            const missingMcpServers = [];
+            for (const ref of refs) {
+                if (ref.slug === "") {
+                    continue;
+                }
+                // Per-kind validation, exactly Go's switch: only mcp_server today.
+                if (ref.kind === ApiResourceKind.mcp_server) {
+                    const found = await findResourceBySlug(store, ApiResourceKind.mcp_server, McpServerSchema, ref.slug, ref.org);
+                    if (found === undefined) {
+                        missingMcpServers.push(`'${ref.slug}' (org: ${ref.org})`);
+                    }
+                }
             }
-            const parent = {
-                org: metadata.org,
-                visibility: requested,
-            };
-            const targets = await loadReferenceTargets(store, refs);
-            const refusal = referenceRefusal(parent, refs
-                .map((ref) => ({
-                ref,
-                verdict: checkReference(targets, parent, ref),
-            }))
-                .filter(({ verdict }) => verdict.kind === "below-floor"));
-            if (refusal !== undefined) {
-                throw refusal;
+            if (missingMcpServers.length > 0) {
+                throw failedPreconditionError(`referenced MCP server(s) not found: ${missingMcpServers.join(", ")}. ` +
+                    "Verify the slug and org are correct. " +
+                    "Use 'stigmer get mcp-servers' to list available MCP servers.");
             }
         },
     };
 }
-// ---------------------------------------------------------------------------
-// The walk.
-// ---------------------------------------------------------------------------
 /**
- * Every ApiResourceReference in a resource's spec, each with the kind its
- * field declares — the walk both steps run, exported for the readers that
- * ask the reverse question ("who references this?"): the plugin delete
- * guard scans an organization's agents and workflows for references to a
- * member it is about to remove.
+ * Every ApiResourceReference in a resource's spec — the same walk
+ * ValidateReferences runs, exported for the readers that ask the reverse
+ * question ("who references this?"): the plugin delete guard scans an
+ * organization's agents and workflows for references to a member it is
+ * about to remove.
  */
 export function collectSpecReferences(schema, msg) {
     const refs = [];
-    forEachSpecReference(schema, msg, (ref, field) => {
+    forEachSpecReference(schema, msg, (ref) => {
         refs.push({
-            kind: declaredKind(field, ref),
+            kind: numberField(ref, "kind"),
             slug: stringField(ref, "slug"),
             org: stringField(ref, "org"),
         });
     });
     return refs;
 }
-/**
- * The kind a reference names: the field's `reference_kind` option when the
- * contract declares one (every reference field does), else the kind the
- * message carries (the walk's only fallback, for a field the contract has
- * not annotated).
- */
-function declaredKind(field, ref) {
-    if (hasOption(field, reference_kind)) {
-        return getOption(field, reference_kind);
-    }
-    return numberField(ref, "kind");
-}
 /**
  * Walks the resource's spec and invokes fn on every ApiResourceReference
- * (singular, repeated, and map-valued message fields, recursively) with
- * the field that holds it. Mutations through the ReflectMessage write
- * through.
+ * (singular, repeated, and map-valued message fields, recursively) —
+ * the shared traversal behind both steps (Go walkAndResolveOrg /
+ * walkAndCollectRefs). Mutations through the ReflectMessage write through.
  */
 function forEachSpecReference(schema, msg, fn) {
     const root = reflect(schema, msg);
@@ -400,7 +99,7 @@ function walk(msg, fn) {
                 continue;
             }
             for (const item of msg.get(field)) {
-                visit(item, field, fn);
+                visit(item, fn);
             }
         }
         else if (field.fieldKind === "map") {
@@ -409,20 +108,20 @@ function walk(msg, fn) {
             }
             const map = msg.get(field);
             for (const [, value] of map) {
-                visit(value, field, fn);
+                visit(value, fn);
             }
         }
         else if (field.fieldKind === "message") {
             if (!msg.isSet(field)) {
                 continue;
             }
-            visit(msg.get(field), field, fn);
+            visit(msg.get(field), fn);
         }
     }
 }
-function visit(sub, field, fn) {
+function visit(sub, fn) {
     if (sub.desc.typeName === API_RESOURCE_REFERENCE_TYPE) {
-        fn(sub, field);
+        fn(sub);
     }
     else {
         walk(sub, fn);

package/dist/pipeline/steps/references.js.map

@@ -1 +1 @@
-{"version":3,"file":"references.js","sourceRoot":"","sources":["../../../src/pipeline/steps/references.ts"],"names":[],"mappings":"AAgFA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAGrD,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yDAAyD,CAAC;AAC3F,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EAAE,cAAc,EAAE,MAAM,iEAAiE,CAAC;AAEjG,OAAO,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AAGnF,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE7D,MAAM,2BAA2B,GAC/B,qDAAqD,CAAC;AAkBxD,MAAM,CAAC,MAAM,sBAAsB,GAAuC;IACxE;QACE,IAAI,EAAE,eAAe,CAAC,KAAK;QAC3B,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,qBAAqB;KAChC;IACD;QACE,IAAI,EAAE,eAAe,CAAC,UAAU;QAChC,MAAM,EAAE,eAAe;QACvB,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,eAAe;QACtB,QAAQ,EAAE,yBAAyB;KACpC;IACD;QACE,IAAI,EAAE,eAAe,CAAC,KAAK;QAC3B,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,qBAAqB;KAChC;IACD;QACE,IAAI,EAAE,eAAe,CAAC,WAAW;QACjC,MAAM,EAAE,iBAAiB;QACzB,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,gBAAgB;QACvB,QAAQ,EAAE,2BAA2B;KACtC;IACD;QACE,IAAI,EAAE,eAAe,CAAC,WAAW;QACjC,MAAM,EAAE,gBAAgB;QACxB,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,gBAAgB;QACvB,QAAQ,EAAE,0BAA0B;KACrC;IACD;QACE,IAAI,EAAE,eAAe,CAAC,SAAS;QAC/B,MAAM,EAAE,cAAc;QACtB,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,cAAc;QACrB,QAAQ,EAAE,SAAS;KACpB;CACF,CAAC;AAEF,MAAM,UAAU,mBAAmB,CACjC,IAAqB;IAErB,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACrE,CAAC;AAuCD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAY,EACZ,IAAkC;IAElC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuD,CAAC;IAC9E,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,QAAQ,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAClE,EACD,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiC,CAAC;QACvD,KAAK,MAAM,IAAI,IAAI,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,IAAI,QAAQ,CAAC;YACb,IAAI,CAAC;gBACH,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACnD,SAAS;YACX,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO;QACL,YAAY,CAAC,GAAG;YACd,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,IAAY;IAC1C,OAAO,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,cAAc,CAC5B,OAAyB,EACzB,MAAuB,EACvB,GAAkB;IAElB,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;QAC3B,OAAO,MAAM,KAAK,qBAAqB,CAAC,mBAAmB;YACzD,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YAChB,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,IACE,KAAK,EAAE,SAAS,KAAK,IAAI;QACzB,cAAc,CAAC,MAAM,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,EAC1D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,KAA4B;IAClD,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,qBAAqB,CAAC,mCAAmC,CAAC;QAC/D,KAAK,qBAAqB,CAAC,kBAAkB;YAC3C,OAAO,CAAC,CAAC;QACX,KAAK,qBAAqB,CAAC,cAAc;YACvC,OAAO,CAAC,CAAC;QACX,KAAK,qBAAqB,CAAC,mBAAmB;YAC5C,OAAO,CAAC,CAAC;QACX,KAAK,qBAAqB,CAAC,iBAAiB;YAC1C,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,6BAA6B;AAC7B,MAAM,UAAU,qBAAqB,CACnC,KAA0B,EAC1B,IAAY;IAEZ,OAAO,cAAc,KAAK,CAAC,KAAK,KAAK,IAAI,oGAAoG,CAAC;AAChJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAA0B,EAC1B,OAAuE;IAEvE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,MAAM,IAAI,GACR,KAAK,CAAC,QAAQ,KAAK,SAAS;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,SAAS,KAAK,CAAC,QAAQ,uBAAuB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;IACrE,OAAO,cAAc,KAAK,CAAC,KAAK,eAAe,IAAI,yCAAyC,IAAI,EAAE,CAAC;AACrG,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,iBAAiB,CAC/B,KAA0B,EAC1B,GAAkB,EAClB,gBAAuC,EACvC,gBAAuC;IAEvC,OAAO,cAAc,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,QAAQ,SAAS,CAAC,gBAAgB,CAAC,2BAA2B,SAAS,CAAC,gBAAgB,CAAC,iDAAiD,MAAM,CAAC,KAAK,CAAC,+EAA+E,CAAC;AACrS,CAAC;AAED,4GAA4G;AAC5G,SAAS,SAAS,CAAC,KAA4B;IAC7C,OAAO,KAAK,KAAK,qBAAqB,CAAC,mCAAmC;QACxE,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,kBAAkB,CAAC;QACjE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,4BAA4B,CAC1C,KAA0B,EAC1B,GAAkB;IAElB,OAAO,cAAc,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,0JAA0J,CAAC;AACzN,CAAC;AAED,kFAAkF;AAClF,SAAS,QAAQ,CAAC,KAA0B;IAC1C,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,MAAM,CAAC,KAA0B;IACxC,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAuB,EACvB,QAGE;IAEF,uEAAuE;IACvE,+BAA+B;IAC/B,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoC,CAAC;IAClE,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAmB,CAAC;IACpD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,IAAI;gBACP,MAAM;YACR,KAAK,QAAQ;gBACX,SAAS,GAAG,IAAI,CAAC;gBACjB,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBACvD,MAAM;YACR,KAAK,SAAS;gBACZ,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC/B,SAAS,CAAC,IAAI,CACZ,wBAAwB,CAAC,KAAK,EAAE,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CACnE,CAAC;gBACJ,CAAC;gBACD,MAAM;YACR,KAAK,aAAa;gBAChB,SAAS,CAAC,IAAI,CACZ,iBAAiB,CACf,KAAK,EACL,GAAG,EACH,OAAO,CAAC,gBAAgB,EACxB,MAAM,CAAC,UAAU,CAClB,CACF,CAAC;gBACF,MAAM;YACR,KAAK,eAAe;gBAClB,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;gBACzD,MAAM;YACR,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,UAAU,GAAU,OAAO,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;AAChF,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,MAAM,UAAU,0BAA0B;IAGxC,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,OAAO,CAAC,GAAyB;YAC/B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,0BAA0B,CAAC,EACrC,sBAAsB,CACvB,CAAC;YACJ,CAAC;YACD,kEAAkE;YAClE,wCAAwC;YACxC,IAAI,QAAQ,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;gBACrD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;gBAC1D,IAAI,QAAQ,KAAK,SAAS,IAAK,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAY,KAAK,EAAE,EAAE,CAAC;oBACnE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAY;IAEZ,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,0BAA0B,CAAC,EACrC,qBAAqB,CACtB,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CACjE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CACzB,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAoB;gBAC9B,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,OAAO,CAAC;YAChB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAY,EACZ,MAAuB,EACvB,IAAkC;IAElC,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxD,OAAO,gBAAgB,CACrB,MAAM,EACN,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAC5E,CAAC;AACJ,CAAC;AAKD;;;;;GAKG;AACH,MAAM,UAAU,sCAAsC,CACpD,KAAY,EACZ,SAAiB,EACjB,UAA6C;IAE7C,OAAO;QACL,IAAI,EAAE,iCAAiC;QACvC,KAAK,CAAC,OAAO,CACX,GAAuD;YAEvD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAwB,CAAC;YACtD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,+DAA+D;gBAC/D,+CAA+C;gBAC/C,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,kGAAkG,CACnG,EACD,8CAA8C,CAC/C,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,0BAA0B,CAAC,EACrC,8CAA8C,CAC/C,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;YACvC,IAAI,cAAc,CAAC,SAAS,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrE,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,UAAU;iBACpB,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;iBAClC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAoB;gBAC9B,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,UAAU,EAAE,SAAS;aACtB,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,gBAAgB,CAC9B,MAAM,EACN,IAAI;iBACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACb,GAAG;gBACH,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC;aAC9C,CAAC,CAAC;iBACF,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa,CAAC,CAC3D,CAAC;YACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,OAAO,CAAC;YAChB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAmB,EACnB,GAAkC;IAElC,MAAM,IAAI,GAAoB,EAAE,CAAC;IACjC,oBAAoB,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/C,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC;YAC9B,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC;YAC9B,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAgB,EAAE,GAAmB;IACzD,IAAI,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC;QACrC,OAAO,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,EAAE,MAAM,CAAoB,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,MAAmB,EACnB,GAAkC,EAClC,EAAmD;IAEnD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACtD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,IAAI,CACX,GAAmB,EACnB,EAAmD;IAEnD,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YAC/B,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACjC,SAAS;YACX,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,KAAK,CAAC,IAAsB,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YACrC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAChC,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC;gBAC5B,KAAK,CAAC,KAAuB,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CACZ,GAAmB,EACnB,KAAgB,EAChB,EAAmD;IAEnD,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,2BAA2B,EAAE,CAAC;QACtD,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAmB,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,GAAmB,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"references.js","sourceRoot":"","sources":["../../../src/pipeline/steps/references.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAGrD,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE7D,MAAM,2BAA2B,GAC/B,qDAAqD,CAAC;AAExD,MAAM,UAAU,0BAA0B;IAGxC,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,OAAO,CAAC,GAAyB;YAC/B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,0BAA0B,CAAC,EACrC,sBAAsB,CACvB,CAAC;YACJ,CAAC;YACD,qEAAqE;YACrE,wDAAwD;YACxD,IAAI,QAAQ,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;gBACrD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;gBAC1D,IAAI,QAAQ,KAAK,SAAS,IAAK,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAY,KAAK,EAAE,EAAE,CAAC;oBACnE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAY;IAEZ,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,IAAI,GAAuD,EAAE,CAAC;YACpE,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;gBACrD,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC;oBAC9B,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC;oBAC9B,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC;iBAC7B,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,MAAM,iBAAiB,GAAa,EAAE,CAAC;YACvC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;oBACpB,SAAS;gBACX,CAAC;gBACD,mEAAmE;gBACnE,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,CAAC,UAAU,EAAE,CAAC;oBAC5C,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,KAAK,EACL,eAAe,CAAC,UAAU,EAC1B,eAAe,EACf,GAAG,CAAC,IAAI,EACR,GAAG,CAAC,GAAG,CACR,CAAC;oBACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACxB,iBAAiB,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,WAAW,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;oBAC5D,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,uBAAuB,CAC3B,uCAAuC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBACrE,uCAAuC;oBACvC,8DAA8D,CACjE,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAmB,EACnB,GAAkC;IAElC,MAAM,IAAI,GAAoB,EAAE,CAAC;IACjC,oBAAoB,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;QACxC,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,CAAoB;YACjD,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC;YAC9B,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,MAAmB,EACnB,GAAkC,EAClC,EAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACtD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,EAAiC;IAClE,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YAC/B,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACjC,SAAS;YACX,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,KAAK,CAAC,IAAsB,EAAE,EAAE,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YACrC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAChC,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC;gBAC5B,KAAK,CAAC,KAAuB,EAAE,EAAE,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,GAAmB,EAAE,EAAiC;IACnE,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,2BAA2B,EAAE,CAAC;QACtD,EAAE,CAAC,GAAG,CAAC,CAAC;IACV,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAmB,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,GAAmB,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC"}

package/dist/pipeline/steps/visibility-gates.d.ts

@@ -0,0 +1,27 @@
+import type { DescMessage } from "@bufbuild/protobuf";
+import type { Authorizer } from "../../extensions/authorizer.js";
+import type { CallerIdentity } from "../../extensions/identity.js";
+import type { PipelineStep } from "../pipeline.js";
+/**
+ * The denial callers see at both doors (the Java policy copy verbatim).
+ * Deliberately not byte-pinned by the OSS conformance suite; the cloud
+ * gate itself is recorded via the clientPublicVisibilityWrites flag.
+ */
+export declare const PUBLIC_VISIBILITY_DENY_MESSAGE: string;
+/** The CREATE door: a new state declaring PUBLIC needs the operator grant. */
+export declare function newGuardPublicVisibilityStep<Desc extends DescMessage>(authorizer: Authorizer): PipelineStep<Desc>;
+/**
+ * The UPDATE door: escalation to PUBLIC (the stored level is anything
+ * else) needs the operator grant. Reads the loaded target from the
+ * chain's own context key (every updateVisibility chain stores it —
+ * the RecordVisibilityBeforeUpdate pattern).
+ */
+export declare function newAuthorizeVisibilityTransitionStep<Desc extends DescMessage>(targetKey: string, authorizer: Authorizer): PipelineStep<Desc>;
+/**
+ * The single owner of "may this caller set public?" — both doors call it,
+ * and so does the plugin push chain, whose requested level rides the
+ * request (the level then flows to every member through the members' own
+ * create and updateVisibility doors, which run this check again).
+ */
+export declare function requireOperatorMaySetPublic(authorizer: Authorizer, caller: CallerIdentity): Promise<void>;
+//# sourceMappingURL=visibility-gates.d.ts.map

package/dist/pipeline/steps/visibility-gates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"visibility-gates.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/visibility-gates.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAOtD,OAAO,KAAK,EAAE,UAAU,EAAiB,MAAM,gCAAgC,CAAC;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAInD;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,QAEU,CAAC;AAEtD,8EAA8E;AAC9E,wBAAgB,4BAA4B,CAAC,IAAI,SAAS,WAAW,EACnE,UAAU,EAAE,UAAU,GACrB,YAAY,CAAC,IAAI,CAAC,CAgBpB;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAAC,IAAI,SAAS,WAAW,EAC3E,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,UAAU,GACrB,YAAY,CAAC,IAAI,CAAC,CA+BpB;AAED;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CA6Bf"}

package/dist/pipeline/steps/visibility-gates.js

@@ -0,0 +1,139 @@
+/**
+ * The PUBLIC-visibility operator gates — the two write doors a resource
+ * can become public through, both consulting the ONE composed Authorizer
+ * with the same platform-scoped check (the Java
+ * PublicVisibilityEscalationPolicy port; C2 Stage 3, 20260827.10).
+ *
+ * PUBLIC is the only level that crosses every org boundary (one flip
+ * lists a resource in every tenant's cross-org catalog), so entering it
+ * is a curation decision: the owner requests, the platform team grants.
+ * The answer is `can_set_public_visibility` on `platform:stigmer` — a
+ * named operator capability, never a bare operator lookup.
+ *
+ *   - GuardPublicVisibility: the CREATE door, in the create chains of
+ *     the kinds whose VisibilityConfig supports PUBLIC (agent, workflow,
+ *     mcp_server, agent_instance, workflow_instance). After
+ *     BuildNewState — it inspects the state that will persist — which
+ *     keeps the pinned INVALID_ARGUMENT level-support rejections (the
+ *     earlier ValidateVisibility) their precedence over this
+ *     PERMISSION_DENIED.
+ *   - AuthorizeVisibilityTransition: the UPDATE door, in every
+ *     updateVisibility chain after ValidateVisibilityUpdate (the pinned
+ *     FAILED_PRECONDITION default-instance rejection keeps precedence,
+ *     the Java ordering the conformance suite depends on). Gates only
+ *     the ESCALATION to public (stored level is anything else).
+ *
+ * Both run LAZILY — only requests that actually involve the PUBLIC level
+ * reach the Authorizer — and both pass for internal callers (server-side
+ * flows publish platform resources by design). The OSS permissive
+ * default allows, so the local posture keeps today's behavior
+ * byte-identically; the cloud's FGA Authorizer supplies the gate.
+ *
+ * DELIBERATE partial port, recorded owner-visibly (Stage-3 execution
+ * record): Java's transition step additionally lets operators WITHOUT
+ * resource can_edit publish and take down (its updateVisibility chains
+ * authorize post-load, transition-aware); this edition's position-1
+ * Authorize enforces can_edit on updateVisibility before any step here
+ * runs, so those operator-without-edit lanes require can_edit until the
+ * Stage-4 chain disposition addresses them. No conformance lane pins
+ * them.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { internalError } from "../errors.js";
+import { metadataOf } from "./shapes.js";
+/**
+ * The denial callers see at both doors (the Java policy copy verbatim).
+ * Deliberately not byte-pinned by the OSS conformance suite; the cloud
+ * gate itself is recorded via the clientPublicVisibilityWrites flag.
+ */
+export const PUBLIC_VISIBILITY_DENY_MESSAGE = "Public visibility is granted by the platform team. " +
+    "Ask a platform operator to publish this resource.";
+/** The CREATE door: a new state declaring PUBLIC needs the operator grant. */
+export function newGuardPublicVisibilityStep(authorizer) {
+    return {
+        name: "GuardPublicVisibility",
+        async execute(ctx) {
+            if (ctx.callerIdentity.callerClass === "internal") {
+                return;
+            }
+            if (metadataOf(ctx.newState)?.visibility !==
+                ApiResourceVisibility.visibility_public) {
+                return;
+            }
+            await requireOperatorMaySetPublic(authorizer, ctx.callerIdentity);
+        },
+    };
+}
+/**
+ * The UPDATE door: escalation to PUBLIC (the stored level is anything
+ * else) needs the operator grant. Reads the loaded target from the
+ * chain's own context key (every updateVisibility chain stores it —
+ * the RecordVisibilityBeforeUpdate pattern).
+ */
+export function newAuthorizeVisibilityTransitionStep(targetKey, authorizer) {
+    return {
+        name: "AuthorizeVisibilityTransition",
+        async execute(ctx) {
+            if (ctx.callerIdentity.callerClass === "internal") {
+                return;
+            }
+            const requested = ctx.input
+                .visibility;
+            if (requested !== ApiResourceVisibility.visibility_public) {
+                return;
+            }
+            const target = ctx.get(targetKey);
+            if (target === undefined) {
+                // Wiring error, not a user error: without the loaded target there
+                // is no stored level, and a gate that silently passes un-guards
+                // the boundary it exists to protect.
+                throw internalError(new Error("AuthorizeVisibilityTransition ran without a loaded target — step must be placed after the load step"), "visibility authorization requires the loaded resource");
+            }
+            const stored = metadataOf(target)?.visibility;
+            if (stored === ApiResourceVisibility.visibility_public) {
+                return; // Re-asserting a stored PUBLIC is not an escalation.
+            }
+            await requireOperatorMaySetPublic(authorizer, ctx.callerIdentity);
+        },
+    };
+}
+/**
+ * The single owner of "may this caller set public?" — both doors call it,
+ * and so does the plugin push chain, whose requested level rides the
+ * request (the level then flows to every member through the members' own
+ * create and updateVisibility doors, which run this check again).
+ */
+export async function requireOperatorMaySetPublic(authorizer, caller) {
+    let decision;
+    try {
+        decision = await authorizer.authorize(caller, {
+            permission: IamPermission.can_set_public_visibility,
+            resourceKind: ApiResourceKind.platform,
+            resourceId: "stigmer",
+        });
+    }
+    catch (error) {
+        throw publicVisibilityCheckFailure(error);
+    }
+    switch (decision.kind) {
+        case "allow":
+            return;
+        case "deny":
+        case "not-found":
+            throw new ConnectError(PUBLIC_VISIBILITY_DENY_MESSAGE, Code.PermissionDenied);
+        case "unavailable":
+            throw publicVisibilityCheckFailure(decision.cause);
+        default: {
+            const exhaustive = decision;
+            throw publicVisibilityCheckFailure(new Error(`unknown decision ${JSON.stringify(exhaustive)}`));
+        }
+    }
+}
+/** Authorization infrastructure failure: fail closed, sanitized (#478). */
+function publicVisibilityCheckFailure(error) {
+    return internalError(error instanceof Error ? error : new Error(String(error)), "public-visibility authorization could not be completed");
+}
+//# sourceMappingURL=visibility-gates.js.map