@stigmer/server 3.15.3-dev.20260914121148 → 3.16.0

package/dist/pipeline/steps/validate-visibility.d.ts

@@ -15,7 +15,9 @@
  * (Cloud's push handler does not validate either) — do not "fix" these.
  */
 import type { DescMessage } from "@bufbuild/protobuf";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import { UpdateVisibilityInputSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { PipelineStep } from "../pipeline.js";
 export declare function newValidateVisibilityStep<Desc extends DescMessage>(): PipelineStep<Desc>;
 export declare function newValidateVisibilityUpdateStep(): PipelineStep<typeof UpdateVisibilityInputSchema>;
@@ -26,4 +28,11 @@ export declare function newValidateVisibilityUpdateStep(): PipelineStep<typeof U
  * the PREDICATE lives in the instance controllers' own guard steps.
  */
 export declare function rejectDefaultInstanceVisibilityUpdate(): never;
+/** Go rejectUnsupportedVisibility (the shared level check + copy). */
+/**
+ * The one sentence for a level a kind does not support. Exported for the
+ * push-shaped chains whose requested level rides the request rather than
+ * a resource's metadata (plugin push), so the copy stays in one place.
+ */
+export declare function rejectUnsupportedVisibility(kind: ApiResourceKind, visibility: ApiResourceVisibility): void;
 //# sourceMappingURL=validate-visibility.d.ts.map

package/dist/pipeline/steps/validate-visibility.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-visibility.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/validate-visibility.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AAanG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAInD,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,KAAK,YAAY,CAAC,IAAI,CAAC,CAWxF;AAED,wBAAgB,+BAA+B,IAAI,YAAY,CAC7D,OAAO,2BAA2B,CACnC,CAOA;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,IAAI,KAAK,CAK7D"}
+{"version":3,"file":"validate-visibility.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/validate-visibility.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EAAE,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AACnG,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAYtH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAInD,wBAAgB,yBAAyB,CACvC,IAAI,SAAS,WAAW,KACrB,YAAY,CAAC,IAAI,CAAC,CAWtB;AAED,wBAAgB,+BAA+B,IAAI,YAAY,CAC7D,OAAO,2BAA2B,CACnC,CAOA;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,IAAI,KAAK,CAK7D;AAED,sEAAsE;AACtE;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,qBAAqB,GAChC,IAAI,CAeN"}

package/dist/pipeline/steps/validate-visibility.js

@@ -34,7 +34,12 @@ export function rejectDefaultInstanceVisibilityUpdate() {
         "the parent blueprint. Change the blueprint's visibility instead.");
 }
 /** Go rejectUnsupportedVisibility (the shared level check + copy). */
-function rejectUnsupportedVisibility(kind, visibility) {
+/**
+ * The one sentence for a level a kind does not support. Exported for the
+ * push-shaped chains whose requested level rides the request rather than
+ * a resource's metadata (plugin push), so the copy stays in one place.
+ */
+export function rejectUnsupportedVisibility(kind, visibility) {
     let supported;
     let levels;
     try {

package/dist/pipeline/steps/validate-visibility.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate-visibility.js","sourceRoot":"","sources":["../../../src/pipeline/steps/validate-visibility.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAI/F,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAGlE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,OAAO,CAAC,GAAyB;YAC/B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO,CAAC,yDAAyD;YACnE,CAAC;YACD,2BAA2B,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B;IAG7C,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,OAAO,CAAC,GAAuD;YAC7D,2BAA2B,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC;IACnD,MAAM,uBAAuB,CAC3B,6EAA6E;QAC3E,kEAAkE,CACrE,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,SAAS,2BAA2B,CAClC,IAAqB,EACrB,UAAiC;IAEjC,IAAI,SAAkB,CAAC;IACvB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACjD,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,+CAA+C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;IACT,CAAC;IACD,MAAM,oBAAoB,CACxB,GAAG,mBAAmB,CAAC,IAAI,CAAC,+BAA+B,qBAAqB,CAAC,UAAU,CAAC,kCAAkC,MAAM,GAAG,CACxI,CAAC;AACJ,CAAC"}
+{"version":3,"file":"validate-visibility.js","sourceRoot":"","sources":["../../../src/pipeline/steps/validate-visibility.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAI/F,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAGlE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,yBAAyB;IAGvC,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,OAAO,CAAC,GAAyB;YAC/B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO,CAAC,yDAAyD;YACnE,CAAC;YACD,2BAA2B,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B;IAG7C,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,OAAO,CAAC,GAAuD;YAC7D,2BAA2B,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC;IACnD,MAAM,uBAAuB,CAC3B,6EAA6E;QAC3E,kEAAkE,CACrE,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAqB,EACrB,UAAiC;IAEjC,IAAI,SAAkB,CAAC;IACvB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,SAAS,GAAG,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACjD,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,+CAA+C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;IACT,CAAC;IACD,MAAM,oBAAoB,CACxB,GAAG,mBAAmB,CAAC,IAAI,CAAC,+BAA+B,qBAAqB,CAAC,UAAU,CAAC,kCAAkC,MAAM,GAAG,CACxI,CAAC;AACJ,CAAC"}

package/dist/pipeline/steps/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/validation.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAOnD,wBAAgB,SAAS,IAAI,SAAS,CAKrC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,SAAS,WAAW,KAAK,YAAY,CAAC,IAAI,CAAC,CAmBnF"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/validation.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAOnD,wBAAgB,SAAS,IAAI,SAAS,CAKrC;AAED,wBAAgB,oBAAoB,CAClC,IAAI,SAAS,WAAW,KACrB,YAAY,CAAC,IAAI,CAAC,CAmBtB"}

package/dist/pipeline/steps/validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../src/pipeline/steps/validation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAM1D,0EAA0E;AAC1E,yBAAyB;AACzB,IAAI,eAAsC,CAAC;AAE3C,MAAM,UAAU,SAAS;IACvB,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,eAAe,GAAG,eAAe,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,OAAO,CAAC,GAAyB;YAC/B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3D,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACrE,CAAC;YACD,oEAAoE;YACpE,qDAAqD;YACrD,MAAM,IAAI,YAAY,CACpB,6BAA6B,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACnD,IAAI,CAAC,QAAQ,CACd,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../src/pipeline/steps/validation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAM1D,0EAA0E;AAC1E,yBAAyB;AACzB,IAAI,eAAsC,CAAC;AAE3C,MAAM,UAAU,SAAS;IACvB,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,eAAe,GAAG,eAAe,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,oBAAoB;IAGlC,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,OAAO,CAAC,GAAyB;YAC/B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3D,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACrE,CAAC;YACD,oEAAoE;YACpE,qDAAqD;YACrD,MAAM,IAAI,YAAY,CACpB,6BAA6B,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACnD,IAAI,CAAC,QAAQ,CACd,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/pipeline/steps/version-archive.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The write side of content-addressed versioning, shared by every kind
+ * whose version is the SHA-256 of a pushed archive (skills, plugins): the
+ * "archive the head" step a push runs after the head is fully populated,
+ * and the best-effort archive cleanup a delete runs before the row. Skills
+ * carried both alone (#341, adopted for skills in #475; the Go
+ * ArchiveCurrentSkillStep / DeleteSkillArchivesStep port); plugins need the
+ * identical semantics over another schema, so the steps live here and each
+ * kind names its step (`ArchiveCurrentSkill`, `ArchiveCurrentPlugin`), its
+ * context key and where its hash and tag live.
+ *
+ * The load-bearing semantics, all preserved from the skill port:
+ *   - repoint-never-duplicate: re-pushing EVER-archived content repoints the
+ *     head to the existing audit row (an A→B→A re-push must not duplicate
+ *     A's row);
+ *   - snapshots archive TAGLESS; the audit tag COLUMN is the tag's only
+ *     home, assigned through the single-holder setAuditTag primitive —
+ *     assigned even when the content was already archived, because
+ *     re-pushing under a new tag is the only retag path;
+ *   - safe degradation: archive failure clears the version hash from the
+ *     head (the persisted head never references an unresolvable audit
+ *     entry); tag-assignment failure clears the live tag.
+ *
+ * Proven by the skill domain's __tests__/push-degradation.test.ts (the
+ * failing-store arms) and both kinds' conformance suites (the
+ * content-addressed versioning blocks).
+ */
+import type { DescMessage, MessageShape } from "@bufbuild/protobuf";
+import type { Logger } from "../../boot/logger.js";
+import type { PipelineStep } from "../pipeline.js";
+import type { Store } from "../../store/interface.js";
+/** What a content-versioned kind must expose for its head to be archived. */
+export interface ArchiveCurrentVersionBinding<Desc extends DescMessage> {
+    /** The step's name in the chain; shared vocabulary, never renamed. */
+    readonly stepName: string;
+    /** The context key the fully populated head rides. */
+    readonly resourceKey: string;
+    readonly schema: Desc;
+    /** The noun in log lines: "skill", "plugin". */
+    readonly noun: string;
+    headHashOf(resource: MessageShape<Desc>): string;
+    /** Degradation arm: the head must never reference an unresolvable audit row. */
+    clearHeadHash(resource: MessageShape<Desc>): void;
+    liveTagOf(resource: MessageShape<Desc>): string;
+    /** Degradation arm: the live tag must agree with the audit column. */
+    clearLiveTag(resource: MessageShape<Desc>): void;
+}
+/**
+ * Repoint or archive, then the single-holder tag assignment, each with its
+ * safe degradation. Runs AFTER the populate step so the archived snapshot
+ * is the fully populated head.
+ */
+export declare function newArchiveCurrentVersionStep<Desc extends DescMessage, RequestDesc extends DescMessage>(store: Store, logger: Logger, binding: ArchiveCurrentVersionBinding<Desc>): PipelineStep<RequestDesc>;
+/**
+ * Best-effort audit cleanup BEFORE the resource row (no FK cascade in the
+ * schema, by design): failures log and never block the delete. Reads the
+ * id ExtractResourceId set.
+ */
+export declare function newDeleteVersionArchivesStep<RequestDesc extends DescMessage>(store: Store, logger: Logger, binding: {
+    readonly stepName: string;
+    readonly noun: string;
+}): PipelineStep<RequestDesc>;
+//# sourceMappingURL=version-archive.d.ts.map

package/dist/pipeline/steps/version-archive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-archive.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/version-archive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAItD,6EAA6E;AAC7E,MAAM,WAAW,4BAA4B,CAAC,IAAI,SAAS,WAAW;IACpE,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IACjD,gFAAgF;IAChF,aAAa,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAClD,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IAChD,sEAAsE;IACtE,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAClD;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,SAAS,WAAW,EACxB,WAAW,SAAS,WAAW,EAE/B,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,4BAA4B,CAAC,IAAI,CAAC,GAC1C,YAAY,CAAC,WAAW,CAAC,CAiH3B;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,WAAW,SAAS,WAAW,EAC1E,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5D,YAAY,CAAC,WAAW,CAAC,CA8B3B"}

package/dist/pipeline/steps/version-archive.js

@@ -0,0 +1,129 @@
+import { AuditNotFoundError } from "../../store/interface.js";
+import { RESOURCE_ID_KEY } from "./delete.js";
+import { metadataOf } from "./shapes.js";
+/**
+ * Repoint or archive, then the single-holder tag assignment, each with its
+ * safe degradation. Runs AFTER the populate step so the archived snapshot
+ * is the fully populated head.
+ */
+export function newArchiveCurrentVersionStep(store, logger, binding) {
+    return {
+        name: binding.stepName,
+        async execute(ctx) {
+            const resource = ctx.get(binding.resourceKey);
+            const versionHash = binding.headHashOf(resource);
+            if (versionHash === "") {
+                return;
+            }
+            const tag = binding.liveTagOf(resource);
+            const resourceId = metadataOf(resource)?.id ?? "";
+            const idField = `${binding.noun}Id`;
+            // Repoint, never duplicate: if this content was ever archived, the
+            // head simply repoints to the existing row and only the tag
+            // assignment below still runs. An unexpected lookup failure degrades
+            // to archiving anyway — a possible duplicate row beats a failed push
+            // (readers resolve duplicates newest-wins).
+            let alreadyArchived = false;
+            try {
+                await store.getAuditByHash(ctx.apiResourceKind, resourceId, versionHash, binding.schema);
+                alreadyArchived = true;
+            }
+            catch (error) {
+                if (!(error instanceof AuditNotFoundError)) {
+                    logger.warn(`Could not check for an existing archived ${binding.noun} version — archiving anyway`, {
+                        [idField]: resourceId,
+                        versionHash,
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                }
+            }
+            if (!alreadyArchived) {
+                // Archive the snapshot tagless: the tag lives only in the audit tag
+                // column (the source of truth), assigned below through the
+                // single-holder primitive — a later tag move never rewrites this
+                // immutable content.
+                try {
+                    await store.saveAudit(ctx.apiResourceKind, resourceId, binding.schema, resource, versionHash, "");
+                }
+                catch (error) {
+                    logger.error(`Failed to archive ${binding.noun} version — reverting the version hash to maintain the audit-resolvability invariant`, {
+                        [idField]: resourceId,
+                        versionHash,
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                    // Revert: the persisted head must never reference an audit entry
+                    // that does not exist. The push still succeeds, but without
+                    // version tracking for this apply.
+                    binding.clearHeadHash(resource);
+                    return;
+                }
+            }
+            // Assign the requested tag through setAuditTag — the single-holder
+            // primitive — so the head version (freshly archived or repointed-to)
+            // becomes the tag's sole holder; any prior holder is cleared.
+            if (tag !== "") {
+                try {
+                    await store.setAuditTag(ctx.apiResourceKind, resourceId, versionHash, tag);
+                }
+                catch (error) {
+                    logger.error(`Archived ${binding.noun} version but failed to assign its tag — clearing the live tag to stay consistent with the audit column`, {
+                        [idField]: resourceId,
+                        versionHash,
+                        tag,
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                    // The audit head is now untagged; keep the live head consistent
+                    // so get / getByReference never advertise a tag the store cannot
+                    // resolve.
+                    binding.clearLiveTag(resource);
+                }
+            }
+            if (alreadyArchived) {
+                logger.info(`${capitalize(binding.noun)} version content already archived — repointed head without a new history row`, { [idField]: resourceId, versionHash, tag });
+            }
+            else {
+                logger.info(`Archived ${binding.noun} version to audit history`, {
+                    [idField]: resourceId,
+                    versionHash,
+                    tag,
+                });
+            }
+        },
+    };
+}
+/**
+ * Best-effort audit cleanup BEFORE the resource row (no FK cascade in the
+ * schema, by design): failures log and never block the delete. Reads the
+ * id ExtractResourceId set.
+ */
+export function newDeleteVersionArchivesStep(store, logger, binding) {
+    return {
+        name: binding.stepName,
+        async execute(ctx) {
+            const resourceId = ctx.get(RESOURCE_ID_KEY);
+            if (typeof resourceId !== "string") {
+                throw new Error("resource id not found in context (ExtractResourceIdStep must run first)");
+            }
+            const idField = `${binding.noun}Id`;
+            try {
+                const deletedCount = await store.deleteAuditByResourceId(ctx.apiResourceKind, resourceId);
+                if (deletedCount > 0) {
+                    logger.info(`Deleted archive records for ${binding.noun}`, {
+                        [idField]: resourceId,
+                        count: deletedCount,
+                    });
+                }
+            }
+            catch (error) {
+                logger.warn(`failed to delete ${binding.noun} archives (best-effort)`, {
+                    [idField]: resourceId,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        },
+    };
+}
+function capitalize(word) {
+    return word.charAt(0).toUpperCase() + word.slice(1);
+}
+//# sourceMappingURL=version-archive.js.map

package/dist/pipeline/steps/version-archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-archive.js","sourceRoot":"","sources":["../../../src/pipeline/steps/version-archive.ts"],"names":[],"mappings":"AAgCA,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAmBzC;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAI1C,KAAY,EACZ,MAAc,EACd,OAA2C;IAE3C,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,QAAQ;QACtB,KAAK,CAAC,OAAO,CAAC,GAAgC;YAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAuB,CAAC;YACpE,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACjD,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACxC,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC;YAEpC,mEAAmE;YACnE,4DAA4D;YAC5D,qEAAqE;YACrE,qEAAqE;YACrE,4CAA4C;YAC5C,IAAI,eAAe,GAAG,KAAK,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,cAAc,CACxB,GAAG,CAAC,eAAe,EACnB,UAAU,EACV,WAAW,EACX,OAAO,CAAC,MAAM,CACf,CAAC;gBACF,eAAe,GAAG,IAAI,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,kBAAkB,CAAC,EAAE,CAAC;oBAC3C,MAAM,CAAC,IAAI,CACT,4CAA4C,OAAO,CAAC,IAAI,6BAA6B,EACrF;wBACE,CAAC,OAAO,CAAC,EAAE,UAAU;wBACrB,WAAW;wBACX,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,oEAAoE;gBACpE,2DAA2D;gBAC3D,iEAAiE;gBACjE,qBAAqB;gBACrB,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,SAAS,CACnB,GAAG,CAAC,eAAe,EACnB,UAAU,EACV,OAAO,CAAC,MAAM,EACd,QAAQ,EACR,WAAW,EACX,EAAE,CACH,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CACV,qBAAqB,OAAO,CAAC,IAAI,qFAAqF,EACtH;wBACE,CAAC,OAAO,CAAC,EAAE,UAAU;wBACrB,WAAW;wBACX,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CACF,CAAC;oBACF,iEAAiE;oBACjE,4DAA4D;oBAC5D,mCAAmC;oBACnC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;oBAChC,OAAO;gBACT,CAAC;YACH,CAAC;YAED,mEAAmE;YACnE,qEAAqE;YACrE,8DAA8D;YAC9D,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,WAAW,CACrB,GAAG,CAAC,eAAe,EACnB,UAAU,EACV,WAAW,EACX,GAAG,CACJ,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CACV,YAAY,OAAO,CAAC,IAAI,wGAAwG,EAChI;wBACE,CAAC,OAAO,CAAC,EAAE,UAAU;wBACrB,WAAW;wBACX,GAAG;wBACH,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CACF,CAAC;oBACF,gEAAgE;oBAChE,iEAAiE;oBACjE,WAAW;oBACX,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC;YAED,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CACT,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,8EAA8E,EACzG,EAAE,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,CAC5C,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,IAAI,2BAA2B,EAAE;oBAC/D,CAAC,OAAO,CAAC,EAAE,UAAU;oBACrB,WAAW;oBACX,GAAG;iBACJ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAAY,EACZ,MAAc,EACd,OAA6D;IAE7D,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,QAAQ;QACtB,KAAK,CAAC,OAAO,CAAC,GAAgC;YAC5C,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAC5C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,uBAAuB,CACtD,GAAG,CAAC,eAAe,EACnB,UAAU,CACX,CAAC;gBACF,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;oBACrB,MAAM,CAAC,IAAI,CAAC,+BAA+B,OAAO,CAAC,IAAI,EAAE,EAAE;wBACzD,CAAC,OAAO,CAAC,EAAE,UAAU;wBACrB,KAAK,EAAE,YAAY;qBACpB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,IAAI,yBAAyB,EAAE;oBACrE,CAAC,OAAO,CAAC,EAAE,UAAU;oBACrB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC"}

package/dist/pipeline/steps/version-history.d.ts

@@ -0,0 +1,49 @@
+import type { DescMessage, Message, MessageShape } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { ApiResourceReferenceSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import type { PipelineStep } from "../pipeline.js";
+import type { Store } from "../../store/interface.js";
+export declare function isVersionHash(version: string): boolean;
+/** What a content-versioned kind must say about itself for the ladder. */
+export interface VersionedResourceBinding<Desc extends DescMessage> {
+    readonly kind: ApiResourceKind;
+    readonly schema: Desc;
+    /** The noun in sentences: "skill", "plugin". */
+    readonly noun: string;
+    /** The head's content hash (status.version_hash, status.digest). */
+    headHashOf(resource: MessageShape<Desc>): string;
+    /** The tag the live head claims (spec.tag; the plugin's manifest version). */
+    liveTagOf(resource: MessageShape<Desc>): string;
+}
+type GetByReferenceDesc = typeof ApiResourceReferenceSchema;
+/** The reference + version ladder (Go LoadSkillByReferenceStep, generalised). */
+export declare function newLoadByReferenceWithVersionStep<Desc extends DescMessage>(store: Store, binding: VersionedResourceBinding<Desc>, stepName: string): PipelineStep<GetByReferenceDesc>;
+export declare const LIST_VERSIONS_RESOURCE_ID_KEY = "listVersionsResourceId";
+export declare const LIST_VERSIONS_HEAD_HASH_KEY = "listVersionsHeadHash";
+export declare const LIST_VERSIONS_RESPONSE_KEY = "listVersionsResponse";
+/** The fields every ListVersions input carries; the binding reads them off its own message. */
+export interface ListVersionsInputShape {
+    readonly org: string;
+    readonly slug: string;
+    readonly pageToken: string;
+    readonly pageSize: number;
+}
+/** What differs per kind in the version history: the input, the entry, the response. */
+export interface VersionHistoryBinding<Desc extends DescMessage, InputDesc extends DescMessage, Entry extends Message, Response extends Message> extends VersionedResourceBinding<Desc> {
+    input(message: MessageShape<InputDesc>): ListVersionsInputShape;
+    /** An archived snapshot to one entry; `tag` is the audit column's. */
+    mapEntry(snapshot: MessageShape<Desc>, isCurrent: boolean, tag: string): Entry;
+    response(entries: Entry[], nextPageToken: string, totalCount: number): Response;
+}
+/** Resolves the head by slug and captures its id and hash (Go ResolveSkillBySlugStep, generalised). */
+export declare function newResolveBySlugForVersionsStep<Desc extends DescMessage, InputDesc extends DescMessage, Entry extends Message, Response extends Message>(store: Store, binding: VersionHistoryBinding<Desc, InputDesc, Entry, Response>, stepName: string): PipelineStep<InputDesc>;
+/** Audit records → entries → one page (Go LoadAndMapVersionsStep, generalised). */
+export declare function newLoadAndMapVersionsStep<Desc extends DescMessage, InputDesc extends DescMessage, Entry extends Message, Response extends Message>(store: Store, binding: VersionHistoryBinding<Desc, InputDesc, Entry, Response>, stepName: string): PipelineStep<InputDesc>;
+/**
+ * Decodes the base64 cursor with Go's strictness: base64.StdEncoding
+ * rejects malformed input and strconv.Atoi rejects trailing garbage —
+ * Buffer.from is lenient on both, so validity is checked explicitly.
+ */
+export declare function decodePageToken(token: string): number;
+export {};
+//# sourceMappingURL=version-history.d.ts.map

package/dist/pipeline/steps/version-history.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-history.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/version-history.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE7E,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sDAAsD,CAAC;AAOvG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAQtD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,0EAA0E;AAC1E,MAAM,WAAW,wBAAwB,CAAC,IAAI,SAAS,WAAW;IAChE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IACjD,8EAA8E;IAC9E,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;CACjD;AAED,KAAK,kBAAkB,GAAG,OAAO,0BAA0B,CAAC;AAE5D,iFAAiF;AACjF,wBAAgB,iCAAiC,CAAC,IAAI,SAAS,WAAW,EACxE,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,wBAAwB,CAAC,IAAI,CAAC,EACvC,QAAQ,EAAE,MAAM,GACf,YAAY,CAAC,kBAAkB,CAAC,CAkElC;AAmDD,eAAO,MAAM,6BAA6B,2BAA2B,CAAC;AACtE,eAAO,MAAM,2BAA2B,yBAAyB,CAAC;AAClE,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AAEjE,+FAA+F;AAC/F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,wFAAwF;AACxF,MAAM,WAAW,qBAAqB,CACpC,IAAI,SAAS,WAAW,EACxB,SAAS,SAAS,WAAW,EAC7B,KAAK,SAAS,OAAO,EACrB,QAAQ,SAAS,OAAO,CACxB,SAAQ,wBAAwB,CAAC,IAAI,CAAC;IACtC,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,GAAG,sBAAsB,CAAC;IAChE,sEAAsE;IACtE,QAAQ,CACN,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,EAC5B,SAAS,EAAE,OAAO,EAClB,GAAG,EAAE,MAAM,GACV,KAAK,CAAC;IACT,QAAQ,CACN,OAAO,EAAE,KAAK,EAAE,EAChB,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,MAAM,GACjB,QAAQ,CAAC;CACb;AAED,uGAAuG;AACvG,wBAAgB,+BAA+B,CAC7C,IAAI,SAAS,WAAW,EACxB,SAAS,SAAS,WAAW,EAC7B,KAAK,SAAS,OAAO,EACrB,QAAQ,SAAS,OAAO,EAExB,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,qBAAqB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,EAChE,QAAQ,EAAE,MAAM,GACf,YAAY,CAAC,SAAS,CAAC,CA2BzB;AAED,mFAAmF;AACnF,wBAAgB,yBAAyB,CACvC,IAAI,SAAS,WAAW,EACxB,SAAS,SAAS,WAAW,EAC7B,KAAK,SAAS,OAAO,EACrB,QAAQ,SAAS,OAAO,EAExB,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,qBAAqB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,EAChE,QAAQ,EAAE,MAAM,GACf,YAAY,CAAC,SAAS,CAAC,CAkEzB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWrD"}

package/dist/pipeline/steps/version-history.js

@@ -0,0 +1,229 @@
+/**
+ * The read side of content-addressed versioning, shared by every kind whose
+ * version is the SHA-256 of a pushed archive (skills, plugins): the
+ * getByReference version ladder and the paginated version history. Skills
+ * carried both alone (the Go LoadSkillByReferenceStep / ListVersions port);
+ * plugins need the identical ladder over another schema, and a second copy
+ * would be the drift the house forbids, so the steps take a
+ * `VersionedResourceBinding` that names what differs per kind (the schema,
+ * the noun in sentences, where the head hash and the live tag live, how a
+ * snapshot maps to an entry) and keep everything else once.
+ *
+ * The ladder: resolve the live head by slug+org; empty/"latest" returns it;
+ * a 64-hex version matches the head's hash or falls to the indexed
+ * audit-by-hash lookup; anything else is a tag, matching the head's live
+ * tag first (honest under the single-holder model: a push reconciles the
+ * live tag with the audit tag column, clearing the live tag when
+ * assignment fails) and then the indexed audit-by-tag lookup.
+ *
+ * listVersions marks is_current by HEAD-HASH match, not recency: under
+ * repoint semantics (#475) re-pushing archived content re-activates its
+ * existing row, so the current version need not be the newest-archived
+ * one. Tags come from the audit COLUMN (the single-holder source of
+ * truth), never from the snapshot.
+ *
+ * Proven by the skill domain's __tests__/skill.test.ts (ladder and
+ * pagination blocks) and the skill and plugin conformance suites'
+ * getByReference/listVersions blocks.
+ */
+import { fromBinary } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { internalError, invalidArgumentError, notFoundError, } from "../errors.js";
+import { AuditNotFoundError } from "../../store/interface.js";
+import { findResourceBySlug, requireOrgForReference } from "./helpers.js";
+import { TARGET_RESOURCE_KEY } from "./load-target.js";
+import { metadataOf } from "./shapes.js";
+/** A 64-character lowercase-hex string (a SHA-256 content hash). */
+const HASH_PATTERN = /^[a-f0-9]{64}$/;
+export function isVersionHash(version) {
+    return HASH_PATTERN.test(version);
+}
+/** The reference + version ladder (Go LoadSkillByReferenceStep, generalised). */
+export function newLoadByReferenceWithVersionStep(store, binding, stepName) {
+    return {
+        name: stepName,
+        async execute(ctx) {
+            const ref = ctx.input;
+            if (ref.slug === "") {
+                throw invalidArgumentError("slug is required in reference");
+            }
+            // Org-scoped kinds: the slug is unique only within an org, so an
+            // empty-org reference is under-specified.
+            requireOrgForReference(ctx.apiResourceKind, ref.org);
+            if (ref.kind !== ApiResourceKind.api_resource_kind_unknown &&
+                ref.kind !== binding.kind) {
+                throw invalidArgumentError(`kind mismatch: expected ${ApiResourceKind[binding.kind]}, got ${ApiResourceKind[ref.kind]}`);
+            }
+            let head;
+            try {
+                head = await findResourceBySlug(store, ctx.apiResourceKind, binding.schema, ref.slug, ref.org);
+            }
+            catch (error) {
+                throw internalError(error, `failed to list ${binding.noun}s`);
+            }
+            if (head === undefined) {
+                throw notFoundError(binding.noun, ref.slug);
+            }
+            const version = ref.version.trim();
+            if (version === "" || version === "latest") {
+                ctx.set(TARGET_RESOURCE_KEY, head);
+                return;
+            }
+            if (headMatchesVersion(binding, head, version)) {
+                ctx.set(TARGET_RESOURCE_KEY, head);
+                return;
+            }
+            const archived = await findAuditByVersion(store, ctx.apiResourceKind, binding.schema, idOf(head), version);
+            if (archived === undefined) {
+                throw notFoundError(`${binding.noun} version`, `${ref.slug}:${version}`);
+            }
+            ctx.set(TARGET_RESOURCE_KEY, archived);
+        },
+    };
+}
+/** Whether the live head IS the requested version — by hash, or by its live tag. */
+function headMatchesVersion(binding, head, version) {
+    if (isVersionHash(version)) {
+        return binding.headHashOf(head) === version;
+    }
+    const liveTag = binding.liveTagOf(head);
+    return liveTag !== "" && liveTag === version;
+}
+/**
+ * Indexed audit lookup by hash or tag — not-found is a normal outcome
+ * (undefined), storage failures are Internal.
+ */
+async function findAuditByVersion(store, kind, schema, resourceId, version) {
+    if (isVersionHash(version)) {
+        try {
+            return await store.getAuditByHash(kind, resourceId, version, schema);
+        }
+        catch (error) {
+            if (error instanceof AuditNotFoundError) {
+                return undefined;
+            }
+            throw internalError(error, "failed to query audit by hash");
+        }
+    }
+    try {
+        return await store.getAuditByTag(kind, resourceId, version, schema);
+    }
+    catch (error) {
+        if (error instanceof AuditNotFoundError) {
+            return undefined;
+        }
+        throw internalError(error, "failed to query audit by tag");
+    }
+}
+// ─── listVersions ────────────────────────────────────────────────────────
+const DEFAULT_PAGE_SIZE = 50;
+const MAX_PAGE_SIZE = 100;
+export const LIST_VERSIONS_RESOURCE_ID_KEY = "listVersionsResourceId";
+export const LIST_VERSIONS_HEAD_HASH_KEY = "listVersionsHeadHash";
+export const LIST_VERSIONS_RESPONSE_KEY = "listVersionsResponse";
+/** Resolves the head by slug and captures its id and hash (Go ResolveSkillBySlugStep, generalised). */
+export function newResolveBySlugForVersionsStep(store, binding, stepName) {
+    return {
+        name: stepName,
+        async execute(ctx) {
+            const req = binding.input(ctx.input);
+            let head;
+            try {
+                head = await findResourceBySlug(store, ctx.apiResourceKind, binding.schema, req.slug, req.org);
+            }
+            catch (error) {
+                throw internalError(error, `failed to search for ${binding.noun}`);
+            }
+            if (head === undefined) {
+                throw notFoundError(binding.noun, `${req.slug} (org: ${req.org})`);
+            }
+            ctx.set(LIST_VERSIONS_RESOURCE_ID_KEY, idOf(head));
+            // The live head's hash decides is_current downstream. Under repoint
+            // semantics the current version need not be the newest-archived row,
+            // so recency cannot stand in for currency.
+            ctx.set(LIST_VERSIONS_HEAD_HASH_KEY, binding.headHashOf(head));
+        },
+    };
+}
+/** Audit records → entries → one page (Go LoadAndMapVersionsStep, generalised). */
+export function newLoadAndMapVersionsStep(store, binding, stepName) {
+    return {
+        name: stepName,
+        async execute(ctx) {
+            const req = binding.input(ctx.input);
+            const resourceId = ctx.get(LIST_VERSIONS_RESOURCE_ID_KEY);
+            let records;
+            try {
+                records = await store.listAuditRecords(ctx.apiResourceKind, resourceId);
+            }
+            catch (error) {
+                throw internalError(error, "failed to load version history");
+            }
+            // is_current = the entry whose hash matches the live head, not the
+            // newest row. Legacy data may hold duplicate-hash rows (predating
+            // repoint semantics); marking only the first match keeps
+            // exactly-one-current true for them too.
+            const headHash = ctx.get(LIST_VERSIONS_HEAD_HASH_KEY);
+            let currentMarked = false;
+            const entries = [];
+            for (const record of records) {
+                let snapshot;
+                try {
+                    snapshot = fromBinary(binding.schema, record.data);
+                }
+                catch {
+                    continue;
+                }
+                const isCurrent = !currentMarked &&
+                    headHash !== "" &&
+                    binding.headHashOf(snapshot) === headHash;
+                currentMarked = currentMarked || isCurrent;
+                // Tag comes from the audit column (source of truth), not the snapshot.
+                entries.push(binding.mapEntry(snapshot, isCurrent, record.tag));
+            }
+            let pageSize = req.pageSize;
+            if (pageSize <= 0) {
+                pageSize = DEFAULT_PAGE_SIZE;
+            }
+            if (pageSize > MAX_PAGE_SIZE) {
+                pageSize = MAX_PAGE_SIZE;
+            }
+            let startIndex = 0;
+            if (req.pageToken !== "") {
+                startIndex = decodePageToken(req.pageToken);
+            }
+            let pageEntries = [];
+            let nextPageToken = "";
+            if (startIndex < entries.length) {
+                const end = Math.min(startIndex + pageSize, entries.length);
+                pageEntries = entries.slice(startIndex, end);
+                if (end < entries.length) {
+                    nextPageToken = Buffer.from(String(end)).toString("base64");
+                }
+            }
+            ctx.set(LIST_VERSIONS_RESPONSE_KEY, binding.response(pageEntries, nextPageToken, entries.length));
+        },
+    };
+}
+/**
+ * Decodes the base64 cursor with Go's strictness: base64.StdEncoding
+ * rejects malformed input and strconv.Atoi rejects trailing garbage —
+ * Buffer.from is lenient on both, so validity is checked explicitly.
+ */
+export function decodePageToken(token) {
+    const decoded = Buffer.from(token, "base64");
+    if (decoded.toString("base64") !== token) {
+        throw invalidArgumentError("invalid page_token");
+    }
+    const text = decoded.toString("utf8");
+    const index = Number.parseInt(text, 10);
+    if (!Number.isSafeInteger(index) || String(index) !== text || index < 0) {
+        throw invalidArgumentError("invalid page_token");
+    }
+    return index;
+}
+/** metadata.id of a resource message; every versioned kind carries the commons metadata. */
+function idOf(resource) {
+    return metadataOf(resource)?.id ?? "";
+}
+//# sourceMappingURL=version-history.js.map

package/dist/pipeline/steps/version-history.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-history.js","sourceRoot":"","sources":["../../../src/pipeline/steps/version-history.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,aAAa,GACd,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,oEAAoE;AACpE,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAEtC,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAgBD,iFAAiF;AACjF,MAAM,UAAU,iCAAiC,CAC/C,KAAY,EACZ,OAAuC,EACvC,QAAgB;IAEhB,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CAAC,GAAuC;YACnD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC;YAEtB,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACpB,MAAM,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;YAC9D,CAAC;YAED,iEAAiE;YACjE,0CAA0C;YAC1C,sBAAsB,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAErD,IACE,GAAG,CAAC,IAAI,KAAK,eAAe,CAAC,yBAAyB;gBACtD,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EACzB,CAAC;gBACD,MAAM,oBAAoB,CACxB,2BAA2B,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAC7F,CAAC;YACJ,CAAC;YAED,IAAI,IAAoC,CAAC;YACzC,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,kBAAkB,CAC7B,KAAK,EACL,GAAG,CAAC,eAAe,EACnB,OAAO,CAAC,MAAM,EACd,GAAG,CAAC,IAAI,EACR,GAAG,CAAC,GAAG,CACR,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,kBAAkB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9C,CAAC;YAED,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC3C,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;gBACnC,OAAO;YACT,CAAC;YAED,IAAI,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;gBACnC,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACvC,KAAK,EACL,GAAG,CAAC,eAAe,EACnB,OAAO,CAAC,MAAM,EACd,IAAI,CAAC,IAAI,CAAC,EACV,OAAO,CACR,CAAC;YACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,GAAG,OAAO,CAAC,IAAI,UAAU,EACzB,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,CACzB,CAAC;YACJ,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,SAAS,kBAAkB,CACzB,OAAuC,EACvC,IAAwB,EACxB,OAAe;IAEf,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC;IAC9C,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,OAAO,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,kBAAkB,CAC/B,KAAY,EACZ,IAAqB,EACrB,MAAY,EACZ,UAAkB,EAClB,OAAe;IAEf,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;gBACxC,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,aAAa,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;YACxC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,aAAa,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,4EAA4E;AAE5E,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,MAAM,CAAC,MAAM,6BAA6B,GAAG,wBAAwB,CAAC;AACtE,MAAM,CAAC,MAAM,2BAA2B,GAAG,sBAAsB,CAAC;AAClE,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AA+BjE,uGAAuG;AACvG,MAAM,UAAU,+BAA+B,CAM7C,KAAY,EACZ,OAAgE,EAChE,QAAgB;IAEhB,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CAAC,GAA8B;YAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,IAAoC,CAAC;YACzC,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,kBAAkB,CAC7B,KAAK,EACL,GAAG,CAAC,eAAe,EACnB,OAAO,CAAC,MAAM,EACd,GAAG,CAAC,IAAI,EACR,GAAG,CAAC,GAAG,CACR,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,wBAAwB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,UAAU,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;YACrE,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,oEAAoE;YACpE,qEAAqE;YACrE,2CAA2C;YAC3C,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,yBAAyB,CAMvC,KAAY,EACZ,OAAgE,EAChE,QAAgB;IAEhB,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CAAC,GAA8B;YAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAW,CAAC;YAEpE,IAAI,OAAO,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAC1E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;YAC/D,CAAC;YAED,mEAAmE;YACnE,kEAAkE;YAClE,yDAAyD;YACzD,yCAAyC;YACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,2BAA2B,CAAW,CAAC;YAChE,IAAI,aAAa,GAAG,KAAK,CAAC;YAC1B,MAAM,OAAO,GAAY,EAAE,CAAC;YAC5B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,QAA4B,CAAC;gBACjC,IAAI,CAAC;oBACH,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBACrD,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,MAAM,SAAS,GACb,CAAC,aAAa;oBACd,QAAQ,KAAK,EAAE;oBACf,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;gBAC5C,aAAa,GAAG,aAAa,IAAI,SAAS,CAAC;gBAC3C,uEAAuE;gBACvE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,CAAC;YAED,IAAI,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC5B,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAClB,QAAQ,GAAG,iBAAiB,CAAC;YAC/B,CAAC;YACD,IAAI,QAAQ,GAAG,aAAa,EAAE,CAAC;gBAC7B,QAAQ,GAAG,aAAa,CAAC;YAC3B,CAAC;YAED,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,GAAG,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;gBACzB,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC9C,CAAC;YAED,IAAI,WAAW,GAAY,EAAE,CAAC;YAC9B,IAAI,aAAa,GAAG,EAAE,CAAC;YACvB,IAAI,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC5D,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;gBAC7C,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;oBACzB,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;YAED,GAAG,CAAC,GAAG,CACL,0BAA0B,EAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,CAC7D,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;QACzC,MAAM,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACxE,MAAM,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4FAA4F;AAC5F,SAAS,IAAI,CAAC,QAAiB;IAC7B,OAAO,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC"}

package/dist/pipeline/steps/visibility-gates.d.ts

@@ -1,5 +1,6 @@
 import type { DescMessage } from "@bufbuild/protobuf";
 import type { Authorizer } from "../../extensions/authorizer.js";
+import type { CallerIdentity } from "../../extensions/identity.js";
 import type { PipelineStep } from "../pipeline.js";
 /**
  * The denial callers see at both doors (the Java policy copy verbatim).
@@ -16,4 +17,11 @@ export declare function newGuardPublicVisibilityStep<Desc extends DescMessage>(a
  * the RecordVisibilityBeforeUpdate pattern).
  */
 export declare function newAuthorizeVisibilityTransitionStep<Desc extends DescMessage>(targetKey: string, authorizer: Authorizer): PipelineStep<Desc>;
+/**
+ * The single owner of "may this caller set public?" — both doors call it,
+ * and so does the plugin push chain, whose requested level rides the
+ * request (the level then flows to every member through the members' own
+ * create and updateVisibility doors, which run this check again).
+ */
+export declare function requireOperatorMaySetPublic(authorizer: Authorizer, caller: CallerIdentity): Promise<void>;
 //# sourceMappingURL=visibility-gates.d.ts.map

package/dist/pipeline/steps/visibility-gates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"visibility-gates.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/visibility-gates.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAOtD,OAAO,KAAK,EACV,UAAU,EAEX,MAAM,gCAAgC,CAAC;AAGxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAInD;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,QAEU,CAAC;AAEtD,8EAA8E;AAC9E,wBAAgB,4BAA4B,CAAC,IAAI,SAAS,WAAW,EACnE,UAAU,EAAE,UAAU,GACrB,YAAY,CAAC,IAAI,CAAC,CAgBpB;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAClD,IAAI,SAAS,WAAW,EACxB,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CA+B/D"}
+{"version":3,"file":"visibility-gates.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/visibility-gates.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAOtD,OAAO,KAAK,EAAE,UAAU,EAAiB,MAAM,gCAAgC,CAAC;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAInD;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,QAEU,CAAC;AAEtD,8EAA8E;AAC9E,wBAAgB,4BAA4B,CAAC,IAAI,SAAS,WAAW,EACnE,UAAU,EAAE,UAAU,GACrB,YAAY,CAAC,IAAI,CAAC,CAgBpB;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAAC,IAAI,SAAS,WAAW,EAC3E,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,UAAU,GACrB,YAAY,CAAC,IAAI,CAAC,CA+BpB;AAED;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CA6Bf"}

package/dist/pipeline/steps/visibility-gates.js

@@ -100,8 +100,13 @@ export function newAuthorizeVisibilityTransitionStep(targetKey, authorizer) {
         },
     };
 }
-/** The single owner of "may this caller set public?" — both doors call it. */
-async function requireOperatorMaySetPublic(authorizer, caller) {
+/**
+ * The single owner of "may this caller set public?" — both doors call it,
+ * and so does the plugin push chain, whose requested level rides the
+ * request (the level then flows to every member through the members' own
+ * create and updateVisibility doors, which run this check again).
+ */
+export async function requireOperatorMaySetPublic(authorizer, caller) {
     let decision;
     try {
         decision = await authorizer.authorize(caller, {

package/dist/pipeline/steps/visibility-gates.js.map

@@ -1 +1 @@
-{"version":3,"file":"visibility-gates.js","sourceRoot":"","sources":["../../../src/pipeline/steps/visibility-gates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAO1E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GACzC,qDAAqD;IACrD,mDAAmD,CAAC;AAEtD,8EAA8E;AAC9E,MAAM,UAAU,4BAA4B,CAC1C,UAAsB;IAEtB,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,GAAG,CAAC,cAAc,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,IACE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,UAAU;gBACpC,qBAAqB,CAAC,iBAAiB,EACvC,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,2BAA2B,CAAC,UAAU,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oCAAoC,CAElD,SAAiB,EAAE,UAAsB;IACzC,OAAO;QACL,IAAI,EAAE,+BAA+B;QACrC,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,GAAG,CAAC,cAAc,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,MAAM,SAAS,GAAI,GAAG,CAAC,KAA0C;iBAC9D,UAAU,CAAC;YACd,IAAI,SAAS,KAAK,qBAAqB,CAAC,iBAAiB,EAAE,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,kEAAkE;gBAClE,gEAAgE;gBAChE,qCAAqC;gBACrC,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,qGAAqG,CACtG,EACD,uDAAuD,CACxD,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAA6B,CAAC,EAAE,UAAU,CAAC;YACrE,IAAI,MAAM,KAAK,qBAAqB,CAAC,iBAAiB,EAAE,CAAC;gBACvD,OAAO,CAAC,qDAAqD;YAC/D,CAAC;YACD,MAAM,2BAA2B,CAAC,UAAU,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,2BAA2B,CACxC,UAAsB,EACtB,MAAsB;IAEtB,IAAI,QAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE;YAC5C,UAAU,EAAE,aAAa,CAAC,yBAAyB;YACnD,YAAY,EAAE,eAAe,CAAC,QAAQ;YACtC,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO;QACT,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW;YACd,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,IAAI,CAAC,gBAAgB,CACtB,CAAC;QACJ,KAAK,aAAa;YAChB,MAAM,4BAA4B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,4BAA4B,CAChC,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,SAAS,4BAA4B,CAAC,KAAc;IAClD,OAAO,aAAa,CAClB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACzD,wDAAwD,CACzD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"visibility-gates.js","sourceRoot":"","sources":["../../../src/pipeline/steps/visibility-gates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAI1E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GACzC,qDAAqD;IACrD,mDAAmD,CAAC;AAEtD,8EAA8E;AAC9E,MAAM,UAAU,4BAA4B,CAC1C,UAAsB;IAEtB,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,GAAG,CAAC,cAAc,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,IACE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,UAAU;gBACpC,qBAAqB,CAAC,iBAAiB,EACvC,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,2BAA2B,CAAC,UAAU,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oCAAoC,CAClD,SAAiB,EACjB,UAAsB;IAEtB,OAAO;QACL,IAAI,EAAE,+BAA+B;QACrC,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,GAAG,CAAC,cAAc,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,MAAM,SAAS,GAAI,GAAG,CAAC,KAA0C;iBAC9D,UAAU,CAAC;YACd,IAAI,SAAS,KAAK,qBAAqB,CAAC,iBAAiB,EAAE,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,kEAAkE;gBAClE,gEAAgE;gBAChE,qCAAqC;gBACrC,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,qGAAqG,CACtG,EACD,uDAAuD,CACxD,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAA6B,CAAC,EAAE,UAAU,CAAC;YACrE,IAAI,MAAM,KAAK,qBAAqB,CAAC,iBAAiB,EAAE,CAAC;gBACvD,OAAO,CAAC,qDAAqD;YAC/D,CAAC;YACD,MAAM,2BAA2B,CAAC,UAAU,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,UAAsB,EACtB,MAAsB;IAEtB,IAAI,QAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE;YAC5C,UAAU,EAAE,aAAa,CAAC,yBAAyB;YACnD,YAAY,EAAE,eAAe,CAAC,QAAQ;YACtC,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO;QACT,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW;YACd,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,IAAI,CAAC,gBAAgB,CACtB,CAAC;QACJ,KAAK,aAAa;YAChB,MAAM,4BAA4B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,4BAA4B,CAChC,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,SAAS,4BAA4B,CAAC,KAAc;IAClD,OAAO,aAAa,CAClB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACzD,wDAAwD,CACzD,CAAC;AACJ,CAAC"}