@stigmer/server 3.22.1 → 3.23.1-dev.20260923075205

package/src/store/sqlite/__tests__/migrations.test.ts

@@ -6,7 +6,10 @@
  * predates Go's idempotent ALTERs gains its columns; a legacy pre-v2
  * database gets its prefix-based audit rows migrated. Rollback safety
  * (DD-006): a v7 database re-opened by Go-shaped version checks
- * (< 6) runs nothing.
+ * (< 6) runs nothing. v10, the chain's first row-decoding step, moves
+ * every row of the seven kinds that held the retired public level to org
+ * and leaves every other row's bytes as they were; a row it cannot decode
+ * fails the step and leaves the database at v9.
  */
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -15,12 +18,20 @@ import { DatabaseSync } from "node:sqlite";
 
 import { afterEach, describe, expect, it } from "vitest";
 
+import { create, fromBinary, fromJson, toBinary } from "@bufbuild/protobuf";
+import type { DescMessage } from "@bufbuild/protobuf";
+
+import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+
 import { SqliteStore } from "../store.js";
 import {
   CURRENT_SCHEMA_VERSION,
+  SCHEMA_VERSION_10,
   getSchemaVersion,
   runMigrations,
 } from "../migrations.js";
+import { PUBLIC_ROW_KINDS_AT_RETIREMENT } from "../../public-visibility-retired.js";
 import { materializeGoFixture } from "./support.js";
 
 const cleanups: Array<() => void | Promise<void>> = [];
@@ -81,7 +92,9 @@ describe("fresh database", () => {
     const rows = db
       .prepare(`SELECT version FROM schema_version ORDER BY version`)
       .all() as Array<{ version: number }>;
-    expect(rows.map((row) => row.version)).toEqual([1, 2, 3, 4, 5, 6, 7, 8, 9]);
+    expect(rows.map((row) => row.version)).toEqual([
+      1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
+    ]);
   });
 
   it("re-opening an already-migrated database is a no-op", async () => {
@@ -138,7 +151,9 @@ describe("Go-created v6 database adoption (DD-002 fixture)", () => {
     expect(org.id).toBe("acme");
 
     const audit = db
-      .prepare(`SELECT version_hash, tag FROM resource_audit WHERE kind = 'organization'`)
+      .prepare(
+        `SELECT version_hash, tag FROM resource_audit WHERE kind = 'organization'`,
+      )
       .get() as { version_hash: string; tag: string };
     expect(audit).toEqual({ version_hash: "hash-v1", tag: "stable" });
 
@@ -283,8 +298,10 @@ describe("legacy pre-v2 database", () => {
       CREATE TABLE schema_version (version INTEGER PRIMARY KEY, applied_at TEXT NOT NULL DEFAULT (datetime('now')));
       INSERT INTO schema_version (version) VALUES (1);
       CREATE TABLE resources (kind TEXT NOT NULL, id TEXT NOT NULL, data BLOB NOT NULL, updated_at TEXT NOT NULL DEFAULT (datetime('now')), PRIMARY KEY (kind, id)) WITHOUT ROWID;
-      INSERT INTO resources (kind, id, data) VALUES ('skill', 'skl_1', X'0a01aa');
-      INSERT INTO resources (kind, id, data) VALUES ('skill', 'skill_audit/skl_1/1706123456789', X'0a01bb');
+      -- Field 1 (api_version) holding one ASCII byte: bytes v10 can decode
+      -- as a Skill, since it walks every live row of that kind.
+      INSERT INTO resources (kind, id, data) VALUES ('skill', 'skl_1', X'0a0176');
+      INSERT INTO resources (kind, id, data) VALUES ('skill', 'skill_audit/skl_1/1706123456789', X'0a0177');
     `);
     setup.close();
 
@@ -330,3 +347,172 @@ describe("rollback safety (DD-006)", () => {
     expect(version.v).toBeGreaterThanOrEqual(6);
   });
 });
+
+describe("v10: the retired public level leaves every row", () => {
+  /** A v9 database: the chain replayed, then v10's version row removed. */
+  function v9Database(): { dbPath: string; db: DatabaseSync } {
+    const dbPath = tempDbPath();
+    const setup = new DatabaseSync(dbPath);
+    runMigrations(setup);
+    setup
+      .prepare(`DELETE FROM schema_version WHERE version = ?`)
+      .run(SCHEMA_VERSION_10);
+    expect(getSchemaVersion(setup)).toBe(SCHEMA_VERSION_10 - 1);
+    return { dbPath, db: setup };
+  }
+
+  function agentBytes(
+    id: string,
+    visibility: ApiResourceVisibility,
+  ): Uint8Array {
+    return toBinary(
+      AgentSchema,
+      create(AgentSchema, {
+        apiVersion: "agentic.stigmer.ai/v1",
+        kind: "Agent",
+        metadata: { id, name: id, slug: id, org: "acme", visibility },
+        spec: { instructions: "a conformant instruction body" },
+      }),
+    );
+  }
+
+  /** A row of `schema` carrying only the envelope every kind shares, at `visibility`. */
+  function envelopeBytes(
+    schema: DescMessage,
+    id: string,
+    visibility: ApiResourceVisibility,
+  ): Uint8Array {
+    return toBinary(
+      schema,
+      fromJson(schema, {
+        metadata: {
+          id,
+          name: id,
+          slug: id,
+          org: "acme",
+          visibility: ApiResourceVisibility[visibility],
+        },
+      }),
+    );
+  }
+
+  function insert(
+    db: DatabaseSync,
+    kind: string,
+    id: string,
+    data: Uint8Array,
+  ): void {
+    db.prepare(
+      `INSERT INTO resources (kind, id, data, updated_at) VALUES (?, ?, ?, '2026-09-01 00:00:00')`,
+    ).run(kind, id, data);
+  }
+
+  function row(
+    db: DatabaseSync,
+    kind: string,
+    id: string,
+  ): { data: Uint8Array; updated_at: string } {
+    return db
+      .prepare(
+        `SELECT data, updated_at FROM resources WHERE kind = ? AND id = ?`,
+      )
+      .get(kind, id) as { data: Uint8Array; updated_at: string };
+  }
+
+  it("moves a public row of every kind in the frozen table to org, and leaves an org row and a private row byte-for-byte", () => {
+    const { dbPath, db: setup } = v9Database();
+    // One public row per kind the level could live under, each encoded
+    // through its own schema.
+    for (const entry of PUBLIC_ROW_KINDS_AT_RETIREMENT) {
+      insert(
+        setup,
+        entry.kind,
+        `${entry.kind}_public`,
+        envelopeBytes(
+          entry.schema,
+          `${entry.kind}_public`,
+          ApiResourceVisibility.visibility_public,
+        ),
+      );
+    }
+    const orgBytes = agentBytes(
+      "agt_org",
+      ApiResourceVisibility.visibility_org,
+    );
+    const privateBytes = agentBytes(
+      "agt_private",
+      ApiResourceVisibility.visibility_private,
+    );
+    insert(setup, "agent", "agt_org", orgBytes);
+    insert(setup, "agent", "agt_private", privateBytes);
+    setup.close();
+
+    const store = SqliteStore.open(dbPath);
+    cleanups.push(() => store.close());
+    const db = new DatabaseSync(dbPath);
+    cleanups.push(() => db.close());
+
+    expect(getSchemaVersion(db)).toBe(CURRENT_SCHEMA_VERSION);
+    for (const entry of PUBLIC_ROW_KINDS_AT_RETIREMENT) {
+      const moved = row(db, entry.kind, `${entry.kind}_public`);
+      expect(moved.data, entry.kind).toEqual(
+        envelopeBytes(
+          entry.schema,
+          `${entry.kind}_public`,
+          ApiResourceVisibility.visibility_org,
+        ),
+      );
+      expect(moved.updated_at, `${entry.kind} updated_at bumped`).not.toBe(
+        "2026-09-01 00:00:00",
+      );
+    }
+    expect(row(db, "agent", "agt_org")).toEqual({
+      data: orgBytes,
+      updated_at: "2026-09-01 00:00:00",
+    });
+    expect(row(db, "agent", "agt_private")).toEqual({
+      data: privateBytes,
+      updated_at: "2026-09-01 00:00:00",
+    });
+    const publicLeft = db
+      .prepare(`SELECT count(*) AS n FROM resources WHERE kind = 'agent'`)
+      .get() as { n: number };
+    expect(publicLeft.n).toBe(3);
+  });
+
+  it("a row of a kind outside the frozen table is never decoded", () => {
+    const { dbPath, db: setup } = v9Database();
+    // Bytes no schema decodes, under a kind the level never applied to.
+    insert(setup, "session", "ses_opaque", new Uint8Array([0xff, 0xff]));
+    setup.close();
+
+    const store = SqliteStore.open(dbPath);
+    cleanups.push(() => store.close());
+    const db = new DatabaseSync(dbPath);
+    cleanups.push(() => db.close());
+    expect(getSchemaVersion(db)).toBe(CURRENT_SCHEMA_VERSION);
+    expect(row(db, "session", "ses_opaque").data).toEqual(
+      new Uint8Array([0xff, 0xff]),
+    );
+  });
+
+  it("a row of a table kind that does not decode fails the step, names the row, and leaves the database at v9 with every row untouched", () => {
+    const { dbPath, db: setup } = v9Database();
+    const publicBytes = agentBytes(
+      "agt_public",
+      ApiResourceVisibility.visibility_public,
+    );
+    insert(setup, "agent", "agt_public", publicBytes);
+    insert(setup, "agent", "agt_broken", new Uint8Array([0xff, 0xff, 0xff]));
+    setup.close();
+
+    expect(() => SqliteStore.open(dbPath)).toThrow(
+      /migrate to v10: .*agent 'agt_broken' cannot be moved off the retired public level/,
+    );
+
+    const db = new DatabaseSync(dbPath);
+    cleanups.push(() => db.close());
+    expect(getSchemaVersion(db)).toBe(SCHEMA_VERSION_10 - 1);
+    expect(row(db, "agent", "agt_public").data).toEqual(publicBytes);
+  });
+});

package/src/store/sqlite/migrations.ts

@@ -32,6 +32,11 @@
  */
 import type { DatabaseSync } from "node:sqlite";
 
+import {
+  PUBLIC_ROW_KINDS_AT_RETIREMENT,
+  movePublicRowToOrg,
+} from "../public-visibility-retired.js";
+
 export const SCHEMA_VERSION_1 = 1;
 export const SCHEMA_VERSION_2 = 2;
 export const SCHEMA_VERSION_3 = 3;
@@ -44,9 +49,11 @@ export const SCHEMA_VERSION_7 = 7;
 export const SCHEMA_VERSION_8 = 8;
 /** v9: the rows of the removed Project kind deleted. */
 export const SCHEMA_VERSION_9 = 9;
+/** v10: every row holding the retired public visibility level moved to org. */
+export const SCHEMA_VERSION_10 = 10;
 
 /** Target version for new databases. */
-export const CURRENT_SCHEMA_VERSION = SCHEMA_VERSION_9;
+export const CURRENT_SCHEMA_VERSION = SCHEMA_VERSION_10;
 
 /** Applies all pending migrations in order. */
 export function runMigrations(db: DatabaseSync): void {
@@ -69,6 +76,7 @@ export function runMigrations(db: DatabaseSync): void {
     [SCHEMA_VERSION_7, migrateToV7],
     [SCHEMA_VERSION_8, migrateToV8],
     [SCHEMA_VERSION_9, migrateToV9],
+    [SCHEMA_VERSION_10, migrateToV10],
   ];
 
   for (const [version, migrate] of chain) {
@@ -379,3 +387,39 @@ function migrateToV9(db: DatabaseSync): void {
     DELETE FROM resource_audit WHERE kind = 'project';
   `);
 }
+
+/**
+ * v10: the public visibility level is retired, so every row that still
+ * holds it is moved to org visibility — the chain's first migration that
+ * decodes a row (public-visibility-retired.ts says why a migration, why
+ * the kind table is frozen there, and why an undecodable row fails the
+ * step). This step owns the SQL: one read per kind in the frozen table,
+ * one UPDATE per moved row with `updated_at` bumped the way saveResource
+ * bumps it, rows that hold any other level left byte-for-byte as they
+ * are. Runs inside applyInTransaction's BEGIN, so a throw from the mover
+ * rolls the whole step back and the boot stops on the row it names.
+ */
+function migrateToV10(db: DatabaseSync): void {
+  const update = db.prepare(
+    `UPDATE resources SET data = ?, updated_at = datetime('now') WHERE kind = ? AND id = ?`,
+  );
+  for (const entry of PUBLIC_ROW_KINDS_AT_RETIREMENT) {
+    const rows = db
+      .prepare(`SELECT id, data FROM resources WHERE kind = ?`)
+      .all(entry.kind) as Array<{ id: string; data: Uint8Array }>;
+    for (const row of rows) {
+      let moved: Uint8Array | undefined;
+      try {
+        moved = movePublicRowToOrg(entry, row.data);
+      } catch (error) {
+        throw new Error(
+          `${entry.kind} '${row.id}' cannot be moved off the retired public level: ${String(error)}`,
+          { cause: error },
+        );
+      }
+      if (moved !== undefined) {
+        update.run(moved, entry.kind, row.id);
+      }
+    }
+  }
+}

package/src/store/sqlite/store.ts

@@ -820,21 +820,15 @@ export class SqliteStore implements Store {
     const kindPlaceholders = query.kinds.map(() => "?").join(",");
     const kindArgs = [...query.kinds];
 
-    // The scope-filter fragments, byte-identical to Go's buildScopeFilter:
-    // org (strict or public-widened) and the independent public subtraction.
+    // The scope-filter fragments: the org filter, strict (a row is in the
+    // requested org or it is not; visibility never widens or narrows the
+    // scope), then the authorized-id allowlist.
     const scopeClauses: string[] = [];
     const scopeArgs: string[] = [];
     if (query.orgFilter !== "") {
-      scopeClauses.push(
-        query.crossOrgPublic
-          ? `AND (org = ? OR visibility = 'visibility_public')`
-          : `AND org = ?`,
-      );
+      scopeClauses.push(`AND org = ?`);
       scopeArgs.push(query.orgFilter);
     }
-    if (query.excludePublic) {
-      scopeClauses.push(`AND visibility != 'visibility_public'`);
-    }
     if (query.authorizedIdsByKind !== undefined) {
       // The 20260830.01 scoping arm: per-kind resource_id allowlists.
       // An empty set contributes NO clause — that kind matches nothing —

package/src/transport/registry/__tests__/lanes.test.ts

@@ -38,7 +38,7 @@ beforeAll(async () => {
   // test previously composed against the DEFAULT paths, which meant
   // opening the developer's real ~/.stigmer/stigmer.db — and with the
   // skill domain's boot-time staging wipe (#8) it would now also clear
-  // ~/.stigmer/storage/skills-staging. Tests never touch the home dir.
+  // ~/.stigmer/storage/skills/staging. Tests never touch the home dir.
   testDir = mkdtempSync(path.join(tmpdir(), "registry-lanes-test-"));
   const config = loadConfig({
     STIGMER_MODEL_REGISTRY_REFRESH: "off",

package/dist/pipeline/steps/visibility-gates.d.ts

@@ -1,27 +0,0 @@
-import type { DescMessage } from "@bufbuild/protobuf";
-import type { Authorizer } from "../../extensions/authorizer.js";
-import type { CallerIdentity } from "../../extensions/identity.js";
-import type { PipelineStep } from "../pipeline.js";
-/**
- * The denial callers see at both doors (the Java policy copy verbatim).
- * Deliberately not byte-pinned by the OSS conformance suite; the cloud
- * gate itself is recorded via the clientPublicVisibilityWrites flag.
- */
-export declare const PUBLIC_VISIBILITY_DENY_MESSAGE: string;
-/** The CREATE door: a new state declaring PUBLIC needs the operator grant. */
-export declare function newGuardPublicVisibilityStep<Desc extends DescMessage>(authorizer: Authorizer): PipelineStep<Desc>;
-/**
- * The UPDATE door: escalation to PUBLIC (the stored level is anything
- * else) needs the operator grant. Reads the loaded target from the
- * chain's own context key (every updateVisibility chain stores it —
- * the RecordVisibilityBeforeUpdate pattern).
- */
-export declare function newAuthorizeVisibilityTransitionStep<Desc extends DescMessage>(targetKey: string, authorizer: Authorizer): PipelineStep<Desc>;
-/**
- * The single owner of "may this caller set public?" — both doors call it,
- * and so does the plugin push chain, whose requested level rides the
- * request (the level then flows to every member through the members' own
- * create and updateVisibility doors, which run this check again).
- */
-export declare function requireOperatorMaySetPublic(authorizer: Authorizer, caller: CallerIdentity): Promise<void>;
-//# sourceMappingURL=visibility-gates.d.ts.map

package/dist/pipeline/steps/visibility-gates.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"visibility-gates.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/visibility-gates.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAOtD,OAAO,KAAK,EAAE,UAAU,EAAiB,MAAM,gCAAgC,CAAC;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAInD;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,QAEU,CAAC;AAEtD,8EAA8E;AAC9E,wBAAgB,4BAA4B,CAAC,IAAI,SAAS,WAAW,EACnE,UAAU,EAAE,UAAU,GACrB,YAAY,CAAC,IAAI,CAAC,CAgBpB;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAAC,IAAI,SAAS,WAAW,EAC3E,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,UAAU,GACrB,YAAY,CAAC,IAAI,CAAC,CA+BpB;AAED;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CA6Bf"}

package/dist/pipeline/steps/visibility-gates.js

@@ -1,139 +0,0 @@
-/**
- * The PUBLIC-visibility operator gates — the two write doors a resource
- * can become public through, both consulting the ONE composed Authorizer
- * with the same platform-scoped check (the Java
- * PublicVisibilityEscalationPolicy port; C2 Stage 3, 20260827.10).
- *
- * PUBLIC is the only level that crosses every org boundary (one flip
- * lists a resource in every tenant's cross-org catalog), so entering it
- * is a curation decision: the owner requests, the platform team grants.
- * The answer is `can_set_public_visibility` on `platform:stigmer` — a
- * named operator capability, never a bare operator lookup.
- *
- *   - GuardPublicVisibility: the CREATE door, in the create chains of
- *     the kinds whose VisibilityConfig supports PUBLIC (agent, workflow,
- *     mcp_server, agent_instance, workflow_instance). After
- *     BuildNewState — it inspects the state that will persist — which
- *     keeps the pinned INVALID_ARGUMENT level-support rejections (the
- *     earlier ValidateVisibility) their precedence over this
- *     PERMISSION_DENIED.
- *   - AuthorizeVisibilityTransition: the UPDATE door, in every
- *     updateVisibility chain after ValidateVisibilityUpdate (the pinned
- *     FAILED_PRECONDITION default-instance rejection keeps precedence,
- *     the Java ordering the conformance suite depends on). Gates only
- *     the ESCALATION to public (stored level is anything else).
- *
- * Both run LAZILY — only requests that actually involve the PUBLIC level
- * reach the Authorizer — and both pass for internal callers (server-side
- * flows publish platform resources by design). The OSS permissive
- * default allows, so the local posture keeps today's behavior
- * byte-identically; the cloud's FGA Authorizer supplies the gate.
- *
- * DELIBERATE partial port, recorded owner-visibly (Stage-3 execution
- * record): Java's transition step additionally lets operators WITHOUT
- * resource can_edit publish and take down (its updateVisibility chains
- * authorize post-load, transition-aware); this edition's position-1
- * Authorize enforces can_edit on updateVisibility before any step here
- * runs, so those operator-without-edit lanes require can_edit until the
- * Stage-4 chain disposition addresses them. No conformance lane pins
- * them.
- */
-import { Code, ConnectError } from "@connectrpc/connect";
-import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
-import { internalError } from "../errors.js";
-import { metadataOf } from "./shapes.js";
-/**
- * The denial callers see at both doors (the Java policy copy verbatim).
- * Deliberately not byte-pinned by the OSS conformance suite; the cloud
- * gate itself is recorded via the clientPublicVisibilityWrites flag.
- */
-export const PUBLIC_VISIBILITY_DENY_MESSAGE = "Public visibility is granted by the platform team. " +
-    "Ask a platform operator to publish this resource.";
-/** The CREATE door: a new state declaring PUBLIC needs the operator grant. */
-export function newGuardPublicVisibilityStep(authorizer) {
-    return {
-        name: "GuardPublicVisibility",
-        async execute(ctx) {
-            if (ctx.callerIdentity.callerClass === "internal") {
-                return;
-            }
-            if (metadataOf(ctx.newState)?.visibility !==
-                ApiResourceVisibility.visibility_public) {
-                return;
-            }
-            await requireOperatorMaySetPublic(authorizer, ctx.callerIdentity);
-        },
-    };
-}
-/**
- * The UPDATE door: escalation to PUBLIC (the stored level is anything
- * else) needs the operator grant. Reads the loaded target from the
- * chain's own context key (every updateVisibility chain stores it —
- * the RecordVisibilityBeforeUpdate pattern).
- */
-export function newAuthorizeVisibilityTransitionStep(targetKey, authorizer) {
-    return {
-        name: "AuthorizeVisibilityTransition",
-        async execute(ctx) {
-            if (ctx.callerIdentity.callerClass === "internal") {
-                return;
-            }
-            const requested = ctx.input
-                .visibility;
-            if (requested !== ApiResourceVisibility.visibility_public) {
-                return;
-            }
-            const target = ctx.get(targetKey);
-            if (target === undefined) {
-                // Wiring error, not a user error: without the loaded target there
-                // is no stored level, and a gate that silently passes un-guards
-                // the boundary it exists to protect.
-                throw internalError(new Error("AuthorizeVisibilityTransition ran without a loaded target — step must be placed after the load step"), "visibility authorization requires the loaded resource");
-            }
-            const stored = metadataOf(target)?.visibility;
-            if (stored === ApiResourceVisibility.visibility_public) {
-                return; // Re-asserting a stored PUBLIC is not an escalation.
-            }
-            await requireOperatorMaySetPublic(authorizer, ctx.callerIdentity);
-        },
-    };
-}
-/**
- * The single owner of "may this caller set public?" — both doors call it,
- * and so does the plugin push chain, whose requested level rides the
- * request (the level then flows to every member through the members' own
- * create and updateVisibility doors, which run this check again).
- */
-export async function requireOperatorMaySetPublic(authorizer, caller) {
-    let decision;
-    try {
-        decision = await authorizer.authorize(caller, {
-            permission: IamPermission.can_set_public_visibility,
-            resourceKind: ApiResourceKind.platform,
-            resourceId: "stigmer",
-        });
-    }
-    catch (error) {
-        throw publicVisibilityCheckFailure(error);
-    }
-    switch (decision.kind) {
-        case "allow":
-            return;
-        case "deny":
-        case "not-found":
-            throw new ConnectError(PUBLIC_VISIBILITY_DENY_MESSAGE, Code.PermissionDenied);
-        case "unavailable":
-            throw publicVisibilityCheckFailure(decision.cause);
-        default: {
-            const exhaustive = decision;
-            throw publicVisibilityCheckFailure(new Error(`unknown decision ${JSON.stringify(exhaustive)}`));
-        }
-    }
-}
-/** Authorization infrastructure failure: fail closed, sanitized (#478). */
-function publicVisibilityCheckFailure(error) {
-    return internalError(error instanceof Error ? error : new Error(String(error)), "public-visibility authorization could not be completed");
-}
-//# sourceMappingURL=visibility-gates.js.map

package/dist/pipeline/steps/visibility-gates.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"visibility-gates.js","sourceRoot":"","sources":["../../../src/pipeline/steps/visibility-gates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAI1E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GACzC,qDAAqD;IACrD,mDAAmD,CAAC;AAEtD,8EAA8E;AAC9E,MAAM,UAAU,4BAA4B,CAC1C,UAAsB;IAEtB,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,GAAG,CAAC,cAAc,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,IACE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,UAAU;gBACpC,qBAAqB,CAAC,iBAAiB,EACvC,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,2BAA2B,CAAC,UAAU,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oCAAoC,CAClD,SAAiB,EACjB,UAAsB;IAEtB,OAAO;QACL,IAAI,EAAE,+BAA+B;QACrC,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,IAAI,GAAG,CAAC,cAAc,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,MAAM,SAAS,GAAI,GAAG,CAAC,KAA0C;iBAC9D,UAAU,CAAC;YACd,IAAI,SAAS,KAAK,qBAAqB,CAAC,iBAAiB,EAAE,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,kEAAkE;gBAClE,gEAAgE;gBAChE,qCAAqC;gBACrC,MAAM,aAAa,CACjB,IAAI,KAAK,CACP,qGAAqG,CACtG,EACD,uDAAuD,CACxD,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAA6B,CAAC,EAAE,UAAU,CAAC;YACrE,IAAI,MAAM,KAAK,qBAAqB,CAAC,iBAAiB,EAAE,CAAC;gBACvD,OAAO,CAAC,qDAAqD;YAC/D,CAAC;YACD,MAAM,2BAA2B,CAAC,UAAU,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,UAAsB,EACtB,MAAsB;IAEtB,IAAI,QAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE;YAC5C,UAAU,EAAE,aAAa,CAAC,yBAAyB;YACnD,YAAY,EAAE,eAAe,CAAC,QAAQ;YACtC,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO;QACT,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW;YACd,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,IAAI,CAAC,gBAAgB,CACtB,CAAC;QACJ,KAAK,aAAa;YAChB,MAAM,4BAA4B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,4BAA4B,CAChC,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,SAAS,4BAA4B,CAAC,KAAc;IAClD,OAAO,aAAa,CAClB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACzD,wDAAwD,CACzD,CAAC;AACJ,CAAC"}

package/src/authorization/__tests__/fixtures/fga/cross-org-share-creation.fga.yaml

@@ -1,98 +0,0 @@
-# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/cross-org-share-creation.fga.yaml
-# at commit 2ec420161 (the OpenFGA store test the cloud runs against its live model).
-# The body below is byte-identical to the source; the cloud re-runs the LIVE
-# file against this evaluator at the re-pin, so a stale copy is caught there.
-# Cross-org share creation, the FGA half of the decision 013 D2 consent
-# bar. Creating a share of ANOTHER org's marketplace-public agent requires:
-#
-#   1. can_execute on the agent — granted to every authenticated account by
-#      the allow_public wildcard when the agent is public (checked here),
-#      and to nobody cross-org when it is not.
-#   2. can_create_agent_share on the SHARE's own org — admin-level: a
-#      public share spends the org's credits on the open internet. The
-#      per-kind can_create_* pattern, one more row.
-#
-# The same-org bar (agent can_edit) is untouched and pinned by
-# agent-share-owner.fga.yaml; the app-level halves of the contract
-# (visibility check, audience rule, dependency sweep, agent-id pin) are
-# handler logic outside FGA, pinned by the Java and Go unit tests.
-
-name: cross-org-share-creation
-model_file: ../model/fga.mod
-
-tuples:
-  # provider-org publishes a marketplace-public agent (the conditional
-  # wildcard viewer tuple visibility_public writes).
-  - user: organization:provider-org
-    relation: organization
-    object: agent:public-helper
-  - user: identity_account:paula
-    relation: owner
-    object: agent:public-helper
-  - user: identity_account:*
-    relation: viewer
-    object: agent:public-helper
-    condition:
-      name: allow_public
-      context: {}
-
-  # A private agent in the same provider org — the wildcard is absent.
-  - user: organization:provider-org
-    relation: organization
-    object: agent:private-helper
-  - user: identity_account:paula
-    relation: owner
-    object: agent:private-helper
-
-  # consumer-org: an admin and a plain member.
-  - user: identity_account:adam
-    relation: admin
-    object: organization:consumer-org
-  - user: identity_account:mia
-    relation: member
-    object: organization:consumer-org
-
-tests:
-  - name: consumer-org admin holds both halves of the cross-org bar
-    check:
-      - user: identity_account:adam
-        object: agent:public-helper
-        context:
-          allow: true
-        assertions:
-          can_execute: true
-          can_edit: false
-      - user: identity_account:adam
-        object: organization:consumer-org
-        assertions:
-          can_create_agent_share: true
-
-  - name: plain member lacks the org-side bar (spending is admin-level)
-    check:
-      - user: identity_account:mia
-        object: agent:public-helper
-        context:
-          allow: true
-        assertions:
-          can_execute: true
-      - user: identity_account:mia
-        object: organization:consumer-org
-        assertions:
-          can_create_agent_share: false
-
-  - name: nobody cross-org can execute a private agent
-    check:
-      - user: identity_account:adam
-        object: agent:private-helper
-        context:
-          allow: true
-        assertions:
-          can_execute: false
-          can_view: false
-
-  - name: the org-side bar does not leak across orgs
-    check:
-      - user: identity_account:paula
-        object: organization:consumer-org
-        assertions:
-          can_create_agent_share: false

package/src/authorization/__tests__/fixtures/fga/public-visibility-setter.fga.yaml

@@ -1,52 +0,0 @@
-# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/public-visibility-setter.fga.yaml
-# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
-# The body below is byte-identical to the source; the cloud re-runs the LIVE
-# file against this evaluator at the re-pin, so a stale copy is caught there.
-# Store tests for the public-visibility permission (marketplace curation).
-#
-# can_set_public_visibility gates who may set a resource's visibility to
-# PUBLIC — the only level that crosses every org boundary. It derives
-# from the platform operator role: operators (human curators and the
-# seeding machine account) hold it; ordinary tenants — even org owners,
-# who can otherwise fully manage their resources — never do. Enforced by
-# PublicVisibilityEscalationPolicy at both write doors (updateVisibility
-# escalation and create-with-public).
-#
-# Run with:
-#   fga model test --tests public-visibility-setter.fga.yaml
-name: public-visibility-setter
-model_file: ../model/fga.mod
-
-tuples:
-  # The bootstrap machine account is the platform operator
-  # (BootstrapIdentitySeeder re-asserts this tuple on every boot).
-  - user: identity_account:machine
-    relation: operator
-    object: platform:stigmer
-
-  # A human operator granted the same platform role.
-  - user: identity_account:opal
-    relation: operator
-    object: platform:stigmer
-
-  # A tenant org owner — owns everything in their org, nothing on the
-  # platform.
-  - user: identity_account:mallory
-    relation: owner
-    object: organization:acme
-
-tests:
-  - name: operators may set public visibility, tenants may not
-    check:
-      - user: identity_account:machine
-        object: platform:stigmer
-        assertions:
-          can_set_public_visibility: true
-      - user: identity_account:opal
-        object: platform:stigmer
-        assertions:
-          can_set_public_visibility: true
-      - user: identity_account:mallory
-        object: platform:stigmer
-        assertions:
-          can_set_public_visibility: false