@stigmer/server 3.15.2-dev.20260913223433 → 3.15.3-dev.20260914100347

package/dist/pipeline/steps/authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/pipeline/steps/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,MAAM,IAAI,sBAAsB,EAChC,SAAS,EACT,qBAAqB,GACtB,MAAM,0DAA0D,CAAC;AAQlE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAI5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAC5C,4CAA4C,CAAC;AAE/C,uEAAuE;AACvE,MAAM,CAAC,MAAM,qCAAqC,GAAG,mBAAmB,CAAC;AAEzE;;;;;;GAMG;AACH,MAAM,UAAU,iCAAiC;IAC/C,OAAO;QACL,SAAS;YACP,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAkB,EAClB,UAAsB;IAEtB,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,OAAO,CAAC,GAAyB;YAC/B,OAAO,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC;AAYD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAkB,EAClB,UAAsB,EACtB,QAAwB,EACxB,KAAc,EACd,QAAkC;IAElC,IAAI,QAAQ,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACxC,OAAO;IACT,CAAC;IACD,IACE,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC;QAC5B,SAAS,CAAC,MAAM,EAAE,qBAAqB,CAAC,EACxC,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAEzD,OAAO,yBAAyB,CAC9B,UAAU,EACV,QAAQ,EACR;QACE,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC;QAChD,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC;KACrE,EACD,MAAM,CAAC,QAAQ,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,UAAsB,EACtB,QAAwB,EACxB,KAAiB,EACjB,QAAgB;IAEhB,IAAI,QAAQ,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACxC,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClE,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO;QACT,KAAK,MAAM;YACT,MAAM,IAAI,YAAY,CACpB,QAAQ,KAAK,EAAE;gBACb,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,EAAE;oBACtB,CAAC,CAAC,QAAQ,CAAC,MAAM;oBACjB,CAAC,CAAC,qCAAqC,EAC3C,IAAI,CAAC,gBAAgB,CACtB,CAAC;QACJ,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,+DAA+D;YAC/D,6DAA6D;YAC7D,gDAAgD;YAChD,IACE,KAAK,CAAC,UAAU,KAAK,EAAE;gBACvB,KAAK,CAAC,YAAY,KAAK,eAAe,CAAC,yBAAyB,EAChE,CAAC;gBACD,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,+DAA+D,CAChE,EACD,iCAAiC,CAClC,CAAC;YACJ,CAAC;YACD,MAAM,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,aAAa;YAChB,MAAM,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAC3D,iCAAiC,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAC1B,UAAsB,EACtB,QAAwB,EACxB,KAAiB;IAEjB,IAAI,CAAC;QACH,OAAO,MAAM,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,mBAAmB,CAC1B,KAAc,EACd,MAA8B;IAE9B,IAAI,MAAM,CAAC,gBAAgB,KAAK,EAAE,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC7D,OAAO,OAAO,KAAK,KAAK,QAAQ;QAC9B,CAAC,CAAE,KAAyB;QAC5B,CAAC,CAAC,eAAe,CAAC,yBAAyB,CAAC;AAChD,CAAC;AAED,yEAAyE;AACzE,SAAS,iBAAiB,CACxB,KAAc,EACd,MAA8B;IAE9B,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC;IAC3B,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAClD,IAAI,OAAO,GAAY,KAAK,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAI,OAAmC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/pipeline/steps/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,MAAM,IAAI,sBAAsB,EAChC,SAAS,EACT,qBAAqB,GACtB,MAAM,0DAA0D,CAAC;AAQlE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAI5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAC5C,4CAA4C,CAAC;AAE/C,uEAAuE;AACvE,MAAM,CAAC,MAAM,qCAAqC,GAAG,mBAAmB,CAAC;AAEzE;;;;;;GAMG;AACH,MAAM,UAAU,iCAAiC;IAC/C,OAAO;QACL,SAAS;YACP,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAkB,EAClB,UAAsB;IAEtB,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,OAAO,CAAC,GAAyB;YAC/B,OAAO,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC;AAgBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAkB,EAClB,UAAsB,EACtB,QAAwB,EACxB,KAAc,EACd,QAAkC;IAElC,IAAI,QAAQ,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACxC,OAAO;IACT,CAAC;IACD,IACE,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC;QAC5B,SAAS,CAAC,MAAM,EAAE,qBAAqB,CAAC,EACxC,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAEzD,OAAO,yBAAyB,CAC9B,UAAU,EACV,QAAQ,EACR;QACE,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EACV,QAAQ,EAAE,YAAY,IAAI,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC;QAC9D,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC;KACrE,EACD,MAAM,CAAC,QAAQ,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,UAAsB,EACtB,QAAwB,EACxB,KAAiB,EACjB,QAAgB;IAEhB,IAAI,QAAQ,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACxC,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACvE,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO;QACT,KAAK,MAAM;YACT,MAAM,IAAI,YAAY,CACpB,QAAQ,KAAK,EAAE;gBACb,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,EAAE;oBACtB,CAAC,CAAC,QAAQ,CAAC,MAAM;oBACjB,CAAC,CAAC,qCAAqC,EAC3C,IAAI,CAAC,gBAAgB,CACtB,CAAC;QACJ,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,+DAA+D;YAC/D,6DAA6D;YAC7D,gDAAgD;YAChD,IACE,KAAK,CAAC,UAAU,KAAK,EAAE;gBACvB,KAAK,CAAC,YAAY,KAAK,eAAe,CAAC,yBAAyB,EAChE,CAAC;gBACD,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,+DAA+D,CAChE,EACD,iCAAiC,CAClC,CAAC;YACJ,CAAC;YACD,MAAM,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,aAAa;YAChB,MAAM,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAC3D,iCAAiC,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAsB,EACtB,QAAwB,EACxB,KAAiB;IAEjB,IAAI,CAAC;QACH,OAAO,MAAM,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAC1B,KAAc,EACd,MAA8B;IAE9B,IAAI,MAAM,CAAC,gBAAgB,KAAK,EAAE,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAwB,CAAC;IAClC,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,eAAe,CAAC,yBAAyB,CAAC;AACnD,CAAC;AAED,yEAAyE;AACzE,SAAS,iBAAiB,CACxB,KAAc,EACd,MAA8B;IAE9B,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC;IAC3B,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAClD,IAAI,OAAO,GAAY,KAAK,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAI,OAAmC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9E,CAAC"}

package/dist/pipeline/steps/defaults.d.ts

@@ -94,4 +94,14 @@ export declare function setAuditReflect(schema: DescMessage, resource: Message,
  * consistency, exactly as Go lowercases oklog's output.
  */
 export declare function generateId(prefix: string): string;
+/**
+ * The derived id of a kind whose id is a function of its natural key
+ * (metadata.proto `id`): `{prefix}_` + the top 130 bits of
+ * sha256(canonicalText) as 26 lowercase Crockford-base32 characters. Pure
+ * and total; the CALLER owns what `canonicalText` may be (the domains
+ * refuse an empty subject or an ambiguous triple before hashing), and the
+ * domains' golden vectors are the wire-adjacent pin — a change here
+ * re-addresses every derived row open source ever wrote.
+ */
+export declare function derivedId(prefix: string, canonicalText: string): string;
 //# sourceMappingURL=defaults.d.ts.map

package/dist/pipeline/steps/defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/defaults.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAI/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AASxD,OAAO,KAAK,EACV,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,0DAA0D,CAAC;AAElE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAUnD,wBAAgB,oBAAoB,CAClC,IAAI,SAAS,WAAW,KACrB,YAAY,CAAC,IAAI,CAAC,CAuCtB;AAED,iEAAiE;AACjE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,GAAG,IAAI,CAQxE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,cAAc,GACvB,IAAI,CAeN;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,cAAc,CAAC;AAEtD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,OAAO,EACjB,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,cAAc,GACvB,IAAI,CAUN;AAeD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAO5E;AAED,8EAA8E;AAC9E,wBAAgB,6BAA6B,IAAI,IAAI,CAIpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,IAAI;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB,CAEA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,cAAc,GAAG,qBAAqB,CAM7E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,qBAAqB,GAAG,SAAS,EAC5C,SAAS,EAAE,SAAS,GAAG,SAAS,EAChC,KAAK,EAAE,qBAAqB,EAC5B,GAAG,EAAE,SAAS,GACb,oBAAoB,CAQtB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,OAAO,EACjB,IAAI,EAAE,SAAS,GACd;IACD,SAAS,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC7C,SAAS,EAAE,SAAS,GAAG,SAAS,CAAC;CAClC,CAWA;AAED,6EAA6E;AAC7E,wBAAgB,OAAO,CACrB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,OAAO,GAChB,gBAAgB,GAAG,SAAS,CAU9B;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,gBAAgB,GACtB,IAAI,CAUN;AA+BD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEjD"}
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/defaults.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAI/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AASxD,OAAO,KAAK,EACV,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,0DAA0D,CAAC;AAElE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAUnD,wBAAgB,oBAAoB,CAClC,IAAI,SAAS,WAAW,KACrB,YAAY,CAAC,IAAI,CAAC,CAuCtB;AAED,iEAAiE;AACjE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,GAAG,IAAI,CAQxE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,cAAc,GACvB,IAAI,CAeN;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,cAAc,CAAC;AAEtD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,OAAO,EACjB,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,cAAc,GACvB,IAAI,CAUN;AAeD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAO5E;AAED,8EAA8E;AAC9E,wBAAgB,6BAA6B,IAAI,IAAI,CAIpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,IAAI;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB,CAEA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,cAAc,GAAG,qBAAqB,CAM7E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,qBAAqB,GAAG,SAAS,EAC5C,SAAS,EAAE,SAAS,GAAG,SAAS,EAChC,KAAK,EAAE,qBAAqB,EAC5B,GAAG,EAAE,SAAS,GACb,oBAAoB,CAQtB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,OAAO,EACjB,IAAI,EAAE,SAAS,GACd;IACD,SAAS,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC7C,SAAS,EAAE,SAAS,GAAG,SAAS,CAAC;CAClC,CAWA;AAED,6EAA6E;AAC7E,wBAAgB,OAAO,CACrB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,OAAO,GAChB,gBAAgB,GAAG,SAAS,CAU9B;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,gBAAgB,GACtB,IAAI,CAUN;AA+BD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEjD;AAQD;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAavE"}

package/dist/pipeline/steps/defaults.js

@@ -14,7 +14,18 @@
  * setAuditFieldsForUpdate call site declares which slot it owns —
  * SpecAudit for definition changes (search recency, version "pushed at"),
  * StatusAudit for operational changes (Recents, lifecycle metadata).
+ *
+ * This module is also the one home of how an id is SPELLED. `generateId`
+ * mints `{prefix}_{ulid}`; `derivedId` is its sibling for the kinds
+ * metadata.proto names as deriving their id from a natural key instead
+ * (a direct IdentityAccount from its issuer subject, an IamPolicy from its
+ * triple): `{prefix}_` + the top 130 bits of sha256 over the key's
+ * canonical text as 26 lowercase Crockford-base32 characters. The two
+ * shapes are indistinguishable on the wire, so nothing downstream learns
+ * a second grammar, and the primary key becomes the one home of "one row
+ * per natural key" without a secondary index or a scan.
  */
+import { createHash } from "node:crypto";
 import { create, clone } from "@bufbuild/protobuf";
 import { reflect } from "@bufbuild/protobuf/reflect";
 import { timestampNow } from "@bufbuild/protobuf/wkt";
@@ -248,4 +259,32 @@ function setAuditSlotReflect(schema, resource, slot, info) {
 export function generateId(prefix) {
     return `${prefix}_${ulid().toLowerCase()}`;
 }
+/** Crockford base32, lowercased — the alphabet every minted ULID id uses. */
+const CROCKFORD_ALPHABET = "0123456789abcdefghjkmnpqrstvwxyz";
+const DERIVED_ID_CHARS = 26;
+const DERIVED_ID_BITS = BigInt(DERIVED_ID_CHARS * 5);
+const SHA256_BITS = 256n;
+/**
+ * The derived id of a kind whose id is a function of its natural key
+ * (metadata.proto `id`): `{prefix}_` + the top 130 bits of
+ * sha256(canonicalText) as 26 lowercase Crockford-base32 characters. Pure
+ * and total; the CALLER owns what `canonicalText` may be (the domains
+ * refuse an empty subject or an ambiguous triple before hashing), and the
+ * domains' golden vectors are the wire-adjacent pin — a change here
+ * re-addresses every derived row open source ever wrote.
+ */
+export function derivedId(prefix, canonicalText) {
+    const digest = createHash("sha256").update(canonicalText, "utf8").digest();
+    let bits = 0n;
+    for (const byte of digest) {
+        bits = (bits << 8n) | BigInt(byte);
+    }
+    let top = bits >> (SHA256_BITS - DERIVED_ID_BITS);
+    let encoded = "";
+    for (let i = 0; i < DERIVED_ID_CHARS; i++) {
+        encoded = CROCKFORD_ALPHABET[Number(top & 31n)] + encoded;
+        top >>= 5n;
+    }
+    return `${prefix}_${encoded}`;
+}
 //# sourceMappingURL=defaults.js.map

package/dist/pipeline/steps/defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../../src/pipeline/steps/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAErD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,0DAA0D,CAAC;AAQlE,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,MAAM,UAAU,oBAAoB;IAGlC,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,OAAO,CAAC,GAAyB;YAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC9B,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,0BAA0B,CAAC,EACrC,iBAAiB,CAClB,CAAC;YACJ,CAAC;YAED,qEAAqE;YACrE,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACzC,CAAC;YAED,qEAAqE;YACrE,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACvB,QAAQ,CAAC,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;YAC7D,CAAC;YAED,8DAA8D;YAC9D,qDAAqD;YACrD,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B,uBAAuB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YACpE,CAAC;YAED,qEAAqE;YACrE,gEAAgE;YAChE,IACE,QAAQ,CAAC,UAAU;gBACnB,qBAAqB,CAAC,mCAAmC,EACzD,CAAC;gBACD,QAAQ,CAAC,UAAU,GAAG,oBAAoB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,gBAAgB,CAAC,MAAmB,EAAE,GAAY;IAChE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CACxD,CAAC;IACF,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAmB,EACnB,QAAiB,EACjB,QAAwB;IAExB,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,0BAA0B,EAAE;QAC9C,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,GAAG;QACd,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IACH,eAAe,CACb,MAAM,EACN,QAAQ,EACR,MAAM,CAAC,sBAAsB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CACvE,CAAC;AACJ,CAAC;AASD;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAmB,EACnB,QAAiB,EACjB,IAAe,EACf,QAAwB;IAExB,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzE,mBAAmB,CACjB,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,mEAAmE;AACnE,yEAAyE;AACzE,kEAAkE;AAClE,sEAAsE;AACtE,uEAAuE;AACvE,oEAAoE;AACpE,uEAAuE;AACvE,oBAAoB;AACpB,IAAI,aAAa,GAAG,EAAE,CAAC;AACvB,IAAI,YAAY,GAAG,EAAE,CAAC;AACtB,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,WAAmB;IACpE,IAAI,yBAAyB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,yBAAyB,GAAG,IAAI,CAAC;IACjC,aAAa,GAAG,KAAK,CAAC;IACtB,YAAY,GAAG,WAAW,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,6BAA6B;IAC3C,yBAAyB,GAAG,KAAK,CAAC;IAClC,aAAa,GAAG,EAAE,CAAC;IACnB,YAAY,GAAG,EAAE,CAAC;AACpB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB;IAItC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAAC,QAAwB;IACpD,OAAO,MAAM,CAAC,2BAA2B,EAAE;QACzC,EAAE,EAAE,QAAQ,CAAC,UAAU;QACvB,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,EAAE;QAC3B,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE;KACxC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAA4C,EAC5C,SAAgC,EAChC,KAA4B,EAC5B,GAAc;IAEd,OAAO,MAAM,CAAC,0BAA0B,EAAE;QACxC,SAAS,EAAE,SAAS,IAAI,KAAK;QAC7B,SAAS,EAAE,SAAS,IAAI,GAAG;QAC3B,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,GAAG;QACd,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAmB,EACnB,QAAiB,EACjB,IAAe;IAKf,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC;IAC3E,OAAO;QACL,SAAS,EACP,IAAI,EAAE,SAAS,KAAK,SAAS;YAC3B,CAAC,CAAC,KAAK,CAAC,2BAA2B,EAAE,IAAI,CAAC,SAAS,CAAC;YACpD,CAAC,CAAC,SAAS;QACf,SAAS,EACP,IAAI,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;KACpE,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,OAAO,CACrB,MAAmB,EACnB,QAAiB;IAEjB,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAsC,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAmB,EACnB,QAAiB,EACjB,KAAuB;IAEvB,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAC1B,MAAmB,EACnB,QAAiB,EACjB,IAAe,EACf,IAA0B;IAE1B,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO;IACT,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,QAAQ,GAAmB,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,OAAO,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../../src/pipeline/steps/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAErD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,0DAA0D,CAAC;AAQlE,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,MAAM,UAAU,oBAAoB;IAGlC,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,OAAO,CAAC,GAAyB;YAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC9B,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,0BAA0B,CAAC,EACrC,iBAAiB,CAClB,CAAC;YACJ,CAAC;YAED,qEAAqE;YACrE,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACzC,CAAC;YAED,qEAAqE;YACrE,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACvB,QAAQ,CAAC,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;YAC7D,CAAC;YAED,8DAA8D;YAC9D,qDAAqD;YACrD,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B,uBAAuB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YACpE,CAAC;YAED,qEAAqE;YACrE,gEAAgE;YAChE,IACE,QAAQ,CAAC,UAAU;gBACnB,qBAAqB,CAAC,mCAAmC,EACzD,CAAC;gBACD,QAAQ,CAAC,UAAU,GAAG,oBAAoB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,gBAAgB,CAAC,MAAmB,EAAE,GAAY;IAChE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CACxD,CAAC;IACF,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAmB,EACnB,QAAiB,EACjB,QAAwB;IAExB,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,0BAA0B,EAAE;QAC9C,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,GAAG;QACd,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IACH,eAAe,CACb,MAAM,EACN,QAAQ,EACR,MAAM,CAAC,sBAAsB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CACvE,CAAC;AACJ,CAAC;AASD;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAmB,EACnB,QAAiB,EACjB,IAAe,EACf,QAAwB;IAExB,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzE,mBAAmB,CACjB,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,mEAAmE;AACnE,yEAAyE;AACzE,kEAAkE;AAClE,sEAAsE;AACtE,uEAAuE;AACvE,oEAAoE;AACpE,uEAAuE;AACvE,oBAAoB;AACpB,IAAI,aAAa,GAAG,EAAE,CAAC;AACvB,IAAI,YAAY,GAAG,EAAE,CAAC;AACtB,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,WAAmB;IACpE,IAAI,yBAAyB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,yBAAyB,GAAG,IAAI,CAAC;IACjC,aAAa,GAAG,KAAK,CAAC;IACtB,YAAY,GAAG,WAAW,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,6BAA6B;IAC3C,yBAAyB,GAAG,KAAK,CAAC;IAClC,aAAa,GAAG,EAAE,CAAC;IACnB,YAAY,GAAG,EAAE,CAAC;AACpB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB;IAItC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAAC,QAAwB;IACpD,OAAO,MAAM,CAAC,2BAA2B,EAAE;QACzC,EAAE,EAAE,QAAQ,CAAC,UAAU;QACvB,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,EAAE;QAC3B,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE;KACxC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAA4C,EAC5C,SAAgC,EAChC,KAA4B,EAC5B,GAAc;IAEd,OAAO,MAAM,CAAC,0BAA0B,EAAE;QACxC,SAAS,EAAE,SAAS,IAAI,KAAK;QAC7B,SAAS,EAAE,SAAS,IAAI,GAAG;QAC3B,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,GAAG;QACd,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAmB,EACnB,QAAiB,EACjB,IAAe;IAKf,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC;IAC3E,OAAO;QACL,SAAS,EACP,IAAI,EAAE,SAAS,KAAK,SAAS;YAC3B,CAAC,CAAC,KAAK,CAAC,2BAA2B,EAAE,IAAI,CAAC,SAAS,CAAC;YACpD,CAAC,CAAC,SAAS;QACf,SAAS,EACP,IAAI,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;KACpE,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,OAAO,CACrB,MAAmB,EACnB,QAAiB;IAEjB,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAsC,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAmB,EACnB,QAAiB,EACjB,KAAuB;IAEvB,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAC1B,MAAmB,EACnB,QAAiB,EACjB,IAAe,EACf,IAA0B;IAE1B,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO;IACT,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,QAAQ,GAAmB,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,OAAO,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;AAC7C,CAAC;AAED,6EAA6E;AAC7E,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;AAC9D,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,eAAe,GAAG,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC;AACrD,MAAM,WAAW,GAAG,IAAI,CAAC;AAEzB;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,aAAqB;IAC7D,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3E,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC,WAAW,GAAG,eAAe,CAAC,CAAC;IAClD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,gBAAgB,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC;QAC1D,GAAG,KAAK,EAAE,CAAC;IACb,CAAC;IACD,OAAO,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;AAChC,CAAC"}

package/dist/store/port-contract.d.ts

@@ -0,0 +1,61 @@
+/**
+ * The port-contract runner — the scaffolding every domain store PORT's
+ * contract kit is built on (identity-account's store-contract.ts since
+ * 20260911.11 A11; IamPolicy's since 20260913.01 slice 2, when this was
+ * lifted out of the first kit so the second did not carry a copy).
+ *
+ * A port kit is a list of named cases a DRIVER's test iterates: open
+ * source runs them over its adapter on sqlite and Postgres, a composition
+ * runs the same list over the store it registers as a driver, so "the port
+ * holds" is one statement proven per driver, never restated per
+ * repository. This module owns the part every kit shares and no kit should
+ * restate: a FRESH fixture per case, the body run over it, cleanup after,
+ * and the rule that a failing body is the failure reported (a cleanup that
+ * fails after a failed body must not replace the assertion that matters
+ * with a teardown detail; a cleanup that fails after a passing body is a
+ * real failure).
+ *
+ * Shape. The package's precedent is store/__tests__/store-contract.ts —
+ * `describeStoreContract(makeFixture)` over the generic Store, a vitest
+ * `describe`. A port kit is consumed by ANOTHER package's tests through the
+ * published barrel, so it ships in dist/ and must not import vitest (a
+ * devDependency that would enter the root barrel's runtime import graph).
+ * It therefore returns cases instead of calling `describe`, asserts through
+ * node:assert/strict, and the consumer's framework does
+ * `for (const c of cases) it(c.name, c.run)`. Do not "fix" it back to the
+ * precedent's vitest shape.
+ *
+ * `disconnect` is the one escape hatch a port cannot express: a port has
+ * no lifecycle by design (a composition owns its store's), yet "an outage
+ * never reads as not-found" is the line that matters most, so a fixture
+ * cuts its store from the database and the kit asserts that the fault
+ * propagates. `cleanup` must tolerate a disconnected store.
+ */
+/** One fresh, isolated store per case, plus the one escape hatch the port cannot express. */
+export interface PortContractFixture<Port> {
+    readonly store: Port;
+    /**
+     * Cuts the store from its database so every later call is an
+     * infrastructure fault. `cleanup` still runs afterwards and must tolerate
+     * a disconnected store (both OSS drivers' `close` is idempotent; a pool
+     * fixture ends a per-case pool here and skips it in cleanup).
+     */
+    disconnect(): Promise<void>;
+    cleanup(): Promise<void>;
+}
+export interface PortContractCase {
+    /** The contract line, in the port's words; the framework prints it as the test name. */
+    readonly name: string;
+    /** Makes a FRESH fixture, runs the case, cleans up. A failing assertion wins over a failing cleanup. */
+    run(): Promise<void>;
+}
+/** A case body over a live fixture; the runner owns the fixture's lifecycle around it. */
+export type PortContractBody<Port> = (fixture: PortContractFixture<Port>) => Promise<void>;
+/** A kit's declaration: the contract line and the body that proves it. */
+export type PortContractDeclaration<Port> = readonly [
+    name: string,
+    body: PortContractBody<Port>
+];
+/** The kit's declarations as runnable cases over `makeFixture`, one fresh fixture per case, in declared order. */
+export declare function portContractCases<Port>(declarations: ReadonlyArray<PortContractDeclaration<Port>>, makeFixture: () => Promise<PortContractFixture<Port>>): ReadonlyArray<PortContractCase>;
+//# sourceMappingURL=port-contract.d.ts.map

package/dist/store/port-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"port-contract.d.ts","sourceRoot":"","sources":["../../src/store/port-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,6FAA6F;AAC7F,MAAM,WAAW,mBAAmB,CAAC,IAAI;IACvC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IACrB;;;;;OAKG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wGAAwG;IACxG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACtB;AAED,0FAA0F;AAC1F,MAAM,MAAM,gBAAgB,CAAC,IAAI,IAAI,CACnC,OAAO,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAC/B,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,0EAA0E;AAC1E,MAAM,MAAM,uBAAuB,CAAC,IAAI,IAAI,SAAS;IACnD,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC;CAC7B,CAAC;AA6BF,kHAAkH;AAClH,wBAAgB,iBAAiB,CAAC,IAAI,EACpC,YAAY,EAAE,aAAa,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,EAC1D,WAAW,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,GACpD,aAAa,CAAC,gBAAgB,CAAC,CAKjC"}

package/dist/store/port-contract.js

@@ -0,0 +1,67 @@
+/**
+ * The port-contract runner — the scaffolding every domain store PORT's
+ * contract kit is built on (identity-account's store-contract.ts since
+ * 20260911.11 A11; IamPolicy's since 20260913.01 slice 2, when this was
+ * lifted out of the first kit so the second did not carry a copy).
+ *
+ * A port kit is a list of named cases a DRIVER's test iterates: open
+ * source runs them over its adapter on sqlite and Postgres, a composition
+ * runs the same list over the store it registers as a driver, so "the port
+ * holds" is one statement proven per driver, never restated per
+ * repository. This module owns the part every kit shares and no kit should
+ * restate: a FRESH fixture per case, the body run over it, cleanup after,
+ * and the rule that a failing body is the failure reported (a cleanup that
+ * fails after a failed body must not replace the assertion that matters
+ * with a teardown detail; a cleanup that fails after a passing body is a
+ * real failure).
+ *
+ * Shape. The package's precedent is store/__tests__/store-contract.ts —
+ * `describeStoreContract(makeFixture)` over the generic Store, a vitest
+ * `describe`. A port kit is consumed by ANOTHER package's tests through the
+ * published barrel, so it ships in dist/ and must not import vitest (a
+ * devDependency that would enter the root barrel's runtime import graph).
+ * It therefore returns cases instead of calling `describe`, asserts through
+ * node:assert/strict, and the consumer's framework does
+ * `for (const c of cases) it(c.name, c.run)`. Do not "fix" it back to the
+ * precedent's vitest shape.
+ *
+ * `disconnect` is the one escape hatch a port cannot express: a port has
+ * no lifecycle by design (a composition owns its store's), yet "an outage
+ * never reads as not-found" is the line that matters most, so a fixture
+ * cuts its store from the database and the kit asserts that the fault
+ * propagates. `cleanup` must tolerate a disconnected store.
+ */
+/**
+ * Runs `body` over a fresh fixture. The body's failure is the one reported:
+ * a cleanup failure after a failed body would otherwise replace the
+ * assertion that matters with a teardown detail.
+ */
+async function withFixture(makeFixture, body) {
+    const fixture = await makeFixture();
+    let failed = false;
+    try {
+        await body(fixture);
+    }
+    catch (error) {
+        failed = true;
+        throw error;
+    }
+    finally {
+        try {
+            await fixture.cleanup();
+        }
+        catch (cleanupError) {
+            if (!failed) {
+                throw cleanupError;
+            }
+        }
+    }
+}
+/** The kit's declarations as runnable cases over `makeFixture`, one fresh fixture per case, in declared order. */
+export function portContractCases(declarations, makeFixture) {
+    return declarations.map(([name, body]) => ({
+        name,
+        run: () => withFixture(makeFixture, body),
+    }));
+}
+//# sourceMappingURL=port-contract.js.map

package/dist/store/port-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"port-contract.js","sourceRoot":"","sources":["../../src/store/port-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAiCH;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,WAAqD,EACrD,IAA4B;IAE5B,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,YAAY,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,iBAAiB,CAC/B,YAA0D,EAC1D,WAAqD;IAErD,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI;QACJ,GAAG,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC;KAC1C,CAAC,CAAC,CAAC;AACN,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/server",
-  "version": "3.15.2-dev.20260913223433",
+  "version": "3.15.3-dev.20260914100347",
   "description": "The Stigmer OSS control plane as a composable library: composeServer, the extension registry and the driver seams a composition builds on. The self-contained deployable of the same server is @stigmer/server-slim.",
   "license": "Apache-2.0",
   "type": "module",
@@ -62,9 +62,9 @@
     "@connectrpc/connect-node": "^2.0.0",
     "@kubernetes/client-node": "2.0.0",
     "@opentelemetry/api": "^1.9.0",
-    "@stigmer/protos": "3.15.2-dev.20260913223433",
-    "@stigmer/temporal-codecs": "3.15.2-dev.20260913223433",
-    "@stigmer/zip-structure": "3.15.2-dev.20260913223433",
+    "@stigmer/protos": "3.15.3-dev.20260914100347",
+    "@stigmer/temporal-codecs": "3.15.3-dev.20260914100347",
+    "@stigmer/zip-structure": "3.15.3-dev.20260914100347",
     "@temporalio/activity": "1.16.2",
     "@temporalio/client": "1.16.2",
     "@temporalio/common": "1.16.2",

package/src/boot/compose.ts

@@ -72,6 +72,12 @@ import {
 import { ensureOperatorAccount } from "../domain/identityaccount/operator.js";
 import { newDirectAccountProvisioner } from "../domain/identityaccount/provisioning.js";
 import { newResourceIdentityAccountStore } from "../domain/identityaccount/resource-store.js";
+import { registerIamPolicyServices } from "../domain/iampolicy/controller.js";
+import { newIamPolicyGrantPath } from "../domain/iampolicy/grant-path.js";
+import { newOrganizationOnlyGrantScope } from "../domain/iampolicy/grant-scope.js";
+import { newMembershipRules } from "../domain/iampolicy/membership.js";
+import { newResourceIamPolicyStore } from "../domain/iampolicy/resource-store.js";
+import { newBuiltInRoleLifecycle } from "../domain/iampolicy/role-lifecycle.js";
 import { newIssuerDiscovery } from "../identity/oidc-discovery.js";
 import { newOidcUserInfoClient } from "../identity/oidc-userinfo.js";
 import { newApiKeyIdentityVerifier } from "../domain/apikey/verifier.js";
@@ -285,13 +291,13 @@ export async function composeServer(
   // position 1 of every chain calls it (O2).
   const authorizer =
     extensions.authorizer ?? newPermissiveSingleTeamAuthorizer();
-  // The C2 tuple-lifecycle driver (ruling Q2): undefined = the three
-  // shared tuple steps (CreateAuthorizationTuples / CleanupIamPolicies /
-  // UpdateVisibilityTuples) no-op — OSS behavior byte-identical. Handed
-  // to every resource controller as an explicit dependency, the same
-  // threading as the authorizer.
-  const authorizationLifecycle =
-    extensions.drivers.resourceAuthorizationLifecycle;
+  // The built-in authorization POSTURE (20260913.01, Q-OR-6), named once:
+  // no unit registered an Authorizer, so the roles open source records
+  // exist to feed the built-in one. Under it — and only under it — the
+  // identity-accounts stage below installs the built-in role lifecycle
+  // and the membership rules; a composition with its own Authorizer has
+  // its own onboarding and gets neither.
+  const builtInAuthorization = extensions.authorizer === undefined;
 
   // Stage: storage — the driver selection seam (DD-010): DATABASE_URL
   // present → Postgres (async connect + advisory-locked migrations), else
@@ -338,11 +344,67 @@ export async function composeServer(
   const identityAccounts =
     extensions.drivers.identityAccountStore ??
     newResourceIdentityAccountStore(store);
+  // The IamPolicy row half (20260913.01): the store PORT bound the same way
+  // (`drivers.iamPolicyStore`, Q-OR-10; open source's adapter over `store`
+  // when absent) and the domain's ONE grant and revoke path built over it.
+  // The grant path's lifecycle is the composed DRIVER — the cloud's tuple
+  // hooks — never the built-in lifecycle below, which sits ON TOP of the
+  // grant path; that direction keeps the two acyclic (S1 finding B). Both
+  // bindings are what the IamPolicy controller registers over (routes).
+  const iamPolicies =
+    extensions.drivers.iamPolicyStore ?? newResourceIamPolicyStore(store);
+  const iamPolicyGrantPath = newIamPolicyGrantPath({
+    policies: iamPolicies,
+    lifecycle: extensions.drivers.resourceAuthorizationLifecycle,
+    logger,
+  });
+  // The C2 tuple-lifecycle driver (ruling Q2): undefined = the three
+  // shared tuple steps (CreateAuthorizationTuples / CleanupIamPolicies /
+  // UpdateVisibilityTuples) no-op before any resolution work — OSS
+  // behavior byte-identical. Handed to every resource controller as an
+  // explicit dependency, the same threading as the authorizer.
+  const authorizationLifecycle =
+    extensions.drivers.resourceAuthorizationLifecycle;
+  // The lifecycle the ORGANIZATION and IDENTITY-ACCOUNT controllers get
+  // (20260913.01 slice 4, Q-S4-8): the composed driver when a unit
+  // registers one; otherwise, under the built-in posture, open source's
+  // role lifecycle — the organization creator's `owner` row, cleanup on
+  // organization and account deletes — the row half of the seam that
+  // records authorization at lifecycle points in every edition
+  // (extensions/resource-authorization.ts, corrected 2026-09-13). Those
+  // two kinds ONLY, because a lifecycle on a controller turns on the
+  // steps' full event RESOLUTION for that kind, and resolution fails a
+  // request whose configured parent id is missing (Java parity the
+  // cloud relies on) — a state open source admits by contract (a memory
+  // captured with no credential has no subject). The built-in object is
+  // a two-kind role recorder, so only two controllers see it; every other
+  // controller keeps the composed driver above and stays byte-identical.
+  const roleLifecycle =
+    authorizationLifecycle ??
+    (builtInAuthorization
+      ? newBuiltInRoleLifecycle({
+          grantPath: iamPolicyGrantPath,
+          accounts: identityAccounts,
+        })
+      : undefined);
+  // The operator seam is read once here for both its consumers below: the
+  // trusted-local account ensure and the membership rules' operator-email
+  // arm (which also applies under an authentication posture — the
+  // operator who signs in through OIDC is admin of what the laptop has).
+  const operatorIdentity = operatorIdentitySnapshot();
+  const membership = builtInAuthorization
+    ? newMembershipRules({
+        grantPath: iamPolicyGrantPath,
+        policies: iamPolicies,
+        store,
+        operatorEmail: operatorIdentity.email,
+      })
+    : undefined;
   const identityAccountPath = {
     accounts: identityAccounts,
     logger,
     authorizer,
-    authorizationLifecycle,
+    authorizationLifecycle: roleLifecycle,
   };
   const createIdentityAccount = newCreateAccountPath(
     identityAccountPath,
@@ -377,11 +439,22 @@ export async function composeServer(
   if (!requireAuthentication) {
     const operator = await ensureOperatorAccount(
       { accounts: identityAccounts, createAccount: createIdentityAccount },
-      operatorIdentitySnapshot(),
+      operatorIdentity,
     );
     logger.info("trusted-local operator account ensured", {
       accountId: operator.metadata?.id ?? "",
     });
+    // The laptop's one principal owns what the laptop has (Q-OR-6c):
+    // `owner` on every organization with no owner row, create-if-absent,
+    // so the Members page tells the truth from the first boot after roles
+    // exist. Under the built-in posture only — a unit with its own
+    // Authorizer and no authentication posture keeps its own rules.
+    if (membership !== undefined) {
+      await membership.ensureOperatorOwnership(operator);
+      logger.info("trusted-local operator ownership ensured", {
+        accountId: operator.metadata?.id ?? "",
+      });
+    }
   }
 
   // Stage: keys — the ratified fail-loud boot ASYMMETRY (D2 cross-domain
@@ -899,7 +972,9 @@ export async function composeServer(
       logger,
       authorizer,
       gateSteps: extensions.gateSteps,
-      authorizationLifecycle,
+      // The role lifecycle (the identity stage): the composed driver, or
+      // open source's owner-row writer under the built-in posture.
+      authorizationLifecycle: roleLifecycle,
       organizationDirectory: extensions.drivers.organizationDirectory,
     });
     // ApiKey is the first domain born AFTER the Go port (O3, 20260827.06 —
@@ -919,11 +994,33 @@ export async function composeServer(
     // composition adds what differs per edition through the registry —
     // the federation capability (the four federated RPC arms) and the
     // provision slot's gate steps (the cloud's personal organization).
+    // The membership rules are core, selected by posture (20260913.01).
     registerIdentityAccountServices(router, {
       ...identityAccountPath,
       provisioner: identityAccountProvisioner,
       federation: extensions.drivers.identityFederation,
       gateSteps: extensions.gateSteps,
+      membership,
+    });
+    // IamPolicy (20260913.01): the ROW half served once by open source in
+    // every edition over the store port and the grant path bound in the
+    // identity stage. A composition adds what differs per edition through
+    // the registry — a wider grant scope (`drivers.policyGrantScope`; the
+    // default is open source's organization-only scope, installed at this
+    // `??` site like the permissive Authorizer) and the tuple-half query
+    // engine (`drivers.authorizationQueries`; absent, those RPCs refuse
+    // UNIMPLEMENTED). The chains take no lifecycle: a policy is the
+    // authorization record, not a protected resource.
+    registerIamPolicyServices(router, {
+      grantPath: iamPolicyGrantPath,
+      policies: iamPolicies,
+      accounts: identityAccounts,
+      authorizer,
+      grantScope:
+        extensions.drivers.policyGrantScope ?? newOrganizationOnlyGrantScope(),
+      queries: extensions.drivers.authorizationQueries,
+      edition: extensions.edition,
+      logger,
     });
     registerEnvironmentServices(router, {
       store,