@stigmer/server 3.15.3-dev.20260914121148 → 3.15.3-dev.20260916211208

package/dist/extensions/schedule-fire-caller.d.ts

@@ -2,32 +2,59 @@
  * The schedule-fire caller seam (stigmer-cloud#572) — WHO a schedule fire
  * acts as when the RunStarter re-enters the execution create pipeline.
  *
- * OSS deliberately has no caller identity on this lane (DD-015 D-G: the
- * single-user edition has no tokens to carry one), so with no driver
- * composed every fire enters as the in-process `internal` class — today's
- * behavior, byte-identical. The cloud edition's Java baseline instead
- * mints a schedule JWT per fire (sub = the org's system-schedule account,
- * claim = the firing Schedule id) so the created session and execution
- * carry real attribution and the schedule's viewer set reaches the run
- * (the FGA model's session#schedule link — "without it a scheduled run is
- * invisible to every human, including the schedule's owner"). This seam
- * lets a composition supply that identity; the fire then propagates it
- * through the R5 caller-propagation header exactly like the other
- * request-origin in-process creates.
+ * With no driver composed a fire enters as the in-process `internal`
+ * class — the trusted-local laptop's lane, where the one caller is the
+ * server's operator and attribution has nobody to separate. Under an
+ * authentication posture that lane is wrong: the internal class carries
+ * the operator's email or `"system"`, which no enforcing evaluator
+ * recognizes as a person, so the fired session would belong to nobody
+ * (the FGA model's own words — "without it a scheduled run is invisible
+ * to every human, including the schedule's owner"). Two drivers answer
+ * it: the cloud edition mints a schedule JWT per fire (sub = the org's
+ * system-schedule account, claim = the firing Schedule id) so the run
+ * reaches the schedule's viewer set through the session#schedule link;
+ * open source, under the built-in authorization posture, makes the fire
+ * act as the schedule's CREATOR (authorization/schedule-fire-caller.ts),
+ * so the run and its session are that person's. The fire then propagates
+ * the identity through the R5 caller-propagation header exactly like the
+ * other request-origin in-process creates.
  *
  * Single-instance point. The mint is per fire — the schedule id is a
- * claim of the minted credential, never a cached field — and a mint
- * failure is an infrastructure fault: the RunStarter lets it propagate,
- * so the tick activity retries (the deterministic execution name absorbs
- * the retry) and a manual trigger surfaces the failure to its caller.
+ * claim of the minted credential, never a cached field. Two failure
+ * shapes, and the RunStarter tells them apart by type, the store-fault
+ * precedent (`ResourceNotFoundError` is checked with `instanceof`; every
+ * other fault is infrastructure):
+ *
+ *   - any other thrown error is an INFRASTRUCTURE fault: the RunStarter
+ *     lets it propagate, so the tick activity retries (the deterministic
+ *     execution name absorbs the retry) and a manual trigger surfaces
+ *     the failure to its caller;
+ *   - `ScheduleFireCallerRefusedError` is a DETERMINISTIC refusal — this
+ *     fire can act as nobody, and no retry will change that (a schedule
+ *     stamped by no person this server knows). The RunStarter answers
+ *     the `refused` outcome the way it answers a launch gate's refusal:
+ *     the failure streak counts it and pauses the schedule with the
+ *     reason, so the person who scheduled it sees why in the console
+ *     instead of a tick failing quietly forever.
  */
 import type { CallerIdentity } from "./identity.js";
 export interface ScheduleFireCallerMint {
     /**
      * Mints the caller identity one fire acts as. `rawToken` must carry the
-     * edition's verifiable credential for the identity (compositions read
-     * fire-scoped claims — e.g. the schedule id — from it downstream).
+     * edition's verifiable credential for the identity when the edition
+     * reads fire-scoped claims from it downstream (the cloud does — the
+     * schedule id); an edition that propagates the identity in-process and
+     * reads nothing off the token leaves it empty (open source does).
      */
     mintFireCaller(org: string, scheduleId: string): Promise<CallerIdentity>;
 }
+/**
+ * The mint's deterministic refusal (the module header): thrown by a
+ * driver when the fire can act as nobody and retrying cannot help. The
+ * message is the reason the schedule's status carries, so it is written
+ * for the person who scheduled the run.
+ */
+export declare class ScheduleFireCallerRefusedError extends Error {
+    constructor(reason: string);
+}
 //# sourceMappingURL=schedule-fire-caller.d.ts.map

package/dist/extensions/schedule-fire-caller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schedule-fire-caller.d.ts","sourceRoot":"","sources":["../../src/extensions/schedule-fire-caller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1E"}
+{"version":3,"file":"schedule-fire-caller.d.ts","sourceRoot":"","sources":["../../src/extensions/schedule-fire-caller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1E;AAED;;;;;GAKG;AACH,qBAAa,8BAA+B,SAAQ,KAAK;gBAC3C,MAAM,EAAE,MAAM;CAI3B"}

package/dist/extensions/schedule-fire-caller.js

@@ -1,2 +1,13 @@
-export {};
+/**
+ * The mint's deterministic refusal (the module header): thrown by a
+ * driver when the fire can act as nobody and retrying cannot help. The
+ * message is the reason the schedule's status carries, so it is written
+ * for the person who scheduled the run.
+ */
+export class ScheduleFireCallerRefusedError extends Error {
+    constructor(reason) {
+        super(reason);
+        this.name = "ScheduleFireCallerRefusedError";
+    }
+}
 //# sourceMappingURL=schedule-fire-caller.js.map

package/dist/extensions/schedule-fire-caller.js.map

@@ -1 +1 @@
-{"version":3,"file":"schedule-fire-caller.js","sourceRoot":"","sources":["../../src/extensions/schedule-fire-caller.ts"],"names":[],"mappings":""}
+{"version":3,"file":"schedule-fire-caller.js","sourceRoot":"","sources":["../../src/extensions/schedule-fire-caller.ts"],"names":[],"mappings":"AAoDA;;;;;GAKG;AACH,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACvD,YAAY,MAAc;QACxB,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF"}

package/dist/index.d.ts

@@ -69,8 +69,18 @@ export type { AuthorizationQueryEngine } from "./extensions/authorization-querie
 export type { IdentityFederation } from "./extensions/identity-federation.js";
 export type { AccountsBySubject } from "./domain/identityaccount/resolve.js";
 export { identityIdForSubject } from "./domain/identityaccount/resolve.js";
+export type { DerivedRelation, KindDeclaration, Rewrite, SubjectType, } from "./authorization/model/rewrite.js";
+export type { Model } from "./authorization/model/index.js";
+export { builtInModel, declarationFor, newModel, } from "./authorization/model/index.js";
+export type { CheckContext, ObjectRef, Person, Subject, Tuple, TupleSource, } from "./authorization/tuples.js";
+export type { EvaluationFault } from "./authorization/evaluator.js";
+export { AuthorizationEvaluationError, MAX_RESOLUTION_DEPTH, checkRelation, } from "./authorization/evaluator.js";
+export type { StoreTestCase, StoreTestDocument, StoreTestKit, StoreTestSkip, StoreTestSkipReason, } from "./authorization/store-test-kit.js";
+export { parseStoreTestDocument, storeTestCases, } from "./authorization/store-test-kit.js";
+export { NOT_FOUND_EXEMPT_KINDS } from "./authorization/authorizer.js";
 export type { ListReadScope, ListEntryMeta, } from "./extensions/list-read-scope.js";
 export type { ScheduleFireCallerMint } from "./extensions/schedule-fire-caller.js";
+export { ScheduleFireCallerRefusedError } from "./extensions/schedule-fire-caller.js";
 export type { VisitorErrorPolicy } from "./pipeline/interceptors/error-boundary.js";
 export { createErrorBoundaryInterceptor } from "./pipeline/interceptors/error-boundary.js";
 export { diffVisibilityShapes, visibilityShapesFor, } from "./pipeline/steps/authorization-tuples.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,YAAY,EACV,QAAQ,EACR,SAAS,EACT,MAAM,EACN,aAAa,EACb,QAAQ,EACR,OAAO,GACR,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,4BAA4B,EAC5B,kBAAkB,EAClB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AASlC,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAOjE,YAAY,EACV,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAIzE,YAAY,EACV,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAChD,YAAY,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAO3E,YAAY,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAI1E,YAAY,EACV,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAU1F,YAAY,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,YAAY,EACV,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,YAAY,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,YAAY,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACtF,YAAY,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,YAAY,EACV,aAAa,EACb,aAAa,GACd,MAAM,iCAAiC,CAAC;AAIzC,YAAY,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AASnF,YAAY,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAGlD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAKxD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAgBzC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAOjF,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAKtE,YAAY,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAK9B,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAWhE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,YAAY,EACV,eAAe,EACf,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAIrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,YAAY,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAMvE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAKjG,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AACrG,YAAY,EACV,wBAAwB,EAKxB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EAKxB,qBAAqB,GACtB,MAAM,4CAA4C,CAAC;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAcpC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAMzD,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAS9E,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAQrE,YAAY,EACV,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,0CAA0C,CAAC;AAOlD,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,YAAY,EACV,QAAQ,EACR,SAAS,EACT,MAAM,EACN,aAAa,EACb,QAAQ,EACR,OAAO,GACR,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,4BAA4B,EAC5B,kBAAkB,EAClB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AASlC,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAOjE,YAAY,EACV,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAIzE,YAAY,EACV,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAChD,YAAY,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAO3E,YAAY,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAI1E,YAAY,EACV,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAU1F,YAAY,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,YAAY,EACV,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,YAAY,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,YAAY,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACtF,YAAY,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAO3E,YAAY,EACV,eAAe,EACf,eAAe,EACf,OAAO,EACP,WAAW,GACZ,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EACL,YAAY,EACZ,cAAc,EACd,QAAQ,GACT,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,YAAY,EACZ,SAAS,EACT,MAAM,EACN,OAAO,EACP,KAAK,EACL,WAAW,GACZ,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,aAAa,GACd,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,sBAAsB,EACtB,cAAc,GACf,MAAM,mCAAmC,CAAC;AAI3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,YAAY,EACV,aAAa,EACb,aAAa,GACd,MAAM,iCAAiC,CAAC;AAMzC,YAAY,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AAStF,YAAY,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAGlD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAKxD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAgBzC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAOjF,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAKtE,YAAY,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAK9B,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAWhE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,YAAY,EACV,eAAe,EACf,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAIrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,YAAY,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAMvE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAKjG,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AACrG,YAAY,EACV,wBAAwB,EAKxB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EAKxB,qBAAqB,GACtB,MAAM,4CAA4C,CAAC;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAcpC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAMzD,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAS9E,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAQrE,YAAY,EACV,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,0CAA0C,CAAC;AAOlD,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -49,6 +49,14 @@ export { identityAccountStoreContract } from "./domain/identityaccount/store-con
 export { DuplicatePolicyError } from "./domain/iampolicy/store.js";
 export { iamPolicyStoreContract } from "./domain/iampolicy/store-contract.js";
 export { identityIdForSubject } from "./domain/identityaccount/resolve.js";
+export { builtInModel, declarationFor, newModel, } from "./authorization/model/index.js";
+export { AuthorizationEvaluationError, MAX_RESOLUTION_DEPTH, checkRelation, } from "./authorization/evaluator.js";
+export { parseStoreTestDocument, storeTestCases, } from "./authorization/store-test-kit.js";
+// The kinds whose missing row the built-in authorizer denies instead of
+// answering not-found — the cloud's probe exemption over the open-source
+// tier; exported so the cloud's drift test pins the two sets equal.
+export { NOT_FOUND_EXEMPT_KINDS } from "./authorization/authorizer.js";
+export { ScheduleFireCallerRefusedError } from "./extensions/schedule-fire-caller.js";
 export { createErrorBoundaryInterceptor } from "./pipeline/interceptors/error-boundary.js";
 export { diffVisibilityShapes, visibilityShapesFor, } from "./pipeline/steps/authorization-tuples.js";
 export { RequestContext } from "./pipeline/request-context.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,wCAAwC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAiEhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAQ3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAQ1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAW1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAKnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAK9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAkB3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAIlD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,yEAAyE;AACzE,+DAA+D;AAC/D,wEAAwE;AACxE,QAAQ;AACR,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,gEAAgE;AAChE,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,sEAAsE;AACtE,qEAAqE;AACrE,6DAA6D;AAC7D,iEAAiE;AACjE,wEAAwE;AACxE,iEAAiE;AACjE,yEAAyE;AACzE,+DAA+D;AAC/D,yEAAyE;AACzE,8DAA8D;AAC9D,wEAAwE;AACxE,uEAAuE;AACvE,mEAAmE;AACnE,2DAA2D;AAC3D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,+DAA+D;AAC/D,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,oEAAoE;AACpE,wEAAwE;AACxE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kDAAkD;AAClD,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,0EAA0E;AAC1E,uEAAuE;AACvE,oEAAoE;AACpE,uEAAuE;AACvE,oEAAoE;AACpE,wCAAwC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAMtE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAM9B,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAO1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAQvE,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AAkBrG,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,qEAAqE;AACrE,6DAA6D;AAC7D,uEAAuE;AACvE,qEAAqE;AACrE,gEAAgE;AAChE,0EAA0E;AAC1E,qEAAqE;AACrE,uEAAuE;AACvE,iEAAiE;AACjE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AAepC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAE9E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,kDAAkD;AAClD,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AA0BrE,oEAAoE;AACpE,yEAAyE;AACzE,iDAAiD;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,wCAAwC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAiEhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAQ3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAQ1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAW1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAKnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAK9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAc3E,OAAO,EACL,YAAY,EACZ,cAAc,EACd,QAAQ,GACT,MAAM,gCAAgC,CAAC;AAUxC,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,aAAa,GACd,MAAM,8BAA8B,CAAC;AAQtC,OAAO,EACL,sBAAsB,EACtB,cAAc,GACf,MAAM,mCAAmC,CAAC;AAC3C,wEAAwE;AACxE,yEAAyE;AACzE,oEAAoE;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAWvE,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AAUtF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAIlD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,yEAAyE;AACzE,+DAA+D;AAC/D,wEAAwE;AACxE,QAAQ;AACR,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,gEAAgE;AAChE,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,sEAAsE;AACtE,qEAAqE;AACrE,6DAA6D;AAC7D,iEAAiE;AACjE,wEAAwE;AACxE,iEAAiE;AACjE,yEAAyE;AACzE,+DAA+D;AAC/D,yEAAyE;AACzE,8DAA8D;AAC9D,wEAAwE;AACxE,uEAAuE;AACvE,mEAAmE;AACnE,2DAA2D;AAC3D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,+DAA+D;AAC/D,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,oEAAoE;AACpE,wEAAwE;AACxE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kDAAkD;AAClD,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,0EAA0E;AAC1E,uEAAuE;AACvE,oEAAoE;AACpE,uEAAuE;AACvE,oEAAoE;AACpE,wCAAwC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAMtE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAM9B,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAO1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAQvE,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AAkBrG,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,qEAAqE;AACrE,6DAA6D;AAC7D,uEAAuE;AACvE,qEAAqE;AACrE,gEAAgE;AAChE,0EAA0E;AAC1E,qEAAqE;AACrE,uEAAuE;AACvE,iEAAiE;AACjE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AAepC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAE9E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,kDAAkD;AAClD,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AA0BrE,oEAAoE;AACpE,yEAAyE;AACzE,iDAAiD;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/pipeline/apiresource-labels.d.ts

@@ -8,9 +8,12 @@
  * instances) but never to GRANT anything. Where a grant-shaped decision is
  * needed, key it on server-owned state instead (e.g. the parent blueprint's
  * status.default_instance_id, written only by the create/self-heal flows).
- * The cloud edition additionally guards the whole reserved namespace at its
- * write boundaries (GuardReservedLabelsStep); OSS has no such guard, which
- * is one of the reasons OSS predicates must not trust these labels alone.
+ * Every write boundary runs GuardReservedLabels over the namespace
+ * (pipeline/steps/guard-reserved-labels.ts), but the open-source
+ * authorizer's permissive default ALLOWS reserved-label writes by design
+ * (the self-hosted operator owns the store), which is why a restrict-shaped
+ * predicate here still pairs the label with server-owned state: the
+ * plugin-managed guard refuses only beside an existing plugin row.
  */
 import type { ApiResourceMetadata } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
 /**
@@ -39,6 +42,23 @@ export declare const SYSTEM_MANAGED_LABEL = "stigmer.ai/system-managed";
  * read by the predicates here.
  */
 export declare const RESERVED_LABEL_TRUE = "true";
+/**
+ * The plugin that materialised a resource: the label's value is the
+ * plugin's id (`plg_...`), never its slug, because `findAllByLabel` is
+ * org-agnostic and two organizations may both install `thermos`. Written
+ * only by the plugin controller (in-process, as the installing caller);
+ * membership is derived on read from it and stored nowhere else.
+ */
+export declare const PLUGIN_LABEL = "stigmer.ai/plugin";
+/**
+ * The archive digest a member was last materialised from — the per-child
+ * convergence marker. A re-push compares every member's value with the
+ * head's digest before deciding it has nothing to do, so a member another
+ * lane deleted or an older install left behind is re-materialised.
+ */
+export declare const PLUGIN_VERSION_LABEL = "stigmer.ai/plugin-version";
+/** The plugin id a resource's labels claim, or undefined when unlabelled. */
+export declare function pluginIdOf(metadata: ApiResourceMetadata | undefined): string | undefined;
 /**
  * Whether the metadata carries the DEFAULT_INSTANCE_LABEL marker
  * (undefined-safe) — Go IsDefaultInstance.

package/dist/pipeline/apiresource-labels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiresource-labels.d.ts","sourceRoot":"","sources":["../../src/pipeline/apiresource-labels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4DAA4D,CAAC;AAEtG;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,gCAA6C,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,8BAA2C,CAAC;AAE7E;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAE1C;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,mBAAmB,GAAG,SAAS,GACxC,OAAO,CAET"}
+{"version":3,"file":"apiresource-labels.d.ts","sourceRoot":"","sources":["../../src/pipeline/apiresource-labels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4DAA4D,CAAC;AAEtG;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,gCAA6C,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,8BAA2C,CAAC;AAE7E;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAE1C;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,sBAAmC,CAAC;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,8BAA2C,CAAC;AAE7E,6EAA6E;AAC7E,wBAAgB,UAAU,CACxB,QAAQ,EAAE,mBAAmB,GAAG,SAAS,GACxC,MAAM,GAAG,SAAS,CAGpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,mBAAmB,GAAG,SAAS,GACxC,OAAO,CAET"}

package/dist/pipeline/apiresource-labels.js

@@ -24,6 +24,26 @@ export const SYSTEM_MANAGED_LABEL = `${RESERVED_LABEL_PREFIX}system-managed`;
  * read by the predicates here.
  */
 export const RESERVED_LABEL_TRUE = "true";
+/**
+ * The plugin that materialised a resource: the label's value is the
+ * plugin's id (`plg_...`), never its slug, because `findAllByLabel` is
+ * org-agnostic and two organizations may both install `thermos`. Written
+ * only by the plugin controller (in-process, as the installing caller);
+ * membership is derived on read from it and stored nowhere else.
+ */
+export const PLUGIN_LABEL = `${RESERVED_LABEL_PREFIX}plugin`;
+/**
+ * The archive digest a member was last materialised from — the per-child
+ * convergence marker. A re-push compares every member's value with the
+ * head's digest before deciding it has nothing to do, so a member another
+ * lane deleted or an older install left behind is re-materialised.
+ */
+export const PLUGIN_VERSION_LABEL = `${RESERVED_LABEL_PREFIX}plugin-version`;
+/** The plugin id a resource's labels claim, or undefined when unlabelled. */
+export function pluginIdOf(metadata) {
+    const value = metadata?.labels[PLUGIN_LABEL];
+    return value === undefined || value === "" ? undefined : value;
+}
 /**
  * Whether the metadata carries the DEFAULT_INSTANCE_LABEL marker
  * (undefined-safe) — Go IsDefaultInstance.

package/dist/pipeline/apiresource-labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiresource-labels.js","sourceRoot":"","sources":["../../src/pipeline/apiresource-labels.ts"],"names":[],"mappings":"AAgBA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,qBAAqB,kBAAkB,CAAC;AAEjF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,qBAAqB,gBAAgB,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAyC;IAEzC,OAAO,QAAQ,EAAE,MAAM,CAAC,sBAAsB,CAAC,KAAK,mBAAmB,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"apiresource-labels.js","sourceRoot":"","sources":["../../src/pipeline/apiresource-labels.ts"],"names":[],"mappings":"AAmBA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,qBAAqB,kBAAkB,CAAC;AAEjF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,qBAAqB,gBAAgB,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,qBAAqB,QAAQ,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,qBAAqB,gBAAgB,CAAC;AAE7E,6EAA6E;AAC7E,MAAM,UAAU,UAAU,CACxB,QAAyC;IAEzC,MAAM,KAAK,GAAG,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7C,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAyC;IAEzC,OAAO,QAAQ,EAAE,MAAM,CAAC,sBAAsB,CAAC,KAAK,mBAAmB,CAAC;AAC1E,CAAC"}

package/dist/pipeline/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/pipeline/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,4CAA4C;AAC5C,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,YAAY,CAExE;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAElE;AAED,sDAAsD;AACtD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,YAAY,CAE7E;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAErE;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAE1D;AAED,qEAAqE;AACrE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,CAE3E;AA2BD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAE/C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,YAAY,GAClB,YAAY,CAKd;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAE3D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY,CAErE"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/pipeline/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,4CAA4C;AAC5C,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,YAAY,CAExE;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAElE;AAED,sDAAsD;AACtD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,YAAY,CAK7E;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAErE;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAE1D;AAED,qEAAqE;AACrE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,CAE3E;AA2BD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAE/C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,YAAY,GAClB,YAAY,CAEd;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAE3D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY,CAErE"}

package/dist/pipeline/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/pipeline/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,4CAA4C;AAC5C,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,EAAU;IACxD,OAAO,IAAI,YAAY,CAAC,GAAG,QAAQ,eAAe,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;AACzD,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,EAAU;IAC7D,OAAO,IAAI,YAAY,CAAC,GAAG,QAAQ,oBAAoB,EAAE,EAAE,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;AACnF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAC5D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,OAAe;IAC3D,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,eAAe,GAAmC;IACtD,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS;IACzB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,iBAAiB;IACzC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,kBAAkB;IAC3C,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,eAAe;IACrC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,kBAAkB;IAC3C,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,mBAAmB;IAC7C,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,oBAAoB;IAC/C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS;IACzB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,YAAY;IAC/B,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,eAAe;IACrC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,aAAa;IACjC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,iBAAiB;CAC1C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAU;IACrC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,KAAmB;IAEnB,OAAO,IAAI,YAAY,CACrB,GAAG,MAAM,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,EACtC,KAAK,CAAC,IAAI,CACX,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAAmB;IACjD,OAAO,qBAAqB,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,UAAU,EAAE,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAmB;IACrD,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/pipeline/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,4CAA4C;AAC5C,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,EAAU;IACxD,OAAO,IAAI,YAAY,CAAC,GAAG,QAAQ,eAAe,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;AACzD,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,EAAU;IAC7D,OAAO,IAAI,YAAY,CACrB,GAAG,QAAQ,oBAAoB,EAAE,EAAE,EACnC,IAAI,CAAC,aAAa,CACnB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAC5D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,OAAe;IAC3D,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,eAAe,GAAmC;IACtD,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS;IACzB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,iBAAiB;IACzC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,kBAAkB;IAC3C,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,eAAe;IACrC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,kBAAkB;IAC3C,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,mBAAmB;IAC7C,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,oBAAoB;IAC/C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS;IACzB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,YAAY;IAC/B,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,eAAe;IACrC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,aAAa;IACjC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,iBAAiB;CAC1C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAU;IACrC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,KAAmB;IAEnB,OAAO,IAAI,YAAY,CAAC,GAAG,MAAM,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAAmB;IACjD,OAAO,qBAAqB,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,UAAU,EAAE,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAmB;IACrD,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC"}

package/dist/pipeline/steps/authorization-facts.d.ts

@@ -0,0 +1,12 @@
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { ResolvedParentLink, RowAuthorizationFacts } from "../../extensions/resource-authorization.js";
+/** The row's facts, read structurally; every absence is the empty value, never a throw. */
+export declare function rowAuthorizationFactsOf(kind: ApiResourceKind, resource: object): RowAuthorizationFacts;
+/** `status.audit.spec_audit.created_by.id` as stamped — "" when any link is absent. */
+export declare function createdByOf(resource: object): string;
+/**
+ * The scope link and every configured additional parent the row names, in
+ * the tuple lifecycle's order. A parent the row does not name is left out.
+ */
+export declare function parentLinksOf(kind: ApiResourceKind, resource: object, org: string): ReadonlyArray<ResolvedParentLink>;
+//# sourceMappingURL=authorization-facts.d.ts.map

package/dist/pipeline/steps/authorization-facts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-facts.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/authorization-facts.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAI3H,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EACtB,MAAM,4CAA4C,CAAC;AAUpD,2FAA2F;AAC3F,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,MAAM,GACf,qBAAqB,CAYvB;AAED,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIpD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,aAAa,CAAC,kBAAkB,CAAC,CAsCnC"}

package/dist/pipeline/steps/authorization-facts.js

@@ -0,0 +1,100 @@
+/**
+ * The facts a stored row's authorization tuples derive from, read back
+ * from the row (`RowAuthorizationFacts`, extensions/resource-authorization.ts)
+ * — the read-time twin of the tuple lifecycle's create-time resolution in
+ * authorization-tuples.ts, and deliberately not that function: the
+ * create-time one throws when a row is missing its organization or its
+ * parent (a create must not half-succeed), while a row read back years
+ * later is a fact, missing pieces included — an empty organization
+ * resolves `admin from organization` to nobody, it does not fault a read.
+ * The two cannot drift unnoticed: src/authorization/__tests__/facts.test.ts
+ * pins that a well-formed row resolves to the same links through both.
+ *
+ * Two readers share this one resolver, which is the reason it is a leaf
+ * of its own: the list lanes' shared helper (extensions/list-read-scope.ts)
+ * builds every candidate's `ListEntryMeta` through it, and the built-in
+ * authorizer (src/authorization/facts.ts) derives a loaded row's tuples
+ * through it. It imports the two pure leaves it needs (apiresource-meta,
+ * shapes) and the protos, and nothing else, so the seam may import it by
+ * value without a cycle — the third such leaf, beside those two.
+ *
+ * Every read is structural (shapes.ts's own premise: protobuf-es messages
+ * are plain objects sharing the generated metadata and audit types), so
+ * the resolver needs no schema — a list lane holds decoded rows of a kind
+ * it names, not their descriptors.
+ */
+import { AuthorizationScopeType } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import { getKindEnum, getKindMeta } from "../apiresource-meta.js";
+import { parentIdOf } from "./shapes.js";
+/** The row's facts, read structurally; every absence is the empty value, never a throw. */
+export function rowAuthorizationFactsOf(kind, resource) {
+    const metadata = resource.metadata;
+    const org = metadata?.org ?? "";
+    return {
+        id: metadata?.id ?? "",
+        org,
+        visibility: metadata?.visibility ??
+            ApiResourceVisibility.api_resource_visibility_unspecified,
+        createdBy: createdByOf(resource),
+        parentLinks: parentLinksOf(kind, resource, org),
+    };
+}
+/** `status.audit.spec_audit.created_by.id` as stamped — "" when any link is absent. */
+export function createdByOf(resource) {
+    return (resource.status?.audit?.specAudit?.createdBy?.id ?? "");
+}
+/**
+ * The scope link and every configured additional parent the row names, in
+ * the tuple lifecycle's order. A parent the row does not name is left out.
+ */
+export function parentLinksOf(kind, resource, org) {
+    const config = getKindMeta(kind).authorization;
+    if (config === undefined) {
+        return [];
+    }
+    const links = [];
+    switch (config.scopeType) {
+        case AuthorizationScopeType.ORGANIZATION:
+            if (org !== "") {
+                links.push({
+                    relation: "organization",
+                    parentKind: getKindEnum("organization"),
+                    parentId: org,
+                });
+            }
+            break;
+        case AuthorizationScopeType.PARENT:
+            if (config.parent !== undefined) {
+                pushLink(links, resource, config.parent);
+            }
+            break;
+        case AuthorizationScopeType.OWNER_ONLY:
+        case AuthorizationScopeType.PLATFORM:
+        case AuthorizationScopeType.NONE:
+        case AuthorizationScopeType.UNSPECIFIED:
+            // No scope link: OWNER_ONLY by design; PLATFORM is dead config in
+            // both editions (the lifecycle warns and writes none); NONE and
+            // UNSPECIFIED are kinds outside the model.
+            break;
+        default: {
+            const exhaustive = config.scopeType;
+            throw new Error(`unknown scope type: ${String(exhaustive)}`);
+        }
+    }
+    for (const parent of config.additionalParents) {
+        pushLink(links, resource, parent);
+    }
+    return links;
+}
+function pushLink(links, resource, parent) {
+    const parentId = parentIdOf(resource, parent.specField);
+    if (parentId !== "") {
+        links.push({
+            relation: parent.relation,
+            parentKind: getKindEnum(parent.kind),
+            parentId,
+        });
+    }
+}
+//# sourceMappingURL=authorization-facts.js.map

package/dist/pipeline/steps/authorization-facts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-facts.js","sourceRoot":"","sources":["../../../src/pipeline/steps/authorization-facts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,wFAAwF,CAAC;AAGhI,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAO/F,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAQzC,2FAA2F;AAC3F,MAAM,UAAU,uBAAuB,CACrC,IAAqB,EACrB,QAAgB;IAEhB,MAAM,QAAQ,GAAI,QAA6B,CAAC,QAAQ,CAAC;IACzD,MAAM,GAAG,GAAG,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;IAChC,OAAO;QACL,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE;QACtB,GAAG;QACH,UAAU,EACR,QAAQ,EAAE,UAAU;YACpB,qBAAqB,CAAC,mCAAmC;QAC3D,SAAS,EAAE,WAAW,CAAC,QAAQ,CAAC;QAChC,WAAW,EAAE,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,OAAO,CACJ,QAA0B,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAC1E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAqB,EACrB,QAAgB,EAChB,GAAW;IAEX,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;IAC/C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,QAAQ,MAAM,CAAC,SAAS,EAAE,CAAC;QACzB,KAAK,sBAAsB,CAAC,YAAY;YACtC,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;gBACf,KAAK,CAAC,IAAI,CAAC;oBACT,QAAQ,EAAE,cAAc;oBACxB,UAAU,EAAE,WAAW,CAAC,cAAc,CAAC;oBACvC,QAAQ,EAAE,GAAG;iBACd,CAAC,CAAC;YACL,CAAC;YACD,MAAM;QACR,KAAK,sBAAsB,CAAC,MAAM;YAChC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM;QACR,KAAK,sBAAsB,CAAC,UAAU,CAAC;QACvC,KAAK,sBAAsB,CAAC,QAAQ,CAAC;QACrC,KAAK,sBAAsB,CAAC,IAAI,CAAC;QACjC,KAAK,sBAAsB,CAAC,WAAW;YACrC,kEAAkE;YAClE,gEAAgE;YAChE,2CAA2C;YAC3C,MAAM;QACR,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,MAAM,CAAC,SAAS,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9C,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CACf,KAA2B,EAC3B,QAAgB,EAChB,MAA4B;IAE5B,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC;YACpC,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/pipeline/steps/delete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/delete.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,WAAW,EAAgB,MAAM,oBAAoB,CAAC;AAGpE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAGtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAKnD,2DAA2D;AAC3D,eAAO,MAAM,eAAe,eAAe,CAAC;AAE5C,wBAAgB,wBAAwB,CAAC,IAAI,SAAS,WAAW,KAAK,YAAY,CAAC,IAAI,CAAC,CAWvF;AAED,wBAAgB,4BAA4B,CAC1C,SAAS,SAAS,WAAW,EAC7B,YAAY,SAAS,WAAW,EAChC,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,GAAG,YAAY,CAAC,SAAS,CAAC,CAuBrE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,SAAS,WAAW,EAC5D,KAAK,EAAE,KAAK,GACX,YAAY,CAAC,IAAI,CAAC,CAepB"}
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/delete.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,WAAW,EAAgB,MAAM,oBAAoB,CAAC;AAGpE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAOtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAKnD,2DAA2D;AAC3D,eAAO,MAAM,eAAe,eAAe,CAAC;AAE5C,wBAAgB,wBAAwB,CACtC,IAAI,SAAS,WAAW,KACrB,YAAY,CAAC,IAAI,CAAC,CAWtB;AAED,wBAAgB,4BAA4B,CAC1C,SAAS,SAAS,WAAW,EAC7B,YAAY,SAAS,WAAW,EAChC,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,GAAG,YAAY,CAAC,SAAS,CAAC,CAuBrE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,SAAS,WAAW,EAC5D,KAAK,EAAE,KAAK,GACX,YAAY,CAAC,IAAI,CAAC,CAepB"}

package/dist/pipeline/steps/delete.js

@@ -1,6 +1,6 @@
 import { ResourceNotFoundError } from "../../store/interface.js";
 import { getKindName } from "../apiresource-meta.js";
-import { internalError, invalidArgumentError, notFoundError } from "../errors.js";
+import { internalError, invalidArgumentError, notFoundError, } from "../errors.js";
 import { EXISTING_RESOURCE_KEY } from "./load-existing.js";
 import { idValueOf } from "./shapes.js";
 /** Context key for the extracted id (Go ResourceIdKey). */

package/dist/pipeline/steps/delete.js.map

@@ -1 +1 @@
-{"version":3,"file":"delete.js","sourceRoot":"","sources":["../../../src/pipeline/steps/delete.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGlF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,2DAA2D;AAC3D,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC;AAE5C,MAAM,UAAU,wBAAwB;IACtC,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,OAAO,CAAC,GAAyB;YAC/B,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACd,MAAM,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;YACxD,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAG1C,KAAY,EAAE,cAA4B;IAC1C,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,KAAK,CAAC,OAAO,CAAC,GAA8B;YAC1C,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YAElC,IAAI,QAAoC,CAAC;YACzC,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAChC,GAAG,CAAC,eAAe,EACnB,EAAE,EACF,cAAc,CACf,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,MAAM,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5D,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAY;IAEZ,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CACjB,KAAK,EACL,oBAAoB,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CACvD,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAyB;IAEzB,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,qEAAqE,CAAC,EAChF,0BAA0B,CAC3B,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}
+{"version":3,"file":"delete.js","sourceRoot":"","sources":["../../../src/pipeline/steps/delete.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,aAAa,GACd,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,2DAA2D;AAC3D,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC;AAE5C,MAAM,UAAU,wBAAwB;IAGtC,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,OAAO,CAAC,GAAyB;YAC/B,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACd,MAAM,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;YACxD,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAG1C,KAAY,EAAE,cAA4B;IAC1C,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,KAAK,CAAC,OAAO,CAAC,GAA8B;YAC1C,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YAElC,IAAI,QAAoC,CAAC;YACzC,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAChC,GAAG,CAAC,eAAe,EACnB,EAAE,EACF,cAAc,CACf,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,MAAM,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5D,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAY;IAEZ,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CACjB,KAAK,EACL,oBAAoB,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CACvD,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAyB;IAEzB,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,qEAAqE,CACtE,EACD,0BAA0B,CAC3B,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/pipeline/steps/duplicate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"duplicate.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/duplicate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAGtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAKnD,wBAAgB,qBAAqB,CAAC,IAAI,SAAS,WAAW,EAC5D,KAAK,EAAE,KAAK,GACX,YAAY,CAAC,IAAI,CAAC,CAmCpB"}
+{"version":3,"file":"duplicate.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/duplicate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAGtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAKnD,wBAAgB,qBAAqB,CAAC,IAAI,SAAS,WAAW,EAC5D,KAAK,EAAE,KAAK,GACX,YAAY,CAAC,IAAI,CAAC,CAyCpB"}

package/dist/pipeline/steps/duplicate.js.map

@@ -1 +1 @@
-{"version":3,"file":"duplicate.js","sourceRoot":"","sources":["../../../src/pipeline/steps/duplicate.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,qBAAqB,CACnC,KAAY;IAEZ,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,kEAAkE;gBAClE,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACzB,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAC9E,CAAC;YAED,IAAI,QAAQ,CAAC;YACb,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,kBAAkB,CACjC,KAAK,EACL,GAAG,CAAC,eAAe,EACnB,GAAG,CAAC,MAAM,EACV,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,GAAG,CACb,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;YAC/D,CAAC;YAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,gBAAgB,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC9C,MAAM,kBAAkB,CACtB,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,EAChC,SAAS,QAAQ,CAAC,IAAI,aAAa,gBAAgB,EAAE,GAAG,IAAI,EAAE,UAAU,gBAAgB,EAAE,EAAE,IAAI,EAAE,GAAG,CACtG,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"duplicate.js","sourceRoot":"","sources":["../../../src/pipeline/steps/duplicate.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,qBAAqB,CACnC,KAAY;IAEZ,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,kEAAkE;gBAClE,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,0BAA0B,CAAC,EACrC,iBAAiB,CAClB,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACzB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,wBAAwB,CAAC,EACnC,iBAAiB,CAClB,CAAC;YACJ,CAAC;YAED,IAAI,QAAQ,CAAC;YACb,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,kBAAkB,CACjC,KAAK,EACL,GAAG,CAAC,eAAe,EACnB,GAAG,CAAC,MAAM,EACV,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,GAAG,CACb,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;YAC/D,CAAC;YAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,gBAAgB,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC9C,MAAM,kBAAkB,CACtB,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,EAChC,SAAS,QAAQ,CAAC,IAAI,aAAa,gBAAgB,EAAE,GAAG,IAAI,EAAE,UAAU,gBAAgB,EAAE,EAAE,IAAI,EAAE,GAAG,CACtG,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/pipeline/steps/guard-plugin-managed.d.ts

@@ -0,0 +1,12 @@
+import type { DescMessage } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { PipelineStep } from "../pipeline.js";
+import type { Store } from "../../store/interface.js";
+/** The one sentence a refused mutation carries; the CLI and console render it as is. */
+export declare function pluginManagedRefusal(kind: ApiResourceKind, slug: string, pluginSlug: string): string;
+export interface GuardPluginManagedPositions {
+    /** The context key the stored resource rides; defaults to EXISTING_RESOURCE_KEY. */
+    readonly existingKey?: string;
+}
+export declare function newGuardPluginManagedStep<Desc extends DescMessage>(store: Store, positions?: GuardPluginManagedPositions): PipelineStep<Desc>;
+//# sourceMappingURL=guard-plugin-managed.d.ts.map

package/dist/pipeline/steps/guard-plugin-managed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-plugin-managed.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-plugin-managed.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,WAAW,EAAW,MAAM,oBAAoB,CAAC;AAG/D,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAItH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAYtD,wFAAwF;AACxF,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,EACrB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,GACjB,MAAM,CAOR;AAED,MAAM,WAAW,2BAA2B;IAC1C,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,KAAK,EAAE,KAAK,EACZ,SAAS,GAAE,2BAAgC,GAC1C,YAAY,CAAC,IAAI,CAAC,CAkDpB"}

package/dist/pipeline/steps/guard-plugin-managed.js

@@ -0,0 +1,96 @@
+/**
+ * GuardPluginManaged — the write boundary for resources a plugin
+ * materialised. A plugin's skills, MCP servers, agent and workflows are
+ * ordinary resources in the organization, labelled `stigmer.ai/plugin:
+ * <plugin id>` by the controller that installed them; the plugin owns
+ * their definition, so a client edit would be silently overwritten by the
+ * next upgrade and a client delete would leave the plugin claiming a
+ * member it no longer has. Customisation is composition: the user writes
+ * their own agent over the plugin's skills and servers, which stay readable
+ * and usable by everyone the visibility admits.
+ *
+ * Two facts decide, together (the apiresource-labels.ts doctrine: a label
+ * restricts only beside server-owned state):
+ *   - the STORED resource carries the plugin label — the request's labels
+ *     are never consulted, so a client cannot detach a child by omitting
+ *     the label on an update;
+ *   - AND the plugin row it names exists. A label whose plugin is gone (a
+ *     cascade that failed part-way; a label a self-hosted operator stamped
+ *     by hand under the permissive authorizer) leaves the resource editable
+ *     and deletable, so nothing can be locked forever.
+ *
+ * Server-composed writes pass by structure: the plugin controller is the
+ * one writer of these resources and rides the in-process lane as the
+ * installing caller (`origin: "in-process"`), exactly the arm
+ * GuardReservedLabels passes. Operational RPCs (connect, OAuth flows,
+ * instances, sessions, executions) never splice this step: they read or
+ * enrich a server, they do not redefine it.
+ *
+ * Placement: after the chain's load of the stored resource (LoadExisting,
+ * LoadExistingForDelete, a kind's visibility loader, skill push's
+ * FindExistingBySlug), before any state is built or persisted. The
+ * refusal is FAILED_PRECONDITION with the plugin named, so the user knows
+ * which door to use instead.
+ *
+ * Proven by __tests__/guard-plugin-managed.test.ts and the plugin
+ * conformance suite's managed-child arms.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { PluginSchema } from "@stigmer/protos/ai/stigmer/agentic/plugin/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { pluginIdOf } from "../apiresource-labels.js";
+import { internalError } from "../errors.js";
+import { ResourceNotFoundError } from "../../store/interface.js";
+import { EXISTING_RESOURCE_KEY } from "./load-existing.js";
+import { metadataOf } from "./shapes.js";
+/** The kinds a plugin materialises; the noun opens the refusal sentence. */
+const MANAGED_KIND_NOUNS = new Map([
+    [ApiResourceKind.skill, "skill"],
+    [ApiResourceKind.mcp_server, "MCP server"],
+    [ApiResourceKind.agent, "agent"],
+    [ApiResourceKind.workflow, "workflow"],
+]);
+/** The one sentence a refused mutation carries; the CLI and console render it as is. */
+export function pluginManagedRefusal(kind, slug, pluginSlug) {
+    const noun = MANAGED_KIND_NOUNS.get(kind) ?? ApiResourceKind[kind] ?? String(kind);
+    return (`${noun} '${slug}' is managed by plugin '${pluginSlug}'; change the plugin and ` +
+        "push it again, or compose your own agent over it");
+}
+export function newGuardPluginManagedStep(store, positions = {}) {
+    const existingKey = positions.existingKey ?? EXISTING_RESOURCE_KEY;
+    return {
+        name: "GuardPluginManaged",
+        async execute(ctx) {
+            if (ctx.callerIdentity.callerClass === "internal" ||
+                ctx.callerIdentity.origin === "in-process") {
+                // The plugin controller's own materialisation, upgrade and cascade
+                // writes; the same structural pass GuardReservedLabels takes.
+                return;
+            }
+            const existing = ctx.get(existingKey);
+            if (existing === undefined) {
+                return;
+            }
+            const metadata = metadataOf(existing);
+            const pluginId = pluginIdOf(metadata);
+            if (pluginId === undefined) {
+                return;
+            }
+            let pluginSlug;
+            try {
+                const plugin = await store.getResource(ApiResourceKind.plugin, pluginId, PluginSchema);
+                pluginSlug = plugin.metadata?.slug ?? pluginId;
+            }
+            catch (error) {
+                if (error instanceof ResourceNotFoundError) {
+                    // A dangling label locks nothing: the plugin that would own this
+                    // resource is gone, so the resource is the user's again.
+                    return;
+                }
+                throw internalError(error, "plugin ownership could not be checked");
+            }
+            throw new ConnectError(pluginManagedRefusal(ctx.apiResourceKind, metadata?.slug ?? "", pluginSlug), Code.FailedPrecondition);
+        },
+    };
+}
+//# sourceMappingURL=guard-plugin-managed.js.map

package/dist/pipeline/steps/guard-plugin-managed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-plugin-managed.js","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-plugin-managed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,4EAA4E;AAC5E,MAAM,kBAAkB,GAAyC,IAAI,GAAG,CAAC;IACvE,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC;IAChC,CAAC,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC;IAC1C,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC;IAChC,CAAC,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC;CACvC,CAAC,CAAC;AAEH,wFAAwF;AACxF,MAAM,UAAU,oBAAoB,CAClC,IAAqB,EACrB,IAAY,EACZ,UAAkB;IAElB,MAAM,IAAI,GACR,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;IACxE,OAAO,CACL,GAAG,IAAI,KAAK,IAAI,2BAA2B,UAAU,2BAA2B;QAChF,kDAAkD,CACnD,CAAC;AACJ,CAAC;AAOD,MAAM,UAAU,yBAAyB,CACvC,KAAY,EACZ,YAAyC,EAAE;IAE3C,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACnE,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IACE,GAAG,CAAC,cAAc,CAAC,WAAW,KAAK,UAAU;gBAC7C,GAAG,CAAC,cAAc,CAAC,MAAM,KAAK,YAAY,EAC1C,CAAC;gBACD,mEAAmE;gBACnE,8DAA8D;gBAC9D,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAmB,CAAC,CAAC;YACjD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,IAAI,UAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CACpC,eAAe,CAAC,MAAM,EACtB,QAAQ,EACR,YAAY,CACb,CAAC;gBACF,UAAU,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,QAAQ,CAAC;YACjD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,iEAAiE;oBACjE,yDAAyD;oBACzD,OAAO;gBACT,CAAC;gBACD,MAAM,aAAa,CAAC,KAAK,EAAE,uCAAuC,CAAC,CAAC;YACtE,CAAC;YAED,MAAM,IAAI,YAAY,CACpB,oBAAoB,CAClB,GAAG,CAAC,eAAe,EACnB,QAAQ,EAAE,IAAI,IAAI,EAAE,EACpB,UAAU,CACX,EACD,IAAI,CAAC,kBAAkB,CACxB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}