@stigmer/server 3.19.0 → 3.20.0

package/src/query/search/registry.ts

@@ -12,11 +12,9 @@
  * (registry.go ValidateExpectedKinds; server.go:509): a missing extractor
  * degrades that kind to unsearchable, never refuses boot.
  *
- * The project extractor is registered here by THIS sub-project (#14)
- * although the project DOMAIN ports with #16 — boot RebuildIndex re-indexes
- * every registered kind from the resources table, and an adopted Go
- * database may already hold projects; without the extractor those rows
- * would silently vanish from search (D4 #14 DD-D, owner-ratified).
+ * Boot RebuildIndex re-indexes every registered kind from the resources
+ * table, so a kind with no extractor here is a kind whose rows vanish from
+ * search on the next boot; a domain and its extractor land together.
  */
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 
@@ -28,7 +26,6 @@ import { executionContextSearchExtractor } from "../../domain/executioncontext/s
 import { mcpServerSearchExtractor } from "../../domain/mcpserver/search-extractor.js";
 import { organizationSearchExtractor } from "../../domain/organization/search-extractor.js";
 import { pluginSearchExtractor } from "../../domain/plugin/search-extractor.js";
-import { projectSearchExtractor } from "../../domain/project/search-extractor.js";
 import { sessionSearchExtractor } from "../../domain/session/search-extractor.js";
 import { skillSearchExtractor } from "../../domain/skill/search-extractor.js";
 import { workflowSearchExtractor } from "../../domain/workflow/search-extractor.js";
@@ -116,7 +113,6 @@ export function newSearchableResourceRegistry(): SearchableResourceRegistry {
     mcpServerSearchExtractor,
     organizationSearchExtractor,
     pluginSearchExtractor,
-    projectSearchExtractor,
     sessionSearchExtractor,
     skillSearchExtractor,
     workflowSearchExtractor,

package/src/store/postgres/__tests__/migrations.test.ts

@@ -91,24 +91,43 @@ describe.skipIf(testDatabaseAdminUrl() === undefined)(
       }
     });
 
-    it("a v1 database resumes the chain on reopen: the v2/v3 indexes arrive", async () => {
+    it("a v1 database resumes the chain on reopen: the v2/v3 indexes arrive and v4 removes the Project rows", async () => {
       const store = await PostgresStore.open(db.databaseUrl);
       await store.close();
 
-      // Rewind to a v1 database: drop exactly what v2+v3 created and their
-      // version rows — the state any pre-v2 deployment is actually in.
+      // Rewind to a v1 database: drop exactly what v2+v4 created and their
+      // version rows — the state any pre-v2 deployment is actually in —
+      // and seed one row of the Project kind an earlier release wrote
+      // (the kind column holds the enum NAME) beside a row v4 must keep.
       const client = new pg.Client({ connectionString: db.databaseUrl });
       await client.connect();
       try {
         await client.query(`DROP INDEX idx_wfee_created_at`);
         await client.query(`DROP INDEX idx_oauth_grant_resource`);
         await client.query(
-          `DELETE FROM schema_version WHERE version IN (2, 3)`,
+          `DELETE FROM schema_version WHERE version IN (2, 3, 4)`,
+        );
+        await client.query(
+          `INSERT INTO resources (kind, id, data) VALUES ('project', 'prj_seeded', '\\x00'), ('organization', 'acme', '\\x00')`,
+        );
+        await client.query(
+          `INSERT INTO resource_audit (kind, resource_id, data, version_hash, tag) VALUES ('project', 'prj_seeded', '\\x00', '', '')`,
         );
 
         const reopened = await PostgresStore.open(db.databaseUrl);
         await reopened.close();
 
+        const remaining = await client.query(
+          `SELECT kind, id FROM resources ORDER BY kind`,
+        );
+        expect(remaining.rows, "v4 removed the Project row and kept the rest").toEqual([
+          { kind: "organization", id: "acme" },
+        ]);
+        const projectAudit = await client.query(
+          `SELECT count(*)::int AS n FROM resource_audit WHERE kind = 'project'`,
+        );
+        expect((projectAudit.rows[0] as { n: number }).n).toBe(0);
+
         const sweepIndex = await client.query(
           `SELECT indexname FROM pg_indexes
            WHERE tablename = 'workflow_execution_events'

package/src/store/postgres/migrations.ts

@@ -41,9 +41,11 @@ import type { PoolClient } from "pg";
 export const SCHEMA_VERSION_1 = 1;
 export const SCHEMA_VERSION_2 = 2;
 export const SCHEMA_VERSION_3 = 3;
+/** v4: the rows of the removed Project kind deleted. */
+export const SCHEMA_VERSION_4 = 4;
 
 /** Target version for new databases. */
-export const CURRENT_SCHEMA_VERSION = SCHEMA_VERSION_3;
+export const CURRENT_SCHEMA_VERSION = SCHEMA_VERSION_4;
 
 /**
  * Advisory lock key for the migration chain. Arbitrary but stable 64-bit
@@ -76,6 +78,7 @@ export async function runMigrations(client: PoolClient): Promise<void> {
       [SCHEMA_VERSION_1, migrateToV1],
       [SCHEMA_VERSION_2, migrateToV2],
       [SCHEMA_VERSION_3, migrateToV3],
+      [SCHEMA_VERSION_4, migrateToV4],
     ];
 
     for (const [version, migrate] of chain) {
@@ -296,3 +299,19 @@ async function migrateToV3(client: PoolClient): Promise<void> {
     CREATE INDEX idx_oauth_grant_resource ON oauth_grant (resource_id, org_id);
   `);
 }
+
+/**
+ * v4: the Project kind (kind 60, id prefix "prj") was removed from the
+ * contract, so a database seeded by an earlier release may hold rows no
+ * code can read, list or delete any more. The chain's first data
+ * migration, and the same shape as the sqlite driver's v9: rows deleted,
+ * not archived (the audit table is the version history of kinds the
+ * server serves), keyed on the enum NAME the kind column holds
+ * (proto-fields.ts apiResourceKindName), the search index left to boot's
+ * RebuildIndex. Member rows the Project once listed are ordinary
+ * resources of their own kinds and stay.
+ */
+async function migrateToV4(client: PoolClient): Promise<void> {
+  await client.query(`DELETE FROM resources WHERE kind = 'project'`);
+  await client.query(`DELETE FROM resource_audit WHERE kind = 'project'`);
+}

package/src/store/sqlite/__tests__/migrations.test.ts

@@ -81,7 +81,7 @@ describe("fresh database", () => {
     const rows = db
       .prepare(`SELECT version FROM schema_version ORDER BY version`)
       .all() as Array<{ version: number }>;
-    expect(rows.map((row) => row.version)).toEqual([1, 2, 3, 4, 5, 6, 7, 8]);
+    expect(rows.map((row) => row.version)).toEqual([1, 2, 3, 4, 5, 6, 7, 8, 9]);
   });
 
   it("re-opening an already-migrated database is a no-op", async () => {
@@ -106,8 +106,21 @@ describe("Go-created v6 database adoption (DD-002 fixture)", () => {
     cleanups.push(() => fixture.cleanup());
 
     // Preconditions: the fixture really is a v6 database with live data.
+    // Beside the fixture's rows, one row of the Project kind an earlier
+    // release seeded (the kind column holds the enum NAME): v9 must
+    // remove exactly it, from both tables, and nothing else.
     const before = new DatabaseSync(fixture.dbPath);
     expect(getSchemaVersion(before)).toBe(6);
+    before
+      .prepare(
+        `INSERT INTO resources (kind, id, data, updated_at) VALUES ('project', 'prj_seeded', X'00', '2026-08-23 11:43:54')`,
+      )
+      .run();
+    before
+      .prepare(
+        `INSERT INTO resource_audit (kind, resource_id, data, archived_at, version_hash, tag) VALUES ('project', 'prj_seeded', X'00', '2026-08-23 11:43:54', '', '')`,
+      )
+      .run();
     before.close();
 
     const store = SqliteStore.open(fixture.dbPath);
@@ -125,10 +138,20 @@ describe("Go-created v6 database adoption (DD-002 fixture)", () => {
     expect(org.id).toBe("acme");
 
     const audit = db
-      .prepare(`SELECT version_hash, tag FROM resource_audit`)
+      .prepare(`SELECT version_hash, tag FROM resource_audit WHERE kind = 'organization'`)
       .get() as { version_hash: string; tag: string };
     expect(audit).toEqual({ version_hash: "hash-v1", tag: "stable" });
 
+    // v9 removed the Project rows and nothing else.
+    const projectRows = db
+      .prepare(
+        `SELECT (SELECT count(*) FROM resources WHERE kind = 'project') AS resources,
+                (SELECT count(*) FROM resource_audit WHERE kind = 'project') AS audit,
+                (SELECT count(*) FROM resources) AS total`,
+      )
+      .get() as { resources: number; audit: number; total: number };
+    expect(projectRows).toEqual({ resources: 0, audit: 0, total: 1 });
+
     const bootstrap = db
       .prepare(
         `SELECT value FROM bootstrap_state WHERE key = 'seedpack_version'`,
@@ -214,6 +237,7 @@ describe("v7 column reconciliation", () => {
       CREATE TABLE schema_version (version INTEGER PRIMARY KEY, applied_at TEXT NOT NULL DEFAULT (datetime('now')));
       INSERT INTO schema_version (version) VALUES (1),(2),(3),(4),(5),(6);
       CREATE TABLE resources (kind TEXT NOT NULL, id TEXT NOT NULL, data BLOB NOT NULL, updated_at TEXT NOT NULL DEFAULT (datetime('now')), PRIMARY KEY (kind, id)) WITHOUT ROWID;
+      CREATE TABLE resource_audit (id INTEGER PRIMARY KEY AUTOINCREMENT, kind TEXT NOT NULL, resource_id TEXT NOT NULL, data BLOB NOT NULL, archived_at TEXT NOT NULL DEFAULT (datetime('now')), version_hash TEXT, tag TEXT);
       CREATE TABLE pending_oauth_state (
         state               TEXT PRIMARY KEY,
         code_verifier       TEXT NOT NULL,

package/src/store/sqlite/migrations.ts

@@ -42,9 +42,11 @@ export const SCHEMA_VERSION_6 = 6;
 export const SCHEMA_VERSION_7 = 7;
 /** v8: the by-resource grant-teardown index (the C3 channel installer). */
 export const SCHEMA_VERSION_8 = 8;
+/** v9: the rows of the removed Project kind deleted. */
+export const SCHEMA_VERSION_9 = 9;
 
 /** Target version for new databases. */
-export const CURRENT_SCHEMA_VERSION = SCHEMA_VERSION_8;
+export const CURRENT_SCHEMA_VERSION = SCHEMA_VERSION_9;
 
 /** Applies all pending migrations in order. */
 export function runMigrations(db: DatabaseSync): void {
@@ -66,6 +68,7 @@ export function runMigrations(db: DatabaseSync): void {
     [SCHEMA_VERSION_6, migrateToV6],
     [SCHEMA_VERSION_7, migrateToV7],
     [SCHEMA_VERSION_8, migrateToV8],
+    [SCHEMA_VERSION_9, migrateToV9],
   ];
 
   for (const [version, migrate] of chain) {
@@ -357,3 +360,22 @@ function migrateToV8(db: DatabaseSync): void {
     CREATE INDEX IF NOT EXISTS idx_oauth_grant_resource ON oauth_grant(resource_id, org_id);
   `);
 }
+
+/**
+ * v9: the Project kind (kind 60, id prefix "prj") was removed from the
+ * contract, so a database seeded by an earlier release may hold rows no
+ * code can read, list or delete any more. Rows are deleted, not archived:
+ * the audit table is the version history of kinds the server serves, and
+ * bytes of a kind nothing will ever decode are not history. The kind
+ * column holds the enum NAME (proto-fields.ts apiResourceKindName), which
+ * is why the literal string works after the enum value is gone. The search
+ * index is not touched here: boot's RebuildIndex clears it and re-indexes
+ * only the registered kinds. Member rows the Project once listed are
+ * ordinary resources of their own kinds and stay.
+ */
+function migrateToV9(db: DatabaseSync): void {
+  db.exec(`
+    DELETE FROM resources WHERE kind = 'project';
+    DELETE FROM resource_audit WHERE kind = 'project';
+  `);
+}

package/dist/authorization/model/project.d.ts

@@ -1,2 +0,0 @@
-export declare const projectDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=project.d.ts.map

package/dist/authorization/model/project.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/project.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,kBAAkB,wCA2B7B,CAAC"}

package/dist/authorization/model/project.js

@@ -1,32 +0,0 @@
-/**
- * Transcript of fga/model/tenancy/project.fga — an organization's
- * grouping: admins own it, and `viewer from organization` lets every
- * organization viewer read it without a visibility tuple (projects have
- * no visibility axis in `kind_meta`; the whole organization is their
- * audience by the model's own line).
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { ProjectSchema } from "@stigmer/protos/ai/stigmer/tenancy/project/v1/api_pb";
-import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
-export const projectDeclaration = declareKind({
-    kind: ApiResourceKind.project,
-    schema: ProjectSchema,
-    source: "fga/model/tenancy/project.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        [
-            "owner",
-            union(direct(objectOf("identity_account")), from("admin", "organization")),
-        ],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account")), computed("owner"), from("viewer", "organization")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=project.js.map

package/dist/authorization/model/project.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"project.js","sourceRoot":"","sources":["../../../src/authorization/model/project.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,sDAAsD,CAAC;AAErF,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAAC;IAC5C,IAAI,EAAE,eAAe,CAAC,OAAO;IAC7B,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,+BAA+B;IACvC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,QAAQ,CAAC,OAAO,CAAC,EACjB,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAC/B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/domain/project/controller.d.ts

@@ -1,48 +0,0 @@
-/**
- * Project controller — ports pkg/domain/project/controller (command + query
- * sides). Project is the aggregate root grouping related resources: its spec
- * carries lightweight ApiResourceReference members the CLI derives from
- * individual apply responses (never user-authored); apply reconciles the
- * membership and prunes orphans through the four downstream domains'
- * in-process clients — the widest client fan-out of any CRUD domain, which
- * is why it ported last of Class A (D4 #16).
- *
- * Pipeline per RPC mirrors the Go step chains character-for-character; the
- * create/update ASYMMETRY is contract: create runs ValidateVisibility and
- * NormalizeReferences, update runs neither (an updated members list persists
- * without reference normalization — Go update.go). No chain runs
- * ValidateReferences: members referencing nonexistent resources persist
- * silently. Delete removes ONLY the project — members are never cascaded.
- *
- * Proven by project.conformance.test.ts (CONFORMANCE_TARGET=local) and
- * __tests__/{reconcile,project.composed}.test.ts (the conformance suite
- * never touches spec.members or last_reconciliation; the composed tests own
- * those pins).
- *
- * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies,
- * Publish, and TransformResponse steps (no multi-tenant auth, IAM/FGA, or
- * event publishing here).
- */
-import type { ConnectRouter } from "@connectrpc/connect";
-import type { Logger } from "../../boot/logger.js";
-import type { Authorizer } from "../../extensions/authorizer.js";
-import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
-import type { Store } from "../../store/interface.js";
-import type { OrphanDeleter } from "./reconcile.js";
-export interface ProjectControllerDeps {
-    readonly store: Store;
-    readonly logger: Logger;
-    /** The composed authorization seam — the Authorize step at position 1 of every chain calls it (O2, DD-007 §3). */
-    readonly authorizer: Authorizer;
-    /** The composed tuple-lifecycle driver — undefined = the shared steps no-op (C2). */
-    readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
-    /**
-     * The four downstream delete edges (agent/workflow/mcp_server/skill),
-     * lazy per the compose root's boot-ordering idiom — the TS replacement
-     * for Go's SetReconciliationService late-bind (server.go:635-648).
-     */
-    readonly orphanDeleter: () => OrphanDeleter;
-}
-/** Registers both project services on the router (routes stage). */
-export declare function registerProjectServices(router: ConnectRouter, deps: ProjectControllerDeps): void;
-//# sourceMappingURL=controller.d.ts.map

package/dist/domain/project/controller.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/project/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAYzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AA2CjG,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAMtD,OAAO,KAAK,EAAE,aAAa,EAAyB,MAAM,gBAAgB,CAAC;AAG3E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kHAAkH;IAClH,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,qFAAqF;IACrF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC5E;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,aAAa,CAAC;CAC7C;AAED,oEAAoE;AACpE,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,qBAAqB,GAC1B,IAAI,CAgBN"}

package/dist/domain/project/controller.js

@@ -1,192 +0,0 @@
-import { create } from "@bufbuild/protobuf";
-import { ProjectSchema } from "@stigmer/protos/ai/stigmer/tenancy/project/v1/api_pb";
-import { ProjectCommandController } from "@stigmer/protos/ai/stigmer/tenancy/project/v1/command_pb";
-import { ProjectQueryController } from "@stigmer/protos/ai/stigmer/tenancy/project/v1/query_pb";
-import { ProjectStatusSchema } from "@stigmer/protos/ai/stigmer/tenancy/project/v1/status_pb";
-import { internalError } from "../../pipeline/errors.js";
-import { apiResourceKindKey } from "../../pipeline/interceptors/apiresource.js";
-import { newPipeline } from "../../pipeline/pipeline.js";
-import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
-import { RequestContext } from "../../pipeline/request-context.js";
-import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
-import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
-import { newBuildUpdateStateStep } from "../../pipeline/steps/build-update-state.js";
-import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
-import { newDeleteResourceStep, newExtractResourceIdStep, newLoadExistingForDeleteStep, } from "../../pipeline/steps/delete.js";
-import { newCheckDuplicateStep } from "../../pipeline/steps/duplicate.js";
-import { newDeleteSearchIndexStep, newIndexSearchStep, } from "../../pipeline/steps/index-search.js";
-import { newLoadByReferenceStep } from "../../pipeline/steps/load-by-reference.js";
-import { EXISTING_RESOURCE_KEY, newLoadExistingStep, } from "../../pipeline/steps/load-existing.js";
-import { SHOULD_CREATE_KEY, newLoadForApplyStep, withResolvedApplyId, } from "../../pipeline/steps/load-for-apply.js";
-import { TARGET_RESOURCE_KEY, newLoadTargetStep, } from "../../pipeline/steps/load-target.js";
-import { newCleanupIamPoliciesStep, newCreateAuthorizationTuplesStep, } from "../../pipeline/steps/authorization-tuples.js";
-import { newPersistStep } from "../../pipeline/steps/persist.js";
-import { newNormalizeReferencesStep } from "../../pipeline/steps/references.js";
-import { newResolveSlugStep } from "../../pipeline/steps/slug.js";
-import { newValidateVisibilityStep } from "../../pipeline/steps/validate-visibility.js";
-import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
-import { DEFAULT_RECONCILIATION_OPTIONS, newReconciliationService, toProtoSummary, } from "./reconcile.js";
-import { projectSearchExtractor } from "./search-extractor.js";
-/** Registers both project services on the router (routes stage). */
-export function registerProjectServices(router, deps) {
-    const reconciliation = newReconciliationService({
-        store: deps.store,
-        orphanDeleter: deps.orphanDeleter,
-        logger: deps.logger,
-    });
-    router.service(ProjectCommandController, {
-        apply: (project, ctx) => apply(deps, reconciliation, project, ctx),
-        create: (project, ctx) => createProject(deps, project, ctx),
-        update: (project, ctx) => update(deps, project, ctx),
-        delete: (projectId, ctx) => deleteProject(deps, projectId, ctx),
-    });
-    router.service(ProjectQueryController, {
-        get: (projectId, ctx) => get(deps, projectId, ctx),
-        getByReference: (ref, ctx) => getByReference(deps, ref, ctx),
-    });
-}
-function kindOf(ctx) {
-    return ctx.values.get(apiResourceKindKey);
-}
-/** Create — chain per Go buildCreatePipeline (create.go:54-63). */
-async function createProject(deps, project, ctx) {
-    const reqCtx = new RequestContext(ProjectSchema, project, callerIdentityOf(ctx), kindOf(ctx));
-    await newPipeline("project-create", deps.logger)
-        .addStep(newAuthorizeStep(ProjectCommandController.method.create, deps.authorizer))
-        .addStep(newValidateProtoStep())
-        .addStep(newValidateVisibilityStep())
-        .addStep(newResolveSlugStep())
-        .addStep(newCheckDuplicateStep(deps.store))
-        .addStep(newBuildNewStateStep())
-        .addStep(newGuardReservedLabelsStep(deps.authorizer))
-        .addStep(newNormalizeReferencesStep())
-        .addStep(newPersistStep(deps.store))
-        .addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle, deps.logger))
-        .addStep(newIndexSearchStep(deps.store, projectSearchExtractor, deps.logger))
-        .build()
-        .execute(reqCtx);
-    return reqCtx.newState;
-}
-/**
- * Update — chain per Go buildUpdatePipeline (update.go:55-62). Deliberately
- * narrower than create (no ValidateVisibility, no NormalizeReferences —
- * the asymmetry is contract; see the module header).
- */
-async function update(deps, project, ctx) {
-    const reqCtx = new RequestContext(ProjectSchema, project, callerIdentityOf(ctx), kindOf(ctx));
-    await newPipeline("project-update", deps.logger)
-        .addStep(newAuthorizeStep(ProjectCommandController.method.update, deps.authorizer))
-        .addStep(newValidateProtoStep())
-        .addStep(newResolveSlugStep())
-        .addStep(newLoadExistingStep(deps.store))
-        .addStep(newBuildUpdateStateStep())
-        .addStep(newPersistStep(deps.store))
-        .addStep(newIndexSearchStep(deps.store, projectSearchExtractor, deps.logger))
-        .build()
-        .execute(reqCtx);
-    return reqCtx.newState;
-}
-/**
- * Apply — declarative create-or-update PLUS membership reconciliation
- * (apply.go:29-85): a minimal pipeline decides existence, the previous
- * members are captured BEFORE delegation overwrites them, the full Create
- * or Update handler runs, then the reconciler diffs previous vs persisted
- * members and prunes orphans.
- *
- * Two ported postures:
- *   - A reconcile failure is logged and SWALLOWED — apply still succeeds,
- *     returning the persisted project without a summary (apply.go:77-82;
- *     defensive in both editions — the reconciler never throws).
- *   - On success the summary is set UNCONDITIONALLY, so every successful
- *     apply response carries status.last_reconciliation, even as an empty
- *     message. Response-only — never persisted.
- */
-async function apply(deps, reconciliation, project, ctx) {
-    const reqCtx = new RequestContext(ProjectSchema, project, callerIdentityOf(ctx), kindOf(ctx));
-    await newPipeline("project-apply", deps.logger)
-        .addStep(newAuthorizeStep(ProjectCommandController.method.apply, deps.authorizer))
-        .addStep(newValidateProtoStep())
-        .addStep(newResolveSlugStep())
-        .addStep(newLoadForApplyStep(deps.store))
-        .build()
-        .execute(reqCtx);
-    const shouldCreate = reqCtx.get(SHOULD_CREATE_KEY);
-    if (typeof shouldCreate !== "boolean") {
-        throw internalError(new Error("apply pipeline did not set shouldCreate flag"), "apply operation failed to determine create vs update");
-    }
-    // Captured before Create/Update runs; on first apply (create) there are
-    // no previous members (Go apply.go:45-50).
-    const previousMembers = shouldCreate
-        ? []
-        : (reqCtx.get(EXISTING_RESOURCE_KEY)?.spec
-            ?.members ?? []);
-    const persisted = shouldCreate
-        ? await createProject(deps, project, ctx)
-        : await update(deps, withResolvedApplyId(ProjectSchema, project, reqCtx), ctx);
-    const currentMembers = persisted.spec?.members ?? [];
-    try {
-        const result = await reconciliation.reconcile(previousMembers, currentMembers, DEFAULT_RECONCILIATION_OPTIONS);
-        persisted.status ??= create(ProjectStatusSchema);
-        persisted.status.lastReconciliation = toProtoSummary(result);
-    }
-    catch (error) {
-        deps.logger.error("Reconciliation failed", {
-            projectId: persisted.metadata?.id ?? "",
-            error: error instanceof Error ? error.message : String(error),
-        });
-    }
-    return persisted;
-}
-/**
- * Delete — returns the pre-delete resource (delete.go). Deletes ONLY the
- * project entity: member resources are never cascaded.
- */
-async function deleteProject(deps, projectId, ctx) {
-    const reqCtx = new RequestContext(ProjectCommandController.method.delete.input, projectId, callerIdentityOf(ctx), kindOf(ctx));
-    await newPipeline("project-delete", deps.logger)
-        .addStep(newAuthorizeStep(ProjectCommandController.method.delete, deps.authorizer))
-        .addStep(newValidateProtoStep())
-        .addStep(newExtractResourceIdStep())
-        .addStep(newLoadExistingForDeleteStep(deps.store, ProjectSchema))
-        .addStep(newDeleteResourceStep(deps.store))
-        .addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle, deps.logger))
-        .addStep(newDeleteSearchIndexStep(deps.store, deps.logger))
-        .build()
-        .execute(reqCtx);
-    const deleted = reqCtx.get(EXISTING_RESOURCE_KEY);
-    if (deleted === undefined) {
-        // Go puts this text ON THE WIRE (delete.go:43, InternalError(nil, …));
-        // the arm is unreachable in practice but the copy is byte-pinned.
-        throw internalError(new Error("delete pipeline completed without a loaded resource"), "deleted project not found in context");
-    }
-    return deleted;
-}
-/** Get — LoadTarget by id; NotFound when absent (get.go). */
-async function get(deps, projectId, ctx) {
-    const reqCtx = new RequestContext(ProjectQueryController.method.get.input, projectId, callerIdentityOf(ctx), kindOf(ctx));
-    await newPipeline("project-get", deps.logger)
-        .addStep(newAuthorizeStep(ProjectQueryController.method.get, deps.authorizer))
-        .addStep(newValidateProtoStep())
-        .addStep(newLoadTargetStep(deps.store, ProjectSchema))
-        .build()
-        .execute(reqCtx);
-    return reqCtx.get(TARGET_RESOURCE_KEY);
-}
-/**
- * GetByReference — slug lookup within an org (get_by_reference.go). Project
- * is org-scoped, so an empty-org reference is rejected InvalidArgument by
- * the shared step's kind_meta scope check — a bare slug is under-specified,
- * never a global search (the conformance suite pins this; Go's file-level
- * doc comment claiming a platform-scoped fallback is stale).
- */
-async function getByReference(deps, ref, ctx) {
-    const reqCtx = new RequestContext(ProjectQueryController.method.getByReference.input, ref, callerIdentityOf(ctx), kindOf(ctx));
-    await newPipeline("project-get-by-reference", deps.logger)
-        .addStep(newAuthorizeStep(ProjectQueryController.method.getByReference, deps.authorizer))
-        .addStep(newValidateProtoStep())
-        .addStep(newLoadByReferenceStep(deps.store, ProjectSchema))
-        .build()
-        .execute(reqCtx);
-    return reqCtx.get(TARGET_RESOURCE_KEY);
-}
-//# sourceMappingURL=controller.js.map

package/dist/domain/project/controller.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/project/controller.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAI5C,OAAO,EAAE,aAAa,EAAE,MAAM,sDAAsD,CAAC;AAErF,OAAO,EAAE,wBAAwB,EAAE,MAAM,0DAA0D,CAAC;AAEpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,wDAAwD,CAAC;AAChG,OAAO,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAK9F,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE1E,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAiB/D,oEAAoE;AACpE,MAAM,UAAU,uBAAuB,CACrC,MAAqB,EACrB,IAA2B;IAE3B,MAAM,cAAc,GAAG,wBAAwB,CAAC;QAC9C,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE;QACvC,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,CAAC;QAClE,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;QAC3D,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;QACpD,MAAM,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC;KAChE,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,sBAAsB,EAAE;QACrC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC;QAClD,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED,mEAAmE;AACnE,KAAK,UAAU,aAAa,CAC1B,IAA2B,EAC3B,OAAgB,EAChB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,aAAa,EACb,OAAO,EACP,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAuB,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC;SACnE,OAAO,CACN,gBAAgB,CAAC,wBAAwB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAC1E;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,0BAA0B,EAAE,CAAC;SACrC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,OAAO,CACN,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,MAAM,CACnB,IAA2B,EAC3B,OAAgB,EAChB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,aAAa,EACb,OAAO,EACP,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAuB,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC;SACnE,OAAO,CACN,gBAAgB,CAAC,wBAAwB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAC1E;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,KAAK,CAClB,IAA2B,EAC3B,cAAqC,EACrC,OAAgB,EAChB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,aAAa,EACb,OAAO,EACP,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAuB,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC;SAClE,OAAO,CACN,gBAAgB,CAAC,wBAAwB,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CACzE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,OAAO,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,8CAA8C,CAAC,EACzD,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,2CAA2C;IAC3C,MAAM,eAAe,GAAwC,YAAY;QACvE,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAE,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAyB,EAAE,IAAI;YAC/D,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IAEvB,MAAM,SAAS,GAAG,YAAY;QAC5B,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC;QACzC,CAAC,CAAC,MAAM,MAAM,CACV,IAAI,EACJ,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,EACnD,GAAG,CACJ,CAAC;IAEN,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC;IAErD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,SAAS,CAC3C,eAAe,EACf,cAAc,EACd,8BAA8B,CAC/B,CAAC;QACF,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACjD,SAAS,CAAC,MAAM,CAAC,kBAAkB,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE;YACzC,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;YACvC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa,CAC1B,IAA2B,EAC3B,SAAoB,EACpB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,wBAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAC5C,SAAS,EACT,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,gBAAgB,EAChB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,wBAAwB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAC1E;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,wBAAwB,EAAE,CAAC;SACnC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;SAChE,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SAC1D,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,qDAAqD,CAAC,EAChE,sCAAsC,CACvC,CAAC;IACJ,CAAC;IACD,OAAO,OAAkB,CAAC;AAC5B,CAAC;AAED,6DAA6D;AAC7D,KAAK,UAAU,GAAG,CAChB,IAA2B,EAC3B,SAAoB,EACpB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EACvC,SAAS,EACT,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,aAAa,EACb,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,sBAAsB,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CACrE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;SACrD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAY,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,cAAc,CAC3B,IAA2B,EAC3B,GAAyB,EACzB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,sBAAsB,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EAClD,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,0BAA0B,EAC1B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,sBAAsB,CAAC,MAAM,CAAC,cAAc,EAC5C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;SAC1D,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAY,CAAC;AACpD,CAAC"}

package/dist/domain/project/reconcile.d.ts

@@ -1,77 +0,0 @@
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
-import type { ReconciliationSummary } from "@stigmer/protos/ai/stigmer/tenancy/project/v1/status_pb";
-import type { Logger } from "../../boot/logger.js";
-import type { Store } from "../../store/interface.js";
-/**
- * Deletes one orphaned resource by kind and id — Go's ResourceDeleter, the
- * only execution capability the reference model needs (resources are
- * created/updated individually by the CLI; the server only deletes orphans).
- * Implemented over the four in-process command clients (boot/inprocess.ts).
- */
-export interface OrphanDeleter {
-    delete(kind: ApiResourceKind, resourceId: string): Promise<void>;
-}
-/**
- * Go ReconciliationOptions, reduced to the two flags the algorithm reads.
- * Production always passes DEFAULT_RECONCILIATION_OPTIONS; the other
- * combinations remain reachable for tests because the branches are part of
- * the ported algorithm.
- */
-export interface ReconciliationOptions {
-    /** When true, orphaned resources are deleted (Go default). */
-    readonly pruneEnabled: boolean;
-    /** When true, the plan is computed but nothing is deleted. */
-    readonly dryRun: boolean;
-}
-export declare const DEFAULT_RECONCILIATION_OPTIONS: ReconciliationOptions;
-/** One per-orphan failure — log-only, never wire-visible (Go, verified). */
-export interface ReconciliationError {
-    /** "{kind}:{slug}" of the orphan that failed. */
-    readonly resourceKey: string;
-    readonly message: string;
-    readonly cause: unknown;
-}
-/** Go ReconciliationResult, as a plain immutable value. */
-export interface ReconciliationResult {
-    /** References in current but not previous — newly associated members. */
-    readonly added: ReadonlyArray<ApiResourceReference>;
-    /**
-     * Orphans successfully deleted (or, on a dry run, the orphans that WOULD
-     * be deleted — Go reports them in the same slot without deleting).
-     */
-    readonly removed: ReadonlyArray<ApiResourceReference>;
-    readonly errors: ReadonlyArray<ReconciliationError>;
-}
-export interface ReconciliationService {
-    /**
-     * Compares memberships and prunes orphans per the options. NEVER throws —
-     * Go's implementation always returns a nil error; failures ride
-     * result.errors (and the apply handler's error-swallow arm upstream is
-     * therefore defensive dead code in both editions, ported anyway).
-     */
-    reconcile(previousMembers: ReadonlyArray<ApiResourceReference>, currentMembers: ReadonlyArray<ApiResourceReference>, options: ReconciliationOptions): Promise<ReconciliationResult>;
-}
-export interface ReconciliationServiceDeps {
-    readonly store: Store;
-    /**
-     * Lazy per the compose root's boot-ordering idiom: the in-process clients
-     * behind the deleter exist only after routes registration completes.
-     */
-    readonly orphanDeleter: () => OrphanDeleter;
-    readonly logger: Logger;
-}
-export declare function newReconciliationService(deps: ReconciliationServiceDeps): ReconciliationService;
-/**
- * "{kind}:{slug}" with the kind's enum NAME — Go fmt %s of the enum (e.g.
- * "agent:my-agent", "mcp_server:tools"). The numeric form would diverge
- * from Go's log/error copy.
- */
-export declare function referenceKey(ref: ApiResourceReference): string;
-/**
- * Go ToProtoSummary: added → created, updated ALWAYS empty (not applicable
- * in the reference model), removed → deleted. Every successful apply sets
- * the summary — even an all-empty one is a PRESENT message on the wire.
- */
-export declare function toProtoSummary(result: ReconciliationResult): ReconciliationSummary;
-//# sourceMappingURL=reconcile.d.ts.map

package/dist/domain/project/reconcile.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../../../src/domain/project/reconcile.ts"],"names":[],"mappings":"AAiCA,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAEjG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yDAAyD,CAAC;AAErG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAGnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,eAAO,MAAM,8BAA8B,EAAE,qBAG5C,CAAC;AAEF,4EAA4E;AAC5E,MAAM,WAAW,mBAAmB;IAClC,iDAAiD;IACjD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,2DAA2D;AAC3D,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;IACpD;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;IACtD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,SAAS,CACP,eAAe,EAAE,aAAa,CAAC,oBAAoB,CAAC,EACpD,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,EACnD,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,aAAa,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,yBAAyB,GAC9B,qBAAqB,CA+BvB;AAmHD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,oBAAoB,GAAG,MAAM,CAE9D;AAYD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,oBAAoB,GAC3B,qBAAqB,CAMvB"}