@stigmer/server 3.22.1-dev.20260922095755 → 3.23.0

package/src/domain/mcpserver/__tests__/mcpserver.test.ts

@@ -41,11 +41,7 @@ import { composeServer } from "../../../boot/compose.js";
 import type { ComposedServer } from "../../../boot/compose.js";
 import { createLogger } from "../../../boot/logger.js";
 
-const silentLogger = createLogger({
-  level: "error",
-  pretty: false,
-  write: () => {},
-});
+const silentLogger = createLogger({ level: "error", pretty: false, write: () => {} });
 
 const API_VERSION = "agentic.stigmer.ai/v1";
 const KIND = "McpServer";
@@ -132,11 +128,7 @@ function serverInput(overrides?: {
   };
 }
 
-async function expectCode(
-  promise: Promise<unknown>,
-  code: Code,
-  arm: string,
-): Promise<ConnectError> {
+async function expectCode(promise: Promise<unknown>, code: Code, arm: string): Promise<ConnectError> {
   try {
     await promise;
   } catch (error) {
@@ -165,10 +157,7 @@ async function seedCapabilities(
     serverId,
     McpServerSchema,
   );
-  const patched = fromBinary(
-    McpServerSchema,
-    toBinary(McpServerSchema, stored),
-  );
+  const patched = fromBinary(McpServerSchema, toBinary(McpServerSchema, stored));
   patched.status ??= create(McpServerStatusSchema, {});
   patched.status.discoveredCapabilities = create(DiscoveredCapabilitiesSchema, {
     tools: tools.map((name) => ({ name })),
@@ -187,19 +176,13 @@ describe("CRUD", () => {
     const created = await command.create(serverInput({ name: "GitHub Tools" }));
     expect(created.metadata?.id).toMatch(/^mcp_[0-9a-z]{26}$/);
     expect(created.metadata?.slug).toBe("github-tools");
-    expect(created.metadata?.visibility).toBe(
-      ApiResourceVisibility.visibility_org,
-    );
+    expect(created.metadata?.visibility).toBe(ApiResourceVisibility.visibility_org);
   });
 
   it("rejects a duplicate create by slug within the org; a different org reuses the slug", async () => {
     const name = `Dup Target ${++counter}`;
     await command.create(serverInput({ name }));
-    await expectCode(
-      command.create(serverInput({ name })),
-      Code.AlreadyExists,
-      "duplicate create",
-    );
+    await expectCode(command.create(serverInput({ name })), Code.AlreadyExists, "duplicate create");
     const other = await command.create(serverInput({ name, org: "other-org" }));
     expect(other.metadata?.org).toBe("other-org");
   });
@@ -218,17 +201,10 @@ describe("CRUD", () => {
   it("get and getByReference resolve the same resource; unknowns answer NotFound", async () => {
     const created = await command.create(serverInput());
     const byId = await query.get({ value: created.metadata!.id });
-    const byRef = await query.getByReference({
-      org: ORG,
-      slug: created.metadata!.slug,
-    });
+    const byRef = await query.getByReference({ org: ORG, slug: created.metadata!.slug });
     expect(byId.metadata?.id).toBe(created.metadata?.id);
     expect(byRef.metadata?.id).toBe(created.metadata?.id);
-    await expectCode(
-      query.get({ value: "mcps_missing" }),
-      Code.NotFound,
-      "get unknown",
-    );
+    await expectCode(query.get({ value: "mcps_missing" }), Code.NotFound, "get unknown");
     await expectCode(
       query.getByReference({ org: ORG, slug: "never-created" }),
       Code.NotFound,
@@ -240,11 +216,7 @@ describe("CRUD", () => {
     const created = await command.create(serverInput());
     const deleted = await command.delete({ resourceId: created.metadata!.id });
     expect(deleted.metadata?.id).toBe(created.metadata?.id);
-    await expectCode(
-      query.get({ value: created.metadata!.id }),
-      Code.NotFound,
-      "get after delete",
-    );
+    await expectCode(query.get({ value: created.metadata!.id }), Code.NotFound, "get after delete");
   });
 
   it("update of a non-existent server and delete of a non-existent server answer NotFound; delete with an empty id is InvalidArgument", async () => {
@@ -261,11 +233,7 @@ describe("CRUD", () => {
       Code.NotFound,
       "delete non-existent",
     );
-    await expectCode(
-      command.delete({}),
-      Code.InvalidArgument,
-      "delete empty id",
-    );
+    await expectCode(command.delete({}), Code.InvalidArgument, "delete empty id");
   });
 });
 
@@ -276,17 +244,13 @@ describe("updateVisibility (no conformance coverage for this domain — the D4-d
       resourceId: created.metadata!.id,
       visibility: ApiResourceVisibility.visibility_private,
     });
-    expect(updated.metadata?.visibility).toBe(
-      ApiResourceVisibility.visibility_private,
-    );
+    expect(updated.metadata?.visibility).toBe(ApiResourceVisibility.visibility_private);
     expect(updated.spec?.description).toBe(created.spec?.description);
     // A visibility change is a STATUS mutation: status_audit re-stamped
     // (updated event, fresh timestamp bounds are creation-or-later),
     // spec_audit byte-untouched.
     expect(updated.status?.audit?.statusAudit?.event).toBe("updated");
-    expect(updated.status?.audit?.specAudit).toEqual(
-      created.status?.audit?.specAudit,
-    );
+    expect(updated.status?.audit?.specAudit).toEqual(created.status?.audit?.specAudit);
   });
 
   it("answers NotFound for an unknown id", async () => {
@@ -332,9 +296,7 @@ describe("ValidateDefaultEnabledTools (#402)", () => {
   it("accepts names the server exposes; skips when the list is empty or the server never connected", async () => {
     // Never connected: any names pass (no authoritative toolset yet).
     const fresh = await command.create(serverInput());
-    const freshUpdate = await command.update(
-      updateInput(fresh, ["anything-goes"]),
-    );
+    const freshUpdate = await command.update(updateInput(fresh, ["anything-goes"]));
     expect(freshUpdate.spec?.defaultEnabledTools).toEqual(["anything-goes"]);
 
     // Connected: valid names pass.
@@ -346,11 +308,7 @@ describe("ValidateDefaultEnabledTools (#402)", () => {
 
   it("rejects unknown tools and resource templates with the byte-pinned teaching copy", async () => {
     const created = await command.create(serverInput());
-    await seedCapabilities(
-      created.metadata!.id,
-      ["search", "fetch"],
-      ["files"],
-    );
+    await seedCapabilities(created.metadata!.id, ["search", "fetch"], ["files"]);
 
     const err = await expectCode(
       command.update(updateInput(created, ["serch", "files"])),
@@ -376,10 +334,7 @@ describe("EnrichOAuthStatus (#523) — response-only oauth_status", () => {
       OAuthAppSchema,
       create(OAuthAppSchema, {
         metadata: { id, org: ORG, slug, name: slug },
-        spec: {
-          vendorApprovalStatus: approval,
-          vendorApprovalDocsUrl: docsUrl,
-        },
+        spec: { vendorApprovalStatus: approval, vendorApprovalDocsUrl: docsUrl },
       }),
     );
   }
@@ -391,25 +346,14 @@ describe("EnrichOAuthStatus (#523) — response-only oauth_status", () => {
   });
 
   it("a missing OAuthApp skips enrichment (the initiate path owns refusing)", async () => {
-    // The app must exist when the server is written (the reference rule);
-    // a reference dangles when its target leaves afterwards.
-    await seedOAuthApp("never-applied", VendorApprovalStatus.UNSPECIFIED, "");
-    const created = await command.create(
-      serverInput({ oauthAppSlug: "never-applied" }),
-    );
-    await server.store.deleteResource(
-      ApiResourceKind.oauth_app,
-      "oaa_neverapplied",
-    );
+    const created = await command.create(serverInput({ oauthAppSlug: "never-applied" }));
     const got = await query.get({ value: created.metadata!.id });
     expect(got.status?.oauthStatus).toBeUndefined();
   });
 
   it("nothing-to-report means ABSENT — presence itself is the SDK's signal", async () => {
     await seedOAuthApp("plain-app", VendorApprovalStatus.UNSPECIFIED, "");
-    const created = await command.create(
-      serverInput({ oauthAppSlug: "plain-app" }),
-    );
+    const created = await command.create(serverInput({ oauthAppSlug: "plain-app" }));
     const got = await query.get({ value: created.metadata!.id });
     expect(got.status?.oauthStatus).toBeUndefined();
   });
@@ -419,42 +363,24 @@ describe("EnrichOAuthStatus (#523) — response-only oauth_status", () => {
   // alone must enrich (Go enrich_oauth_status_test.go's docs-only and
   // status-only arms — the executable spec of the #523 shared contract).
   it("a docs URL ALONE enriches, even with an UNSPECIFIED approval status", async () => {
-    await seedOAuthApp(
-      "docs-only-app",
-      VendorApprovalStatus.UNSPECIFIED,
-      "https://vendor.example/setup",
-    );
-    const created = await command.create(
-      serverInput({ oauthAppSlug: "docs-only-app" }),
-    );
+    await seedOAuthApp("docs-only-app", VendorApprovalStatus.UNSPECIFIED, "https://vendor.example/setup");
+    const created = await command.create(serverInput({ oauthAppSlug: "docs-only-app" }));
     const got = await query.get({ value: created.metadata!.id });
-    expect(got.status?.oauthStatus?.vendorApprovalStatus).toBe(
-      VendorApprovalStatus.UNSPECIFIED,
-    );
-    expect(got.status?.oauthStatus?.vendorApprovalDocsUrl).toBe(
-      "https://vendor.example/setup",
-    );
+    expect(got.status?.oauthStatus?.vendorApprovalStatus).toBe(VendorApprovalStatus.UNSPECIFIED);
+    expect(got.status?.oauthStatus?.vendorApprovalDocsUrl).toBe("https://vendor.example/setup");
   });
 
   it("a non-default approval status ALONE enriches — REJECTED and even APPROVED are reported", async () => {
     await seedOAuthApp("rejected-app", VendorApprovalStatus.REJECTED, "");
-    const rejected = await command.create(
-      serverInput({ oauthAppSlug: "rejected-app" }),
-    );
+    const rejected = await command.create(serverInput({ oauthAppSlug: "rejected-app" }));
     const gotRejected = await query.get({ value: rejected.metadata!.id });
-    expect(gotRejected.status?.oauthStatus?.vendorApprovalStatus).toBe(
-      VendorApprovalStatus.REJECTED,
-    );
+    expect(gotRejected.status?.oauthStatus?.vendorApprovalStatus).toBe(VendorApprovalStatus.REJECTED);
     expect(gotRejected.status?.oauthStatus?.vendorApprovalDocsUrl).toBe("");
 
     await seedOAuthApp("approved-app", VendorApprovalStatus.APPROVED, "");
-    const approved = await command.create(
-      serverInput({ oauthAppSlug: "approved-app" }),
-    );
+    const approved = await command.create(serverInput({ oauthAppSlug: "approved-app" }));
     const gotApproved = await query.get({ value: approved.metadata!.id });
-    expect(gotApproved.status?.oauthStatus?.vendorApprovalStatus).toBe(
-      VendorApprovalStatus.APPROVED,
-    );
+    expect(gotApproved.status?.oauthStatus?.vendorApprovalStatus).toBe(VendorApprovalStatus.APPROVED);
   });
 
   it("an auth block WITHOUT an oauth_app_ref (the DCR arm) is untouched", async () => {
@@ -465,14 +391,8 @@ describe("EnrichOAuthStatus (#523) — response-only oauth_status", () => {
   });
 
   it("a gating approval status or docs URL enriches BOTH read paths, response-only", async () => {
-    await seedOAuthApp(
-      "gated-app",
-      VendorApprovalStatus.PENDING,
-      "https://vendor.example/approval",
-    );
-    const created = await command.create(
-      serverInput({ oauthAppSlug: "gated-app" }),
-    );
+    await seedOAuthApp("gated-app", VendorApprovalStatus.PENDING, "https://vendor.example/approval");
+    const created = await command.create(serverInput({ oauthAppSlug: "gated-app" }));
 
     for (const loaded of [
       await query.get({ value: created.metadata!.id }),
@@ -510,12 +430,7 @@ describe("org-OAuth-app surface — UNIMPLEMENTED by design (#558, DD-019)", ()
     expect(getErr.rawMessage).toBe("method GetOrgOAuthApp not implemented");
 
     const setErr = await expectCode(
-      command.setOrgOAuthApp({
-        resourceId: "mcps_test",
-        org: ORG,
-        clientId: "x",
-        clientSecret: "y",
-      }),
+      command.setOrgOAuthApp({ resourceId: "mcps_test", org: ORG, clientId: "x", clientSecret: "y" }),
       Code.Unimplemented,
       "setOrgOAuthApp",
     );
@@ -526,8 +441,6 @@ describe("org-OAuth-app surface — UNIMPLEMENTED by design (#558, DD-019)", ()
       Code.Unimplemented,
       "deleteOrgOAuthApp",
     );
-    expect(deleteErr.rawMessage).toBe(
-      "method DeleteOrgOAuthApp not implemented",
-    );
+    expect(deleteErr.rawMessage).toBe("method DeleteOrgOAuthApp not implemented");
   });
 });

package/src/domain/mcpserver/__tests__/oauth-handshake.test.ts

@@ -41,11 +41,7 @@ import { composeServer } from "../../../boot/compose.js";
 import type { ComposedServer } from "../../../boot/compose.js";
 import { createLogger } from "../../../boot/logger.js";
 
-const silentLogger = createLogger({
-  level: "error",
-  pretty: false,
-  write: () => {},
-});
+const silentLogger = createLogger({ level: "error", pretty: false, write: () => {} });
 
 const REDIRECT_URI = "http://127.0.0.1:8234/auth/oauth/callback";
 const ORG = "acme";
@@ -372,30 +368,20 @@ describe("initiateOAuthConnect", () => {
       "OAuth sign-in is unavailable: the platform's OAuth app for 'exampleco' is pending approval by the vendor. This server only accepts OAuth sign-in; an org admin can configure your own OAuth app instead.",
     ],
   ];
-  it.each(refusals)(
-    "vendor arm refuses %s",
-    async (_label, status, oauthOnly, copy) => {
-      const slug = `vendor-${status}-${oauthOnly ? "only" : "manual"}`;
-      await seedOAuthApp(slug, status);
-      const id = await applyServer({ vendorSlug: slug, oauthOnly });
-      const error = await expectCode(
-        command.initiateOAuthConnect({ mcpServerId: id, org: ORG }),
-        Code.FailedPrecondition,
-        copy,
-      );
-      expect(error.rawMessage).toBe(copy);
-    },
-  );
+  it.each(refusals)("vendor arm refuses %s", async (_label, status, oauthOnly, copy) => {
+    const slug = `vendor-${status}-${oauthOnly ? "only" : "manual"}`;
+    await seedOAuthApp(slug, status);
+    const id = await applyServer({ vendorSlug: slug, oauthOnly });
+    const error = await expectCode(
+      command.initiateOAuthConnect({ mcpServerId: id, org: ORG }),
+      Code.FailedPrecondition,
+      copy,
+    );
+    expect(error.rawMessage).toBe(copy);
+  });
 
   it("vendor arm answers NotFound for an unresolvable oauth_app_ref", async () => {
-    // The app must exist when the server is written (the reference rule);
-    // the reference becomes unresolvable when its target leaves afterwards.
-    await seedOAuthApp("no-such-app", VendorApprovalStatus.APPROVED);
     const id = await applyServer({ vendorSlug: "no-such-app" });
-    await server.store.deleteResource(
-      ApiResourceKind.oauth_app,
-      "oap_no-such-app",
-    );
     await expectCode(
       command.initiateOAuthConnect({ mcpServerId: id, org: ORG }),
       Code.NotFound,
@@ -420,29 +406,17 @@ describe("initiateOAuthConnect", () => {
 describe("completeOAuthConnect → grant → disconnect (the full lifecycle)", () => {
   it("guards its inputs (proto rules answer first, exactly as on Go)", async () => {
     await expectCode(
-      command.completeOAuthConnect({
-        mcpServerId: "",
-        state: "s",
-        authorizationCode: "c",
-      }),
+      command.completeOAuthConnect({ mcpServerId: "", state: "s", authorizationCode: "c" }),
       Code.InvalidArgument,
       "mcp_server_id: value is required [required]",
     );
     await expectCode(
-      command.completeOAuthConnect({
-        mcpServerId: "m",
-        state: "",
-        authorizationCode: "c",
-      }),
+      command.completeOAuthConnect({ mcpServerId: "m", state: "", authorizationCode: "c" }),
       Code.InvalidArgument,
       "state:",
     );
     await expectCode(
-      command.completeOAuthConnect({
-        mcpServerId: "m",
-        state: "s",
-        authorizationCode: "",
-      }),
+      command.completeOAuthConnect({ mcpServerId: "m", state: "s", authorizationCode: "" }),
       Code.InvalidArgument,
       "authorization_code:",
     );
@@ -526,10 +500,7 @@ describe("completeOAuthConnect → grant → disconnect (the full lifecycle)", (
 
     // The grant is queryable and HEALTHY; the refresh-token env var is
     // stamped unconditionally (oss#863's precondition, ported as-is).
-    const status = await query.getOAuthGrantStatus({
-      resourceId: id,
-      org: ORG,
-    });
+    const status = await query.getOAuthGrantStatus({ resourceId: id, org: ORG });
     expect(status.connected).toBe(true);
     expect(status.targetEnvVar).toBe("EXAMPLE_TOKEN");
     expect(status.authMethod).toBe("mcp_oauth");
@@ -543,10 +514,7 @@ describe("completeOAuthConnect → grant → disconnect (the full lifecycle)", (
     expect(firstEnvId).not.toBe("");
 
     // Re-connect reuses the managed environment.
-    const again = await command.initiateOAuthConnect({
-      mcpServerId: id,
-      org: ORG,
-    });
+    const again = await command.initiateOAuthConnect({ mcpServerId: id, org: ORG });
     await command.completeOAuthConnect({
       mcpServerId: id,
       state: again.state,
@@ -557,10 +525,7 @@ describe("completeOAuthConnect → grant → disconnect (the full lifecycle)", (
 
     // Disconnect tears down grant + environment; a second disconnect is
     // the idempotent no-grant arm.
-    const disconnected = await command.disconnectOAuth({
-      resourceId: id,
-      org: ORG,
-    });
+    const disconnected = await command.disconnectOAuth({ resourceId: id, org: ORG });
     expect(disconnected.disconnected).toBe(true);
     expect(await server.store.oauthGrants.find("", id, ORG)).toBeUndefined();
     const againDisconnected = await command.disconnectOAuth({

package/src/domain/mcpserver/controller.ts

@@ -58,6 +58,10 @@ import {
   newAuthorizeResolvedTargetStep,
 } from "../../pipeline/steps/authorize-resolved-target.js";
 import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
+import {
+  newAuthorizeVisibilityTransitionStep,
+  newGuardPublicVisibilityStep,
+} from "../../pipeline/steps/visibility-gates.js";
 import {
   setAuditFieldsForUpdate,
   newBuildNewStateStep,
@@ -88,10 +92,7 @@ import {
   TARGET_RESOURCE_KEY,
   newLoadTargetStep,
 } from "../../pipeline/steps/load-target.js";
-import {
-  newNormalizeReferencesStep,
-  newValidateReferencesStep,
-} from "../../pipeline/steps/references.js";
+import { newNormalizeReferencesStep } from "../../pipeline/steps/references.js";
 import {
   newCleanupIamPoliciesStep,
   newCreateAuthorizationTuplesStep,
@@ -240,13 +241,13 @@ async function createMcpServer(
     .addStep(newResolveSlugStep())
     .addStep(newCheckDuplicateStep(deps.store))
     .addStep(newBuildNewStateStep())
+    .addStep(newGuardPublicVisibilityStep(deps.authorizer))
     // A URL-only server is asked once whether it wants OAuth and completed
     // when it does; immediately before GuardReservedLabels because the
     // provenance label it stamps is one the guard diffs.
     .addStep(newCompleteEndpointAuthStep(endpointAuthDeps(deps)))
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newNormalizeReferencesStep())
-    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newPersistStep(deps.store))
     .addStep(
       newCreateAuthorizationTuplesStep(
@@ -299,7 +300,6 @@ async function update(
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newValidateDefaultEnabledToolsStep())
     .addStep(newNormalizeReferencesStep())
-    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newPersistStep(deps.store))
     .addStep(
       newIndexSearchStep(deps.store, mcpServerSearchExtractor, deps.logger),
@@ -463,6 +463,12 @@ async function updateVisibility(
       newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_MCP_SERVER_KEY),
     )
     .addStep(newValidateVisibilityUpdateStep())
+    .addStep(
+      newAuthorizeVisibilityTransitionStep(
+        UPDATE_VISIBILITY_MCP_SERVER_KEY,
+        deps.authorizer,
+      ),
+    )
     .addStep(newSetMcpServerVisibilityStep())
     .addStep(newPersistMcpServerForVisibilityUpdateStep(deps.store))
     .addStep(

package/src/domain/plugin/controller.ts

@@ -103,10 +103,13 @@ import {
   newAuthorizeResolvedTargetStep,
 } from "../../pipeline/steps/authorize-resolved-target.js";
 import type { VersionHistoryBinding } from "../../pipeline/steps/version-history.js";
+import { newAuthorizeVisibilityTransitionStep } from "../../pipeline/steps/visibility-gates.js";
 import { metadataOf } from "../../pipeline/steps/shapes.js";
 import type { Store } from "../../store/interface.js";
-import { uploadUrl } from "../skill/transfer/handler.js";
-import type { UploadSlots } from "../skill/transfer/slots.js";
+import type {
+  ArchiveStaging,
+  StagedUpload,
+} from "../skill/transfer/staging.js";
 import { TRANSFER_LANE_NOT_CONFIGURED } from "./constants.js";
 import type { PluginMaterializerProvider } from "./materialize/ports.js";
 import { findMembers } from "./members.js";
@@ -139,12 +142,6 @@ import {
 } from "./push.js";
 import { pluginSearchExtractor } from "./search-extractor.js";
 
-/** The transfer lane's controller-side pair; the slots are the skill lane's (one upload surface). */
-export interface PluginTransferLaneDeps {
-  readonly slots: UploadSlots;
-  readonly baseUrl: string;
-}
-
 export interface PluginControllerDeps {
   readonly store: Store;
   readonly logger: Logger;
@@ -152,7 +149,8 @@ export interface PluginControllerDeps {
   readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
   readonly artifactStorage: ContentAddressedArchiveStore;
   readonly materializerProvider: PluginMaterializerProvider;
-  readonly transferLane?: PluginTransferLaneDeps;
+  /** The skill lane's staging port (one upload surface for every archive); absent, the lane answers FailedPrecondition. */
+  readonly staging?: ArchiveStaging;
 }
 
 /** Registers both plugin services on the router (routes stage). */
@@ -207,7 +205,7 @@ async function push(
     .addStep(newValidateProtoStep())
     .addStep(
       newResolveArtifactSourceStep<typeof PushPluginRequestSchema>(
-        deps.transferLane?.slots,
+        deps.staging,
         {
           source: (input) => ({
             artifact: input.artifact,
@@ -225,7 +223,7 @@ async function push(
     .addStep(newParseOverlayDocumentsStep())
     .addStep(newSanitizePluginMetadataStep(deps.authorizer))
     .addStep(newPlanMaterializationStep(deps.store, deps.authorizer))
-    .addStep(newGuardPluginVisibilityStep())
+    .addStep(newGuardPluginVisibilityStep(deps.authorizer))
     .addStep(newResolveConvergenceStep())
     .build()
     .execute(reqCtx);
@@ -273,16 +271,17 @@ async function push(
 // ─── createArtifactUploadUrl ─────────────────────────────────────────────
 
 /**
- * Mints a short-lived, single-use upload URL over the shared slots; an
- * over-limit declaration is refused with the limit BEFORE any bytes move.
+ * Mints a short-lived, single-use upload URL through the shared staging
+ * port; an over-limit declaration is refused with the limit BEFORE any
+ * bytes move.
  */
 async function createArtifactUploadUrl(
   deps: PluginControllerDeps,
   req: CreatePluginArtifactUploadUrlRequest,
   ctx: HandlerContext,
 ): Promise<PluginArtifactUploadUrl> {
-  const lane = deps.transferLane;
-  if (lane === undefined) {
+  const staging = deps.staging;
+  if (staging === undefined) {
     throw failedPreconditionError(TRANSFER_LANE_NOT_CONFIGURED);
   }
   const reqCtx = new RequestContext(
@@ -309,14 +308,14 @@ async function createArtifactUploadUrl(
       `plugin archive size ${req.sizeBytes} bytes exceeds the ${MAX_ZIP_SIZE}-byte (100MB) archive limit`,
     );
   }
-  let minted: { ref: string; ttlMs: number };
+  let minted: StagedUpload;
   try {
-    minted = lane.slots.mint(Number(req.sizeBytes));
+    minted = await staging.mint(Number(req.sizeBytes));
   } catch (error) {
     throw internalError(error, "failed to mint upload reference");
   }
   return create(PluginArtifactUploadUrlSchema, {
-    url: uploadUrl(lane.baseUrl, minted.ref),
+    url: minted.url,
     artifactUploadRef: minted.ref,
     ttlSeconds: Math.trunc(minted.ttlMs / 1000),
   });
@@ -358,6 +357,12 @@ async function updateVisibility(
     .addStep(newLoadPluginByIdStep(deps.store, UPDATE_VISIBILITY_PLUGIN_KEY))
     .addStep(newRecordVisibilityBeforeUpdateStep(UPDATE_VISIBILITY_PLUGIN_KEY))
     .addStep(newValidateVisibilityUpdateStep())
+    .addStep(
+      newAuthorizeVisibilityTransitionStep(
+        UPDATE_VISIBILITY_PLUGIN_KEY,
+        deps.authorizer,
+      ),
+    )
     .addStep(newSetPluginVisibilityStep())
     .addStep(
       newPersistPluginStep(

package/src/domain/plugin/push.ts

@@ -94,6 +94,7 @@ import { ARTIFACT_BYTES_KEY } from "../../pipeline/steps/resolve-artifact-source
 import { generateSlug } from "../../pipeline/steps/slug.js";
 import { rejectUnsupportedVisibility } from "../../pipeline/steps/validate-visibility.js";
 import { newArchiveCurrentVersionStep } from "../../pipeline/steps/version-archive.js";
+import { requireOperatorMaySetPublic } from "../../pipeline/steps/visibility-gates.js";
 import { ResourceNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
 import { openPluginArchive } from "./archive.js";
@@ -492,23 +493,30 @@ export function newPlanMaterializationStep(
 
 /**
  * GuardPluginVisibility — the requested level must be one the plugin and
- * every planned member kind support: the push chain's counterpart of the
- * ValidateVisibility step on the resource create chains, asked here for
- * the head and for each member kind before anything is written, so a
- * plugin cannot be installed at a level one of its members may not hold.
- * Each member's own chain checks again in-process; refusing here keeps the
- * head from being written before the answer is known.
+ * every planned member kind support, and PUBLIC needs the operator grant
+ * (the one owner of that question, shared with every other create door).
+ * Each member's own chain will check again in-process; refusing here keeps
+ * the head from being written before the answer is known.
  */
-export function newGuardPluginVisibilityStep(): PipelineStep<PushDesc> {
+export function newGuardPluginVisibilityStep(
+  authorizer: Authorizer,
+): PipelineStep<PushDesc> {
   return {
     name: "GuardPluginVisibility",
-    execute(ctx: RequestContext<PushDesc>): void {
+    async execute(ctx: RequestContext<PushDesc>): Promise<void> {
       const level = requestedVisibility(ctx);
       const plan = ctx.get(PLUGIN_PLAN_KEY) as MaterializationPlan;
       rejectUnsupportedVisibility(ctx.apiResourceKind, level);
       for (const kind of new Set(plan.members.map((member) => member.kind))) {
         rejectUnsupportedVisibility(kind, level);
       }
+      if (level !== ApiResourceVisibility.visibility_public) {
+        return;
+      }
+      if (ctx.callerIdentity.callerClass === "internal") {
+        return;
+      }
+      await requireOperatorMaySetPublic(authorizer, ctx.callerIdentity);
     },
   };
 }

package/src/domain/schedule/controller.ts

@@ -97,10 +97,7 @@ import {
   newCreateAuthorizationTuplesStep,
 } from "../../pipeline/steps/authorization-tuples.js";
 import { newPersistStep } from "../../pipeline/steps/persist.js";
-import {
-  newNormalizeReferencesStep,
-  newValidateReferencesStep,
-} from "../../pipeline/steps/references.js";
+import { newNormalizeReferencesStep } from "../../pipeline/steps/references.js";
 import { newResolveSlugStep } from "../../pipeline/steps/slug.js";
 import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
 import { newValidateVisibilityStep } from "../../pipeline/steps/validate-visibility.js";
@@ -223,7 +220,6 @@ async function createSchedule(
     .addStep(newBuildNewStateStep())
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newNormalizeReferencesStep())
-    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newPersistStep(deps.store))
     .addStep(
       newCreateAuthorizationTuplesStep(
@@ -263,7 +259,6 @@ async function update(
     .addStep(newBuildUpdateStateStep())
     .addStep(newGuardReservedLabelsStep(deps.authorizer))
     .addStep(newNormalizeReferencesStep())
-    .addStep(newValidateReferencesStep(deps.store))
     .addStep(newPersistScheduleUpdateStep(deps.store))
     .addStep(newArmScheduleStep(deps.clock, deps.logger))
     .build()