@stigmer/server 3.14.0-dev.20260910084630

package/dist/pipeline/steps/build-update-state.js

@@ -0,0 +1,93 @@
+/**
+ * BuildUpdateState — ports steps/build_update_state.go (aligned with
+ * Cloud's UpdateOperationBuildNewStateStepV2): full spec replacement from
+ * the input, immutable identifiers preserved from the existing resource,
+ * the ENTIRE existing status preserved (all system state), and only the
+ * audit fields refreshed.
+ *
+ * Visibility is update-immutable (oss#573): updateVisibility is the ONLY
+ * door — every visibility guard lives on those pipelines, so a plain
+ * Update that changed the level would bypass them all. A request-carried
+ * level is deliberately IGNORED, never rejected: stale manifests
+ * re-applied after a console visibility change must not fail the update.
+ */
+import { clone } from "@bufbuild/protobuf";
+import { reflect } from "@bufbuild/protobuf/reflect";
+import { timestampNow } from "@bufbuild/protobuf/wkt";
+import { create } from "@bufbuild/protobuf";
+import { ApiResourceAuditSchema, ApiResourceAuditInfoSchema, } from "@stigmer/protos/ai/stigmer/commons/apiresource/status_pb";
+import { internalError } from "../errors.js";
+import { auditActorFor, clearStatusField, creationAuditOf, setAuditReflect, updatedAuditInfo, } from "./defaults.js";
+import { EXISTING_RESOURCE_KEY } from "./load-existing.js";
+import { hasStatusField, messageFieldByName, metadataOf } from "./shapes.js";
+export function newBuildUpdateStateStep() {
+    return {
+        name: "BuildUpdateState",
+        execute(ctx) {
+            const existing = ctx.get(EXISTING_RESOURCE_KEY);
+            if (existing === undefined) {
+                throw internalError(new Error("existing resource not found in context - LoadExisting must run first"), "build update state");
+            }
+            // Full spec replacement: the client sends complete desired state.
+            const merged = clone(ctx.schema, ctx.input);
+            preserveImmutableFields(merged, existing);
+            if (hasStatusField(ctx.schema)) {
+                // Client-provided status is discarded, then the existing resource's
+                // ENTIRE status (default_instance_id, phase, conditions, …) is
+                // carried over — only audit gets refreshed below.
+                clearStatusField(ctx.schema, merged);
+                copyStatusFromExisting(ctx.schema, merged, existing);
+                updateAuditFields(ctx.schema, merged, existing, ctx.callerIdentity);
+            }
+            ctx.setNewState(merged);
+        },
+    };
+}
+/**
+ * Go preserveImmutableFields: id, slug, org, and visibility (oss#573) come
+ * from the existing resource. metadata.name and the other display fields
+ * stay client-updatable.
+ */
+function preserveImmutableFields(merged, existing) {
+    const mergedMeta = metadataOf(merged);
+    const existingMeta = metadataOf(existing);
+    if (mergedMeta === undefined || existingMeta === undefined) {
+        throw internalError(new Error("metadata is nil"), "preserve immutable fields");
+    }
+    mergedMeta.id = existingMeta.id;
+    mergedMeta.slug = existingMeta.slug;
+    mergedMeta.org = existingMeta.org;
+    mergedMeta.visibility = existingMeta.visibility;
+}
+/** Go copyStatusFromExisting (Cloud ApiResourcePreviousStatusReplacer). */
+function copyStatusFromExisting(schema, merged, existing) {
+    const existingRoot = reflect(schema, existing);
+    const statusField = messageFieldByName(existingRoot, "status");
+    if (statusField === undefined || !existingRoot.isSet(statusField)) {
+        return;
+    }
+    // Deep copy: the merged resource must not alias the loaded original.
+    const statusCopy = reflect(statusField.message, clone(statusField.message, existingRoot.get(statusField).message));
+    reflect(schema, merged).set(statusField, statusCopy);
+}
+/**
+ * Go updateAuditFieldsReflect: spec_audit keeps the existing creation
+ * identity with a fresh update stamp; status_audit is fully current (the
+ * status was rebuilt); both carry event "updated".
+ */
+function updateAuditFields(schema, resource, existing, identity) {
+    const now = timestampNow();
+    const actor = auditActorFor(identity);
+    const { createdBy, createdAt } = creationAuditOf(schema, existing, "spec_audit");
+    setAuditReflect(schema, resource, create(ApiResourceAuditSchema, {
+        specAudit: updatedAuditInfo(createdBy, createdAt, actor, now),
+        statusAudit: create(ApiResourceAuditInfoSchema, {
+            createdBy: actor,
+            createdAt: now,
+            updatedBy: actor,
+            updatedAt: now,
+            event: "updated",
+        }),
+    }));
+}
+//# sourceMappingURL=build-update-state.js.map

package/dist/pipeline/steps/build-update-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-update-state.js","sourceRoot":"","sources":["../../../src/pipeline/steps/build-update-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,0DAA0D,CAAC;AAElE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAI7C,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE7E,MAAM,UAAU,uBAAuB;IAGrC,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,OAAO,CAAC,GAAyB;YAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAEjC,CAAC;YACd,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,sEAAsE,CACvE,EACD,oBAAoB,CACrB,CAAC;YACJ,CAAC;YAED,kEAAkE;YAClE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAE5C,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAE1C,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B,oEAAoE;gBACpE,+DAA+D;gBAC/D,kDAAkD;gBAClD,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACrC,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACrD,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YACtE,CAAC;YAED,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,MAAe,EAAE,QAAiB;IACjE,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,UAAU,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC3D,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,iBAAiB,CAAC,EAC5B,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IACD,UAAU,CAAC,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC;IAChC,UAAU,CAAC,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC;IACpC,UAAU,CAAC,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC;IAClC,UAAU,CAAC,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC;AAClD,CAAC;AAED,2EAA2E;AAC3E,SAAS,sBAAsB,CAC7B,MAAmB,EACnB,MAAe,EACf,QAAiB;IAEjB,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,kBAAkB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAClE,OAAO;IACT,CAAC;IACD,qEAAqE;IACrE,MAAM,UAAU,GAAG,OAAO,CACxB,WAAW,CAAC,OAAO,EACnB,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAClE,CAAC;IACF,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,MAAmB,EACnB,QAAiB,EACjB,QAAiB,EACjB,QAAwB;IAExB,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,eAAe,CAC9C,MAAM,EACN,QAAQ,EACR,YAAY,CACb,CAAC;IAEF,eAAe,CACb,MAAM,EACN,QAAQ,EACR,MAAM,CAAC,sBAAsB,EAAE;QAC7B,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC;QAC7D,WAAW,EAAE,MAAM,CAAC,0BAA0B,EAAE;YAC9C,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,GAAG;YACd,KAAK,EAAE,SAAS;SACjB,CAAC;KACH,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/pipeline/steps/defaults.d.ts

@@ -0,0 +1,97 @@
+import type { DescMessage, Message } from "@bufbuild/protobuf";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import type { ApiResourceAudit, ApiResourceAuditActor, ApiResourceAuditInfo } from "@stigmer/protos/ai/stigmer/commons/apiresource/status_pb";
+import type { CallerIdentity } from "../../extensions/identity.js";
+import type { PipelineStep } from "../pipeline.js";
+export declare function newBuildNewStateStep<Desc extends DescMessage>(): PipelineStep<Desc>;
+/** Clears the resource's status (Go clearStatusFieldReflect). */
+export declare function clearStatusField(schema: DescMessage, msg: Message): void;
+/**
+ * Go SetAuditFieldsForCreate: both slots identical, event "created". A
+ * resource without a status (or audit) field is a no-op. The actor is
+ * derived from the REQUEST's caller identity (O2 ruling Q5 — the
+ * DD-007 amendment): every call site holds a RequestContext, so audit
+ * attribution follows the caller, not a process-global.
+ */
+export declare function setAuditFieldsForCreate(schema: DescMessage, resource: Message, identity: CallerIdentity): void;
+/**
+ * Which half of status.audit a targeted mutation writes (#540). There is
+ * deliberately no default: every setAuditFieldsForUpdate call site must
+ * declare which slot it owns.
+ */
+export type AuditSlot = "spec_audit" | "status_audit";
+/**
+ * Go SetAuditFieldsForUpdate: stamps ONE audit slot on a targeted
+ * mutation. The named slot keeps its created_by/created_at (falling back
+ * to the current actor/time when the slot had no prior audit) and gets a
+ * fresh updated_by/updated_at with event "updated"; the other slot is not
+ * rewritten. The write SETS a newly allocated slot message — never mutates
+ * the existing slot in place (skill push copies slot pointers onto a new
+ * wrapper; in-place assignment would corrupt the in-memory original, #540).
+ */
+export declare function setAuditFieldsForUpdate(schema: DescMessage, resource: Message, slot: AuditSlot, identity: CallerIdentity): void;
+/**
+ * Installs the operator identity (STIGMER_OPERATOR_EMAIL/NAME — validation
+ * lives with the config loader). Empty email keeps the "system"
+ * placeholder behavior. Call exactly once at boot.
+ */
+export declare function setOperatorIdentity(email: string, displayName: string): void;
+/** Test seam: resets the one-shot guard (never called by production code). */
+export declare function resetOperatorIdentityForTests(): void;
+/**
+ * The installed operator identity, read by the verifier-chain chassis to
+ * mint the trusted-local CallerIdentity (O2): the single-operator trust
+ * domain's one principal. Empty email = unconfigured, the "system"
+ * placeholder posture. Audit stamping no longer reads this seam directly —
+ * it derives the actor from the request's CallerIdentity (ruling Q5),
+ * which for local postures carries exactly these values, so the stamped
+ * bytes are unchanged.
+ */
+export declare function operatorIdentitySnapshot(): {
+    email: string;
+    displayName: string;
+};
+/**
+ * The audit actor derived from a caller identity (O2 ruling Q5 — replaces
+ * the retired process-global currentAuditActor). A FRESH message per call
+ * (audit stamping shares the returned reference across created_by/
+ * updated_by; a singleton would alias unrelated resources' audit state).
+ *
+ * For local postures the trusted-local identity carries the #400 operator
+ * identity, so the derived actor is byte-identical to what the retired
+ * seam stamped: configured operator → email-first id with display fields;
+ * unconfigured → the "system" placeholder, which the runner deliberately
+ * demotes to anonymous (SYSTEM_CREATOR_SENTINEL). Verifier-produced
+ * identities (O3's OIDC claims onward) stamp their own email/displayName
+ * when present, identityId alone otherwise.
+ */
+export declare function auditActorFor(identity: CallerIdentity): ApiResourceAuditActor;
+/**
+ * Go updatedAuditInfo: preserved creation identity (falling back to the
+ * updating actor/time when the resource had none) + a fresh update stamp.
+ */
+export declare function updatedAuditInfo(createdBy: ApiResourceAuditActor | undefined, createdAt: Timestamp | undefined, actor: ApiResourceAuditActor, now: Timestamp): ApiResourceAuditInfo;
+/**
+ * Go creationAuditOf: created_by/created_at from the named slot, as deep
+ * copies (they must survive the audit field being overwritten). Either may
+ * be undefined when absent — callers decide the fallback.
+ */
+export declare function creationAuditOf(schema: DescMessage, resource: Message, slot: AuditSlot): {
+    createdBy: ApiResourceAuditActor | undefined;
+    createdAt: Timestamp | undefined;
+};
+/** The resource's status.audit, undefined at any absent link (read-only). */
+export declare function auditOf(schema: DescMessage, resource: Message): ApiResourceAudit | undefined;
+/**
+ * Go setAuditReflect: writes the whole audit block onto status.audit,
+ * creating status if needed. Kinds without status/audit are a no-op.
+ */
+export declare function setAuditReflect(schema: DescMessage, resource: Message, audit: ApiResourceAudit): void;
+/**
+ * Go GenerateID: {prefix}_{lowercase ULID}, e.g.
+ * agt_01arz3ndektsv4rrffq69g5fav. ulidx matches oklog/ulid's format
+ * (Crockford base32, 48-bit time + 80-bit randomness); lowercased for URL
+ * consistency, exactly as Go lowercases oklog's output.
+ */
+export declare function generateId(prefix: string): string;
+//# sourceMappingURL=defaults.d.ts.map

package/dist/pipeline/steps/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/defaults.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAI/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AASxD,OAAO,KAAK,EACV,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,0DAA0D,CAAC;AAElE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAUnD,wBAAgB,oBAAoB,CAClC,IAAI,SAAS,WAAW,KACrB,YAAY,CAAC,IAAI,CAAC,CAuCtB;AAED,iEAAiE;AACjE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,GAAG,IAAI,CAQxE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,cAAc,GACvB,IAAI,CAeN;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,cAAc,CAAC;AAEtD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,OAAO,EACjB,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,cAAc,GACvB,IAAI,CAUN;AAeD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAO5E;AAED,8EAA8E;AAC9E,wBAAgB,6BAA6B,IAAI,IAAI,CAIpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,IAAI;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB,CAEA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,cAAc,GAAG,qBAAqB,CAM7E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,qBAAqB,GAAG,SAAS,EAC5C,SAAS,EAAE,SAAS,GAAG,SAAS,EAChC,KAAK,EAAE,qBAAqB,EAC5B,GAAG,EAAE,SAAS,GACb,oBAAoB,CAQtB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,OAAO,EACjB,IAAI,EAAE,SAAS,GACd;IACD,SAAS,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC7C,SAAS,EAAE,SAAS,GAAG,SAAS,CAAC;CAClC,CAWA;AAED,6EAA6E;AAC7E,wBAAgB,OAAO,CACrB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,OAAO,GAChB,gBAAgB,GAAG,SAAS,CAU9B;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,gBAAgB,GACtB,IAAI,CAUN;AA+BD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEjD"}

package/dist/pipeline/steps/defaults.js

@@ -0,0 +1,251 @@
+/**
+ * BuildNewState + audit stamping + operator identity — ports
+ * steps/defaults.go.
+ *
+ * BuildNewState (create-state builder, aligned with Cloud's
+ * CreateOperationBuildNewStateStepV2): clears the client-provided status
+ * (system-managed), mints metadata.id = {kind-prefix}_{lowercase ULID}
+ * when unset, stamps spec_audit and status_audit identically with event
+ * "created", and defaults metadata.visibility from the kind's proto
+ * VisibilityConfig (blueprints → org, everything else → private; an
+ * explicit level is never overwritten).
+ *
+ * SpecAudit/StatusAudit are SLOTS, not steps (stigmer/stigmer#540): every
+ * setAuditFieldsForUpdate call site declares which slot it owns —
+ * SpecAudit for definition changes (search recency, version "pushed at"),
+ * StatusAudit for operational changes (Recents, lifecycle metadata).
+ */
+import { create, clone } from "@bufbuild/protobuf";
+import { reflect } from "@bufbuild/protobuf/reflect";
+import { timestampNow } from "@bufbuild/protobuf/wkt";
+import { ulid } from "ulidx";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import { ApiResourceAuditSchema, ApiResourceAuditActorSchema, ApiResourceAuditInfoSchema, } from "@stigmer/protos/ai/stigmer/commons/apiresource/status_pb";
+import { defaultVisibilityFor, getIdPrefix } from "../apiresource-meta.js";
+import { internalError } from "../errors.js";
+import { getOrCreateStatusField, getStatusField, hasStatusField, messageFieldByName, metadataOf, } from "./shapes.js";
+export function newBuildNewStateStep() {
+    return {
+        name: "BuildNewState",
+        execute(ctx) {
+            const resource = ctx.newState;
+            const metadata = metadataOf(resource);
+            if (metadata === undefined) {
+                throw internalError(new Error("resource metadata is nil"), "build new state");
+            }
+            // 1. Clear the status field — system-managed, never client-provided.
+            if (hasStatusField(ctx.schema)) {
+                clearStatusField(ctx.schema, resource);
+            }
+            // 2. Mint the id when unset (idempotent): {prefix}_{lowercase ULID}.
+            if (metadata.id === "") {
+                metadata.id = generateId(getIdPrefix(ctx.apiResourceKind));
+            }
+            // 3. Stamp both audit slots identically with event "created",
+            // attributed to the request's caller (O2 ruling Q5).
+            if (hasStatusField(ctx.schema)) {
+                setAuditFieldsForCreate(ctx.schema, resource, ctx.callerIdentity);
+            }
+            // 4. Default visibility from the kind's proto config when the client
+            // left it unspecified — an explicit level is never overwritten.
+            if (metadata.visibility ===
+                ApiResourceVisibility.api_resource_visibility_unspecified) {
+                metadata.visibility = defaultVisibilityFor(ctx.apiResourceKind);
+            }
+        },
+    };
+}
+/** Clears the resource's status (Go clearStatusFieldReflect). */
+export function clearStatusField(schema, msg) {
+    const root = reflect(schema, msg);
+    const field = root.fields.find((f) => f.name === "status" && f.fieldKind === "message");
+    if (field !== undefined && root.isSet(field)) {
+        root.clear(field);
+    }
+}
+/**
+ * Go SetAuditFieldsForCreate: both slots identical, event "created". A
+ * resource without a status (or audit) field is a no-op. The actor is
+ * derived from the REQUEST's caller identity (O2 ruling Q5 — the
+ * DD-007 amendment): every call site holds a RequestContext, so audit
+ * attribution follows the caller, not a process-global.
+ */
+export function setAuditFieldsForCreate(schema, resource, identity) {
+    const now = timestampNow();
+    const actor = auditActorFor(identity);
+    const info = create(ApiResourceAuditInfoSchema, {
+        createdBy: actor,
+        createdAt: now,
+        updatedBy: actor,
+        updatedAt: now,
+        event: "created",
+    });
+    setAuditReflect(schema, resource, create(ApiResourceAuditSchema, { specAudit: info, statusAudit: info }));
+}
+/**
+ * Go SetAuditFieldsForUpdate: stamps ONE audit slot on a targeted
+ * mutation. The named slot keeps its created_by/created_at (falling back
+ * to the current actor/time when the slot had no prior audit) and gets a
+ * fresh updated_by/updated_at with event "updated"; the other slot is not
+ * rewritten. The write SETS a newly allocated slot message — never mutates
+ * the existing slot in place (skill push copies slot pointers onto a new
+ * wrapper; in-place assignment would corrupt the in-memory original, #540).
+ */
+export function setAuditFieldsForUpdate(schema, resource, slot, identity) {
+    const now = timestampNow();
+    const actor = auditActorFor(identity);
+    const { createdBy, createdAt } = creationAuditOf(schema, resource, slot);
+    setAuditSlotReflect(schema, resource, slot, updatedAuditInfo(createdBy, createdAt, actor, now));
+}
+// Operator identity (stigmer/stigmer#400): installed once at boot — before
+// any request — and read by the identity chassis when it mints the
+// trusted-local CallerIdentity (O2; audit stamping now derives its actor
+// from that identity rather than reading this seam directly). The
+// module-level seam is Go's, kept deliberately: threading a boot-time
+// constant through every step constructor would be machinery without a
+// beneficiary. The one-shot guard adds the composition-root idiom's
+// loudness: a second install is a wiring bug and throws at boot, not a
+// silent overwrite.
+let operatorEmail = "";
+let operatorName = "";
+let operatorIdentityInstalled = false;
+/**
+ * Installs the operator identity (STIGMER_OPERATOR_EMAIL/NAME — validation
+ * lives with the config loader). Empty email keeps the "system"
+ * placeholder behavior. Call exactly once at boot.
+ */
+export function setOperatorIdentity(email, displayName) {
+    if (operatorIdentityInstalled) {
+        throw new Error("operator identity already installed (boot wiring bug)");
+    }
+    operatorIdentityInstalled = true;
+    operatorEmail = email;
+    operatorName = displayName;
+}
+/** Test seam: resets the one-shot guard (never called by production code). */
+export function resetOperatorIdentityForTests() {
+    operatorIdentityInstalled = false;
+    operatorEmail = "";
+    operatorName = "";
+}
+/**
+ * The installed operator identity, read by the verifier-chain chassis to
+ * mint the trusted-local CallerIdentity (O2): the single-operator trust
+ * domain's one principal. Empty email = unconfigured, the "system"
+ * placeholder posture. Audit stamping no longer reads this seam directly —
+ * it derives the actor from the request's CallerIdentity (ruling Q5),
+ * which for local postures carries exactly these values, so the stamped
+ * bytes are unchanged.
+ */
+export function operatorIdentitySnapshot() {
+    return { email: operatorEmail, displayName: operatorName };
+}
+/**
+ * The audit actor derived from a caller identity (O2 ruling Q5 — replaces
+ * the retired process-global currentAuditActor). A FRESH message per call
+ * (audit stamping shares the returned reference across created_by/
+ * updated_by; a singleton would alias unrelated resources' audit state).
+ *
+ * For local postures the trusted-local identity carries the #400 operator
+ * identity, so the derived actor is byte-identical to what the retired
+ * seam stamped: configured operator → email-first id with display fields;
+ * unconfigured → the "system" placeholder, which the runner deliberately
+ * demotes to anonymous (SYSTEM_CREATOR_SENTINEL). Verifier-produced
+ * identities (O3's OIDC claims onward) stamp their own email/displayName
+ * when present, identityId alone otherwise.
+ */
+export function auditActorFor(identity) {
+    return create(ApiResourceAuditActorSchema, {
+        id: identity.identityId,
+        email: identity.email ?? "",
+        displayName: identity.displayName ?? "",
+    });
+}
+/**
+ * Go updatedAuditInfo: preserved creation identity (falling back to the
+ * updating actor/time when the resource had none) + a fresh update stamp.
+ */
+export function updatedAuditInfo(createdBy, createdAt, actor, now) {
+    return create(ApiResourceAuditInfoSchema, {
+        createdBy: createdBy ?? actor,
+        createdAt: createdAt ?? now,
+        updatedBy: actor,
+        updatedAt: now,
+        event: "updated",
+    });
+}
+/**
+ * Go creationAuditOf: created_by/created_at from the named slot, as deep
+ * copies (they must survive the audit field being overwritten). Either may
+ * be undefined when absent — callers decide the fallback.
+ */
+export function creationAuditOf(schema, resource, slot) {
+    const audit = auditOf(schema, resource);
+    const info = slot === "spec_audit" ? audit?.specAudit : audit?.statusAudit;
+    return {
+        createdBy: info?.createdBy !== undefined
+            ? clone(ApiResourceAuditActorSchema, info.createdBy)
+            : undefined,
+        createdAt: info?.createdAt !== undefined ? { ...info.createdAt } : undefined,
+    };
+}
+/** The resource's status.audit, undefined at any absent link (read-only). */
+export function auditOf(schema, resource) {
+    const status = getStatusField(schema, resource);
+    if (status === undefined) {
+        return undefined;
+    }
+    const auditField = messageFieldByName(status, "audit");
+    if (auditField === undefined || !status.isSet(auditField)) {
+        return undefined;
+    }
+    return status.get(auditField).message;
+}
+/**
+ * Go setAuditReflect: writes the whole audit block onto status.audit,
+ * creating status if needed. Kinds without status/audit are a no-op.
+ */
+export function setAuditReflect(schema, resource, audit) {
+    const status = getOrCreateStatusField(schema, resource);
+    if (status === undefined) {
+        return;
+    }
+    const auditField = messageFieldByName(status, "audit");
+    if (auditField === undefined) {
+        return;
+    }
+    status.set(auditField, reflect(ApiResourceAuditSchema, audit));
+}
+/**
+ * Go setAuditSlotReflect: writes one slot of status.audit, leaving the
+ * other untouched (creating status/audit wrappers as needed).
+ */
+function setAuditSlotReflect(schema, resource, slot, info) {
+    const status = getOrCreateStatusField(schema, resource);
+    if (status === undefined) {
+        return;
+    }
+    const auditField = messageFieldByName(status, "audit");
+    if (auditField === undefined) {
+        return;
+    }
+    if (!status.isSet(auditField)) {
+        status.set(auditField, reflect(auditField.message));
+    }
+    const auditMsg = status.get(auditField);
+    const slotField = messageFieldByName(auditMsg, slot);
+    if (slotField === undefined) {
+        return;
+    }
+    auditMsg.set(slotField, reflect(ApiResourceAuditInfoSchema, info));
+}
+/**
+ * Go GenerateID: {prefix}_{lowercase ULID}, e.g.
+ * agt_01arz3ndektsv4rrffq69g5fav. ulidx matches oklog/ulid's format
+ * (Crockford base32, 48-bit time + 80-bit randomness); lowercased for URL
+ * consistency, exactly as Go lowercases oklog's output.
+ */
+export function generateId(prefix) {
+    return `${prefix}_${ulid().toLowerCase()}`;
+}
+//# sourceMappingURL=defaults.js.map

package/dist/pipeline/steps/defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../../src/pipeline/steps/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAErD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,0DAA0D,CAAC;AAQlE,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,MAAM,UAAU,oBAAoB;IAGlC,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,OAAO,CAAC,GAAyB;YAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC9B,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,0BAA0B,CAAC,EACrC,iBAAiB,CAClB,CAAC;YACJ,CAAC;YAED,qEAAqE;YACrE,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACzC,CAAC;YAED,qEAAqE;YACrE,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACvB,QAAQ,CAAC,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;YAC7D,CAAC;YAED,8DAA8D;YAC9D,qDAAqD;YACrD,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B,uBAAuB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YACpE,CAAC;YAED,qEAAqE;YACrE,gEAAgE;YAChE,IACE,QAAQ,CAAC,UAAU;gBACnB,qBAAqB,CAAC,mCAAmC,EACzD,CAAC;gBACD,QAAQ,CAAC,UAAU,GAAG,oBAAoB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,gBAAgB,CAAC,MAAmB,EAAE,GAAY;IAChE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CACxD,CAAC;IACF,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAmB,EACnB,QAAiB,EACjB,QAAwB;IAExB,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,0BAA0B,EAAE;QAC9C,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,GAAG;QACd,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IACH,eAAe,CACb,MAAM,EACN,QAAQ,EACR,MAAM,CAAC,sBAAsB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CACvE,CAAC;AACJ,CAAC;AASD;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAmB,EACnB,QAAiB,EACjB,IAAe,EACf,QAAwB;IAExB,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzE,mBAAmB,CACjB,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,mEAAmE;AACnE,yEAAyE;AACzE,kEAAkE;AAClE,sEAAsE;AACtE,uEAAuE;AACvE,oEAAoE;AACpE,uEAAuE;AACvE,oBAAoB;AACpB,IAAI,aAAa,GAAG,EAAE,CAAC;AACvB,IAAI,YAAY,GAAG,EAAE,CAAC;AACtB,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,WAAmB;IACpE,IAAI,yBAAyB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,yBAAyB,GAAG,IAAI,CAAC;IACjC,aAAa,GAAG,KAAK,CAAC;IACtB,YAAY,GAAG,WAAW,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,6BAA6B;IAC3C,yBAAyB,GAAG,KAAK,CAAC;IAClC,aAAa,GAAG,EAAE,CAAC;IACnB,YAAY,GAAG,EAAE,CAAC;AACpB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB;IAItC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAAC,QAAwB;IACpD,OAAO,MAAM,CAAC,2BAA2B,EAAE;QACzC,EAAE,EAAE,QAAQ,CAAC,UAAU;QACvB,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,EAAE;QAC3B,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE;KACxC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAA4C,EAC5C,SAAgC,EAChC,KAA4B,EAC5B,GAAc;IAEd,OAAO,MAAM,CAAC,0BAA0B,EAAE;QACxC,SAAS,EAAE,SAAS,IAAI,KAAK;QAC7B,SAAS,EAAE,SAAS,IAAI,GAAG;QAC3B,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,GAAG;QACd,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAmB,EACnB,QAAiB,EACjB,IAAe;IAKf,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC;IAC3E,OAAO;QACL,SAAS,EACP,IAAI,EAAE,SAAS,KAAK,SAAS;YAC3B,CAAC,CAAC,KAAK,CAAC,2BAA2B,EAAE,IAAI,CAAC,SAAS,CAAC;YACpD,CAAC,CAAC,SAAS;QACf,SAAS,EACP,IAAI,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;KACpE,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,OAAO,CACrB,MAAmB,EACnB,QAAiB;IAEjB,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAsC,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAmB,EACnB,QAAiB,EACjB,KAAuB;IAEvB,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAC1B,MAAmB,EACnB,QAAiB,EACjB,IAAe,EACf,IAA0B;IAE1B,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO;IACT,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,QAAQ,GAAmB,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,OAAO,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;AAC7C,CAAC"}

package/dist/pipeline/steps/delete.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Delete steps — port steps/delete.go: ExtractResourceId (ID-wrapper →
+ * context), LoadExistingForDelete (loads the doomed resource so Delete can
+ * return it; NotFound when absent), DeleteResource (the store delete).
+ *
+ * Deliberate divergence from the Go source (ratified 2026-08-26): Go
+ * mapped ANY store error on the load to NotFound. Here only the typed
+ * ResourceNotFoundError is NotFound; other store failures surface as
+ * sanitized Internal — rethrown from the load (the executor converts,
+ * see pipeline.ts) or thrown directly by DeleteResource. Same narrowing
+ * as load-target.ts, applied at every store-read site.
+ */
+import type { DescMessage } from "@bufbuild/protobuf";
+import type { Store } from "../../store/interface.js";
+import type { PipelineStep } from "../pipeline.js";
+/** Context key for the extracted id (Go ResourceIdKey). */
+export declare const RESOURCE_ID_KEY = "resourceId";
+export declare function newExtractResourceIdStep<Desc extends DescMessage>(): PipelineStep<Desc>;
+export declare function newLoadExistingForDeleteStep<InputDesc extends DescMessage, ResourceDesc extends DescMessage>(store: Store, resourceSchema: ResourceDesc): PipelineStep<InputDesc>;
+export declare function newDeleteResourceStep<Desc extends DescMessage>(store: Store): PipelineStep<Desc>;
+//# sourceMappingURL=delete.d.ts.map

package/dist/pipeline/steps/delete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/delete.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,WAAW,EAAgB,MAAM,oBAAoB,CAAC;AAGpE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAGtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAKnD,2DAA2D;AAC3D,eAAO,MAAM,eAAe,eAAe,CAAC;AAE5C,wBAAgB,wBAAwB,CAAC,IAAI,SAAS,WAAW,KAAK,YAAY,CAAC,IAAI,CAAC,CAWvF;AAED,wBAAgB,4BAA4B,CAC1C,SAAS,SAAS,WAAW,EAC7B,YAAY,SAAS,WAAW,EAChC,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,GAAG,YAAY,CAAC,SAAS,CAAC,CAuBrE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,SAAS,WAAW,EAC5D,KAAK,EAAE,KAAK,GACX,YAAY,CAAC,IAAI,CAAC,CAepB"}

package/dist/pipeline/steps/delete.js

@@ -0,0 +1,60 @@
+import { ResourceNotFoundError } from "../../store/interface.js";
+import { getKindName } from "../apiresource-meta.js";
+import { internalError, invalidArgumentError, notFoundError } from "../errors.js";
+import { EXISTING_RESOURCE_KEY } from "./load-existing.js";
+import { idValueOf } from "./shapes.js";
+/** Context key for the extracted id (Go ResourceIdKey). */
+export const RESOURCE_ID_KEY = "resourceId";
+export function newExtractResourceIdStep() {
+    return {
+        name: "ExtractResourceId",
+        execute(ctx) {
+            const id = idValueOf(ctx.input);
+            if (id === "") {
+                throw invalidArgumentError("resource id is required");
+            }
+            ctx.set(RESOURCE_ID_KEY, id);
+        },
+    };
+}
+export function newLoadExistingForDeleteStep(store, resourceSchema) {
+    return {
+        name: "LoadExistingForDelete",
+        async execute(ctx) {
+            const id = requireResourceId(ctx);
+            let resource;
+            try {
+                resource = await store.getResource(ctx.apiResourceKind, id, resourceSchema);
+            }
+            catch (error) {
+                if (error instanceof ResourceNotFoundError) {
+                    throw notFoundError(getKindName(ctx.apiResourceKind), id);
+                }
+                throw error;
+            }
+            ctx.set(EXISTING_RESOURCE_KEY, resource);
+        },
+    };
+}
+export function newDeleteResourceStep(store) {
+    return {
+        name: "DeleteResource",
+        async execute(ctx) {
+            const id = requireResourceId(ctx);
+            try {
+                await store.deleteResource(ctx.apiResourceKind, id);
+            }
+            catch (error) {
+                throw internalError(error, `failed to delete ${getKindName(ctx.apiResourceKind)}`);
+            }
+        },
+    };
+}
+function requireResourceId(ctx) {
+    const id = ctx.get(RESOURCE_ID_KEY);
+    if (typeof id !== "string" || id === "") {
+        throw internalError(new Error("resource id not found in context (ExtractResourceId must run first)"), "delete pipeline ordering");
+    }
+    return id;
+}
+//# sourceMappingURL=delete.js.map

package/dist/pipeline/steps/delete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.js","sourceRoot":"","sources":["../../../src/pipeline/steps/delete.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGlF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,2DAA2D;AAC3D,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC;AAE5C,MAAM,UAAU,wBAAwB;IACtC,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,OAAO,CAAC,GAAyB;YAC/B,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACd,MAAM,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;YACxD,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAG1C,KAAY,EAAE,cAA4B;IAC1C,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,KAAK,CAAC,OAAO,CAAC,GAA8B;YAC1C,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YAElC,IAAI,QAAoC,CAAC;YACzC,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAChC,GAAG,CAAC,eAAe,EACnB,EAAE,EACF,cAAc,CACf,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,MAAM,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5D,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAY;IAEZ,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CACjB,KAAK,EACL,oBAAoB,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CACvD,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAyB;IAEzB,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,qEAAqE,CAAC,EAChF,0BAA0B,CAC3B,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/pipeline/steps/duplicate.d.ts

@@ -0,0 +1,12 @@
+/**
+ * CheckDuplicate — ports steps/duplicate.go. Rejects a create whose slug
+ * already exists WITHIN THE SAME ORG (slugs are org-scoped; an empty org
+ * falls back to a global check). Domains with different uniqueness rules
+ * bring their own step under the same name (organization: global by id —
+ * see the domain's steps module).
+ */
+import type { DescMessage } from "@bufbuild/protobuf";
+import type { Store } from "../../store/interface.js";
+import type { PipelineStep } from "../pipeline.js";
+export declare function newCheckDuplicateStep<Desc extends DescMessage>(store: Store): PipelineStep<Desc>;
+//# sourceMappingURL=duplicate.d.ts.map

package/dist/pipeline/steps/duplicate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"duplicate.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/duplicate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAGtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAKnD,wBAAgB,qBAAqB,CAAC,IAAI,SAAS,WAAW,EAC5D,KAAK,EAAE,KAAK,GACX,YAAY,CAAC,IAAI,CAAC,CAmCpB"}

package/dist/pipeline/steps/duplicate.js

@@ -0,0 +1,31 @@
+import { getKindName } from "../apiresource-meta.js";
+import { alreadyExistsError, internalError } from "../errors.js";
+import { findResourceBySlug } from "./helpers.js";
+import { metadataOf } from "./shapes.js";
+export function newCheckDuplicateStep(store) {
+    return {
+        name: "CheckDuplicate",
+        async execute(ctx) {
+            const metadata = metadataOf(ctx.newState);
+            if (metadata === undefined) {
+                // Established by earlier steps — a server-side programming error.
+                throw internalError(new Error("resource metadata is nil"), "duplicate check");
+            }
+            if (metadata.slug === "") {
+                throw internalError(new Error("resource slug is empty"), "duplicate check");
+            }
+            let existing;
+            try {
+                existing = await findResourceBySlug(store, ctx.apiResourceKind, ctx.schema, metadata.slug, metadata.org);
+            }
+            catch (error) {
+                throw internalError(error, "failed to check for duplicates");
+            }
+            if (existing !== undefined) {
+                const existingMetadata = metadataOf(existing);
+                throw alreadyExistsError(getKindName(ctx.apiResourceKind), `slug '${metadata.slug}' in org '${existingMetadata?.org ?? ""}' (id: ${existingMetadata?.id ?? ""})`);
+            }
+        },
+    };
+}
+//# sourceMappingURL=duplicate.js.map

package/dist/pipeline/steps/duplicate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"duplicate.js","sourceRoot":"","sources":["../../../src/pipeline/steps/duplicate.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,qBAAqB,CACnC,KAAY;IAEZ,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,kEAAkE;gBAClE,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACzB,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAC9E,CAAC;YAED,IAAI,QAAQ,CAAC;YACb,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,kBAAkB,CACjC,KAAK,EACL,GAAG,CAAC,eAAe,EACnB,GAAG,CAAC,MAAM,EACV,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,GAAG,CACb,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;YAC/D,CAAC;YAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,gBAAgB,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC9C,MAAM,kBAAkB,CACtB,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,EAChC,SAAS,QAAQ,CAAC,IAAI,aAAa,gBAAgB,EAAE,GAAG,IAAI,EAAE,UAAU,gBAAgB,EAAE,EAAE,IAAI,EAAE,GAAG,CACtG,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}