@stigmer/server 3.21.0 → 3.22.1-dev.20260922095755

package/dist/pipeline/steps/authorize.d.ts

@@ -38,6 +38,26 @@ export interface AuthorizeTargetOverride {
     readonly resourceKind?: ApiResourceKind;
     readonly resourceId: string;
 }
+/**
+ * One question for the Authorizer together with the lane's deny copy: the
+ * unit `authorizeResolvedResource` consumes, whether the annotation named
+ * it (`resolveAnnotatedCheck`) or a chain's own resolver did (the run gate,
+ * the resolved-target step).
+ */
+export interface AuthorizationTarget extends AuthzCheck {
+    readonly deniedMessage: string;
+}
+/**
+ * The annotation's answer for one method: the target it names for this
+ * request, or `undefined` when it names none — `is_public`,
+ * `is_skip_authorization`, or no config at all. Pure over the descriptor
+ * and the request; the `internal` exemption is the evaluation's, not the
+ * annotation's, so it is not applied here. Exported so a chain step can
+ * authorize a loaded row exactly as a SIBLING method's annotation would
+ * (a read by reference asks what its `get` asks) without a second copy of
+ * the skip arms or the field-path resolution.
+ */
+export declare function resolveAnnotatedCheck(method: DescMethod, input: Message, override?: AuthorizeTargetOverride): AuthorizationTarget | undefined;
 /**
  * The Authorize evaluation for direct handlers: identical skip arms,
  * target resolution, and decision-to-wire mapping as the pipeline step
@@ -45,6 +65,13 @@ export interface AuthorizeTargetOverride {
  * non-allow arm; resolves on allow and on every skip arm.
  */
 export declare function authorizeDirect(method: DescMethod, authorizer: Authorizer, identity: CallerIdentity, input: Message, override?: AuthorizeTargetOverride): Promise<void>;
+/**
+ * `authorizeResolvedResource` over an AuthorizationTarget: the check the
+ * Authorizer sees carries exactly the three fields of an AuthzCheck, never
+ * the copy, so a recording Authorizer (a test's, a driver's audit line)
+ * observes the question and nothing else.
+ */
+export declare function authorizeTarget(authorizer: Authorizer, identity: CallerIdentity, target: AuthorizationTarget): Promise<void>;
 /**
  * The SAME evaluation for a check whose target the HANDLER resolved —
  * the mid-chain resolved-id pattern DD-007 names ("the pattern the two

package/dist/pipeline/steps/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/authorize.ts"],"names":[],"mappings":"AA4DA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAG3E,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAQtH,OAAO,KAAK,EACV,UAAU,EACV,UAAU,EACV,aAAa,EACd,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGnD;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,+CACA,CAAC;AAE/C,uEAAuE;AACvE,eAAO,MAAM,qCAAqC,sBAAsB,CAAC;AAEzE;;;;;;GAMG;AACH,wBAAgB,iCAAiC,IAAI,UAAU,CAM9D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,SAAS,WAAW,EACvD,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,UAAU,GACrB,YAAY,CAAC,IAAI,CAAC,CAOpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,CAAC,EAAE,eAAe,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,OAAO,EACd,QAAQ,CAAC,EAAE,uBAAuB,GACjC,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CA4Cf;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,aAAa,CAAC,CASxB"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/authorize.ts"],"names":[],"mappings":"AAoEA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAG3E,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAQtH,OAAO,KAAK,EACV,UAAU,EACV,UAAU,EACV,aAAa,EACd,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGnD;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,+CACA,CAAC;AAE/C,uEAAuE;AACvE,eAAO,MAAM,qCAAqC,sBAAsB,CAAC;AAEzE;;;;;;GAMG;AACH,wBAAgB,iCAAiC,IAAI,UAAU,CAM9D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,SAAS,WAAW,EACvD,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,UAAU,GACrB,YAAY,CAAC,IAAI,CAAC,CAOpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,CAAC,EAAE,eAAe,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,OAAO,EACd,QAAQ,CAAC,EAAE,uBAAuB,GACjC,mBAAmB,GAAG,SAAS,CAiBjC;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,OAAO,EACd,QAAQ,CAAC,EAAE,uBAAuB,GACjC,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,cAAc,EACxB,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAWf;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CA4Cf;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,aAAa,CAAC,CASxB"}

package/dist/pipeline/steps/authorize.js

@@ -56,6 +56,14 @@
  * names no kind because the target is the loaded row's resource). The
  * annotation keeps owning the permission, the copy and the skip arms in
  * both shapes; only the target is the handler's.
+ *
+ * The annotation read itself is one pure function, `resolveAnnotatedCheck`,
+ * so a third entry shape needs no third copy of it: the resolved-target
+ * step (authorize-resolved-target.ts) authorizes a row a chain LOADED as
+ * a sibling method's annotation would — a read by reference asks exactly
+ * what its `get` asks, target override and all — and every lane whose
+ * position-1 annotation is a skip because the target is not in the request
+ * answers its question there, with the same four arms.
  */
 import { Code, ConnectError } from "@connectrpc/connect";
 import { getOption, hasOption } from "@bufbuild/protobuf";
@@ -98,6 +106,32 @@ export function newAuthorizeStep(method, authorizer) {
         },
     };
 }
+/**
+ * The annotation's answer for one method: the target it names for this
+ * request, or `undefined` when it names none — `is_public`,
+ * `is_skip_authorization`, or no config at all. Pure over the descriptor
+ * and the request; the `internal` exemption is the evaluation's, not the
+ * annotation's, so it is not applied here. Exported so a chain step can
+ * authorize a loaded row exactly as a SIBLING method's annotation would
+ * (a read by reference asks what its `get` asks) without a second copy of
+ * the skip arms or the field-path resolution.
+ */
+export function resolveAnnotatedCheck(method, input, override) {
+    if (getOption(method, is_public) ||
+        getOption(method, is_skip_authorization)) {
+        return undefined;
+    }
+    if (!hasOption(method, rpcAuthorizationConfig)) {
+        return undefined;
+    }
+    const config = getOption(method, rpcAuthorizationConfig);
+    return {
+        permission: config.permission,
+        resourceKind: override?.resourceKind ?? resolveResourceKind(input, config),
+        resourceId: override?.resourceId ?? resolveResourceId(input, config),
+        deniedMessage: config.errorMsg,
+    };
+}
 /**
  * The Authorize evaluation for direct handlers: identical skip arms,
  * target resolution, and decision-to-wire mapping as the pipeline step
@@ -108,19 +142,24 @@ export async function authorizeDirect(method, authorizer, identity, input, overr
     if (identity.callerClass === "internal") {
         return;
     }
-    if (getOption(method, is_public) ||
-        getOption(method, is_skip_authorization)) {
+    const target = resolveAnnotatedCheck(method, input, override);
+    if (target === undefined) {
         return;
     }
-    if (!hasOption(method, rpcAuthorizationConfig)) {
-        return;
-    }
-    const config = getOption(method, rpcAuthorizationConfig);
+    return authorizeTarget(authorizer, identity, target);
+}
+/**
+ * `authorizeResolvedResource` over an AuthorizationTarget: the check the
+ * Authorizer sees carries exactly the three fields of an AuthzCheck, never
+ * the copy, so a recording Authorizer (a test's, a driver's audit line)
+ * observes the question and nothing else.
+ */
+export function authorizeTarget(authorizer, identity, target) {
     return authorizeResolvedResource(authorizer, identity, {
-        permission: config.permission,
-        resourceKind: override?.resourceKind ?? resolveResourceKind(input, config),
-        resourceId: override?.resourceId ?? resolveResourceId(input, config),
-    }, config.errorMsg);
+        permission: target.permission,
+        resourceKind: target.resourceKind,
+        resourceId: target.resourceId,
+    }, target.deniedMessage);
 }
 /**
  * The SAME evaluation for a check whose target the HANDLER resolved —

package/dist/pipeline/steps/authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/pipeline/steps/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,MAAM,IAAI,sBAAsB,EAChC,SAAS,EACT,qBAAqB,GACtB,MAAM,0DAA0D,CAAC;AAQlE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAI5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAC5C,4CAA4C,CAAC;AAE/C,uEAAuE;AACvE,MAAM,CAAC,MAAM,qCAAqC,GAAG,mBAAmB,CAAC;AAEzE;;;;;;GAMG;AACH,MAAM,UAAU,iCAAiC;IAC/C,OAAO;QACL,SAAS;YACP,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAkB,EAClB,UAAsB;IAEtB,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,OAAO,CAAC,GAAyB;YAC/B,OAAO,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC;AAgBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAkB,EAClB,UAAsB,EACtB,QAAwB,EACxB,KAAc,EACd,QAAkC;IAElC,IAAI,QAAQ,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACxC,OAAO;IACT,CAAC;IACD,IACE,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC;QAC5B,SAAS,CAAC,MAAM,EAAE,qBAAqB,CAAC,EACxC,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAEzD,OAAO,yBAAyB,CAC9B,UAAU,EACV,QAAQ,EACR;QACE,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EACV,QAAQ,EAAE,YAAY,IAAI,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC;QAC9D,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC;KACrE,EACD,MAAM,CAAC,QAAQ,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,UAAsB,EACtB,QAAwB,EACxB,KAAiB,EACjB,QAAgB;IAEhB,IAAI,QAAQ,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACxC,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACvE,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO;QACT,KAAK,MAAM;YACT,MAAM,IAAI,YAAY,CACpB,QAAQ,KAAK,EAAE;gBACb,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,EAAE;oBACtB,CAAC,CAAC,QAAQ,CAAC,MAAM;oBACjB,CAAC,CAAC,qCAAqC,EAC3C,IAAI,CAAC,gBAAgB,CACtB,CAAC;QACJ,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,+DAA+D;YAC/D,6DAA6D;YAC7D,gDAAgD;YAChD,IACE,KAAK,CAAC,UAAU,KAAK,EAAE;gBACvB,KAAK,CAAC,YAAY,KAAK,eAAe,CAAC,yBAAyB,EAChE,CAAC;gBACD,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,+DAA+D,CAChE,EACD,iCAAiC,CAClC,CAAC;YACJ,CAAC;YACD,MAAM,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,aAAa;YAChB,MAAM,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAC3D,iCAAiC,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAsB,EACtB,QAAwB,EACxB,KAAiB;IAEjB,IAAI,CAAC;QACH,OAAO,MAAM,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAC1B,KAAc,EACd,MAA8B;IAE9B,IAAI,MAAM,CAAC,gBAAgB,KAAK,EAAE,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAwB,CAAC;IAClC,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,eAAe,CAAC,yBAAyB,CAAC;AACnD,CAAC;AAED,yEAAyE;AACzE,SAAS,iBAAiB,CACxB,KAAc,EACd,MAA8B;IAE9B,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC;IAC3B,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAClD,IAAI,OAAO,GAAY,KAAK,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAI,OAAmC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/pipeline/steps/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,MAAM,IAAI,sBAAsB,EAChC,SAAS,EACT,qBAAqB,GACtB,MAAM,0DAA0D,CAAC;AAQlE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAI5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAC5C,4CAA4C,CAAC;AAE/C,uEAAuE;AACvE,MAAM,CAAC,MAAM,qCAAqC,GAAG,mBAAmB,CAAC;AAEzE;;;;;;GAMG;AACH,MAAM,UAAU,iCAAiC;IAC/C,OAAO;QACL,SAAS;YACP,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAkB,EAClB,UAAsB;IAEtB,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,OAAO,CAAC,GAAyB;YAC/B,OAAO,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC;AA0BD;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAkB,EAClB,KAAc,EACd,QAAkC;IAElC,IACE,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC;QAC5B,SAAS,CAAC,MAAM,EAAE,qBAAqB,CAAC,EACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACzD,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC;QAC1E,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC;QACpE,aAAa,EAAE,MAAM,CAAC,QAAQ;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAkB,EAClB,UAAsB,EACtB,QAAwB,EACxB,KAAc,EACd,QAAkC;IAElC,IAAI,QAAQ,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACxC,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,OAAO,eAAe,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,UAAsB,EACtB,QAAwB,EACxB,MAA2B;IAE3B,OAAO,yBAAyB,CAC9B,UAAU,EACV,QAAQ,EACR;QACE,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,EACD,MAAM,CAAC,aAAa,CACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,UAAsB,EACtB,QAAwB,EACxB,KAAiB,EACjB,QAAgB;IAEhB,IAAI,QAAQ,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACxC,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACvE,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO;QACT,KAAK,MAAM;YACT,MAAM,IAAI,YAAY,CACpB,QAAQ,KAAK,EAAE;gBACb,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,EAAE;oBACtB,CAAC,CAAC,QAAQ,CAAC,MAAM;oBACjB,CAAC,CAAC,qCAAqC,EAC3C,IAAI,CAAC,gBAAgB,CACtB,CAAC;QACJ,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,+DAA+D;YAC/D,6DAA6D;YAC7D,gDAAgD;YAChD,IACE,KAAK,CAAC,UAAU,KAAK,EAAE;gBACvB,KAAK,CAAC,YAAY,KAAK,eAAe,CAAC,yBAAyB,EAChE,CAAC;gBACD,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,+DAA+D,CAChE,EACD,iCAAiC,CAClC,CAAC;YACJ,CAAC;YACD,MAAM,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,aAAa;YAChB,MAAM,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAC3D,iCAAiC,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAsB,EACtB,QAAwB,EACxB,KAAiB;IAEjB,IAAI,CAAC;QACH,OAAO,MAAM,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAC1B,KAAc,EACd,MAA8B;IAE9B,IAAI,MAAM,CAAC,gBAAgB,KAAK,EAAE,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAwB,CAAC;IAClC,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,eAAe,CAAC,yBAAyB,CAAC;AACnD,CAAC;AAED,yEAAyE;AACzE,SAAS,iBAAiB,CACxB,KAAc,EACd,MAA8B;IAE9B,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC;IAC3B,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAClD,IAAI,OAAO,GAAY,KAAK,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAI,OAAmC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9E,CAAC"}

package/dist/pipeline/steps/guard-memory-capture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard-memory-capture.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-memory-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAG/F,wEAAwE;AACxE,eAAO,MAAM,6BAA6B,iEACsB,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AAEvE,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,QAAQ,CAAC,EAAE,wBAAwB,GAClC,YAAY,CAAC,IAAI,CAAC,CAsDpB;AAED,4EAA4E;AAC5E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,GACxB,uBAAuB,GAAG,SAAS,CAWrC"}
+{"version":3,"file":"guard-memory-capture.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-memory-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAItD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAG/F,wEAAwE;AACxE,eAAO,MAAM,6BAA6B,iEACsB,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AAEvE,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,QAAQ,CAAC,EAAE,wBAAwB,GAClC,YAAY,CAAC,IAAI,CAAC,CAsDpB;AAED,4EAA4E;AAC5E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,GACxB,uBAAuB,GAAG,SAAS,CAWrC"}

package/dist/pipeline/steps/guard-memory-capture.js

@@ -1,4 +1,5 @@
 import { Code, ConnectError } from "@connectrpc/connect";
+import { isServerComposedRequest } from "../../extensions/identity.js";
 import { metadataOf } from "./shapes.js";
 /** The Java MemoryPolicy.MEMORY_CAPTURE_CALLER_MESSAGE, byte-pinned. */
 export const MEMORY_CAPTURE_CALLER_MESSAGE = "memory can only be captured for a first-party human operator";
@@ -14,7 +15,7 @@ export function newGuardMemoryCaptureStep(provider) {
         name: "GuardMemoryCapture",
         async execute(ctx) {
             const caller = ctx.callerIdentity;
-            if (caller.callerClass === "internal" || caller.origin === "in-process") {
+            if (isServerComposedRequest(caller)) {
                 // Server-composed traversals are not capture requests from a
                 // credential; the entry-point request already passed the gate.
                 return;

package/dist/pipeline/steps/guard-memory-capture.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard-memory-capture.js","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-memory-capture.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKzD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,wEAAwE;AACxE,MAAM,CAAC,MAAM,6BAA6B,GACxC,8DAA8D,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAC;AAEvE,MAAM,UAAU,yBAAyB,CACvC,QAAmC;IAEnC,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC;YAClC,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBACxE,6DAA6D;gBAC7D,+DAA+D;gBAC/D,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,EAAE,sBAAsB,CAAC;YAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,gEAAgE;gBAChE,8DAA8D;gBAC9D,8DAA8D;gBAC9D,gEAAgE;gBAChE,2DAA2D;gBAC3D,4DAA4D;gBAC5D,uDAAuD;gBACvD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;gBAC1D,QAAQ,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACzB,KAAK,OAAO;wBACV,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE;4BACrC,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;4BAC3D,eAAe,EAAE,QAAQ,CAAC,eAAe;yBAC1C,CAAC,CAAC;wBACH,OAAO;oBACT,KAAK,QAAQ;wBACX,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,gBAAgB,CACtB,CAAC;oBACJ,KAAK,YAAY;wBACf,MAAM;oBACR,OAAO,CAAC,CAAC,CAAC;wBACR,MAAM,UAAU,GAAU,QAAQ,CAAC;wBACnC,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAChE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IACE,MAAM,CAAC,WAAW,KAAK,SAAS;gBAChC,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC3C,CAAC;gBACD,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,gBAAgB,CACtB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAyB;IAEzB,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACvD,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,0BAA0B,IAAI,OAAO;QACrC,iBAAiB,IAAI,OAAO,EAC5B,CAAC;QACD,OAAO,OAAkC,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B,CAAC,QAAgB;IAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,CAAC,iDAAiD;IACjE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACnB,CAAC;QACtC,OAAO,CACL,OAAO,OAAO,CAAC,kBAAkB,KAAK,QAAQ;YAC9C,OAAO,CAAC,kBAAkB,KAAK,EAAE,CAClC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"guard-memory-capture.js","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-memory-capture.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAIvE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,wEAAwE;AACxE,MAAM,CAAC,MAAM,6BAA6B,GACxC,8DAA8D,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAC;AAEvE,MAAM,UAAU,yBAAyB,CACvC,QAAmC;IAEnC,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC;YAClC,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,6DAA6D;gBAC7D,+DAA+D;gBAC/D,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,EAAE,sBAAsB,CAAC;YAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,gEAAgE;gBAChE,8DAA8D;gBAC9D,8DAA8D;gBAC9D,gEAAgE;gBAChE,2DAA2D;gBAC3D,4DAA4D;gBAC5D,uDAAuD;gBACvD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;gBAC1D,QAAQ,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACzB,KAAK,OAAO;wBACV,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE;4BACrC,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;4BAC3D,eAAe,EAAE,QAAQ,CAAC,eAAe;yBAC1C,CAAC,CAAC;wBACH,OAAO;oBACT,KAAK,QAAQ;wBACX,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,gBAAgB,CACtB,CAAC;oBACJ,KAAK,YAAY;wBACf,MAAM;oBACR,OAAO,CAAC,CAAC,CAAC;wBACR,MAAM,UAAU,GAAU,QAAQ,CAAC;wBACnC,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAChE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IACE,MAAM,CAAC,WAAW,KAAK,SAAS;gBAChC,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC3C,CAAC;gBACD,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,gBAAgB,CACtB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAyB;IAEzB,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACvD,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,0BAA0B,IAAI,OAAO;QACrC,iBAAiB,IAAI,OAAO,EAC5B,CAAC;QACD,OAAO,OAAkC,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B,CAAC,QAAgB;IAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,CAAC,iDAAiD;IACjE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACnB,CAAC;QACtC,OAAO,CACL,OAAO,OAAO,CAAC,kBAAkB,KAAK,QAAQ;YAC9C,OAAO,CAAC,kBAAkB,KAAK,EAAE,CAClC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/pipeline/steps/guard-reserved-labels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard-reserved-labels.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-reserved-labels.ts"],"names":[],"mappings":"AAmDA,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAK/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAK5D,uEAAuE;AACvE,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAYnD;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACxC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC1C,aAAa,CAAC,MAAM,CAAC,CAQvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,4BAA4B,CAAC,IAAI,SAAS,WAAW;IACpE,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,OAAO,GAAG,SAAS,CAAC;IACtE,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,wBAAgB,0BAA0B,CAAC,IAAI,SAAS,WAAW,EACjE,UAAU,EAAE,UAAU,EACtB,SAAS,GAAE,4BAA4B,CAAC,IAAI,CAAM,GACjD,YAAY,CAAC,IAAI,CAAC,CAwEpB"}
+{"version":3,"file":"guard-reserved-labels.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-reserved-labels.ts"],"names":[],"mappings":"AAmDA,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAK/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAGjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAK5D,uEAAuE;AACvE,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAYnD;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACxC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC1C,aAAa,CAAC,MAAM,CAAC,CAQvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,4BAA4B,CAAC,IAAI,SAAS,WAAW;IACpE,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,OAAO,GAAG,SAAS,CAAC;IACtE,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,wBAAgB,0BAA0B,CAAC,IAAI,SAAS,WAAW,EACjE,UAAU,EAAE,UAAU,EACtB,SAAS,GAAE,4BAA4B,CAAC,IAAI,CAAM,GACjD,YAAY,CAAC,IAAI,CAAC,CAoEpB"}

package/dist/pipeline/steps/guard-reserved-labels.js

@@ -51,6 +51,7 @@
 import { Code, ConnectError } from "@connectrpc/connect";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { isServerComposedRequest } from "../../extensions/identity.js";
 import { internalError } from "../errors.js";
 import { EXISTING_RESOURCE_KEY } from "./load-existing.js";
 import { serverStampedReservedLabels } from "./server-stamped-reserved-labels.js";
@@ -83,13 +84,11 @@ export function newGuardReservedLabelsStep(authorizer, positions = {}) {
     return {
         name: "GuardReservedLabels",
         async execute(ctx) {
-            if (ctx.callerIdentity.callerClass === "internal" ||
-                ctx.callerIdentity.origin === "in-process") {
-                // Server-composed request (the Java isInProcessCall arm,
-                // cloud#386): the trust decision was made by the service code
-                // that built it — default-instance factories stamp reserved
-                // labels by design, even when the call propagates the user's
-                // identity for attribution (ruling R5).
+            if (isServerComposedRequest(ctx.callerIdentity)) {
+                // The Java isInProcessCall arm (cloud#386): the trust decision was
+                // made by the service code that built the request — default-instance
+                // factories stamp reserved labels by design, even when the call
+                // propagates the user's identity for attribution (ruling R5).
                 return;
             }
             const state = stateOf(ctx);

package/dist/pipeline/steps/guard-reserved-labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard-reserved-labels.js","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-reserved-labels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAG1E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,uEAAuE;AACvE,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD;;;;GAIG;AACH,MAAM,yBAAyB,GAG3B,IAAI,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE/E;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAwC,EACxC,SAA2C;IAE3C,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,IAAI,GAAG,CAAC,UAAU,CAAC,qBAAqB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;YACnE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAgBD,MAAM,UAAU,0BAA0B,CACxC,UAAsB,EACtB,YAAgD,EAAE;IAElD,MAAM,OAAO,GACX,SAAS,CAAC,OAAO,IAAI,CAAC,CAAC,GAAyB,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACnE,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IACE,GAAG,CAAC,cAAc,CAAC,WAAW,KAAK,UAAU;gBAC7C,GAAG,CAAC,cAAc,CAAC,MAAM,KAAK,YAAY,EAC1C,CAAC;gBACD,yDAAyD;gBACzD,8DAA8D;gBAC9D,4DAA4D;gBAC5D,6DAA6D;gBAC7D,wCAAwC;gBACxC,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,SAAS,GACb,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACtC,MAAM,MAAM,GACV,QAAQ,KAAK,SAAS;gBACpB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,UAAU,CAAC,QAAmB,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;YAEtD,MAAM,SAAS,GACb,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;YAClE,MAAM,OAAO,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,MAAM,CAChE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAClD,CAAC;YACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,+DAA+D;YAC/D,4CAA4C;YAC5C,IAAI,QAAQ,CAAC;YACb,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc,EAAE;oBACxD,UAAU,EAAE,aAAa,CAAC,yBAAyB;oBACnD,YAAY,EAAE,eAAe,CAAC,QAAQ;oBACtC,UAAU,EAAE,SAAS;iBACtB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAC;YACzC,CAAC;YACD,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACtB,KAAK,OAAO;oBACV,OAAO;gBACT,KAAK,MAAM,CAAC;gBACZ,KAAK,WAAW;oBACd,MAAM,IAAI,YAAY,CACpB,2BAA2B,qBAAqB,cAAc;wBAC5D,4DAA4D;wBAC5D,YAAY,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B;wBAC3D,0CAA0C,EAC5C,IAAI,CAAC,eAAe,CACrB,CAAC;gBACJ,KAAK,aAAa;oBAChB,MAAM,yBAAyB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAClD,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,UAAU,GAAU,QAAQ,CAAC;oBACnC,MAAM,yBAAyB,CAC7B,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAC5D,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,yBAAyB,CAAC,KAAc;IAC/C,OAAO,aAAa,CAClB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACzD,kDAAkD,CACnD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"guard-reserved-labels.js","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-reserved-labels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAG1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,uEAAuE;AACvE,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD;;;;GAIG;AACH,MAAM,yBAAyB,GAG3B,IAAI,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE/E;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAwC,EACxC,SAA2C;IAE3C,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,IAAI,GAAG,CAAC,UAAU,CAAC,qBAAqB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;YACnE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAgBD,MAAM,UAAU,0BAA0B,CACxC,UAAsB,EACtB,YAAgD,EAAE;IAElD,MAAM,OAAO,GACX,SAAS,CAAC,OAAO,IAAI,CAAC,CAAC,GAAyB,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACnE,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;gBAChD,mEAAmE;gBACnE,qEAAqE;gBACrE,gEAAgE;gBAChE,8DAA8D;gBAC9D,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,SAAS,GACb,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACtC,MAAM,MAAM,GACV,QAAQ,KAAK,SAAS;gBACpB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,UAAU,CAAC,QAAmB,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;YAEtD,MAAM,SAAS,GACb,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;YAClE,MAAM,OAAO,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,MAAM,CAChE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAClD,CAAC;YACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,+DAA+D;YAC/D,4CAA4C;YAC5C,IAAI,QAAQ,CAAC;YACb,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc,EAAE;oBACxD,UAAU,EAAE,aAAa,CAAC,yBAAyB;oBACnD,YAAY,EAAE,eAAe,CAAC,QAAQ;oBACtC,UAAU,EAAE,SAAS;iBACtB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAC;YACzC,CAAC;YACD,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACtB,KAAK,OAAO;oBACV,OAAO;gBACT,KAAK,MAAM,CAAC;gBACZ,KAAK,WAAW;oBACd,MAAM,IAAI,YAAY,CACpB,2BAA2B,qBAAqB,cAAc;wBAC5D,4DAA4D;wBAC5D,YAAY,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B;wBAC3D,0CAA0C,EAC5C,IAAI,CAAC,eAAe,CACrB,CAAC;gBACJ,KAAK,aAAa;oBAChB,MAAM,yBAAyB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAClD,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,UAAU,GAAU,QAAQ,CAAC;oBACnC,MAAM,yBAAyB,CAC7B,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAC5D,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,yBAAyB,CAAC,KAAc;IAC/C,OAAO,aAAa,CAClB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACzD,kDAAkD,CACnD,CAAC;AACJ,CAAC"}

package/dist/pipeline/steps/helpers.d.ts

@@ -20,11 +20,15 @@ export declare function findResourceBySlug<Desc extends DescMessage>(store: Stor
  */
 export declare function findResourceByLabelAndOrg<Desc extends DescMessage>(store: Store, kind: ApiResourceKind, schema: Desc, labelKey: string, labelValue: string, org: string): Promise<MessageShape<Desc> | undefined>;
 /**
- * Rejects a getByReference lookup that omits org for an org-scoped kind —
- * Go RequireOrgForReference. For AUTHORIZATION_SCOPE_TYPE_ORGANIZATION
- * kinds a slug is unique only WITHIN an org; resolving an org-less
- * reference globally would cross tenant boundaries. The message matches
- * the cloud edition verbatim (cross-edition error contract).
+ * Rejects a getByReference lookup that omits org — Go RequireOrgForReference,
+ * widened to every kind that has a reference lane. A slug is unique only
+ * WITHIN an org, so an org-less reference resolves globally and the first
+ * match wins: for an org-scoped kind that crosses tenant boundaries, and
+ * for an owner-only kind (the execution context) it let a caller name a
+ * slug and receive whichever organization's row matched first. Every kind
+ * with a reference lane is served per organization, so the rule is the
+ * same for all of them. The message matches the cloud edition verbatim
+ * (cross-edition error contract); the kind name comes from kind_meta.
  *
  * Belongs at the getByReference boundary only — the low-level slug finders
  * are legitimately called with a relative (possibly empty) org by internal

package/dist/pipeline/steps/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/helpers.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAKtD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,SAAS,WAAW,EAC/D,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,IAAI,EACZ,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAmBzC;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EACtE,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,IAAI,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAkBzC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,eAAe,EACrB,GAAG,EAAE,MAAM,GACV,IAAI,CAqBN;AAOD,qEAAqE;AACrE,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,SAAS,GAAG,SAAS,EACxB,CAAC,EAAE,SAAS,GAAG,SAAS,GACvB,MAAM,CAcR;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAC9B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACnC,OAAO,CAIT"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/helpers.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAKtD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,SAAS,WAAW,EAC/D,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,IAAI,EACZ,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAmBzC;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EACtE,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,IAAI,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAkBzC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,eAAe,EACrB,GAAG,EAAE,MAAM,GACV,IAAI,CAcN;AAOD,qEAAqE;AACrE,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,SAAS,GAAG,SAAS,EACxB,CAAC,EAAE,SAAS,GAAG,SAAS,GACvB,MAAM,CAcR;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAC9B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACnC,OAAO,CAIT"}

package/dist/pipeline/steps/helpers.js

@@ -4,7 +4,6 @@
  * interface, not here — D2 §3).
  */
 import { fromBinary } from "@bufbuild/protobuf";
-import { AuthorizationScopeType } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
 import { getKindMeta } from "../apiresource-meta.js";
 import { internalError, invalidArgumentError } from "../errors.js";
 import { metadataOf } from "./shapes.js";
@@ -65,11 +64,15 @@ export async function findResourceByLabelAndOrg(store, kind, schema, labelKey, l
     return undefined;
 }
 /**
- * Rejects a getByReference lookup that omits org for an org-scoped kind —
- * Go RequireOrgForReference. For AUTHORIZATION_SCOPE_TYPE_ORGANIZATION
- * kinds a slug is unique only WITHIN an org; resolving an org-less
- * reference globally would cross tenant boundaries. The message matches
- * the cloud edition verbatim (cross-edition error contract).
+ * Rejects a getByReference lookup that omits org — Go RequireOrgForReference,
+ * widened to every kind that has a reference lane. A slug is unique only
+ * WITHIN an org, so an org-less reference resolves globally and the first
+ * match wins: for an org-scoped kind that crosses tenant boundaries, and
+ * for an owner-only kind (the execution context) it let a caller name a
+ * slug and receive whichever organization's row matched first. Every kind
+ * with a reference lane is served per organization, so the rule is the
+ * same for all of them. The message matches the cloud edition verbatim
+ * (cross-edition error contract); the kind name comes from kind_meta.
  *
  * Belongs at the getByReference boundary only — the low-level slug finders
  * are legitimately called with a relative (possibly empty) org by internal
@@ -79,21 +82,14 @@ export function requireOrgForReference(kind, org) {
     if (org !== "") {
         return;
     }
-    let scopeType;
     let kindName;
     try {
-        const meta = getKindMeta(kind);
-        scopeType = meta.authorization?.scopeType;
-        kindName = meta.name;
+        kindName = getKindMeta(kind).name;
     }
     catch (error) {
         throw internalError(error, "failed to resolve kind metadata for reference org check");
     }
-    // protobuf-es strips the shared enum prefix: proto
-    // AUTHORIZATION_SCOPE_TYPE_ORGANIZATION generates as ORGANIZATION.
-    if (scopeType === AuthorizationScopeType.ORGANIZATION) {
-        throw invalidArgumentError(`org is required for ${kindName} lookup`);
-    }
+    throw invalidArgumentError(`org is required for ${kindName} lookup`);
 }
 // The two list-step helpers below are duplicated per package in Go (each
 // controller carries its own copy); the TS tree consolidates them here

package/dist/pipeline/steps/helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../../src/pipeline/steps/helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAKhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wFAAwF,CAAC;AAGhI,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAY,EACZ,IAAqB,EACrB,MAAY,EACZ,IAAY,EACZ,GAAW;IAEX,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACH,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,kCAAkC;QAC9C,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrD,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,EAAE,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACvC,SAAS;QACX,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAY,EACZ,IAAqB,EACrB,MAAY,EACZ,QAAgB,EAChB,UAAkB,EAClB,GAAW;IAEX,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACH,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,UAAU,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACrE,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAqB,EACrB,GAAW;IAEX,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IACD,IAAI,SAA6C,CAAC;IAClD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC;QAC1C,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CACjB,KAAK,EACL,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,mDAAmD;IACnD,mEAAmE;IACnE,IAAI,SAAS,KAAK,sBAAsB,CAAC,YAAY,EAAE,CAAC;QACtD,MAAM,oBAAoB,CAAC,uBAAuB,QAAQ,SAAS,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,YAAY;AAEZ,qEAAqE;AACrE,MAAM,UAAU,oBAAoB,CAClC,CAAwB,EACxB,CAAwB;IAExB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAC9B,cAAsC,EACtC,YAAoC;IAEpC,OAAO,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,KAAK,CACvC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,KAAK,CAChD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../../src/pipeline/steps/helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAOhD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAY,EACZ,IAAqB,EACrB,MAAY,EACZ,IAAY,EACZ,GAAW;IAEX,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACH,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,kCAAkC;QAC9C,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACrD,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,EAAE,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACvC,SAAS;QACX,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAY,EACZ,IAAqB,EACrB,MAAY,EACZ,QAAgB,EAChB,UAAkB,EAClB,GAAW;IAEX,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACH,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,UAAU,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACrE,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAqB,EACrB,GAAW;IAEX,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IACD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CACjB,KAAK,EACL,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,oBAAoB,CAAC,uBAAuB,QAAQ,SAAS,CAAC,CAAC;AACvE,CAAC;AAED,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,YAAY;AAEZ,qEAAqE;AACrE,MAAM,UAAU,oBAAoB,CAClC,CAAwB,EACxB,CAAwB;IAExB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAC9B,cAAsC,EACtC,YAAoC;IAEpC,OAAO,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,KAAK,CACvC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,KAAK,CAChD,CAAC;AACJ,CAAC"}

package/dist/pipeline/steps/references.d.ts

@@ -1,38 +1,196 @@
 /**
- * NormalizeReferences + ValidateReferences — port
- * steps/normalize_references.go and steps/validate_references.go, sharing
- * one spec walker (as the Go files share theirs).
+ * References — the two shared steps every chain that stores a spec with
+ * `ApiResourceReference` fields runs, and the ONE rule that decides whether
+ * a reference may be written.
  *
  * NormalizeReferences fills EMPTY org fields in ApiResourceReference
  * messages inside the spec from the resource's own metadata.org, so stored
- * references are absolute; explicit orgs (cross-org refs) are preserved.
- * Only the spec is walked — status is system-generated and already
- * absolute. Runs after BuildNewState/BuildUpdateState, before Persist.
- *
- * ValidateReferences verifies spec references point at existing resources
- * — strict FAILED_PRECONDITION for missing MCP servers (an agent whose MCP
- * server is missing cannot execute its declared tools). Runs AFTER
- * NormalizeReferences so orgs are resolved.
+ * references are absolute; an explicit org is preserved. Only the spec is
+ * walked — status is system-generated and already absolute. Runs after
+ * BuildNewState/BuildUpdateState, before Persist.
+ *
+ * ValidateReferences runs directly after it and asks `checkReference` for
+ * every reference the walk finds. The rule has three clauses, in the
+ * order they are asked:
+ *
+ *   (i)  A reference with no organization is refused. After the normalize
+ *        step the only way an org is still empty is a resource that has
+ *        none itself; a slug looked up with no org matches any
+ *        organization's row (helpers.ts), which is the cross-tenant read
+ *        the reference lane's `requireOrgForReference` exists to forbid.
+ *   (ii) Same organization as the resource: the target must exist, and,
+ *        when the target's kind is one the RUN reads as the person
+ *        (`readByRun` in the table below), its visibility must be at least
+ *        the resource's on the order private < org < platform — the FLOOR.
+ *        What a person can run they must also be able to read: an
+ *        org-visible agent over a private MCP server would run for every
+ *        member and be readable by one. Environments, OAuth apps and
+ *        channel apps are resolved by the server on the run's behalf and
+ *        never read by the person, so their level is not a leak the floor
+ *        closes, and an org-visible instance may hold a private personal
+ *        environment as it always has.
+ *   (iii) Another organization: the target must exist AND be
+ *        platform-visible, answered with ONE sentence that does not say
+ *        which failed. The caller has no standing to learn what another
+ *        organization holds (the anti-probe posture the AgentShare lane set
+ *        first). The rule reads the target's LEVEL, not tenancy: whether
+ *        the writer's organization is one the target's identity provider
+ *        links is the run-time authorizer's question, asked when the run
+ *        reads the target, and the copy here claims no more than the rule
+ *        checks. No Environment, OAuth app or channel app is ever
+ *        platform-visible, so every cross-organization reference to one is
+ *        refused here.
+ *
+ * The kind a reference names is the kind its FIELD declares
+ * (`reference_kind`, the contract's word for what the field points to),
+ * never the `kind` value a client happened to put on the message: the
+ * runtime resolves `skill_refs` as skills whatever the message says, and
+ * the rule must agree with the runtime. A reference with an empty slug is
+ * unset and skipped (the field-level CEL rules own "required").
+ *
+ * The floor has a second door. Raising a resource's level through
+ * updateVisibility could open the same gap a create cannot, so
+ * GuardReferenceFloorOnEscalation runs on the two chains whose rows carry
+ * run-read references (agent, workflow) after ValidateVisibilityUpdate:
+ * when the requested level is above the stored one, every run-read
+ * reference the STORED row carries must be at least the requested level,
+ * judged by the same function over the same collectors, else the
+ * escalation is refused naming the dependencies. Only the floor is asked at
+ * that door — a dependency that has since left or stopped being shared was
+ * judged when the row was written and is the run's to refuse.
+ *
+ * REFERENCE_TARGET_KINDS is the one explicit table of kinds a spec may
+ * reference, with each kind's schema and its `readByRun` flag: the
+ * composition-root idiom (query/search/registry.ts) — an explicit list a
+ * test pins against the protos, so a new `reference_kind` in the contract
+ * fails the pin until this table says how it is read.
+ *
+ * Cost: one `listResources` scan per referenced KIND per write (not per
+ * reference), decoded once into a (org, slug) index; the same scan every
+ * runtime path already pays per reference when it resolves the target at
+ * run start. A store read by (kind, org, slug) is the follow-on that
+ * removes the scan everywhere, and is not this module's.
+ *
+ * The refusal copy is exported below. The MCP-server sentence predates the
+ * rule and is wire contract (byte-pinned by pipeline/__tests__/steps.test.ts
+ * and the agent conformance suite); its siblings for the other kinds take
+ * the same shape. `collectSpecReferences` is the walk exported for the
+ * readers that ask the reverse question ("who references this?").
  */
-import type { DescMessage } from "@bufbuild/protobuf";
+import type { DescMessage, Message } from "@bufbuild/protobuf";
 import { reflect } from "@bufbuild/protobuf/reflect";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import type { UpdateVisibilityInputSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
 import type { Store } from "../../store/interface.js";
+import { failedPreconditionError } from "../errors.js";
 import type { PipelineStep } from "../pipeline.js";
-export declare function newNormalizeReferencesStep<Desc extends DescMessage>(): PipelineStep<Desc>;
-export declare function newValidateReferencesStep<Desc extends DescMessage>(store: Store): PipelineStep<Desc>;
-/** One reference a spec carries, as the walker reads it. */
+/** One kind a spec may reference, and how the rule reads it (the module header). */
+export interface ReferenceTargetKind {
+    readonly kind: ApiResourceKind;
+    readonly schema: DescMessage;
+    /** Whether the run reads the target AS THE PERSON — the kinds the floor applies to. */
+    readonly readByRun: boolean;
+    /** The kind in the refusal copy's words, singular with the plural marker: "MCP server(s)". */
+    readonly label: string;
+    /** The CLI command a refusal points at, or undefined where the CLI has no verb for the kind. */
+    readonly listHint: string | undefined;
+}
+export declare const REFERENCE_TARGET_KINDS: ReadonlyArray<ReferenceTargetKind>;
+export declare function referenceTargetKind(kind: ApiResourceKind): ReferenceTargetKind | undefined;
+/** One reference a spec carries, as the walker reads it; `kind` is the field's declared kind. */
 export interface SpecReference {
     readonly kind: ApiResourceKind;
     readonly slug: string;
     readonly org: string;
 }
+/** The resource the references belong to, as the rule needs it. */
+export interface ReferenceParent {
+    readonly org: string;
+    readonly visibility: ApiResourceVisibility;
+}
+/** What the rule found for one reference; the collectors turn it into copy. */
+export type ReferenceVerdict = {
+    readonly kind: "ok";
+}
+/** Clause (i): the reference names no organization. */
+ | {
+    readonly kind: "no-org";
+}
+/** Clause (ii): the same-organization target does not exist. */
+ | {
+    readonly kind: "missing";
+}
+/** Clause (ii): the target exists and is less visible than the resource. */
+ | {
+    readonly kind: "below-floor";
+    readonly targetVisibility: ApiResourceVisibility;
+}
+/** Clause (iii): the other-organization target is missing or not platform-visible — one answer. */
+ | {
+    readonly kind: "not-available";
+};
+/** The visibility of every referenced row the rule may need, one scan per kind (the module header). */
+export interface ReferenceTargets {
+    visibilityOf(ref: SpecReference): ApiResourceVisibility | undefined;
+}
+/**
+ * Loads the rows the given references could name: one `listResources` per
+ * distinct kind, decoded once, indexed by (org, slug). A row that does not
+ * decode is skipped as the slug helpers skip it — it is not a row a
+ * reference can reach. A reference whose kind is not in the table is a
+ * contract the pin test has not admitted yet and is an internal fault.
+ */
+export declare function loadReferenceTargets(store: Store, refs: ReadonlyArray<SpecReference>): Promise<ReferenceTargets>;
+/** The three clauses of the module header, for one reference. */
+export declare function checkReference(targets: ReferenceTargets, parent: ReferenceParent, ref: SpecReference): ReferenceVerdict;
+/** Clause (i)'s sentence. */
+export declare function noOrgReferenceMessage(entry: ReferenceTargetKind, slug: string): string;
+/**
+ * Clause (ii)'s sentence for the targets not found, one per kind. The MCP
+ * server form is the wire contract that predates the rule; the others are
+ * its siblings.
+ */
+export declare function missingReferencesMessage(entry: ReferenceTargetKind, handles: ReadonlyArray<{
+    readonly slug: string;
+    readonly org: string;
+}>): string;
+/** Clause (ii)'s floor sentence: the dependency and its level, against the resource's. */
+export declare function belowFloorMessage(entry: ReferenceTargetKind, ref: SpecReference, targetVisibility: ApiResourceVisibility, parentVisibility: ApiResourceVisibility): string;
+/** Clause (iii)'s one sentence — the same whether the target is missing or not platform-visible. */
+export declare function notAvailableReferenceMessage(entry: ReferenceTargetKind, ref: SpecReference): string;
+/**
+ * The refusal for a set of verdicts, or undefined when every one is ok.
+ * Missing same-organization targets are grouped per kind into one sentence
+ * (the contract's shape); every other refusal is its own sentence; the
+ * sentences are joined in the order the references were read. A no-org
+ * reference is malformed input (INVALID_ARGUMENT); everything else is a
+ * precondition the store does not meet (FAILED_PRECONDITION), the code the
+ * MCP-server contract already answers.
+ */
+export declare function referenceRefusal(parent: ReferenceParent, verdicts: ReadonlyArray<{
+    readonly ref: SpecReference;
+    readonly verdict: ReferenceVerdict;
+}>): ReturnType<typeof failedPreconditionError> | undefined;
+export declare function newNormalizeReferencesStep<Desc extends DescMessage>(): PipelineStep<Desc>;
+export declare function newValidateReferencesStep<Desc extends DescMessage>(store: Store): PipelineStep<Desc>;
+/** The rule over a collected list: load once, check each, render the refusal. */
+export declare function checkReferences(store: Store, parent: ReferenceParent, refs: ReadonlyArray<SpecReference>): Promise<ReturnType<typeof referenceRefusal>>;
+/** The references a stored row carries, for the escalation door; a chain passes one collector per place its row keeps them. */
+export type ReferenceCollector = (row: Message) => ReadonlyArray<SpecReference>;
+/**
+ * The floor's second door (the module header): on an updateVisibility chain,
+ * after the loaded row is on the context under `targetKey` and after
+ * ValidateVisibilityUpdate, refuses raising the level while a run-read
+ * reference the row carries would end below it.
+ */
+export declare function newGuardReferenceFloorOnEscalationStep(store: Store, targetKey: string, collectors: ReadonlyArray<ReferenceCollector>): PipelineStep<typeof UpdateVisibilityInputSchema>;
 /**
- * Every ApiResourceReference in a resource's spec — the same walk
- * ValidateReferences runs, exported for the readers that ask the reverse
- * question ("who references this?"): the plugin delete guard scans an
- * organization's agents and workflows for references to a member it is
- * about to remove.
+ * Every ApiResourceReference in a resource's spec, each with the kind its
+ * field declares — the walk both steps run, exported for the readers that
+ * ask the reverse question ("who references this?"): the plugin delete
+ * guard scans an organization's agents and workflows for references to a
+ * member it is about to remove.
  */
 export declare function collectSpecReferences(schema: DescMessage, msg: Parameters<typeof reflect>[1]): SpecReference[];
 //# sourceMappingURL=references.d.ts.map

package/dist/pipeline/steps/references.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"references.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/references.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAIrD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAQnD,wBAAgB,0BAA0B,CACxC,IAAI,SAAS,WAAW,KACrB,YAAY,CAAC,IAAI,CAAC,CAwBtB;AAED,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,KAAK,EAAE,KAAK,GACX,YAAY,CAAC,IAAI,CAAC,CA0CpB;AAED,4DAA4D;AAC5D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,GACjC,aAAa,EAAE,CAUjB"}
+{"version":3,"file":"references.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/references.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AACH,OAAO,KAAK,EAAa,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE1E,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAQrD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAE/F,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AAGxG,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EACL,uBAAuB,EAGxB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAWnD,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gGAAgG;IAChG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAED,eAAO,MAAM,sBAAsB,EAAE,aAAa,CAAC,mBAAmB,CA2CrE,CAAC;AAEF,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,GACpB,mBAAmB,GAAG,SAAS,CAEjC;AAMD,iGAAiG;AACjG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;CAC5C;AAED,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE;AACzB,uDAAuD;GACrD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE;AAC7B,gEAAgE;GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE;AAC9B,4EAA4E;GAC1E;IACE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,qBAAqB,CAAC;CAClD;AACH,mGAAmG;GACjG;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC;AAEvC,uGAAuG;AACvG,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CAAC,GAAG,EAAE,aAAa,GAAG,qBAAqB,GAAG,SAAS,CAAC;CACrE;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,aAAa,CAAC,aAAa,CAAC,GACjC,OAAO,CAAC,gBAAgB,CAAC,CAgC3B;AAMD,iEAAiE;AACjE,wBAAgB,cAAc,CAC5B,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,eAAe,EACvB,GAAG,EAAE,aAAa,GACjB,gBAAgB,CAqBlB;AA+BD,6BAA6B;AAC7B,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,MAAM,GACX,MAAM,CAER;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,GACtE,MAAM,CAOR;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,mBAAmB,EAC1B,GAAG,EAAE,aAAa,EAClB,gBAAgB,EAAE,qBAAqB,EACvC,gBAAgB,EAAE,qBAAqB,GACtC,MAAM,CAER;AASD,oGAAoG;AACpG,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,mBAAmB,EAC1B,GAAG,EAAE,aAAa,GACjB,MAAM,CAER;AAWD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,aAAa,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;CACpC,CAAC,GACD,UAAU,CAAC,OAAO,uBAAuB,CAAC,GAAG,SAAS,CA6DxD;AAMD,wBAAgB,0BAA0B,CACxC,IAAI,SAAS,WAAW,KACrB,YAAY,CAAC,IAAI,CAAC,CAwBtB;AAED,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,KAAK,EAAE,KAAK,GACX,YAAY,CAAC,IAAI,CAAC,CA2BpB;AAED,iFAAiF;AACjF,wBAAsB,eAAe,CACnC,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,aAAa,CAAC,aAAa,CAAC,GACjC,OAAO,CAAC,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAM9C;AAED,+HAA+H;AAC/H,MAAM,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,aAAa,CAAC,aAAa,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,wBAAgB,sCAAsC,CACpD,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,aAAa,CAAC,kBAAkB,CAAC,GAC5C,YAAY,CAAC,OAAO,2BAA2B,CAAC,CAqDlD;AAMD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,GACjC,aAAa,EAAE,CAUjB"}