@stigmer/server 3.15.3-dev.20260914121148 → 3.16.0

package/src/pipeline/steps/delete.ts

@@ -15,7 +15,11 @@ import type { DescMessage, MessageShape } from "@bufbuild/protobuf";
 import { ResourceNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
 import { getKindName } from "../apiresource-meta.js";
-import { internalError, invalidArgumentError, notFoundError } from "../errors.js";
+import {
+  internalError,
+  invalidArgumentError,
+  notFoundError,
+} from "../errors.js";
 import type { PipelineStep } from "../pipeline.js";
 import type { RequestContext } from "../request-context.js";
 import { EXISTING_RESOURCE_KEY } from "./load-existing.js";
@@ -24,7 +28,9 @@ import { idValueOf } from "./shapes.js";
 /** Context key for the extracted id (Go ResourceIdKey). */
 export const RESOURCE_ID_KEY = "resourceId";
 
-export function newExtractResourceIdStep<Desc extends DescMessage>(): PipelineStep<Desc> {
+export function newExtractResourceIdStep<
+  Desc extends DescMessage,
+>(): PipelineStep<Desc> {
   return {
     name: "ExtractResourceId",
     execute(ctx: RequestContext<Desc>): void {
@@ -90,7 +96,9 @@ function requireResourceId<Desc extends DescMessage>(
   const id = ctx.get(RESOURCE_ID_KEY);
   if (typeof id !== "string" || id === "") {
     throw internalError(
-      new Error("resource id not found in context (ExtractResourceId must run first)"),
+      new Error(
+        "resource id not found in context (ExtractResourceId must run first)",
+      ),
       "delete pipeline ordering",
     );
   }

package/src/pipeline/steps/duplicate.ts

@@ -24,10 +24,16 @@ export function newCheckDuplicateStep<Desc extends DescMessage>(
       const metadata = metadataOf(ctx.newState);
       if (metadata === undefined) {
         // Established by earlier steps — a server-side programming error.
-        throw internalError(new Error("resource metadata is nil"), "duplicate check");
+        throw internalError(
+          new Error("resource metadata is nil"),
+          "duplicate check",
+        );
       }
       if (metadata.slug === "") {
-        throw internalError(new Error("resource slug is empty"), "duplicate check");
+        throw internalError(
+          new Error("resource slug is empty"),
+          "duplicate check",
+        );
       }
 
       let existing;

package/src/pipeline/steps/guard-memory-capture.ts

@@ -59,7 +59,7 @@ export function newGuardMemoryCaptureStep<Desc extends DescMessage>(
 ): PipelineStep<Desc> {
   return {
     name: "GuardMemoryCapture",
-    execute(ctx: RequestContext<Desc>): void {
+    async execute(ctx: RequestContext<Desc>): Promise<void> {
       const caller = ctx.callerIdentity;
       if (caller.callerClass === "internal" || caller.origin === "in-process") {
         // Server-composed traversals are not capture requests from a
@@ -72,9 +72,11 @@ export function newGuardMemoryCaptureStep<Desc extends DescMessage>(
         // arm checks it against the token's own claim (and throws its
         // byte-pinned refusal itself). Empty when the request carries
         // none; Java requires metadata.org before its org-match arm, so
-        // an empty value can only ever narrow.
+        // an empty value can only ever narrow. Awaited because the
+        // built-in provider reads the bound execution's row for the
+        // session and org the cloud's token carries as claims.
         const org = metadataOf(ctx.newState)?.org ?? "";
-        const decision = decide.call(provider, caller, org);
+        const decision = await decide.call(provider, caller, org);
         switch (decision.verdict) {
           case "admit":
             ctx.set(MEMORY_CAPTURE_CREDENTIAL_KEY, {

package/src/pipeline/steps/guard-plugin-managed.ts

@@ -0,0 +1,133 @@
+/**
+ * GuardPluginManaged — the write boundary for resources a plugin
+ * materialised. A plugin's skills, MCP servers, agent and workflows are
+ * ordinary resources in the organization, labelled `stigmer.ai/plugin:
+ * <plugin id>` by the controller that installed them; the plugin owns
+ * their definition, so a client edit would be silently overwritten by the
+ * next upgrade and a client delete would leave the plugin claiming a
+ * member it no longer has. Customisation is composition: the user writes
+ * their own agent over the plugin's skills and servers, which stay readable
+ * and usable by everyone the visibility admits.
+ *
+ * Two facts decide, together (the apiresource-labels.ts doctrine: a label
+ * restricts only beside server-owned state):
+ *   - the STORED resource carries the plugin label — the request's labels
+ *     are never consulted, so a client cannot detach a child by omitting
+ *     the label on an update;
+ *   - AND the plugin row it names exists. A label whose plugin is gone (a
+ *     cascade that failed part-way; a label a self-hosted operator stamped
+ *     by hand under the permissive authorizer) leaves the resource editable
+ *     and deletable, so nothing can be locked forever.
+ *
+ * Server-composed writes pass by structure: the plugin controller is the
+ * one writer of these resources and rides the in-process lane as the
+ * installing caller (`origin: "in-process"`), exactly the arm
+ * GuardReservedLabels passes. Operational RPCs (connect, OAuth flows,
+ * instances, sessions, executions) never splice this step: they read or
+ * enrich a server, they do not redefine it.
+ *
+ * Placement: after the chain's load of the stored resource (LoadExisting,
+ * LoadExistingForDelete, a kind's visibility loader, skill push's
+ * FindExistingBySlug), before any state is built or persisted. The
+ * refusal is FAILED_PRECONDITION with the plugin named, so the user knows
+ * which door to use instead.
+ *
+ * Proven by __tests__/guard-plugin-managed.test.ts and the plugin
+ * conformance suite's managed-child arms.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import type { DescMessage, Message } from "@bufbuild/protobuf";
+
+import { PluginSchema } from "@stigmer/protos/ai/stigmer/agentic/plugin/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+
+import { pluginIdOf } from "../apiresource-labels.js";
+import { internalError } from "../errors.js";
+import type { PipelineStep } from "../pipeline.js";
+import type { RequestContext } from "../request-context.js";
+import { ResourceNotFoundError } from "../../store/interface.js";
+import type { Store } from "../../store/interface.js";
+import { EXISTING_RESOURCE_KEY } from "./load-existing.js";
+import { metadataOf } from "./shapes.js";
+
+/** The kinds a plugin materialises; the noun opens the refusal sentence. */
+const MANAGED_KIND_NOUNS: ReadonlyMap<ApiResourceKind, string> = new Map([
+  [ApiResourceKind.skill, "skill"],
+  [ApiResourceKind.mcp_server, "MCP server"],
+  [ApiResourceKind.agent, "agent"],
+  [ApiResourceKind.workflow, "workflow"],
+]);
+
+/** The one sentence a refused mutation carries; the CLI and console render it as is. */
+export function pluginManagedRefusal(
+  kind: ApiResourceKind,
+  slug: string,
+  pluginSlug: string,
+): string {
+  const noun =
+    MANAGED_KIND_NOUNS.get(kind) ?? ApiResourceKind[kind] ?? String(kind);
+  return (
+    `${noun} '${slug}' is managed by plugin '${pluginSlug}'; change the plugin and ` +
+    "push it again, or compose your own agent over it"
+  );
+}
+
+export interface GuardPluginManagedPositions {
+  /** The context key the stored resource rides; defaults to EXISTING_RESOURCE_KEY. */
+  readonly existingKey?: string;
+}
+
+export function newGuardPluginManagedStep<Desc extends DescMessage>(
+  store: Store,
+  positions: GuardPluginManagedPositions = {},
+): PipelineStep<Desc> {
+  const existingKey = positions.existingKey ?? EXISTING_RESOURCE_KEY;
+  return {
+    name: "GuardPluginManaged",
+    async execute(ctx: RequestContext<Desc>): Promise<void> {
+      if (
+        ctx.callerIdentity.callerClass === "internal" ||
+        ctx.callerIdentity.origin === "in-process"
+      ) {
+        // The plugin controller's own materialisation, upgrade and cascade
+        // writes; the same structural pass GuardReservedLabels takes.
+        return;
+      }
+      const existing = ctx.get(existingKey);
+      if (existing === undefined) {
+        return;
+      }
+      const metadata = metadataOf(existing as Message);
+      const pluginId = pluginIdOf(metadata);
+      if (pluginId === undefined) {
+        return;
+      }
+
+      let pluginSlug: string;
+      try {
+        const plugin = await store.getResource(
+          ApiResourceKind.plugin,
+          pluginId,
+          PluginSchema,
+        );
+        pluginSlug = plugin.metadata?.slug ?? pluginId;
+      } catch (error) {
+        if (error instanceof ResourceNotFoundError) {
+          // A dangling label locks nothing: the plugin that would own this
+          // resource is gone, so the resource is the user's again.
+          return;
+        }
+        throw internalError(error, "plugin ownership could not be checked");
+      }
+
+      throw new ConnectError(
+        pluginManagedRefusal(
+          ctx.apiResourceKind,
+          metadata?.slug ?? "",
+          pluginSlug,
+        ),
+        Code.FailedPrecondition,
+      );
+    },
+  };
+}

package/src/pipeline/steps/guard-reserved-labels.ts

@@ -40,12 +40,15 @@
  *
  * Placement: after BuildNewState/BuildUpdateState — the step inspects the
  * state that will persist, and update chains have LoadExisting's stored
- * labels for echo detection. The infrastructure-failure arm answers a
+ * labels for echo detection. A push-shaped chain (skill push, whose
+ * PushSkillRequest carries `labels`) places it after its populate step and
+ * names its own positions (GuardReservedLabelsPositions), since its
+ * resource rides a domain key, not newState. The infrastructure-failure arm answers a
  * sanitized INTERNAL (the TS store-fault doctrine, #478) where Java
  * echoes raw exception text — an unpinned outage-lane difference.
  */
 import { Code, ConnectError } from "@connectrpc/connect";
-import type { DescMessage } from "@bufbuild/protobuf";
+import type { DescMessage, Message } from "@bufbuild/protobuf";
 
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
@@ -69,9 +72,7 @@ export const RESERVED_LABEL_PREFIX = "stigmer.ai/";
 const CLIENT_CONTRACT_ALLOWLIST: ReadonlyMap<
   ApiResourceKind,
   ReadonlySet<string>
-> = new Map([
-  [ApiResourceKind.environment, new Set(["stigmer.ai/personal"])],
-]);
+> = new Map([[ApiResourceKind.environment, new Set(["stigmer.ai/personal"])]]);
 
 /**
  * The reserved keys `requested` would introduce or change relative to
@@ -91,9 +92,27 @@ export function reservedLabelMutations(
   return mutations.sort();
 }
 
+/**
+ * Where the guard finds the state that will persist and the stored state
+ * it is judged against. The create and update chains carry both in the
+ * shared positions (`ctx.newState`, EXISTING_RESOURCE_KEY); a push-shaped
+ * chain builds its resource from an artifact and rides its own keys, so
+ * it names them here. Defaults are the shared positions.
+ */
+export interface GuardReservedLabelsPositions<Desc extends DescMessage> {
+  /** The resource about to persist; defaults to the chain's newState. */
+  readonly stateOf?: (ctx: RequestContext<Desc>) => Message | undefined;
+  /** The context key the stored resource rides; defaults to EXISTING_RESOURCE_KEY. */
+  readonly existingKey?: string;
+}
+
 export function newGuardReservedLabelsStep<Desc extends DescMessage>(
   authorizer: Authorizer,
+  positions: GuardReservedLabelsPositions<Desc> = {},
 ): PipelineStep<Desc> {
+  const stateOf =
+    positions.stateOf ?? ((ctx: RequestContext<Desc>) => ctx.newState);
+  const existingKey = positions.existingKey ?? EXISTING_RESOURCE_KEY;
   return {
     name: "GuardReservedLabels",
     async execute(ctx: RequestContext<Desc>): Promise<void> {
@@ -108,12 +127,14 @@ export function newGuardReservedLabelsStep<Desc extends DescMessage>(
         // identity for attribution (ruling R5).
         return;
       }
-      const requested = metadataOf(ctx.newState)?.labels ?? {};
-      const existing = ctx.get(EXISTING_RESOURCE_KEY);
+      const state = stateOf(ctx);
+      const requested =
+        state === undefined ? {} : (metadataOf(state)?.labels ?? {});
+      const existing = ctx.get(existingKey);
       const stored =
         existing === undefined
           ? {}
-          : (metadataOf(existing as typeof ctx.newState)?.labels ?? {});
+          : (metadataOf(existing as Message)?.labels ?? {});
 
       const allowlist =
         CLIENT_CONTRACT_ALLOWLIST.get(ctx.apiResourceKind) ?? new Set();

package/src/pipeline/steps/helpers.ts

@@ -109,7 +109,10 @@ export function requireOrgForReference(
     scopeType = meta.authorization?.scopeType;
     kindName = meta.name;
   } catch (error) {
-    throw internalError(error, "failed to resolve kind metadata for reference org check");
+    throw internalError(
+      error,
+      "failed to resolve kind metadata for reference org check",
+    );
   }
   // protobuf-es strips the shared enum prefix: proto
   // AUTHORIZATION_SCOPE_TYPE_ORGANIZATION generates as ORGANIZATION.

package/src/pipeline/steps/index-search.ts

@@ -37,26 +37,34 @@ export function newIndexSearchStep<Desc extends DescMessage>(
       const resource = ctx.newState;
       const metadata = metadataOf(resource);
       if (metadata === undefined || metadata.id === "") {
-        logger.warn("IndexSearch: resource has no metadata or ID, skipping indexing");
+        logger.warn(
+          "IndexSearch: resource has no metadata or ID, skipping indexing",
+        );
         return;
       }
 
       const entry = extractor.getSearchIndexEntry(resource);
       if (entry === undefined) {
-        logger.warn("IndexSearch: extractor returned no entry, skipping indexing", {
-          id: metadata.id,
-        });
+        logger.warn(
+          "IndexSearch: extractor returned no entry, skipping indexing",
+          {
+            id: metadata.id,
+          },
+        );
         return;
       }
 
       try {
         await store.upsertSearchIndex(ctx.apiResourceKind, metadata.id, entry);
       } catch (error) {
-        logger.warn("IndexSearch: failed to update search index (best-effort)", {
-          id: metadata.id,
-          kind: apiResourceKindName(ctx.apiResourceKind),
-          error: error instanceof Error ? error.message : String(error),
-        });
+        logger.warn(
+          "IndexSearch: failed to update search index (best-effort)",
+          {
+            id: metadata.id,
+            kind: apiResourceKindName(ctx.apiResourceKind),
+            error: error instanceof Error ? error.message : String(error),
+          },
+        );
       }
     },
   };
@@ -72,18 +80,23 @@ export function newDeleteSearchIndexStep<Desc extends DescMessage>(
       const id = ctx.get(RESOURCE_ID_KEY);
       if (typeof id !== "string" || id === "") {
         throw internalError(
-          new Error("resource id not found in context (ExtractResourceId must run first)"),
+          new Error(
+            "resource id not found in context (ExtractResourceId must run first)",
+          ),
           "delete search index ordering",
         );
       }
       try {
         await store.deleteSearchIndex(ctx.apiResourceKind, id);
       } catch (error) {
-        logger.warn("DeleteSearchIndex: failed to remove search index entry (best-effort)", {
-          id,
-          kind: apiResourceKindName(ctx.apiResourceKind),
-          error: error instanceof Error ? error.message : String(error),
-        });
+        logger.warn(
+          "DeleteSearchIndex: failed to remove search index entry (best-effort)",
+          {
+            id,
+            kind: apiResourceKindName(ctx.apiResourceKind),
+            error: error instanceof Error ? error.message : String(error),
+          },
+        );
       }
     },
   };

package/src/pipeline/steps/load-existing.ts

@@ -15,7 +15,11 @@ import type { DescMessage, MessageShape } from "@bufbuild/protobuf";
 import { ResourceNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
 import { getKindName } from "../apiresource-meta.js";
-import { internalError, invalidArgumentError, notFoundError } from "../errors.js";
+import {
+  internalError,
+  invalidArgumentError,
+  notFoundError,
+} from "../errors.js";
 import type { PipelineStep } from "../pipeline.js";
 import type { RequestContext } from "../request-context.js";
 import { findResourceBySlug } from "./helpers.js";
@@ -32,7 +36,10 @@ export function newLoadExistingStep<Desc extends DescMessage>(
     async execute(ctx: RequestContext<Desc>): Promise<void> {
       const metadata = metadataOf(ctx.newState);
       if (metadata === undefined) {
-        throw internalError(new Error("resource metadata is nil"), "load existing");
+        throw internalError(
+          new Error("resource metadata is nil"),
+          "load existing",
+        );
       }
 
       let existing: MessageShape<Desc>;
@@ -64,7 +71,9 @@ export function newLoadExistingStep<Desc extends DescMessage>(
         // Populate the id so merge and persist have it.
         metadata.id = metadataOf(existing)?.id ?? "";
       } else {
-        throw invalidArgumentError("resource id or slug is required for update");
+        throw invalidArgumentError(
+          "resource id or slug is required for update",
+        );
       }
 
       ctx.set(EXISTING_RESOURCE_KEY, existing);

package/src/pipeline/steps/references.ts

@@ -31,13 +31,18 @@ import { messageFieldByName, metadataOf } from "./shapes.js";
 const API_RESOURCE_REFERENCE_TYPE =
   "ai.stigmer.commons.apiresource.ApiResourceReference";
 
-export function newNormalizeReferencesStep<Desc extends DescMessage>(): PipelineStep<Desc> {
+export function newNormalizeReferencesStep<
+  Desc extends DescMessage,
+>(): PipelineStep<Desc> {
   return {
     name: "NormalizeReferences",
     execute(ctx: RequestContext<Desc>): void {
       const metadata = metadataOf(ctx.newState);
       if (metadata === undefined) {
-        throw internalError(new Error("resource metadata is nil"), "normalize references");
+        throw internalError(
+          new Error("resource metadata is nil"),
+          "normalize references",
+        );
       }
       // No org to resolve from — skip silently; required-org validation is
       // the validation step's responsibility, not this one's.
@@ -100,6 +105,35 @@ export function newValidateReferencesStep<Desc extends DescMessage>(
   };
 }
 
+/** One reference a spec carries, as the walker reads it. */
+export interface SpecReference {
+  readonly kind: ApiResourceKind;
+  readonly slug: string;
+  readonly org: string;
+}
+
+/**
+ * Every ApiResourceReference in a resource's spec — the same walk
+ * ValidateReferences runs, exported for the readers that ask the reverse
+ * question ("who references this?"): the plugin delete guard scans an
+ * organization's agents and workflows for references to a member it is
+ * about to remove.
+ */
+export function collectSpecReferences(
+  schema: DescMessage,
+  msg: Parameters<typeof reflect>[1],
+): SpecReference[] {
+  const refs: SpecReference[] = [];
+  forEachSpecReference(schema, msg, (ref) => {
+    refs.push({
+      kind: numberField(ref, "kind") as ApiResourceKind,
+      slug: stringField(ref, "slug"),
+      org: stringField(ref, "org"),
+    });
+  });
+  return refs;
+}
+
 /**
  * Walks the resource's spec and invokes fn on every ApiResourceReference
  * (singular, repeated, and map-valued message fields, recursively) —

package/src/pipeline/steps/resolve-artifact-source.ts

@@ -0,0 +1,66 @@
+/**
+ * ResolveArtifactSource — materialises the archive bytes of a push-shaped
+ * request from whichever source it carries: inline bytes pass through; an
+ * upload reference is consumed HERE, which retires the single-use
+ * reference whatever happens downstream. Proto validation has already
+ * guaranteed exactly one source. Downstream steps read the bytes from the
+ * context key and never touch the request's fields, so the two sources
+ * are indistinguishable past this point.
+ *
+ * Skills carried this step alone (the Go ResolveArtifactSource port);
+ * plugins are pushed the same two ways over the same upload slots (one
+ * upload surface, as boot/compose.ts wires it), so the step lives
+ * here and each kind names its lane-absent sentence and the request
+ * fields it reads.
+ *
+ * The unusable-reference arm is INVALID_ARGUMENT, not a server fault: an
+ * unknown, expired, already consumed, or minted-but-never-uploaded
+ * reference all mean the client must re-mint and re-upload.
+ */
+import type { DescMessage, MessageShape } from "@bufbuild/protobuf";
+
+import type { UploadSlots } from "../../domain/skill/transfer/slots.js";
+import { failedPreconditionError, invalidArgumentError } from "../errors.js";
+import type { PipelineStep } from "../pipeline.js";
+import type { RequestContext } from "../request-context.js";
+
+/** Where the resolved bytes ride for every downstream step. */
+export const ARTIFACT_BYTES_KEY = "pushArtifactBytes";
+
+export interface ArtifactSourceBinding<Desc extends DescMessage> {
+  /** The request's two sources; exactly one is set by proto validation. */
+  source(input: MessageShape<Desc>): {
+    readonly artifact: Uint8Array;
+    readonly artifactUploadRef: string;
+  };
+  /** The FailedPrecondition copy when no lane is configured; each kind pins its own. */
+  readonly laneNotConfigured: string;
+}
+
+export function newResolveArtifactSourceStep<Desc extends DescMessage>(
+  slots: UploadSlots | undefined,
+  binding: ArtifactSourceBinding<Desc>,
+): PipelineStep<Desc> {
+  return {
+    name: "ResolveArtifactSource",
+    async execute(ctx: RequestContext<Desc>): Promise<void> {
+      const { artifact, artifactUploadRef } = binding.source(ctx.input);
+      if (artifactUploadRef === "") {
+        ctx.set(ARTIFACT_BYTES_KEY, artifact);
+        return;
+      }
+      if (slots === undefined) {
+        throw failedPreconditionError(binding.laneNotConfigured);
+      }
+      let data: Uint8Array;
+      try {
+        data = await slots.consume(artifactUploadRef);
+      } catch (error) {
+        throw invalidArgumentError(
+          `artifact_upload_ref not usable: ${error instanceof Error ? error.message : String(error)} — request a new upload URL via createArtifactUploadUrl`,
+        );
+      }
+      ctx.set(ARTIFACT_BYTES_KEY, data);
+    },
+  };
+}

package/src/pipeline/steps/server-stamped-reserved-labels.ts

@@ -36,7 +36,8 @@ export function recordServerStampedReservedLabels<Desc extends DescMessage>(
   ...keys: ReadonlyArray<string>
 ): void {
   const existing = ctx.get(STAMPED_KEYS_CONTEXT_KEY);
-  const stamped = existing instanceof Set ? (existing as Set<string>) : new Set<string>();
+  const stamped =
+    existing instanceof Set ? (existing as Set<string>) : new Set<string>();
   for (const key of keys) {
     stamped.add(key);
   }

package/src/pipeline/steps/slug.ts

@@ -14,14 +14,19 @@ import type { PipelineStep } from "../pipeline.js";
 import type { RequestContext } from "../request-context.js";
 import { metadataOf } from "./shapes.js";
 
-export function newResolveSlugStep<Desc extends DescMessage>(): PipelineStep<Desc> {
+export function newResolveSlugStep<
+  Desc extends DescMessage,
+>(): PipelineStep<Desc> {
   return {
     name: "ResolveSlug",
     execute(ctx: RequestContext<Desc>): void {
       const metadata = metadataOf(ctx.newState);
       if (metadata === undefined) {
         // A server-side programming error, not bad client input (Go).
-        throw internalError(new Error("resource metadata is nil"), "slug resolution");
+        throw internalError(
+          new Error("resource metadata is nil"),
+          "slug resolution",
+        );
       }
       if (metadata.slug !== "") {
         return; // already set — idempotent

package/src/pipeline/steps/validate-visibility.ts

@@ -34,7 +34,9 @@ import type { PipelineStep } from "../pipeline.js";
 import type { RequestContext } from "../request-context.js";
 import { metadataOf } from "./shapes.js";
 
-export function newValidateVisibilityStep<Desc extends DescMessage>(): PipelineStep<Desc> {
+export function newValidateVisibilityStep<
+  Desc extends DescMessage,
+>(): PipelineStep<Desc> {
   return {
     name: "ValidateVisibility",
     execute(ctx: RequestContext<Desc>): void {
@@ -72,7 +74,12 @@ export function rejectDefaultInstanceVisibilityUpdate(): never {
 }
 
 /** Go rejectUnsupportedVisibility (the shared level check + copy). */
-function rejectUnsupportedVisibility(
+/**
+ * The one sentence for a level a kind does not support. Exported for the
+ * push-shaped chains whose requested level rides the request rather than
+ * a resource's metadata (plugin push), so the copy stays in one place.
+ */
+export function rejectUnsupportedVisibility(
   kind: ApiResourceKind,
   visibility: ApiResourceVisibility,
 ): void {

package/src/pipeline/steps/validation.ts

@@ -23,7 +23,9 @@ export function validator(): Validator {
   return sharedValidator;
 }
 
-export function newValidateProtoStep<Desc extends DescMessage>(): PipelineStep<Desc> {
+export function newValidateProtoStep<
+  Desc extends DescMessage,
+>(): PipelineStep<Desc> {
   return {
     name: "ValidateProto",
     execute(ctx: RequestContext<Desc>): void {