@stigmer/server 3.14.0-dev.20260910084630

package/dist/pipeline/steps/load-existing.d.ts

@@ -0,0 +1,19 @@
+/**
+ * LoadExisting — ports steps/load_existing.go. Update/Delete's loader:
+ * by id when provided (direct lookup), else by org-scoped slug (the
+ * fallback populates the id back into metadata so merge/persist have it).
+ * NotFound FAILS here — apply's tolerant probe is LoadForApply.
+ *
+ * Deliberate divergence from the Go source (ratified 2026-08-26): Go
+ * mapped ANY store error to NotFound. Here only the typed
+ * ResourceNotFoundError is NotFound; other store failures rethrow to the
+ * executor's sanitized Internal (see pipeline.ts and load-target.ts —
+ * the same narrowing, applied at every store-read site).
+ */
+import type { DescMessage } from "@bufbuild/protobuf";
+import type { Store } from "../../store/interface.js";
+import type { PipelineStep } from "../pipeline.js";
+/** Context key for the loaded resource (Go ExistingResourceKey). */
+export declare const EXISTING_RESOURCE_KEY = "existingResource";
+export declare function newLoadExistingStep<Desc extends DescMessage>(store: Store): PipelineStep<Desc>;
+//# sourceMappingURL=load-existing.d.ts.map

package/dist/pipeline/steps/load-existing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-existing.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/load-existing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,WAAW,EAAgB,MAAM,oBAAoB,CAAC;AAGpE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAGtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAKnD,oEAAoE;AACpE,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD,wBAAgB,mBAAmB,CAAC,IAAI,SAAS,WAAW,EAC1D,KAAK,EAAE,KAAK,GACX,YAAY,CAAC,IAAI,CAAC,CA4CpB"}

package/dist/pipeline/steps/load-existing.js

@@ -0,0 +1,44 @@
+import { ResourceNotFoundError } from "../../store/interface.js";
+import { getKindName } from "../apiresource-meta.js";
+import { internalError, invalidArgumentError, notFoundError } from "../errors.js";
+import { findResourceBySlug } from "./helpers.js";
+import { metadataOf } from "./shapes.js";
+/** Context key for the loaded resource (Go ExistingResourceKey). */
+export const EXISTING_RESOURCE_KEY = "existingResource";
+export function newLoadExistingStep(store) {
+    return {
+        name: "LoadExisting",
+        async execute(ctx) {
+            const metadata = metadataOf(ctx.newState);
+            if (metadata === undefined) {
+                throw internalError(new Error("resource metadata is nil"), "load existing");
+            }
+            let existing;
+            if (metadata.id !== "") {
+                try {
+                    existing = await store.getResource(ctx.apiResourceKind, metadata.id, ctx.schema);
+                }
+                catch (error) {
+                    if (error instanceof ResourceNotFoundError) {
+                        throw notFoundError(getKindName(ctx.apiResourceKind), metadata.id);
+                    }
+                    throw error;
+                }
+            }
+            else if (metadata.slug !== "") {
+                const found = await findResourceBySlug(store, ctx.apiResourceKind, ctx.schema, metadata.slug, metadata.org);
+                if (found === undefined) {
+                    throw notFoundError(getKindName(ctx.apiResourceKind), metadata.slug);
+                }
+                existing = found;
+                // Populate the id so merge and persist have it.
+                metadata.id = metadataOf(existing)?.id ?? "";
+            }
+            else {
+                throw invalidArgumentError("resource id or slug is required for update");
+            }
+            ctx.set(EXISTING_RESOURCE_KEY, existing);
+        },
+    };
+}
+//# sourceMappingURL=load-existing.js.map

package/dist/pipeline/steps/load-existing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-existing.js","sourceRoot":"","sources":["../../../src/pipeline/steps/load-existing.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGlF,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAExD,MAAM,UAAU,mBAAmB,CACjC,KAAY;IAEZ,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,EAAE,eAAe,CAAC,CAAC;YAC9E,CAAC;YAED,IAAI,QAA4B,CAAC;YACjC,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAChC,GAAG,CAAC,eAAe,EACnB,QAAQ,CAAC,EAAE,EACX,GAAG,CAAC,MAAM,CACX,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;wBAC3C,MAAM,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;oBACrE,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;iBAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBAChC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,KAAK,EACL,GAAG,CAAC,eAAe,EACnB,GAAG,CAAC,MAAM,EACV,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,GAAG,CACb,CAAC;gBACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,MAAM,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACvE,CAAC;gBACD,QAAQ,GAAG,KAAK,CAAC;gBACjB,gDAAgD;gBAChD,QAAQ,CAAC,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;YAC/C,CAAC;iBAAM,CAAC;gBACN,MAAM,oBAAoB,CAAC,4CAA4C,CAAC,CAAC;YAC3E,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/pipeline/steps/load-for-apply.d.ts

@@ -0,0 +1,21 @@
+import type { DescMessage, MessageShape } from "@bufbuild/protobuf";
+import type { Store } from "../../store/interface.js";
+import type { PipelineStep } from "../pipeline.js";
+import type { RequestContext } from "../request-context.js";
+/** Context keys (Go ExistsInDatabaseKey / ShouldCreateKey). */
+export declare const EXISTS_IN_DATABASE_KEY = "existsInDatabase";
+export declare const SHOULD_CREATE_KEY = "shouldCreate";
+export declare function newLoadForApplyStep<Desc extends DescMessage>(store: Store): PipelineStep<Desc>;
+/**
+ * The apply update-arm delegation message: the ORIGINAL request (the Go
+ * pin — never the pipeline's mutated clone) with ONLY the resolved id
+ * copied on. Apply requests identify by name+org, not id, so without
+ * this the delegated update chain's Authorize step checks an EMPTY
+ * resource id — the permissive OSS default never noticed, but a real
+ * Authorizer (the cloud edition) must check the true target, exactly as
+ * the Java edition's post-load authorize order does (C2, 20260827.10).
+ * OSS wire behavior is unchanged: the update chain re-resolves and
+ * loads by slug regardless, and the rosters pin the byte-identity.
+ */
+export declare function withResolvedApplyId<Desc extends DescMessage>(schema: Desc, original: MessageShape<Desc>, resolved: RequestContext<Desc>): MessageShape<Desc>;
+//# sourceMappingURL=load-for-apply.d.ts.map

package/dist/pipeline/steps/load-for-apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-for-apply.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/load-for-apply.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEpE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAK5D,+DAA+D;AAC/D,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AACzD,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,wBAAgB,mBAAmB,CAAC,IAAI,SAAS,WAAW,EAC1D,KAAK,EAAE,KAAK,GACX,YAAY,CAAC,IAAI,CAAC,CAkCpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,SAAS,WAAW,EAC1D,MAAM,EAAE,IAAI,EACZ,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,EAC5B,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,GAC7B,YAAY,CAAC,IAAI,CAAC,CAQpB"}

package/dist/pipeline/steps/load-for-apply.js

@@ -0,0 +1,60 @@
+/**
+ * LoadForApply — ports steps/load_for_apply.go. Apply's existence probe:
+ * NEVER fails on not-found — it sets the ShouldCreate/ExistsInDatabase
+ * flags the controller branches on (create vs update), and populates the
+ * id when the resource exists.
+ */
+import { clone } from "@bufbuild/protobuf";
+import { findResourceBySlug } from "./helpers.js";
+import { EXISTING_RESOURCE_KEY } from "./load-existing.js";
+import { metadataOf } from "./shapes.js";
+/** Context keys (Go ExistsInDatabaseKey / ShouldCreateKey). */
+export const EXISTS_IN_DATABASE_KEY = "existsInDatabase";
+export const SHOULD_CREATE_KEY = "shouldCreate";
+export function newLoadForApplyStep(store) {
+    return {
+        name: "LoadForApply",
+        async execute(ctx) {
+            const metadata = metadataOf(ctx.newState);
+            // No metadata or no slug (ResolveSlug should have run) → create.
+            if (metadata === undefined || metadata.slug === "") {
+                ctx.set(EXISTS_IN_DATABASE_KEY, false);
+                ctx.set(SHOULD_CREATE_KEY, true);
+                return;
+            }
+            const existing = await findResourceBySlug(store, ctx.apiResourceKind, ctx.schema, metadata.slug, metadata.org);
+            if (existing === undefined) {
+                ctx.set(EXISTS_IN_DATABASE_KEY, false);
+                ctx.set(SHOULD_CREATE_KEY, true);
+                return;
+            }
+            ctx.set(EXISTING_RESOURCE_KEY, existing);
+            ctx.set(EXISTS_IN_DATABASE_KEY, true);
+            ctx.set(SHOULD_CREATE_KEY, false);
+            if (metadata.id === "") {
+                metadata.id = metadataOf(existing)?.id ?? "";
+            }
+        },
+    };
+}
+/**
+ * The apply update-arm delegation message: the ORIGINAL request (the Go
+ * pin — never the pipeline's mutated clone) with ONLY the resolved id
+ * copied on. Apply requests identify by name+org, not id, so without
+ * this the delegated update chain's Authorize step checks an EMPTY
+ * resource id — the permissive OSS default never noticed, but a real
+ * Authorizer (the cloud edition) must check the true target, exactly as
+ * the Java edition's post-load authorize order does (C2, 20260827.10).
+ * OSS wire behavior is unchanged: the update chain re-resolves and
+ * loads by slug regardless, and the rosters pin the byte-identity.
+ */
+export function withResolvedApplyId(schema, original, resolved) {
+    const enriched = clone(schema, original);
+    const metadata = metadataOf(enriched);
+    const resolvedId = metadataOf(resolved.newState)?.id ?? "";
+    if (metadata !== undefined && metadata.id === "" && resolvedId !== "") {
+        metadata.id = resolvedId;
+    }
+    return enriched;
+}
+//# sourceMappingURL=load-for-apply.js.map

package/dist/pipeline/steps/load-for-apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-for-apply.js","sourceRoot":"","sources":["../../../src/pipeline/steps/load-for-apply.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAM3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;AACzD,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEhD,MAAM,UAAU,mBAAmB,CACjC,KAAY;IAEZ,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,iEAAiE;YACjE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACnD,GAAG,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;gBACvC,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;gBACjC,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACvC,KAAK,EACL,GAAG,CAAC,eAAe,EACnB,GAAG,CAAC,MAAM,EACV,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,GAAG,CACb,CAAC;YAEF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,GAAG,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;gBACvC,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;gBACjC,OAAO;YACT,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;YACzC,GAAG,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;YACtC,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;YAClC,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACvB,QAAQ,CAAC,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAY,EACZ,QAA4B,EAC5B,QAA8B;IAE9B,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;IAC3D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACtE,QAAQ,CAAC,EAAE,GAAG,UAAU,CAAC;IAC3B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/pipeline/steps/load-target.d.ts

@@ -0,0 +1,20 @@
+/**
+ * LoadTarget — ports steps/load_target.go. Get's loader for ID-wrapper
+ * inputs (OrganizationId, AgentId, …): loads by id into the
+ * TargetResource context key; NotFound when absent.
+ *
+ * Deliberate divergence from the Go source (ratified 2026-08-26): Go
+ * mapped ANY store error to NotFound — a locked file or corrupted page
+ * presented as a missing resource, inviting clients to discard real
+ * state. Here only the store's typed ResourceNotFoundError is NotFound;
+ * anything else rethrows, and the pipeline executor answers a sanitized
+ * Internal (see pipeline.ts). The idiom applies at every store-read site
+ * (guidelines §Errors).
+ */
+import type { DescMessage } from "@bufbuild/protobuf";
+import type { Store } from "../../store/interface.js";
+import type { PipelineStep } from "../pipeline.js";
+/** Context key for the loaded target (Go TargetResourceKey). */
+export declare const TARGET_RESOURCE_KEY = "targetResource";
+export declare function newLoadTargetStep<InputDesc extends DescMessage, TargetDesc extends DescMessage>(store: Store, targetSchema: TargetDesc): PipelineStep<InputDesc>;
+//# sourceMappingURL=load-target.d.ts.map

package/dist/pipeline/steps/load-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-target.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/load-target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,WAAW,EAAgB,MAAM,oBAAoB,CAAC;AAGpE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAGtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAInD,gEAAgE;AAChE,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,wBAAgB,iBAAiB,CAC/B,SAAS,SAAS,WAAW,EAC7B,UAAU,SAAS,WAAW,EAC9B,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,GAAG,YAAY,CAAC,SAAS,CAAC,CA0BjE"}

package/dist/pipeline/steps/load-target.js

@@ -0,0 +1,29 @@
+import { ResourceNotFoundError } from "../../store/interface.js";
+import { getKindName } from "../apiresource-meta.js";
+import { invalidArgumentError, notFoundError } from "../errors.js";
+import { idValueOf } from "./shapes.js";
+/** Context key for the loaded target (Go TargetResourceKey). */
+export const TARGET_RESOURCE_KEY = "targetResource";
+export function newLoadTargetStep(store, targetSchema) {
+    return {
+        name: "LoadTarget",
+        async execute(ctx) {
+            const resourceId = idValueOf(ctx.input);
+            if (resourceId === "") {
+                throw invalidArgumentError("resource id is required");
+            }
+            let target;
+            try {
+                target = await store.getResource(ctx.apiResourceKind, resourceId, targetSchema);
+            }
+            catch (error) {
+                if (error instanceof ResourceNotFoundError) {
+                    throw notFoundError(getKindName(ctx.apiResourceKind), resourceId);
+                }
+                throw error;
+            }
+            ctx.set(TARGET_RESOURCE_KEY, target);
+        },
+    };
+}
+//# sourceMappingURL=load-target.js.map

package/dist/pipeline/steps/load-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-target.js","sourceRoot":"","sources":["../../../src/pipeline/steps/load-target.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGnE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,gEAAgE;AAChE,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAEpD,MAAM,UAAU,iBAAiB,CAG/B,KAAY,EAAE,YAAwB;IACtC,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,KAAK,CAAC,OAAO,CAAC,GAA8B;YAC1C,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;gBACtB,MAAM,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;YACxD,CAAC;YAED,IAAI,MAAgC,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAC9B,GAAG,CAAC,eAAe,EACnB,UAAU,EACV,YAAY,CACb,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,MAAM,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/pipeline/steps/persist.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Persist — ports steps/persist.go: saves newState through the store
+ * (metadata.id must be set by an earlier step).
+ */
+import type { DescMessage } from "@bufbuild/protobuf";
+import type { Store } from "../../store/interface.js";
+import type { PipelineStep } from "../pipeline.js";
+export declare function newPersistStep<Desc extends DescMessage>(store: Store): PipelineStep<Desc>;
+//# sourceMappingURL=persist.d.ts.map

package/dist/pipeline/steps/persist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"persist.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/persist.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAInD,wBAAgB,cAAc,CAAC,IAAI,SAAS,WAAW,EACrD,KAAK,EAAE,KAAK,GACX,YAAY,CAAC,IAAI,CAAC,CA0BpB"}

package/dist/pipeline/steps/persist.js

@@ -0,0 +1,23 @@
+import { internalError } from "../errors.js";
+import { metadataOf } from "./shapes.js";
+export function newPersistStep(store) {
+    return {
+        name: "Persist",
+        async execute(ctx) {
+            const metadata = metadataOf(ctx.newState);
+            if (metadata === undefined) {
+                throw internalError(new Error("resource metadata is nil"), "persist");
+            }
+            if (metadata.id === "") {
+                throw internalError(new Error("resource ID is empty, cannot persist"), "persist");
+            }
+            try {
+                await store.saveResource(ctx.apiResourceKind, metadata.id, ctx.schema, ctx.newState);
+            }
+            catch (error) {
+                throw internalError(error, "failed to save resource to store");
+            }
+        },
+    };
+}
+//# sourceMappingURL=persist.js.map

package/dist/pipeline/steps/persist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persist.js","sourceRoot":"","sources":["../../../src/pipeline/steps/persist.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,cAAc,CAC5B,KAAY;IAEZ,OAAO;QACL,IAAI,EAAE,SAAS;QACf,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,EAAE,SAAS,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACvB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,sCAAsC,CAAC,EACjD,SAAS,CACV,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,YAAY,CACtB,GAAG,CAAC,eAAe,EACnB,QAAQ,CAAC,EAAE,EACX,GAAG,CAAC,MAAM,EACV,GAAG,CAAC,QAAQ,CACb,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,kCAAkC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/pipeline/steps/references.d.ts

@@ -0,0 +1,22 @@
+/**
+ * NormalizeReferences + ValidateReferences — port
+ * steps/normalize_references.go and steps/validate_references.go, sharing
+ * one spec walker (as the Go files share theirs).
+ *
+ * NormalizeReferences fills EMPTY org fields in ApiResourceReference
+ * messages inside the spec from the resource's own metadata.org, so stored
+ * references are absolute; explicit orgs (cross-org refs) are preserved.
+ * Only the spec is walked — status is system-generated and already
+ * absolute. Runs after BuildNewState/BuildUpdateState, before Persist.
+ *
+ * ValidateReferences verifies spec references point at existing resources
+ * — strict FAILED_PRECONDITION for missing MCP servers (an agent whose MCP
+ * server is missing cannot execute its declared tools). Runs AFTER
+ * NormalizeReferences so orgs are resolved.
+ */
+import type { DescMessage } from "@bufbuild/protobuf";
+import type { Store } from "../../store/interface.js";
+import type { PipelineStep } from "../pipeline.js";
+export declare function newNormalizeReferencesStep<Desc extends DescMessage>(): PipelineStep<Desc>;
+export declare function newValidateReferencesStep<Desc extends DescMessage>(store: Store): PipelineStep<Desc>;
+//# sourceMappingURL=references.d.ts.map

package/dist/pipeline/steps/references.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"references.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/references.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAOtD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAQnD,wBAAgB,0BAA0B,CAAC,IAAI,SAAS,WAAW,KAAK,YAAY,CAAC,IAAI,CAAC,CAqBzF;AAED,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,KAAK,EAAE,KAAK,GACX,YAAY,CAAC,IAAI,CAAC,CA0CpB"}

package/dist/pipeline/steps/references.js

@@ -0,0 +1,128 @@
+import { reflect } from "@bufbuild/protobuf/reflect";
+import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { failedPreconditionError, internalError } from "../errors.js";
+import { findResourceBySlug } from "./helpers.js";
+import { messageFieldByName, metadataOf } from "./shapes.js";
+const API_RESOURCE_REFERENCE_TYPE = "ai.stigmer.commons.apiresource.ApiResourceReference";
+export function newNormalizeReferencesStep() {
+    return {
+        name: "NormalizeReferences",
+        execute(ctx) {
+            const metadata = metadataOf(ctx.newState);
+            if (metadata === undefined) {
+                throw internalError(new Error("resource metadata is nil"), "normalize references");
+            }
+            // No org to resolve from — skip silently; required-org validation is
+            // the validation step's responsibility, not this one's.
+            if (metadata.org === "") {
+                return;
+            }
+            forEachSpecReference(ctx.schema, ctx.newState, (ref) => {
+                const orgField = ref.fields.find((f) => f.name === "org");
+                if (orgField !== undefined && ref.get(orgField) === "") {
+                    ref.set(orgField, metadata.org);
+                }
+            });
+        },
+    };
+}
+export function newValidateReferencesStep(store) {
+    return {
+        name: "ValidateReferences",
+        async execute(ctx) {
+            const refs = [];
+            forEachSpecReference(ctx.schema, ctx.newState, (ref) => {
+                refs.push({
+                    kind: numberField(ref, "kind"),
+                    slug: stringField(ref, "slug"),
+                    org: stringField(ref, "org"),
+                });
+            });
+            const missingMcpServers = [];
+            for (const ref of refs) {
+                if (ref.slug === "") {
+                    continue;
+                }
+                // Per-kind validation, exactly Go's switch: only mcp_server today.
+                if (ref.kind === ApiResourceKind.mcp_server) {
+                    const found = await findResourceBySlug(store, ApiResourceKind.mcp_server, McpServerSchema, ref.slug, ref.org);
+                    if (found === undefined) {
+                        missingMcpServers.push(`'${ref.slug}' (org: ${ref.org})`);
+                    }
+                }
+            }
+            if (missingMcpServers.length > 0) {
+                throw failedPreconditionError(`referenced MCP server(s) not found: ${missingMcpServers.join(", ")}. ` +
+                    "Verify the slug and org are correct. " +
+                    "Use 'stigmer get mcp-servers' to list available MCP servers.");
+            }
+        },
+    };
+}
+/**
+ * Walks the resource's spec and invokes fn on every ApiResourceReference
+ * (singular, repeated, and map-valued message fields, recursively) —
+ * the shared traversal behind both steps (Go walkAndResolveOrg /
+ * walkAndCollectRefs). Mutations through the ReflectMessage write through.
+ */
+function forEachSpecReference(schema, msg, fn) {
+    const root = reflect(schema, msg);
+    const specField = messageFieldByName(root, "spec");
+    if (specField === undefined || !root.isSet(specField)) {
+        return;
+    }
+    walk(root.get(specField), fn);
+}
+function walk(msg, fn) {
+    for (const field of msg.fields) {
+        if (field.fieldKind === "list") {
+            if (field.listKind !== "message") {
+                continue;
+            }
+            for (const item of msg.get(field)) {
+                visit(item, fn);
+            }
+        }
+        else if (field.fieldKind === "map") {
+            if (field.mapKind !== "message") {
+                continue;
+            }
+            const map = msg.get(field);
+            for (const [, value] of map) {
+                visit(value, fn);
+            }
+        }
+        else if (field.fieldKind === "message") {
+            if (!msg.isSet(field)) {
+                continue;
+            }
+            visit(msg.get(field), fn);
+        }
+    }
+}
+function visit(sub, fn) {
+    if (sub.desc.typeName === API_RESOURCE_REFERENCE_TYPE) {
+        fn(sub);
+    }
+    else {
+        walk(sub, fn);
+    }
+}
+function stringField(msg, name) {
+    const field = msg.fields.find((f) => f.name === name);
+    if (field === undefined) {
+        return "";
+    }
+    const value = msg.get(field);
+    return typeof value === "string" ? value : "";
+}
+function numberField(msg, name) {
+    const field = msg.fields.find((f) => f.name === name);
+    if (field === undefined) {
+        return 0;
+    }
+    const value = msg.get(field);
+    return typeof value === "number" ? value : 0;
+}
+//# sourceMappingURL=references.js.map

package/dist/pipeline/steps/references.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"references.js","sourceRoot":"","sources":["../../../src/pipeline/steps/references.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAGrD,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE7D,MAAM,2BAA2B,GAC/B,qDAAqD,CAAC;AAExD,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,OAAO,CAAC,GAAyB;YAC/B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,EAAE,sBAAsB,CAAC,CAAC;YACrF,CAAC;YACD,qEAAqE;YACrE,wDAAwD;YACxD,IAAI,QAAQ,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;gBACrD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;gBAC1D,IAAI,QAAQ,KAAK,SAAS,IAAK,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAY,KAAK,EAAE,EAAE,CAAC;oBACnE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAY;IAEZ,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,IAAI,GAAuD,EAAE,CAAC;YACpE,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;gBACrD,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC;oBAC9B,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC;oBAC9B,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC;iBAC7B,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,MAAM,iBAAiB,GAAa,EAAE,CAAC;YACvC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;oBACpB,SAAS;gBACX,CAAC;gBACD,mEAAmE;gBACnE,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,CAAC,UAAU,EAAE,CAAC;oBAC5C,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,KAAK,EACL,eAAe,CAAC,UAAU,EAC1B,eAAe,EACf,GAAG,CAAC,IAAI,EACR,GAAG,CAAC,GAAG,CACR,CAAC;oBACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACxB,iBAAiB,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,WAAW,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;oBAC5D,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,uBAAuB,CAC3B,uCAAuC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBACrE,uCAAuC;oBACvC,8DAA8D,CACjE,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,MAAmB,EACnB,GAAkC,EAClC,EAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACtD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,EAAiC;IAClE,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YAC/B,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACjC,SAAS;YACX,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,KAAK,CAAC,IAAsB,EAAE,EAAE,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YACrC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAChC,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC;gBAC5B,KAAK,CAAC,KAAuB,EAAE,EAAE,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,GAAmB,EAAE,EAAiC;IACnE,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,2BAA2B,EAAE,CAAC;QACtD,EAAE,CAAC,GAAG,CAAC,CAAC;IACV,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAmB,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,GAAmB,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC"}

package/dist/pipeline/steps/secret-cleanup.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Secret backing-state cleanup — the OSS half of the Java
+ * SecretValueCleanup contract (secrets-vault migration; wired here by
+ * convergence 20260830.04 Stage 3, gate ruling Q7). When a resource
+ * carrying sealed secrets is deleted — or a secret-bearing key is
+ * dropped by an update — the stored ciphertext's EXTERNAL backing state
+ * must be destroyed: for enc:v3 values that is a KV entry in the vault;
+ * for enc:v1/v2 values (the ciphertext IS the stored value), plaintext,
+ * and the ***REDACTED*** marker, SecretService.delete is a no-op by
+ * construction. Under the OSS default codec set (v1 only) this module
+ * therefore never changes observable behavior — the conformance rosters
+ * pin that.
+ *
+ * Failure semantics (Java parity; the CleanupIamPolicies discipline):
+ * best-effort, AFTER the store write. The row is already gone or
+ * updated, so a destroy failure must never fail the request — each
+ * failure logs ERROR with the resource identity and the pass continues.
+ * The cloud edition additionally counts sweep-side destroy failures
+ * (stigmer.encryption.cleanup.failures); the OSS delete sites log only
+ * (Stage-3 gate ruling G4 — an accepted, disclosed divergence that is
+ * moot until a composition writes enc:v3).
+ */
+import type { DescMessage, MessageShape } from "@bufbuild/protobuf";
+import type { Logger } from "../../boot/logger.js";
+import type { SecretService } from "../../encryption/encryption.js";
+import type { PipelineStep } from "../pipeline.js";
+/**
+ * Destroys the external backing state of each stored secret value,
+ * best-effort: one failure logs ERROR (with the caller's identifying
+ * fields) and never interrupts the rest. Blank values are skipped — the
+ * facade would no-op them anyway, and skipping keeps the logs honest.
+ *
+ * Exported for the write-boundary steps that must capture their old
+ * values before mutating (environment removeVariables) and for the
+ * domain steps that destroy on a key diff rather than a delete.
+ */
+export declare function destroySecretBackingState(secretService: SecretService, logger: Logger, fields: Record<string, unknown>, storedValues: readonly string[]): Promise<void>;
+/**
+ * DestroySecretBackingState — after the store delete in every delete
+ * chain whose kind carries sealed secrets (environment, oauthapp,
+ * channelapp; the OAuth-managed environment lane rides the environment
+ * chain through the in-process client). Reads the doomed resource from
+ * EXISTING_RESOURCE_KEY (seeded by LoadExistingForDelete); the
+ * per-domain extractor names which spec fields hold sealed values.
+ */
+export declare function newDestroySecretBackingStateStep<InputDesc extends DescMessage, ResourceDesc extends DescMessage>(secretService: SecretService, logger: Logger, extractSecretValues: (resource: MessageShape<ResourceDesc>) => readonly string[]): PipelineStep<InputDesc>;
+//# sourceMappingURL=secret-cleanup.d.ts.map

package/dist/pipeline/steps/secret-cleanup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-cleanup.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/secret-cleanup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAEpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAKnD;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,OAAO,CAAC,IAAI,CAAC,CAoBf;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAC9C,SAAS,SAAS,WAAW,EAC7B,YAAY,SAAS,WAAW,EAEhC,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,MAAM,EACd,mBAAmB,EAAE,CACnB,QAAQ,EAAE,YAAY,CAAC,YAAY,CAAC,KACjC,SAAS,MAAM,EAAE,GACrB,YAAY,CAAC,SAAS,CAAC,CAsBzB"}

package/dist/pipeline/steps/secret-cleanup.js

@@ -0,0 +1,56 @@
+import { getKindName } from "../apiresource-meta.js";
+import { EXISTING_RESOURCE_KEY } from "./load-existing.js";
+/**
+ * Destroys the external backing state of each stored secret value,
+ * best-effort: one failure logs ERROR (with the caller's identifying
+ * fields) and never interrupts the rest. Blank values are skipped — the
+ * facade would no-op them anyway, and skipping keeps the logs honest.
+ *
+ * Exported for the write-boundary steps that must capture their old
+ * values before mutating (environment removeVariables) and for the
+ * domain steps that destroy on a key diff rather than a delete.
+ */
+export async function destroySecretBackingState(secretService, logger, fields, storedValues) {
+    for (const storedValue of storedValues) {
+        if (storedValue === "") {
+            continue;
+        }
+        try {
+            await secretService.delete(storedValue);
+        }
+        catch (error) {
+            // The DB write already succeeded — an orphaned external entry is
+            // the recoverable outcome (the vault retains it; the convergence
+            // sweep's census keeps it visible). Never the request's failure.
+            logger.error("secret backing-state destruction failed after persist — external state may be orphaned", {
+                ...fields,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+}
+/**
+ * DestroySecretBackingState — after the store delete in every delete
+ * chain whose kind carries sealed secrets (environment, oauthapp,
+ * channelapp; the OAuth-managed environment lane rides the environment
+ * chain through the in-process client). Reads the doomed resource from
+ * EXISTING_RESOURCE_KEY (seeded by LoadExistingForDelete); the
+ * per-domain extractor names which spec fields hold sealed values.
+ */
+export function newDestroySecretBackingStateStep(secretService, logger, extractSecretValues) {
+    return {
+        name: "DestroySecretBackingState",
+        async execute(ctx) {
+            const deleted = ctx.get(EXISTING_RESOURCE_KEY);
+            if (deleted === undefined) {
+                return;
+            }
+            const metadata = deleted.metadata;
+            await destroySecretBackingState(secretService, logger, {
+                kind: getKindName(ctx.apiResourceKind),
+                resourceId: metadata?.id ?? "",
+            }, extractSecretValues(deleted));
+        },
+    };
+}
+//# sourceMappingURL=secret-cleanup.js.map

package/dist/pipeline/steps/secret-cleanup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-cleanup.js","sourceRoot":"","sources":["../../../src/pipeline/steps/secret-cleanup.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAGrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAG3D;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,aAA4B,EAC5B,MAAc,EACd,MAA+B,EAC/B,YAA+B;IAE/B,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,iEAAiE;YACjE,iEAAiE;YACjE,iEAAiE;YACjE,MAAM,CAAC,KAAK,CACV,wFAAwF,EACxF;gBACE,GAAG,MAAM;gBACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CACF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gCAAgC,CAI9C,aAA4B,EAC5B,MAAc,EACd,mBAEsB;IAEtB,OAAO;QACL,IAAI,EAAE,2BAA2B;QACjC,KAAK,CAAC,OAAO,CAAC,GAA8B;YAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAEhC,CAAC;YACd,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAI,OAAuC,CAAC,QAAQ,CAAC;YACnE,MAAM,yBAAyB,CAC7B,aAAa,EACb,MAAM,EACN;gBACE,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC;gBACtC,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE;aAC/B,EACD,mBAAmB,CAAC,OAAO,CAAC,CAC7B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/pipeline/steps/server-stamped-reserved-labels.d.ts

@@ -0,0 +1,36 @@
+/**
+ * ServerStampedReservedLabels — the per-request record of reserved
+ * `stigmer.ai/*` label keys that pipeline steps vouched for server-side
+ * (the Java ServerStampedReservedLabels port, cloud#386; parity entry
+ * 20260830.05).
+ *
+ * Some lanes legitimately carry reserved labels the client "sent": the
+ * workflow runner's CallAgent activity stamps the lineage pair
+ * (`stigmer.ai/workflow-execution-id`, `stigmer.ai/workflow-task`) on
+ * every child execution it creates. To GuardReservedLabels, which diffs
+ * the built state against the stored one, those stamps are
+ * indistinguishable from client mutations. A step that has made the
+ * trust decision for specific keys records EXACTLY those keys here, and
+ * the guard exempts exactly them — everything else in the namespace
+ * stays operator-only, so a client smuggling a different reserved key
+ * into the same request is still rejected.
+ *
+ * The record lives in the request context's metadata map: only server
+ * code can reach it, and it never survives the request (the same
+ * request-scoped posture as Java's gRPC Context key).
+ */
+import type { DescMessage } from "@bufbuild/protobuf";
+import type { RequestContext } from "../request-context.js";
+/**
+ * Records reserved label keys the calling step vouched for on this
+ * request. Call immediately next to the decision that vouches them, so
+ * the record and the decision cannot drift apart.
+ */
+export declare function recordServerStampedReservedLabels<Desc extends DescMessage>(ctx: RequestContext<Desc>, ...keys: ReadonlyArray<string>): void;
+/**
+ * The reserved label keys server-side steps vouched for on this request
+ * so far — GuardReservedLabels' exemption set. Empty when nothing was
+ * recorded (an empty answer only narrows what passes).
+ */
+export declare function serverStampedReservedLabels<Desc extends DescMessage>(ctx: RequestContext<Desc>): ReadonlySet<string>;
+//# sourceMappingURL=server-stamped-reserved-labels.d.ts.map

package/dist/pipeline/steps/server-stamped-reserved-labels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-stamped-reserved-labels.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/server-stamped-reserved-labels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAK5D;;;;GAIG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,SAAS,WAAW,EACxE,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,EACzB,GAAG,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAC7B,IAAI,CAON;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,SAAS,WAAW,EAClE,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,GACxB,WAAW,CAAC,MAAM,CAAC,CAGrB"}

package/dist/pipeline/steps/server-stamped-reserved-labels.js

@@ -0,0 +1,25 @@
+/** The context-metadata key carrying the vouched key set. */
+const STAMPED_KEYS_CONTEXT_KEY = "serverStampedReservedLabels";
+/**
+ * Records reserved label keys the calling step vouched for on this
+ * request. Call immediately next to the decision that vouches them, so
+ * the record and the decision cannot drift apart.
+ */
+export function recordServerStampedReservedLabels(ctx, ...keys) {
+    const existing = ctx.get(STAMPED_KEYS_CONTEXT_KEY);
+    const stamped = existing instanceof Set ? existing : new Set();
+    for (const key of keys) {
+        stamped.add(key);
+    }
+    ctx.set(STAMPED_KEYS_CONTEXT_KEY, stamped);
+}
+/**
+ * The reserved label keys server-side steps vouched for on this request
+ * so far — GuardReservedLabels' exemption set. Empty when nothing was
+ * recorded (an empty answer only narrows what passes).
+ */
+export function serverStampedReservedLabels(ctx) {
+    const stamped = ctx.get(STAMPED_KEYS_CONTEXT_KEY);
+    return stamped instanceof Set ? stamped : new Set();
+}
+//# sourceMappingURL=server-stamped-reserved-labels.js.map

package/dist/pipeline/steps/server-stamped-reserved-labels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-stamped-reserved-labels.js","sourceRoot":"","sources":["../../../src/pipeline/steps/server-stamped-reserved-labels.ts"],"names":[],"mappings":"AAyBA,6DAA6D;AAC7D,MAAM,wBAAwB,GAAG,6BAA6B,CAAC;AAE/D;;;;GAIG;AACH,MAAM,UAAU,iCAAiC,CAC/C,GAAyB,EACzB,GAAG,IAA2B;IAE9B,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,QAAQ,YAAY,GAAG,CAAC,CAAC,CAAE,QAAwB,CAAC,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC;IACxF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,GAAyB;IAEzB,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAClD,OAAO,OAAO,YAAY,GAAG,CAAC,CAAC,CAAE,OAAuB,CAAC,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC;AAC/E,CAAC"}