@stigmer/server 3.14.0-dev.20260910084630

package/dist/pipeline/steps/authorization-tuples.js

@@ -0,0 +1,315 @@
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import { AuthorizationScopeType, } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
+/**
+ * Fires the driver's default-instance link event (C2 Stage 3 — the
+ * default_of invariant). Called by the pointer-persist sites — every
+ * flow that writes a blueprint's `status.defaultInstanceId` — AFTER the
+ * pointer lands, so the tuple exists iff the pointer names the instance.
+ * No driver (or a driver without the optional method) = no-op — OSS
+ * behavior byte-identical. Synchronous: a throw fails the request; the
+ * persisted pointer survives and a retry converges (idempotent write).
+ */
+export async function notifyDefaultInstanceLinked(lifecycle, event) {
+    if (lifecycle?.onDefaultInstanceLinked === undefined) {
+        return;
+    }
+    await lifecycle.onDefaultInstanceLinked(event);
+}
+import { getKindEnum, getKindMeta, getKindName } from "../apiresource-meta.js";
+import { internalError } from "../errors.js";
+import { EXISTING_RESOURCE_KEY } from "./load-existing.js";
+import { metadataOf } from "./shapes.js";
+// ---------------------------------------------------------------------------
+// Visibility shape policy — the reconciler's level→shape mapping, ported
+// from the Java VisibilityTupleReconciler (its unit-test matrix is
+// re-pinned in this module's tests).
+// ---------------------------------------------------------------------------
+/**
+ * The tuple shapes a visibility level expands to for a kind. Levels the
+ * kind does not support yield the empty set SILENTLY (Java parity — the
+ * ValidateVisibility steps reject unsupported levels with
+ * InvalidArgument before persist; this policy never doubles as
+ * validation).
+ *
+ * The org floor: kinds flagged defaults_to_org_visibility (blueprints —
+ * shared org assets) keep the org-viewer shape at public and platform
+ * levels, so sharing a blueprint beyond the org never hides it from its
+ * own org's catalog (ListObjects suppresses the public wildcard).
+ */
+export function visibilityShapesFor(kind, level) {
+    const config = getKindMeta(kind).authorization?.visibility;
+    const shapes = new Set();
+    const orgFloor = config?.defaultsToOrgVisibility === true && config.supportsOrg === true;
+    switch (level) {
+        case ApiResourceVisibility.visibility_org:
+            if (config?.supportsOrg === true) {
+                shapes.add("org-viewer");
+            }
+            break;
+        case ApiResourceVisibility.visibility_public:
+            if (config?.supportsPublic === true) {
+                shapes.add("public-viewer");
+                if (orgFloor) {
+                    shapes.add("org-viewer");
+                }
+            }
+            break;
+        case ApiResourceVisibility.visibility_platform:
+            if (config?.supportsPlatform === true) {
+                shapes.add("platform-viewer");
+                if (orgFloor) {
+                    shapes.add("org-viewer");
+                }
+            }
+            break;
+        default:
+            // private / unspecified / unknown → no visibility tuples.
+            break;
+    }
+    return shapes;
+}
+/** The set-diff of a visibility transition; shared shapes stay untouched. */
+export function diffVisibilityShapes(kind, oldLevel, newLevel) {
+    if (oldLevel === newLevel) {
+        return { shapesToCreate: [], shapesToDelete: [] };
+    }
+    const oldShapes = visibilityShapesFor(kind, oldLevel);
+    const newShapes = visibilityShapesFor(kind, newLevel);
+    return {
+        shapesToCreate: [...newShapes].filter((shape) => !oldShapes.has(shape)),
+        shapesToDelete: [...oldShapes].filter((shape) => !newShapes.has(shape)),
+    };
+}
+// ---------------------------------------------------------------------------
+// Parent-id resolution — the ParentIdExtractorRegistry port. Zero
+// hardcoded kind knowledge: the proto config names the spec field, this
+// module reads it structurally (protobuf-es spec messages are plain
+// objects whose properties are the camelCase proto field names).
+// ---------------------------------------------------------------------------
+/** proto snake_case field name → the generated property name. */
+function camelCaseFieldName(specField) {
+    return specField.replace(/_([a-z0-9])/g, (_, ch) => ch.toUpperCase());
+}
+/**
+ * Extracts the parent id named by the config from the resource's spec.
+ * Returns "" for every miss (no spec, no field, non-string value) — the
+ * caller decides whether that is fatal, exactly as Java's registry
+ * returns null and the service throws.
+ */
+function extractParentId(resource, specField) {
+    // Structural access is the shapes.ts idiom: spec messages are plain
+    // objects; the property name is the camelCase form of the proto field.
+    const spec = resource.spec;
+    if (spec === undefined) {
+        return "";
+    }
+    const value = spec[camelCaseFieldName(specField)];
+    return typeof value === "string" ? value : "";
+}
+function resolveParentLink(kind, resource, parentConfig) {
+    const parentId = extractParentId(resource, parentConfig.specField);
+    if (parentId === "") {
+        // Java: "Parent ID required for X but not found" → the request fails.
+        throw internalError(new Error(`parent id for relation '${parentConfig.relation}' (spec field '${parentConfig.specField}') is missing on ${getKindName(kind)}`), "failed to create authorization tuples");
+    }
+    return {
+        relation: parentConfig.relation,
+        parentKind: getKindEnum(parentConfig.kind),
+        parentId,
+    };
+}
+/**
+ * The scope link + additional parents for a created resource — resolved
+ * in Java's order (scope first, additional parents after).
+ */
+function resolveParentLinks(kind, config, resource, orgId, logger) {
+    const links = [];
+    switch (config.scopeType) {
+        case AuthorizationScopeType.ORGANIZATION: {
+            if (orgId === "") {
+                throw internalError(new Error(`organization id is required to create authorization tuples for ${getKindName(kind)}`), "failed to create authorization tuples");
+            }
+            links.push({
+                relation: "organization",
+                parentKind: getKindEnum("organization"),
+                parentId: orgId,
+            });
+            break;
+        }
+        case AuthorizationScopeType.PARENT: {
+            if (config.parent === undefined) {
+                throw internalError(new Error(`${getKindName(kind)} declares PARENT scope without a parent config`), "failed to create authorization tuples");
+            }
+            links.push(resolveParentLink(kind, resource, config.parent));
+            break;
+        }
+        case AuthorizationScopeType.OWNER_ONLY:
+            break;
+        case AuthorizationScopeType.PLATFORM:
+            // Dead config in both editions — Java's switch warns and writes no
+            // scope link (organization/identity_account are OWNER_ONLY in the
+            // shipped config). Ported as the same conscious warn.
+            logger.warn("unhandled PLATFORM authorization scope — no scope link", {
+                kind: getKindName(kind),
+            });
+            break;
+        default:
+            break;
+    }
+    for (const parent of config.additionalParents) {
+        links.push(resolveParentLink(kind, resource, parent));
+    }
+    return links;
+}
+// ---------------------------------------------------------------------------
+// The steps.
+// ---------------------------------------------------------------------------
+/**
+ * Resolves the creation event for a just-persisted resource, or
+ * undefined for kinds whose scope is NONE/UNSPECIFIED (Java's early
+ * return — no owner tuple, no visibility either). Shared by the generic
+ * create step and the domain-local lanes whose pipeline message is not
+ * the resource (skill push rides SKILL_KEY).
+ */
+export function resolveResourceCreatedEvent(kind, resource, caller, logger) {
+    const config = getKindMeta(kind).authorization;
+    if (config === undefined ||
+        config.scopeType === AuthorizationScopeType.NONE ||
+        config.scopeType === AuthorizationScopeType.UNSPECIFIED) {
+        return undefined;
+    }
+    const metadata = metadataOf(resource);
+    if (metadata === undefined || metadata.id === "") {
+        throw internalError(new Error("resource metadata missing after persist"), "failed to create authorization tuples");
+    }
+    return {
+        kind,
+        resourceId: metadata.id,
+        orgId: metadata.org,
+        caller,
+        ownerAttribution: config.ownerType,
+        requiresCreatorTuple: config.requiresCreatorTuple,
+        parentLinks: resolveParentLinks(kind, config, resource, metadata.org, logger),
+        // Creation is the unspecified→level transition (Java models it the
+        // same way through the reconciler).
+        visibilityShapes: [...visibilityShapesFor(kind, metadata.visibility)],
+    };
+}
+/**
+ * CreateAuthorizationTuples — post-persist in every create chain (apply
+ * delegates to create, so the apply lane is covered by construction).
+ */
+export function newCreateAuthorizationTuplesStep(lifecycle, logger) {
+    return {
+        name: "CreateAuthorizationTuples",
+        async execute(ctx) {
+            if (lifecycle === undefined) {
+                return;
+            }
+            const event = resolveResourceCreatedEvent(ctx.apiResourceKind, ctx.newState, ctx.callerIdentity, logger);
+            if (event === undefined) {
+                return;
+            }
+            try {
+                await lifecycle.onResourceCreated(event);
+            }
+            catch (error) {
+                throw internalError(error, "failed to create authorization tuples");
+            }
+        },
+    };
+}
+/**
+ * CleanupIamPolicies — after the store delete in every delete chain.
+ * Best-effort by contract: a driver failure is logged and the delete
+ * succeeds (Java's DeleteOperationCleanupIamPoliciesStep swallows all —
+ * the cloud side owns convergence for orphaned grants).
+ */
+export function newCleanupIamPoliciesStep(lifecycle, logger) {
+    return {
+        name: "CleanupIamPolicies",
+        async execute(ctx) {
+            if (lifecycle === undefined) {
+                return;
+            }
+            const deleted = ctx.get(EXISTING_RESOURCE_KEY);
+            const metadata = deleted?.metadata;
+            if (metadata === undefined || metadata.id === "") {
+                return;
+            }
+            try {
+                await lifecycle.onResourceDeleted({
+                    kind: ctx.apiResourceKind,
+                    resourceId: metadata.id,
+                    orgId: metadata.org,
+                    caller: ctx.callerIdentity,
+                });
+            }
+            catch (error) {
+                logger.warn("authorization cleanup failed — orphaned IAM policies may remain", {
+                    kind: getKindName(ctx.apiResourceKind),
+                    resourceId: metadata.id,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        },
+    };
+}
+/** Context key for the pre-update visibility level. */
+export const OLD_VISIBILITY_KEY = "authorizationOldVisibility";
+/**
+ * RecordVisibilityBeforeUpdate — captures the loaded resource's current
+ * level BEFORE the Set*Visibility step mutates it in place. Splices
+ * after the domain's load step; `resourceKey` names the domain-local
+ * context key holding the loaded resource.
+ */
+export function newRecordVisibilityBeforeUpdateStep(resourceKey) {
+    return {
+        name: "RecordVisibilityBeforeUpdate",
+        execute(ctx) {
+            const resource = ctx.get(resourceKey);
+            ctx.set(OLD_VISIBILITY_KEY, resource?.metadata?.visibility ??
+                ApiResourceVisibility.api_resource_visibility_unspecified);
+        },
+    };
+}
+/**
+ * UpdateVisibilityTuples — post-persist in every updateVisibility chain
+ * (and the skill push lanes, which set visibility at creation time
+ * through the create step instead). A driver failure fails the request
+ * (Java parity: metadata persisted, tuples lagging, retry converges).
+ */
+export function newUpdateVisibilityTuplesStep(lifecycle, resourceKey) {
+    return {
+        name: "UpdateVisibilityTuples",
+        async execute(ctx) {
+            if (lifecycle === undefined) {
+                return;
+            }
+            const resource = ctx.get(resourceKey);
+            const metadata = resource?.metadata;
+            if (metadata === undefined || metadata.id === "") {
+                return;
+            }
+            const oldLevel = ctx.get(OLD_VISIBILITY_KEY) ??
+                ApiResourceVisibility.api_resource_visibility_unspecified;
+            const { shapesToCreate, shapesToDelete } = diffVisibilityShapes(ctx.apiResourceKind, oldLevel, metadata.visibility);
+            if (shapesToCreate.length === 0 && shapesToDelete.length === 0) {
+                return;
+            }
+            try {
+                await lifecycle.onVisibilityChanged({
+                    kind: ctx.apiResourceKind,
+                    resourceId: metadata.id,
+                    orgId: metadata.org,
+                    shapesToCreate,
+                    shapesToDelete,
+                });
+            }
+            catch (error) {
+                throw internalError(error, "failed to update visibility tuples");
+            }
+        },
+    };
+}
+//# sourceMappingURL=authorization-tuples.js.map

package/dist/pipeline/steps/authorization-tuples.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-tuples.js","sourceRoot":"","sources":["../../../src/pipeline/steps/authorization-tuples.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAE/F,OAAO,EACL,sBAAsB,GAEvB,MAAM,wFAAwF,CAAC;AAgBhG;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,SAAqD,EACrD,KAAiC;IAEjC,IAAI,SAAS,EAAE,uBAAuB,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO;IACT,CAAC;IACD,MAAM,SAAS,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;AACjD,CAAC;AACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,8EAA8E;AAC9E,yEAAyE;AACzE,mEAAmE;AACnE,qCAAqC;AACrC,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAqB,EACrB,KAA4B;IAE5B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,MAAM,QAAQ,GACZ,MAAM,EAAE,uBAAuB,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC;IAC1E,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,qBAAqB,CAAC,cAAc;YACvC,IAAI,MAAM,EAAE,WAAW,KAAK,IAAI,EAAE,CAAC;gBACjC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC3B,CAAC;YACD,MAAM;QACR,KAAK,qBAAqB,CAAC,iBAAiB;YAC1C,IAAI,MAAM,EAAE,cAAc,KAAK,IAAI,EAAE,CAAC;gBACpC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC5B,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,MAAM;QACR,KAAK,qBAAqB,CAAC,mBAAmB;YAC5C,IAAI,MAAM,EAAE,gBAAgB,KAAK,IAAI,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;gBAC9B,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,MAAM;QACR;YACE,0DAA0D;YAC1D,MAAM;IACV,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAClC,IAAqB,EACrB,QAA+B,EAC/B,QAA+B;IAK/B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtD,OAAO;QACL,cAAc,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvE,cAAc,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACxE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,kEAAkE;AAClE,wEAAwE;AACxE,oEAAoE;AACpE,iEAAiE;AACjE,8EAA8E;AAE9E,iEAAiE;AACjE,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,OAAO,SAAS,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,QAAiB,EAAE,SAAiB;IAC3D,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,IAAI,GAAI,QAA0D,CAAC,IAAI,CAAC;IAC9E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;IAClD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAqB,EACrB,QAAiB,EACjB,YAAkC;IAElC,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,sEAAsE;QACtE,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,2BAA2B,YAAY,CAAC,QAAQ,kBAAkB,YAAY,CAAC,SAAS,oBAAoB,WAAW,CAAC,IAAI,CAAC,EAAE,CAChI,EACD,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC;QAC1C,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,IAAqB,EACrB,MAA2B,EAC3B,QAAiB,EACjB,KAAa,EACb,MAAc;IAEd,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,QAAQ,MAAM,CAAC,SAAS,EAAE,CAAC;QACzB,KAAK,sBAAsB,CAAC,YAAY,CAAC,CAAC,CAAC;YACzC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACjB,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,kEAAkE,WAAW,CAAC,IAAI,CAAC,EAAE,CACtF,EACD,uCAAuC,CACxC,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,cAAc;gBACxB,UAAU,EAAE,WAAW,CAAC,cAAc,CAAC;gBACvC,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAC;YACH,MAAM;QACR,CAAC;QACD,KAAK,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,GAAG,WAAW,CAAC,IAAI,CAAC,gDAAgD,CACrE,EACD,uCAAuC,CACxC,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7D,MAAM;QACR,CAAC;QACD,KAAK,sBAAsB,CAAC,UAAU;YACpC,MAAM;QACR,KAAK,sBAAsB,CAAC,QAAQ;YAClC,mEAAmE;YACnE,kEAAkE;YAClE,sDAAsD;YACtD,MAAM,CAAC,IAAI,CAAC,wDAAwD,EAAE;gBACpE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC;aACxB,CAAC,CAAC;YACH,MAAM;QACR;YACE,MAAM;IACV,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAqB,EACrB,QAAiB,EACjB,MAAsB,EACtB,MAAc;IAEd,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;IAC/C,IACE,MAAM,KAAK,SAAS;QACpB,MAAM,CAAC,SAAS,KAAK,sBAAsB,CAAC,IAAI;QAChD,MAAM,CAAC,SAAS,KAAK,sBAAsB,CAAC,WAAW,EACvD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,yCAAyC,CAAC,EACpD,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI;QACJ,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,KAAK,EAAE,QAAQ,CAAC,GAAG;QACnB,MAAM;QACN,gBAAgB,EAAE,MAAM,CAAC,SAAS;QAClC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,WAAW,EAAE,kBAAkB,CAC7B,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,QAAQ,CAAC,GAAG,EACZ,MAAM,CACP;QACD,mEAAmE;QACnE,oCAAoC;QACpC,gBAAgB,EAAE,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;KACtE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAC9C,SAAqD,EACrD,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,2BAA2B;QACjC,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,2BAA2B,CACvC,GAAG,CAAC,eAAe,EACnB,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,cAAc,EAClB,MAAM,CACP,CAAC;YACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,uCAAuC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAqD,EACrD,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAEhC,CAAC;YACd,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;YACnC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjD,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,iBAAiB,CAAC;oBAChC,IAAI,EAAE,GAAG,CAAC,eAAe;oBACzB,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,KAAK,EAAE,QAAQ,CAAC,GAAG;oBACnB,MAAM,EAAE,GAAG,CAAC,cAAc;iBAC3B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CACT,iEAAiE,EACjE;oBACE,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC;oBACtC,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CACF,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CACjD,WAAmB;IAEnB,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,OAAO,CAAC,GAAyB;YAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAiC,CAAC;YACtE,GAAG,CAAC,GAAG,CACL,kBAAkB,EAClB,QAAQ,EAAE,QAAQ,EAAE,UAAU;gBAC5B,qBAAqB,CAAC,mCAAmC,CAC5D,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,SAAqD,EACrD,WAAmB;IAEnB,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAiC,CAAC;YACtE,MAAM,QAAQ,GAAG,QAAQ,EAAE,QAAQ,CAAC;YACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjD,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GACX,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAuC;gBAClE,qBAAqB,CAAC,mCAAmC,CAAC;YAC5D,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,oBAAoB,CAC7D,GAAG,CAAC,eAAe,EACnB,QAAQ,EACR,QAAQ,CAAC,UAAU,CACpB,CAAC;YACF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/D,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,mBAAmB,CAAC;oBAClC,IAAI,EAAE,GAAG,CAAC,eAAe;oBACzB,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,KAAK,EAAE,QAAQ,CAAC,GAAG;oBACnB,cAAc;oBACd,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/pipeline/steps/authorize.d.ts

@@ -0,0 +1,61 @@
+import type { DescMethod, DescMessage, Message } from "@bufbuild/protobuf";
+import type { Authorizer, AuthzCheck } from "../../extensions/authorizer.js";
+import type { CallerIdentity } from "../../extensions/identity.js";
+import type { PipelineStep } from "../pipeline.js";
+/**
+ * The wire copy for the unavailable arm — static and sanitized (#478):
+ * the backend's real error rides ConnectError.cause into the server log,
+ * never to an anonymous caller.
+ */
+export declare const AUTHORIZATION_UNAVAILABLE_MESSAGE = "authorization check could not be completed";
+/** The deny copy when the method's annotation carries no error_msg. */
+export declare const AUTHORIZATION_DENIED_FALLBACK_MESSAGE = "permission denied";
+/**
+ * The OSS default Authorizer: the permissive single-team posture (DD-007
+ * §3) — one trust domain, every authenticated caller may do everything,
+ * exactly the pre-O2 behavior. Installed by the composition root when no
+ * extension registers an Authorizer (the default lives with the consumer
+ * that defines its semantics — registry.ts contract).
+ */
+export declare function newPermissiveSingleTeamAuthorizer(): Authorizer;
+/**
+ * Builds the Authorize step for one RPC method. The descriptor comes in
+ * at construction (descriptors are static imports — the apiresource.ts
+ * idiom); the caller identity comes from the RequestContext at execution.
+ */
+export declare function newAuthorizeStep<Desc extends DescMessage>(method: DescMethod, authorizer: Authorizer): PipelineStep<Desc>;
+/**
+ * The one lane whose authorization target is server-side state rather
+ * than a request field (see the module header). `resourceId` replaces the
+ * annotation's `field_path`/`resource_id` resolution; everything else —
+ * skip arms, kind, permission, copy — still comes from the annotation.
+ */
+export interface AuthorizeTargetOverride {
+    readonly resourceId: string;
+}
+/**
+ * The Authorize evaluation for direct handlers: identical skip arms,
+ * target resolution, and decision-to-wire mapping as the pipeline step
+ * (which delegates here). Throws the mapped ConnectError on any
+ * non-allow arm; resolves on allow and on every skip arm.
+ */
+export declare function authorizeDirect(method: DescMethod, authorizer: Authorizer, identity: CallerIdentity, input: Message, override?: AuthorizeTargetOverride): Promise<void>;
+/**
+ * The SAME evaluation for a check whose target the HANDLER resolved —
+ * the mid-chain resolved-id pattern DD-007 names ("the pattern the two
+ * traced ListVersions handlers port onto", shipped by
+ * 20260830.01.sp.list-read-scoping ruling Q8). It serves the
+ * `is_skip_authorization` lanes whose Java baseline runs a hand-rolled
+ * check the declarative annotation cannot express (a mid-chain resolved
+ * id, a two-field target dispatch): the skip annotation makes the
+ * position-1 step a no-op, and the handler calls THIS at the Java
+ * baseline's exact position instead. Skip arms deliberately reduce to
+ * the `internal` class alone — the annotation skips do not apply because
+ * the caller IS the enforcement the annotation opted out of.
+ *
+ * `errorMsg` is the lane's byte-pinned deny copy (the Java handler's
+ * error_msg); empty falls back to the Authorizer's reason, then the
+ * shared fallback — the authorizeDirect precedence exactly.
+ */
+export declare function authorizeResolvedResource(authorizer: Authorizer, identity: CallerIdentity, check: AuthzCheck, errorMsg: string): Promise<void>;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/pipeline/steps/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/authorize.ts"],"names":[],"mappings":"AAmDA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAW3E,OAAO,KAAK,EACV,UAAU,EACV,UAAU,EAEX,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGnD;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,+CACA,CAAC;AAE/C,uEAAuE;AACvE,eAAO,MAAM,qCAAqC,sBAAsB,CAAC;AAEzE;;;;;;GAMG;AACH,wBAAgB,iCAAiC,IAAI,UAAU,CAM9D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,SAAS,WAAW,EACvD,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,UAAU,GACrB,YAAY,CAAC,IAAI,CAAC,CAOpB;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,OAAO,EACd,QAAQ,CAAC,EAAE,uBAAuB,GACjC,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CA4Cf"}

package/dist/pipeline/steps/authorize.js

@@ -0,0 +1,221 @@
+/**
+ * Authorize — the ONE shared authorization step (O2, 20260827.01; DD-007
+ * §3), added explicitly as the FIRST .addStep of every pipeline chain
+ * (ruling Q1: visible and greppable — step order is OSS-owned contract,
+ * never hidden behind a chain-builder wrapper).
+ *
+ * The step reads the same declarative proto method options the Java
+ * edition's authorization step reads — `(ai.stigmer.commons.rpc.config)`,
+ * `is_public` (50057), `is_skip_authorization` (50058) — resolves the
+ * check target from the request, and maps the Authorizer's three decision
+ * arms to the wire:
+ *
+ *   allow       → the chain proceeds;
+ *   deny        → PERMISSION_DENIED, carrying the annotation's byte-pinned
+ *                 `error_msg` (the reason arm is the fallback copy);
+ *   not-found   → NOT_FOUND with the load-first chain's copy (the C2
+ *                 ruling-Q1 refinement: a resource-scoped check on a
+ *                 nonexistent id answers what Java's load-before-authorize
+ *                 order answers, stigmer#224);
+ *   unavailable → INTERNAL — an authorization-backend outage is NEVER
+ *                 softened into a denial (the verified Java StepResult
+ *                 lesson, DD-007's wire-visible contract).
+ *
+ * Skip arms, in order: the `internal` caller class (the in-process chain's
+ * own calls — the TS rendering of the Java in-process authorization skip,
+ * ruling Q4), `is_public`, `is_skip_authorization`, and methods carrying
+ * no config at all (no authorization requirement is declared; the O2
+ * coverage inventory records every such method, so C1/C2 inherit the map
+ * instead of discovering it).
+ *
+ * Resolution never throws: an unresolvable `field_path` yields an empty
+ * resource id and an unresolvable `resource_kind_path` yields the unknown
+ * kind — the check still reaches the Authorizer, which owns the decision.
+ * A thrown resolution would be a NEW wire behavior on requests that are
+ * legal today (byte-identity forbids it); an implementation that wants to
+ * refuse empty ids does so as a deny, visibly.
+ *
+ * `authorizeDirect` is the SAME evaluation exported for the direct
+ * handlers — the config-annotated methods that deliberately run no
+ * pipeline (streams cannot run in the pipeline executor; the rest are
+ * ported direct forms, docs/authorization-coverage.md). One evaluation,
+ * two entry shapes; a direct handler calls it after its own input
+ * validation and before any load or side effect, mirroring the Java
+ * edition's validate → authorize handler order (C2 Stage 4 ruling,
+ * 20260827.10). The optional target override serves the one lane whose
+ * true target is server-side state rather than caller input
+ * (completeOAuthConnect authorizes the PENDING RECORD's server id — a
+ * caller-supplied id would be a confused-deputy hole, the Java
+ * McpServerCompleteOAuthConnectHandler discipline).
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { getOption, hasOption } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { config as rpcAuthorizationConfig, is_public, is_skip_authorization, } from "@stigmer/protos/ai/stigmer/commons/rpc/method_options_pb";
+import { getKindName } from "../apiresource-meta.js";
+import { internalError, notFoundError } from "../errors.js";
+/**
+ * The wire copy for the unavailable arm — static and sanitized (#478):
+ * the backend's real error rides ConnectError.cause into the server log,
+ * never to an anonymous caller.
+ */
+export const AUTHORIZATION_UNAVAILABLE_MESSAGE = "authorization check could not be completed";
+/** The deny copy when the method's annotation carries no error_msg. */
+export const AUTHORIZATION_DENIED_FALLBACK_MESSAGE = "permission denied";
+/**
+ * The OSS default Authorizer: the permissive single-team posture (DD-007
+ * §3) — one trust domain, every authenticated caller may do everything,
+ * exactly the pre-O2 behavior. Installed by the composition root when no
+ * extension registers an Authorizer (the default lives with the consumer
+ * that defines its semantics — registry.ts contract).
+ */
+export function newPermissiveSingleTeamAuthorizer() {
+    return {
+        authorize() {
+            return Promise.resolve({ kind: "allow" });
+        },
+    };
+}
+/**
+ * Builds the Authorize step for one RPC method. The descriptor comes in
+ * at construction (descriptors are static imports — the apiresource.ts
+ * idiom); the caller identity comes from the RequestContext at execution.
+ */
+export function newAuthorizeStep(method, authorizer) {
+    return {
+        name: "Authorize",
+        execute(ctx) {
+            return authorizeDirect(method, authorizer, ctx.callerIdentity, ctx.input);
+        },
+    };
+}
+/**
+ * The Authorize evaluation for direct handlers: identical skip arms,
+ * target resolution, and decision-to-wire mapping as the pipeline step
+ * (which delegates here). Throws the mapped ConnectError on any
+ * non-allow arm; resolves on allow and on every skip arm.
+ */
+export async function authorizeDirect(method, authorizer, identity, input, override) {
+    if (identity.callerClass === "internal") {
+        return;
+    }
+    if (getOption(method, is_public) ||
+        getOption(method, is_skip_authorization)) {
+        return;
+    }
+    if (!hasOption(method, rpcAuthorizationConfig)) {
+        return;
+    }
+    const config = getOption(method, rpcAuthorizationConfig);
+    return authorizeResolvedResource(authorizer, identity, {
+        permission: config.permission,
+        resourceKind: resolveResourceKind(input, config),
+        resourceId: override?.resourceId ?? resolveResourceId(input, config),
+    }, config.errorMsg);
+}
+/**
+ * The SAME evaluation for a check whose target the HANDLER resolved —
+ * the mid-chain resolved-id pattern DD-007 names ("the pattern the two
+ * traced ListVersions handlers port onto", shipped by
+ * 20260830.01.sp.list-read-scoping ruling Q8). It serves the
+ * `is_skip_authorization` lanes whose Java baseline runs a hand-rolled
+ * check the declarative annotation cannot express (a mid-chain resolved
+ * id, a two-field target dispatch): the skip annotation makes the
+ * position-1 step a no-op, and the handler calls THIS at the Java
+ * baseline's exact position instead. Skip arms deliberately reduce to
+ * the `internal` class alone — the annotation skips do not apply because
+ * the caller IS the enforcement the annotation opted out of.
+ *
+ * `errorMsg` is the lane's byte-pinned deny copy (the Java handler's
+ * error_msg); empty falls back to the Authorizer's reason, then the
+ * shared fallback — the authorizeDirect precedence exactly.
+ */
+export async function authorizeResolvedResource(authorizer, identity, check, errorMsg) {
+    if (identity.callerClass === "internal") {
+        return;
+    }
+    const decision = await runAuthorizer(authorizer, identity, check);
+    switch (decision.kind) {
+        case "allow":
+            return;
+        case "deny":
+            throw new ConnectError(errorMsg !== ""
+                ? errorMsg
+                : decision.reason !== ""
+                    ? decision.reason
+                    : AUTHORIZATION_DENIED_FALLBACK_MESSAGE, Code.PermissionDenied);
+        case "not-found": {
+            // The ruling-Q1 arm: the exact copy the load-first chain would
+            // answer for the missing id (LoadTarget's notFoundError), so
+            // the wire cannot distinguish which step spoke.
+            if (check.resourceId === "" ||
+                check.resourceKind === ApiResourceKind.api_resource_kind_unknown) {
+                throw internalError(new Error("authorizer answered not-found for a non-resource-scoped check"), AUTHORIZATION_UNAVAILABLE_MESSAGE);
+            }
+            throw notFoundError(getKindName(check.resourceKind), check.resourceId);
+        }
+        case "unavailable":
+            throw internalError(decision.cause, AUTHORIZATION_UNAVAILABLE_MESSAGE);
+        default: {
+            const exhaustive = decision;
+            throw internalError(new Error(`unknown decision ${JSON.stringify(exhaustive)}`), AUTHORIZATION_UNAVAILABLE_MESSAGE);
+        }
+    }
+}
+/**
+ * An Authorizer that THROWS is an evaluation failure by definition —
+ * normalized into the unavailable arm so a buggy implementation can never
+ * soften an outage into a denial by accident.
+ */
+async function runAuthorizer(authorizer, identity, check) {
+    try {
+        return await authorizer.authorize(identity, check);
+    }
+    catch (error) {
+        return {
+            kind: "unavailable",
+            cause: error instanceof Error ? error : new Error(String(error)),
+        };
+    }
+}
+/** Static kind, or the resource_kind_path read, or unknown — never a throw. */
+function resolveResourceKind(input, config) {
+    if (config.resourceKindPath === "") {
+        return config.resourceKind;
+    }
+    const value = resolveDotPath(input, config.resourceKindPath);
+    return typeof value === "number"
+        ? value
+        : ApiResourceKind.api_resource_kind_unknown;
+}
+/** Static resource_id, or the field_path read, or "" — never a throw. */
+function resolveResourceId(input, config) {
+    if (config.resourceId !== "") {
+        return config.resourceId;
+    }
+    if (config.fieldPath === "") {
+        return "";
+    }
+    const value = resolveDotPath(input, config.fieldPath);
+    return typeof value === "string" ? value : "";
+}
+/**
+ * Walks a proto-snake-case dot path ("metadata.org") over the generated
+ * message's camelCase properties. Undefined at any absent link — the
+ * caller maps that to its empty value.
+ */
+function resolveDotPath(input, path) {
+    let current = input;
+    for (const segment of path.split(".")) {
+        if (current === null || typeof current !== "object") {
+            return undefined;
+        }
+        current = current[snakeToCamel(segment)];
+    }
+    return current;
+}
+/** "agent_execution_id" → "agentExecutionId" (protobuf-es property names). */
+function snakeToCamel(segment) {
+    return segment.replace(/_([a-z0-9])/g, (_, ch) => ch.toUpperCase());
+}
+//# sourceMappingURL=authorize.js.map

package/dist/pipeline/steps/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/pipeline/steps/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,MAAM,IAAI,sBAAsB,EAChC,SAAS,EACT,qBAAqB,GACtB,MAAM,0DAA0D,CAAC;AAQlE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAI5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAC5C,4CAA4C,CAAC;AAE/C,uEAAuE;AACvE,MAAM,CAAC,MAAM,qCAAqC,GAAG,mBAAmB,CAAC;AAEzE;;;;;;GAMG;AACH,MAAM,UAAU,iCAAiC;IAC/C,OAAO;QACL,SAAS;YACP,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAkB,EAClB,UAAsB;IAEtB,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,OAAO,CAAC,GAAyB;YAC/B,OAAO,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC;AAYD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAkB,EAClB,UAAsB,EACtB,QAAwB,EACxB,KAAc,EACd,QAAkC;IAElC,IAAI,QAAQ,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACxC,OAAO;IACT,CAAC;IACD,IACE,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC;QAC5B,SAAS,CAAC,MAAM,EAAE,qBAAqB,CAAC,EACxC,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAEzD,OAAO,yBAAyB,CAC9B,UAAU,EACV,QAAQ,EACR;QACE,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC;QAChD,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC;KACrE,EACD,MAAM,CAAC,QAAQ,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,UAAsB,EACtB,QAAwB,EACxB,KAAiB,EACjB,QAAgB;IAEhB,IAAI,QAAQ,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACxC,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClE,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO;QACT,KAAK,MAAM;YACT,MAAM,IAAI,YAAY,CACpB,QAAQ,KAAK,EAAE;gBACb,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,EAAE;oBACtB,CAAC,CAAC,QAAQ,CAAC,MAAM;oBACjB,CAAC,CAAC,qCAAqC,EAC3C,IAAI,CAAC,gBAAgB,CACtB,CAAC;QACJ,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,+DAA+D;YAC/D,6DAA6D;YAC7D,gDAAgD;YAChD,IACE,KAAK,CAAC,UAAU,KAAK,EAAE;gBACvB,KAAK,CAAC,YAAY,KAAK,eAAe,CAAC,yBAAyB,EAChE,CAAC;gBACD,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,+DAA+D,CAChE,EACD,iCAAiC,CAClC,CAAC;YACJ,CAAC;YACD,MAAM,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,aAAa;YAChB,MAAM,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAC3D,iCAAiC,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAC1B,UAAsB,EACtB,QAAwB,EACxB,KAAiB;IAEjB,IAAI,CAAC;QACH,OAAO,MAAM,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,mBAAmB,CAC1B,KAAc,EACd,MAA8B;IAE9B,IAAI,MAAM,CAAC,gBAAgB,KAAK,EAAE,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC7D,OAAO,OAAO,KAAK,KAAK,QAAQ;QAC9B,CAAC,CAAE,KAAyB;QAC5B,CAAC,CAAC,eAAe,CAAC,yBAAyB,CAAC;AAChD,CAAC;AAED,yEAAyE;AACzE,SAAS,iBAAiB,CACxB,KAAc,EACd,MAA8B;IAE9B,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC;IAC3B,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAClD,IAAI,OAAO,GAAY,KAAK,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAI,OAAmC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9E,CAAC"}

package/dist/pipeline/steps/build-update-state.d.ts

@@ -0,0 +1,4 @@
+import type { DescMessage } from "@bufbuild/protobuf";
+import type { PipelineStep } from "../pipeline.js";
+export declare function newBuildUpdateStateStep<Desc extends DescMessage>(): PipelineStep<Desc>;
+//# sourceMappingURL=build-update-state.d.ts.map

package/dist/pipeline/steps/build-update-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-update-state.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/build-update-state.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,WAAW,EAAyB,MAAM,oBAAoB,CAAC;AAW7E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAanD,wBAAgB,uBAAuB,CACrC,IAAI,SAAS,WAAW,KACrB,YAAY,CAAC,IAAI,CAAC,CAiCtB"}