@stigmer/server 3.14.0-dev.20260910084630

package/dist/pipeline/steps/guard-memory-capture.d.ts

@@ -0,0 +1,61 @@
+/**
+ * GuardMemoryCapture — the memory create chain's capture-eligibility gate
+ * (C2 Stage 3D; the Java MemoryCreateHandler's first gate, DD-002 D4 as
+ * amended): memory may only be captured for a FIRST-PARTY HUMAN OPERATOR
+ * — or the remember tool's SESSION-SCOPED sandbox credential acting as
+ * its human subject (the Stage 3 decision, restored for compositions by
+ * parity entry 20260830.05 / stigmer-cloud#564). Machine accounts and
+ * every minted-credential lane — PlatformClient user tokens, guest
+ * embeds, channel senders, schedule runs — stay refused; "the label is
+ * not authorization; the server refuses."
+ *
+ * The credential class is read from the VERIFIED token's own claims
+ * (position 1 verified it; decoding here is a read of trusted state):
+ * every Stigmer-minted non-first-party credential carries the
+ * `platform_client_id` claim (StigmerJwtIssuer stamps it on user, guest,
+ * channel, and schedule tokens alike), so its presence IS the exclusion
+ * the Java RequestCallerIdentity.isFirstPartyHumanOperator computes.
+ *
+ * RUNNER credentials carry neither the machine class nor that claim —
+ * their eligibility is EDITION POLICY, so the gate consults the composed
+ * RunnerCredentialProvider's authorizeMemoryCapture capability (the
+ * token-type vocabulary that classifies a runner credential is the
+ * provider's own; no caller class expresses it and OSS never learns
+ * another edition's lane names). The capability's three verdicts:
+ * `admit` (the session-scoped capture lane — the token's proved subject
+ * and session id are stashed under MEMORY_CAPTURE_CREDENTIAL_KEY for
+ * ResolveMemoryDefaults' Java-parity field derivation), `refuse` (a
+ * runner credential outside the capture lane — the byte-pinned copy
+ * below), `no-opinion` (not a credential the implementation classifies —
+ * this gate's own logic applies). The capability throws its own
+ * byte-pinned refusal for the org-mismatch arm. With no capability
+ * composed the gate's logic is byte-identical to before the seam: OSS
+ * trusted-local callers carry no token and OIDC console logins carry no
+ * platform_client_id claim — the step admits both, so the single-user
+ * posture is unchanged (proven by the rosters).
+ */
+import type { DescMessage } from "@bufbuild/protobuf";
+import type { PipelineStep } from "../pipeline.js";
+import type { RequestContext } from "../request-context.js";
+import type { RunnerCredentialProvider } from "../../runnerauth/runner-credential-provider.js";
+/** The Java MemoryPolicy.MEMORY_CAPTURE_CALLER_MESSAGE, byte-pinned. */
+export declare const MEMORY_CAPTURE_CALLER_MESSAGE = "memory can only be captured for a first-party human operator";
+/**
+ * Context key carrying an admitted capture credential's proved claims
+ * (subjectIdentityAccountId + provedSessionId) from this gate to
+ * ResolveMemoryDefaults — present exactly when the capability answered
+ * `admit`, so the defaults step needs no second consult.
+ */
+export declare const MEMORY_CAPTURE_CREDENTIAL_KEY = "memoryCaptureCredential";
+export declare function newGuardMemoryCaptureStep<Desc extends DescMessage>(provider?: RunnerCredentialProvider): PipelineStep<Desc>;
+/** An admitted capture credential's proved claims (the context payload). */
+export interface MemoryCaptureCredential {
+    readonly subjectIdentityAccountId: string;
+    readonly provedSessionId: string;
+}
+/**
+ * Reads the admitted capture credential stashed by this gate, if any —
+ * ResolveMemoryDefaults' half of the handoff.
+ */
+export declare function memoryCaptureCredentialOf<Desc extends DescMessage>(ctx: RequestContext<Desc>): MemoryCaptureCredential | undefined;
+//# sourceMappingURL=guard-memory-capture.d.ts.map

package/dist/pipeline/steps/guard-memory-capture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-memory-capture.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-memory-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAG/F,wEAAwE;AACxE,eAAO,MAAM,6BAA6B,iEACsB,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AAEvE,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,QAAQ,CAAC,EAAE,wBAAwB,GAClC,YAAY,CAAC,IAAI,CAAC,CAoDpB;AAED,4EAA4E;AAC5E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,GACxB,uBAAuB,GAAG,SAAS,CAWrC"}

package/dist/pipeline/steps/guard-memory-capture.js

@@ -0,0 +1,83 @@
+import { Code, ConnectError } from "@connectrpc/connect";
+import { metadataOf } from "./shapes.js";
+/** The Java MemoryPolicy.MEMORY_CAPTURE_CALLER_MESSAGE, byte-pinned. */
+export const MEMORY_CAPTURE_CALLER_MESSAGE = "memory can only be captured for a first-party human operator";
+/**
+ * Context key carrying an admitted capture credential's proved claims
+ * (subjectIdentityAccountId + provedSessionId) from this gate to
+ * ResolveMemoryDefaults — present exactly when the capability answered
+ * `admit`, so the defaults step needs no second consult.
+ */
+export const MEMORY_CAPTURE_CREDENTIAL_KEY = "memoryCaptureCredential";
+export function newGuardMemoryCaptureStep(provider) {
+    return {
+        name: "GuardMemoryCapture",
+        execute(ctx) {
+            const caller = ctx.callerIdentity;
+            if (caller.callerClass === "internal" || caller.origin === "in-process") {
+                // Server-composed traversals are not capture requests from a
+                // credential; the entry-point request already passed the gate.
+                return;
+            }
+            const decide = provider?.authorizeMemoryCapture;
+            if (decide !== undefined) {
+                // The org the capture addresses — the capability's org-mismatch
+                // arm checks it against the token's own claim (and throws its
+                // byte-pinned refusal itself). Empty when the request carries
+                // none; Java requires metadata.org before its org-match arm, so
+                // an empty value can only ever narrow.
+                const org = metadataOf(ctx.newState)?.org ?? "";
+                const decision = decide.call(provider, caller, org);
+                switch (decision.verdict) {
+                    case "admit":
+                        ctx.set(MEMORY_CAPTURE_CREDENTIAL_KEY, {
+                            subjectIdentityAccountId: decision.subjectIdentityAccountId,
+                            provedSessionId: decision.provedSessionId,
+                        });
+                        return;
+                    case "refuse":
+                        throw new ConnectError(MEMORY_CAPTURE_CALLER_MESSAGE, Code.PermissionDenied);
+                    case "no-opinion":
+                        break;
+                    default: {
+                        const exhaustive = decision;
+                        throw new Error(`unknown memory capture decision ${JSON.stringify(exhaustive)}`);
+                    }
+                }
+            }
+            if (caller.callerClass === "machine" ||
+                carriesPlatformClientClaim(caller.rawToken)) {
+                throw new ConnectError(MEMORY_CAPTURE_CALLER_MESSAGE, Code.PermissionDenied);
+            }
+        },
+    };
+}
+/**
+ * Reads the admitted capture credential stashed by this gate, if any —
+ * ResolveMemoryDefaults' half of the handoff.
+ */
+export function memoryCaptureCredentialOf(ctx) {
+    const payload = ctx.get(MEMORY_CAPTURE_CREDENTIAL_KEY);
+    if (typeof payload === "object" &&
+        payload !== null &&
+        "subjectIdentityAccountId" in payload &&
+        "provedSessionId" in payload) {
+        return payload;
+    }
+    return undefined;
+}
+function carriesPlatformClientClaim(rawToken) {
+    const segments = rawToken.split(".");
+    if (segments.length !== 3) {
+        return false; // not a JWT — the trusted-local no-token posture
+    }
+    try {
+        const payload = JSON.parse(Buffer.from(segments[1], "base64url").toString("utf8"));
+        return (typeof payload.platform_client_id === "string" &&
+            payload.platform_client_id !== "");
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=guard-memory-capture.js.map

package/dist/pipeline/steps/guard-memory-capture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-memory-capture.js","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-memory-capture.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKzD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,wEAAwE;AACxE,MAAM,CAAC,MAAM,6BAA6B,GACxC,8DAA8D,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAC;AAEvE,MAAM,UAAU,yBAAyB,CACvC,QAAmC;IAEnC,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,OAAO,CAAC,GAAyB;YAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC;YAClC,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBACxE,6DAA6D;gBAC7D,+DAA+D;gBAC/D,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,EAAE,sBAAsB,CAAC;YAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,gEAAgE;gBAChE,8DAA8D;gBAC9D,8DAA8D;gBAC9D,gEAAgE;gBAChE,uCAAuC;gBACvC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;gBACpD,QAAQ,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACzB,KAAK,OAAO;wBACV,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE;4BACrC,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;4BAC3D,eAAe,EAAE,QAAQ,CAAC,eAAe;yBAC1C,CAAC,CAAC;wBACH,OAAO;oBACT,KAAK,QAAQ;wBACX,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,gBAAgB,CACtB,CAAC;oBACJ,KAAK,YAAY;wBACf,MAAM;oBACR,OAAO,CAAC,CAAC,CAAC;wBACR,MAAM,UAAU,GAAU,QAAQ,CAAC;wBACnC,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAChE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IACE,MAAM,CAAC,WAAW,KAAK,SAAS;gBAChC,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC3C,CAAC;gBACD,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,gBAAgB,CACtB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAyB;IAEzB,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACvD,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,0BAA0B,IAAI,OAAO;QACrC,iBAAiB,IAAI,OAAO,EAC5B,CAAC;QACD,OAAO,OAAkC,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B,CAAC,QAAgB;IAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,CAAC,iDAAiD;IACjE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACnB,CAAC;QACtC,OAAO,CACL,OAAO,OAAO,CAAC,kBAAkB,KAAK,QAAQ;YAC9C,OAAO,CAAC,kBAAkB,KAAK,EAAE,CAClC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/pipeline/steps/guard-reserved-labels.d.ts

@@ -0,0 +1,13 @@
+import type { DescMessage } from "@bufbuild/protobuf";
+import type { Authorizer } from "../../extensions/authorizer.js";
+import type { PipelineStep } from "../pipeline.js";
+/** The platform-reserved label key namespace (SystemManagedLabels). */
+export declare const RESERVED_LABEL_PREFIX = "stigmer.ai/";
+/**
+ * The reserved keys `requested` would introduce or change relative to
+ * `stored` — the guard's predicate (SystemManagedLabels
+ * reservedLabelMutations). Removals and echoes are not mutations.
+ */
+export declare function reservedLabelMutations(stored: Readonly<Record<string, string>>, requested: Readonly<Record<string, string>>): ReadonlyArray<string>;
+export declare function newGuardReservedLabelsStep<Desc extends DescMessage>(authorizer: Authorizer): PipelineStep<Desc>;
+//# sourceMappingURL=guard-reserved-labels.d.ts.map

package/dist/pipeline/steps/guard-reserved-labels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-reserved-labels.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-reserved-labels.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAKtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAMnD,uEAAuE;AACvE,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAcnD;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACxC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC1C,aAAa,CAAC,MAAM,CAAC,CAQvB;AAED,wBAAgB,0BAA0B,CAAC,IAAI,SAAS,WAAW,EACjE,UAAU,EAAE,UAAU,GACrB,YAAY,CAAC,IAAI,CAAC,CAmEpB"}

package/dist/pipeline/steps/guard-reserved-labels.js

@@ -0,0 +1,138 @@
+/**
+ * GuardReservedLabels — the write-boundary guard for the platform-reserved
+ * `stigmer.ai/*` label namespace (the Java GuardReservedLabelsStep port,
+ * cloud#320/#386; C2 Stage 3, 20260827.10).
+ *
+ * Reserved labels carry platform semantics — the motivating one is
+ * `stigmer.ai/default-agent`, which the default-agent resolution reads
+ * GLOBALLY (label + visibility_public), so a tenant labeling its own
+ * public agent would enter every organization's default-agent candidate
+ * set. Only rejecting the write closes that.
+ *
+ * Behavior (the Java matrix verbatim):
+ *   - ECHOES pass — clients read-modify-write whole resources, so a
+ *     stored reserved label legitimately comes back on honest updates.
+ *   - REMOVALS pass — dropping a reserved label only shrinks what it
+ *     granted (de-escalation, and the operator cleanup path).
+ *   - INTRODUCTIONS and CHANGES reject with INVALID_ARGUMENT (the
+ *     cloud#229 boundary doctrine: server-reserved sentinels are not
+ *     accepted from clients) — unless the caller holds
+ *     `can_write_reserved_labels` on `platform:stigmer`, consulted
+ *     LAZILY through the one composed Authorizer, so normal writes pay
+ *     no authorization round-trip. The OSS permissive default allows —
+ *     the local posture keeps today's behavior byte-identically; the
+ *     cloud's FGA Authorizer supplies the operator gate.
+ *   - INTERNAL callers pass (the in-process chain's own composed
+ *     requests — default-instance factories, managed environments; the
+ *     TS rendering of Java's skipAuthorization + isInProcessCall arms).
+ *   - PER-KIND CLIENT CONTRACTS pass: `stigmer.ai/personal` on
+ *     Environment, which the console legitimately sends on create — the
+ *     one allowlist entry, kept here with the doctrine so widening it is
+ *     one reviewable diff.
+ *   - SERVER-STAMPED KEYS pass (server-stamped-reserved-labels.ts, the
+ *     Java ServerStampedReservedLabels arm, cloud#386): a step that made
+ *     the trust decision for specific keys on THIS request records
+ *     exactly those keys, and the guard exempts exactly them (the
+ *     agentexecution create chain's RecordRunnerLineageLabels is the
+ *     first recorder — parity entry 20260830.05).
+ *   - LABELS only, deliberately not annotations (annotations carry no
+ *     resolution or authorization semantics).
+ *
+ * Placement: after BuildNewState/BuildUpdateState — the step inspects the
+ * state that will persist, and update chains have LoadExisting's stored
+ * labels for echo detection. The infrastructure-failure arm answers a
+ * sanitized INTERNAL (the TS store-fault doctrine, #478) where Java
+ * echoes raw exception text — an unpinned outage-lane difference.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { internalError } from "../errors.js";
+import { EXISTING_RESOURCE_KEY } from "./load-existing.js";
+import { serverStampedReservedLabels } from "./server-stamped-reserved-labels.js";
+import { metadataOf } from "./shapes.js";
+/** The platform-reserved label key namespace (SystemManagedLabels). */
+export const RESERVED_LABEL_PREFIX = "stigmer.ai/";
+/**
+ * The reserved keys clients may legitimately write per kind — the one
+ * entry today is the personal-environment marker the console sends on
+ * create (the Java CLIENT_CONTRACT_ALLOWLIST verbatim).
+ */
+const CLIENT_CONTRACT_ALLOWLIST = new Map([
+    [ApiResourceKind.environment, new Set(["stigmer.ai/personal"])],
+]);
+/**
+ * The reserved keys `requested` would introduce or change relative to
+ * `stored` — the guard's predicate (SystemManagedLabels
+ * reservedLabelMutations). Removals and echoes are not mutations.
+ */
+export function reservedLabelMutations(stored, requested) {
+    const mutations = [];
+    for (const [key, value] of Object.entries(requested)) {
+        if (key.startsWith(RESERVED_LABEL_PREFIX) && stored[key] !== value) {
+            mutations.push(key);
+        }
+    }
+    return mutations.sort();
+}
+export function newGuardReservedLabelsStep(authorizer) {
+    return {
+        name: "GuardReservedLabels",
+        async execute(ctx) {
+            if (ctx.callerIdentity.callerClass === "internal" ||
+                ctx.callerIdentity.origin === "in-process") {
+                // Server-composed request (the Java isInProcessCall arm,
+                // cloud#386): the trust decision was made by the service code
+                // that built it — default-instance factories stamp reserved
+                // labels by design, even when the call propagates the user's
+                // identity for attribution (ruling R5).
+                return;
+            }
+            const requested = metadataOf(ctx.newState)?.labels ?? {};
+            const existing = ctx.get(EXISTING_RESOURCE_KEY);
+            const stored = existing === undefined
+                ? {}
+                : (metadataOf(existing)?.labels ?? {});
+            const allowlist = CLIENT_CONTRACT_ALLOWLIST.get(ctx.apiResourceKind) ?? new Set();
+            const stamped = serverStampedReservedLabels(ctx);
+            const mutations = reservedLabelMutations(stored, requested).filter((key) => !allowlist.has(key) && !stamped.has(key));
+            if (mutations.length === 0) {
+                return;
+            }
+            // Lazy operator check — only a request that actually mutates a
+            // reserved key ever reaches the Authorizer.
+            let decision;
+            try {
+                decision = await authorizer.authorize(ctx.callerIdentity, {
+                    permission: IamPermission.can_write_reserved_labels,
+                    resourceKind: ApiResourceKind.platform,
+                    resourceId: "stigmer",
+                });
+            }
+            catch (error) {
+                throw reservedLabelCheckFailure(error);
+            }
+            switch (decision.kind) {
+                case "allow":
+                    return;
+                case "deny":
+                case "not-found":
+                    throw new ConnectError(`Labels in the reserved '${RESERVED_LABEL_PREFIX}' namespace ` +
+                        "are platform-managed and cannot be set or changed by this " +
+                        `request: ${mutations.join(", ")}. Stored reserved labels ` +
+                        "may be echoed back unchanged or removed.", Code.InvalidArgument);
+                case "unavailable":
+                    throw reservedLabelCheckFailure(decision.cause);
+                default: {
+                    const exhaustive = decision;
+                    throw reservedLabelCheckFailure(new Error(`unknown decision ${JSON.stringify(exhaustive)}`));
+                }
+            }
+        },
+    };
+}
+/** Authorization infrastructure failure: fail closed, sanitized (#478). */
+function reservedLabelCheckFailure(error) {
+    return internalError(error instanceof Error ? error : new Error(String(error)), "reserved-label validation could not be completed");
+}
+//# sourceMappingURL=guard-reserved-labels.js.map

package/dist/pipeline/steps/guard-reserved-labels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-reserved-labels.js","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-reserved-labels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAG1E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,uEAAuE;AACvE,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD;;;;GAIG;AACH,MAAM,yBAAyB,GAG3B,IAAI,GAAG,CAAC;IACV,CAAC,eAAe,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC;CAChE,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAwC,EACxC,SAA2C;IAE3C,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,IAAI,GAAG,CAAC,UAAU,CAAC,qBAAqB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;YACnE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,UAAsB;IAEtB,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IACE,GAAG,CAAC,cAAc,CAAC,WAAW,KAAK,UAAU;gBAC7C,GAAG,CAAC,cAAc,CAAC,MAAM,KAAK,YAAY,EAC1C,CAAC;gBACD,yDAAyD;gBACzD,8DAA8D;gBAC9D,4DAA4D;gBAC5D,6DAA6D;gBAC7D,wCAAwC;gBACxC,OAAO;YACT,CAAC;YACD,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC;YACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YAChD,MAAM,MAAM,GACV,QAAQ,KAAK,SAAS;gBACpB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,UAAU,CAAC,QAA+B,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;YAElE,MAAM,SAAS,GACb,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;YAClE,MAAM,OAAO,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,MAAM,CAChE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAClD,CAAC;YACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,+DAA+D;YAC/D,4CAA4C;YAC5C,IAAI,QAAQ,CAAC;YACb,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc,EAAE;oBACxD,UAAU,EAAE,aAAa,CAAC,yBAAyB;oBACnD,YAAY,EAAE,eAAe,CAAC,QAAQ;oBACtC,UAAU,EAAE,SAAS;iBACtB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAC;YACzC,CAAC;YACD,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACtB,KAAK,OAAO;oBACV,OAAO;gBACT,KAAK,MAAM,CAAC;gBACZ,KAAK,WAAW;oBACd,MAAM,IAAI,YAAY,CACpB,2BAA2B,qBAAqB,cAAc;wBAC5D,4DAA4D;wBAC5D,YAAY,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B;wBAC3D,0CAA0C,EAC5C,IAAI,CAAC,eAAe,CACrB,CAAC;gBACJ,KAAK,aAAa;oBAChB,MAAM,yBAAyB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAClD,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,UAAU,GAAU,QAAQ,CAAC;oBACnC,MAAM,yBAAyB,CAC7B,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAC5D,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,yBAAyB,CAAC,KAAc;IAC/C,OAAO,aAAa,CAClB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACzD,kDAAkD,CACnD,CAAC;AACJ,CAAC"}

package/dist/pipeline/steps/helpers.d.ts

@@ -0,0 +1,38 @@
+import type { DescMessage, MessageShape } from "@bufbuild/protobuf";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { Store } from "../../store/interface.js";
+/**
+ * Finds one resource by slug, optionally narrowed to an org — Go
+ * FindResourceBySlug. Slugs are org-scoped identifiers: the same slug can
+ * exist in different orgs; an EMPTY org applies no filter (matches any
+ * org). Not-found is a normal outcome (undefined), never an error.
+ */
+export declare function findResourceBySlug<Desc extends DescMessage>(store: Store, kind: ApiResourceKind, schema: Desc, slug: string, org: string): Promise<MessageShape<Desc> | undefined>;
+/**
+ * Finds one resource by (labelKey=labelValue, org) — Go
+ * FindResourceByLabelAndOrg. Org is matched EXACTLY here, unlike the slug
+ * helper: (label, org) together form the composite uniqueness key, and
+ * treating an empty org as a wildcard would make an empty-org resource
+ * collide with matching resources in EVERY org — the cross-tenant
+ * over-matching this helper exists to prevent (metadata.org is
+ * proto-unconstrained on create, so empty is a reachable input).
+ */
+export declare function findResourceByLabelAndOrg<Desc extends DescMessage>(store: Store, kind: ApiResourceKind, schema: Desc, labelKey: string, labelValue: string, org: string): Promise<MessageShape<Desc> | undefined>;
+/**
+ * Rejects a getByReference lookup that omits org for an org-scoped kind —
+ * Go RequireOrgForReference. For AUTHORIZATION_SCOPE_TYPE_ORGANIZATION
+ * kinds a slug is unique only WITHIN an org; resolving an org-less
+ * reference globally would cross tenant boundaries. The message matches
+ * the cloud edition verbatim (cross-edition error contract).
+ *
+ * Belongs at the getByReference boundary only — the low-level slug finders
+ * are legitimately called with a relative (possibly empty) org by internal
+ * resolvers.
+ */
+export declare function requireOrgForReference(kind: ApiResourceKind, org: string): void;
+/** Go's sort.Slice comparator: newest first; nil timestamps last. */
+export declare function compareCreatedAtDesc(a: Timestamp | undefined, b: Timestamp | undefined): number;
+/** True when resourceLabels contains every filter entry (empty = all). */
+export declare function matchesAllLabels(resourceLabels: Record<string, string>, filterLabels: Record<string, string>): boolean;
+//# sourceMappingURL=helpers.d.ts.map

package/dist/pipeline/steps/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/helpers.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAKtD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,SAAS,WAAW,EAC/D,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,IAAI,EACZ,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAmBzC;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EACtE,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,IAAI,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAkBzC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,eAAe,EACrB,GAAG,EAAE,MAAM,GACV,IAAI,CAkBN;AAOD,qEAAqE;AACrE,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,SAAS,GAAG,SAAS,EACxB,CAAC,EAAE,SAAS,GAAG,SAAS,GACvB,MAAM,CAcR;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAC9B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACnC,OAAO,CAIT"}

package/dist/pipeline/steps/helpers.js

@@ -0,0 +1,122 @@
+/**
+ * Shared lookup helpers — port steps/helpers.go. Full-scan slug and label
+ * lookups, exactly Go's semantics (indexability is guaranteed at the store
+ * interface, not here — D2 §3).
+ */
+import { fromBinary } from "@bufbuild/protobuf";
+import { AuthorizationScopeType } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
+import { getKindMeta } from "../apiresource-meta.js";
+import { internalError, invalidArgumentError } from "../errors.js";
+import { metadataOf } from "./shapes.js";
+/**
+ * Finds one resource by slug, optionally narrowed to an org — Go
+ * FindResourceBySlug. Slugs are org-scoped identifiers: the same slug can
+ * exist in different orgs; an EMPTY org applies no filter (matches any
+ * org). Not-found is a normal outcome (undefined), never an error.
+ */
+export async function findResourceBySlug(store, kind, schema, slug, org) {
+    const rows = await store.listResources(kind);
+    for (const data of rows) {
+        let resource;
+        try {
+            resource = fromBinary(schema, data);
+        }
+        catch {
+            continue; // skip malformed rows, as Go does
+        }
+        const metadata = metadataOf(resource);
+        if (metadata === undefined || metadata.slug !== slug) {
+            continue;
+        }
+        if (org !== "" && metadata.org !== org) {
+            continue;
+        }
+        return resource;
+    }
+    return undefined;
+}
+/**
+ * Finds one resource by (labelKey=labelValue, org) — Go
+ * FindResourceByLabelAndOrg. Org is matched EXACTLY here, unlike the slug
+ * helper: (label, org) together form the composite uniqueness key, and
+ * treating an empty org as a wildcard would make an empty-org resource
+ * collide with matching resources in EVERY org — the cross-tenant
+ * over-matching this helper exists to prevent (metadata.org is
+ * proto-unconstrained on create, so empty is a reachable input).
+ */
+export async function findResourceByLabelAndOrg(store, kind, schema, labelKey, labelValue, org) {
+    const rows = await store.listResources(kind);
+    for (const data of rows) {
+        let resource;
+        try {
+            resource = fromBinary(schema, data);
+        }
+        catch {
+            continue;
+        }
+        const metadata = metadataOf(resource);
+        if (metadata === undefined) {
+            continue;
+        }
+        if (metadata.labels[labelKey] === labelValue && metadata.org === org) {
+            return resource;
+        }
+    }
+    return undefined;
+}
+/**
+ * Rejects a getByReference lookup that omits org for an org-scoped kind —
+ * Go RequireOrgForReference. For AUTHORIZATION_SCOPE_TYPE_ORGANIZATION
+ * kinds a slug is unique only WITHIN an org; resolving an org-less
+ * reference globally would cross tenant boundaries. The message matches
+ * the cloud edition verbatim (cross-edition error contract).
+ *
+ * Belongs at the getByReference boundary only — the low-level slug finders
+ * are legitimately called with a relative (possibly empty) org by internal
+ * resolvers.
+ */
+export function requireOrgForReference(kind, org) {
+    if (org !== "") {
+        return;
+    }
+    let scopeType;
+    let kindName;
+    try {
+        const meta = getKindMeta(kind);
+        scopeType = meta.authorization?.scopeType;
+        kindName = meta.name;
+    }
+    catch (error) {
+        throw internalError(error, "failed to resolve kind metadata for reference org check");
+    }
+    // protobuf-es strips the shared enum prefix: proto
+    // AUTHORIZATION_SCOPE_TYPE_ORGANIZATION generates as ORGANIZATION.
+    if (scopeType === AuthorizationScopeType.ORGANIZATION) {
+        throw invalidArgumentError(`org is required for ${kindName} lookup`);
+    }
+}
+// The two list-step helpers below are duplicated per package in Go (each
+// controller carries its own copy); the TS tree consolidates them here
+// because the shared-steps guideline promotes a helper on its second
+// consumer.
+/** Go's sort.Slice comparator: newest first; nil timestamps last. */
+export function compareCreatedAtDesc(a, b) {
+    if (a === undefined || b === undefined) {
+        if (a === undefined && b === undefined) {
+            return 0;
+        }
+        return a !== undefined ? -1 : 1;
+    }
+    if (a.seconds !== b.seconds) {
+        return a.seconds > b.seconds ? -1 : 1;
+    }
+    if (a.nanos !== b.nanos) {
+        return a.nanos > b.nanos ? -1 : 1;
+    }
+    return 0;
+}
+/** True when resourceLabels contains every filter entry (empty = all). */
+export function matchesAllLabels(resourceLabels, filterLabels) {
+    return Object.entries(filterLabels).every(([key, value]) => resourceLabels[key] === value);
+}
+//# sourceMappingURL=helpers.js.map

package/dist/pipeline/steps/helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../../src/pipeline/steps/helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAKhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wFAAwF,CAAC;AAGhI,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAY,EACZ,IAAqB,EACrB,MAAY,EACZ,IAAY,EACZ,GAAW;IAEX,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACH,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,kCAAkC;QAC9C,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrD,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,EAAE,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACvC,SAAS;QACX,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAY,EACZ,IAAqB,EACrB,MAAY,EACZ,QAAgB,EAChB,UAAkB,EAClB,GAAW;IAEX,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACH,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,UAAU,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACrE,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAqB,EACrB,GAAW;IAEX,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IACD,IAAI,SAA6C,CAAC;IAClD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC;QAC1C,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,yDAAyD,CAAC,CAAC;IACxF,CAAC;IACD,mDAAmD;IACnD,mEAAmE;IACnE,IAAI,SAAS,KAAK,sBAAsB,CAAC,YAAY,EAAE,CAAC;QACtD,MAAM,oBAAoB,CAAC,uBAAuB,QAAQ,SAAS,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,YAAY;AAEZ,qEAAqE;AACrE,MAAM,UAAU,oBAAoB,CAClC,CAAwB,EACxB,CAAwB;IAExB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAC9B,cAAsC,EACtC,YAAoC;IAEpC,OAAO,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,KAAK,CACvC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,KAAK,CAChD,CAAC;AACJ,CAAC"}

package/dist/pipeline/steps/index-search.d.ts

@@ -0,0 +1,23 @@
+/**
+ * IndexSearch / DeleteSearchIndex — port steps/index_search.go. Search
+ * index maintenance is BEST-EFFORT by contract: the resource is already
+ * persisted (or deleted) when these run, and the index can be rebuilt from
+ * the resources table — a failure logs a warning and never fails the
+ * pipeline. IndexSearch runs AFTER Persist; DeleteSearchIndex AFTER
+ * DeleteResource.
+ */
+import type { DescMessage } from "@bufbuild/protobuf";
+import type { Message } from "@bufbuild/protobuf";
+import type { SearchIndexEntry, Store } from "../../store/interface.js";
+import type { Logger } from "../../boot/logger.js";
+import type { PipelineStep } from "../pipeline.js";
+/**
+ * Extracts the searchable fields from a resource — Go SearchIndexExtractor.
+ * Each indexed domain registers its own extractor (undefined entry = skip).
+ */
+export interface SearchIndexExtractor {
+    getSearchIndexEntry(resource: Message): SearchIndexEntry | undefined;
+}
+export declare function newIndexSearchStep<Desc extends DescMessage>(store: Store, extractor: SearchIndexExtractor, logger: Logger): PipelineStep<Desc>;
+export declare function newDeleteSearchIndexStep<Desc extends DescMessage>(store: Store, logger: Logger): PipelineStep<Desc>;
+//# sourceMappingURL=index-search.d.ts.map

package/dist/pipeline/steps/index-search.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-search.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/index-search.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAMnD;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,GAAG,gBAAgB,GAAG,SAAS,CAAC;CACtE;AAED,wBAAgB,kBAAkB,CAAC,IAAI,SAAS,WAAW,EACzD,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,oBAAoB,EAC/B,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CA8BpB;AAED,wBAAgB,wBAAwB,CAAC,IAAI,SAAS,WAAW,EAC/D,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CAsBpB"}

package/dist/pipeline/steps/index-search.js

@@ -0,0 +1,56 @@
+import { apiResourceKindName } from "../../store/proto-fields.js";
+import { RESOURCE_ID_KEY } from "./delete.js";
+import { internalError } from "../errors.js";
+import { metadataOf } from "./shapes.js";
+export function newIndexSearchStep(store, extractor, logger) {
+    return {
+        name: "IndexSearch",
+        async execute(ctx) {
+            const resource = ctx.newState;
+            const metadata = metadataOf(resource);
+            if (metadata === undefined || metadata.id === "") {
+                logger.warn("IndexSearch: resource has no metadata or ID, skipping indexing");
+                return;
+            }
+            const entry = extractor.getSearchIndexEntry(resource);
+            if (entry === undefined) {
+                logger.warn("IndexSearch: extractor returned no entry, skipping indexing", {
+                    id: metadata.id,
+                });
+                return;
+            }
+            try {
+                await store.upsertSearchIndex(ctx.apiResourceKind, metadata.id, entry);
+            }
+            catch (error) {
+                logger.warn("IndexSearch: failed to update search index (best-effort)", {
+                    id: metadata.id,
+                    kind: apiResourceKindName(ctx.apiResourceKind),
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        },
+    };
+}
+export function newDeleteSearchIndexStep(store, logger) {
+    return {
+        name: "DeleteSearchIndex",
+        async execute(ctx) {
+            const id = ctx.get(RESOURCE_ID_KEY);
+            if (typeof id !== "string" || id === "") {
+                throw internalError(new Error("resource id not found in context (ExtractResourceId must run first)"), "delete search index ordering");
+            }
+            try {
+                await store.deleteSearchIndex(ctx.apiResourceKind, id);
+            }
+            catch (error) {
+                logger.warn("DeleteSearchIndex: failed to remove search index entry (best-effort)", {
+                    id,
+                    kind: apiResourceKindName(ctx.apiResourceKind),
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        },
+    };
+}
+//# sourceMappingURL=index-search.js.map

package/dist/pipeline/steps/index-search.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-search.js","sourceRoot":"","sources":["../../../src/pipeline/steps/index-search.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAGlE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAUzC,MAAM,UAAU,kBAAkB,CAChC,KAAY,EACZ,SAA+B,EAC/B,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC9B,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjD,MAAM,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;gBAC9E,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,SAAS,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,6DAA6D,EAAE;oBACzE,EAAE,EAAE,QAAQ,CAAC,EAAE;iBAChB,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,0DAA0D,EAAE;oBACtE,EAAE,EAAE,QAAQ,CAAC,EAAE;oBACf,IAAI,EAAE,mBAAmB,CAAC,GAAG,CAAC,eAAe,CAAC;oBAC9C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAY,EACZ,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACpC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACxC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,qEAAqE,CAAC,EAChF,8BAA8B,CAC/B,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,sEAAsE,EAAE;oBAClF,EAAE;oBACF,IAAI,EAAE,mBAAmB,CAAC,GAAG,CAAC,eAAe,CAAC;oBAC9C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/pipeline/steps/load-by-reference.d.ts

@@ -0,0 +1,12 @@
+/**
+ * LoadByReference — ports steps/load_by_reference.go. GetByReference's
+ * loader: validates the reference (kind mismatch → InvalidArgument;
+ * org-scoped kinds require an org — RequireOrgForReference), resolves by
+ * slug with optional org narrowing, stores under TargetResource.
+ */
+import type { DescMessage } from "@bufbuild/protobuf";
+import { ApiResourceReferenceSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import type { Store } from "../../store/interface.js";
+import type { PipelineStep } from "../pipeline.js";
+export declare function newLoadByReferenceStep<TargetDesc extends DescMessage>(store: Store, targetSchema: TargetDesc): PipelineStep<typeof ApiResourceReferenceSchema>;
+//# sourceMappingURL=load-by-reference.d.ts.map

package/dist/pipeline/steps/load-by-reference.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-by-reference.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/load-by-reference.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,WAAW,EAAgB,MAAM,oBAAoB,CAAC;AAEpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,sDAAsD,CAAC;AAGlG,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAItD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAKnD,wBAAgB,sBAAsB,CAAC,UAAU,SAAS,WAAW,EACnE,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,UAAU,GACvB,YAAY,CAAC,OAAO,0BAA0B,CAAC,CAgCjD"}

package/dist/pipeline/steps/load-by-reference.js

@@ -0,0 +1,29 @@
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { getKindName } from "../apiresource-meta.js";
+import { invalidArgumentError, notFoundError } from "../errors.js";
+import { apiResourceKindName } from "../../store/proto-fields.js";
+import { findResourceBySlug, requireOrgForReference } from "./helpers.js";
+import { TARGET_RESOURCE_KEY } from "./load-target.js";
+export function newLoadByReferenceStep(store, targetSchema) {
+    return {
+        name: "LoadByReference",
+        async execute(ctx) {
+            const ref = ctx.input;
+            if (ref.slug === "") {
+                throw invalidArgumentError("slug is required in reference");
+            }
+            const kind = ctx.apiResourceKind;
+            if (ref.kind !== ApiResourceKind.api_resource_kind_unknown &&
+                ref.kind !== kind) {
+                throw invalidArgumentError(`kind mismatch: expected ${apiResourceKindName(kind)}, got ${apiResourceKindName(ref.kind)}`);
+            }
+            requireOrgForReference(kind, ref.org);
+            const target = await findResourceBySlug(store, kind, targetSchema, ref.slug, ref.org);
+            if (target === undefined) {
+                throw notFoundError(getKindName(kind), ref.slug);
+            }
+            ctx.set(TARGET_RESOURCE_KEY, target);
+        },
+    };
+}
+//# sourceMappingURL=load-by-reference.js.map

package/dist/pipeline/steps/load-by-reference.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-by-reference.js","sourceRoot":"","sources":["../../../src/pipeline/steps/load-by-reference.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAGlE,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,UAAU,sBAAsB,CACpC,KAAY,EACZ,YAAwB;IAExB,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,KAAK,CAAC,OAAO,CACX,GAAsD;YAEtD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC;YACtB,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACpB,MAAM,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;YAC9D,CAAC;YAED,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,CAAC;YACjC,IACE,GAAG,CAAC,IAAI,KAAK,eAAe,CAAC,yBAAyB;gBACtD,GAAG,CAAC,IAAI,KAAK,IAAI,EACjB,CAAC;gBACD,MAAM,oBAAoB,CACxB,2BAA2B,mBAAmB,CAAC,IAAI,CAAC,SAAS,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAC7F,CAAC;YACJ,CAAC;YAED,sBAAsB,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAEtC,MAAM,MAAM,GACV,MAAM,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YACzE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACnD,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC"}