@stigmer/server 3.14.0-dev.20260910084630

package/dist/pipeline/interceptors/logging.js

@@ -0,0 +1,68 @@
+/**
+ * Logging interceptor — chain position 2, ported from the Go server's
+ * loggingUnaryInterceptor/loggingStreamInterceptor
+ * (backend/libs/go/grpc/server.go:273-381).
+ *
+ * The level tiering is contract, not taste: expected-in-normal-operation
+ * outcomes must not pollute operator logs at error level.
+ *
+ *   NotFound / AlreadyExists            → debug ("returned not found")
+ *   InvalidArgument / FailedPrecondition → warn  ("client error")
+ *   any other error code                 → error
+ *   success                              → info — EXCEPT health-service
+ *                                          methods, which log at debug
+ *                                          (the CLI polls health; Go
+ *                                          server.go:328-331,343-345)
+ *
+ * Go logs err.Error() — the REAL error — while the wire carries the
+ * sanitized status message (server.go:314-323). Mirrored here: the `error`
+ * field is the thrown error's own message, whatever the handler chose to
+ * put on the wire.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+/** Health successes are polled chatter, logged at debug (Go grpc lib server.go:30). */
+const HEALTH_SERVICE_TYPE_NAME = "grpc.health.v1.Health";
+export function createLoggingInterceptor(logger) {
+    return (next) => async (request) => {
+        const procedure = `/${request.service.typeName}/${request.method.name}`;
+        const startedAt = performance.now();
+        try {
+            const response = await next(request);
+            const fields = { procedure, durationMs: elapsed(startedAt) };
+            if (request.service.typeName === HEALTH_SERVICE_TYPE_NAME) {
+                logger.debug("rpc completed", fields);
+            }
+            else {
+                logger.info("rpc completed", fields);
+            }
+            return response;
+        }
+        catch (error) {
+            const connectError = ConnectError.from(error);
+            const fields = {
+                procedure,
+                code: Code[connectError.code],
+                durationMs: elapsed(startedAt),
+                // The real error, not the sanitized wire message (Go parity).
+                error: error instanceof Error ? error.message : String(error),
+            };
+            switch (connectError.code) {
+                case Code.NotFound:
+                case Code.AlreadyExists:
+                    logger.debug("rpc returned not found", fields);
+                    break;
+                case Code.InvalidArgument:
+                case Code.FailedPrecondition:
+                    logger.warn("rpc client error", fields);
+                    break;
+                default:
+                    logger.error("rpc failed", fields);
+            }
+            throw error;
+        }
+    };
+}
+function elapsed(startedAt) {
+    return Math.round(performance.now() - startedAt);
+}
+//# sourceMappingURL=logging.js.map

package/dist/pipeline/interceptors/logging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.js","sourceRoot":"","sources":["../../../src/pipeline/interceptors/logging.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKzD,uFAAuF;AACvF,MAAM,wBAAwB,GAAG,uBAAuB,CAAC;AAEzD,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACjC,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACxE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7D,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,KAAK,wBAAwB,EAAE,CAAC;gBAC1D,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG;gBACb,SAAS;gBACT,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;gBAC7B,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC;gBAC9B,8DAA8D;gBAC9D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC;YACF,QAAQ,YAAY,CAAC,IAAI,EAAE,CAAC;gBAC1B,KAAK,IAAI,CAAC,QAAQ,CAAC;gBACnB,KAAK,IAAI,CAAC,aAAa;oBACrB,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;oBAC/C,MAAM;gBACR,KAAK,IAAI,CAAC,eAAe,CAAC;gBAC1B,KAAK,IAAI,CAAC,kBAAkB;oBAC1B,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;oBACxC,MAAM;gBACR;oBACE,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACvC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,SAAiB;IAChC,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;AACnD,CAAC"}

package/dist/pipeline/interceptors/protovalidate.d.ts

@@ -0,0 +1,3 @@
+import type { Interceptor } from "@connectrpc/connect";
+export declare function createProtovalidateInterceptor(): Interceptor;
+//# sourceMappingURL=protovalidate.d.ts.map

package/dist/pipeline/interceptors/protovalidate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protovalidate.d.ts","sourceRoot":"","sources":["../../../src/pipeline/interceptors/protovalidate.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAMvD,wBAAgB,8BAA8B,IAAI,WAAW,CAa5D"}

package/dist/pipeline/interceptors/protovalidate.js

@@ -0,0 +1,50 @@
+/**
+ * Protovalidate interceptor — chain position 3, the boundary validator
+ * (D2 §2; Go registers protovalidateinterceptor on both the unary and
+ * stream chains, pkg/server/server.go:253-254).
+ *
+ * Every request message is validated against its proto rules BEFORE any
+ * handler code, including in-process calls through the router transport —
+ * that traversal is the validation-parity property spike SP-B proved.
+ * Client/bidi-streaming requests validate each message as it arrives.
+ *
+ * Violations map to InvalidArgument carrying the library's violation text.
+ * WATCH ITEM for the first domain port (#4): protovalidate-es and
+ * protovalidate-go may format violation strings differently; if a
+ * conformance suite pins validation MESSAGE bytes (not just the code),
+ * that divergence surfaces there and goes to the owner — do not paper over
+ * it here.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { createValidator } from "@bufbuild/protovalidate";
+export function createProtovalidateInterceptor() {
+    const validator = createValidator();
+    return (next) => (request) => {
+        if (!request.stream) {
+            assertValid(validator, request.method.input, request.message);
+            return next(request);
+        }
+        return next({
+            ...request,
+            message: validateEach(validator, request.method.input, request.message),
+        });
+    };
+}
+function assertValid(validator, schema, message) {
+    const result = validator.validate(schema, message);
+    if (result.kind === "valid") {
+        return;
+    }
+    if (result.kind === "invalid") {
+        throw new ConnectError(result.error.message, Code.InvalidArgument);
+    }
+    // A rule that fails to compile/evaluate is a server defect, not bad input.
+    throw new ConnectError(`validation could not run: ${result.error.message}`, Code.Internal);
+}
+async function* validateEach(validator, schema, messages) {
+    for await (const message of messages) {
+        assertValid(validator, schema, message);
+        yield message;
+    }
+}
+//# sourceMappingURL=protovalidate.js.map

package/dist/pipeline/interceptors/protovalidate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protovalidate.js","sourceRoot":"","sources":["../../../src/pipeline/interceptors/protovalidate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAIzD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAG1D,MAAM,UAAU,8BAA8B;IAC5C,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;IAEpC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,IAAI,CAAC;YACV,GAAG,OAAO;YACV,OAAO,EAAE,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC;SACxE,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,SAAoB,EACpB,MAAmB,EACnB,OAAgB;IAEhB,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAkB,CAAC,CAAC;IAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACrE,CAAC;IACD,2EAA2E;IAC3E,MAAM,IAAI,YAAY,CACpB,6BAA6B,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACnD,IAAI,CAAC,QAAQ,CACd,CAAC;AACJ,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,YAAY,CAC1B,SAAoB,EACpB,MAAmB,EACnB,QAA0B;IAE1B,IAAI,KAAK,EAAE,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QACrC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACxC,MAAM,OAAO,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/pipeline/interceptors/request-metrics.d.ts

@@ -0,0 +1,5 @@
+import type { Interceptor } from "@connectrpc/connect";
+/** Test seam: a fake clock; production reads `performance.now()`. */
+export type Clock = () => number;
+export declare function createRequestMetricsInterceptor(now?: Clock): Interceptor;
+//# sourceMappingURL=request-metrics.d.ts.map

package/dist/pipeline/interceptors/request-metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-metrics.d.ts","sourceRoot":"","sources":["../../../src/pipeline/interceptors/request-metrics.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAUvD,qEAAqE;AACrE,MAAM,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC;AAEjC,wBAAgB,+BAA+B,CAC7C,GAAG,GAAE,KAA+B,GACnC,WAAW,CA4Bb"}

package/dist/pipeline/interceptors/request-metrics.js

@@ -0,0 +1,99 @@
+/**
+ * Request-metrics interceptor — the serving chain's RED emitter, the TS
+ * port of the cloud Java `GrpcRequestMetricsInterceptor` (convergence
+ * entry 20260909.02, gate rulings Q1–Q5 as recommended). One record per
+ * RPC into `observability/rpc-metrics.ts`: the count and the duration,
+ * labelled with the service, the method and the gRPC status name.
+ *
+ * Placement contract: SERVING chain only, immediately INSIDE the identity
+ * source (chain.ts). That is Java's real position —
+ * `@Order(ORDER_SECURITY_AUTHENTICATION + 2)`, after the authentication
+ * interceptor that closes tokenless and invalid-token calls — and the
+ * position the logging interceptor already holds, so metrics and logs
+ * observe the same set of requests: an identity refusal is position 1's
+ * own record (auth.ts logs it), never a counted error. The choice has a
+ * paging consequence and was ruled, not assumed: `grpc-error-rate-spike`
+ * counts every non-OK code with no exclusions, and an outermost emitter
+ * would page on an expired console tab's retries or an internet scanner
+ * at a quiet hour. The disclosed deviation from Java: the caller guards
+ * run inside position 1 here (Java's platform-client enforcement sat
+ * inside its metrics), so a guard refusal is not counted either — fewer
+ * errors counted, never more. The in-process chain never composes this
+ * interceptor: an in-process hop is not a request.
+ *
+ * Status of a failure is `ConnectError.from(error).code`, exactly the
+ * logging interceptor's derivation: a raw non-ConnectError is UNKNOWN
+ * here and INTERNAL on the wire after the error boundary outside converts
+ * it — the boundary's error-level line names each such conversion, and
+ * grpc-java produced UNKNOWN for the same class. Health is not measured
+ * (the by-name authentication-exempt services — Kubernetes probes every
+ * few seconds would own the request-rate signal; Java's auth and metrics
+ * skip lists are the same names by construction); `is_public` methods
+ * ARE measured — they are API.
+ *
+ * Duration is fractional milliseconds from interception to the RPC's
+ * end. For a server stream that is the END OF THE STREAM (Java measured
+ * to `ServerCall.close`): the response iterable is re-wrapped, the error
+ * boundary's idiom, and the one record fires in `finally` — OK when the
+ * stream ran to completion, the error's code when it threw, CANCELLED
+ * when the consumer stopped early (the client went away, or the
+ * transport stopped pulling). The logging interceptor measures a stream
+ * only to the handler's return; the difference is deliberate here and
+ * disclosed there.
+ */
+import { ConnectError } from "@connectrpc/connect";
+import { GRPC_STATUS_OK, grpcStatusName, recordRpc, } from "../../observability/rpc-metrics.js";
+import { AUTHENTICATION_EXEMPT_SERVICES } from "./auth.js";
+export function createRequestMetricsInterceptor(now = () => performance.now()) {
+    return (next) => async (request) => {
+        if (AUTHENTICATION_EXEMPT_SERVICES.has(request.service.typeName)) {
+            return next(request);
+        }
+        const service = request.service.typeName;
+        const method = request.method.name;
+        const startedAt = now();
+        const record = (status) => {
+            recordRpc(service, method, status, now() - startedAt);
+        };
+        let response;
+        try {
+            response = await next(request);
+        }
+        catch (error) {
+            record(statusOf(error));
+            throw error;
+        }
+        if (!response.stream) {
+            record(GRPC_STATUS_OK);
+            return response;
+        }
+        return {
+            ...response,
+            message: measureStream(response.message, record),
+        };
+    };
+}
+function statusOf(error) {
+    return grpcStatusName(ConnectError.from(error).code);
+}
+/**
+ * Records once when the stream ends, however it ends. `finally` runs on
+ * completion, on a throw, and when the consumer returns early — the
+ * three ways a server stream closes; `outcome` distinguishes the first two
+ * and its absence is the third.
+ */
+async function* measureStream(messages, record) {
+    let outcome;
+    try {
+        yield* messages;
+        outcome = GRPC_STATUS_OK;
+    }
+    catch (error) {
+        outcome = statusOf(error);
+        throw error;
+    }
+    finally {
+        record(outcome ?? "CANCELLED");
+    }
+}
+//# sourceMappingURL=request-metrics.js.map

package/dist/pipeline/interceptors/request-metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-metrics.js","sourceRoot":"","sources":["../../../src/pipeline/interceptors/request-metrics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGnD,OAAO,EACL,cAAc,EACd,cAAc,EACd,SAAS,GACV,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,8BAA8B,EAAE,MAAM,WAAW,CAAC;AAK3D,MAAM,UAAU,+BAA+B,CAC7C,MAAa,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;IAEpC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACjC,IAAI,8BAA8B,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QACnC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,CAAC,MAAsB,EAAQ,EAAE;YAC9C,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;QACxD,CAAC,CAAC;QAEF,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YACxB,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,MAAM,CAAC,cAAc,CAAC,CAAC;YACvB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO;YACL,GAAG,QAAQ;YACX,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;SACjD,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,KAAK,SAAS,CAAC,CAAC,aAAa,CAC3B,QAA0B,EAC1B,MAAwC;IAExC,IAAI,OAAmC,CAAC;IACxC,IAAI,CAAC;QACH,KAAK,CAAC,CAAC,QAAQ,CAAC;QAChB,OAAO,GAAG,cAAc,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,IAAI,WAAW,CAAC,CAAC;IACjC,CAAC;AACH,CAAC"}

package/dist/pipeline/pipeline.d.ts

@@ -0,0 +1,36 @@
+import type { DescMessage } from "@bufbuild/protobuf";
+import type { Logger } from "../boot/logger.js";
+import type { RequestContext } from "./request-context.js";
+/** One step in request processing (Go PipelineStep). */
+export interface PipelineStep<Desc extends DescMessage> {
+    /** Human-readable step name — the shared vocabulary (guidelines §3). */
+    readonly name: string;
+    /** Runs the step; throwing halts the pipeline. May be sync or async. */
+    execute(ctx: RequestContext<Desc>): void | Promise<void>;
+}
+/**
+ * The wire description for a step that threw a plain (non-Connect) error —
+ * Go's internalFallbackMessage, byte-identical.
+ */
+export declare const INTERNAL_FALLBACK_MESSAGE = "internal server error";
+export declare class Pipeline<Desc extends DescMessage> {
+    private readonly pipelineName;
+    private readonly steps;
+    private readonly logger;
+    constructor(pipelineName: string, steps: ReadonlyArray<PipelineStep<Desc>>, logger: Logger);
+    get name(): string;
+    get stepCount(): number;
+    /** Runs all steps in order; throws the first failure as a ConnectError. */
+    execute(ctx: RequestContext<Desc>): Promise<void>;
+}
+/** Fluent builder (Go NewPipeline(name).AddStep(...).Build()). */
+export declare class PipelineBuilder<Desc extends DescMessage> {
+    private readonly name;
+    private readonly logger;
+    private readonly steps;
+    constructor(name: string, logger: Logger);
+    addStep(step: PipelineStep<Desc>): this;
+    build(): Pipeline<Desc>;
+}
+export declare function newPipeline<Desc extends DescMessage>(name: string, logger: Logger): PipelineBuilder<Desc>;
+//# sourceMappingURL=pipeline.d.ts.map

package/dist/pipeline/pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../src/pipeline/pipeline.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,wDAAwD;AACxD,MAAM,WAAW,YAAY,CAAC,IAAI,SAAS,WAAW;IACpD,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AAEjE,qBAAa,QAAQ,CAAC,IAAI,SAAS,WAAW;IAE1C,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EACxC,MAAM,EAAE,MAAM;IAGjC,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,2EAA2E;IACrE,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CA0BxD;AAED,kEAAkE;AAClE,qBAAa,eAAe,CAAC,IAAI,SAAS,WAAW;IAIjD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;gBAGpC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM;IAGjC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,IAAI;IAKvC,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC;CAGxB;AAED,wBAAgB,WAAW,CAAC,IAAI,SAAS,WAAW,EAClD,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,eAAe,CAAC,IAAI,CAAC,CAEvB"}

package/dist/pipeline/pipeline.js

@@ -0,0 +1,93 @@
+/**
+ * Pipeline executor — ports backend/libs/go/grpc/request/pipeline/
+ * {pipeline,step,error}.go. Steps run in order; the first error halts the
+ * chain.
+ *
+ * The error contract is Go's PipelineError.GRPCStatus, verbatim in
+ * ConnectRPC terms (stigmer/stigmer#478):
+ *   - a step that throws a ConnectError has its code AND message preserved
+ *     on the wire (the clean domain message — no step-name prefix);
+ *   - a step that throws anything else reaches the wire as
+ *     Internal/"internal server error" — the raw text can carry
+ *     storage-engine detail or filesystem paths, which an anonymous caller
+ *     must never see. The original error rides `cause`.
+ * The step name and real error are logged HERE (Go's pipeline logs them via
+ * log.Printf; the transport logging interceptor separately records the
+ * wire-level outcome). Nothing diverges silently.
+ *
+ * Tracing spans are not ported: the TS server has no telemetry seam yet and
+ * Go's default is a no-op tracer — the span plumbing would be machinery
+ * without a consumer. It returns together with a real telemetry decision.
+ */
+import { ConnectError } from "@connectrpc/connect";
+import { internalError } from "./errors.js";
+/**
+ * The wire description for a step that threw a plain (non-Connect) error —
+ * Go's internalFallbackMessage, byte-identical.
+ */
+export const INTERNAL_FALLBACK_MESSAGE = "internal server error";
+export class Pipeline {
+    pipelineName;
+    steps;
+    logger;
+    constructor(pipelineName, steps, logger) {
+        this.pipelineName = pipelineName;
+        this.steps = steps;
+        this.logger = logger;
+    }
+    get name() {
+        return this.pipelineName;
+    }
+    get stepCount() {
+        return this.steps.length;
+    }
+    /** Runs all steps in order; throws the first failure as a ConnectError. */
+    async execute(ctx) {
+        for (const step of this.steps) {
+            const startedAt = performance.now();
+            try {
+                await step.execute(ctx);
+            }
+            catch (error) {
+                // The real error is logged here with its step (Go pipeline.go's
+                // failure log line); the wire gets the sanitized form below.
+                this.logger.warn("pipeline step failed", {
+                    pipeline: this.pipelineName,
+                    step: step.name,
+                    durationMs: Math.round(performance.now() - startedAt),
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                if (error instanceof ConnectError) {
+                    throw error;
+                }
+                throw internalError(error, INTERNAL_FALLBACK_MESSAGE);
+            }
+            this.logger.debug("pipeline step completed", {
+                pipeline: this.pipelineName,
+                step: step.name,
+                durationMs: Math.round(performance.now() - startedAt),
+            });
+        }
+    }
+}
+/** Fluent builder (Go NewPipeline(name).AddStep(...).Build()). */
+export class PipelineBuilder {
+    name;
+    logger;
+    steps = [];
+    constructor(name, logger) {
+        this.name = name;
+        this.logger = logger;
+    }
+    addStep(step) {
+        this.steps.push(step);
+        return this;
+    }
+    build() {
+        return new Pipeline(this.name, this.steps, this.logger);
+    }
+}
+export function newPipeline(name, logger) {
+    return new PipelineBuilder(name, logger);
+}
+//# sourceMappingURL=pipeline.js.map

package/dist/pipeline/pipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../../src/pipeline/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAInD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAW5C;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAEjE,MAAM,OAAO,QAAQ;IAEA;IACA;IACA;IAHnB,YACmB,YAAoB,EACpB,KAAwC,EACxC,MAAc;QAFd,iBAAY,GAAZ,YAAY,CAAQ;QACpB,UAAK,GAAL,KAAK,CAAmC;QACxC,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3B,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,OAAO,CAAC,GAAyB;QACrC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,gEAAgE;gBAChE,6DAA6D;gBAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;oBACvC,QAAQ,EAAE,IAAI,CAAC,YAAY;oBAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;oBACrD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;oBAClC,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,aAAa,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE;gBAC3C,QAAQ,EAAE,IAAI,CAAC,YAAY;gBAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAED,kEAAkE;AAClE,MAAM,OAAO,eAAe;IAIP;IACA;IAJF,KAAK,GAA8B,EAAE,CAAC;IAEvD,YACmB,IAAY,EACZ,MAAc;QADd,SAAI,GAAJ,IAAI,CAAQ;QACZ,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ,OAAO,CAAC,IAAwB;QAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC;CACF;AAED,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,MAAc;IAEd,OAAO,IAAI,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3C,CAAC"}

package/dist/pipeline/request-context.d.ts

@@ -0,0 +1,39 @@
+import type { DescMessage, MessageShape } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { CallerIdentity } from "../extensions/identity.js";
+/**
+ * The lifecycle chains' loaded-resource context key (Go's key string,
+ * verbatim). On lifecycle pipelines the request `Desc` is the INPUT
+ * message, so `ctx.newState` is the input — the loaded resource rides the
+ * metadata map under this key, stamped by each chain's LoadExecutionById
+ * step. Hoisted here (C4 Stage 3) so the two lifecycle modules and
+ * extension gate steps registered into recover-chain slots share ONE
+ * definition of the string instead of three copies of a silent contract.
+ */
+export declare const LOADED_EXECUTION_KEY = "loadedExecution";
+export declare class RequestContext<Desc extends DescMessage> {
+    /** The original, immutable request message. */
+    readonly input: MessageShape<Desc>;
+    /** The request's message schema (steps clone/compare through it). */
+    readonly schema: Desc;
+    /** The authenticated caller, produced at chain position 1 (O2). */
+    readonly callerIdentity: CallerIdentity;
+    /**
+     * The resource kind of the target service (Go: injected by the
+     * apiresource interceptor; unknown when the service carries no
+     * api_resource_kind option).
+     */
+    readonly apiResourceKind: ApiResourceKind;
+    private state;
+    private readonly metadata;
+    constructor(schema: Desc, input: MessageShape<Desc>, callerIdentity: CallerIdentity, apiResourceKind?: ApiResourceKind);
+    /** The resource being built/modified (Go NewState()). */
+    get newState(): MessageShape<Desc>;
+    /** Replaces the resource being built (Go SetNewState()). */
+    setNewState(state: MessageShape<Desc>): void;
+    /** Inter-step value by key; undefined when absent (Go Get()). */
+    get(key: string): unknown;
+    /** Stores an inter-step value (Go Set()). */
+    set(key: string, value: unknown): void;
+}
+//# sourceMappingURL=request-context.d.ts.map

package/dist/pipeline/request-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../src/pipeline/request-context.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEpE,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AAEtD,qBAAa,cAAc,CAAC,IAAI,SAAS,WAAW;IAClD,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,mEAAmE;IACnE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAE1C,OAAO,CAAC,KAAK,CAAqB;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8B;gBAGrD,MAAM,EAAE,IAAI,EACZ,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,EACzB,cAAc,EAAE,cAAc,EAC9B,eAAe,GAAE,eAA2D;IAS9E,yDAAyD;IACzD,IAAI,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,CAEjC;IAED,4DAA4D;IAC5D,WAAW,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,IAAI;IAI5C,iEAAiE;IACjE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIzB,6CAA6C;IAC7C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;CAGvC"}

package/dist/pipeline/request-context.js

@@ -0,0 +1,76 @@
+/**
+ * RequestContext — ports backend/libs/go/grpc/request/pipeline/context.go.
+ *
+ * input vs newState: `input` is the original, immutable request; `newState`
+ * is an auto-cloned copy the steps mutate. The separation keeps the
+ * original request pristine for debugging, logging, and idempotency —
+ * steps read from and modify newState, never input.
+ *
+ * Three mechanics differ from Go, deliberately:
+ *   - The resolved ApiResourceKind is a constructor parameter instead of a
+ *     hidden context.Context value. Go's steps fish it out of ctx (injected
+ *     by the apiresource interceptor); here the controller reads it from
+ *     the ConnectRPC contextValues (apiResourceKindKey) once and passes it
+ *     explicitly — a missing kind is a compile error, not a zero-value
+ *     surprise (the composition-root idiom, guidelines §4).
+ *   - The CallerIdentity is a REQUIRED constructor parameter (O2, ruling
+ *     Q3 — the same doctrine delivered for real): position 1 of every
+ *     chain stamps it, the controller reads it once (callerIdentityOf),
+ *     and every construction site that forgets it is a compile error.
+ *     The Authorize step and the audit-actor derivation read it here.
+ *   - metadata values are typed per key via the small helpers below rather
+ *     than blind interface{} casts; the KEY STRINGS stay identical to Go's
+ *     so the inventory's step notes read straight onto this code.
+ */
+import { clone } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+/**
+ * The lifecycle chains' loaded-resource context key (Go's key string,
+ * verbatim). On lifecycle pipelines the request `Desc` is the INPUT
+ * message, so `ctx.newState` is the input — the loaded resource rides the
+ * metadata map under this key, stamped by each chain's LoadExecutionById
+ * step. Hoisted here (C4 Stage 3) so the two lifecycle modules and
+ * extension gate steps registered into recover-chain slots share ONE
+ * definition of the string instead of three copies of a silent contract.
+ */
+export const LOADED_EXECUTION_KEY = "loadedExecution";
+export class RequestContext {
+    /** The original, immutable request message. */
+    input;
+    /** The request's message schema (steps clone/compare through it). */
+    schema;
+    /** The authenticated caller, produced at chain position 1 (O2). */
+    callerIdentity;
+    /**
+     * The resource kind of the target service (Go: injected by the
+     * apiresource interceptor; unknown when the service carries no
+     * api_resource_kind option).
+     */
+    apiResourceKind;
+    state;
+    metadata = new Map();
+    constructor(schema, input, callerIdentity, apiResourceKind = ApiResourceKind.api_resource_kind_unknown) {
+        this.schema = schema;
+        this.input = input;
+        this.state = clone(schema, input);
+        this.callerIdentity = callerIdentity;
+        this.apiResourceKind = apiResourceKind;
+    }
+    /** The resource being built/modified (Go NewState()). */
+    get newState() {
+        return this.state;
+    }
+    /** Replaces the resource being built (Go SetNewState()). */
+    setNewState(state) {
+        this.state = state;
+    }
+    /** Inter-step value by key; undefined when absent (Go Get()). */
+    get(key) {
+        return this.metadata.get(key);
+    }
+    /** Stores an inter-step value (Go Set()). */
+    set(key, value) {
+        this.metadata.set(key, value);
+    }
+}
+//# sourceMappingURL=request-context.js.map

package/dist/pipeline/request-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../src/pipeline/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAG3C,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAItH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AAEtD,MAAM,OAAO,cAAc;IACzB,+CAA+C;IACtC,KAAK,CAAqB;IACnC,qEAAqE;IAC5D,MAAM,CAAO;IACtB,mEAAmE;IAC1D,cAAc,CAAiB;IACxC;;;;OAIG;IACM,eAAe,CAAkB;IAElC,KAAK,CAAqB;IACjB,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEvD,YACE,MAAY,EACZ,KAAyB,EACzB,cAA8B,EAC9B,kBAAmC,eAAe,CAAC,yBAAyB;QAE5E,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED,yDAAyD;IACzD,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,4DAA4D;IAC5D,WAAW,CAAC,KAAyB;QACnC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,iEAAiE;IACjE,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,6CAA6C;IAC7C,GAAG,CAAC,GAAW,EAAE,KAAc;QAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;CACF"}

package/dist/pipeline/steps/authorization-tuples.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Authorization-tuple lifecycle steps — the OSS half of the C2 seam
+ * (convergence 20260827.10, ruling Q2). Ports the Java service's
+ * config-driven tuple machinery: CreateAuthorizationTuplesStepV2 (create
+ * chains, post-persist), DeleteOperationCleanupIamPoliciesStep (delete
+ * chains, best-effort), and the VisibilityTupleReconciler's level→shape
+ * policy with set-diff transitions (updateVisibility chains,
+ * post-persist). Verified against the Java sources 2026-08-27; the
+ * behavioral inventory lives in the sub-project's T01 records.
+ *
+ * Everything edition-neutral resolves HERE — the kind's proto
+ * AuthorizationConfig (via kind_meta, the apiresource-meta idiom),
+ * parent ids from spec fields (the ParentRelationConfig.spec_field
+ * contract, proto reflection — zero hardcoded kind knowledge), and the
+ * visibility shape diff (org floor included). The composed
+ * ResourceAuthorizationLifecycle driver receives resolved events and
+ * owns only the tuple writes. No driver = every step no-ops before any
+ * resolution work — OSS behavior AND cost are byte-identical.
+ *
+ * Failure semantics (Java parity):
+ *   - create: a resolution gap (missing parent id, missing org) or a
+ *     driver throw FAILS the request as Internal — after persist, so a
+ *     half-created resource is a real, retry-healed state (inherited).
+ *   - delete cleanup: best-effort — log and continue, never fail the
+ *     delete (Java's step swallows everything; orphaned grants are inert
+ *     once the row is gone).
+ *   - visibility: a driver throw fails the request as Internal — after
+ *     persist; retrying the same transition converges (set-diff
+ *     idempotency).
+ *   - the PLATFORM scope arm is dead config in BOTH editions (no kind
+ *     uses it; Java's switch falls through to a warn) — ported as the
+ *     same conscious warn, never an implementation.
+ */
+import type { DescMessage, Message } from "@bufbuild/protobuf";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { Logger } from "../../boot/logger.js";
+import type { CallerIdentity } from "../../extensions/identity.js";
+import type { DefaultInstanceLinkedEvent, ResourceAuthorizationLifecycle, ResourceCreatedEvent, VisibilityTupleShape } from "../../extensions/resource-authorization.js";
+/**
+ * Fires the driver's default-instance link event (C2 Stage 3 — the
+ * default_of invariant). Called by the pointer-persist sites — every
+ * flow that writes a blueprint's `status.defaultInstanceId` — AFTER the
+ * pointer lands, so the tuple exists iff the pointer names the instance.
+ * No driver (or a driver without the optional method) = no-op — OSS
+ * behavior byte-identical. Synchronous: a throw fails the request; the
+ * persisted pointer survives and a retry converges (idempotent write).
+ */
+export declare function notifyDefaultInstanceLinked(lifecycle: ResourceAuthorizationLifecycle | undefined, event: DefaultInstanceLinkedEvent): Promise<void>;
+import type { PipelineStep } from "../pipeline.js";
+/**
+ * The tuple shapes a visibility level expands to for a kind. Levels the
+ * kind does not support yield the empty set SILENTLY (Java parity — the
+ * ValidateVisibility steps reject unsupported levels with
+ * InvalidArgument before persist; this policy never doubles as
+ * validation).
+ *
+ * The org floor: kinds flagged defaults_to_org_visibility (blueprints —
+ * shared org assets) keep the org-viewer shape at public and platform
+ * levels, so sharing a blueprint beyond the org never hides it from its
+ * own org's catalog (ListObjects suppresses the public wildcard).
+ */
+export declare function visibilityShapesFor(kind: ApiResourceKind, level: ApiResourceVisibility): ReadonlySet<VisibilityTupleShape>;
+/** The set-diff of a visibility transition; shared shapes stay untouched. */
+export declare function diffVisibilityShapes(kind: ApiResourceKind, oldLevel: ApiResourceVisibility, newLevel: ApiResourceVisibility): {
+    readonly shapesToCreate: ReadonlyArray<VisibilityTupleShape>;
+    readonly shapesToDelete: ReadonlyArray<VisibilityTupleShape>;
+};
+/**
+ * Resolves the creation event for a just-persisted resource, or
+ * undefined for kinds whose scope is NONE/UNSPECIFIED (Java's early
+ * return — no owner tuple, no visibility either). Shared by the generic
+ * create step and the domain-local lanes whose pipeline message is not
+ * the resource (skill push rides SKILL_KEY).
+ */
+export declare function resolveResourceCreatedEvent(kind: ApiResourceKind, resource: Message, caller: CallerIdentity, logger: Logger): ResourceCreatedEvent | undefined;
+/**
+ * CreateAuthorizationTuples — post-persist in every create chain (apply
+ * delegates to create, so the apply lane is covered by construction).
+ */
+export declare function newCreateAuthorizationTuplesStep<Desc extends DescMessage>(lifecycle: ResourceAuthorizationLifecycle | undefined, logger: Logger): PipelineStep<Desc>;
+/**
+ * CleanupIamPolicies — after the store delete in every delete chain.
+ * Best-effort by contract: a driver failure is logged and the delete
+ * succeeds (Java's DeleteOperationCleanupIamPoliciesStep swallows all —
+ * the cloud side owns convergence for orphaned grants).
+ */
+export declare function newCleanupIamPoliciesStep<Desc extends DescMessage>(lifecycle: ResourceAuthorizationLifecycle | undefined, logger: Logger): PipelineStep<Desc>;
+/** Context key for the pre-update visibility level. */
+export declare const OLD_VISIBILITY_KEY = "authorizationOldVisibility";
+/**
+ * RecordVisibilityBeforeUpdate — captures the loaded resource's current
+ * level BEFORE the Set*Visibility step mutates it in place. Splices
+ * after the domain's load step; `resourceKey` names the domain-local
+ * context key holding the loaded resource.
+ */
+export declare function newRecordVisibilityBeforeUpdateStep<Desc extends DescMessage>(resourceKey: string): PipelineStep<Desc>;
+/**
+ * UpdateVisibilityTuples — post-persist in every updateVisibility chain
+ * (and the skill push lanes, which set visibility at creation time
+ * through the create step instead). A driver failure fails the request
+ * (Java parity: metadata persisted, tuples lagging, retry converges).
+ */
+export declare function newUpdateVisibilityTuplesStep<Desc extends DescMessage>(lifecycle: ResourceAuthorizationLifecycle | undefined, resourceKey: string): PipelineStep<Desc>;
+//# sourceMappingURL=authorization-tuples.d.ts.map

package/dist/pipeline/steps/authorization-tuples.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-tuples.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/authorization-tuples.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAU3H,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EACV,0BAA0B,EAE1B,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,4CAA4C,CAAC;AAEpD;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,IAAI,CAAC,CAKf;AAGD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAYnD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,qBAAqB,GAC3B,WAAW,CAAC,oBAAoB,CAAC,CAgCnC;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,qBAAqB,EAC/B,QAAQ,EAAE,qBAAqB,GAC9B;IACD,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;IAC7D,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9D,CAUA;AAqHD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,MAAM,GACb,oBAAoB,GAAG,SAAS,CAkClC;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,SAAS,WAAW,EACvE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CAuBpB;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CAiCpB;AAED,uDAAuD;AACvD,eAAO,MAAM,kBAAkB,+BAA+B,CAAC;AAE/D;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,IAAI,SAAS,WAAW,EAC1E,WAAW,EAAE,MAAM,GAClB,YAAY,CAAC,IAAI,CAAC,CAYpB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,SAAS,WAAW,EACpE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,WAAW,EAAE,MAAM,GAClB,YAAY,CAAC,IAAI,CAAC,CAoCpB"}