@stigmer/server 3.20.0 → 3.22.0

package/dist/pipeline/steps/authorize-resolved-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-resolved-target.js","sourceRoot":"","sources":["../../../src/pipeline/steps/authorize-resolved-target.ts"],"names":[],"mappings":"AAkEA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EACL,eAAe,EACf,qBAAqB,GAEtB,MAAM,gBAAgB,CAAC;AAExB,gFAAgF;AAChF,MAAM,CAAC,MAAM,8BAA8B,GAAG,yBAAyB,CAAC;AAYxE,MAAM,UAAU,8BAA8B,CAC5C,UAAsB,EACtB,OAAqC,EACrC,WAAmB,8BAA8B;IAEjD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,eAAe,CAAC,UAAU,EAAE,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAKD;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAe;IAEf,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAwB,CAAC;QACnE,MAAM,EAAE,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACrE,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,GAAG,8BAA8B,0CAA0C,mBAAmB,6BAA6B,CAC5H,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACzE,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC;AACJ,CAAC"}

package/dist/pipeline/steps/authorize.d.ts

@@ -38,6 +38,26 @@ export interface AuthorizeTargetOverride {
     readonly resourceKind?: ApiResourceKind;
     readonly resourceId: string;
 }
+/**
+ * One question for the Authorizer together with the lane's deny copy: the
+ * unit `authorizeResolvedResource` consumes, whether the annotation named
+ * it (`resolveAnnotatedCheck`) or a chain's own resolver did (the run gate,
+ * the resolved-target step).
+ */
+export interface AuthorizationTarget extends AuthzCheck {
+    readonly deniedMessage: string;
+}
+/**
+ * The annotation's answer for one method: the target it names for this
+ * request, or `undefined` when it names none — `is_public`,
+ * `is_skip_authorization`, or no config at all. Pure over the descriptor
+ * and the request; the `internal` exemption is the evaluation's, not the
+ * annotation's, so it is not applied here. Exported so a chain step can
+ * authorize a loaded row exactly as a SIBLING method's annotation would
+ * (a read by reference asks what its `get` asks) without a second copy of
+ * the skip arms or the field-path resolution.
+ */
+export declare function resolveAnnotatedCheck(method: DescMethod, input: Message, override?: AuthorizeTargetOverride): AuthorizationTarget | undefined;
 /**
  * The Authorize evaluation for direct handlers: identical skip arms,
  * target resolution, and decision-to-wire mapping as the pipeline step
@@ -45,6 +65,13 @@ export interface AuthorizeTargetOverride {
  * non-allow arm; resolves on allow and on every skip arm.
  */
 export declare function authorizeDirect(method: DescMethod, authorizer: Authorizer, identity: CallerIdentity, input: Message, override?: AuthorizeTargetOverride): Promise<void>;
+/**
+ * `authorizeResolvedResource` over an AuthorizationTarget: the check the
+ * Authorizer sees carries exactly the three fields of an AuthzCheck, never
+ * the copy, so a recording Authorizer (a test's, a driver's audit line)
+ * observes the question and nothing else.
+ */
+export declare function authorizeTarget(authorizer: Authorizer, identity: CallerIdentity, target: AuthorizationTarget): Promise<void>;
 /**
  * The SAME evaluation for a check whose target the HANDLER resolved —
  * the mid-chain resolved-id pattern DD-007 names ("the pattern the two

package/dist/pipeline/steps/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/authorize.ts"],"names":[],"mappings":"AA4DA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAG3E,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAQtH,OAAO,KAAK,EACV,UAAU,EACV,UAAU,EACV,aAAa,EACd,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGnD;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,+CACA,CAAC;AAE/C,uEAAuE;AACvE,eAAO,MAAM,qCAAqC,sBAAsB,CAAC;AAEzE;;;;;;GAMG;AACH,wBAAgB,iCAAiC,IAAI,UAAU,CAM9D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,SAAS,WAAW,EACvD,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,UAAU,GACrB,YAAY,CAAC,IAAI,CAAC,CAOpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,CAAC,EAAE,eAAe,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,OAAO,EACd,QAAQ,CAAC,EAAE,uBAAuB,GACjC,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CA4Cf;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,aAAa,CAAC,CASxB"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/authorize.ts"],"names":[],"mappings":"AAoEA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAG3E,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAQtH,OAAO,KAAK,EACV,UAAU,EACV,UAAU,EACV,aAAa,EACd,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGnD;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,+CACA,CAAC;AAE/C,uEAAuE;AACvE,eAAO,MAAM,qCAAqC,sBAAsB,CAAC;AAEzE;;;;;;GAMG;AACH,wBAAgB,iCAAiC,IAAI,UAAU,CAM9D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,SAAS,WAAW,EACvD,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,UAAU,GACrB,YAAY,CAAC,IAAI,CAAC,CAOpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,CAAC,EAAE,eAAe,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,OAAO,EACd,QAAQ,CAAC,EAAE,uBAAuB,GACjC,mBAAmB,GAAG,SAAS,CAiBjC;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,OAAO,EACd,QAAQ,CAAC,EAAE,uBAAuB,GACjC,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,cAAc,EACxB,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAWf;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CA4Cf;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,aAAa,CAAC,CASxB"}

package/dist/pipeline/steps/authorize.js

@@ -56,6 +56,14 @@
  * names no kind because the target is the loaded row's resource). The
  * annotation keeps owning the permission, the copy and the skip arms in
  * both shapes; only the target is the handler's.
+ *
+ * The annotation read itself is one pure function, `resolveAnnotatedCheck`,
+ * so a third entry shape needs no third copy of it: the resolved-target
+ * step (authorize-resolved-target.ts) authorizes a row a chain LOADED as
+ * a sibling method's annotation would — a read by reference asks exactly
+ * what its `get` asks, target override and all — and every lane whose
+ * position-1 annotation is a skip because the target is not in the request
+ * answers its question there, with the same four arms.
  */
 import { Code, ConnectError } from "@connectrpc/connect";
 import { getOption, hasOption } from "@bufbuild/protobuf";
@@ -98,6 +106,32 @@ export function newAuthorizeStep(method, authorizer) {
         },
     };
 }
+/**
+ * The annotation's answer for one method: the target it names for this
+ * request, or `undefined` when it names none — `is_public`,
+ * `is_skip_authorization`, or no config at all. Pure over the descriptor
+ * and the request; the `internal` exemption is the evaluation's, not the
+ * annotation's, so it is not applied here. Exported so a chain step can
+ * authorize a loaded row exactly as a SIBLING method's annotation would
+ * (a read by reference asks what its `get` asks) without a second copy of
+ * the skip arms or the field-path resolution.
+ */
+export function resolveAnnotatedCheck(method, input, override) {
+    if (getOption(method, is_public) ||
+        getOption(method, is_skip_authorization)) {
+        return undefined;
+    }
+    if (!hasOption(method, rpcAuthorizationConfig)) {
+        return undefined;
+    }
+    const config = getOption(method, rpcAuthorizationConfig);
+    return {
+        permission: config.permission,
+        resourceKind: override?.resourceKind ?? resolveResourceKind(input, config),
+        resourceId: override?.resourceId ?? resolveResourceId(input, config),
+        deniedMessage: config.errorMsg,
+    };
+}
 /**
  * The Authorize evaluation for direct handlers: identical skip arms,
  * target resolution, and decision-to-wire mapping as the pipeline step
@@ -108,19 +142,24 @@ export async function authorizeDirect(method, authorizer, identity, input, overr
     if (identity.callerClass === "internal") {
         return;
     }
-    if (getOption(method, is_public) ||
-        getOption(method, is_skip_authorization)) {
+    const target = resolveAnnotatedCheck(method, input, override);
+    if (target === undefined) {
         return;
     }
-    if (!hasOption(method, rpcAuthorizationConfig)) {
-        return;
-    }
-    const config = getOption(method, rpcAuthorizationConfig);
+    return authorizeTarget(authorizer, identity, target);
+}
+/**
+ * `authorizeResolvedResource` over an AuthorizationTarget: the check the
+ * Authorizer sees carries exactly the three fields of an AuthzCheck, never
+ * the copy, so a recording Authorizer (a test's, a driver's audit line)
+ * observes the question and nothing else.
+ */
+export function authorizeTarget(authorizer, identity, target) {
     return authorizeResolvedResource(authorizer, identity, {
-        permission: config.permission,
-        resourceKind: override?.resourceKind ?? resolveResourceKind(input, config),
-        resourceId: override?.resourceId ?? resolveResourceId(input, config),
-    }, config.errorMsg);
+        permission: target.permission,
+        resourceKind: target.resourceKind,
+        resourceId: target.resourceId,
+    }, target.deniedMessage);
 }
 /**
  * The SAME evaluation for a check whose target the HANDLER resolved —

package/dist/pipeline/steps/authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/pipeline/steps/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,MAAM,IAAI,sBAAsB,EAChC,SAAS,EACT,qBAAqB,GACtB,MAAM,0DAA0D,CAAC;AAQlE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAI5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAC5C,4CAA4C,CAAC;AAE/C,uEAAuE;AACvE,MAAM,CAAC,MAAM,qCAAqC,GAAG,mBAAmB,CAAC;AAEzE;;;;;;GAMG;AACH,MAAM,UAAU,iCAAiC;IAC/C,OAAO;QACL,SAAS;YACP,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAkB,EAClB,UAAsB;IAEtB,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,OAAO,CAAC,GAAyB;YAC/B,OAAO,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC;AAgBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAkB,EAClB,UAAsB,EACtB,QAAwB,EACxB,KAAc,EACd,QAAkC;IAElC,IAAI,QAAQ,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACxC,OAAO;IACT,CAAC;IACD,IACE,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC;QAC5B,SAAS,CAAC,MAAM,EAAE,qBAAqB,CAAC,EACxC,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAEzD,OAAO,yBAAyB,CAC9B,UAAU,EACV,QAAQ,EACR;QACE,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EACV,QAAQ,EAAE,YAAY,IAAI,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC;QAC9D,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC;KACrE,EACD,MAAM,CAAC,QAAQ,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,UAAsB,EACtB,QAAwB,EACxB,KAAiB,EACjB,QAAgB;IAEhB,IAAI,QAAQ,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACxC,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACvE,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO;QACT,KAAK,MAAM;YACT,MAAM,IAAI,YAAY,CACpB,QAAQ,KAAK,EAAE;gBACb,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,EAAE;oBACtB,CAAC,CAAC,QAAQ,CAAC,MAAM;oBACjB,CAAC,CAAC,qCAAqC,EAC3C,IAAI,CAAC,gBAAgB,CACtB,CAAC;QACJ,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,+DAA+D;YAC/D,6DAA6D;YAC7D,gDAAgD;YAChD,IACE,KAAK,CAAC,UAAU,KAAK,EAAE;gBACvB,KAAK,CAAC,YAAY,KAAK,eAAe,CAAC,yBAAyB,EAChE,CAAC;gBACD,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,+DAA+D,CAChE,EACD,iCAAiC,CAClC,CAAC;YACJ,CAAC;YACD,MAAM,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,aAAa;YAChB,MAAM,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAC3D,iCAAiC,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAsB,EACtB,QAAwB,EACxB,KAAiB;IAEjB,IAAI,CAAC;QACH,OAAO,MAAM,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAC1B,KAAc,EACd,MAA8B;IAE9B,IAAI,MAAM,CAAC,gBAAgB,KAAK,EAAE,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAwB,CAAC;IAClC,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,eAAe,CAAC,yBAAyB,CAAC;AACnD,CAAC;AAED,yEAAyE;AACzE,SAAS,iBAAiB,CACxB,KAAc,EACd,MAA8B;IAE9B,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC;IAC3B,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAClD,IAAI,OAAO,GAAY,KAAK,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAI,OAAmC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/pipeline/steps/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,MAAM,IAAI,sBAAsB,EAChC,SAAS,EACT,qBAAqB,GACtB,MAAM,0DAA0D,CAAC;AAQlE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAI5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAC5C,4CAA4C,CAAC;AAE/C,uEAAuE;AACvE,MAAM,CAAC,MAAM,qCAAqC,GAAG,mBAAmB,CAAC;AAEzE;;;;;;GAMG;AACH,MAAM,UAAU,iCAAiC;IAC/C,OAAO;QACL,SAAS;YACP,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAkB,EAClB,UAAsB;IAEtB,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,OAAO,CAAC,GAAyB;YAC/B,OAAO,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC;AA0BD;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAkB,EAClB,KAAc,EACd,QAAkC;IAElC,IACE,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC;QAC5B,SAAS,CAAC,MAAM,EAAE,qBAAqB,CAAC,EACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACzD,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC;QAC1E,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC;QACpE,aAAa,EAAE,MAAM,CAAC,QAAQ;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAkB,EAClB,UAAsB,EACtB,QAAwB,EACxB,KAAc,EACd,QAAkC;IAElC,IAAI,QAAQ,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACxC,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,OAAO,eAAe,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,UAAsB,EACtB,QAAwB,EACxB,MAA2B;IAE3B,OAAO,yBAAyB,CAC9B,UAAU,EACV,QAAQ,EACR;QACE,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,EACD,MAAM,CAAC,aAAa,CACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,UAAsB,EACtB,QAAwB,EACxB,KAAiB,EACjB,QAAgB;IAEhB,IAAI,QAAQ,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACxC,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACvE,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO;QACT,KAAK,MAAM;YACT,MAAM,IAAI,YAAY,CACpB,QAAQ,KAAK,EAAE;gBACb,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,EAAE;oBACtB,CAAC,CAAC,QAAQ,CAAC,MAAM;oBACjB,CAAC,CAAC,qCAAqC,EAC3C,IAAI,CAAC,gBAAgB,CACtB,CAAC;QACJ,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,+DAA+D;YAC/D,6DAA6D;YAC7D,gDAAgD;YAChD,IACE,KAAK,CAAC,UAAU,KAAK,EAAE;gBACvB,KAAK,CAAC,YAAY,KAAK,eAAe,CAAC,yBAAyB,EAChE,CAAC;gBACD,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,+DAA+D,CAChE,EACD,iCAAiC,CAClC,CAAC;YACJ,CAAC;YACD,MAAM,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,aAAa;YAChB,MAAM,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAC3D,iCAAiC,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAsB,EACtB,QAAwB,EACxB,KAAiB;IAEjB,IAAI,CAAC;QACH,OAAO,MAAM,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAC1B,KAAc,EACd,MAA8B;IAE9B,IAAI,MAAM,CAAC,gBAAgB,KAAK,EAAE,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAwB,CAAC;IAClC,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,eAAe,CAAC,yBAAyB,CAAC;AACnD,CAAC;AAED,yEAAyE;AACzE,SAAS,iBAAiB,CACxB,KAAc,EACd,MAA8B;IAE9B,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC;IAC3B,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAClD,IAAI,OAAO,GAAY,KAAK,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAI,OAAmC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9E,CAAC"}

package/dist/pipeline/steps/guard-memory-capture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard-memory-capture.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-memory-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAG/F,wEAAwE;AACxE,eAAO,MAAM,6BAA6B,iEACsB,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AAEvE,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,QAAQ,CAAC,EAAE,wBAAwB,GAClC,YAAY,CAAC,IAAI,CAAC,CAsDpB;AAED,4EAA4E;AAC5E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,GACxB,uBAAuB,GAAG,SAAS,CAWrC"}
+{"version":3,"file":"guard-memory-capture.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-memory-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAItD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAG/F,wEAAwE;AACxE,eAAO,MAAM,6BAA6B,iEACsB,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AAEvE,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,QAAQ,CAAC,EAAE,wBAAwB,GAClC,YAAY,CAAC,IAAI,CAAC,CAsDpB;AAED,4EAA4E;AAC5E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,GACxB,uBAAuB,GAAG,SAAS,CAWrC"}

package/dist/pipeline/steps/guard-memory-capture.js

@@ -1,4 +1,5 @@
 import { Code, ConnectError } from "@connectrpc/connect";
+import { isServerComposedRequest } from "../../extensions/identity.js";
 import { metadataOf } from "./shapes.js";
 /** The Java MemoryPolicy.MEMORY_CAPTURE_CALLER_MESSAGE, byte-pinned. */
 export const MEMORY_CAPTURE_CALLER_MESSAGE = "memory can only be captured for a first-party human operator";
@@ -14,7 +15,7 @@ export function newGuardMemoryCaptureStep(provider) {
         name: "GuardMemoryCapture",
         async execute(ctx) {
             const caller = ctx.callerIdentity;
-            if (caller.callerClass === "internal" || caller.origin === "in-process") {
+            if (isServerComposedRequest(caller)) {
                 // Server-composed traversals are not capture requests from a
                 // credential; the entry-point request already passed the gate.
                 return;

package/dist/pipeline/steps/guard-memory-capture.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard-memory-capture.js","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-memory-capture.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKzD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,wEAAwE;AACxE,MAAM,CAAC,MAAM,6BAA6B,GACxC,8DAA8D,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAC;AAEvE,MAAM,UAAU,yBAAyB,CACvC,QAAmC;IAEnC,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC;YAClC,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBACxE,6DAA6D;gBAC7D,+DAA+D;gBAC/D,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,EAAE,sBAAsB,CAAC;YAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,gEAAgE;gBAChE,8DAA8D;gBAC9D,8DAA8D;gBAC9D,gEAAgE;gBAChE,2DAA2D;gBAC3D,4DAA4D;gBAC5D,uDAAuD;gBACvD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;gBAC1D,QAAQ,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACzB,KAAK,OAAO;wBACV,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE;4BACrC,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;4BAC3D,eAAe,EAAE,QAAQ,CAAC,eAAe;yBAC1C,CAAC,CAAC;wBACH,OAAO;oBACT,KAAK,QAAQ;wBACX,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,gBAAgB,CACtB,CAAC;oBACJ,KAAK,YAAY;wBACf,MAAM;oBACR,OAAO,CAAC,CAAC,CAAC;wBACR,MAAM,UAAU,GAAU,QAAQ,CAAC;wBACnC,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAChE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IACE,MAAM,CAAC,WAAW,KAAK,SAAS;gBAChC,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC3C,CAAC;gBACD,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,gBAAgB,CACtB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAyB;IAEzB,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACvD,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,0BAA0B,IAAI,OAAO;QACrC,iBAAiB,IAAI,OAAO,EAC5B,CAAC;QACD,OAAO,OAAkC,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B,CAAC,QAAgB;IAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,CAAC,iDAAiD;IACjE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACnB,CAAC;QACtC,OAAO,CACL,OAAO,OAAO,CAAC,kBAAkB,KAAK,QAAQ;YAC9C,OAAO,CAAC,kBAAkB,KAAK,EAAE,CAClC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"guard-memory-capture.js","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-memory-capture.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAIvE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,wEAAwE;AACxE,MAAM,CAAC,MAAM,6BAA6B,GACxC,8DAA8D,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAC;AAEvE,MAAM,UAAU,yBAAyB,CACvC,QAAmC;IAEnC,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC;YAClC,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,6DAA6D;gBAC7D,+DAA+D;gBAC/D,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,EAAE,sBAAsB,CAAC;YAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,gEAAgE;gBAChE,8DAA8D;gBAC9D,8DAA8D;gBAC9D,gEAAgE;gBAChE,2DAA2D;gBAC3D,4DAA4D;gBAC5D,uDAAuD;gBACvD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;gBAC1D,QAAQ,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACzB,KAAK,OAAO;wBACV,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE;4BACrC,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;4BAC3D,eAAe,EAAE,QAAQ,CAAC,eAAe;yBAC1C,CAAC,CAAC;wBACH,OAAO;oBACT,KAAK,QAAQ;wBACX,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,gBAAgB,CACtB,CAAC;oBACJ,KAAK,YAAY;wBACf,MAAM;oBACR,OAAO,CAAC,CAAC,CAAC;wBACR,MAAM,UAAU,GAAU,QAAQ,CAAC;wBACnC,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAChE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IACE,MAAM,CAAC,WAAW,KAAK,SAAS;gBAChC,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC3C,CAAC;gBACD,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,gBAAgB,CACtB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAyB;IAEzB,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACvD,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,0BAA0B,IAAI,OAAO;QACrC,iBAAiB,IAAI,OAAO,EAC5B,CAAC;QACD,OAAO,OAAkC,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B,CAAC,QAAgB;IAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,CAAC,iDAAiD;IACjE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACnB,CAAC;QACtC,OAAO,CACL,OAAO,OAAO,CAAC,kBAAkB,KAAK,QAAQ;YAC9C,OAAO,CAAC,kBAAkB,KAAK,EAAE,CAClC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/pipeline/steps/guard-reserved-labels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard-reserved-labels.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-reserved-labels.ts"],"names":[],"mappings":"AAkDA,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAK/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAK5D,uEAAuE;AACvE,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAYnD;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACxC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC1C,aAAa,CAAC,MAAM,CAAC,CAQvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,4BAA4B,CAAC,IAAI,SAAS,WAAW;IACpE,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,OAAO,GAAG,SAAS,CAAC;IACtE,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,wBAAgB,0BAA0B,CAAC,IAAI,SAAS,WAAW,EACjE,UAAU,EAAE,UAAU,EACtB,SAAS,GAAE,4BAA4B,CAAC,IAAI,CAAM,GACjD,YAAY,CAAC,IAAI,CAAC,CAwEpB"}
+{"version":3,"file":"guard-reserved-labels.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-reserved-labels.ts"],"names":[],"mappings":"AAmDA,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAK/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAGjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAK5D,uEAAuE;AACvE,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAYnD;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACxC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC1C,aAAa,CAAC,MAAM,CAAC,CAQvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,4BAA4B,CAAC,IAAI,SAAS,WAAW;IACpE,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,OAAO,GAAG,SAAS,CAAC;IACtE,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,wBAAgB,0BAA0B,CAAC,IAAI,SAAS,WAAW,EACjE,UAAU,EAAE,UAAU,EACtB,SAAS,GAAE,4BAA4B,CAAC,IAAI,CAAM,GACjD,YAAY,CAAC,IAAI,CAAC,CAoEpB"}

package/dist/pipeline/steps/guard-reserved-labels.js

@@ -3,11 +3,12 @@
  * `stigmer.ai/*` label namespace (the Java GuardReservedLabelsStep port,
  * cloud#320/#386; C2 Stage 3, 20260827.10).
  *
- * Reserved labels carry platform semantics — the motivating one is
- * `stigmer.ai/default-agent`, which the default-agent resolution reads
- * GLOBALLY (label + visibility_public), so a tenant labeling its own
- * public agent would enter every organization's default-agent candidate
- * set. Only rejecting the write closes that.
+ * Reserved labels carry platform semantics the server reads and acts on
+ * (the personal-environment marker, the default-instance marker, the
+ * membership and lineage labels): a client that could write one would be
+ * writing a platform decision, and any reader trusting the label would be
+ * trusting the client. Only rejecting the write closes that; the label is
+ * not authorization, the server is.
  *
  * Behavior (the Java matrix verbatim):
  *   - ECHOES pass — clients read-modify-write whole resources, so a
@@ -50,6 +51,7 @@
 import { Code, ConnectError } from "@connectrpc/connect";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { isServerComposedRequest } from "../../extensions/identity.js";
 import { internalError } from "../errors.js";
 import { EXISTING_RESOURCE_KEY } from "./load-existing.js";
 import { serverStampedReservedLabels } from "./server-stamped-reserved-labels.js";
@@ -82,13 +84,11 @@ export function newGuardReservedLabelsStep(authorizer, positions = {}) {
     return {
         name: "GuardReservedLabels",
         async execute(ctx) {
-            if (ctx.callerIdentity.callerClass === "internal" ||
-                ctx.callerIdentity.origin === "in-process") {
-                // Server-composed request (the Java isInProcessCall arm,
-                // cloud#386): the trust decision was made by the service code
-                // that built it — default-instance factories stamp reserved
-                // labels by design, even when the call propagates the user's
-                // identity for attribution (ruling R5).
+            if (isServerComposedRequest(ctx.callerIdentity)) {
+                // The Java isInProcessCall arm (cloud#386): the trust decision was
+                // made by the service code that built the request — default-instance
+                // factories stamp reserved labels by design, even when the call
+                // propagates the user's identity for attribution (ruling R5).
                 return;
             }
             const state = stateOf(ctx);

package/dist/pipeline/steps/guard-reserved-labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard-reserved-labels.js","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-reserved-labels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAG1E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,uEAAuE;AACvE,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD;;;;GAIG;AACH,MAAM,yBAAyB,GAG3B,IAAI,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE/E;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAwC,EACxC,SAA2C;IAE3C,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,IAAI,GAAG,CAAC,UAAU,CAAC,qBAAqB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;YACnE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAgBD,MAAM,UAAU,0BAA0B,CACxC,UAAsB,EACtB,YAAgD,EAAE;IAElD,MAAM,OAAO,GACX,SAAS,CAAC,OAAO,IAAI,CAAC,CAAC,GAAyB,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACnE,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IACE,GAAG,CAAC,cAAc,CAAC,WAAW,KAAK,UAAU;gBAC7C,GAAG,CAAC,cAAc,CAAC,MAAM,KAAK,YAAY,EAC1C,CAAC;gBACD,yDAAyD;gBACzD,8DAA8D;gBAC9D,4DAA4D;gBAC5D,6DAA6D;gBAC7D,wCAAwC;gBACxC,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,SAAS,GACb,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACtC,MAAM,MAAM,GACV,QAAQ,KAAK,SAAS;gBACpB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,UAAU,CAAC,QAAmB,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;YAEtD,MAAM,SAAS,GACb,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;YAClE,MAAM,OAAO,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,MAAM,CAChE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAClD,CAAC;YACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,+DAA+D;YAC/D,4CAA4C;YAC5C,IAAI,QAAQ,CAAC;YACb,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc,EAAE;oBACxD,UAAU,EAAE,aAAa,CAAC,yBAAyB;oBACnD,YAAY,EAAE,eAAe,CAAC,QAAQ;oBACtC,UAAU,EAAE,SAAS;iBACtB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAC;YACzC,CAAC;YACD,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACtB,KAAK,OAAO;oBACV,OAAO;gBACT,KAAK,MAAM,CAAC;gBACZ,KAAK,WAAW;oBACd,MAAM,IAAI,YAAY,CACpB,2BAA2B,qBAAqB,cAAc;wBAC5D,4DAA4D;wBAC5D,YAAY,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B;wBAC3D,0CAA0C,EAC5C,IAAI,CAAC,eAAe,CACrB,CAAC;gBACJ,KAAK,aAAa;oBAChB,MAAM,yBAAyB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAClD,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,UAAU,GAAU,QAAQ,CAAC;oBACnC,MAAM,yBAAyB,CAC7B,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAC5D,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,yBAAyB,CAAC,KAAc;IAC/C,OAAO,aAAa,CAClB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACzD,kDAAkD,CACnD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"guard-reserved-labels.js","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-reserved-labels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAG1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,uEAAuE;AACvE,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD;;;;GAIG;AACH,MAAM,yBAAyB,GAG3B,IAAI,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE/E;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAwC,EACxC,SAA2C;IAE3C,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,IAAI,GAAG,CAAC,UAAU,CAAC,qBAAqB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;YACnE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAgBD,MAAM,UAAU,0BAA0B,CACxC,UAAsB,EACtB,YAAgD,EAAE;IAElD,MAAM,OAAO,GACX,SAAS,CAAC,OAAO,IAAI,CAAC,CAAC,GAAyB,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACnE,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;gBAChD,mEAAmE;gBACnE,qEAAqE;gBACrE,gEAAgE;gBAChE,8DAA8D;gBAC9D,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,SAAS,GACb,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACtC,MAAM,MAAM,GACV,QAAQ,KAAK,SAAS;gBACpB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,UAAU,CAAC,QAAmB,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;YAEtD,MAAM,SAAS,GACb,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;YAClE,MAAM,OAAO,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,MAAM,CAChE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAClD,CAAC;YACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,+DAA+D;YAC/D,4CAA4C;YAC5C,IAAI,QAAQ,CAAC;YACb,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc,EAAE;oBACxD,UAAU,EAAE,aAAa,CAAC,yBAAyB;oBACnD,YAAY,EAAE,eAAe,CAAC,QAAQ;oBACtC,UAAU,EAAE,SAAS;iBACtB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAC;YACzC,CAAC;YACD,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACtB,KAAK,OAAO;oBACV,OAAO;gBACT,KAAK,MAAM,CAAC;gBACZ,KAAK,WAAW;oBACd,MAAM,IAAI,YAAY,CACpB,2BAA2B,qBAAqB,cAAc;wBAC5D,4DAA4D;wBAC5D,YAAY,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B;wBAC3D,0CAA0C,EAC5C,IAAI,CAAC,eAAe,CACrB,CAAC;gBACJ,KAAK,aAAa;oBAChB,MAAM,yBAAyB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAClD,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,UAAU,GAAU,QAAQ,CAAC;oBACnC,MAAM,yBAAyB,CAC7B,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAC5D,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,yBAAyB,CAAC,KAAc;IAC/C,OAAO,aAAa,CAClB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACzD,kDAAkD,CACnD,CAAC;AACJ,CAAC"}

package/dist/pipeline/steps/helpers.d.ts

@@ -20,11 +20,15 @@ export declare function findResourceBySlug<Desc extends DescMessage>(store: Stor
  */
 export declare function findResourceByLabelAndOrg<Desc extends DescMessage>(store: Store, kind: ApiResourceKind, schema: Desc, labelKey: string, labelValue: string, org: string): Promise<MessageShape<Desc> | undefined>;
 /**
- * Rejects a getByReference lookup that omits org for an org-scoped kind —
- * Go RequireOrgForReference. For AUTHORIZATION_SCOPE_TYPE_ORGANIZATION
- * kinds a slug is unique only WITHIN an org; resolving an org-less
- * reference globally would cross tenant boundaries. The message matches
- * the cloud edition verbatim (cross-edition error contract).
+ * Rejects a getByReference lookup that omits org — Go RequireOrgForReference,
+ * widened to every kind that has a reference lane. A slug is unique only
+ * WITHIN an org, so an org-less reference resolves globally and the first
+ * match wins: for an org-scoped kind that crosses tenant boundaries, and
+ * for an owner-only kind (the execution context) it let a caller name a
+ * slug and receive whichever organization's row matched first. Every kind
+ * with a reference lane is served per organization, so the rule is the
+ * same for all of them. The message matches the cloud edition verbatim
+ * (cross-edition error contract); the kind name comes from kind_meta.
  *
  * Belongs at the getByReference boundary only — the low-level slug finders
  * are legitimately called with a relative (possibly empty) org by internal

package/dist/pipeline/steps/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/helpers.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAKtD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,SAAS,WAAW,EAC/D,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,IAAI,EACZ,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAmBzC;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EACtE,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,IAAI,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAkBzC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,eAAe,EACrB,GAAG,EAAE,MAAM,GACV,IAAI,CAqBN;AAOD,qEAAqE;AACrE,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,SAAS,GAAG,SAAS,EACxB,CAAC,EAAE,SAAS,GAAG,SAAS,GACvB,MAAM,CAcR;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAC9B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACnC,OAAO,CAIT"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/helpers.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAKtD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,SAAS,WAAW,EAC/D,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,IAAI,EACZ,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAmBzC;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EACtE,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,IAAI,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAkBzC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,eAAe,EACrB,GAAG,EAAE,MAAM,GACV,IAAI,CAcN;AAOD,qEAAqE;AACrE,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,SAAS,GAAG,SAAS,EACxB,CAAC,EAAE,SAAS,GAAG,SAAS,GACvB,MAAM,CAcR;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAC9B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACnC,OAAO,CAIT"}

package/dist/pipeline/steps/helpers.js

@@ -4,7 +4,6 @@
  * interface, not here — D2 §3).
  */
 import { fromBinary } from "@bufbuild/protobuf";
-import { AuthorizationScopeType } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
 import { getKindMeta } from "../apiresource-meta.js";
 import { internalError, invalidArgumentError } from "../errors.js";
 import { metadataOf } from "./shapes.js";
@@ -65,11 +64,15 @@ export async function findResourceByLabelAndOrg(store, kind, schema, labelKey, l
     return undefined;
 }
 /**
- * Rejects a getByReference lookup that omits org for an org-scoped kind —
- * Go RequireOrgForReference. For AUTHORIZATION_SCOPE_TYPE_ORGANIZATION
- * kinds a slug is unique only WITHIN an org; resolving an org-less
- * reference globally would cross tenant boundaries. The message matches
- * the cloud edition verbatim (cross-edition error contract).
+ * Rejects a getByReference lookup that omits org — Go RequireOrgForReference,
+ * widened to every kind that has a reference lane. A slug is unique only
+ * WITHIN an org, so an org-less reference resolves globally and the first
+ * match wins: for an org-scoped kind that crosses tenant boundaries, and
+ * for an owner-only kind (the execution context) it let a caller name a
+ * slug and receive whichever organization's row matched first. Every kind
+ * with a reference lane is served per organization, so the rule is the
+ * same for all of them. The message matches the cloud edition verbatim
+ * (cross-edition error contract); the kind name comes from kind_meta.
  *
  * Belongs at the getByReference boundary only — the low-level slug finders
  * are legitimately called with a relative (possibly empty) org by internal
@@ -79,21 +82,14 @@ export function requireOrgForReference(kind, org) {
     if (org !== "") {
         return;
     }
-    let scopeType;
     let kindName;
     try {
-        const meta = getKindMeta(kind);
-        scopeType = meta.authorization?.scopeType;
-        kindName = meta.name;
+        kindName = getKindMeta(kind).name;
     }
     catch (error) {
         throw internalError(error, "failed to resolve kind metadata for reference org check");
     }
-    // protobuf-es strips the shared enum prefix: proto
-    // AUTHORIZATION_SCOPE_TYPE_ORGANIZATION generates as ORGANIZATION.
-    if (scopeType === AuthorizationScopeType.ORGANIZATION) {
-        throw invalidArgumentError(`org is required for ${kindName} lookup`);
-    }
+    throw invalidArgumentError(`org is required for ${kindName} lookup`);
 }
 // The two list-step helpers below are duplicated per package in Go (each
 // controller carries its own copy); the TS tree consolidates them here

package/dist/pipeline/steps/helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../../src/pipeline/steps/helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAKhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wFAAwF,CAAC;AAGhI,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAY,EACZ,IAAqB,EACrB,MAAY,EACZ,IAAY,EACZ,GAAW;IAEX,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACH,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,kCAAkC;QAC9C,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrD,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,EAAE,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACvC,SAAS;QACX,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAY,EACZ,IAAqB,EACrB,MAAY,EACZ,QAAgB,EAChB,UAAkB,EAClB,GAAW;IAEX,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACH,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,UAAU,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACrE,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAqB,EACrB,GAAW;IAEX,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IACD,IAAI,SAA6C,CAAC;IAClD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC;QAC1C,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CACjB,KAAK,EACL,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,mDAAmD;IACnD,mEAAmE;IACnE,IAAI,SAAS,KAAK,sBAAsB,CAAC,YAAY,EAAE,CAAC;QACtD,MAAM,oBAAoB,CAAC,uBAAuB,QAAQ,SAAS,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,YAAY;AAEZ,qEAAqE;AACrE,MAAM,UAAU,oBAAoB,CAClC,CAAwB,EACxB,CAAwB;IAExB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAC9B,cAAsC,EACtC,YAAoC;IAEpC,OAAO,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,KAAK,CACvC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,KAAK,CAChD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../../src/pipeline/steps/helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAOhD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAY,EACZ,IAAqB,EACrB,MAAY,EACZ,IAAY,EACZ,GAAW;IAEX,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACH,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,kCAAkC;QAC9C,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrD,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,EAAE,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACvC,SAAS;QACX,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAY,EACZ,IAAqB,EACrB,MAAY,EACZ,QAAgB,EAChB,UAAkB,EAClB,GAAW;IAEX,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACH,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,UAAU,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACrE,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAqB,EACrB,GAAW;IAEX,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IACD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CACjB,KAAK,EACL,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,oBAAoB,CAAC,uBAAuB,QAAQ,SAAS,CAAC,CAAC;AACvE,CAAC;AAED,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,YAAY;AAEZ,qEAAqE;AACrE,MAAM,UAAU,oBAAoB,CAClC,CAAwB,EACxB,CAAwB;IAExB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAC9B,cAAsC,EACtC,YAAoC;IAEpC,OAAO,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,KAAK,CACvC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,KAAK,CAChD,CAAC;AACJ,CAAC"}

package/dist/pipeline/steps/version-history.d.ts

@@ -3,6 +3,7 @@ import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/
 import type { ApiResourceReferenceSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
 import type { PipelineStep } from "../pipeline.js";
 import type { Store } from "../../store/interface.js";
+import type { ResolvedTargetResolver } from "./authorize-resolved-target.js";
 export declare function isVersionHash(version: string): boolean;
 /** What a content-versioned kind must say about itself for the ladder. */
 export interface VersionedResourceBinding<Desc extends DescMessage> {
@@ -21,6 +22,16 @@ export declare function newLoadByReferenceWithVersionStep<Desc extends DescMessa
 export declare const LIST_VERSIONS_RESOURCE_ID_KEY = "listVersionsResourceId";
 export declare const LIST_VERSIONS_HEAD_HASH_KEY = "listVersionsHeadHash";
 export declare const LIST_VERSIONS_RESPONSE_KEY = "listVersionsResponse";
+/**
+ * The ListVersions lanes' authorization question, for the
+ * AuthorizeResolvedTarget step placed after the slug resolver: `can_view`
+ * on the resolved head's id (the version history of a row is readable by
+ * whoever may read the row), with the lane's byte-pinned copy. The id key
+ * is the resolver's own — the shared resolver stashes under
+ * LIST_VERSIONS_RESOURCE_ID_KEY; a domain resolver with its own key names
+ * it. An id the chain did not stash is a broken invariant and throws.
+ */
+export declare function versionHistoryTarget<Desc extends DescMessage>(kind: ApiResourceKind, deniedMessage: string, idKey?: string): ResolvedTargetResolver<Desc>;
 /** The fields every ListVersions input carries; the binding reads them off its own message. */
 export interface ListVersionsInputShape {
     readonly org: string;

package/dist/pipeline/steps/version-history.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version-history.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/version-history.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE7E,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sDAAsD,CAAC;AAOvG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAQtD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,0EAA0E;AAC1E,MAAM,WAAW,wBAAwB,CAAC,IAAI,SAAS,WAAW;IAChE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IACjD,8EAA8E;IAC9E,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;CACjD;AAED,KAAK,kBAAkB,GAAG,OAAO,0BAA0B,CAAC;AAE5D,iFAAiF;AACjF,wBAAgB,iCAAiC,CAAC,IAAI,SAAS,WAAW,EACxE,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,wBAAwB,CAAC,IAAI,CAAC,EACvC,QAAQ,EAAE,MAAM,GACf,YAAY,CAAC,kBAAkB,CAAC,CAkElC;AAmDD,eAAO,MAAM,6BAA6B,2BAA2B,CAAC;AACtE,eAAO,MAAM,2BAA2B,yBAAyB,CAAC;AAClE,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AAEjE,+FAA+F;AAC/F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,wFAAwF;AACxF,MAAM,WAAW,qBAAqB,CACpC,IAAI,SAAS,WAAW,EACxB,SAAS,SAAS,WAAW,EAC7B,KAAK,SAAS,OAAO,EACrB,QAAQ,SAAS,OAAO,CACxB,SAAQ,wBAAwB,CAAC,IAAI,CAAC;IACtC,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,GAAG,sBAAsB,CAAC;IAChE,sEAAsE;IACtE,QAAQ,CACN,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,EAC5B,SAAS,EAAE,OAAO,EAClB,GAAG,EAAE,MAAM,GACV,KAAK,CAAC;IACT,QAAQ,CACN,OAAO,EAAE,KAAK,EAAE,EAChB,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,MAAM,GACjB,QAAQ,CAAC;CACb;AAED,uGAAuG;AACvG,wBAAgB,+BAA+B,CAC7C,IAAI,SAAS,WAAW,EACxB,SAAS,SAAS,WAAW,EAC7B,KAAK,SAAS,OAAO,EACrB,QAAQ,SAAS,OAAO,EAExB,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,qBAAqB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,EAChE,QAAQ,EAAE,MAAM,GACf,YAAY,CAAC,SAAS,CAAC,CA2BzB;AAED,mFAAmF;AACnF,wBAAgB,yBAAyB,CACvC,IAAI,SAAS,WAAW,EACxB,SAAS,SAAS,WAAW,EAC7B,KAAK,SAAS,OAAO,EACrB,QAAQ,SAAS,OAAO,EAExB,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,qBAAqB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,EAChE,QAAQ,EAAE,MAAM,GACf,YAAY,CAAC,SAAS,CAAC,CAkEzB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWrD"}
+{"version":3,"file":"version-history.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/version-history.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE7E,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sDAAsD,CAAC;AAQvG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAO7E,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,0EAA0E;AAC1E,MAAM,WAAW,wBAAwB,CAAC,IAAI,SAAS,WAAW;IAChE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IACjD,8EAA8E;IAC9E,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;CACjD;AAED,KAAK,kBAAkB,GAAG,OAAO,0BAA0B,CAAC;AAE5D,iFAAiF;AACjF,wBAAgB,iCAAiC,CAAC,IAAI,SAAS,WAAW,EACxE,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,wBAAwB,CAAC,IAAI,CAAC,EACvC,QAAQ,EAAE,MAAM,GACf,YAAY,CAAC,kBAAkB,CAAC,CAkElC;AAmDD,eAAO,MAAM,6BAA6B,2BAA2B,CAAC;AACtE,eAAO,MAAM,2BAA2B,yBAAyB,CAAC;AAClE,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AAEjE;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,SAAS,WAAW,EAC3D,IAAI,EAAE,eAAe,EACrB,aAAa,EAAE,MAAM,EACrB,KAAK,GAAE,MAAsC,GAC5C,sBAAsB,CAAC,IAAI,CAAC,CAiB9B;AAED,+FAA+F;AAC/F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,wFAAwF;AACxF,MAAM,WAAW,qBAAqB,CACpC,IAAI,SAAS,WAAW,EACxB,SAAS,SAAS,WAAW,EAC7B,KAAK,SAAS,OAAO,EACrB,QAAQ,SAAS,OAAO,CACxB,SAAQ,wBAAwB,CAAC,IAAI,CAAC;IACtC,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,GAAG,sBAAsB,CAAC;IAChE,sEAAsE;IACtE,QAAQ,CACN,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,EAC5B,SAAS,EAAE,OAAO,EAClB,GAAG,EAAE,MAAM,GACV,KAAK,CAAC;IACT,QAAQ,CACN,OAAO,EAAE,KAAK,EAAE,EAChB,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,MAAM,GACjB,QAAQ,CAAC;CACb;AAED,uGAAuG;AACvG,wBAAgB,+BAA+B,CAC7C,IAAI,SAAS,WAAW,EACxB,SAAS,SAAS,WAAW,EAC7B,KAAK,SAAS,OAAO,EACrB,QAAQ,SAAS,OAAO,EAExB,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,qBAAqB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,EAChE,QAAQ,EAAE,MAAM,GACf,YAAY,CAAC,SAAS,CAAC,CA2BzB;AAED,mFAAmF;AACnF,wBAAgB,yBAAyB,CACvC,IAAI,SAAS,WAAW,EACxB,SAAS,SAAS,WAAW,EAC7B,KAAK,SAAS,OAAO,EACrB,QAAQ,SAAS,OAAO,EAExB,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,qBAAqB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,EAChE,QAAQ,EAAE,MAAM,GACf,YAAY,CAAC,SAAS,CAAC,CAkEzB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWrD"}

package/dist/pipeline/steps/version-history.js

@@ -28,6 +28,7 @@
  */
 import { fromBinary } from "@bufbuild/protobuf";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import { internalError, invalidArgumentError, notFoundError, } from "../errors.js";
 import { AuditNotFoundError } from "../../store/interface.js";
 import { findResourceBySlug, requireOrgForReference } from "./helpers.js";
@@ -121,6 +122,31 @@ const MAX_PAGE_SIZE = 100;
 export const LIST_VERSIONS_RESOURCE_ID_KEY = "listVersionsResourceId";
 export const LIST_VERSIONS_HEAD_HASH_KEY = "listVersionsHeadHash";
 export const LIST_VERSIONS_RESPONSE_KEY = "listVersionsResponse";
+/**
+ * The ListVersions lanes' authorization question, for the
+ * AuthorizeResolvedTarget step placed after the slug resolver: `can_view`
+ * on the resolved head's id (the version history of a row is readable by
+ * whoever may read the row), with the lane's byte-pinned copy. The id key
+ * is the resolver's own — the shared resolver stashes under
+ * LIST_VERSIONS_RESOURCE_ID_KEY; a domain resolver with its own key names
+ * it. An id the chain did not stash is a broken invariant and throws.
+ */
+export function versionHistoryTarget(kind, deniedMessage, idKey = LIST_VERSIONS_RESOURCE_ID_KEY) {
+    return (ctx) => {
+        const resourceId = ctx.get(idKey);
+        if (typeof resourceId !== "string" || resourceId === "") {
+            throw new Error(`ListVersions: no resolved resource id under ${idKey}; the slug resolver must run first`);
+        }
+        return [
+            {
+                permission: IamPermission.can_view,
+                resourceKind: kind,
+                resourceId,
+                deniedMessage,
+            },
+        ];
+    };
+}
 /** Resolves the head by slug and captures its id and hash (Go ResolveSkillBySlugStep, generalised). */
 export function newResolveBySlugForVersionsStep(store, binding, stepName) {
     return {

package/dist/pipeline/steps/version-history.js.map

@@ -1 +1 @@
-{"version":3,"file":"version-history.js","sourceRoot":"","sources":["../../../src/pipeline/steps/version-history.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,aAAa,GACd,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,oEAAoE;AACpE,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAEtC,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAgBD,iFAAiF;AACjF,MAAM,UAAU,iCAAiC,CAC/C,KAAY,EACZ,OAAuC,EACvC,QAAgB;IAEhB,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CAAC,GAAuC;YACnD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC;YAEtB,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACpB,MAAM,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;YAC9D,CAAC;YAED,iEAAiE;YACjE,0CAA0C;YAC1C,sBAAsB,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAErD,IACE,GAAG,CAAC,IAAI,KAAK,eAAe,CAAC,yBAAyB;gBACtD,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EACzB,CAAC;gBACD,MAAM,oBAAoB,CACxB,2BAA2B,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAC7F,CAAC;YACJ,CAAC;YAED,IAAI,IAAoC,CAAC;YACzC,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,kBAAkB,CAC7B,KAAK,EACL,GAAG,CAAC,eAAe,EACnB,OAAO,CAAC,MAAM,EACd,GAAG,CAAC,IAAI,EACR,GAAG,CAAC,GAAG,CACR,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,kBAAkB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9C,CAAC;YAED,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC3C,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;gBACnC,OAAO;YACT,CAAC;YAED,IAAI,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;gBACnC,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACvC,KAAK,EACL,GAAG,CAAC,eAAe,EACnB,OAAO,CAAC,MAAM,EACd,IAAI,CAAC,IAAI,CAAC,EACV,OAAO,CACR,CAAC;YACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,GAAG,OAAO,CAAC,IAAI,UAAU,EACzB,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,CACzB,CAAC;YACJ,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,SAAS,kBAAkB,CACzB,OAAuC,EACvC,IAAwB,EACxB,OAAe;IAEf,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC;IAC9C,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,OAAO,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,kBAAkB,CAC/B,KAAY,EACZ,IAAqB,EACrB,MAAY,EACZ,UAAkB,EAClB,OAAe;IAEf,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;gBACxC,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,aAAa,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;YACxC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,aAAa,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,4EAA4E;AAE5E,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,MAAM,CAAC,MAAM,6BAA6B,GAAG,wBAAwB,CAAC;AACtE,MAAM,CAAC,MAAM,2BAA2B,GAAG,sBAAsB,CAAC;AAClE,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AA+BjE,uGAAuG;AACvG,MAAM,UAAU,+BAA+B,CAM7C,KAAY,EACZ,OAAgE,EAChE,QAAgB;IAEhB,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CAAC,GAA8B;YAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,IAAoC,CAAC;YACzC,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,kBAAkB,CAC7B,KAAK,EACL,GAAG,CAAC,eAAe,EACnB,OAAO,CAAC,MAAM,EACd,GAAG,CAAC,IAAI,EACR,GAAG,CAAC,GAAG,CACR,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,wBAAwB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,UAAU,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;YACrE,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,oEAAoE;YACpE,qEAAqE;YACrE,2CAA2C;YAC3C,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,yBAAyB,CAMvC,KAAY,EACZ,OAAgE,EAChE,QAAgB;IAEhB,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CAAC,GAA8B;YAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAW,CAAC;YAEpE,IAAI,OAAO,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAC1E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;YAC/D,CAAC;YAED,mEAAmE;YACnE,kEAAkE;YAClE,yDAAyD;YACzD,yCAAyC;YACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,2BAA2B,CAAW,CAAC;YAChE,IAAI,aAAa,GAAG,KAAK,CAAC;YAC1B,MAAM,OAAO,GAAY,EAAE,CAAC;YAC5B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,QAA4B,CAAC;gBACjC,IAAI,CAAC;oBACH,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBACrD,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,MAAM,SAAS,GACb,CAAC,aAAa;oBACd,QAAQ,KAAK,EAAE;oBACf,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;gBAC5C,aAAa,GAAG,aAAa,IAAI,SAAS,CAAC;gBAC3C,uEAAuE;gBACvE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,CAAC;YAED,IAAI,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC5B,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAClB,QAAQ,GAAG,iBAAiB,CAAC;YAC/B,CAAC;YACD,IAAI,QAAQ,GAAG,aAAa,EAAE,CAAC;gBAC7B,QAAQ,GAAG,aAAa,CAAC;YAC3B,CAAC;YAED,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,GAAG,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;gBACzB,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC9C,CAAC;YAED,IAAI,WAAW,GAAY,EAAE,CAAC;YAC9B,IAAI,aAAa,GAAG,EAAE,CAAC;YACvB,IAAI,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC5D,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;gBAC7C,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;oBACzB,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;YAED,GAAG,CAAC,GAAG,CACL,0BAA0B,EAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,CAC7D,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;QACzC,MAAM,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACxE,MAAM,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4FAA4F;AAC5F,SAAS,IAAI,CAAC,QAAiB;IAC7B,OAAO,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC"}
+{"version":3,"file":"version-history.js","sourceRoot":"","sources":["../../../src/pipeline/steps/version-history.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAE1E,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,aAAa,GACd,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAE1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,oEAAoE;AACpE,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAEtC,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAgBD,iFAAiF;AACjF,MAAM,UAAU,iCAAiC,CAC/C,KAAY,EACZ,OAAuC,EACvC,QAAgB;IAEhB,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CAAC,GAAuC;YACnD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC;YAEtB,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACpB,MAAM,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;YAC9D,CAAC;YAED,iEAAiE;YACjE,0CAA0C;YAC1C,sBAAsB,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAErD,IACE,GAAG,CAAC,IAAI,KAAK,eAAe,CAAC,yBAAyB;gBACtD,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EACzB,CAAC;gBACD,MAAM,oBAAoB,CACxB,2BAA2B,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAC7F,CAAC;YACJ,CAAC;YAED,IAAI,IAAoC,CAAC;YACzC,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,kBAAkB,CAC7B,KAAK,EACL,GAAG,CAAC,eAAe,EACnB,OAAO,CAAC,MAAM,EACd,GAAG,CAAC,IAAI,EACR,GAAG,CAAC,GAAG,CACR,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,kBAAkB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9C,CAAC;YAED,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC3C,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;gBACnC,OAAO;YACT,CAAC;YAED,IAAI,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;gBACnC,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACvC,KAAK,EACL,GAAG,CAAC,eAAe,EACnB,OAAO,CAAC,MAAM,EACd,IAAI,CAAC,IAAI,CAAC,EACV,OAAO,CACR,CAAC;YACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,GAAG,OAAO,CAAC,IAAI,UAAU,EACzB,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,CACzB,CAAC;YACJ,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,SAAS,kBAAkB,CACzB,OAAuC,EACvC,IAAwB,EACxB,OAAe;IAEf,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC;IAC9C,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,OAAO,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,kBAAkB,CAC/B,KAAY,EACZ,IAAqB,EACrB,MAAY,EACZ,UAAkB,EAClB,OAAe;IAEf,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;gBACxC,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,aAAa,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;YACxC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,aAAa,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,4EAA4E;AAE5E,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,MAAM,CAAC,MAAM,6BAA6B,GAAG,wBAAwB,CAAC;AACtE,MAAM,CAAC,MAAM,2BAA2B,GAAG,sBAAsB,CAAC;AAClE,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAqB,EACrB,aAAqB,EACrB,QAAgB,6BAA6B;IAE7C,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,+CAA+C,KAAK,oCAAoC,CACzF,CAAC;QACJ,CAAC;QACD,OAAO;YACL;gBACE,UAAU,EAAE,aAAa,CAAC,QAAQ;gBAClC,YAAY,EAAE,IAAI;gBAClB,UAAU;gBACV,aAAa;aACd;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AA+BD,uGAAuG;AACvG,MAAM,UAAU,+BAA+B,CAM7C,KAAY,EACZ,OAAgE,EAChE,QAAgB;IAEhB,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CAAC,GAA8B;YAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,IAAoC,CAAC;YACzC,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,kBAAkB,CAC7B,KAAK,EACL,GAAG,CAAC,eAAe,EACnB,OAAO,CAAC,MAAM,EACd,GAAG,CAAC,IAAI,EACR,GAAG,CAAC,GAAG,CACR,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,wBAAwB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,UAAU,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;YACrE,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,oEAAoE;YACpE,qEAAqE;YACrE,2CAA2C;YAC3C,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,yBAAyB,CAMvC,KAAY,EACZ,OAAgE,EAChE,QAAgB;IAEhB,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CAAC,GAA8B;YAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAW,CAAC;YAEpE,IAAI,OAAO,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAC1E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;YAC/D,CAAC;YAED,mEAAmE;YACnE,kEAAkE;YAClE,yDAAyD;YACzD,yCAAyC;YACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,2BAA2B,CAAW,CAAC;YAChE,IAAI,aAAa,GAAG,KAAK,CAAC;YAC1B,MAAM,OAAO,GAAY,EAAE,CAAC;YAC5B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,QAA4B,CAAC;gBACjC,IAAI,CAAC;oBACH,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBACrD,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,MAAM,SAAS,GACb,CAAC,aAAa;oBACd,QAAQ,KAAK,EAAE;oBACf,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;gBAC5C,aAAa,GAAG,aAAa,IAAI,SAAS,CAAC;gBAC3C,uEAAuE;gBACvE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,CAAC;YAED,IAAI,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC5B,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAClB,QAAQ,GAAG,iBAAiB,CAAC;YAC/B,CAAC;YACD,IAAI,QAAQ,GAAG,aAAa,EAAE,CAAC;gBAC7B,QAAQ,GAAG,aAAa,CAAC;YAC3B,CAAC;YAED,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,GAAG,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;gBACzB,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC9C,CAAC;YAED,IAAI,WAAW,GAAY,EAAE,CAAC;YAC9B,IAAI,aAAa,GAAG,EAAE,CAAC;YACvB,IAAI,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC5D,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;gBAC7C,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;oBACzB,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;YAED,GAAG,CAAC,GAAG,CACL,0BAA0B,EAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,CAC7D,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;QACzC,MAAM,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACxE,MAAM,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4FAA4F;AAC5F,SAAS,IAAI,CAAC,QAAiB;IAC7B,OAAO,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/server",
-  "version": "3.20.0",
+  "version": "3.22.0",
   "description": "The Stigmer OSS control plane as a composable library: composeServer, the extension registry and the driver seams a composition builds on. The self-contained deployable of the same server is @stigmer/server-slim.",
   "license": "Apache-2.0",
   "type": "module",
@@ -62,11 +62,11 @@
     "@connectrpc/connect-node": "^2.0.0",
     "@kubernetes/client-node": "2.0.0",
     "@opentelemetry/api": "^1.9.0",
-    "@stigmer/outbound": "3.20.0",
-    "@stigmer/plugin-package": "3.20.0",
-    "@stigmer/protos": "3.20.0",
-    "@stigmer/temporal-codecs": "3.20.0",
-    "@stigmer/zip-structure": "3.20.0",
+    "@stigmer/outbound": "3.22.0",
+    "@stigmer/plugin-package": "3.22.0",
+    "@stigmer/protos": "3.22.0",
+    "@stigmer/temporal-codecs": "3.22.0",
+    "@stigmer/zip-structure": "3.22.0",
     "@temporalio/activity": "1.16.2",
     "@temporalio/client": "1.16.2",
     "@temporalio/common": "1.16.2",

package/src/authorization/__tests__/list-read-scope.test.ts

@@ -17,7 +17,9 @@
  * org-observable reaches the organization's viewers; a memory with no
  * subject is nobody's; an instance reaches whoever reads its blueprint
  * only when it is the default. Then the contract: a scope only narrows
- * and never reorders; the `internal` class is the in-process skip; an
+ * and never reorders; the `internal` class is the in-process skip on the
+ * enumeration verb and a loud consumer bug on the restrict verb (the
+ * shared helper answers the class before any driver, stigmer#1207); an
  * unprovisioned subject is their raw subject (the 3.14 verifiers' stamp); a
  * fault throws and is never an empty answer; an undeclared kind is a
  * consumer bug, loud; the enumeration verb equals the restrict verb over
@@ -583,17 +585,7 @@ describe.each(driverFixtures(SEEDED_KINDS))(
             expect(accountReads).toBe(0);
           });
 
-          it("the `internal` class — the server acting as itself — keeps every offered id and enumerates every id of the kind: the in-process authorization skip, with no account even asked for", async () => {
-            const offered = rowsOf(ApiResourceKind.agent).map((row) =>
-              entryOf(ApiResourceKind.agent, row),
-            );
-            expect([
-              ...(await scope().restrictListEntries(
-                INTERNAL,
-                ApiResourceKind.agent,
-                offered,
-              )),
-            ]).toEqual(offered.map((entry) => entry.id));
+          it("the `internal` class on the enumeration verb — the server acting as itself — is every id of the kind, with no account even asked for (the in-process skip; no helper stands before this verb)", async () => {
             expect(
               [
                 ...(await scope().authorizedResourceIds(
@@ -605,6 +597,25 @@ describe.each(driverFixtures(SEEDED_KINDS))(
             expect(accountReads).toBe(0);
           });
 
+          it("the `internal` class on the restrict verb is a consumer bug, loud: the shared helper answers that class before any driver, so a driver offered it was reached around the idiom", async () => {
+            const offered = rowsOf(ApiResourceKind.agent).map((row) =>
+              entryOf(ApiResourceKind.agent, row),
+            );
+            const refusal = await scope()
+              .restrictListEntries(INTERNAL, ApiResourceKind.agent, offered)
+              .then(
+                () => undefined,
+                (error: unknown) => error,
+              );
+            expect(refusal).toBeInstanceOf(AuthorizationEvaluationError);
+            expect((refusal as AuthorizationEvaluationError).reason).toBe(
+              "internal-caller-offered",
+            );
+            // Refused before any read: the server was never evaluated as a person.
+            expect(accountReads).toBe(0);
+            expect(storeReads).toEqual({ rows: 0, scans: 0 });
+          });
+
           it("an unprovisioned subject is their raw subject and nothing else: the 3.14-stamped row is theirs, the organization's rows are not", async () => {
             // `agt_legacy` is stamped with LEGACY's raw subject; a caller
             // who IS that subject and holds no account reaches it through