@stigmer/server 3.23.1-dev.20260923075205 → 3.24.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/domain/workflow/agent-call-references.d.ts +60 -33
- package/dist/domain/workflow/agent-call-references.d.ts.map +1 -1
- package/dist/domain/workflow/agent-call-references.js +43 -23
- package/dist/domain/workflow/agent-call-references.js.map +1 -1
- package/dist/domain/workflow/registry/data/task-kind-registry.json +2 -2
- package/dist/pipeline/apiresource-labels.d.ts +10 -9
- package/dist/pipeline/apiresource-labels.d.ts.map +1 -1
- package/dist/pipeline/apiresource-labels.js +10 -9
- package/dist/pipeline/apiresource-labels.js.map +1 -1
- package/dist/pipeline/steps/references.d.ts +30 -4
- package/dist/pipeline/steps/references.d.ts.map +1 -1
- package/dist/pipeline/steps/references.js +13 -1
- package/dist/pipeline/steps/references.js.map +1 -1
- package/package.json +6 -6
- package/src/domain/workflow/__tests__/agent-call-references.test.ts +178 -27
- package/src/domain/workflow/agent-call-references.ts +95 -48
- package/src/domain/workflow/registry/data/task-kind-registry.json +2 -2
- package/src/pipeline/apiresource-labels.ts +10 -9
- package/src/pipeline/steps/__tests__/references.test.ts +35 -1
- package/src/pipeline/steps/references.ts +49 -5
|
@@ -1,53 +1,80 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* ValidateAgentCallReferences — the second collector for the reference rule
|
|
3
3
|
* (pipeline/steps/references.ts): a workflow's `agent_call` tasks name their
|
|
4
|
-
* agent as a STRING
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
*
|
|
8
|
-
*
|
|
9
|
-
*
|
|
10
|
-
* and asks the rule's one function — same clauses, same copy. It
|
|
11
|
-
* the workflow domain and not inside `InProcessValidator` because
|
|
12
|
-
* validator is pure over the spec by design and a rule that reads the
|
|
4
|
+
* agent as a STRING inside a `google.protobuf.Struct` config the generic
|
|
5
|
+
* spec walker cannot see, so the rule would never meet them. This step
|
|
6
|
+
* parses each task's config through the converter's own strict decoder
|
|
7
|
+
* (`unmarshalTaskConfig`, the one reader of a task config), walks nested
|
|
8
|
+
* control-flow tasks exactly as the constraint validator does, turns every
|
|
9
|
+
* `agent` string the write can judge into a reference with the workflow as
|
|
10
|
+
* parent, and asks the rule's one function — same clauses, same copy. It
|
|
11
|
+
* lives in the workflow domain and not inside `InProcessValidator` because
|
|
12
|
+
* the validator is pure over the spec by design and a rule that reads the
|
|
13
13
|
* target's row cannot be.
|
|
14
14
|
*
|
|
15
|
-
* The
|
|
16
|
-
*
|
|
17
|
-
*
|
|
18
|
-
*
|
|
19
|
-
*
|
|
20
|
-
*
|
|
21
|
-
*
|
|
22
|
-
*
|
|
23
|
-
*
|
|
15
|
+
* The string has three forms (the `agent` field's contract in
|
|
16
|
+
* agent_call.proto), told apart by `classifyAgentReference`:
|
|
17
|
+
*
|
|
18
|
+
* - `org/slug`, a LITERAL: judged now, like any stored reference;
|
|
19
|
+
* - a bare `slug`, RELATIVE: the runner resolves it in the organization
|
|
20
|
+
* the workflow runs in (`__stigmer_org_id`, the execution's), which is
|
|
21
|
+
* not the workflow's when a person runs it from another organization by
|
|
22
|
+
* id. It is judged now in the workflow's own organization with its
|
|
23
|
+
* floor capped at org (references.ts, "RELATIVE");
|
|
24
|
+
* - a value holding `${`, fixed only AT RUN: the runner's jq phase
|
|
25
|
+
* (`${ expr }`, whole or embedded) or its activity phase
|
|
26
|
+
* (`${.env_vars.KEY}`, `${.secrets.KEY}`) produces the reference when
|
|
27
|
+
* the task runs. The write collects nothing for it; the run reads the
|
|
28
|
+
* resolved agent as the person who ran the workflow, as it reads every
|
|
29
|
+
* id-bound binding. The slug grammar (metadata.proto) can never contain
|
|
30
|
+
* `${`, so the test is exact. It deliberately does not recognise only
|
|
31
|
+
* the runner's shapes: that would be a second copy of the runner's
|
|
32
|
+
* grammar in a package that shares only the protos with it, and a
|
|
33
|
+
* mistyped expression already fails at run with the read's not-found.
|
|
34
|
+
*
|
|
35
|
+
* Anything else is refused at write naming the task. The runner's own
|
|
36
|
+
* parser (`parseAgentReference` in runner/src/activities/call-agent.ts) is
|
|
37
|
+
* lenient — it splits on the first `/` and drops a third segment — and the
|
|
38
|
+
* CLI's `parseReference` (client-apps/cli/src/resources/reference.ts)
|
|
39
|
+
* refuses a leading slash; refusing every malformed literal here means
|
|
40
|
+
* neither ever meets one. The three cannot share code; the conformance
|
|
41
|
+
* suites are where their agreement is proven.
|
|
24
42
|
*
|
|
25
43
|
* Runs after NormalizeReferences and ValidateReferences on the workflow
|
|
26
|
-
* create and update chains,
|
|
27
|
-
*
|
|
28
|
-
*
|
|
44
|
+
* create and update chains, and feeds the workflow's escalation door
|
|
45
|
+
* (controller.ts). Proven by __tests__/agent-call-references.test.ts, the
|
|
46
|
+
* workflow conformance suite's agent_call reference arm, and the
|
|
47
|
+
* runner-as-subject execution arm for a reference fixed only at run.
|
|
29
48
|
*/
|
|
30
49
|
import type { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
|
|
31
50
|
import type { WorkflowSpec } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/spec_pb";
|
|
32
51
|
import type { Store } from "../../store/interface.js";
|
|
33
52
|
import type { PipelineStep } from "../../pipeline/pipeline.js";
|
|
34
53
|
import type { SpecReference } from "../../pipeline/steps/references.js";
|
|
35
|
-
/** The one sentence for an `agent` string that is
|
|
54
|
+
/** The one sentence for an `agent` string that is none of the three forms. */
|
|
36
55
|
export declare function malformedAgentReferenceMessage(taskName: string, agent: string): string;
|
|
37
|
-
/**
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
*/
|
|
41
|
-
export declare function parseAgentReference(agent: string): {
|
|
56
|
+
/** What an `agent` string is before the rule reads it (the module header). */
|
|
57
|
+
export type AgentReferenceForm = {
|
|
58
|
+
readonly kind: "literal";
|
|
42
59
|
readonly org: string;
|
|
43
60
|
readonly slug: string;
|
|
44
|
-
} |
|
|
61
|
+
} | {
|
|
62
|
+
readonly kind: "relative";
|
|
63
|
+
readonly slug: string;
|
|
64
|
+
} | {
|
|
65
|
+
readonly kind: "run-time";
|
|
66
|
+
} | {
|
|
67
|
+
readonly kind: "malformed";
|
|
68
|
+
};
|
|
69
|
+
export declare function classifyAgentReference(agent: string): AgentReferenceForm;
|
|
45
70
|
/**
|
|
46
|
-
* Every `agent_call` task's agent as a reference,
|
|
47
|
-
* declaration order
|
|
48
|
-
*
|
|
49
|
-
*
|
|
50
|
-
*
|
|
71
|
+
* Every `agent_call` task's agent the write can judge, as a reference,
|
|
72
|
+
* nested tasks included in declaration order: a literal as written, a
|
|
73
|
+
* relative slug in `parentOrg` and marked relative, a value fixed only at
|
|
74
|
+
* run not at all. Throws INVALID_ARGUMENT on the first malformed string. A
|
|
75
|
+
* config that does not decode is skipped: the spec validation step has
|
|
76
|
+
* already refused the workflow for it, and this collector never
|
|
77
|
+
* double-reports.
|
|
51
78
|
*/
|
|
52
79
|
export declare function collectAgentCallReferences(spec: WorkflowSpec | undefined, parentOrg: string): SpecReference[];
|
|
53
80
|
export declare function newValidateAgentCallReferencesStep(store: Store): PipelineStep<typeof WorkflowSchema>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"agent-call-references.d.ts","sourceRoot":"","sources":["../../../src/domain/workflow/agent-call-references.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"agent-call-references.d.ts","sourceRoot":"","sources":["../../../src/domain/workflow/agent-call-references.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AAE5F,OAAO,KAAK,EACV,YAAY,EAEb,MAAM,wDAAwD,CAAC;AAIhE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE/D,OAAO,KAAK,EAEV,aAAa,EACd,MAAM,oCAAoC,CAAC;AAM5C,8EAA8E;AAC9E,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,MAAM,CAER;AAED,8EAA8E;AAC9E,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC;AAKnC,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,CAYxE;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,SAAS,EAAE,MAAM,GAChB,aAAa,EAAE,CA4DjB;AAED,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,KAAK,GACX,YAAY,CAAC,OAAO,cAAc,CAAC,CAyBrC"}
|
|
@@ -5,30 +5,33 @@ import { checkReferences } from "../../pipeline/steps/references.js";
|
|
|
5
5
|
import { metadataOf } from "../../pipeline/steps/shapes.js";
|
|
6
6
|
import { unmarshalTaskConfig } from "./converter/unmarshal.js";
|
|
7
7
|
import { nestedTasks } from "./validation/task-config-constraints.js";
|
|
8
|
-
/** The one sentence for an `agent` string that is
|
|
8
|
+
/** The one sentence for an `agent` string that is none of the three forms. */
|
|
9
9
|
export function malformedAgentReferenceMessage(taskName, agent) {
|
|
10
10
|
return `task '${taskName}': agent '${agent}' is not a reference; write 'slug' for an agent of this organization or 'org/slug' for another organization's.`;
|
|
11
11
|
}
|
|
12
|
-
/**
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
12
|
+
/** Opens every runtime expression and placeholder the runner evaluates; never part of a slug. */
|
|
13
|
+
const RUNTIME_EXPRESSION_MARKER = "${";
|
|
14
|
+
export function classifyAgentReference(agent) {
|
|
15
|
+
if (agent.includes(RUNTIME_EXPRESSION_MARKER)) {
|
|
16
|
+
return { kind: "run-time" };
|
|
17
|
+
}
|
|
17
18
|
const parts = agent.split("/");
|
|
18
|
-
if (parts.length === 1) {
|
|
19
|
-
return
|
|
19
|
+
if (parts.length === 1 && parts[0] !== "") {
|
|
20
|
+
return { kind: "relative", slug: parts[0] };
|
|
20
21
|
}
|
|
21
22
|
if (parts.length === 2 && parts[0] !== "" && parts[1] !== "") {
|
|
22
|
-
return { org: parts[0], slug: parts[1] };
|
|
23
|
+
return { kind: "literal", org: parts[0], slug: parts[1] };
|
|
23
24
|
}
|
|
24
|
-
return
|
|
25
|
+
return { kind: "malformed" };
|
|
25
26
|
}
|
|
26
27
|
/**
|
|
27
|
-
* Every `agent_call` task's agent as a reference,
|
|
28
|
-
* declaration order
|
|
29
|
-
*
|
|
30
|
-
*
|
|
31
|
-
*
|
|
28
|
+
* Every `agent_call` task's agent the write can judge, as a reference,
|
|
29
|
+
* nested tasks included in declaration order: a literal as written, a
|
|
30
|
+
* relative slug in `parentOrg` and marked relative, a value fixed only at
|
|
31
|
+
* run not at all. Throws INVALID_ARGUMENT on the first malformed string. A
|
|
32
|
+
* config that does not decode is skipped: the spec validation step has
|
|
33
|
+
* already refused the workflow for it, and this collector never
|
|
34
|
+
* double-reports.
|
|
32
35
|
*/
|
|
33
36
|
export function collectAgentCallReferences(spec, parentOrg) {
|
|
34
37
|
const refs = [];
|
|
@@ -47,15 +50,32 @@ export function collectAgentCallReferences(spec, parentOrg) {
|
|
|
47
50
|
if (config !== undefined) {
|
|
48
51
|
if (task.kind === WorkflowTaskKind.agent_call) {
|
|
49
52
|
const agent = config.agent;
|
|
50
|
-
const
|
|
51
|
-
|
|
52
|
-
|
|
53
|
+
const form = classifyAgentReference(agent);
|
|
54
|
+
switch (form.kind) {
|
|
55
|
+
case "literal":
|
|
56
|
+
refs.push({
|
|
57
|
+
kind: ApiResourceKind.agent,
|
|
58
|
+
org: form.org,
|
|
59
|
+
slug: form.slug,
|
|
60
|
+
});
|
|
61
|
+
break;
|
|
62
|
+
case "relative":
|
|
63
|
+
refs.push({
|
|
64
|
+
kind: ApiResourceKind.agent,
|
|
65
|
+
org: parentOrg,
|
|
66
|
+
slug: form.slug,
|
|
67
|
+
resolvesIn: "running-organization",
|
|
68
|
+
});
|
|
69
|
+
break;
|
|
70
|
+
case "run-time":
|
|
71
|
+
break;
|
|
72
|
+
case "malformed":
|
|
73
|
+
throw invalidArgumentError(malformedAgentReferenceMessage(task.name, agent));
|
|
74
|
+
default: {
|
|
75
|
+
const exhaustive = form;
|
|
76
|
+
throw new Error(`unknown agent reference form: ${JSON.stringify(exhaustive)}`);
|
|
77
|
+
}
|
|
53
78
|
}
|
|
54
|
-
refs.push({
|
|
55
|
-
kind: ApiResourceKind.agent,
|
|
56
|
-
org: parsed.org === "" ? parentOrg : parsed.org,
|
|
57
|
-
slug: parsed.slug,
|
|
58
|
-
});
|
|
59
79
|
}
|
|
60
80
|
for (const nested of nestedTasks(config)) {
|
|
61
81
|
visit(nested);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"agent-call-references.js","sourceRoot":"","sources":["../../../src/domain/workflow/agent-call-references.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"agent-call-references.js","sourceRoot":"","sources":["../../../src/domain/workflow/agent-call-references.ts"],"names":[],"mappings":"AAsDA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wDAAwD,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAO/E,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AAEtE,8EAA8E;AAC9E,MAAM,UAAU,8BAA8B,CAC5C,QAAgB,EAChB,KAAa;IAEb,OAAO,SAAS,QAAQ,aAAa,KAAK,gHAAgH,CAAC;AAC7J,CAAC;AASD,iGAAiG;AACjG,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAEvC,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,CAAC;IAC/C,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,IAA8B,EAC9B,SAAiB;IAEjB,MAAM,IAAI,GAAoB,EAAE,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,IAAkB,EAAQ,EAAE;QACzC,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,SAAS,CAAC;YACrB,CAAC;YACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,CAAC,UAAU,EAAE,CAAC;oBAC9C,MAAM,KAAK,GAAI,MAA8B,CAAC,KAAK,CAAC;oBACpD,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;oBAC3C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;wBAClB,KAAK,SAAS;4BACZ,IAAI,CAAC,IAAI,CAAC;gCACR,IAAI,EAAE,eAAe,CAAC,KAAK;gCAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;gCACb,IAAI,EAAE,IAAI,CAAC,IAAI;6BAChB,CAAC,CAAC;4BACH,MAAM;wBACR,KAAK,UAAU;4BACb,IAAI,CAAC,IAAI,CAAC;gCACR,IAAI,EAAE,eAAe,CAAC,KAAK;gCAC3B,GAAG,EAAE,SAAS;gCACd,IAAI,EAAE,IAAI,CAAC,IAAI;gCACf,UAAU,EAAE,sBAAsB;6BACnC,CAAC,CAAC;4BACH,MAAM;wBACR,KAAK,UAAU;4BACb,MAAM;wBACR,KAAK,WAAW;4BACd,MAAM,oBAAoB,CACxB,8BAA8B,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CACjD,CAAC;wBACJ,OAAO,CAAC,CAAC,CAAC;4BACR,MAAM,UAAU,GAAU,IAAI,CAAC;4BAC/B,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAC9D,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;oBACzC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,KAAK,CAAC,UAAU,CAAC,CAAC;QACpB,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,KAAY;IAEZ,OAAO;QACL,IAAI,EAAE,6BAA6B;QACnC,KAAK,CAAC,OAAO,CAAC,GAA0C;YACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,0BAA0B,CAAC,EACrC,gCAAgC,CACjC,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,0BAA0B,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;YACzE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAoB;gBAC9B,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,OAAO,CAAC;YAChB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -1362,7 +1362,7 @@
|
|
|
1362
1362
|
{
|
|
1363
1363
|
"name": "agent",
|
|
1364
1364
|
"displayName": "Agent",
|
|
1365
|
-
"description": "Agent
|
|
1365
|
+
"description": "Agent to invoke, as \"slug\", \"org/slug\", or a value holding a runtime expression. - \"slug\": an agent of the organization the workflow runs in; checked when the workflow is saved, against the workflow's own organization - \"org/slug\": that organization's agent; checked when the workflow is saved, and another organization's agent must be shared at platform visibility - a value holding \"${ ... }\", \"${.env_vars.KEY}\" or \"${.secrets.KEY}\": resolved to \"slug\" or \"org/slug\" when the task runs, and read as the person who ran the workflow Examples: \"code-reviewer\", \"acme/data-analyst\", \"${.env_vars.TEAM_ORG}/assistant\" Required field.",
|
|
1366
1366
|
"type": "string",
|
|
1367
1367
|
"required": true,
|
|
1368
1368
|
"groupId": "core",
|
|
@@ -1470,7 +1470,7 @@
|
|
|
1470
1470
|
"additionalProperties": false,
|
|
1471
1471
|
"properties": {
|
|
1472
1472
|
"agent": {
|
|
1473
|
-
"description": "Agent
|
|
1473
|
+
"description": "Agent to invoke, as \"slug\", \"org/slug\", or a value holding a runtime expression. - \"slug\": an agent of the organization the workflow runs in; checked when the workflow is saved, against the workflow's own organization - \"org/slug\": that organization's agent; checked when the workflow is saved, and another organization's agent must be shared at platform visibility - a value holding \"${ ... }\", \"${.env_vars.KEY}\" or \"${.secrets.KEY}\": resolved to \"slug\" or \"org/slug\" when the task runs, and read as the person who ran the workflow Examples: \"code-reviewer\", \"acme/data-analyst\", \"${.env_vars.TEAM_ORG}/assistant\" Required field.",
|
|
1474
1474
|
"maxLength": 127,
|
|
1475
1475
|
"minLength": 1,
|
|
1476
1476
|
"type": "string"
|
|
@@ -41,15 +41,16 @@ export declare const DEFAULT_INSTANCE_LABEL = "stigmer.ai/default-instance";
|
|
|
41
41
|
export declare const SYSTEM_MANAGED_LABEL = "stigmer.ai/system-managed";
|
|
42
42
|
/**
|
|
43
43
|
* Marks system content: a resource the platform itself seeded rather than a
|
|
44
|
-
* user authored
|
|
45
|
-
*
|
|
46
|
-
*
|
|
47
|
-
*
|
|
48
|
-
*
|
|
49
|
-
*
|
|
50
|
-
*
|
|
51
|
-
*
|
|
52
|
-
*
|
|
44
|
+
* user authored. The retired seedpack wrote it on every row it applied, and
|
|
45
|
+
* CLIs before the bootstrap stopped labelling stamped it on the `stigmer`
|
|
46
|
+
* organization they created. A plugin overlay may still carry it on a
|
|
47
|
+
* member (a reserved label, so the push charges the platform permission for
|
|
48
|
+
* it). It has one server-side meaning: a plugin
|
|
49
|
+
* push may adopt a system-content row that holds a slug the plugin needs,
|
|
50
|
+
* keeping the row's id and everything bound to it, instead of refusing the
|
|
51
|
+
* slug as taken. It never marks a user's resource, so a user's row is never
|
|
52
|
+
* adopted (domain/plugin/members.ts, judgeSlug); on an organization it is
|
|
53
|
+
* inert.
|
|
53
54
|
*/
|
|
54
55
|
export declare const SYSTEM_LABEL = "stigmer.ai/system";
|
|
55
56
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"apiresource-labels.d.ts","sourceRoot":"","sources":["../../src/pipeline/apiresource-labels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4DAA4D,CAAC;AAEtG;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,gCAA6C,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,8BAA2C,CAAC;AAE7E
|
|
1
|
+
{"version":3,"file":"apiresource-labels.d.ts","sourceRoot":"","sources":["../../src/pipeline/apiresource-labels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4DAA4D,CAAC;AAEtG;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,gCAA6C,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,8BAA2C,CAAC;AAE7E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY,sBAAmC,CAAC;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAE1C;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,sBAAmC,CAAC;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,8BAA2C,CAAC;AAE7E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc,wBAAqC,CAAC;AAEjE,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,aAAa,CAAC;AAE5C,6EAA6E;AAC7E,wBAAgB,UAAU,CACxB,QAAQ,EAAE,mBAAmB,GAAG,SAAS,GACxC,MAAM,GAAG,SAAS,CAGpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,mBAAmB,GAAG,SAAS,GACxC,OAAO,CAET;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,mBAAmB,GAAG,SAAS,GACxC,OAAO,CAET"}
|
|
@@ -19,15 +19,16 @@ export const DEFAULT_INSTANCE_LABEL = `${RESERVED_LABEL_PREFIX}default-instance`
|
|
|
19
19
|
export const SYSTEM_MANAGED_LABEL = `${RESERVED_LABEL_PREFIX}system-managed`;
|
|
20
20
|
/**
|
|
21
21
|
* Marks system content: a resource the platform itself seeded rather than a
|
|
22
|
-
* user authored
|
|
23
|
-
*
|
|
24
|
-
*
|
|
25
|
-
*
|
|
26
|
-
*
|
|
27
|
-
*
|
|
28
|
-
*
|
|
29
|
-
*
|
|
30
|
-
*
|
|
22
|
+
* user authored. The retired seedpack wrote it on every row it applied, and
|
|
23
|
+
* CLIs before the bootstrap stopped labelling stamped it on the `stigmer`
|
|
24
|
+
* organization they created. A plugin overlay may still carry it on a
|
|
25
|
+
* member (a reserved label, so the push charges the platform permission for
|
|
26
|
+
* it). It has one server-side meaning: a plugin
|
|
27
|
+
* push may adopt a system-content row that holds a slug the plugin needs,
|
|
28
|
+
* keeping the row's id and everything bound to it, instead of refusing the
|
|
29
|
+
* slug as taken. It never marks a user's resource, so a user's row is never
|
|
30
|
+
* adopted (domain/plugin/members.ts, judgeSlug); on an organization it is
|
|
31
|
+
* inert.
|
|
31
32
|
*/
|
|
32
33
|
export const SYSTEM_LABEL = `${RESERVED_LABEL_PREFIX}system`;
|
|
33
34
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"apiresource-labels.js","sourceRoot":"","sources":["../../src/pipeline/apiresource-labels.ts"],"names":[],"mappings":"AAuBA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,qBAAqB,kBAAkB,CAAC;AAEjF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,qBAAqB,gBAAgB,CAAC;AAE7E
|
|
1
|
+
{"version":3,"file":"apiresource-labels.js","sourceRoot":"","sources":["../../src/pipeline/apiresource-labels.ts"],"names":[],"mappings":"AAuBA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,qBAAqB,kBAAkB,CAAC;AAEjF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,qBAAqB,gBAAgB,CAAC;AAE7E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,qBAAqB,QAAQ,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,qBAAqB,QAAQ,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,qBAAqB,gBAAgB,CAAC;AAE7E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,qBAAqB,UAAU,CAAC;AAEjE,uFAAuF;AACvF,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAE5C,6EAA6E;AAC7E,MAAM,UAAU,UAAU,CACxB,QAAyC;IAEzC,MAAM,KAAK,GAAG,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7C,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAyC;IAEzC,OAAO,QAAQ,EAAE,MAAM,CAAC,sBAAsB,CAAC,KAAK,mBAAmB,CAAC;AAC1E,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAC7B,QAAyC;IAEzC,OAAO,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,KAAK,mBAAmB,CAAC;AAChE,CAAC"}
|
|
@@ -28,7 +28,8 @@
|
|
|
28
28
|
* channel apps are resolved by the server on the run's behalf and
|
|
29
29
|
* never read by the person, so their level is not a leak the floor
|
|
30
30
|
* closes, and an org-visible instance may hold a private personal
|
|
31
|
-
* environment as it always has.
|
|
31
|
+
* environment as it always has. A RELATIVE reference (below) is
|
|
32
|
+
* compared against the resource's level capped at org.
|
|
32
33
|
* (iii) Another organization: the target must exist AND be
|
|
33
34
|
* platform-visible, answered with ONE sentence that does not say
|
|
34
35
|
* which failed. The caller has no standing to learn what another
|
|
@@ -48,14 +49,32 @@
|
|
|
48
49
|
* the rule must agree with the runtime. A reference with an empty slug is
|
|
49
50
|
* unset and skipped (the field-level CEL rules own "required").
|
|
50
51
|
*
|
|
52
|
+
* A reference is RELATIVE when it names no organization of its own and
|
|
53
|
+
* the runtime resolves it in the organization the resource RUNS in, not
|
|
54
|
+
* the one it is stored in. Exactly one exists: a workflow `agent_call`
|
|
55
|
+
* task's bare slug (domain/workflow/agent-call-references.ts), which the
|
|
56
|
+
* runner resolves in the execution's organization; any workflow a person
|
|
57
|
+
* may execute can run from another organization by id. The rule judges
|
|
58
|
+
* it in the resource's own organization — the one its author can see, so
|
|
59
|
+
* the target must exist there — and caps its floor at org: only the
|
|
60
|
+
* running organization's own people ever read a target through it, and
|
|
61
|
+
* they can read an org-visible one. The cap changes nothing for a
|
|
62
|
+
* private or org resource and lets a platform-visible workflow call its
|
|
63
|
+
* organization's org-visible agent. A value fixed only at run (an
|
|
64
|
+
* `agent_call` agent holding a runtime expression) is not a reference at
|
|
65
|
+
* all: the collector yields nothing for it, and the run reads the
|
|
66
|
+
* resolved target as the person the run acts as, as it reads every
|
|
67
|
+
* id-bound binding.
|
|
68
|
+
*
|
|
51
69
|
* The floor has a second door. Raising a resource's level through
|
|
52
70
|
* updateVisibility could open the same gap a create cannot, so
|
|
53
71
|
* GuardReferenceFloorOnEscalation runs on the two chains whose rows carry
|
|
54
72
|
* run-read references (agent, workflow) after ValidateVisibilityUpdate:
|
|
55
73
|
* when the requested level is above the stored one, every run-read
|
|
56
|
-
* reference the STORED row carries must be at least the requested level
|
|
57
|
-
*
|
|
58
|
-
*
|
|
74
|
+
* reference the STORED row carries must be at least the requested level
|
|
75
|
+
* (a relative one, at least the requested level capped at org), judged by
|
|
76
|
+
* the same function over the same collectors, else the escalation is
|
|
77
|
+
* refused naming the dependencies. Only the floor is asked at
|
|
59
78
|
* that door — a dependency that has since left or stopped being shared was
|
|
60
79
|
* judged when the row was written and is the run's to refuse.
|
|
61
80
|
*
|
|
@@ -103,6 +122,13 @@ export interface SpecReference {
|
|
|
103
122
|
readonly kind: ApiResourceKind;
|
|
104
123
|
readonly slug: string;
|
|
105
124
|
readonly org: string;
|
|
125
|
+
/**
|
|
126
|
+
* Present only on a RELATIVE reference (the module header): `org` is the
|
|
127
|
+
* resource's own, filled by the collector, and the runtime resolves the
|
|
128
|
+
* slug in the organization the resource runs in. The generic walker
|
|
129
|
+
* never sets it; only the `agent_call` collector does.
|
|
130
|
+
*/
|
|
131
|
+
readonly resolvesIn?: "running-organization";
|
|
106
132
|
}
|
|
107
133
|
/** The resource the references belong to, as the rule needs it. */
|
|
108
134
|
export interface ReferenceParent {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"references.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/references.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"references.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/references.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiGG;AACH,OAAO,KAAK,EAAa,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE1E,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAQrD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAE/F,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AAGxG,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EACL,uBAAuB,EAGxB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAWnD,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gGAAgG;IAChG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAED,eAAO,MAAM,sBAAsB,EAAE,aAAa,CAAC,mBAAmB,CA2CrE,CAAC;AAEF,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,GACpB,mBAAmB,GAAG,SAAS,CAEjC;AAMD,iGAAiG;AACjG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,sBAAsB,CAAC;CAC9C;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;CAC5C;AAED,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE;AACzB,uDAAuD;GACrD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE;AAC7B,gEAAgE;GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE;AAC9B,4EAA4E;GAC1E;IACE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,qBAAqB,CAAC;CAClD;AACH,mGAAmG;GACjG;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC;AAEvC,uGAAuG;AACvG,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CAAC,GAAG,EAAE,aAAa,GAAG,qBAAqB,GAAG,SAAS,CAAC;CACrE;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,aAAa,CAAC,aAAa,CAAC,GACjC,OAAO,CAAC,gBAAgB,CAAC,CAgC3B;AAMD,iEAAiE;AACjE,wBAAgB,cAAc,CAC5B,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,eAAe,EACvB,GAAG,EAAE,aAAa,GACjB,gBAAgB,CAqBlB;AAiDD,6BAA6B;AAC7B,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,MAAM,GACX,MAAM,CAER;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,GACtE,MAAM,CAOR;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,mBAAmB,EAC1B,GAAG,EAAE,aAAa,EAClB,gBAAgB,EAAE,qBAAqB,EACvC,gBAAgB,EAAE,qBAAqB,GACtC,MAAM,CAER;AASD,oGAAoG;AACpG,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,mBAAmB,EAC1B,GAAG,EAAE,aAAa,GACjB,MAAM,CAER;AAWD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,aAAa,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;CACpC,CAAC,GACD,UAAU,CAAC,OAAO,uBAAuB,CAAC,GAAG,SAAS,CA6DxD;AAMD,wBAAgB,0BAA0B,CACxC,IAAI,SAAS,WAAW,KACrB,YAAY,CAAC,IAAI,CAAC,CAwBtB;AAED,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,KAAK,EAAE,KAAK,GACX,YAAY,CAAC,IAAI,CAAC,CA2BpB;AAED,iFAAiF;AACjF,wBAAsB,eAAe,CACnC,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,aAAa,CAAC,aAAa,CAAC,GACjC,OAAO,CAAC,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAM9C;AAED,+HAA+H;AAC/H,MAAM,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,aAAa,CAAC,aAAa,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,wBAAgB,sCAAsC,CACpD,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,aAAa,CAAC,kBAAkB,CAAC,GAC5C,YAAY,CAAC,OAAO,2BAA2B,CAAC,CAqDlD;AAMD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,GACjC,aAAa,EAAE,CAUjB"}
|
|
@@ -114,11 +114,23 @@ export function checkReference(targets, parent, ref) {
|
|
|
114
114
|
}
|
|
115
115
|
const entry = referenceTargetKind(ref.kind);
|
|
116
116
|
if (entry?.readByRun === true &&
|
|
117
|
-
visibilityRank(target) < visibilityRank(parent
|
|
117
|
+
visibilityRank(target) < visibilityRank(floorOf(parent, ref))) {
|
|
118
118
|
return { kind: "below-floor", targetVisibility: target };
|
|
119
119
|
}
|
|
120
120
|
return { kind: "ok" };
|
|
121
121
|
}
|
|
122
|
+
/**
|
|
123
|
+
* The level a same-organization target must reach: the resource's own,
|
|
124
|
+
* capped at org for a relative reference (the module header).
|
|
125
|
+
*/
|
|
126
|
+
function floorOf(parent, ref) {
|
|
127
|
+
if (ref.resolvesIn === "running-organization" &&
|
|
128
|
+
visibilityRank(parent.visibility) >
|
|
129
|
+
visibilityRank(ApiResourceVisibility.visibility_org)) {
|
|
130
|
+
return ApiResourceVisibility.visibility_org;
|
|
131
|
+
}
|
|
132
|
+
return parent.visibility;
|
|
133
|
+
}
|
|
122
134
|
/**
|
|
123
135
|
* The order the floor compares on: private < org < platform, an unset
|
|
124
136
|
* level reading as private (the level a row with no config holds). The
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"references.js","sourceRoot":"","sources":["../../../src/pipeline/steps/references.ts"],"names":[],"mappings":"AAgFA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAGrD,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yDAAyD,CAAC;AAC3F,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EAAE,cAAc,EAAE,MAAM,iEAAiE,CAAC;AAEjG,OAAO,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AAGnF,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE7D,MAAM,2BAA2B,GAC/B,qDAAqD,CAAC;AAkBxD,MAAM,CAAC,MAAM,sBAAsB,GAAuC;IACxE;QACE,IAAI,EAAE,eAAe,CAAC,KAAK;QAC3B,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,qBAAqB;KAChC;IACD;QACE,IAAI,EAAE,eAAe,CAAC,UAAU;QAChC,MAAM,EAAE,eAAe;QACvB,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,eAAe;QACtB,QAAQ,EAAE,yBAAyB;KACpC;IACD;QACE,IAAI,EAAE,eAAe,CAAC,KAAK;QAC3B,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,qBAAqB;KAChC;IACD;QACE,IAAI,EAAE,eAAe,CAAC,WAAW;QACjC,MAAM,EAAE,iBAAiB;QACzB,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,gBAAgB;QACvB,QAAQ,EAAE,2BAA2B;KACtC;IACD;QACE,IAAI,EAAE,eAAe,CAAC,WAAW;QACjC,MAAM,EAAE,gBAAgB;QACxB,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,gBAAgB;QACvB,QAAQ,EAAE,0BAA0B;KACrC;IACD;QACE,IAAI,EAAE,eAAe,CAAC,SAAS;QAC/B,MAAM,EAAE,cAAc;QACtB,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,cAAc;QACrB,QAAQ,EAAE,SAAS;KACpB;CACF,CAAC;AAEF,MAAM,UAAU,mBAAmB,CACjC,IAAqB;IAErB,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACrE,CAAC;AAuCD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAY,EACZ,IAAkC;IAElC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuD,CAAC;IAC9E,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,QAAQ,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAClE,EACD,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiC,CAAC;QACvD,KAAK,MAAM,IAAI,IAAI,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,IAAI,QAAQ,CAAC;YACb,IAAI,CAAC;gBACH,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACnD,SAAS;YACX,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO;QACL,YAAY,CAAC,GAAG;YACd,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,IAAY;IAC1C,OAAO,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,cAAc,CAC5B,OAAyB,EACzB,MAAuB,EACvB,GAAkB;IAElB,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;QAC3B,OAAO,MAAM,KAAK,qBAAqB,CAAC,mBAAmB;YACzD,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YAChB,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,IACE,KAAK,EAAE,SAAS,KAAK,IAAI;QACzB,cAAc,CAAC,MAAM,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,EAC1D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,KAA4B;IAClD,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,qBAAqB,CAAC,mCAAmC,CAAC;QAC/D,KAAK,qBAAqB,CAAC,kBAAkB;YAC3C,OAAO,CAAC,CAAC;QACX,KAAK,qBAAqB,CAAC,cAAc;YACvC,OAAO,CAAC,CAAC;QACX,KAAK,qBAAqB,CAAC,mBAAmB;YAC5C,OAAO,CAAC,CAAC;QACX,KAAK,qBAAqB,CAAC,iBAAiB;YAC1C,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,6BAA6B;AAC7B,MAAM,UAAU,qBAAqB,CACnC,KAA0B,EAC1B,IAAY;IAEZ,OAAO,cAAc,KAAK,CAAC,KAAK,KAAK,IAAI,oGAAoG,CAAC;AAChJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAA0B,EAC1B,OAAuE;IAEvE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,MAAM,IAAI,GACR,KAAK,CAAC,QAAQ,KAAK,SAAS;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,SAAS,KAAK,CAAC,QAAQ,uBAAuB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;IACrE,OAAO,cAAc,KAAK,CAAC,KAAK,eAAe,IAAI,yCAAyC,IAAI,EAAE,CAAC;AACrG,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,iBAAiB,CAC/B,KAA0B,EAC1B,GAAkB,EAClB,gBAAuC,EACvC,gBAAuC;IAEvC,OAAO,cAAc,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,QAAQ,SAAS,CAAC,gBAAgB,CAAC,2BAA2B,SAAS,CAAC,gBAAgB,CAAC,iDAAiD,MAAM,CAAC,KAAK,CAAC,+EAA+E,CAAC;AACrS,CAAC;AAED,4GAA4G;AAC5G,SAAS,SAAS,CAAC,KAA4B;IAC7C,OAAO,KAAK,KAAK,qBAAqB,CAAC,mCAAmC;QACxE,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,kBAAkB,CAAC;QACjE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,4BAA4B,CAC1C,KAA0B,EAC1B,GAAkB;IAElB,OAAO,cAAc,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,0JAA0J,CAAC;AACzN,CAAC;AAED,kFAAkF;AAClF,SAAS,QAAQ,CAAC,KAA0B;IAC1C,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,MAAM,CAAC,KAA0B;IACxC,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAuB,EACvB,QAGE;IAEF,uEAAuE;IACvE,+BAA+B;IAC/B,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoC,CAAC;IAClE,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAmB,CAAC;IACpD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,IAAI;gBACP,MAAM;YACR,KAAK,QAAQ;gBACX,SAAS,GAAG,IAAI,CAAC;gBACjB,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBACvD,MAAM;YACR,KAAK,SAAS;gBACZ,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC/B,SAAS,CAAC,IAAI,CACZ,wBAAwB,CAAC,KAAK,EAAE,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CACnE,CAAC;gBACJ,CAAC;gBACD,MAAM;YACR,KAAK,aAAa;gBAChB,SAAS,CAAC,IAAI,CACZ,iBAAiB,CACf,KAAK,EACL,GAAG,EACH,OAAO,CAAC,gBAAgB,EACxB,MAAM,CAAC,UAAU,CAClB,CACF,CAAC;gBACF,MAAM;YACR,KAAK,eAAe;gBAClB,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;gBACzD,MAAM;YACR,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,UAAU,GAAU,OAAO,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;AAChF,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,MAAM,UAAU,0BAA0B;IAGxC,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,OAAO,CAAC,GAAyB;YAC/B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,0BAA0B,CAAC,EACrC,sBAAsB,CACvB,CAAC;YACJ,CAAC;YACD,kEAAkE;YAClE,wCAAwC;YACxC,IAAI,QAAQ,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;gBACrD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;gBAC1D,IAAI,QAAQ,KAAK,SAAS,IAAK,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAY,KAAK,EAAE,EAAE,CAAC;oBACnE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAY;IAEZ,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,0BAA0B,CAAC,EACrC,qBAAqB,CACtB,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CACjE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CACzB,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAoB;gBAC9B,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,OAAO,CAAC;YAChB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAY,EACZ,MAAuB,EACvB,IAAkC;IAElC,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxD,OAAO,gBAAgB,CACrB,MAAM,EACN,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAC5E,CAAC;AACJ,CAAC;AAKD;;;;;GAKG;AACH,MAAM,UAAU,sCAAsC,CACpD,KAAY,EACZ,SAAiB,EACjB,UAA6C;IAE7C,OAAO;QACL,IAAI,EAAE,iCAAiC;QACvC,KAAK,CAAC,OAAO,CACX,GAAuD;YAEvD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAwB,CAAC;YACtD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,+DAA+D;gBAC/D,+CAA+C;gBAC/C,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,kGAAkG,CACnG,EACD,8CAA8C,CAC/C,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,0BAA0B,CAAC,EACrC,8CAA8C,CAC/C,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;YACvC,IAAI,cAAc,CAAC,SAAS,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrE,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,UAAU;iBACpB,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;iBAClC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAoB;gBAC9B,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,UAAU,EAAE,SAAS;aACtB,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,gBAAgB,CAC9B,MAAM,EACN,IAAI;iBACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACb,GAAG;gBACH,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC;aAC9C,CAAC,CAAC;iBACF,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa,CAAC,CAC3D,CAAC;YACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,OAAO,CAAC;YAChB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAmB,EACnB,GAAkC;IAElC,MAAM,IAAI,GAAoB,EAAE,CAAC;IACjC,oBAAoB,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/C,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC;YAC9B,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC;YAC9B,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAgB,EAAE,GAAmB;IACzD,IAAI,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC;QACrC,OAAO,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,EAAE,MAAM,CAAoB,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,MAAmB,EACnB,GAAkC,EAClC,EAAmD;IAEnD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACtD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,IAAI,CACX,GAAmB,EACnB,EAAmD;IAEnD,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YAC/B,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACjC,SAAS;YACX,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,KAAK,CAAC,IAAsB,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YACrC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAChC,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC;gBAC5B,KAAK,CAAC,KAAuB,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CACZ,GAAmB,EACnB,KAAgB,EAChB,EAAmD;IAEnD,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,2BAA2B,EAAE,CAAC;QACtD,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAmB,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,GAAmB,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC"}
|
|
1
|
+
{"version":3,"file":"references.js","sourceRoot":"","sources":["../../../src/pipeline/steps/references.ts"],"names":[],"mappings":"AAmGA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAGrD,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yDAAyD,CAAC;AAC3F,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EAAE,cAAc,EAAE,MAAM,iEAAiE,CAAC;AAEjG,OAAO,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AAGnF,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE7D,MAAM,2BAA2B,GAC/B,qDAAqD,CAAC;AAkBxD,MAAM,CAAC,MAAM,sBAAsB,GAAuC;IACxE;QACE,IAAI,EAAE,eAAe,CAAC,KAAK;QAC3B,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,qBAAqB;KAChC;IACD;QACE,IAAI,EAAE,eAAe,CAAC,UAAU;QAChC,MAAM,EAAE,eAAe;QACvB,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,eAAe;QACtB,QAAQ,EAAE,yBAAyB;KACpC;IACD;QACE,IAAI,EAAE,eAAe,CAAC,KAAK;QAC3B,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,qBAAqB;KAChC;IACD;QACE,IAAI,EAAE,eAAe,CAAC,WAAW;QACjC,MAAM,EAAE,iBAAiB;QACzB,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,gBAAgB;QACvB,QAAQ,EAAE,2BAA2B;KACtC;IACD;QACE,IAAI,EAAE,eAAe,CAAC,WAAW;QACjC,MAAM,EAAE,gBAAgB;QACxB,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,gBAAgB;QACvB,QAAQ,EAAE,0BAA0B;KACrC;IACD;QACE,IAAI,EAAE,eAAe,CAAC,SAAS;QAC/B,MAAM,EAAE,cAAc;QACtB,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,cAAc;QACrB,QAAQ,EAAE,SAAS;KACpB;CACF,CAAC;AAEF,MAAM,UAAU,mBAAmB,CACjC,IAAqB;IAErB,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACrE,CAAC;AA8CD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAY,EACZ,IAAkC;IAElC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuD,CAAC;IAC9E,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,QAAQ,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAClE,EACD,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiC,CAAC;QACvD,KAAK,MAAM,IAAI,IAAI,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,IAAI,QAAQ,CAAC;YACb,IAAI,CAAC;gBACH,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACnD,SAAS;YACX,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO;QACL,YAAY,CAAC,GAAG;YACd,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,IAAY;IAC1C,OAAO,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,cAAc,CAC5B,OAAyB,EACzB,MAAuB,EACvB,GAAkB;IAElB,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;QAC3B,OAAO,MAAM,KAAK,qBAAqB,CAAC,mBAAmB;YACzD,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YAChB,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,IACE,KAAK,EAAE,SAAS,KAAK,IAAI;QACzB,cAAc,CAAC,MAAM,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAC7D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CACd,MAAuB,EACvB,GAAkB;IAElB,IACE,GAAG,CAAC,UAAU,KAAK,sBAAsB;QACzC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC;YAC/B,cAAc,CAAC,qBAAqB,CAAC,cAAc,CAAC,EACtD,CAAC;QACD,OAAO,qBAAqB,CAAC,cAAc,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC,UAAU,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,KAA4B;IAClD,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,qBAAqB,CAAC,mCAAmC,CAAC;QAC/D,KAAK,qBAAqB,CAAC,kBAAkB;YAC3C,OAAO,CAAC,CAAC;QACX,KAAK,qBAAqB,CAAC,cAAc;YACvC,OAAO,CAAC,CAAC;QACX,KAAK,qBAAqB,CAAC,mBAAmB;YAC5C,OAAO,CAAC,CAAC;QACX,KAAK,qBAAqB,CAAC,iBAAiB;YAC1C,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,6BAA6B;AAC7B,MAAM,UAAU,qBAAqB,CACnC,KAA0B,EAC1B,IAAY;IAEZ,OAAO,cAAc,KAAK,CAAC,KAAK,KAAK,IAAI,oGAAoG,CAAC;AAChJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAA0B,EAC1B,OAAuE;IAEvE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,MAAM,IAAI,GACR,KAAK,CAAC,QAAQ,KAAK,SAAS;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,SAAS,KAAK,CAAC,QAAQ,uBAAuB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;IACrE,OAAO,cAAc,KAAK,CAAC,KAAK,eAAe,IAAI,yCAAyC,IAAI,EAAE,CAAC;AACrG,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,iBAAiB,CAC/B,KAA0B,EAC1B,GAAkB,EAClB,gBAAuC,EACvC,gBAAuC;IAEvC,OAAO,cAAc,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,QAAQ,SAAS,CAAC,gBAAgB,CAAC,2BAA2B,SAAS,CAAC,gBAAgB,CAAC,iDAAiD,MAAM,CAAC,KAAK,CAAC,+EAA+E,CAAC;AACrS,CAAC;AAED,4GAA4G;AAC5G,SAAS,SAAS,CAAC,KAA4B;IAC7C,OAAO,KAAK,KAAK,qBAAqB,CAAC,mCAAmC;QACxE,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,kBAAkB,CAAC;QACjE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,4BAA4B,CAC1C,KAA0B,EAC1B,GAAkB;IAElB,OAAO,cAAc,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,0JAA0J,CAAC;AACzN,CAAC;AAED,kFAAkF;AAClF,SAAS,QAAQ,CAAC,KAA0B;IAC1C,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,MAAM,CAAC,KAA0B;IACxC,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAuB,EACvB,QAGE;IAEF,uEAAuE;IACvE,+BAA+B;IAC/B,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoC,CAAC;IAClE,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAmB,CAAC;IACpD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,IAAI;gBACP,MAAM;YACR,KAAK,QAAQ;gBACX,SAAS,GAAG,IAAI,CAAC;gBACjB,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBACvD,MAAM;YACR,KAAK,SAAS;gBACZ,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC/B,SAAS,CAAC,IAAI,CACZ,wBAAwB,CAAC,KAAK,EAAE,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CACnE,CAAC;gBACJ,CAAC;gBACD,MAAM;YACR,KAAK,aAAa;gBAChB,SAAS,CAAC,IAAI,CACZ,iBAAiB,CACf,KAAK,EACL,GAAG,EACH,OAAO,CAAC,gBAAgB,EACxB,MAAM,CAAC,UAAU,CAClB,CACF,CAAC;gBACF,MAAM;YACR,KAAK,eAAe;gBAClB,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;gBACzD,MAAM;YACR,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,UAAU,GAAU,OAAO,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;AAChF,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,MAAM,UAAU,0BAA0B;IAGxC,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,OAAO,CAAC,GAAyB;YAC/B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,0BAA0B,CAAC,EACrC,sBAAsB,CACvB,CAAC;YACJ,CAAC;YACD,kEAAkE;YAClE,wCAAwC;YACxC,IAAI,QAAQ,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;gBACrD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;gBAC1D,IAAI,QAAQ,KAAK,SAAS,IAAK,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAY,KAAK,EAAE,EAAE,CAAC;oBACnE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAY;IAEZ,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,0BAA0B,CAAC,EACrC,qBAAqB,CACtB,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CACjE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CACzB,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAoB;gBAC9B,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,OAAO,CAAC;YAChB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAY,EACZ,MAAuB,EACvB,IAAkC;IAElC,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxD,OAAO,gBAAgB,CACrB,MAAM,EACN,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAC5E,CAAC;AACJ,CAAC;AAKD;;;;;GAKG;AACH,MAAM,UAAU,sCAAsC,CACpD,KAAY,EACZ,SAAiB,EACjB,UAA6C;IAE7C,OAAO;QACL,IAAI,EAAE,iCAAiC;QACvC,KAAK,CAAC,OAAO,CACX,GAAuD;YAEvD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAwB,CAAC;YACtD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,+DAA+D;gBAC/D,+CAA+C;gBAC/C,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,kGAAkG,CACnG,EACD,8CAA8C,CAC/C,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,0BAA0B,CAAC,EACrC,8CAA8C,CAC/C,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;YACvC,IAAI,cAAc,CAAC,SAAS,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrE,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,UAAU;iBACpB,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;iBAClC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAoB;gBAC9B,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,UAAU,EAAE,SAAS;aACtB,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,gBAAgB,CAC9B,MAAM,EACN,IAAI;iBACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACb,GAAG;gBACH,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC;aAC9C,CAAC,CAAC;iBACF,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa,CAAC,CAC3D,CAAC;YACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,OAAO,CAAC;YAChB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAmB,EACnB,GAAkC;IAElC,MAAM,IAAI,GAAoB,EAAE,CAAC;IACjC,oBAAoB,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/C,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC;YAC9B,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC;YAC9B,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAgB,EAAE,GAAmB;IACzD,IAAI,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC;QACrC,OAAO,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,EAAE,MAAM,CAAoB,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,MAAmB,EACnB,GAAkC,EAClC,EAAmD;IAEnD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACtD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,IAAI,CACX,GAAmB,EACnB,EAAmD;IAEnD,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YAC/B,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACjC,SAAS;YACX,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,KAAK,CAAC,IAAsB,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YACrC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAChC,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC;gBAC5B,KAAK,CAAC,KAAuB,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CACZ,GAAmB,EACnB,KAAgB,EAChB,EAAmD;IAEnD,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,2BAA2B,EAAE,CAAC;QACtD,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAmB,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,GAAmB,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@stigmer/server",
|
|
3
|
-
"version": "3.
|
|
3
|
+
"version": "3.24.0",
|
|
4
4
|
"description": "The Stigmer OSS control plane as a composable library: composeServer, the extension registry and the driver seams a composition builds on. The self-contained deployable of the same server is @stigmer/server-slim.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"type": "module",
|
|
@@ -62,11 +62,11 @@
|
|
|
62
62
|
"@connectrpc/connect-node": "^2.0.0",
|
|
63
63
|
"@kubernetes/client-node": "2.0.0",
|
|
64
64
|
"@opentelemetry/api": "^1.9.0",
|
|
65
|
-
"@stigmer/outbound": "3.
|
|
66
|
-
"@stigmer/plugin-package": "3.
|
|
67
|
-
"@stigmer/protos": "3.
|
|
68
|
-
"@stigmer/temporal-codecs": "3.
|
|
69
|
-
"@stigmer/zip-structure": "3.
|
|
65
|
+
"@stigmer/outbound": "3.24.0",
|
|
66
|
+
"@stigmer/plugin-package": "3.24.0",
|
|
67
|
+
"@stigmer/protos": "3.24.0",
|
|
68
|
+
"@stigmer/temporal-codecs": "3.24.0",
|
|
69
|
+
"@stigmer/zip-structure": "3.24.0",
|
|
70
70
|
"@temporalio/activity": "1.16.2",
|
|
71
71
|
"@temporalio/client": "1.16.2",
|
|
72
72
|
"@temporalio/common": "1.16.2",
|
|
@@ -1,40 +1,50 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Pins the workflow domain's collector for the reference rule
|
|
3
|
-
* (../agent-call-references.ts): the
|
|
4
|
-
*
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
*
|
|
8
|
-
*
|
|
9
|
-
*
|
|
10
|
-
*
|
|
3
|
+
* (../agent-call-references.ts): the classifier's four forms (a literal
|
|
4
|
+
* `org/slug`, a relative bare slug, a value holding `${` that is fixed
|
|
5
|
+
* only at run, anything else malformed) and the refusal copy; the walk
|
|
6
|
+
* over top-level, nested and compensate tasks in declaration order, the
|
|
7
|
+
* relative form filled with the workflow's organization and marked, a
|
|
8
|
+
* run-time value collected as nothing; a config that does not decode
|
|
9
|
+
* skipped rather than double-reported; the step over a real store
|
|
10
|
+
* answering the rule's verdicts — a missing agent with the rule's copy,
|
|
11
|
+
* another organization's org-visible agent with the one
|
|
12
|
+
* cross-organization sentence, a platform-visible one admitted, the floor
|
|
13
|
+
* for a literal, the floor capped at org for a bare slug, a run-time value
|
|
14
|
+
* saved with no agent behind it; and the workflow's escalation door
|
|
15
|
+
* applying the same cap when a workflow calling a bare slug is raised to
|
|
16
|
+
* platform.
|
|
11
17
|
*/
|
|
12
18
|
import { create } from "@bufbuild/protobuf";
|
|
13
19
|
import { Code, ConnectError } from "@connectrpc/connect";
|
|
14
20
|
import { afterEach, beforeEach, describe, expect, it } from "vitest";
|
|
15
21
|
|
|
16
22
|
import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
|
|
23
|
+
import type { Workflow } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
|
|
17
24
|
import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
|
|
18
25
|
import { WorkflowTaskKind } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/enum_pb";
|
|
19
26
|
import type { WorkflowSpec } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/spec_pb";
|
|
20
27
|
import { WorkflowSpecSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/spec_pb";
|
|
21
28
|
import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
|
|
22
29
|
import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
|
|
30
|
+
import { UpdateVisibilityInputSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
|
|
23
31
|
|
|
24
32
|
import { RequestContext } from "../../../pipeline/request-context.js";
|
|
25
33
|
import { testCallerIdentity } from "../../../pipeline/__tests__/support.js";
|
|
26
34
|
import {
|
|
35
|
+
belowFloorMessage,
|
|
27
36
|
missingReferencesMessage,
|
|
37
|
+
newGuardReferenceFloorOnEscalationStep,
|
|
28
38
|
notAvailableReferenceMessage,
|
|
29
39
|
referenceTargetKind,
|
|
30
40
|
} from "../../../pipeline/steps/references.js";
|
|
31
41
|
import type { SqliteStore } from "../../../store/sqlite/store.js";
|
|
32
42
|
import { tempStore } from "../../../store/sqlite/__tests__/support.js";
|
|
33
43
|
import {
|
|
44
|
+
classifyAgentReference,
|
|
34
45
|
collectAgentCallReferences,
|
|
35
46
|
malformedAgentReferenceMessage,
|
|
36
47
|
newValidateAgentCallReferencesStep,
|
|
37
|
-
parseAgentReference,
|
|
38
48
|
} from "../agent-call-references.js";
|
|
39
49
|
|
|
40
50
|
const V = ApiResourceVisibility;
|
|
@@ -52,24 +62,48 @@ function specOf(tasks: ReadonlyArray<Record<string, unknown>>): WorkflowSpec {
|
|
|
52
62
|
return create(WorkflowSpecSchema, { tasks } as never);
|
|
53
63
|
}
|
|
54
64
|
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
65
|
+
/** The three shapes the runner evaluates, whole and embedded, as authors write them. */
|
|
66
|
+
const RUN_TIME_VALUES = [
|
|
67
|
+
"${.env_vars.TEAM_ORG}/assistant",
|
|
68
|
+
"${.secrets.AGENT_REF}",
|
|
69
|
+
'${ "acme/reviewer" }',
|
|
70
|
+
"${ .input.agent }",
|
|
71
|
+
"acme/${ .input.slug }",
|
|
72
|
+
"${ .input.org }/a/b",
|
|
73
|
+
];
|
|
74
|
+
|
|
75
|
+
describe("classifyAgentReference", () => {
|
|
76
|
+
it("reads `org/slug` as a literal and a bare slug as relative", () => {
|
|
77
|
+
expect(classifyAgentReference("acme/reviewer")).toEqual({
|
|
78
|
+
kind: "literal",
|
|
79
|
+
org: "acme",
|
|
59
80
|
slug: "reviewer",
|
|
60
81
|
});
|
|
61
|
-
expect(
|
|
62
|
-
|
|
82
|
+
expect(classifyAgentReference("reviewer")).toEqual({
|
|
83
|
+
kind: "relative",
|
|
63
84
|
slug: "reviewer",
|
|
64
85
|
});
|
|
86
|
+
});
|
|
87
|
+
|
|
88
|
+
it("reads any value holding `${` as fixed only at run, whatever its shape", () => {
|
|
89
|
+
for (const value of RUN_TIME_VALUES) {
|
|
90
|
+
expect(classifyAgentReference(value), value).toEqual({
|
|
91
|
+
kind: "run-time",
|
|
92
|
+
});
|
|
93
|
+
}
|
|
94
|
+
});
|
|
95
|
+
|
|
96
|
+
it("reads everything else as malformed", () => {
|
|
65
97
|
for (const malformed of ["", "/reviewer", "acme/", "a/b/c", "//"]) {
|
|
66
|
-
expect(
|
|
98
|
+
expect(classifyAgentReference(malformed), malformed).toEqual({
|
|
99
|
+
kind: "malformed",
|
|
100
|
+
});
|
|
67
101
|
}
|
|
68
102
|
});
|
|
69
103
|
});
|
|
70
104
|
|
|
71
105
|
describe("collectAgentCallReferences", () => {
|
|
72
|
-
it("collects top-level, nested and compensate agent_call tasks in declaration order,
|
|
106
|
+
it("collects top-level, nested and compensate agent_call tasks in declaration order, a bare slug filled with the workflow's organization and marked relative", () => {
|
|
73
107
|
const spec = specOf([
|
|
74
108
|
agentCall("first", "reviewer"),
|
|
75
109
|
{
|
|
@@ -96,9 +130,29 @@ describe("collectAgentCallReferences", () => {
|
|
|
96
130
|
},
|
|
97
131
|
]);
|
|
98
132
|
expect(collectAgentCallReferences(spec, "acme")).toEqual([
|
|
99
|
-
{
|
|
133
|
+
{
|
|
134
|
+
kind: ApiResourceKind.agent,
|
|
135
|
+
org: "acme",
|
|
136
|
+
slug: "reviewer",
|
|
137
|
+
resolvesIn: "running-organization",
|
|
138
|
+
},
|
|
139
|
+
{ kind: ApiResourceKind.agent, org: "globex", slug: "summarizer" },
|
|
140
|
+
{
|
|
141
|
+
kind: ApiResourceKind.agent,
|
|
142
|
+
org: "acme",
|
|
143
|
+
slug: "cleaner",
|
|
144
|
+
resolvesIn: "running-organization",
|
|
145
|
+
},
|
|
146
|
+
]);
|
|
147
|
+
});
|
|
148
|
+
|
|
149
|
+
it("collects nothing for a value fixed only at run, beside the references it does collect", () => {
|
|
150
|
+
const spec = specOf([
|
|
151
|
+
...RUN_TIME_VALUES.map((value, i) => agentCall(`dynamic_${i}`, value)),
|
|
152
|
+
agentCall("fixed", "globex/summarizer"),
|
|
153
|
+
]);
|
|
154
|
+
expect(collectAgentCallReferences(spec, "acme")).toEqual([
|
|
100
155
|
{ kind: ApiResourceKind.agent, org: "globex", slug: "summarizer" },
|
|
101
|
-
{ kind: ApiResourceKind.agent, org: "acme", slug: "cleaner" },
|
|
102
156
|
]);
|
|
103
157
|
});
|
|
104
158
|
|
|
@@ -162,16 +216,19 @@ describe("ValidateAgentCallReferences over a store", () => {
|
|
|
162
216
|
);
|
|
163
217
|
}
|
|
164
218
|
|
|
165
|
-
function workflowCalling(
|
|
219
|
+
function workflowCalling(
|
|
220
|
+
visibility: ApiResourceVisibility,
|
|
221
|
+
...agents: string[]
|
|
222
|
+
): Workflow {
|
|
166
223
|
return create(WorkflowSchema, {
|
|
167
224
|
apiVersion: "agentic.stigmer.ai/v1",
|
|
168
225
|
kind: "Workflow",
|
|
169
|
-
metadata: { name: "Pipeline", org: "acme", visibility
|
|
226
|
+
metadata: { id: "wfl_1", name: "Pipeline", org: "acme", visibility },
|
|
170
227
|
spec: specOf(agents.map((agent, i) => agentCall(`call_${i}`, agent))),
|
|
171
228
|
});
|
|
172
229
|
}
|
|
173
230
|
|
|
174
|
-
async function run(workflow:
|
|
231
|
+
async function run(workflow: Workflow): Promise<unknown> {
|
|
175
232
|
const ctx = new RequestContext(
|
|
176
233
|
WorkflowSchema,
|
|
177
234
|
workflow,
|
|
@@ -187,21 +244,27 @@ describe("ValidateAgentCallReferences over a store", () => {
|
|
|
187
244
|
}
|
|
188
245
|
|
|
189
246
|
it("a missing agent is refused with the rule's copy; an existing one passes", async () => {
|
|
190
|
-
const error = await run(workflowCalling("reviewer"));
|
|
247
|
+
const error = await run(workflowCalling(V.visibility_org, "reviewer"));
|
|
191
248
|
expect(error).toBeInstanceOf(ConnectError);
|
|
192
249
|
expect((error as ConnectError).code).toBe(Code.FailedPrecondition);
|
|
193
250
|
expect((error as ConnectError).rawMessage).toBe(
|
|
194
251
|
missingReferencesMessage(AGENT, [{ slug: "reviewer", org: "acme" }]),
|
|
195
252
|
);
|
|
196
253
|
await seedAgent("agt_1", "acme", "reviewer", V.visibility_org);
|
|
197
|
-
expect(
|
|
254
|
+
expect(
|
|
255
|
+
await run(workflowCalling(V.visibility_org, "reviewer")),
|
|
256
|
+
).toBeUndefined();
|
|
198
257
|
});
|
|
199
258
|
|
|
200
259
|
it("another organization's agent is admitted only at platform visibility, with the one sentence otherwise", async () => {
|
|
201
260
|
await seedAgent("agt_shared", "globex", "shared", V.visibility_platform);
|
|
202
261
|
await seedAgent("agt_internal", "globex", "internal", V.visibility_org);
|
|
203
|
-
expect(
|
|
204
|
-
|
|
262
|
+
expect(
|
|
263
|
+
await run(workflowCalling(V.visibility_org, "globex/shared")),
|
|
264
|
+
).toBeUndefined();
|
|
265
|
+
const error = await run(
|
|
266
|
+
workflowCalling(V.visibility_org, "globex/internal"),
|
|
267
|
+
);
|
|
205
268
|
expect((error as ConnectError).rawMessage).toBe(
|
|
206
269
|
notAvailableReferenceMessage(AGENT, {
|
|
207
270
|
kind: ApiResourceKind.agent,
|
|
@@ -213,10 +276,98 @@ describe("ValidateAgentCallReferences over a store", () => {
|
|
|
213
276
|
|
|
214
277
|
it("the floor holds for the agent a workflow calls: an org-visible workflow may not call a private agent", async () => {
|
|
215
278
|
await seedAgent("agt_mine", "acme", "mine", V.visibility_private);
|
|
216
|
-
const error = await run(workflowCalling("mine"));
|
|
279
|
+
const error = await run(workflowCalling(V.visibility_org, "mine"));
|
|
217
280
|
expect((error as ConnectError).code).toBe(Code.FailedPrecondition);
|
|
218
281
|
expect((error as ConnectError).rawMessage).toContain(
|
|
219
282
|
"referenced agent 'acme/mine' is visibility_private while this resource is visibility_org",
|
|
220
283
|
);
|
|
221
284
|
});
|
|
285
|
+
|
|
286
|
+
it("a platform-visible workflow may call its organization's org-visible agent by bare slug, never by literal, and never a private one", async () => {
|
|
287
|
+
await seedAgent("agt_team", "acme", "team", V.visibility_org);
|
|
288
|
+
await seedAgent("agt_mine", "acme", "mine", V.visibility_private);
|
|
289
|
+
expect(
|
|
290
|
+
await run(workflowCalling(V.visibility_platform, "team")),
|
|
291
|
+
).toBeUndefined();
|
|
292
|
+
// The literal names a fixed row that every organization's runs read.
|
|
293
|
+
const literal = await run(
|
|
294
|
+
workflowCalling(V.visibility_platform, "acme/team"),
|
|
295
|
+
);
|
|
296
|
+
expect((literal as ConnectError).rawMessage).toContain(
|
|
297
|
+
"referenced agent 'acme/team' is visibility_org while this resource is visibility_platform",
|
|
298
|
+
);
|
|
299
|
+
const below = await run(workflowCalling(V.visibility_platform, "mine"));
|
|
300
|
+
expect((below as ConnectError).rawMessage).toContain(
|
|
301
|
+
"referenced agent 'acme/mine' is visibility_private while this resource is visibility_platform",
|
|
302
|
+
);
|
|
303
|
+
});
|
|
304
|
+
|
|
305
|
+
it("a value fixed only at run saves with no agent behind it, at every level", async () => {
|
|
306
|
+
for (const visibility of [
|
|
307
|
+
V.visibility_private,
|
|
308
|
+
V.visibility_org,
|
|
309
|
+
V.visibility_platform,
|
|
310
|
+
]) {
|
|
311
|
+
expect(
|
|
312
|
+
await run(workflowCalling(visibility, ...RUN_TIME_VALUES)),
|
|
313
|
+
V[visibility],
|
|
314
|
+
).toBeUndefined();
|
|
315
|
+
}
|
|
316
|
+
});
|
|
317
|
+
|
|
318
|
+
describe("the workflow's escalation door", () => {
|
|
319
|
+
const TARGET = "loadedWorkflow";
|
|
320
|
+
|
|
321
|
+
async function escalate(
|
|
322
|
+
stored: Workflow,
|
|
323
|
+
requested: ApiResourceVisibility,
|
|
324
|
+
): Promise<unknown> {
|
|
325
|
+
const ctx = new RequestContext(
|
|
326
|
+
UpdateVisibilityInputSchema,
|
|
327
|
+
create(UpdateVisibilityInputSchema, {
|
|
328
|
+
resourceId: "wfl_1",
|
|
329
|
+
visibility: requested,
|
|
330
|
+
}),
|
|
331
|
+
testCallerIdentity(),
|
|
332
|
+
ApiResourceKind.workflow,
|
|
333
|
+
);
|
|
334
|
+
ctx.set(TARGET, stored);
|
|
335
|
+
try {
|
|
336
|
+
await newGuardReferenceFloorOnEscalationStep(store, TARGET, [
|
|
337
|
+
(row) =>
|
|
338
|
+
collectAgentCallReferences(
|
|
339
|
+
(row as Workflow).spec,
|
|
340
|
+
(row as Workflow).metadata?.org ?? "",
|
|
341
|
+
),
|
|
342
|
+
]).execute(ctx);
|
|
343
|
+
return undefined;
|
|
344
|
+
} catch (error) {
|
|
345
|
+
return error;
|
|
346
|
+
}
|
|
347
|
+
}
|
|
348
|
+
|
|
349
|
+
it("raising a workflow that calls a bare slug to platform asks the capped floor", async () => {
|
|
350
|
+
await seedAgent("agt_team", "acme", "team", V.visibility_org);
|
|
351
|
+
await seedAgent("agt_mine", "acme", "mine", V.visibility_private);
|
|
352
|
+
expect(
|
|
353
|
+
await escalate(
|
|
354
|
+
workflowCalling(V.visibility_org, "team"),
|
|
355
|
+
V.visibility_platform,
|
|
356
|
+
),
|
|
357
|
+
).toBeUndefined();
|
|
358
|
+
const error = await escalate(
|
|
359
|
+
workflowCalling(V.visibility_private, "mine"),
|
|
360
|
+
V.visibility_platform,
|
|
361
|
+
);
|
|
362
|
+
expect((error as ConnectError).code).toBe(Code.FailedPrecondition);
|
|
363
|
+
expect((error as ConnectError).rawMessage).toBe(
|
|
364
|
+
belowFloorMessage(
|
|
365
|
+
AGENT,
|
|
366
|
+
{ kind: ApiResourceKind.agent, org: "acme", slug: "mine" },
|
|
367
|
+
V.visibility_private,
|
|
368
|
+
V.visibility_platform,
|
|
369
|
+
),
|
|
370
|
+
);
|
|
371
|
+
});
|
|
372
|
+
});
|
|
222
373
|
});
|
|
@@ -1,31 +1,50 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* ValidateAgentCallReferences — the second collector for the reference rule
|
|
3
3
|
* (pipeline/steps/references.ts): a workflow's `agent_call` tasks name their
|
|
4
|
-
* agent as a STRING
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
*
|
|
8
|
-
*
|
|
9
|
-
*
|
|
10
|
-
* and asks the rule's one function — same clauses, same copy. It
|
|
11
|
-
* the workflow domain and not inside `InProcessValidator` because
|
|
12
|
-
* validator is pure over the spec by design and a rule that reads the
|
|
4
|
+
* agent as a STRING inside a `google.protobuf.Struct` config the generic
|
|
5
|
+
* spec walker cannot see, so the rule would never meet them. This step
|
|
6
|
+
* parses each task's config through the converter's own strict decoder
|
|
7
|
+
* (`unmarshalTaskConfig`, the one reader of a task config), walks nested
|
|
8
|
+
* control-flow tasks exactly as the constraint validator does, turns every
|
|
9
|
+
* `agent` string the write can judge into a reference with the workflow as
|
|
10
|
+
* parent, and asks the rule's one function — same clauses, same copy. It
|
|
11
|
+
* lives in the workflow domain and not inside `InProcessValidator` because
|
|
12
|
+
* the validator is pure over the spec by design and a rule that reads the
|
|
13
13
|
* target's row cannot be.
|
|
14
14
|
*
|
|
15
|
-
* The
|
|
16
|
-
*
|
|
17
|
-
*
|
|
18
|
-
*
|
|
19
|
-
*
|
|
20
|
-
*
|
|
21
|
-
*
|
|
22
|
-
*
|
|
23
|
-
*
|
|
15
|
+
* The string has three forms (the `agent` field's contract in
|
|
16
|
+
* agent_call.proto), told apart by `classifyAgentReference`:
|
|
17
|
+
*
|
|
18
|
+
* - `org/slug`, a LITERAL: judged now, like any stored reference;
|
|
19
|
+
* - a bare `slug`, RELATIVE: the runner resolves it in the organization
|
|
20
|
+
* the workflow runs in (`__stigmer_org_id`, the execution's), which is
|
|
21
|
+
* not the workflow's when a person runs it from another organization by
|
|
22
|
+
* id. It is judged now in the workflow's own organization with its
|
|
23
|
+
* floor capped at org (references.ts, "RELATIVE");
|
|
24
|
+
* - a value holding `${`, fixed only AT RUN: the runner's jq phase
|
|
25
|
+
* (`${ expr }`, whole or embedded) or its activity phase
|
|
26
|
+
* (`${.env_vars.KEY}`, `${.secrets.KEY}`) produces the reference when
|
|
27
|
+
* the task runs. The write collects nothing for it; the run reads the
|
|
28
|
+
* resolved agent as the person who ran the workflow, as it reads every
|
|
29
|
+
* id-bound binding. The slug grammar (metadata.proto) can never contain
|
|
30
|
+
* `${`, so the test is exact. It deliberately does not recognise only
|
|
31
|
+
* the runner's shapes: that would be a second copy of the runner's
|
|
32
|
+
* grammar in a package that shares only the protos with it, and a
|
|
33
|
+
* mistyped expression already fails at run with the read's not-found.
|
|
34
|
+
*
|
|
35
|
+
* Anything else is refused at write naming the task. The runner's own
|
|
36
|
+
* parser (`parseAgentReference` in runner/src/activities/call-agent.ts) is
|
|
37
|
+
* lenient — it splits on the first `/` and drops a third segment — and the
|
|
38
|
+
* CLI's `parseReference` (client-apps/cli/src/resources/reference.ts)
|
|
39
|
+
* refuses a leading slash; refusing every malformed literal here means
|
|
40
|
+
* neither ever meets one. The three cannot share code; the conformance
|
|
41
|
+
* suites are where their agreement is proven.
|
|
24
42
|
*
|
|
25
43
|
* Runs after NormalizeReferences and ValidateReferences on the workflow
|
|
26
|
-
* create and update chains,
|
|
27
|
-
*
|
|
28
|
-
*
|
|
44
|
+
* create and update chains, and feeds the workflow's escalation door
|
|
45
|
+
* (controller.ts). Proven by __tests__/agent-call-references.test.ts, the
|
|
46
|
+
* workflow conformance suite's agent_call reference arm, and the
|
|
47
|
+
* runner-as-subject execution arm for a reference fixed only at run.
|
|
29
48
|
*/
|
|
30
49
|
import type { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
|
|
31
50
|
import type { AgentCallTaskConfig } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/agent_call_pb";
|
|
@@ -49,7 +68,7 @@ import { metadataOf } from "../../pipeline/steps/shapes.js";
|
|
|
49
68
|
import { unmarshalTaskConfig } from "./converter/unmarshal.js";
|
|
50
69
|
import { nestedTasks } from "./validation/task-config-constraints.js";
|
|
51
70
|
|
|
52
|
-
/** The one sentence for an `agent` string that is
|
|
71
|
+
/** The one sentence for an `agent` string that is none of the three forms. */
|
|
53
72
|
export function malformedAgentReferenceMessage(
|
|
54
73
|
taskName: string,
|
|
55
74
|
agent: string,
|
|
@@ -57,29 +76,38 @@ export function malformedAgentReferenceMessage(
|
|
|
57
76
|
return `task '${taskName}': agent '${agent}' is not a reference; write 'slug' for an agent of this organization or 'org/slug' for another organization's.`;
|
|
58
77
|
}
|
|
59
78
|
|
|
60
|
-
/**
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
79
|
+
/** What an `agent` string is before the rule reads it (the module header). */
|
|
80
|
+
export type AgentReferenceForm =
|
|
81
|
+
| { readonly kind: "literal"; readonly org: string; readonly slug: string }
|
|
82
|
+
| { readonly kind: "relative"; readonly slug: string }
|
|
83
|
+
| { readonly kind: "run-time" }
|
|
84
|
+
| { readonly kind: "malformed" };
|
|
85
|
+
|
|
86
|
+
/** Opens every runtime expression and placeholder the runner evaluates; never part of a slug. */
|
|
87
|
+
const RUNTIME_EXPRESSION_MARKER = "${";
|
|
88
|
+
|
|
89
|
+
export function classifyAgentReference(agent: string): AgentReferenceForm {
|
|
90
|
+
if (agent.includes(RUNTIME_EXPRESSION_MARKER)) {
|
|
91
|
+
return { kind: "run-time" };
|
|
92
|
+
}
|
|
67
93
|
const parts = agent.split("/");
|
|
68
|
-
if (parts.length === 1) {
|
|
69
|
-
return
|
|
94
|
+
if (parts.length === 1 && parts[0] !== "") {
|
|
95
|
+
return { kind: "relative", slug: parts[0]! };
|
|
70
96
|
}
|
|
71
97
|
if (parts.length === 2 && parts[0] !== "" && parts[1] !== "") {
|
|
72
|
-
return { org: parts[0]!, slug: parts[1]! };
|
|
98
|
+
return { kind: "literal", org: parts[0]!, slug: parts[1]! };
|
|
73
99
|
}
|
|
74
|
-
return
|
|
100
|
+
return { kind: "malformed" };
|
|
75
101
|
}
|
|
76
102
|
|
|
77
103
|
/**
|
|
78
|
-
* Every `agent_call` task's agent as a reference,
|
|
79
|
-
* declaration order
|
|
80
|
-
*
|
|
81
|
-
*
|
|
82
|
-
*
|
|
104
|
+
* Every `agent_call` task's agent the write can judge, as a reference,
|
|
105
|
+
* nested tasks included in declaration order: a literal as written, a
|
|
106
|
+
* relative slug in `parentOrg` and marked relative, a value fixed only at
|
|
107
|
+
* run not at all. Throws INVALID_ARGUMENT on the first malformed string. A
|
|
108
|
+
* config that does not decode is skipped: the spec validation step has
|
|
109
|
+
* already refused the workflow for it, and this collector never
|
|
110
|
+
* double-reports.
|
|
83
111
|
*/
|
|
84
112
|
export function collectAgentCallReferences(
|
|
85
113
|
spec: WorkflowSpec | undefined,
|
|
@@ -100,17 +128,36 @@ export function collectAgentCallReferences(
|
|
|
100
128
|
if (config !== undefined) {
|
|
101
129
|
if (task.kind === WorkflowTaskKind.agent_call) {
|
|
102
130
|
const agent = (config as AgentCallTaskConfig).agent;
|
|
103
|
-
const
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
131
|
+
const form = classifyAgentReference(agent);
|
|
132
|
+
switch (form.kind) {
|
|
133
|
+
case "literal":
|
|
134
|
+
refs.push({
|
|
135
|
+
kind: ApiResourceKind.agent,
|
|
136
|
+
org: form.org,
|
|
137
|
+
slug: form.slug,
|
|
138
|
+
});
|
|
139
|
+
break;
|
|
140
|
+
case "relative":
|
|
141
|
+
refs.push({
|
|
142
|
+
kind: ApiResourceKind.agent,
|
|
143
|
+
org: parentOrg,
|
|
144
|
+
slug: form.slug,
|
|
145
|
+
resolvesIn: "running-organization",
|
|
146
|
+
});
|
|
147
|
+
break;
|
|
148
|
+
case "run-time":
|
|
149
|
+
break;
|
|
150
|
+
case "malformed":
|
|
151
|
+
throw invalidArgumentError(
|
|
152
|
+
malformedAgentReferenceMessage(task.name, agent),
|
|
153
|
+
);
|
|
154
|
+
default: {
|
|
155
|
+
const exhaustive: never = form;
|
|
156
|
+
throw new Error(
|
|
157
|
+
`unknown agent reference form: ${JSON.stringify(exhaustive)}`,
|
|
158
|
+
);
|
|
159
|
+
}
|
|
108
160
|
}
|
|
109
|
-
refs.push({
|
|
110
|
-
kind: ApiResourceKind.agent,
|
|
111
|
-
org: parsed.org === "" ? parentOrg : parsed.org,
|
|
112
|
-
slug: parsed.slug,
|
|
113
|
-
});
|
|
114
161
|
}
|
|
115
162
|
for (const nested of nestedTasks(config)) {
|
|
116
163
|
visit(nested);
|
|
@@ -1362,7 +1362,7 @@
|
|
|
1362
1362
|
{
|
|
1363
1363
|
"name": "agent",
|
|
1364
1364
|
"displayName": "Agent",
|
|
1365
|
-
"description": "Agent
|
|
1365
|
+
"description": "Agent to invoke, as \"slug\", \"org/slug\", or a value holding a runtime expression. - \"slug\": an agent of the organization the workflow runs in; checked when the workflow is saved, against the workflow's own organization - \"org/slug\": that organization's agent; checked when the workflow is saved, and another organization's agent must be shared at platform visibility - a value holding \"${ ... }\", \"${.env_vars.KEY}\" or \"${.secrets.KEY}\": resolved to \"slug\" or \"org/slug\" when the task runs, and read as the person who ran the workflow Examples: \"code-reviewer\", \"acme/data-analyst\", \"${.env_vars.TEAM_ORG}/assistant\" Required field.",
|
|
1366
1366
|
"type": "string",
|
|
1367
1367
|
"required": true,
|
|
1368
1368
|
"groupId": "core",
|
|
@@ -1470,7 +1470,7 @@
|
|
|
1470
1470
|
"additionalProperties": false,
|
|
1471
1471
|
"properties": {
|
|
1472
1472
|
"agent": {
|
|
1473
|
-
"description": "Agent
|
|
1473
|
+
"description": "Agent to invoke, as \"slug\", \"org/slug\", or a value holding a runtime expression. - \"slug\": an agent of the organization the workflow runs in; checked when the workflow is saved, against the workflow's own organization - \"org/slug\": that organization's agent; checked when the workflow is saved, and another organization's agent must be shared at platform visibility - a value holding \"${ ... }\", \"${.env_vars.KEY}\" or \"${.secrets.KEY}\": resolved to \"slug\" or \"org/slug\" when the task runs, and read as the person who ran the workflow Examples: \"code-reviewer\", \"acme/data-analyst\", \"${.env_vars.TEAM_ORG}/assistant\" Required field.",
|
|
1474
1474
|
"maxLength": 127,
|
|
1475
1475
|
"minLength": 1,
|
|
1476
1476
|
"type": "string"
|
|
@@ -45,15 +45,16 @@ export const SYSTEM_MANAGED_LABEL = `${RESERVED_LABEL_PREFIX}system-managed`;
|
|
|
45
45
|
|
|
46
46
|
/**
|
|
47
47
|
* Marks system content: a resource the platform itself seeded rather than a
|
|
48
|
-
* user authored
|
|
49
|
-
*
|
|
50
|
-
*
|
|
51
|
-
*
|
|
52
|
-
*
|
|
53
|
-
*
|
|
54
|
-
*
|
|
55
|
-
*
|
|
56
|
-
*
|
|
48
|
+
* user authored. The retired seedpack wrote it on every row it applied, and
|
|
49
|
+
* CLIs before the bootstrap stopped labelling stamped it on the `stigmer`
|
|
50
|
+
* organization they created. A plugin overlay may still carry it on a
|
|
51
|
+
* member (a reserved label, so the push charges the platform permission for
|
|
52
|
+
* it). It has one server-side meaning: a plugin
|
|
53
|
+
* push may adopt a system-content row that holds a slug the plugin needs,
|
|
54
|
+
* keeping the row's id and everything bound to it, instead of refusing the
|
|
55
|
+
* slug as taken. It never marks a user's resource, so a user's row is never
|
|
56
|
+
* adopted (domain/plugin/members.ts, judgeSlug); on an organization it is
|
|
57
|
+
* inert.
|
|
57
58
|
*/
|
|
58
59
|
export const SYSTEM_LABEL = `${RESERVED_LABEL_PREFIX}system`;
|
|
59
60
|
|
|
@@ -5,7 +5,8 @@
|
|
|
5
5
|
* task config, through the `reference_kind` field option); each clause on
|
|
6
6
|
* each kind — no org refused, a same-organization target must exist, the
|
|
7
7
|
* floor applies to the kinds the run reads as the person and to no other,
|
|
8
|
-
* a
|
|
8
|
+
* a relative reference's floor is capped at org and its target must still
|
|
9
|
+
* exist in the resource's organization, a cross-organization target is admitted only at platform visibility with
|
|
9
10
|
* ONE sentence whether it is missing or merely not shared; the MCP-server
|
|
10
11
|
* copy that predates the rule is byte-identical and its siblings take its
|
|
11
12
|
* shape; the walk reads a reference's kind from its field, not from the
|
|
@@ -289,6 +290,39 @@ describe("checkReference", () => {
|
|
|
289
290
|
).toEqual({ kind: "below-floor", targetVisibility: V.visibility_org });
|
|
290
291
|
});
|
|
291
292
|
|
|
293
|
+
it("(ii) a relative reference's floor is capped at org: a platform resource may run with its organization's org-visible target, never a private one, and the target must exist", () => {
|
|
294
|
+
const relative = (slug: string): SpecReference => ({
|
|
295
|
+
...ref(K.mcp_server, "acme", slug),
|
|
296
|
+
resolvesIn: "running-organization",
|
|
297
|
+
});
|
|
298
|
+
const privateTarget: SpecReference = {
|
|
299
|
+
...ref(K.skill, "acme", "my-skill"),
|
|
300
|
+
resolvesIn: "running-organization",
|
|
301
|
+
};
|
|
302
|
+
const ACME_PLATFORM: ReferenceParent = {
|
|
303
|
+
org: "acme",
|
|
304
|
+
visibility: V.visibility_platform,
|
|
305
|
+
};
|
|
306
|
+
expect(checkReference(targets, ACME_PLATFORM, relative("github"))).toEqual({
|
|
307
|
+
kind: "ok",
|
|
308
|
+
});
|
|
309
|
+
expect(checkReference(targets, ACME_PLATFORM, privateTarget)).toEqual({
|
|
310
|
+
kind: "below-floor",
|
|
311
|
+
targetVisibility: V.visibility_private,
|
|
312
|
+
});
|
|
313
|
+
expect(checkReference(targets, ACME_PLATFORM, relative("ghost"))).toEqual({
|
|
314
|
+
kind: "missing",
|
|
315
|
+
});
|
|
316
|
+
// Below the cap the resource's own level decides, as for any reference.
|
|
317
|
+
expect(checkReference(targets, ACME_ORG, privateTarget)).toEqual({
|
|
318
|
+
kind: "below-floor",
|
|
319
|
+
targetVisibility: V.visibility_private,
|
|
320
|
+
});
|
|
321
|
+
expect(checkReference(targets, ACME_PRIVATE, privateTarget)).toEqual({
|
|
322
|
+
kind: "ok",
|
|
323
|
+
});
|
|
324
|
+
});
|
|
325
|
+
|
|
292
326
|
it("(ii) the floor does not apply to what the server resolves on the run's behalf", () => {
|
|
293
327
|
// An org-visible instance over a private personal environment: the
|
|
294
328
|
// ordinary shape of a personal instance, admitted.
|
|
@@ -28,7 +28,8 @@
|
|
|
28
28
|
* channel apps are resolved by the server on the run's behalf and
|
|
29
29
|
* never read by the person, so their level is not a leak the floor
|
|
30
30
|
* closes, and an org-visible instance may hold a private personal
|
|
31
|
-
* environment as it always has.
|
|
31
|
+
* environment as it always has. A RELATIVE reference (below) is
|
|
32
|
+
* compared against the resource's level capped at org.
|
|
32
33
|
* (iii) Another organization: the target must exist AND be
|
|
33
34
|
* platform-visible, answered with ONE sentence that does not say
|
|
34
35
|
* which failed. The caller has no standing to learn what another
|
|
@@ -48,14 +49,32 @@
|
|
|
48
49
|
* the rule must agree with the runtime. A reference with an empty slug is
|
|
49
50
|
* unset and skipped (the field-level CEL rules own "required").
|
|
50
51
|
*
|
|
52
|
+
* A reference is RELATIVE when it names no organization of its own and
|
|
53
|
+
* the runtime resolves it in the organization the resource RUNS in, not
|
|
54
|
+
* the one it is stored in. Exactly one exists: a workflow `agent_call`
|
|
55
|
+
* task's bare slug (domain/workflow/agent-call-references.ts), which the
|
|
56
|
+
* runner resolves in the execution's organization; any workflow a person
|
|
57
|
+
* may execute can run from another organization by id. The rule judges
|
|
58
|
+
* it in the resource's own organization — the one its author can see, so
|
|
59
|
+
* the target must exist there — and caps its floor at org: only the
|
|
60
|
+
* running organization's own people ever read a target through it, and
|
|
61
|
+
* they can read an org-visible one. The cap changes nothing for a
|
|
62
|
+
* private or org resource and lets a platform-visible workflow call its
|
|
63
|
+
* organization's org-visible agent. A value fixed only at run (an
|
|
64
|
+
* `agent_call` agent holding a runtime expression) is not a reference at
|
|
65
|
+
* all: the collector yields nothing for it, and the run reads the
|
|
66
|
+
* resolved target as the person the run acts as, as it reads every
|
|
67
|
+
* id-bound binding.
|
|
68
|
+
*
|
|
51
69
|
* The floor has a second door. Raising a resource's level through
|
|
52
70
|
* updateVisibility could open the same gap a create cannot, so
|
|
53
71
|
* GuardReferenceFloorOnEscalation runs on the two chains whose rows carry
|
|
54
72
|
* run-read references (agent, workflow) after ValidateVisibilityUpdate:
|
|
55
73
|
* when the requested level is above the stored one, every run-read
|
|
56
|
-
* reference the STORED row carries must be at least the requested level
|
|
57
|
-
*
|
|
58
|
-
*
|
|
74
|
+
* reference the STORED row carries must be at least the requested level
|
|
75
|
+
* (a relative one, at least the requested level capped at org), judged by
|
|
76
|
+
* the same function over the same collectors, else the escalation is
|
|
77
|
+
* refused naming the dependencies. Only the floor is asked at
|
|
59
78
|
* that door — a dependency that has since left or stopped being shared was
|
|
60
79
|
* judged when the row was written and is the run's to refuse.
|
|
61
80
|
*
|
|
@@ -182,6 +201,13 @@ export interface SpecReference {
|
|
|
182
201
|
readonly kind: ApiResourceKind;
|
|
183
202
|
readonly slug: string;
|
|
184
203
|
readonly org: string;
|
|
204
|
+
/**
|
|
205
|
+
* Present only on a RELATIVE reference (the module header): `org` is the
|
|
206
|
+
* resource's own, filled by the collector, and the runtime resolves the
|
|
207
|
+
* slug in the organization the resource runs in. The generic walker
|
|
208
|
+
* never sets it; only the `agent_call` collector does.
|
|
209
|
+
*/
|
|
210
|
+
readonly resolvesIn?: "running-organization";
|
|
185
211
|
}
|
|
186
212
|
|
|
187
213
|
/** The resource the references belong to, as the rule needs it. */
|
|
@@ -279,13 +305,31 @@ export function checkReference(
|
|
|
279
305
|
const entry = referenceTargetKind(ref.kind);
|
|
280
306
|
if (
|
|
281
307
|
entry?.readByRun === true &&
|
|
282
|
-
visibilityRank(target) < visibilityRank(parent
|
|
308
|
+
visibilityRank(target) < visibilityRank(floorOf(parent, ref))
|
|
283
309
|
) {
|
|
284
310
|
return { kind: "below-floor", targetVisibility: target };
|
|
285
311
|
}
|
|
286
312
|
return { kind: "ok" };
|
|
287
313
|
}
|
|
288
314
|
|
|
315
|
+
/**
|
|
316
|
+
* The level a same-organization target must reach: the resource's own,
|
|
317
|
+
* capped at org for a relative reference (the module header).
|
|
318
|
+
*/
|
|
319
|
+
function floorOf(
|
|
320
|
+
parent: ReferenceParent,
|
|
321
|
+
ref: SpecReference,
|
|
322
|
+
): ApiResourceVisibility {
|
|
323
|
+
if (
|
|
324
|
+
ref.resolvesIn === "running-organization" &&
|
|
325
|
+
visibilityRank(parent.visibility) >
|
|
326
|
+
visibilityRank(ApiResourceVisibility.visibility_org)
|
|
327
|
+
) {
|
|
328
|
+
return ApiResourceVisibility.visibility_org;
|
|
329
|
+
}
|
|
330
|
+
return parent.visibility;
|
|
331
|
+
}
|
|
332
|
+
|
|
289
333
|
/**
|
|
290
334
|
* The order the floor compares on: private < org < platform, an unset
|
|
291
335
|
* level reading as private (the level a row with no config holds). The
|