@stigmer/server 3.15.3-dev.20260914100347 → 3.15.3-dev.20260914121148

package/dist/extensions/list-read-scope.d.ts

@@ -71,19 +71,49 @@
  *     untouched with the org unconsulted (the first line above). Two lanes
  *     have no org on the wire (`session.list`, `apiKey.findAll`) and offer
  *     the kind until P1 entry 12 pages them.
+ *   - A KIND WHOSE AUTHORIZATION IS ITS PARENT'S CARRIES THAT PARENT ON
+ *     EVERY CANDIDATE (stigmer-cloud 20260913.04 T04, Q-LB-33..36). When
+ *     `kind_meta` declares PARENT scope with INHERITED owner
+ *     (`inheritedAuthorizationParentOf`; today agent_execution → session),
+ *     the helper fills `ListEntryMeta.authorizationParent` from the row's
+ *     spec through the same read the tuple lifecycle wrote the parent link
+ *     with. A driver MAY answer the parent's question in place of the
+ *     child's: by the model's construction the two answers are identical
+ *     (the child's `owner`, `viewer` and `can_view` are all `from` the
+ *     parent), and the parent's resolution is direct tuples where the
+ *     child's walks the parent's whole set (OpenFGA's learned `weight2`
+ *     strategy read the founder's 423 sessions per execution; that is what
+ *     rolled back twice on 2026-09-14). A driver that ignores the field is
+ *     still correct. The one observable difference is stated, not hidden:
+ *     a row whose parent tuple never landed (the create chain's "row
+ *     survives, tuple write failed" state, healed by retry) is hidden by
+ *     the child's check and shown by the parent's — the row's truth, read
+ *     from the field the tuple was derived from, and no widening: nobody
+ *     reaches a parent through it who could not create the row in it.
  */
 import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { CallerIdentity } from "./identity.js";
+import type { ResolvedParentLink } from "./resource-authorization.js";
 /**
  * The candidate metadata a post-scan lane offers the scope — the three
  * fields the cloud driver's rules key on (id for the FGA intersection,
  * labels for the guest cookie rule; org rides along for symmetry with
- * the consumer-owned intersection, so a driver can log or assert on it).
+ * the consumer-owned intersection, so a driver can log or assert on it),
+ * plus the parent for kinds whose authorization is their parent's.
  */
 export interface ListEntryMeta {
     readonly id: string;
     readonly org: string;
     readonly labels: Readonly<Record<string, string>>;
+    /**
+     * OPTIONAL (added 20260913.04 T04): the parent this row's authorization
+     * IS — present only for a kind whose `kind_meta` is PARENT scope with
+     * INHERITED owner (the header's last contract line), the same
+     * `ResolvedParentLink` the tuple lifecycle wrote for the row. Absent for
+     * every other kind, and absent when the row's spec does not name its
+     * parent — a driver then asks about the row itself, never drops it.
+     */
+    readonly authorizationParent?: ResolvedParentLink;
 }
 /** The scope contract (single-instance point, ExtensionDrivers.listReadScope). */
 export interface ListReadScope {
@@ -105,7 +135,10 @@ export interface ListReadScope {
 }
 /**
  * The shape every stored API resource message presents to the shared
- * helper — the metadata fields the scope's candidates are built from.
+ * helper — the metadata fields the scope's candidates are built from, and
+ * the spec the parent is read from (structurally, by `kind_meta`'s
+ * `spec_field`; typed loosely because the field differs per kind and the
+ * read is `parentIdOf`'s).
  */
 export interface ScopedListResource {
     metadata?: {
@@ -113,6 +146,7 @@ export interface ScopedListResource {
         org?: string;
         labels?: Record<string, string>;
     };
+    spec?: object;
 }
 /**
  * The ONE consumption idiom for post-scan lanes (the shared-step
@@ -128,8 +162,11 @@ export interface ScopedListResource {
  *     permission-bounded across orgs, verified per lane in the entry's
  *     census — lanes Java does not org-narrow pass ""), then to the kept
  *     ids. The same set either way (both are per-row predicates); the
- *     order is the header's last contract line: the scope sees the org's
- *     rows, not the kind's.
+ *     order is the header's second-to-last contract line: the scope sees
+ *     the org's rows, not the kind's;
+ *   - the candidates of a kind whose authorization is its parent's carry
+ *     `authorizationParent` (the header's last line), resolved once per
+ *     call from `kind_meta` and once per row from the spec.
  */
 export declare function restrictListByReadScope<T extends ScopedListResource>(scope: ListReadScope | undefined, caller: CallerIdentity, kind: ApiResourceKind, resources: ReadonlyArray<T>, requestOrg: string): Promise<T[]>;
 //# sourceMappingURL=list-read-scope.d.ts.map

package/dist/extensions/list-read-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-read-scope.d.ts","sourceRoot":"","sources":["../../src/extensions/list-read-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyEG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAE3H,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACnD;AAED,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,qBAAqB,CACnB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhC;;;;;OAKG;IACH,mBAAmB,CACjB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,GACpC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE;QACT,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,CAAC;CACH;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,uBAAuB,CAAC,CAAC,SAAS,kBAAkB,EACxE,KAAK,EAAE,aAAa,GAAG,SAAS,EAChC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,EACrB,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,EAC3B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,EAAE,CAAC,CAed"}
+{"version":3,"file":"list-read-scope.d.ts","sourceRoot":"","sources":["../../src/extensions/list-read-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4FG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAY3H,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD;;;;;;;OAOG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;CACnD;AAED,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,qBAAqB,CACnB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhC;;;;;OAKG;IACH,mBAAmB,CACjB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,GACpC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;CACjC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE;QACT,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CAAC,CAAC,SAAS,kBAAkB,EACxE,KAAK,EAAE,aAAa,GAAG,SAAS,EAChC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,EACrB,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,EAC3B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,EAAE,CAAC,CAsBd"}

package/dist/extensions/list-read-scope.js

@@ -1,3 +1,9 @@
+// The first VALUE imports from extensions/ into pipeline/ (every other
+// crossing is a type): two pure leaf modules that import nothing but
+// protos, so there is no cycle. Deliberate — one resolver for the tuple
+// writer and the list reader beats a copy in the seam.
+import { getKindEnum, inheritedAuthorizationParentOf, } from "../pipeline/apiresource-meta.js";
+import { parentIdOf } from "../pipeline/steps/shapes.js";
 /**
  * The ONE consumption idiom for post-scan lanes (the shared-step
  * discipline of pipeline/steps/authorization-tuples.ts, rendered as a
@@ -12,8 +18,11 @@
  *     permission-bounded across orgs, verified per lane in the entry's
  *     census — lanes Java does not org-narrow pass ""), then to the kept
  *     ids. The same set either way (both are per-row predicates); the
- *     order is the header's last contract line: the scope sees the org's
- *     rows, not the kind's.
+ *     order is the header's second-to-last contract line: the scope sees
+ *     the org's rows, not the kind's;
+ *   - the candidates of a kind whose authorization is its parent's carry
+ *     `authorizationParent` (the header's last line), resolved once per
+ *     call from `kind_meta` and once per row from the spec.
  */
 export async function restrictListByReadScope(scope, caller, kind, resources, requestOrg) {
     if (scope === undefined) {
@@ -22,12 +31,40 @@ export async function restrictListByReadScope(scope, caller, kind, resources, re
     const offered = requestOrg === ""
         ? resources
         : resources.filter((resource) => resource.metadata?.org === requestOrg);
-    const entries = offered.map((resource) => ({
-        id: resource.metadata?.id ?? "",
-        org: resource.metadata?.org ?? "",
-        labels: resource.metadata?.labels ?? {},
-    }));
+    const parentOf = authorizationParentReader(kind);
+    const entries = offered.map((resource) => {
+        const entry = {
+            id: resource.metadata?.id ?? "",
+            org: resource.metadata?.org ?? "",
+            labels: resource.metadata?.labels ?? {},
+        };
+        const authorizationParent = parentOf(resource);
+        return authorizationParent === undefined
+            ? entry
+            : { ...entry, authorizationParent };
+    });
     const keptIds = await scope.restrictListEntries(caller, kind, entries);
     return offered.filter((resource) => keptIds.has(resource.metadata?.id ?? ""));
 }
+/**
+ * The per-row parent reader for `kind`: a constant `undefined` for the 27
+ * kinds whose authorization is their own, and for the kind whose
+ * authorization is its parent's, the `ResolvedParentLink` the tuple
+ * lifecycle wrote — or undefined for a row whose spec does not name it
+ * (never a throw: a list is not a create). `kind_meta` is consulted once
+ * per call, not once per row.
+ */
+function authorizationParentReader(kind) {
+    const parent = inheritedAuthorizationParentOf(kind);
+    if (parent === undefined) {
+        return () => undefined;
+    }
+    const parentKind = getKindEnum(parent.kind);
+    return (resource) => {
+        const parentId = parentIdOf(resource, parent.specField);
+        return parentId === ""
+            ? undefined
+            : { relation: parent.relation, parentKind, parentId };
+    };
+}
 //# sourceMappingURL=list-read-scope.js.map

package/dist/extensions/list-read-scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-read-scope.js","sourceRoot":"","sources":["../../src/extensions/list-read-scope.ts"],"names":[],"mappings":"AAiIA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAgC,EAChC,MAAsB,EACtB,IAAqB,EACrB,SAA2B,EAC3B,UAAkB;IAElB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,OAAO,GACX,UAAU,KAAK,EAAE;QACf,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAoB,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC1D,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;QAC/B,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE;KACxC,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC"}
+{"version":3,"file":"list-read-scope.js","sourceRoot":"","sources":["../../src/extensions/list-read-scope.ts"],"names":[],"mappings":"AA+FA,uEAAuE;AACvE,qEAAqE;AACrE,wEAAwE;AACxE,uDAAuD;AACvD,OAAO,EACL,WAAW,EACX,8BAA8B,GAC/B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAsEzD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAgC,EAChC,MAAsB,EACtB,IAAqB,EACrB,SAA2B,EAC3B,UAAkB;IAElB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,OAAO,GACX,UAAU,KAAK,EAAE;QACf,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,OAAO,GAAoB,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACxD,MAAM,KAAK,GAAkB;YAC3B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;YAC/B,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE;SACxC,CAAC;QACF,MAAM,mBAAmB,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/C,OAAO,mBAAmB,KAAK,SAAS;YACtC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,yBAAyB,CAChC,IAAqB;IAErB,MAAM,MAAM,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IACzB,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5C,OAAO,CAAC,QAAQ,EAAE,EAAE;QAClB,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,QAAQ,KAAK,EAAE;YACpB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IAC1D,CAAC,CAAC;AACJ,CAAC"}

package/dist/pipeline/apiresource-meta.d.ts

@@ -1,10 +1,31 @@
 import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import { ApiResourceKind, ResourceTier } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { ApiResourceKindMeta } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { ParentRelationConfig } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
 import type { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
 /** Go GetKindMeta: the kind_meta extension of the enum value. */
 export declare function getKindMeta(kind: ApiResourceKind): ApiResourceKindMeta;
+/**
+ * The parent a kind's authorization IS — the `kind_meta` declaration that
+ * a kind's permissions are its parent's whole, not its own: PARENT scope
+ * (the one structural link is to that parent) AND INHERITED owner (no
+ * owner tuple of its own; `owner from <parent>` in the FGA model).
+ * Undefined for every other kind, including kinds with additional parents
+ * whose inheritance is partial (a workflow_execution's opt-in
+ * `execution_viewer from workflow_instance` sits beside its own owner).
+ *
+ * Today exactly one kind answers: agent_execution → session (its
+ * `can_view` is `viewer or can_view from session`, and `viewer` is the
+ * session's). The list read scope reads this to carry the parent on every
+ * candidate (`ListEntryMeta.authorizationParent`, 20260913.04 T04), so a
+ * composed driver may ask its authorization backend about the parent —
+ * direct tuples — instead of the child, whose resolution walks the
+ * parent's whole set. A second kind declaring the pair gets the behavior
+ * from this declaration alone; the table pin in __tests__ makes that a
+ * reviewed change.
+ */
+export declare function inheritedAuthorizationParentOf(kind: ApiResourceKind): ParentRelationConfig | undefined;
 /** Go GetIdPrefix: e.g. agent → "agt". */
 export declare function getIdPrefix(kind: ApiResourceKind): string;
 /** Go GetKindName: the canonical name, e.g. agent → "Agent" (error copy uses this). */

package/dist/pipeline/apiresource-meta.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiresource-meta.d.ts","sourceRoot":"","sources":["../../src/pipeline/apiresource-meta.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EACL,eAAe,EAEf,YAAY,EAEb,MAAM,qFAAqF,CAAC;AAC7F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qFAAqF,CAAC;AAC/H,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,mBAAmB,CAMtE;AAED,0CAA0C;AAC1C,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAEzD;AAED,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,CAS9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAI7D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAO1D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,GACpB,qBAAqB,CAKvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,GACpB,aAAa,CAAC,OAAO,CAAC,CAMxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,aAAa,GACrB,OAAO,CAKT;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,aAAa,GACrB,OAAO,CAET;AAkCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAYT;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAavE"}
+{"version":3,"file":"apiresource-meta.d.ts","sourceRoot":"","sources":["../../src/pipeline/apiresource-meta.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EACL,eAAe,EAEf,YAAY,EAEb,MAAM,qFAAqF,CAAC;AAC7F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qFAAqF,CAAC;AAK/H,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wFAAwF,CAAC;AACnI,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,mBAAmB,CAMtE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,eAAe,GACpB,oBAAoB,GAAG,SAAS,CASlC;AAED,0CAA0C;AAC1C,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAEzD;AAED,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,CAS9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAI7D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAO1D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,GACpB,qBAAqB,CAKvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,GACpB,aAAa,CAAC,OAAO,CAAC,CAMxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,aAAa,GACrB,OAAO,CAKT;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,aAAa,GACrB,OAAO,CAET;AAkCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAYT;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAavE"}

package/dist/pipeline/apiresource-meta.js

@@ -45,6 +45,7 @@
 import { getOption, hasOption } from "@bufbuild/protobuf";
 import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import { ApiResourceKind, ApiResourceKindSchema, ResourceTier, kind_meta, } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { AuthorizationScopeType, OwnerAttributionType, } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
 import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
 /** Go GetKindMeta: the kind_meta extension of the enum value. */
 export function getKindMeta(kind) {
@@ -54,6 +55,33 @@ export function getKindMeta(kind) {
     }
     return getOption(valueDesc, kind_meta);
 }
+/**
+ * The parent a kind's authorization IS — the `kind_meta` declaration that
+ * a kind's permissions are its parent's whole, not its own: PARENT scope
+ * (the one structural link is to that parent) AND INHERITED owner (no
+ * owner tuple of its own; `owner from <parent>` in the FGA model).
+ * Undefined for every other kind, including kinds with additional parents
+ * whose inheritance is partial (a workflow_execution's opt-in
+ * `execution_viewer from workflow_instance` sits beside its own owner).
+ *
+ * Today exactly one kind answers: agent_execution → session (its
+ * `can_view` is `viewer or can_view from session`, and `viewer` is the
+ * session's). The list read scope reads this to carry the parent on every
+ * candidate (`ListEntryMeta.authorizationParent`, 20260913.04 T04), so a
+ * composed driver may ask its authorization backend about the parent —
+ * direct tuples — instead of the child, whose resolution walks the
+ * parent's whole set. A second kind declaring the pair gets the behavior
+ * from this declaration alone; the table pin in __tests__ makes that a
+ * reviewed change.
+ */
+export function inheritedAuthorizationParentOf(kind) {
+    const config = getKindMeta(kind).authorization;
+    if (config?.scopeType !== AuthorizationScopeType.PARENT ||
+        config.ownerType !== OwnerAttributionType.INHERITED) {
+        return undefined;
+    }
+    return config.parent;
+}
 /** Go GetIdPrefix: e.g. agent → "agt". */
 export function getIdPrefix(kind) {
     return getKindMeta(kind).idPrefix;

package/dist/pipeline/apiresource-meta.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiresource-meta.js","sourceRoot":"","sources":["../../src/pipeline/apiresource-meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,SAAS,GACV,MAAM,qFAAqF,CAAC;AAG7F,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,iEAAiE;AACjE,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;AACpC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;IACtE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,CACL,eAAe,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,yBAAyB,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAqB;IAChD,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,KAAK,GACT,mBAAmB,CAAC,IAAI,CAAC;QACzB,mBAAmB,CAAC,eAAe,CAAC,yBAAyB,CAAC,CAAC;IACjE,OAAO,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAqB;IAErB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,OAAO,MAAM,EAAE,uBAAuB,KAAK,IAAI;QAC7C,CAAC,CAAC,qBAAqB,CAAC,cAAc;QACtC,CAAC,CAAC,qBAAqB,CAAC,kBAAkB,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAqB;IAErB,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,aAAa,EAAE,cAAc,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAkB,EAClB,OAAsB;IAEtB,IAAI,OAAO,KAAK,aAAa,CAAC,0BAA0B,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAqB,EACrB,OAAsB;IAEtB,OAAO,mBAAmB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,WAAW,CAAC,OAAsB;IACzC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,aAAa,CAAC,GAAG;YACpB,OAAO,CAAC,CAAC;QACX,KAAK,aAAa,CAAC,UAAU;YAC3B,OAAO,CAAC,CAAC;QACX,KAAK,aAAa,CAAC,KAAK,CAAC;QACzB,KAAK,aAAa,CAAC,0BAA0B;YAC3C,OAAO,CAAC,CAAC;QACX,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAkB;IAClC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,YAAY,CAAC,WAAW,CAAC;QAC9B,KAAK,YAAY,CAAC,yBAAyB;YACzC,OAAO,CAAC,CAAC;QACX,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,CAAC,CAAC;QACX,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,CAAC,CAAC;QACX,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,IAAI,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAqB,EACrB,UAAiC;IAEjC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,qBAAqB,CAAC,iBAAiB;YAC1C,OAAO,MAAM,EAAE,cAAc,KAAK,IAAI,CAAC;QACzC,KAAK,qBAAqB,CAAC,cAAc;YACvC,OAAO,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;QACtC,KAAK,qBAAqB,CAAC,mBAAmB;YAC5C,OAAO,MAAM,EAAE,gBAAgB,KAAK,IAAI,CAAC;QAC3C;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAqB;IAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,IAAI,MAAM,GAAG,oBAAoB,CAAC;IAClC,IAAI,MAAM,EAAE,WAAW,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,kBAAkB,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,EAAE,cAAc,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,qBAAqB,CAAC;IAClC,CAAC;IACD,IAAI,MAAM,EAAE,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,uBAAuB,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAqB;IAChD,OAAO,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,IAAI,kBAA4D,CAAC;AAEjE,SAAS,oBAAoB;IAC3B,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,kBAAkB,GAAG,IAAI,GAAG,CAC1B,qBAAqB,CAAC,MAAM;aACzB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;aAC9C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YACd,iBAAiB,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC;YACnD,KAAK,CAAC,MAAyB;SAChC,CAAC,CACL,CAAC;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,IAAI,aAAuD,CAAC;AAE5D;;;;;GAKG;AACH,SAAS,eAAe;IACtB,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,aAAa,GAAG,IAAI,GAAG,CACrB,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI;YACV,KAAK,CAAC,MAAyB;SAChC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC"}
+{"version":3,"file":"apiresource-meta.js","sourceRoot":"","sources":["../../src/pipeline/apiresource-meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,SAAS,GACV,MAAM,qFAAqF,CAAC;AAE7F,OAAO,EACL,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,wFAAwF,CAAC;AAGhG,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,iEAAiE;AACjE,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,8BAA8B,CAC5C,IAAqB;IAErB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;IAC/C,IACE,MAAM,EAAE,SAAS,KAAK,sBAAsB,CAAC,MAAM;QACnD,MAAM,CAAC,SAAS,KAAK,oBAAoB,CAAC,SAAS,EACnD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;AACpC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;IACtE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,CACL,eAAe,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,yBAAyB,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAqB;IAChD,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,KAAK,GACT,mBAAmB,CAAC,IAAI,CAAC;QACzB,mBAAmB,CAAC,eAAe,CAAC,yBAAyB,CAAC,CAAC;IACjE,OAAO,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAqB;IAErB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,OAAO,MAAM,EAAE,uBAAuB,KAAK,IAAI;QAC7C,CAAC,CAAC,qBAAqB,CAAC,cAAc;QACtC,CAAC,CAAC,qBAAqB,CAAC,kBAAkB,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAqB;IAErB,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,aAAa,EAAE,cAAc,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAkB,EAClB,OAAsB;IAEtB,IAAI,OAAO,KAAK,aAAa,CAAC,0BAA0B,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAqB,EACrB,OAAsB;IAEtB,OAAO,mBAAmB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,WAAW,CAAC,OAAsB;IACzC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,aAAa,CAAC,GAAG;YACpB,OAAO,CAAC,CAAC;QACX,KAAK,aAAa,CAAC,UAAU;YAC3B,OAAO,CAAC,CAAC;QACX,KAAK,aAAa,CAAC,KAAK,CAAC;QACzB,KAAK,aAAa,CAAC,0BAA0B;YAC3C,OAAO,CAAC,CAAC;QACX,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAkB;IAClC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,YAAY,CAAC,WAAW,CAAC;QAC9B,KAAK,YAAY,CAAC,yBAAyB;YACzC,OAAO,CAAC,CAAC;QACX,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,CAAC,CAAC;QACX,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,CAAC,CAAC;QACX,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,IAAI,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAqB,EACrB,UAAiC;IAEjC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,qBAAqB,CAAC,iBAAiB;YAC1C,OAAO,MAAM,EAAE,cAAc,KAAK,IAAI,CAAC;QACzC,KAAK,qBAAqB,CAAC,cAAc;YACvC,OAAO,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;QACtC,KAAK,qBAAqB,CAAC,mBAAmB;YAC5C,OAAO,MAAM,EAAE,gBAAgB,KAAK,IAAI,CAAC;QAC3C;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAqB;IAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,IAAI,MAAM,GAAG,oBAAoB,CAAC;IAClC,IAAI,MAAM,EAAE,WAAW,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,kBAAkB,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,EAAE,cAAc,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,qBAAqB,CAAC;IAClC,CAAC;IACD,IAAI,MAAM,EAAE,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,uBAAuB,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAqB;IAChD,OAAO,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,IAAI,kBAA4D,CAAC;AAEjE,SAAS,oBAAoB;IAC3B,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,kBAAkB,GAAG,IAAI,GAAG,CAC1B,qBAAqB,CAAC,MAAM;aACzB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;aAC9C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YACd,iBAAiB,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC;YACnD,KAAK,CAAC,MAAyB;SAChC,CAAC,CACL,CAAC;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,IAAI,aAAuD,CAAC;AAE5D;;;;;GAKG;AACH,SAAS,eAAe;IACtB,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,aAAa,GAAG,IAAI,GAAG,CACrB,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI;YACV,KAAK,CAAC,MAAyB;SAChC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/pipeline/steps/authorization-tuples.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-tuples.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/authorization-tuples.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAU3H,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EACV,0BAA0B,EAE1B,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,4CAA4C,CAAC;AAEpD;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,IAAI,CAAC,CAKf;AAGD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAYnD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,qBAAqB,GAC3B,WAAW,CAAC,oBAAoB,CAAC,CAgCnC;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,qBAAqB,EAC/B,QAAQ,EAAE,qBAAqB,GAC9B;IACD,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;IAC7D,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9D,CAUA;AAqHD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,MAAM,GACb,oBAAoB,GAAG,SAAS,CAkClC;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,SAAS,WAAW,EACvE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CAuBpB;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CAiCpB;AAED,uDAAuD;AACvD,eAAO,MAAM,kBAAkB,+BAA+B,CAAC;AAE/D;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,IAAI,SAAS,WAAW,EAC1E,WAAW,EAAE,MAAM,GAClB,YAAY,CAAC,IAAI,CAAC,CAYpB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,SAAS,WAAW,EACpE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,WAAW,EAAE,MAAM,GAClB,YAAY,CAAC,IAAI,CAAC,CAoCpB"}
+{"version":3,"file":"authorization-tuples.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/authorization-tuples.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAU3H,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EACV,0BAA0B,EAE1B,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,4CAA4C,CAAC;AAEpD;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,IAAI,CAAC,CAKf;AAGD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAYnD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,qBAAqB,GAC3B,WAAW,CAAC,oBAAoB,CAAC,CAgCnC;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,qBAAqB,EAC/B,QAAQ,EAAE,qBAAqB,GAC9B;IACD,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;IAC7D,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9D,CAUA;AAgGD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,MAAM,GACb,oBAAoB,GAAG,SAAS,CAkClC;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,SAAS,WAAW,EACvE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CAuBpB;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CAiCpB;AAED,uDAAuD;AACvD,eAAO,MAAM,kBAAkB,+BAA+B,CAAC;AAE/D;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,IAAI,SAAS,WAAW,EAC1E,WAAW,EAAE,MAAM,GAClB,YAAY,CAAC,IAAI,CAAC,CAYpB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,SAAS,WAAW,EACpE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,WAAW,EAAE,MAAM,GAClB,YAAY,CAAC,IAAI,CAAC,CAoCpB"}

package/dist/pipeline/steps/authorization-tuples.js

@@ -18,7 +18,7 @@ export async function notifyDefaultInstanceLinked(lifecycle, event) {
 import { getKindEnum, getKindMeta, getKindName } from "../apiresource-meta.js";
 import { internalError } from "../errors.js";
 import { EXISTING_RESOURCE_KEY } from "./load-existing.js";
-import { metadataOf } from "./shapes.js";
+import { metadataOf, parentIdOf } from "./shapes.js";
 // ---------------------------------------------------------------------------
 // Visibility shape policy — the reconciler's level→shape mapping, ported
 // from the Java VisibilityTupleReconciler (its unit-test matrix is
@@ -81,33 +81,14 @@ export function diffVisibilityShapes(kind, oldLevel, newLevel) {
     };
 }
 // ---------------------------------------------------------------------------
-// Parent-id resolution — the ParentIdExtractorRegistry port. Zero
-// hardcoded kind knowledge: the proto config names the spec field, this
-// module reads it structurally (protobuf-es spec messages are plain
-// objects whose properties are the camelCase proto field names).
+// Parent-id resolution — the ParentIdExtractorRegistry port. The spec-field
+// read itself is shapes.ts's `parentIdOf`, shared with the list read scope
+// (20260913.04 T04) so the id a tuple is written with and the id the scope
+// asks about are one read. This module adds the create-time rule: a
+// missing parent fails the request.
 // ---------------------------------------------------------------------------
-/** proto snake_case field name → the generated property name. */
-function camelCaseFieldName(specField) {
-    return specField.replace(/_([a-z0-9])/g, (_, ch) => ch.toUpperCase());
-}
-/**
- * Extracts the parent id named by the config from the resource's spec.
- * Returns "" for every miss (no spec, no field, non-string value) — the
- * caller decides whether that is fatal, exactly as Java's registry
- * returns null and the service throws.
- */
-function extractParentId(resource, specField) {
-    // Structural access is the shapes.ts idiom: spec messages are plain
-    // objects; the property name is the camelCase form of the proto field.
-    const spec = resource.spec;
-    if (spec === undefined) {
-        return "";
-    }
-    const value = spec[camelCaseFieldName(specField)];
-    return typeof value === "string" ? value : "";
-}
 function resolveParentLink(kind, resource, parentConfig) {
-    const parentId = extractParentId(resource, parentConfig.specField);
+    const parentId = parentIdOf(resource, parentConfig.specField);
     if (parentId === "") {
         // Java: "Parent ID required for X but not found" → the request fails.
         throw internalError(new Error(`parent id for relation '${parentConfig.relation}' (spec field '${parentConfig.specField}') is missing on ${getKindName(kind)}`), "failed to create authorization tuples");

package/dist/pipeline/steps/authorization-tuples.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-tuples.js","sourceRoot":"","sources":["../../../src/pipeline/steps/authorization-tuples.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAE/F,OAAO,EACL,sBAAsB,GAEvB,MAAM,wFAAwF,CAAC;AAgBhG;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,SAAqD,EACrD,KAAiC;IAEjC,IAAI,SAAS,EAAE,uBAAuB,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO;IACT,CAAC;IACD,MAAM,SAAS,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;AACjD,CAAC;AACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,8EAA8E;AAC9E,yEAAyE;AACzE,mEAAmE;AACnE,qCAAqC;AACrC,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAqB,EACrB,KAA4B;IAE5B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,MAAM,QAAQ,GACZ,MAAM,EAAE,uBAAuB,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC;IAC1E,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,qBAAqB,CAAC,cAAc;YACvC,IAAI,MAAM,EAAE,WAAW,KAAK,IAAI,EAAE,CAAC;gBACjC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC3B,CAAC;YACD,MAAM;QACR,KAAK,qBAAqB,CAAC,iBAAiB;YAC1C,IAAI,MAAM,EAAE,cAAc,KAAK,IAAI,EAAE,CAAC;gBACpC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC5B,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,MAAM;QACR,KAAK,qBAAqB,CAAC,mBAAmB;YAC5C,IAAI,MAAM,EAAE,gBAAgB,KAAK,IAAI,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;gBAC9B,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,MAAM;QACR;YACE,0DAA0D;YAC1D,MAAM;IACV,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAClC,IAAqB,EACrB,QAA+B,EAC/B,QAA+B;IAK/B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtD,OAAO;QACL,cAAc,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvE,cAAc,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACxE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,kEAAkE;AAClE,wEAAwE;AACxE,oEAAoE;AACpE,iEAAiE;AACjE,8EAA8E;AAE9E,iEAAiE;AACjE,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,OAAO,SAAS,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,QAAiB,EAAE,SAAiB;IAC3D,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,IAAI,GAAI,QAA0D,CAAC,IAAI,CAAC;IAC9E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;IAClD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAqB,EACrB,QAAiB,EACjB,YAAkC;IAElC,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,sEAAsE;QACtE,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,2BAA2B,YAAY,CAAC,QAAQ,kBAAkB,YAAY,CAAC,SAAS,oBAAoB,WAAW,CAAC,IAAI,CAAC,EAAE,CAChI,EACD,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC;QAC1C,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,IAAqB,EACrB,MAA2B,EAC3B,QAAiB,EACjB,KAAa,EACb,MAAc;IAEd,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,QAAQ,MAAM,CAAC,SAAS,EAAE,CAAC;QACzB,KAAK,sBAAsB,CAAC,YAAY,CAAC,CAAC,CAAC;YACzC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACjB,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,kEAAkE,WAAW,CAAC,IAAI,CAAC,EAAE,CACtF,EACD,uCAAuC,CACxC,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,cAAc;gBACxB,UAAU,EAAE,WAAW,CAAC,cAAc,CAAC;gBACvC,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAC;YACH,MAAM;QACR,CAAC;QACD,KAAK,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,GAAG,WAAW,CAAC,IAAI,CAAC,gDAAgD,CACrE,EACD,uCAAuC,CACxC,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7D,MAAM;QACR,CAAC;QACD,KAAK,sBAAsB,CAAC,UAAU;YACpC,MAAM;QACR,KAAK,sBAAsB,CAAC,QAAQ;YAClC,mEAAmE;YACnE,kEAAkE;YAClE,sDAAsD;YACtD,MAAM,CAAC,IAAI,CAAC,wDAAwD,EAAE;gBACpE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC;aACxB,CAAC,CAAC;YACH,MAAM;QACR;YACE,MAAM;IACV,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAqB,EACrB,QAAiB,EACjB,MAAsB,EACtB,MAAc;IAEd,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;IAC/C,IACE,MAAM,KAAK,SAAS;QACpB,MAAM,CAAC,SAAS,KAAK,sBAAsB,CAAC,IAAI;QAChD,MAAM,CAAC,SAAS,KAAK,sBAAsB,CAAC,WAAW,EACvD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,yCAAyC,CAAC,EACpD,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI;QACJ,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,KAAK,EAAE,QAAQ,CAAC,GAAG;QACnB,MAAM;QACN,gBAAgB,EAAE,MAAM,CAAC,SAAS;QAClC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,WAAW,EAAE,kBAAkB,CAC7B,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,QAAQ,CAAC,GAAG,EACZ,MAAM,CACP;QACD,mEAAmE;QACnE,oCAAoC;QACpC,gBAAgB,EAAE,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;KACtE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAC9C,SAAqD,EACrD,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,2BAA2B;QACjC,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,2BAA2B,CACvC,GAAG,CAAC,eAAe,EACnB,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,cAAc,EAClB,MAAM,CACP,CAAC;YACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,uCAAuC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAqD,EACrD,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAEhC,CAAC;YACd,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;YACnC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjD,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,iBAAiB,CAAC;oBAChC,IAAI,EAAE,GAAG,CAAC,eAAe;oBACzB,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,KAAK,EAAE,QAAQ,CAAC,GAAG;oBACnB,MAAM,EAAE,GAAG,CAAC,cAAc;iBAC3B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CACT,iEAAiE,EACjE;oBACE,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC;oBACtC,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CACF,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CACjD,WAAmB;IAEnB,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,OAAO,CAAC,GAAyB;YAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAiC,CAAC;YACtE,GAAG,CAAC,GAAG,CACL,kBAAkB,EAClB,QAAQ,EAAE,QAAQ,EAAE,UAAU;gBAC5B,qBAAqB,CAAC,mCAAmC,CAC5D,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,SAAqD,EACrD,WAAmB;IAEnB,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAiC,CAAC;YACtE,MAAM,QAAQ,GAAG,QAAQ,EAAE,QAAQ,CAAC;YACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjD,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GACX,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAuC;gBAClE,qBAAqB,CAAC,mCAAmC,CAAC;YAC5D,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,oBAAoB,CAC7D,GAAG,CAAC,eAAe,EACnB,QAAQ,EACR,QAAQ,CAAC,UAAU,CACpB,CAAC;YACF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/D,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,mBAAmB,CAAC;oBAClC,IAAI,EAAE,GAAG,CAAC,eAAe;oBACzB,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,KAAK,EAAE,QAAQ,CAAC,GAAG;oBACnB,cAAc;oBACd,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authorization-tuples.js","sourceRoot":"","sources":["../../../src/pipeline/steps/authorization-tuples.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAE/F,OAAO,EACL,sBAAsB,GAEvB,MAAM,wFAAwF,CAAC;AAgBhG;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,SAAqD,EACrD,KAAiC;IAEjC,IAAI,SAAS,EAAE,uBAAuB,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO;IACT,CAAC;IACD,MAAM,SAAS,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;AACjD,CAAC;AACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,8EAA8E;AAC9E,yEAAyE;AACzE,mEAAmE;AACnE,qCAAqC;AACrC,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAqB,EACrB,KAA4B;IAE5B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,MAAM,QAAQ,GACZ,MAAM,EAAE,uBAAuB,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC;IAC1E,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,qBAAqB,CAAC,cAAc;YACvC,IAAI,MAAM,EAAE,WAAW,KAAK,IAAI,EAAE,CAAC;gBACjC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC3B,CAAC;YACD,MAAM;QACR,KAAK,qBAAqB,CAAC,iBAAiB;YAC1C,IAAI,MAAM,EAAE,cAAc,KAAK,IAAI,EAAE,CAAC;gBACpC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC5B,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,MAAM;QACR,KAAK,qBAAqB,CAAC,mBAAmB;YAC5C,IAAI,MAAM,EAAE,gBAAgB,KAAK,IAAI,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;gBAC9B,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,MAAM;QACR;YACE,0DAA0D;YAC1D,MAAM;IACV,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAClC,IAAqB,EACrB,QAA+B,EAC/B,QAA+B;IAK/B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtD,OAAO;QACL,cAAc,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvE,cAAc,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACxE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,oEAAoE;AACpE,oCAAoC;AACpC,8EAA8E;AAE9E,SAAS,iBAAiB,CACxB,IAAqB,EACrB,QAAiB,EACjB,YAAkC;IAElC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,sEAAsE;QACtE,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,2BAA2B,YAAY,CAAC,QAAQ,kBAAkB,YAAY,CAAC,SAAS,oBAAoB,WAAW,CAAC,IAAI,CAAC,EAAE,CAChI,EACD,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC;QAC1C,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,IAAqB,EACrB,MAA2B,EAC3B,QAAiB,EACjB,KAAa,EACb,MAAc;IAEd,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,QAAQ,MAAM,CAAC,SAAS,EAAE,CAAC;QACzB,KAAK,sBAAsB,CAAC,YAAY,CAAC,CAAC,CAAC;YACzC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACjB,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,kEAAkE,WAAW,CAAC,IAAI,CAAC,EAAE,CACtF,EACD,uCAAuC,CACxC,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,cAAc;gBACxB,UAAU,EAAE,WAAW,CAAC,cAAc,CAAC;gBACvC,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAC;YACH,MAAM;QACR,CAAC;QACD,KAAK,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,GAAG,WAAW,CAAC,IAAI,CAAC,gDAAgD,CACrE,EACD,uCAAuC,CACxC,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7D,MAAM;QACR,CAAC;QACD,KAAK,sBAAsB,CAAC,UAAU;YACpC,MAAM;QACR,KAAK,sBAAsB,CAAC,QAAQ;YAClC,mEAAmE;YACnE,kEAAkE;YAClE,sDAAsD;YACtD,MAAM,CAAC,IAAI,CAAC,wDAAwD,EAAE;gBACpE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC;aACxB,CAAC,CAAC;YACH,MAAM;QACR;YACE,MAAM;IACV,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAqB,EACrB,QAAiB,EACjB,MAAsB,EACtB,MAAc;IAEd,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;IAC/C,IACE,MAAM,KAAK,SAAS;QACpB,MAAM,CAAC,SAAS,KAAK,sBAAsB,CAAC,IAAI;QAChD,MAAM,CAAC,SAAS,KAAK,sBAAsB,CAAC,WAAW,EACvD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,yCAAyC,CAAC,EACpD,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI;QACJ,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,KAAK,EAAE,QAAQ,CAAC,GAAG;QACnB,MAAM;QACN,gBAAgB,EAAE,MAAM,CAAC,SAAS;QAClC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,WAAW,EAAE,kBAAkB,CAC7B,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,QAAQ,CAAC,GAAG,EACZ,MAAM,CACP;QACD,mEAAmE;QACnE,oCAAoC;QACpC,gBAAgB,EAAE,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;KACtE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAC9C,SAAqD,EACrD,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,2BAA2B;QACjC,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,2BAA2B,CACvC,GAAG,CAAC,eAAe,EACnB,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,cAAc,EAClB,MAAM,CACP,CAAC;YACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,uCAAuC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAqD,EACrD,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAEhC,CAAC;YACd,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;YACnC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjD,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,iBAAiB,CAAC;oBAChC,IAAI,EAAE,GAAG,CAAC,eAAe;oBACzB,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,KAAK,EAAE,QAAQ,CAAC,GAAG;oBACnB,MAAM,EAAE,GAAG,CAAC,cAAc;iBAC3B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CACT,iEAAiE,EACjE;oBACE,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC;oBACtC,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CACF,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CACjD,WAAmB;IAEnB,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,OAAO,CAAC,GAAyB;YAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAiC,CAAC;YACtE,GAAG,CAAC,GAAG,CACL,kBAAkB,EAClB,QAAQ,EAAE,QAAQ,EAAE,UAAU;gBAC5B,qBAAqB,CAAC,mCAAmC,CAC5D,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,SAAqD,EACrD,WAAmB;IAEnB,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAiC,CAAC;YACtE,MAAM,QAAQ,GAAG,QAAQ,EAAE,QAAQ,CAAC;YACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjD,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GACX,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAuC;gBAClE,qBAAqB,CAAC,mCAAmC,CAAC;YAC5D,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,oBAAoB,CAC7D,GAAG,CAAC,eAAe,EACnB,QAAQ,EACR,QAAQ,CAAC,UAAU,CACpB,CAAC;YACF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/D,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,mBAAmB,CAAC;oBAClC,IAAI,EAAE,GAAG,CAAC,eAAe;oBACzB,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,KAAK,EAAE,QAAQ,CAAC,GAAG;oBACnB,cAAc;oBACd,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/pipeline/steps/shapes.d.ts

@@ -16,6 +16,24 @@ export interface HasValueShape {
 export declare function metadataOf(msg: Message): ApiResourceMetadata | undefined;
 /** The ID-wrapper's value ("" when absent) — Go HasValue.GetValue(). */
 export declare function idValueOf(msg: Message): string;
+/**
+ * The parent id a `kind_meta` ParentRelationConfig names by `spec_field`,
+ * read from the resource's spec — the ParentIdExtractorRegistry port, with
+ * zero hardcoded kind knowledge: the proto config names the field, this
+ * reads it structurally (spec messages are plain objects whose properties
+ * are the camelCase proto field names). Returns "" for every miss (no
+ * spec, no field, non-string value); the caller decides whether that is
+ * fatal — the tuple lifecycle throws at create (Java's registry returned
+ * null and the service threw), the list scope carries no parent.
+ *
+ * ONE reader for both: the id the authorization tuple was written with is
+ * the id the list scope later asks the authorization backend about, so
+ * the two cannot drift (20260913.04 T04). Takes `object` rather than
+ * `Message` because the list lanes hand the scope structurally-typed rows
+ * and their unit suite hands it plain objects — the same posture
+ * `metadataOf` takes behind its cast.
+ */
+export declare function parentIdOf(resource: object, specField: string): string;
 /** A message-typed field, statically narrowed so get()/set() type-check. */
 export type MessageDescField = Extract<DescField, {
     fieldKind: "message";

package/dist/pipeline/steps/shapes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shapes.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/shapes.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4DAA4D,CAAC;AAEtG,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,mBAAmB,GAAG,SAAS,CAExE;AAED,wEAAwE;AACxE,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAG9C;AAED,4EAA4E;AAC5E,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,EAAE;IAAE,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC,CAAC;AAE5E;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,GACX,gBAAgB,GAAG,SAAS,CAK9B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,OAAO,GACX,cAAc,GAAG,SAAS,CAO5B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,OAAO,GACX,cAAc,GAAG,SAAS,CAU5B;AAED,gFAAgF;AAChF,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAI3D"}
+{"version":3,"file":"shapes.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/shapes.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4DAA4D,CAAC;AAEtG,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,mBAAmB,GAAG,SAAS,CAExE;AAED,wEAAwE;AACxE,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAG9C;AAOD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAOtE;AAED,4EAA4E;AAC5E,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,EAAE;IAAE,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC,CAAC;AAE5E;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,GACX,gBAAgB,GAAG,SAAS,CAK9B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,OAAO,GACX,cAAc,GAAG,SAAS,CAO5B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,OAAO,GACX,cAAc,GAAG,SAAS,CAU5B;AAED,gFAAgF;AAChF,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAI3D"}

package/dist/pipeline/steps/shapes.js

@@ -22,6 +22,35 @@ export function idValueOf(msg) {
     const value = msg.value;
     return typeof value === "string" ? value : "";
 }
+/** proto snake_case field name → the generated property name. */
+function camelCaseFieldName(specField) {
+    return specField.replace(/_([a-z0-9])/g, (_, ch) => ch.toUpperCase());
+}
+/**
+ * The parent id a `kind_meta` ParentRelationConfig names by `spec_field`,
+ * read from the resource's spec — the ParentIdExtractorRegistry port, with
+ * zero hardcoded kind knowledge: the proto config names the field, this
+ * reads it structurally (spec messages are plain objects whose properties
+ * are the camelCase proto field names). Returns "" for every miss (no
+ * spec, no field, non-string value); the caller decides whether that is
+ * fatal — the tuple lifecycle throws at create (Java's registry returned
+ * null and the service threw), the list scope carries no parent.
+ *
+ * ONE reader for both: the id the authorization tuple was written with is
+ * the id the list scope later asks the authorization backend about, so
+ * the two cannot drift (20260913.04 T04). Takes `object` rather than
+ * `Message` because the list lanes hand the scope structurally-typed rows
+ * and their unit suite hands it plain objects — the same posture
+ * `metadataOf` takes behind its cast.
+ */
+export function parentIdOf(resource, specField) {
+    const spec = resource.spec;
+    if (spec === undefined) {
+        return "";
+    }
+    const value = spec[camelCaseFieldName(specField)];
+    return typeof value === "string" ? value : "";
+}
 /**
  * Finds a singular message field by proto name with the narrowing TS needs
  * to give ReflectMessage out of get() — the reflection idiom every helper

package/dist/pipeline/steps/shapes.js.map

@@ -1 +1 @@
-{"version":3,"file":"shapes.js","sourceRoot":"","sources":["../../../src/pipeline/steps/shapes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAgBrD;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,OAAQ,GAAmC,CAAC,QAAQ,CAAC;AACvD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,MAAM,KAAK,GAAI,GAAyC,CAAC,KAAK,CAAC;IAC/D,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAKD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAmB,EACnB,IAAY;IAEZ,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QACzD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAmB,EACnB,GAAY;IAEZ,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAmB,EACnB,GAAY;IAEZ,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,cAAc,CAAC,MAAmB;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CACxD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"shapes.js","sourceRoot":"","sources":["../../../src/pipeline/steps/shapes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAgBrD;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,OAAQ,GAAmC,CAAC,QAAQ,CAAC;AACvD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,MAAM,KAAK,GAAI,GAAyC,CAAC,KAAK,CAAC;IAC/D,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,iEAAiE;AACjE,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,OAAO,SAAS,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,SAAiB;IAC5D,MAAM,IAAI,GAAI,QAA+C,CAAC,IAAI,CAAC;IACnE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;IAClD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAKD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAmB,EACnB,IAAY;IAEZ,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QACzD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAmB,EACnB,GAAY;IAEZ,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAmB,EACnB,GAAY;IAEZ,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,cAAc,CAAC,MAAmB;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CACxD,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/server",
-  "version": "3.15.3-dev.20260914100347",
+  "version": "3.15.3-dev.20260914121148",
   "description": "The Stigmer OSS control plane as a composable library: composeServer, the extension registry and the driver seams a composition builds on. The self-contained deployable of the same server is @stigmer/server-slim.",
   "license": "Apache-2.0",
   "type": "module",
@@ -62,9 +62,9 @@
     "@connectrpc/connect-node": "^2.0.0",
     "@kubernetes/client-node": "2.0.0",
     "@opentelemetry/api": "^1.9.0",
-    "@stigmer/protos": "3.15.3-dev.20260914100347",
-    "@stigmer/temporal-codecs": "3.15.3-dev.20260914100347",
-    "@stigmer/zip-structure": "3.15.3-dev.20260914100347",
+    "@stigmer/protos": "3.15.3-dev.20260914121148",
+    "@stigmer/temporal-codecs": "3.15.3-dev.20260914121148",
+    "@stigmer/zip-structure": "3.15.3-dev.20260914121148",
     "@temporalio/activity": "1.16.2",
     "@temporalio/client": "1.16.2",
     "@temporalio/common": "1.16.2",

package/src/extensions/__tests__/list-read-scope.test.ts

@@ -14,6 +14,12 @@
  *     a fraction of the candidates);
  *   - the candidates carry {id, org, labels} — the driver's guest
  *     cookie rule keys on labels;
+ *   - a kind whose authorization is its parent's (kind_meta PARENT scope
+ *     + INHERITED owner; agent_execution → session) carries
+ *     `authorizationParent` on every candidate whose spec names it, the
+ *     same ResolvedParentLink the tuple lifecycle wrote; every other kind
+ *     and every parentless row carries none (stigmer-cloud 20260913.04
+ *     T04);
  *   - a scope failure PROPAGATES — never an empty result (the outage
  *     contract: empty means "authorized to see nothing", outage means
  *     INTERNAL through the caller's sanitized arm).
@@ -155,6 +161,138 @@ describe("restrictListByReadScope", () => {
     ]);
   });
 
+  describe("authorizationParent — the parent a kind's authorization is (20260913.04 T04)", () => {
+    function recordingScope(keep: ReadonlyArray<string>) {
+      const seen: ReadonlyArray<ListEntryMeta>[] = [];
+      const scope: ListReadScope = {
+        authorizedResourceIds: () => Promise.resolve(new Set<string>()),
+        restrictListEntries: (_caller, _kind, entries) => {
+          seen.push(entries);
+          return Promise.resolve(new Set(keep));
+        },
+      };
+      return { scope, seen };
+    }
+
+    it("an agent_execution candidate carries its session as the ResolvedParentLink the tuple lifecycle wrote", async () => {
+      const executions = [
+        {
+          metadata: { id: "aex_1", org: "acme", labels: {} },
+          spec: { sessionId: "ses_a" },
+        },
+        {
+          metadata: { id: "aex_2", org: "acme", labels: {} },
+          spec: { sessionId: "ses_a" },
+        },
+        {
+          metadata: { id: "aex_3", org: "acme", labels: {} },
+          spec: { sessionId: "ses_b" },
+        },
+      ];
+      const { scope, seen } = recordingScope(["aex_1", "aex_3"]);
+      const kept = await restrictListByReadScope(
+        scope,
+        caller,
+        ApiResourceKind.agent_execution,
+        executions,
+        "",
+      );
+      expect(kept.map((r) => r.metadata.id)).toEqual(["aex_1", "aex_3"]);
+      expect(seen[0]).toEqual([
+        {
+          id: "aex_1",
+          org: "acme",
+          labels: {},
+          authorizationParent: {
+            relation: "session",
+            parentKind: ApiResourceKind.session,
+            parentId: "ses_a",
+          },
+        },
+        {
+          id: "aex_2",
+          org: "acme",
+          labels: {},
+          authorizationParent: {
+            relation: "session",
+            parentKind: ApiResourceKind.session,
+            parentId: "ses_a",
+          },
+        },
+        {
+          id: "aex_3",
+          org: "acme",
+          labels: {},
+          authorizationParent: {
+            relation: "session",
+            parentKind: ApiResourceKind.session,
+            parentId: "ses_b",
+          },
+        },
+      ]);
+    });
+
+    it("a row whose spec does not name its parent carries no parent — offered as itself, never dropped", async () => {
+      const executions = [
+        { metadata: { id: "aex_orphan", org: "acme", labels: {} }, spec: {} },
+        { metadata: { id: "aex_specless", org: "acme", labels: {} } },
+      ];
+      const { scope, seen } = recordingScope(["aex_orphan", "aex_specless"]);
+      const kept = await restrictListByReadScope(
+        scope,
+        caller,
+        ApiResourceKind.agent_execution,
+        executions,
+        "",
+      );
+      expect(kept.map((r) => r.metadata.id)).toEqual([
+        "aex_orphan",
+        "aex_specless",
+      ]);
+      expect(seen[0]).toEqual([
+        { id: "aex_orphan", org: "acme", labels: {} },
+        { id: "aex_specless", org: "acme", labels: {} },
+      ]);
+    });
+
+    it("a kind whose authorization is its own carries no parent even when its spec names one", async () => {
+      // A workflow_execution links its workflow_instance (an additional
+      // parent, partial opt-in inheritance) and owns itself: not the pair.
+      const runs = [
+        {
+          metadata: { id: "wex_1", org: "acme", labels: {} },
+          spec: { workflowInstanceId: "wfi_1" },
+        },
+      ];
+      const { scope, seen } = recordingScope(["wex_1"]);
+      await restrictListByReadScope(
+        scope,
+        caller,
+        ApiResourceKind.workflow_execution,
+        runs,
+        "",
+      );
+      expect(seen[0]).toEqual([{ id: "wex_1", org: "acme", labels: {} }]);
+    });
+
+    it("no scope composed = the input unchanged, the parent never resolved", async () => {
+      const executions = [
+        {
+          metadata: { id: "aex_1", org: "acme", labels: {} },
+          spec: { sessionId: "ses_a" },
+        },
+      ];
+      const kept = await restrictListByReadScope(
+        undefined,
+        caller,
+        ApiResourceKind.agent_execution,
+        executions,
+        "acme",
+      );
+      expect(kept).toEqual(executions);
+    });
+  });
+
   it("a scope failure propagates — never an empty result", async () => {
     const failing: ListReadScope = {
       authorizedResourceIds: () => Promise.reject(new Error("fga down")),

package/src/extensions/list-read-scope.ts

@@ -71,21 +71,61 @@
  *     untouched with the org unconsulted (the first line above). Two lanes
  *     have no org on the wire (`session.list`, `apiKey.findAll`) and offer
  *     the kind until P1 entry 12 pages them.
+ *   - A KIND WHOSE AUTHORIZATION IS ITS PARENT'S CARRIES THAT PARENT ON
+ *     EVERY CANDIDATE (stigmer-cloud 20260913.04 T04, Q-LB-33..36). When
+ *     `kind_meta` declares PARENT scope with INHERITED owner
+ *     (`inheritedAuthorizationParentOf`; today agent_execution → session),
+ *     the helper fills `ListEntryMeta.authorizationParent` from the row's
+ *     spec through the same read the tuple lifecycle wrote the parent link
+ *     with. A driver MAY answer the parent's question in place of the
+ *     child's: by the model's construction the two answers are identical
+ *     (the child's `owner`, `viewer` and `can_view` are all `from` the
+ *     parent), and the parent's resolution is direct tuples where the
+ *     child's walks the parent's whole set (OpenFGA's learned `weight2`
+ *     strategy read the founder's 423 sessions per execution; that is what
+ *     rolled back twice on 2026-09-14). A driver that ignores the field is
+ *     still correct. The one observable difference is stated, not hidden:
+ *     a row whose parent tuple never landed (the create chain's "row
+ *     survives, tuple write failed" state, healed by retry) is hidden by
+ *     the child's check and shown by the parent's — the row's truth, read
+ *     from the field the tuple was derived from, and no widening: nobody
+ *     reaches a parent through it who could not create the row in it.
  */
 import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 
+// The first VALUE imports from extensions/ into pipeline/ (every other
+// crossing is a type): two pure leaf modules that import nothing but
+// protos, so there is no cycle. Deliberate — one resolver for the tuple
+// writer and the list reader beats a copy in the seam.
+import {
+  getKindEnum,
+  inheritedAuthorizationParentOf,
+} from "../pipeline/apiresource-meta.js";
+import { parentIdOf } from "../pipeline/steps/shapes.js";
+
 import type { CallerIdentity } from "./identity.js";
+import type { ResolvedParentLink } from "./resource-authorization.js";
 
 /**
  * The candidate metadata a post-scan lane offers the scope — the three
  * fields the cloud driver's rules key on (id for the FGA intersection,
  * labels for the guest cookie rule; org rides along for symmetry with
- * the consumer-owned intersection, so a driver can log or assert on it).
+ * the consumer-owned intersection, so a driver can log or assert on it),
+ * plus the parent for kinds whose authorization is their parent's.
  */
 export interface ListEntryMeta {
   readonly id: string;
   readonly org: string;
   readonly labels: Readonly<Record<string, string>>;
+  /**
+   * OPTIONAL (added 20260913.04 T04): the parent this row's authorization
+   * IS — present only for a kind whose `kind_meta` is PARENT scope with
+   * INHERITED owner (the header's last contract line), the same
+   * `ResolvedParentLink` the tuple lifecycle wrote for the row. Absent for
+   * every other kind, and absent when the row's spec does not name its
+   * parent — a driver then asks about the row itself, never drops it.
+   */
+  readonly authorizationParent?: ResolvedParentLink;
 }
 
 /** The scope contract (single-instance point, ExtensionDrivers.listReadScope). */
@@ -117,7 +157,10 @@ export interface ListReadScope {
 
 /**
  * The shape every stored API resource message presents to the shared
- * helper — the metadata fields the scope's candidates are built from.
+ * helper — the metadata fields the scope's candidates are built from, and
+ * the spec the parent is read from (structurally, by `kind_meta`'s
+ * `spec_field`; typed loosely because the field differs per kind and the
+ * read is `parentIdOf`'s).
  */
 export interface ScopedListResource {
   metadata?: {
@@ -125,6 +168,7 @@ export interface ScopedListResource {
     org?: string;
     labels?: Record<string, string>;
   };
+  spec?: object;
 }
 
 /**
@@ -141,8 +185,11 @@ export interface ScopedListResource {
  *     permission-bounded across orgs, verified per lane in the entry's
  *     census — lanes Java does not org-narrow pass ""), then to the kept
  *     ids. The same set either way (both are per-row predicates); the
- *     order is the header's last contract line: the scope sees the org's
- *     rows, not the kind's.
+ *     order is the header's second-to-last contract line: the scope sees
+ *     the org's rows, not the kind's;
+ *   - the candidates of a kind whose authorization is its parent's carry
+ *     `authorizationParent` (the header's last line), resolved once per
+ *     call from `kind_meta` and once per row from the spec.
  */
 export async function restrictListByReadScope<T extends ScopedListResource>(
   scope: ListReadScope | undefined,
@@ -158,11 +205,42 @@ export async function restrictListByReadScope<T extends ScopedListResource>(
     requestOrg === ""
       ? resources
       : resources.filter((resource) => resource.metadata?.org === requestOrg);
-  const entries: ListEntryMeta[] = offered.map((resource) => ({
-    id: resource.metadata?.id ?? "",
-    org: resource.metadata?.org ?? "",
-    labels: resource.metadata?.labels ?? {},
-  }));
+  const parentOf = authorizationParentReader(kind);
+  const entries: ListEntryMeta[] = offered.map((resource) => {
+    const entry: ListEntryMeta = {
+      id: resource.metadata?.id ?? "",
+      org: resource.metadata?.org ?? "",
+      labels: resource.metadata?.labels ?? {},
+    };
+    const authorizationParent = parentOf(resource);
+    return authorizationParent === undefined
+      ? entry
+      : { ...entry, authorizationParent };
+  });
   const keptIds = await scope.restrictListEntries(caller, kind, entries);
   return offered.filter((resource) => keptIds.has(resource.metadata?.id ?? ""));
 }
+
+/**
+ * The per-row parent reader for `kind`: a constant `undefined` for the 27
+ * kinds whose authorization is their own, and for the kind whose
+ * authorization is its parent's, the `ResolvedParentLink` the tuple
+ * lifecycle wrote — or undefined for a row whose spec does not name it
+ * (never a throw: a list is not a create). `kind_meta` is consulted once
+ * per call, not once per row.
+ */
+function authorizationParentReader(
+  kind: ApiResourceKind,
+): (resource: ScopedListResource) => ResolvedParentLink | undefined {
+  const parent = inheritedAuthorizationParentOf(kind);
+  if (parent === undefined) {
+    return () => undefined;
+  }
+  const parentKind = getKindEnum(parent.kind);
+  return (resource) => {
+    const parentId = parentIdOf(resource, parent.specField);
+    return parentId === ""
+      ? undefined
+      : { relation: parent.relation, parentKind, parentId };
+  };
+}

package/src/pipeline/__tests__/inherited-authorization-parent.test.ts

@@ -0,0 +1,51 @@
+/**
+ * Pins `inheritedAuthorizationParentOf` (pipeline/apiresource-meta.ts):
+ * the kind_meta question "is this kind's authorization its parent's
+ * whole?", answered by the PARENT-scope + INHERITED-owner pair and by
+ * nothing else (stigmer-cloud 20260913.04 T04, Q-LB-34).
+ *
+ * The table below is the WHOLE kind enum, on purpose. The list read scope
+ * carries `authorizationParent` for exactly the kinds this function names,
+ * and a composed driver asks its authorization backend about the parent
+ * in the child's place — so a second kind joining the set is a change in
+ * what that driver checks, and must arrive as a reviewed edit of this
+ * table, never as a silent consequence of a kind_meta edit. Kinds with
+ * additional parents whose inheritance is partial (workflow_execution's
+ * opt-in `execution_viewer from workflow_instance`, agent_instance's
+ * `viewer from default_of`) own themselves and are pinned as `undefined`.
+ */
+import { describe, expect, it } from "vitest";
+
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+
+import { inheritedAuthorizationParentOf } from "../apiresource-meta.js";
+
+describe("inheritedAuthorizationParentOf — the parent a kind's authorization is", () => {
+  it("agent_execution's authorization is its session's: relation `session`, spec field `session_id`", () => {
+    const parent = inheritedAuthorizationParentOf(
+      ApiResourceKind.agent_execution,
+    );
+    expect(parent).toBeDefined();
+    expect(parent?.kind).toBe("session");
+    expect(parent?.relation).toBe("session");
+    expect(parent?.specField).toBe("session_id");
+  });
+
+  it("every other kind's authorization is its own (the whole enum, pinned)", () => {
+    const inherited = Object.values(ApiResourceKind)
+      .filter((value): value is ApiResourceKind => typeof value === "number")
+      .filter((kind) => kind !== ApiResourceKind.api_resource_kind_unknown)
+      .filter((kind) => inheritedAuthorizationParentOf(kind) !== undefined)
+      .map((kind) => ApiResourceKind[kind]);
+    expect(inherited).toEqual(["agent_execution"]);
+  });
+
+  it.each([
+    ApiResourceKind.workflow_execution,
+    ApiResourceKind.agent_instance,
+    ApiResourceKind.workflow_instance,
+    ApiResourceKind.memory,
+  ])("a kind with an additional, partial parent owns itself: %s", (kind) => {
+    expect(inheritedAuthorizationParentOf(kind)).toBeUndefined();
+  });
+});

package/src/pipeline/apiresource-meta.ts

@@ -53,6 +53,11 @@ import {
   kind_meta,
 } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { ApiResourceKindMeta } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import {
+  AuthorizationScopeType,
+  OwnerAttributionType,
+} from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
+import type { ParentRelationConfig } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
 import type { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
 
@@ -65,6 +70,38 @@ export function getKindMeta(kind: ApiResourceKind): ApiResourceKindMeta {
   return getOption(valueDesc, kind_meta);
 }
 
+/**
+ * The parent a kind's authorization IS — the `kind_meta` declaration that
+ * a kind's permissions are its parent's whole, not its own: PARENT scope
+ * (the one structural link is to that parent) AND INHERITED owner (no
+ * owner tuple of its own; `owner from <parent>` in the FGA model).
+ * Undefined for every other kind, including kinds with additional parents
+ * whose inheritance is partial (a workflow_execution's opt-in
+ * `execution_viewer from workflow_instance` sits beside its own owner).
+ *
+ * Today exactly one kind answers: agent_execution → session (its
+ * `can_view` is `viewer or can_view from session`, and `viewer` is the
+ * session's). The list read scope reads this to carry the parent on every
+ * candidate (`ListEntryMeta.authorizationParent`, 20260913.04 T04), so a
+ * composed driver may ask its authorization backend about the parent —
+ * direct tuples — instead of the child, whose resolution walks the
+ * parent's whole set. A second kind declaring the pair gets the behavior
+ * from this declaration alone; the table pin in __tests__ makes that a
+ * reviewed change.
+ */
+export function inheritedAuthorizationParentOf(
+  kind: ApiResourceKind,
+): ParentRelationConfig | undefined {
+  const config = getKindMeta(kind).authorization;
+  if (
+    config?.scopeType !== AuthorizationScopeType.PARENT ||
+    config.ownerType !== OwnerAttributionType.INHERITED
+  ) {
+    return undefined;
+  }
+  return config.parent;
+}
+
 /** Go GetIdPrefix: e.g. agent → "agt". */
 export function getIdPrefix(kind: ApiResourceKind): string {
   return getKindMeta(kind).idPrefix;

package/src/pipeline/steps/authorization-tuples.ts

@@ -78,7 +78,7 @@ import type { PipelineStep } from "../pipeline.js";
 import type { RequestContext } from "../request-context.js";
 import { EXISTING_RESOURCE_KEY } from "./load-existing.js";
 import type { HasMetadataShape } from "./shapes.js";
-import { metadataOf } from "./shapes.js";
+import { metadataOf, parentIdOf } from "./shapes.js";
 
 // ---------------------------------------------------------------------------
 // Visibility shape policy — the reconciler's level→shape mapping, ported
@@ -156,40 +156,19 @@ export function diffVisibilityShapes(
 }
 
 // ---------------------------------------------------------------------------
-// Parent-id resolution — the ParentIdExtractorRegistry port. Zero
-// hardcoded kind knowledge: the proto config names the spec field, this
-// module reads it structurally (protobuf-es spec messages are plain
-// objects whose properties are the camelCase proto field names).
+// Parent-id resolution — the ParentIdExtractorRegistry port. The spec-field
+// read itself is shapes.ts's `parentIdOf`, shared with the list read scope
+// (20260913.04 T04) so the id a tuple is written with and the id the scope
+// asks about are one read. This module adds the create-time rule: a
+// missing parent fails the request.
 // ---------------------------------------------------------------------------
 
-/** proto snake_case field name → the generated property name. */
-function camelCaseFieldName(specField: string): string {
-  return specField.replace(/_([a-z0-9])/g, (_, ch: string) => ch.toUpperCase());
-}
-
-/**
- * Extracts the parent id named by the config from the resource's spec.
- * Returns "" for every miss (no spec, no field, non-string value) — the
- * caller decides whether that is fatal, exactly as Java's registry
- * returns null and the service throws.
- */
-function extractParentId(resource: Message, specField: string): string {
-  // Structural access is the shapes.ts idiom: spec messages are plain
-  // objects; the property name is the camelCase form of the proto field.
-  const spec = (resource as unknown as { spec?: Record<string, unknown> }).spec;
-  if (spec === undefined) {
-    return "";
-  }
-  const value = spec[camelCaseFieldName(specField)];
-  return typeof value === "string" ? value : "";
-}
-
 function resolveParentLink(
   kind: ApiResourceKind,
   resource: Message,
   parentConfig: ParentRelationConfig,
 ): ResolvedParentLink {
-  const parentId = extractParentId(resource, parentConfig.specField);
+  const parentId = parentIdOf(resource, parentConfig.specField);
   if (parentId === "") {
     // Java: "Parent ID required for X but not found" → the request fails.
     throw internalError(

package/src/pipeline/steps/shapes.ts

@@ -39,6 +39,37 @@ export function idValueOf(msg: Message): string {
   return typeof value === "string" ? value : "";
 }
 
+/** proto snake_case field name → the generated property name. */
+function camelCaseFieldName(specField: string): string {
+  return specField.replace(/_([a-z0-9])/g, (_, ch: string) => ch.toUpperCase());
+}
+
+/**
+ * The parent id a `kind_meta` ParentRelationConfig names by `spec_field`,
+ * read from the resource's spec — the ParentIdExtractorRegistry port, with
+ * zero hardcoded kind knowledge: the proto config names the field, this
+ * reads it structurally (spec messages are plain objects whose properties
+ * are the camelCase proto field names). Returns "" for every miss (no
+ * spec, no field, non-string value); the caller decides whether that is
+ * fatal — the tuple lifecycle throws at create (Java's registry returned
+ * null and the service threw), the list scope carries no parent.
+ *
+ * ONE reader for both: the id the authorization tuple was written with is
+ * the id the list scope later asks the authorization backend about, so
+ * the two cannot drift (20260913.04 T04). Takes `object` rather than
+ * `Message` because the list lanes hand the scope structurally-typed rows
+ * and their unit suite hands it plain objects — the same posture
+ * `metadataOf` takes behind its cast.
+ */
+export function parentIdOf(resource: object, specField: string): string {
+  const spec = (resource as { spec?: Record<string, unknown> }).spec;
+  if (spec === undefined) {
+    return "";
+  }
+  const value = spec[camelCaseFieldName(specField)];
+  return typeof value === "string" ? value : "";
+}
+
 /** A message-typed field, statically narrowed so get()/set() type-check. */
 export type MessageDescField = Extract<DescField, { fieldKind: "message" }>;