@stigmer/server 3.15.3-dev.20260914100347 → 3.15.3-dev.20260916211208

package/dist/extensions/schedule-fire-caller.d.ts

@@ -2,32 +2,59 @@
  * The schedule-fire caller seam (stigmer-cloud#572) — WHO a schedule fire
  * acts as when the RunStarter re-enters the execution create pipeline.
  *
- * OSS deliberately has no caller identity on this lane (DD-015 D-G: the
- * single-user edition has no tokens to carry one), so with no driver
- * composed every fire enters as the in-process `internal` class — today's
- * behavior, byte-identical. The cloud edition's Java baseline instead
- * mints a schedule JWT per fire (sub = the org's system-schedule account,
- * claim = the firing Schedule id) so the created session and execution
- * carry real attribution and the schedule's viewer set reaches the run
- * (the FGA model's session#schedule link — "without it a scheduled run is
- * invisible to every human, including the schedule's owner"). This seam
- * lets a composition supply that identity; the fire then propagates it
- * through the R5 caller-propagation header exactly like the other
- * request-origin in-process creates.
+ * With no driver composed a fire enters as the in-process `internal`
+ * class — the trusted-local laptop's lane, where the one caller is the
+ * server's operator and attribution has nobody to separate. Under an
+ * authentication posture that lane is wrong: the internal class carries
+ * the operator's email or `"system"`, which no enforcing evaluator
+ * recognizes as a person, so the fired session would belong to nobody
+ * (the FGA model's own words — "without it a scheduled run is invisible
+ * to every human, including the schedule's owner"). Two drivers answer
+ * it: the cloud edition mints a schedule JWT per fire (sub = the org's
+ * system-schedule account, claim = the firing Schedule id) so the run
+ * reaches the schedule's viewer set through the session#schedule link;
+ * open source, under the built-in authorization posture, makes the fire
+ * act as the schedule's CREATOR (authorization/schedule-fire-caller.ts),
+ * so the run and its session are that person's. The fire then propagates
+ * the identity through the R5 caller-propagation header exactly like the
+ * other request-origin in-process creates.
  *
  * Single-instance point. The mint is per fire — the schedule id is a
- * claim of the minted credential, never a cached field — and a mint
- * failure is an infrastructure fault: the RunStarter lets it propagate,
- * so the tick activity retries (the deterministic execution name absorbs
- * the retry) and a manual trigger surfaces the failure to its caller.
+ * claim of the minted credential, never a cached field. Two failure
+ * shapes, and the RunStarter tells them apart by type, the store-fault
+ * precedent (`ResourceNotFoundError` is checked with `instanceof`; every
+ * other fault is infrastructure):
+ *
+ *   - any other thrown error is an INFRASTRUCTURE fault: the RunStarter
+ *     lets it propagate, so the tick activity retries (the deterministic
+ *     execution name absorbs the retry) and a manual trigger surfaces
+ *     the failure to its caller;
+ *   - `ScheduleFireCallerRefusedError` is a DETERMINISTIC refusal — this
+ *     fire can act as nobody, and no retry will change that (a schedule
+ *     stamped by no person this server knows). The RunStarter answers
+ *     the `refused` outcome the way it answers a launch gate's refusal:
+ *     the failure streak counts it and pauses the schedule with the
+ *     reason, so the person who scheduled it sees why in the console
+ *     instead of a tick failing quietly forever.
  */
 import type { CallerIdentity } from "./identity.js";
 export interface ScheduleFireCallerMint {
     /**
      * Mints the caller identity one fire acts as. `rawToken` must carry the
-     * edition's verifiable credential for the identity (compositions read
-     * fire-scoped claims — e.g. the schedule id — from it downstream).
+     * edition's verifiable credential for the identity when the edition
+     * reads fire-scoped claims from it downstream (the cloud does — the
+     * schedule id); an edition that propagates the identity in-process and
+     * reads nothing off the token leaves it empty (open source does).
      */
     mintFireCaller(org: string, scheduleId: string): Promise<CallerIdentity>;
 }
+/**
+ * The mint's deterministic refusal (the module header): thrown by a
+ * driver when the fire can act as nobody and retrying cannot help. The
+ * message is the reason the schedule's status carries, so it is written
+ * for the person who scheduled the run.
+ */
+export declare class ScheduleFireCallerRefusedError extends Error {
+    constructor(reason: string);
+}
 //# sourceMappingURL=schedule-fire-caller.d.ts.map

package/dist/extensions/schedule-fire-caller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schedule-fire-caller.d.ts","sourceRoot":"","sources":["../../src/extensions/schedule-fire-caller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1E"}
+{"version":3,"file":"schedule-fire-caller.d.ts","sourceRoot":"","sources":["../../src/extensions/schedule-fire-caller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1E;AAED;;;;;GAKG;AACH,qBAAa,8BAA+B,SAAQ,KAAK;gBAC3C,MAAM,EAAE,MAAM;CAI3B"}

package/dist/extensions/schedule-fire-caller.js

@@ -1,2 +1,13 @@
-export {};
+/**
+ * The mint's deterministic refusal (the module header): thrown by a
+ * driver when the fire can act as nobody and retrying cannot help. The
+ * message is the reason the schedule's status carries, so it is written
+ * for the person who scheduled the run.
+ */
+export class ScheduleFireCallerRefusedError extends Error {
+    constructor(reason) {
+        super(reason);
+        this.name = "ScheduleFireCallerRefusedError";
+    }
+}
 //# sourceMappingURL=schedule-fire-caller.js.map

package/dist/extensions/schedule-fire-caller.js.map

@@ -1 +1 @@
-{"version":3,"file":"schedule-fire-caller.js","sourceRoot":"","sources":["../../src/extensions/schedule-fire-caller.ts"],"names":[],"mappings":""}
+{"version":3,"file":"schedule-fire-caller.js","sourceRoot":"","sources":["../../src/extensions/schedule-fire-caller.ts"],"names":[],"mappings":"AAoDA;;;;;GAKG;AACH,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACvD,YAAY,MAAc;QACxB,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF"}

package/dist/index.d.ts

@@ -69,8 +69,18 @@ export type { AuthorizationQueryEngine } from "./extensions/authorization-querie
 export type { IdentityFederation } from "./extensions/identity-federation.js";
 export type { AccountsBySubject } from "./domain/identityaccount/resolve.js";
 export { identityIdForSubject } from "./domain/identityaccount/resolve.js";
+export type { DerivedRelation, KindDeclaration, Rewrite, SubjectType, } from "./authorization/model/rewrite.js";
+export type { Model } from "./authorization/model/index.js";
+export { builtInModel, declarationFor, newModel, } from "./authorization/model/index.js";
+export type { CheckContext, ObjectRef, Person, Subject, Tuple, TupleSource, } from "./authorization/tuples.js";
+export type { EvaluationFault } from "./authorization/evaluator.js";
+export { AuthorizationEvaluationError, MAX_RESOLUTION_DEPTH, checkRelation, } from "./authorization/evaluator.js";
+export type { StoreTestCase, StoreTestDocument, StoreTestKit, StoreTestSkip, StoreTestSkipReason, } from "./authorization/store-test-kit.js";
+export { parseStoreTestDocument, storeTestCases, } from "./authorization/store-test-kit.js";
+export { NOT_FOUND_EXEMPT_KINDS } from "./authorization/authorizer.js";
 export type { ListReadScope, ListEntryMeta, } from "./extensions/list-read-scope.js";
 export type { ScheduleFireCallerMint } from "./extensions/schedule-fire-caller.js";
+export { ScheduleFireCallerRefusedError } from "./extensions/schedule-fire-caller.js";
 export type { VisitorErrorPolicy } from "./pipeline/interceptors/error-boundary.js";
 export { createErrorBoundaryInterceptor } from "./pipeline/interceptors/error-boundary.js";
 export { diffVisibilityShapes, visibilityShapesFor, } from "./pipeline/steps/authorization-tuples.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,YAAY,EACV,QAAQ,EACR,SAAS,EACT,MAAM,EACN,aAAa,EACb,QAAQ,EACR,OAAO,GACR,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,4BAA4B,EAC5B,kBAAkB,EAClB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AASlC,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAOjE,YAAY,EACV,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAIzE,YAAY,EACV,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAChD,YAAY,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAO3E,YAAY,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAI1E,YAAY,EACV,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAU1F,YAAY,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,YAAY,EACV,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,YAAY,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,YAAY,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACtF,YAAY,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,YAAY,EACV,aAAa,EACb,aAAa,GACd,MAAM,iCAAiC,CAAC;AAIzC,YAAY,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AASnF,YAAY,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAGlD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAKxD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAgBzC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAOjF,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAKtE,YAAY,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAK9B,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAWhE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,YAAY,EACV,eAAe,EACf,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAIrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,YAAY,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAMvE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAKjG,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AACrG,YAAY,EACV,wBAAwB,EAKxB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EAKxB,qBAAqB,GACtB,MAAM,4CAA4C,CAAC;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAcpC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAMzD,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAS9E,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAQrE,YAAY,EACV,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,0CAA0C,CAAC;AAOlD,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,YAAY,EACV,QAAQ,EACR,SAAS,EACT,MAAM,EACN,aAAa,EACb,QAAQ,EACR,OAAO,GACR,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,4BAA4B,EAC5B,kBAAkB,EAClB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AASlC,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAOjE,YAAY,EACV,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAIzE,YAAY,EACV,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAChD,YAAY,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAO3E,YAAY,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAI1E,YAAY,EACV,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAU1F,YAAY,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,YAAY,EACV,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,YAAY,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,YAAY,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACtF,YAAY,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAO3E,YAAY,EACV,eAAe,EACf,eAAe,EACf,OAAO,EACP,WAAW,GACZ,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EACL,YAAY,EACZ,cAAc,EACd,QAAQ,GACT,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,YAAY,EACZ,SAAS,EACT,MAAM,EACN,OAAO,EACP,KAAK,EACL,WAAW,GACZ,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,aAAa,GACd,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,sBAAsB,EACtB,cAAc,GACf,MAAM,mCAAmC,CAAC;AAI3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,YAAY,EACV,aAAa,EACb,aAAa,GACd,MAAM,iCAAiC,CAAC;AAMzC,YAAY,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AAStF,YAAY,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAGlD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAKxD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAgBzC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAOjF,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAKtE,YAAY,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAK9B,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAWhE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,YAAY,EACV,eAAe,EACf,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAIrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,YAAY,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAMvE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAKjG,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AACrG,YAAY,EACV,wBAAwB,EAKxB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EAKxB,qBAAqB,GACtB,MAAM,4CAA4C,CAAC;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAcpC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAMzD,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAS9E,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAQrE,YAAY,EACV,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,0CAA0C,CAAC;AAOlD,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -49,6 +49,14 @@ export { identityAccountStoreContract } from "./domain/identityaccount/store-con
 export { DuplicatePolicyError } from "./domain/iampolicy/store.js";
 export { iamPolicyStoreContract } from "./domain/iampolicy/store-contract.js";
 export { identityIdForSubject } from "./domain/identityaccount/resolve.js";
+export { builtInModel, declarationFor, newModel, } from "./authorization/model/index.js";
+export { AuthorizationEvaluationError, MAX_RESOLUTION_DEPTH, checkRelation, } from "./authorization/evaluator.js";
+export { parseStoreTestDocument, storeTestCases, } from "./authorization/store-test-kit.js";
+// The kinds whose missing row the built-in authorizer denies instead of
+// answering not-found — the cloud's probe exemption over the open-source
+// tier; exported so the cloud's drift test pins the two sets equal.
+export { NOT_FOUND_EXEMPT_KINDS } from "./authorization/authorizer.js";
+export { ScheduleFireCallerRefusedError } from "./extensions/schedule-fire-caller.js";
 export { createErrorBoundaryInterceptor } from "./pipeline/interceptors/error-boundary.js";
 export { diffVisibilityShapes, visibilityShapesFor, } from "./pipeline/steps/authorization-tuples.js";
 export { RequestContext } from "./pipeline/request-context.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,wCAAwC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAiEhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAQ3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAQ1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAW1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAKnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAK9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAkB3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAIlD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,yEAAyE;AACzE,+DAA+D;AAC/D,wEAAwE;AACxE,QAAQ;AACR,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,gEAAgE;AAChE,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,sEAAsE;AACtE,qEAAqE;AACrE,6DAA6D;AAC7D,iEAAiE;AACjE,wEAAwE;AACxE,iEAAiE;AACjE,yEAAyE;AACzE,+DAA+D;AAC/D,yEAAyE;AACzE,8DAA8D;AAC9D,wEAAwE;AACxE,uEAAuE;AACvE,mEAAmE;AACnE,2DAA2D;AAC3D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,+DAA+D;AAC/D,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,oEAAoE;AACpE,wEAAwE;AACxE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kDAAkD;AAClD,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,0EAA0E;AAC1E,uEAAuE;AACvE,oEAAoE;AACpE,uEAAuE;AACvE,oEAAoE;AACpE,wCAAwC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAMtE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAM9B,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAO1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAQvE,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AAkBrG,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,qEAAqE;AACrE,6DAA6D;AAC7D,uEAAuE;AACvE,qEAAqE;AACrE,gEAAgE;AAChE,0EAA0E;AAC1E,qEAAqE;AACrE,uEAAuE;AACvE,iEAAiE;AACjE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AAepC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAE9E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,kDAAkD;AAClD,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AA0BrE,oEAAoE;AACpE,yEAAyE;AACzE,iDAAiD;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,wCAAwC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAiEhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAQ3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAQ1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAW1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAKnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAK9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAc3E,OAAO,EACL,YAAY,EACZ,cAAc,EACd,QAAQ,GACT,MAAM,gCAAgC,CAAC;AAUxC,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,aAAa,GACd,MAAM,8BAA8B,CAAC;AAQtC,OAAO,EACL,sBAAsB,EACtB,cAAc,GACf,MAAM,mCAAmC,CAAC;AAC3C,wEAAwE;AACxE,yEAAyE;AACzE,oEAAoE;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAWvE,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AAUtF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAIlD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,yEAAyE;AACzE,+DAA+D;AAC/D,wEAAwE;AACxE,QAAQ;AACR,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,gEAAgE;AAChE,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,sEAAsE;AACtE,qEAAqE;AACrE,6DAA6D;AAC7D,iEAAiE;AACjE,wEAAwE;AACxE,iEAAiE;AACjE,yEAAyE;AACzE,+DAA+D;AAC/D,yEAAyE;AACzE,8DAA8D;AAC9D,wEAAwE;AACxE,uEAAuE;AACvE,mEAAmE;AACnE,2DAA2D;AAC3D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,+DAA+D;AAC/D,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,oEAAoE;AACpE,wEAAwE;AACxE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kDAAkD;AAClD,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,0EAA0E;AAC1E,uEAAuE;AACvE,oEAAoE;AACpE,uEAAuE;AACvE,oEAAoE;AACpE,wCAAwC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAMtE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAM9B,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAO1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAQvE,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AAkBrG,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,qEAAqE;AACrE,6DAA6D;AAC7D,uEAAuE;AACvE,qEAAqE;AACrE,gEAAgE;AAChE,0EAA0E;AAC1E,qEAAqE;AACrE,uEAAuE;AACvE,iEAAiE;AACjE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AAepC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAE9E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,kDAAkD;AAClD,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AA0BrE,oEAAoE;AACpE,yEAAyE;AACzE,iDAAiD;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/pipeline/apiresource-labels.d.ts

@@ -8,9 +8,12 @@
  * instances) but never to GRANT anything. Where a grant-shaped decision is
  * needed, key it on server-owned state instead (e.g. the parent blueprint's
  * status.default_instance_id, written only by the create/self-heal flows).
- * The cloud edition additionally guards the whole reserved namespace at its
- * write boundaries (GuardReservedLabelsStep); OSS has no such guard, which
- * is one of the reasons OSS predicates must not trust these labels alone.
+ * Every write boundary runs GuardReservedLabels over the namespace
+ * (pipeline/steps/guard-reserved-labels.ts), but the open-source
+ * authorizer's permissive default ALLOWS reserved-label writes by design
+ * (the self-hosted operator owns the store), which is why a restrict-shaped
+ * predicate here still pairs the label with server-owned state: the
+ * plugin-managed guard refuses only beside an existing plugin row.
  */
 import type { ApiResourceMetadata } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
 /**
@@ -39,6 +42,23 @@ export declare const SYSTEM_MANAGED_LABEL = "stigmer.ai/system-managed";
  * read by the predicates here.
  */
 export declare const RESERVED_LABEL_TRUE = "true";
+/**
+ * The plugin that materialised a resource: the label's value is the
+ * plugin's id (`plg_...`), never its slug, because `findAllByLabel` is
+ * org-agnostic and two organizations may both install `thermos`. Written
+ * only by the plugin controller (in-process, as the installing caller);
+ * membership is derived on read from it and stored nowhere else.
+ */
+export declare const PLUGIN_LABEL = "stigmer.ai/plugin";
+/**
+ * The archive digest a member was last materialised from — the per-child
+ * convergence marker. A re-push compares every member's value with the
+ * head's digest before deciding it has nothing to do, so a member another
+ * lane deleted or an older install left behind is re-materialised.
+ */
+export declare const PLUGIN_VERSION_LABEL = "stigmer.ai/plugin-version";
+/** The plugin id a resource's labels claim, or undefined when unlabelled. */
+export declare function pluginIdOf(metadata: ApiResourceMetadata | undefined): string | undefined;
 /**
  * Whether the metadata carries the DEFAULT_INSTANCE_LABEL marker
  * (undefined-safe) — Go IsDefaultInstance.

package/dist/pipeline/apiresource-labels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiresource-labels.d.ts","sourceRoot":"","sources":["../../src/pipeline/apiresource-labels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4DAA4D,CAAC;AAEtG;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,gCAA6C,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,8BAA2C,CAAC;AAE7E;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAE1C;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,mBAAmB,GAAG,SAAS,GACxC,OAAO,CAET"}
+{"version":3,"file":"apiresource-labels.d.ts","sourceRoot":"","sources":["../../src/pipeline/apiresource-labels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4DAA4D,CAAC;AAEtG;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,gCAA6C,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,8BAA2C,CAAC;AAE7E;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAE1C;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,sBAAmC,CAAC;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,8BAA2C,CAAC;AAE7E,6EAA6E;AAC7E,wBAAgB,UAAU,CACxB,QAAQ,EAAE,mBAAmB,GAAG,SAAS,GACxC,MAAM,GAAG,SAAS,CAGpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,mBAAmB,GAAG,SAAS,GACxC,OAAO,CAET"}

package/dist/pipeline/apiresource-labels.js

@@ -24,6 +24,26 @@ export const SYSTEM_MANAGED_LABEL = `${RESERVED_LABEL_PREFIX}system-managed`;
  * read by the predicates here.
  */
 export const RESERVED_LABEL_TRUE = "true";
+/**
+ * The plugin that materialised a resource: the label's value is the
+ * plugin's id (`plg_...`), never its slug, because `findAllByLabel` is
+ * org-agnostic and two organizations may both install `thermos`. Written
+ * only by the plugin controller (in-process, as the installing caller);
+ * membership is derived on read from it and stored nowhere else.
+ */
+export const PLUGIN_LABEL = `${RESERVED_LABEL_PREFIX}plugin`;
+/**
+ * The archive digest a member was last materialised from — the per-child
+ * convergence marker. A re-push compares every member's value with the
+ * head's digest before deciding it has nothing to do, so a member another
+ * lane deleted or an older install left behind is re-materialised.
+ */
+export const PLUGIN_VERSION_LABEL = `${RESERVED_LABEL_PREFIX}plugin-version`;
+/** The plugin id a resource's labels claim, or undefined when unlabelled. */
+export function pluginIdOf(metadata) {
+    const value = metadata?.labels[PLUGIN_LABEL];
+    return value === undefined || value === "" ? undefined : value;
+}
 /**
  * Whether the metadata carries the DEFAULT_INSTANCE_LABEL marker
  * (undefined-safe) — Go IsDefaultInstance.

package/dist/pipeline/apiresource-labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiresource-labels.js","sourceRoot":"","sources":["../../src/pipeline/apiresource-labels.ts"],"names":[],"mappings":"AAgBA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,qBAAqB,kBAAkB,CAAC;AAEjF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,qBAAqB,gBAAgB,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAyC;IAEzC,OAAO,QAAQ,EAAE,MAAM,CAAC,sBAAsB,CAAC,KAAK,mBAAmB,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"apiresource-labels.js","sourceRoot":"","sources":["../../src/pipeline/apiresource-labels.ts"],"names":[],"mappings":"AAmBA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,qBAAqB,kBAAkB,CAAC;AAEjF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,qBAAqB,gBAAgB,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,qBAAqB,QAAQ,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,qBAAqB,gBAAgB,CAAC;AAE7E,6EAA6E;AAC7E,MAAM,UAAU,UAAU,CACxB,QAAyC;IAEzC,MAAM,KAAK,GAAG,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7C,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAyC;IAEzC,OAAO,QAAQ,EAAE,MAAM,CAAC,sBAAsB,CAAC,KAAK,mBAAmB,CAAC;AAC1E,CAAC"}

package/dist/pipeline/apiresource-meta.d.ts

@@ -1,10 +1,31 @@
 import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import { ApiResourceKind, ResourceTier } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { ApiResourceKindMeta } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { ParentRelationConfig } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
 import type { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
 /** Go GetKindMeta: the kind_meta extension of the enum value. */
 export declare function getKindMeta(kind: ApiResourceKind): ApiResourceKindMeta;
+/**
+ * The parent a kind's authorization IS — the `kind_meta` declaration that
+ * a kind's permissions are its parent's whole, not its own: PARENT scope
+ * (the one structural link is to that parent) AND INHERITED owner (no
+ * owner tuple of its own; `owner from <parent>` in the FGA model).
+ * Undefined for every other kind, including kinds with additional parents
+ * whose inheritance is partial (a workflow_execution's opt-in
+ * `execution_viewer from workflow_instance` sits beside its own owner).
+ *
+ * Today exactly one kind answers: agent_execution → session (its
+ * `can_view` is `viewer or can_view from session`, and `viewer` is the
+ * session's). The list read scope reads this to carry the parent on every
+ * candidate (`ListEntryMeta.authorizationParent`, 20260913.04 T04), so a
+ * composed driver may ask its authorization backend about the parent —
+ * direct tuples — instead of the child, whose resolution walks the
+ * parent's whole set. A second kind declaring the pair gets the behavior
+ * from this declaration alone; the table pin in __tests__ makes that a
+ * reviewed change.
+ */
+export declare function inheritedAuthorizationParentOf(kind: ApiResourceKind): ParentRelationConfig | undefined;
 /** Go GetIdPrefix: e.g. agent → "agt". */
 export declare function getIdPrefix(kind: ApiResourceKind): string;
 /** Go GetKindName: the canonical name, e.g. agent → "Agent" (error copy uses this). */

package/dist/pipeline/apiresource-meta.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiresource-meta.d.ts","sourceRoot":"","sources":["../../src/pipeline/apiresource-meta.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EACL,eAAe,EAEf,YAAY,EAEb,MAAM,qFAAqF,CAAC;AAC7F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qFAAqF,CAAC;AAC/H,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,mBAAmB,CAMtE;AAED,0CAA0C;AAC1C,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAEzD;AAED,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,CAS9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAI7D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAO1D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,GACpB,qBAAqB,CAKvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,GACpB,aAAa,CAAC,OAAO,CAAC,CAMxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,aAAa,GACrB,OAAO,CAKT;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,aAAa,GACrB,OAAO,CAET;AAkCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAYT;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAavE"}
+{"version":3,"file":"apiresource-meta.d.ts","sourceRoot":"","sources":["../../src/pipeline/apiresource-meta.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EACL,eAAe,EAEf,YAAY,EAEb,MAAM,qFAAqF,CAAC;AAC7F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qFAAqF,CAAC;AAK/H,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wFAAwF,CAAC;AACnI,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,mBAAmB,CAMtE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,eAAe,GACpB,oBAAoB,GAAG,SAAS,CASlC;AAED,0CAA0C;AAC1C,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAEzD;AAED,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,CAS9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAI7D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAO1D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,GACpB,qBAAqB,CAKvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,GACpB,aAAa,CAAC,OAAO,CAAC,CAMxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,aAAa,GACrB,OAAO,CAKT;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,aAAa,GACrB,OAAO,CAET;AAkCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAYT;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAavE"}

package/dist/pipeline/apiresource-meta.js

@@ -45,6 +45,7 @@
 import { getOption, hasOption } from "@bufbuild/protobuf";
 import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import { ApiResourceKind, ApiResourceKindSchema, ResourceTier, kind_meta, } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { AuthorizationScopeType, OwnerAttributionType, } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
 import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
 /** Go GetKindMeta: the kind_meta extension of the enum value. */
 export function getKindMeta(kind) {
@@ -54,6 +55,33 @@ export function getKindMeta(kind) {
     }
     return getOption(valueDesc, kind_meta);
 }
+/**
+ * The parent a kind's authorization IS — the `kind_meta` declaration that
+ * a kind's permissions are its parent's whole, not its own: PARENT scope
+ * (the one structural link is to that parent) AND INHERITED owner (no
+ * owner tuple of its own; `owner from <parent>` in the FGA model).
+ * Undefined for every other kind, including kinds with additional parents
+ * whose inheritance is partial (a workflow_execution's opt-in
+ * `execution_viewer from workflow_instance` sits beside its own owner).
+ *
+ * Today exactly one kind answers: agent_execution → session (its
+ * `can_view` is `viewer or can_view from session`, and `viewer` is the
+ * session's). The list read scope reads this to carry the parent on every
+ * candidate (`ListEntryMeta.authorizationParent`, 20260913.04 T04), so a
+ * composed driver may ask its authorization backend about the parent —
+ * direct tuples — instead of the child, whose resolution walks the
+ * parent's whole set. A second kind declaring the pair gets the behavior
+ * from this declaration alone; the table pin in __tests__ makes that a
+ * reviewed change.
+ */
+export function inheritedAuthorizationParentOf(kind) {
+    const config = getKindMeta(kind).authorization;
+    if (config?.scopeType !== AuthorizationScopeType.PARENT ||
+        config.ownerType !== OwnerAttributionType.INHERITED) {
+        return undefined;
+    }
+    return config.parent;
+}
 /** Go GetIdPrefix: e.g. agent → "agt". */
 export function getIdPrefix(kind) {
     return getKindMeta(kind).idPrefix;

package/dist/pipeline/apiresource-meta.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiresource-meta.js","sourceRoot":"","sources":["../../src/pipeline/apiresource-meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,SAAS,GACV,MAAM,qFAAqF,CAAC;AAG7F,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,iEAAiE;AACjE,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;AACpC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;IACtE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,CACL,eAAe,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,yBAAyB,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAqB;IAChD,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,KAAK,GACT,mBAAmB,CAAC,IAAI,CAAC;QACzB,mBAAmB,CAAC,eAAe,CAAC,yBAAyB,CAAC,CAAC;IACjE,OAAO,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAqB;IAErB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,OAAO,MAAM,EAAE,uBAAuB,KAAK,IAAI;QAC7C,CAAC,CAAC,qBAAqB,CAAC,cAAc;QACtC,CAAC,CAAC,qBAAqB,CAAC,kBAAkB,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAqB;IAErB,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,aAAa,EAAE,cAAc,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAkB,EAClB,OAAsB;IAEtB,IAAI,OAAO,KAAK,aAAa,CAAC,0BAA0B,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAqB,EACrB,OAAsB;IAEtB,OAAO,mBAAmB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,WAAW,CAAC,OAAsB;IACzC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,aAAa,CAAC,GAAG;YACpB,OAAO,CAAC,CAAC;QACX,KAAK,aAAa,CAAC,UAAU;YAC3B,OAAO,CAAC,CAAC;QACX,KAAK,aAAa,CAAC,KAAK,CAAC;QACzB,KAAK,aAAa,CAAC,0BAA0B;YAC3C,OAAO,CAAC,CAAC;QACX,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAkB;IAClC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,YAAY,CAAC,WAAW,CAAC;QAC9B,KAAK,YAAY,CAAC,yBAAyB;YACzC,OAAO,CAAC,CAAC;QACX,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,CAAC,CAAC;QACX,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,CAAC,CAAC;QACX,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,IAAI,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAqB,EACrB,UAAiC;IAEjC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,qBAAqB,CAAC,iBAAiB;YAC1C,OAAO,MAAM,EAAE,cAAc,KAAK,IAAI,CAAC;QACzC,KAAK,qBAAqB,CAAC,cAAc;YACvC,OAAO,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;QACtC,KAAK,qBAAqB,CAAC,mBAAmB;YAC5C,OAAO,MAAM,EAAE,gBAAgB,KAAK,IAAI,CAAC;QAC3C;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAqB;IAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,IAAI,MAAM,GAAG,oBAAoB,CAAC;IAClC,IAAI,MAAM,EAAE,WAAW,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,kBAAkB,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,EAAE,cAAc,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,qBAAqB,CAAC;IAClC,CAAC;IACD,IAAI,MAAM,EAAE,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,uBAAuB,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAqB;IAChD,OAAO,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,IAAI,kBAA4D,CAAC;AAEjE,SAAS,oBAAoB;IAC3B,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,kBAAkB,GAAG,IAAI,GAAG,CAC1B,qBAAqB,CAAC,MAAM;aACzB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;aAC9C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YACd,iBAAiB,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC;YACnD,KAAK,CAAC,MAAyB;SAChC,CAAC,CACL,CAAC;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,IAAI,aAAuD,CAAC;AAE5D;;;;;GAKG;AACH,SAAS,eAAe;IACtB,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,aAAa,GAAG,IAAI,GAAG,CACrB,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI;YACV,KAAK,CAAC,MAAyB;SAChC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC"}
+{"version":3,"file":"apiresource-meta.js","sourceRoot":"","sources":["../../src/pipeline/apiresource-meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,SAAS,GACV,MAAM,qFAAqF,CAAC;AAE7F,OAAO,EACL,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,wFAAwF,CAAC;AAGhG,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,iEAAiE;AACjE,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,8BAA8B,CAC5C,IAAqB;IAErB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;IAC/C,IACE,MAAM,EAAE,SAAS,KAAK,sBAAsB,CAAC,MAAM;QACnD,MAAM,CAAC,SAAS,KAAK,oBAAoB,CAAC,SAAS,EACnD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;AACpC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;IACtE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,CACL,eAAe,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,yBAAyB,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAqB;IAChD,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,KAAK,GACT,mBAAmB,CAAC,IAAI,CAAC;QACzB,mBAAmB,CAAC,eAAe,CAAC,yBAAyB,CAAC,CAAC;IACjE,OAAO,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAqB;IAErB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,OAAO,MAAM,EAAE,uBAAuB,KAAK,IAAI;QAC7C,CAAC,CAAC,qBAAqB,CAAC,cAAc;QACtC,CAAC,CAAC,qBAAqB,CAAC,kBAAkB,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAqB;IAErB,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,aAAa,EAAE,cAAc,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAkB,EAClB,OAAsB;IAEtB,IAAI,OAAO,KAAK,aAAa,CAAC,0BAA0B,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAqB,EACrB,OAAsB;IAEtB,OAAO,mBAAmB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,WAAW,CAAC,OAAsB;IACzC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,aAAa,CAAC,GAAG;YACpB,OAAO,CAAC,CAAC;QACX,KAAK,aAAa,CAAC,UAAU;YAC3B,OAAO,CAAC,CAAC;QACX,KAAK,aAAa,CAAC,KAAK,CAAC;QACzB,KAAK,aAAa,CAAC,0BAA0B;YAC3C,OAAO,CAAC,CAAC;QACX,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAkB;IAClC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,YAAY,CAAC,WAAW,CAAC;QAC9B,KAAK,YAAY,CAAC,yBAAyB;YACzC,OAAO,CAAC,CAAC;QACX,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,CAAC,CAAC;QACX,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,CAAC,CAAC;QACX,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,IAAI,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAqB,EACrB,UAAiC;IAEjC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,qBAAqB,CAAC,iBAAiB;YAC1C,OAAO,MAAM,EAAE,cAAc,KAAK,IAAI,CAAC;QACzC,KAAK,qBAAqB,CAAC,cAAc;YACvC,OAAO,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;QACtC,KAAK,qBAAqB,CAAC,mBAAmB;YAC5C,OAAO,MAAM,EAAE,gBAAgB,KAAK,IAAI,CAAC;QAC3C;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAqB;IAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,IAAI,MAAM,GAAG,oBAAoB,CAAC;IAClC,IAAI,MAAM,EAAE,WAAW,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,kBAAkB,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,EAAE,cAAc,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,qBAAqB,CAAC;IAClC,CAAC;IACD,IAAI,MAAM,EAAE,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,uBAAuB,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAqB;IAChD,OAAO,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,IAAI,kBAA4D,CAAC;AAEjE,SAAS,oBAAoB;IAC3B,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,kBAAkB,GAAG,IAAI,GAAG,CAC1B,qBAAqB,CAAC,MAAM;aACzB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;aAC9C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YACd,iBAAiB,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC;YACnD,KAAK,CAAC,MAAyB;SAChC,CAAC,CACL,CAAC;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,IAAI,aAAuD,CAAC;AAE5D;;;;;GAKG;AACH,SAAS,eAAe;IACtB,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,aAAa,GAAG,IAAI,GAAG,CACrB,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI;YACV,KAAK,CAAC,MAAyB;SAChC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/pipeline/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/pipeline/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,4CAA4C;AAC5C,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,YAAY,CAExE;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAElE;AAED,sDAAsD;AACtD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,YAAY,CAE7E;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAErE;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAE1D;AAED,qEAAqE;AACrE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,CAE3E;AA2BD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAE/C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,YAAY,GAClB,YAAY,CAKd;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAE3D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY,CAErE"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/pipeline/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,4CAA4C;AAC5C,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,YAAY,CAExE;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAElE;AAED,sDAAsD;AACtD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,YAAY,CAK7E;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAErE;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAE1D;AAED,qEAAqE;AACrE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,CAE3E;AA2BD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAE/C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,YAAY,GAClB,YAAY,CAEd;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAE3D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY,CAErE"}

package/dist/pipeline/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/pipeline/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,4CAA4C;AAC5C,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,EAAU;IACxD,OAAO,IAAI,YAAY,CAAC,GAAG,QAAQ,eAAe,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;AACzD,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,EAAU;IAC7D,OAAO,IAAI,YAAY,CAAC,GAAG,QAAQ,oBAAoB,EAAE,EAAE,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;AACnF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAC5D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,OAAe;IAC3D,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,eAAe,GAAmC;IACtD,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS;IACzB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,iBAAiB;IACzC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,kBAAkB;IAC3C,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,eAAe;IACrC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,kBAAkB;IAC3C,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,mBAAmB;IAC7C,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,oBAAoB;IAC/C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS;IACzB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,YAAY;IAC/B,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,eAAe;IACrC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,aAAa;IACjC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,iBAAiB;CAC1C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAU;IACrC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,KAAmB;IAEnB,OAAO,IAAI,YAAY,CACrB,GAAG,MAAM,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,EACtC,KAAK,CAAC,IAAI,CACX,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAAmB;IACjD,OAAO,qBAAqB,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,UAAU,EAAE,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAmB;IACrD,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/pipeline/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,4CAA4C;AAC5C,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,EAAU;IACxD,OAAO,IAAI,YAAY,CAAC,GAAG,QAAQ,eAAe,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;AACzD,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,EAAU;IAC7D,OAAO,IAAI,YAAY,CACrB,GAAG,QAAQ,oBAAoB,EAAE,EAAE,EACnC,IAAI,CAAC,aAAa,CACnB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAC5D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,OAAe;IAC3D,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,eAAe,GAAmC;IACtD,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS;IACzB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,iBAAiB;IACzC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,kBAAkB;IAC3C,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,eAAe;IACrC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,kBAAkB;IAC3C,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,mBAAmB;IAC7C,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,oBAAoB;IAC/C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS;IACzB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,YAAY;IAC/B,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,eAAe;IACrC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,aAAa;IACjC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,iBAAiB;CAC1C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAU;IACrC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,KAAmB;IAEnB,OAAO,IAAI,YAAY,CAAC,GAAG,MAAM,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAAmB;IACjD,OAAO,qBAAqB,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,UAAU,EAAE,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAmB;IACrD,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC"}

package/dist/pipeline/steps/authorization-facts.d.ts

@@ -0,0 +1,12 @@
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { ResolvedParentLink, RowAuthorizationFacts } from "../../extensions/resource-authorization.js";
+/** The row's facts, read structurally; every absence is the empty value, never a throw. */
+export declare function rowAuthorizationFactsOf(kind: ApiResourceKind, resource: object): RowAuthorizationFacts;
+/** `status.audit.spec_audit.created_by.id` as stamped — "" when any link is absent. */
+export declare function createdByOf(resource: object): string;
+/**
+ * The scope link and every configured additional parent the row names, in
+ * the tuple lifecycle's order. A parent the row does not name is left out.
+ */
+export declare function parentLinksOf(kind: ApiResourceKind, resource: object, org: string): ReadonlyArray<ResolvedParentLink>;
+//# sourceMappingURL=authorization-facts.d.ts.map

package/dist/pipeline/steps/authorization-facts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-facts.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/authorization-facts.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAI3H,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EACtB,MAAM,4CAA4C,CAAC;AAUpD,2FAA2F;AAC3F,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,MAAM,GACf,qBAAqB,CAYvB;AAED,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIpD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,aAAa,CAAC,kBAAkB,CAAC,CAsCnC"}

package/dist/pipeline/steps/authorization-facts.js

@@ -0,0 +1,100 @@
+/**
+ * The facts a stored row's authorization tuples derive from, read back
+ * from the row (`RowAuthorizationFacts`, extensions/resource-authorization.ts)
+ * — the read-time twin of the tuple lifecycle's create-time resolution in
+ * authorization-tuples.ts, and deliberately not that function: the
+ * create-time one throws when a row is missing its organization or its
+ * parent (a create must not half-succeed), while a row read back years
+ * later is a fact, missing pieces included — an empty organization
+ * resolves `admin from organization` to nobody, it does not fault a read.
+ * The two cannot drift unnoticed: src/authorization/__tests__/facts.test.ts
+ * pins that a well-formed row resolves to the same links through both.
+ *
+ * Two readers share this one resolver, which is the reason it is a leaf
+ * of its own: the list lanes' shared helper (extensions/list-read-scope.ts)
+ * builds every candidate's `ListEntryMeta` through it, and the built-in
+ * authorizer (src/authorization/facts.ts) derives a loaded row's tuples
+ * through it. It imports the two pure leaves it needs (apiresource-meta,
+ * shapes) and the protos, and nothing else, so the seam may import it by
+ * value without a cycle — the third such leaf, beside those two.
+ *
+ * Every read is structural (shapes.ts's own premise: protobuf-es messages
+ * are plain objects sharing the generated metadata and audit types), so
+ * the resolver needs no schema — a list lane holds decoded rows of a kind
+ * it names, not their descriptors.
+ */
+import { AuthorizationScopeType } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import { getKindEnum, getKindMeta } from "../apiresource-meta.js";
+import { parentIdOf } from "./shapes.js";
+/** The row's facts, read structurally; every absence is the empty value, never a throw. */
+export function rowAuthorizationFactsOf(kind, resource) {
+    const metadata = resource.metadata;
+    const org = metadata?.org ?? "";
+    return {
+        id: metadata?.id ?? "",
+        org,
+        visibility: metadata?.visibility ??
+            ApiResourceVisibility.api_resource_visibility_unspecified,
+        createdBy: createdByOf(resource),
+        parentLinks: parentLinksOf(kind, resource, org),
+    };
+}
+/** `status.audit.spec_audit.created_by.id` as stamped — "" when any link is absent. */
+export function createdByOf(resource) {
+    return (resource.status?.audit?.specAudit?.createdBy?.id ?? "");
+}
+/**
+ * The scope link and every configured additional parent the row names, in
+ * the tuple lifecycle's order. A parent the row does not name is left out.
+ */
+export function parentLinksOf(kind, resource, org) {
+    const config = getKindMeta(kind).authorization;
+    if (config === undefined) {
+        return [];
+    }
+    const links = [];
+    switch (config.scopeType) {
+        case AuthorizationScopeType.ORGANIZATION:
+            if (org !== "") {
+                links.push({
+                    relation: "organization",
+                    parentKind: getKindEnum("organization"),
+                    parentId: org,
+                });
+            }
+            break;
+        case AuthorizationScopeType.PARENT:
+            if (config.parent !== undefined) {
+                pushLink(links, resource, config.parent);
+            }
+            break;
+        case AuthorizationScopeType.OWNER_ONLY:
+        case AuthorizationScopeType.PLATFORM:
+        case AuthorizationScopeType.NONE:
+        case AuthorizationScopeType.UNSPECIFIED:
+            // No scope link: OWNER_ONLY by design; PLATFORM is dead config in
+            // both editions (the lifecycle warns and writes none); NONE and
+            // UNSPECIFIED are kinds outside the model.
+            break;
+        default: {
+            const exhaustive = config.scopeType;
+            throw new Error(`unknown scope type: ${String(exhaustive)}`);
+        }
+    }
+    for (const parent of config.additionalParents) {
+        pushLink(links, resource, parent);
+    }
+    return links;
+}
+function pushLink(links, resource, parent) {
+    const parentId = parentIdOf(resource, parent.specField);
+    if (parentId !== "") {
+        links.push({
+            relation: parent.relation,
+            parentKind: getKindEnum(parent.kind),
+            parentId,
+        });
+    }
+}
+//# sourceMappingURL=authorization-facts.js.map

package/dist/pipeline/steps/authorization-facts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-facts.js","sourceRoot":"","sources":["../../../src/pipeline/steps/authorization-facts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,wFAAwF,CAAC;AAGhI,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAO/F,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAQzC,2FAA2F;AAC3F,MAAM,UAAU,uBAAuB,CACrC,IAAqB,EACrB,QAAgB;IAEhB,MAAM,QAAQ,GAAI,QAA6B,CAAC,QAAQ,CAAC;IACzD,MAAM,GAAG,GAAG,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;IAChC,OAAO;QACL,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE;QACtB,GAAG;QACH,UAAU,EACR,QAAQ,EAAE,UAAU;YACpB,qBAAqB,CAAC,mCAAmC;QAC3D,SAAS,EAAE,WAAW,CAAC,QAAQ,CAAC;QAChC,WAAW,EAAE,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,OAAO,CACJ,QAA0B,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAC1E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAqB,EACrB,QAAgB,EAChB,GAAW;IAEX,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;IAC/C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,QAAQ,MAAM,CAAC,SAAS,EAAE,CAAC;QACzB,KAAK,sBAAsB,CAAC,YAAY;YACtC,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;gBACf,KAAK,CAAC,IAAI,CAAC;oBACT,QAAQ,EAAE,cAAc;oBACxB,UAAU,EAAE,WAAW,CAAC,cAAc,CAAC;oBACvC,QAAQ,EAAE,GAAG;iBACd,CAAC,CAAC;YACL,CAAC;YACD,MAAM;QACR,KAAK,sBAAsB,CAAC,MAAM;YAChC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM;QACR,KAAK,sBAAsB,CAAC,UAAU,CAAC;QACvC,KAAK,sBAAsB,CAAC,QAAQ,CAAC;QACrC,KAAK,sBAAsB,CAAC,IAAI,CAAC;QACjC,KAAK,sBAAsB,CAAC,WAAW;YACrC,kEAAkE;YAClE,gEAAgE;YAChE,2CAA2C;YAC3C,MAAM;QACR,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,MAAM,CAAC,SAAS,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9C,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CACf,KAA2B,EAC3B,QAAgB,EAChB,MAA4B;IAE5B,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC;YACpC,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/pipeline/steps/authorization-tuples.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-tuples.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/authorization-tuples.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAU3H,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EACV,0BAA0B,EAE1B,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,4CAA4C,CAAC;AAEpD;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,IAAI,CAAC,CAKf;AAGD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAYnD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,qBAAqB,GAC3B,WAAW,CAAC,oBAAoB,CAAC,CAgCnC;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,qBAAqB,EAC/B,QAAQ,EAAE,qBAAqB,GAC9B;IACD,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;IAC7D,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9D,CAUA;AAqHD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,MAAM,GACb,oBAAoB,GAAG,SAAS,CAkClC;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,SAAS,WAAW,EACvE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CAuBpB;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CAiCpB;AAED,uDAAuD;AACvD,eAAO,MAAM,kBAAkB,+BAA+B,CAAC;AAE/D;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,IAAI,SAAS,WAAW,EAC1E,WAAW,EAAE,MAAM,GAClB,YAAY,CAAC,IAAI,CAAC,CAYpB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,SAAS,WAAW,EACpE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,WAAW,EAAE,MAAM,GAClB,YAAY,CAAC,IAAI,CAAC,CAoCpB"}
+{"version":3,"file":"authorization-tuples.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/authorization-tuples.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAU3H,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EACV,0BAA0B,EAE1B,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,4CAA4C,CAAC;AAEpD;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,IAAI,CAAC,CAKf;AAGD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAYnD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,qBAAqB,GAC3B,WAAW,CAAC,oBAAoB,CAAC,CAgCnC;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,qBAAqB,EAC/B,QAAQ,EAAE,qBAAqB,GAC9B;IACD,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;IAC7D,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9D,CAUA;AAgGD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,MAAM,GACb,oBAAoB,GAAG,SAAS,CAkClC;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,SAAS,WAAW,EACvE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CAuBpB;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CAiCpB;AAED,uDAAuD;AACvD,eAAO,MAAM,kBAAkB,+BAA+B,CAAC;AAE/D;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,IAAI,SAAS,WAAW,EAC1E,WAAW,EAAE,MAAM,GAClB,YAAY,CAAC,IAAI,CAAC,CAYpB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,SAAS,WAAW,EACpE,SAAS,EAAE,8BAA8B,GAAG,SAAS,EACrD,WAAW,EAAE,MAAM,GAClB,YAAY,CAAC,IAAI,CAAC,CAoCpB"}

package/dist/pipeline/steps/authorization-tuples.js

@@ -18,7 +18,7 @@ export async function notifyDefaultInstanceLinked(lifecycle, event) {
 import { getKindEnum, getKindMeta, getKindName } from "../apiresource-meta.js";
 import { internalError } from "../errors.js";
 import { EXISTING_RESOURCE_KEY } from "./load-existing.js";
-import { metadataOf } from "./shapes.js";
+import { metadataOf, parentIdOf } from "./shapes.js";
 // ---------------------------------------------------------------------------
 // Visibility shape policy — the reconciler's level→shape mapping, ported
 // from the Java VisibilityTupleReconciler (its unit-test matrix is
@@ -81,33 +81,14 @@ export function diffVisibilityShapes(kind, oldLevel, newLevel) {
     };
 }
 // ---------------------------------------------------------------------------
-// Parent-id resolution — the ParentIdExtractorRegistry port. Zero
-// hardcoded kind knowledge: the proto config names the spec field, this
-// module reads it structurally (protobuf-es spec messages are plain
-// objects whose properties are the camelCase proto field names).
+// Parent-id resolution — the ParentIdExtractorRegistry port. The spec-field
+// read itself is shapes.ts's `parentIdOf`, shared with the list read scope
+// (20260913.04 T04) so the id a tuple is written with and the id the scope
+// asks about are one read. This module adds the create-time rule: a
+// missing parent fails the request.
 // ---------------------------------------------------------------------------
-/** proto snake_case field name → the generated property name. */
-function camelCaseFieldName(specField) {
-    return specField.replace(/_([a-z0-9])/g, (_, ch) => ch.toUpperCase());
-}
-/**
- * Extracts the parent id named by the config from the resource's spec.
- * Returns "" for every miss (no spec, no field, non-string value) — the
- * caller decides whether that is fatal, exactly as Java's registry
- * returns null and the service throws.
- */
-function extractParentId(resource, specField) {
-    // Structural access is the shapes.ts idiom: spec messages are plain
-    // objects; the property name is the camelCase form of the proto field.
-    const spec = resource.spec;
-    if (spec === undefined) {
-        return "";
-    }
-    const value = spec[camelCaseFieldName(specField)];
-    return typeof value === "string" ? value : "";
-}
 function resolveParentLink(kind, resource, parentConfig) {
-    const parentId = extractParentId(resource, parentConfig.specField);
+    const parentId = parentIdOf(resource, parentConfig.specField);
     if (parentId === "") {
         // Java: "Parent ID required for X but not found" → the request fails.
         throw internalError(new Error(`parent id for relation '${parentConfig.relation}' (spec field '${parentConfig.specField}') is missing on ${getKindName(kind)}`), "failed to create authorization tuples");