@stigmer/server 3.40.0 → 3.41.0

package/dist/authorization/resource-creators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-creators.js","sourceRoot":"","sources":["../../src/authorization/resource-creators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AAEvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,MAAM,UAAU,wBAAwB,CAAC,KAAY;IACnD,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE;YAC1B,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;YACjD,IACE,IAAI,KAAK,eAAe,CAAC,yBAAyB;gBAClD,IAAI,KAAK,eAAe,CAAC,gBAAgB;gBACzC,MAAM,KAAK,SAAS;gBACpB,EAAE,KAAK,EAAE,EACT,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,WAAW,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;YAChE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/authorization/trusted-local-authorizer.d.ts

@@ -0,0 +1,9 @@
+import type { Authorizer } from "../extensions/authorizer.js";
+import type { Store } from "../store/interface.js";
+/** The one read the driver makes: the Organization's row by id. */
+export type TrustedLocalAuthorizerStore = Pick<Store, "getResource">;
+export interface TrustedLocalAuthorizerDeps {
+    readonly store: TrustedLocalAuthorizerStore;
+}
+export declare function newTrustedLocalAuthorizer(deps: TrustedLocalAuthorizerDeps): Authorizer;
+//# sourceMappingURL=trusted-local-authorizer.d.ts.map

package/dist/authorization/trusted-local-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-local-authorizer.d.ts","sourceRoot":"","sources":["../../src/authorization/trusted-local-authorizer.ts"],"names":[],"mappings":"AA8CA,OAAO,KAAK,EACV,UAAU,EAGX,MAAM,6BAA6B,CAAC;AAErC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,mEAAmE;AACnE,MAAM,MAAM,2BAA2B,GAAG,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;AAErE,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,KAAK,EAAE,2BAA2B,CAAC;CAC7C;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,0BAA0B,GAC/B,UAAU,CA2BZ"}

package/dist/authorization/trusted-local-authorizer.js

@@ -0,0 +1,70 @@
+/**
+ * The trusted-local Authorizer — open source's driver for the one
+ * authorization decision seam (extensions/authorizer.ts) under the
+ * trusted-local posture (posture.ts): the laptop, a server with no sign-in.
+ * It separates no callers (there is one, the operator), so every check is
+ * `allow`, with one exception that is not a permission question at all.
+ *
+ * A check whose target is an Organization the store does not hold is
+ * `not-found`. "Does this Organization exist" is a load question, and
+ * every posture's Authorizer answers it the same way: the built-in
+ * driver's arm 4 (authorizer.ts) before any permission is evaluated, and
+ * the cloud's on its deny path (stigmer-cloud
+ * src/authorizer/fga-authorizer.ts, the existence probe). The Authorize
+ * step turns the arm into the load-first chain's NOT_FOUND,
+ * `Organization not found: <slug>`, so a server without sign-in refuses a
+ * write into a phantom Organization with the sentence a server with
+ * sign-in answers, instead of storing it under a slug nothing lists
+ * (stigmer#1163). Reads that name the Organization (a list by org, a
+ * usage report) are answered the same way, as they are under sign-in.
+ *
+ * Why the Organization alone. Every org-scoped lane authorizes on it (a
+ * create by `metadata.org`, a list or report by `org`/`org_id`), and its
+ * absence is the one no later step catches. The other kinds' update, get
+ * and delete chains load their target first and answer NOT_FOUND
+ * themselves, and a general existence read would refuse the rowless
+ * `platform` (model/bindings.ts), whose checks the laptop must keep
+ * allowing. An Organization's id is its slug (domain/organization/
+ * steps.ts), so the read is one primary key; the posture is open source's
+ * edition only (compose.ts refuses a wider edition without sign-in), so
+ * every Organization is a row in this store.
+ *
+ * Arms, in order: an empty target id is `allow` (a platform-scoped write
+ * names no Organization, and the Authorize step maps a not-found on an
+ * empty id to INTERNAL); a kind other than the Organization is `allow`
+ * with no read; a missing Organization is `not-found`; a present one is
+ * `allow`. A store fault is `unavailable` with its cause, the built-in
+ * driver's guard: an outage is never softened into a refusal of a
+ * different kind, and the driver never throws.
+ *
+ * Proven by __tests__/trusted-local-authorizer.test.ts (the arms, on both
+ * store drivers) and extensions/__tests__/built-in-authorization-
+ * composed.test.ts (the wire, beside the same sentence under sign-in).
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
+import { ResourceNotFoundError } from "../store/interface.js";
+export function newTrustedLocalAuthorizer(deps) {
+    return {
+        async authorize(_caller, check) {
+            if (check.resourceKind !== ApiResourceKind.organization ||
+                check.resourceId === "") {
+                return { kind: "allow" };
+            }
+            try {
+                await deps.store.getResource(ApiResourceKind.organization, check.resourceId, OrganizationSchema);
+                return { kind: "allow" };
+            }
+            catch (error) {
+                if (error instanceof ResourceNotFoundError) {
+                    return { kind: "not-found" };
+                }
+                return {
+                    kind: "unavailable",
+                    cause: error instanceof Error ? error : new Error(String(error)),
+                };
+            }
+        },
+    };
+}
+//# sourceMappingURL=trusted-local-authorizer.js.map

package/dist/authorization/trusted-local-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-local-authorizer.js","sourceRoot":"","sources":["../../src/authorization/trusted-local-authorizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAO/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAU9D,MAAM,UAAU,yBAAyB,CACvC,IAAgC;IAEhC,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,KAAiB;YACxC,IACE,KAAK,CAAC,YAAY,KAAK,eAAe,CAAC,YAAY;gBACnD,KAAK,CAAC,UAAU,KAAK,EAAE,EACvB,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC3B,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAC1B,eAAe,CAAC,YAAY,EAC5B,KAAK,CAAC,UAAU,EAChB,kBAAkB,CACnB,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;gBAC/B,CAAC;gBACD,OAAO;oBACL,IAAI,EAAE,aAAa;oBACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;iBACjE,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/authorization/tuples.d.ts

@@ -78,6 +78,18 @@ export interface Person {
     /** Every string a creator stamp may carry for this person; always contains `accountId`. */
     readonly aliases: ReadonlySet<string>;
 }
+/**
+ * An object other than a person that a check asks about: "does
+ * `organization:o` hold `organization` on this agent", the question a
+ * grant to a team asks before it names the team on a resource. It matches
+ * a tuple's subject by its own reference, with no aliases.
+ */
+export interface ObjectPrincipal {
+    readonly object: ObjectRef;
+}
+/** Whom a check asks about: a person through their aliases, or any other object by its reference. */
+export type Principal = Person | ObjectPrincipal;
+export declare function isPerson(principal: Principal): principal is Person;
 /** `type:id` → ObjectRef; the id may itself contain `:` (issuer subjects do). */
 export declare function parseObjectRef(text: string): ObjectRef;
 export declare function formatObjectRef(object: ObjectRef): string;

package/dist/authorization/tuples.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tuples.d.ts","sourceRoot":"","sources":["../../src/authorization/tuples.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,8EAA8E;AAC9E,eAAO,MAAM,YAAY,qBAAqB,CAAC;AAE/C,0CAA0C;AAC1C,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,+CAA+C;AAC/C,MAAM,MAAM,OAAO;AACjB,4EAA4E;AAC1E;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAAE;AACzD,wEAAwE;GACtE;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEN,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;CAC9E;AAED,8GAA8G;AAC9G,MAAM,WAAW,SAAS;IACxB,oFAAoF;IACpF,IAAI,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;CACvD;AAED,yCAAyC;AACzC,MAAM,WAAW,MAAM;IACrB,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC;AAMD,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAMtD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAEzD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAgBlD;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAWtD;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAEhD;AAED,8DAA8D;AAC9D,wBAAgB,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,2FAA2F;AAC3F,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,GAC3B,WAAW,CAgBb"}
+{"version":3,"file":"tuples.d.ts","sourceRoot":"","sources":["../../src/authorization/tuples.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,8EAA8E;AAC9E,eAAO,MAAM,YAAY,qBAAqB,CAAC;AAE/C,0CAA0C;AAC1C,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,+CAA+C;AAC/C,MAAM,MAAM,OAAO;AACjB,4EAA4E;AAC1E;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAAE;AACzD,wEAAwE;GACtE;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEN,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;CAC9E;AAED,8GAA8G;AAC9G,MAAM,WAAW,SAAS;IACxB,oFAAoF;IACpF,IAAI,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;CACvD;AAED,yCAAyC;AACzC,MAAM,WAAW,MAAM;IACrB,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;CAC5B;AAED,qGAAqG;AACrG,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,eAAe,CAAC;AAEjD,wBAAgB,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,IAAI,MAAM,CAElE;AAMD,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAMtD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAEzD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAgBlD;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAWtD;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAEhD;AAED,8DAA8D;AAC9D,wBAAgB,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,2FAA2F;AAC3F,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,GAC3B,WAAW,CAgBb"}

package/dist/authorization/tuples.js

@@ -1,5 +1,8 @@
 /** The FGA type name of the kind every person is: `identity_account:<id>`. */
 export const ACCOUNT_TYPE = "identity_account";
+export function isPerson(principal) {
+    return "accountId" in principal;
+}
 // ---------------------------------------------------------------------------
 // The string notation.
 // ---------------------------------------------------------------------------

package/dist/authorization/tuples.js.map

@@ -1 +1 @@
-{"version":3,"file":"tuples.js","sourceRoot":"","sources":["../../src/authorization/tuples.ts"],"names":[],"mappings":"AA+BA,8EAA8E;AAC9E,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAqD/C,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC/C,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAC3C,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;SAC/B,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,wDAAwD,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzC,KAAK,SAAS;YACZ,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QAClE,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,KAAY;IACtC,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,OAAO,CAAC,MAAiB,EAAE,QAAgB;IACzD,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;AAClD,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,sBAAsB,CACpC,MAA4B;IAE5B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO;QACL,QAAQ,CAAC,MAAM,EAAE,QAAQ;YACvB,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"tuples.js","sourceRoot":"","sources":["../../src/authorization/tuples.ts"],"names":[],"mappings":"AA+BA,8EAA8E;AAC9E,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAkE/C,MAAM,UAAU,QAAQ,CAAC,SAAoB;IAC3C,OAAO,WAAW,IAAI,SAAS,CAAC;AAClC,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC/C,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAC3C,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;SAC/B,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,wDAAwD,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzC,KAAK,SAAS;YACZ,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QAClE,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,KAAY;IACtC,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,OAAO,CAAC,MAAiB,EAAE,QAAgB;IACzD,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;AAClD,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,sBAAsB,CACpC,MAA4B;IAE5B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO;QACL,QAAQ,CAAC,MAAM,EAAE,QAAQ;YACvB,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/boot/compose.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../src/boot/compose.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AA6BpE,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AAIzE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAsCzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AA2ClE,OAAO,EAKL,aAAa,EAEd,MAAM,6BAA6B,CAAC;AA2BrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AASnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAWjE,OAAO,EAAE,YAAY,IAAI,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAW7G,OAAO,EAAE,WAAW,EAAyB,MAAM,wBAAwB,CAAC;AAS5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIhD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,WAAW,CAAC;IACzB,+EAA+E;IAC/E,KAAK,EAAE,KAAK,CAAC;IACb;;;;;;;;;OASG;IACH,OAAO,EAAE,aAAa,CAAC;IACvB;;;;;OAKG;IACH,eAAe,EAAE,eAAe,CAAC;IACjC;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IACrC;;;;OAIG;IACH,0BAA0B,EAAE,YAAY,CAAC;IACzC;;;;;OAKG;IACH,6BAA6B,EAAE,6BAA6B,CAAC;IAC7D;;;;;;;;;OASG;IACH,kBAAkB,EAAE,SAAS,CAAC;IAC9B;;;;;;;;OAQG;IACH,iBAAiB,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACnD;;;;;OAKG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IACxC,+EAA+E;IAC/E,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACzB,kEAAkE;IAClE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,UAAU,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC5C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CA4lDzB"}
+{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../src/boot/compose.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAoCpE,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AAIzE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAsCzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AA2ClE,OAAO,EAKL,aAAa,EAEd,MAAM,6BAA6B,CAAC;AAyBrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAYnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAWjE,OAAO,EAAE,YAAY,IAAI,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAW7G,OAAO,EAAE,WAAW,EAAyB,MAAM,wBAAwB,CAAC;AAS5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIhD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,WAAW,CAAC;IACzB,+EAA+E;IAC/E,KAAK,EAAE,KAAK,CAAC;IACb;;;;;;;;;OASG;IACH,OAAO,EAAE,aAAa,CAAC;IACvB;;;;;OAKG;IACH,eAAe,EAAE,eAAe,CAAC;IACjC;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IACrC;;;;OAIG;IACH,0BAA0B,EAAE,YAAY,CAAC;IACzC;;;;;OAKG;IACH,6BAA6B,EAAE,6BAA6B,CAAC;IAC7D;;;;;;;;;OASG;IACH,kBAAkB,EAAE,SAAS,CAAC;IAC9B;;;;;;;;OAQG;IACH,iBAAiB,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACnD;;;;;OAKG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IACxC,+EAA+E;IAC/E,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACzB,kEAAkE;IAClE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,UAAU,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC5C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAirDzB"}

package/dist/boot/compose.js

@@ -29,11 +29,14 @@ import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/
 import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
 import { HealthCheckResponse_ServingStatus as ServingStatus } from "@stigmer/protos/grpc/health/v1/health_pb";
 import { newBuiltInAuthorizer } from "../authorization/authorizer.js";
-import { newLaneAdmittedAuthorizer } from "../authorization/lane-admission.js";
 import { newBuiltInListReadScope } from "../authorization/list-read-scope.js";
 import { newBuiltInOrganizationDirectory } from "../authorization/organization-directory.js";
-import { authorizationPostureOf } from "../authorization/posture.js";
+import { newBuiltInPolicyCheck } from "../authorization/policy-check.js";
+import { builtInModel } from "../authorization/model/index.js";
+import { authorizationPostureOf, kindsWithoutRows, } from "../authorization/posture.js";
+import { newStoreResourceCreators } from "../authorization/resource-creators.js";
 import { newBuiltInScheduleFireCaller } from "../authorization/schedule-fire-caller.js";
+import { newTrustedLocalAuthorizer } from "../authorization/trusted-local-authorizer.js";
 import { ABSENT_LICENSE_STATUS } from "../extensions/license-status.js";
 import { relaxedEgressPolicy } from "../extensions/outbound-egress.js";
 import { registerAgentServices } from "../domain/agent/controller.js";
@@ -115,13 +118,14 @@ import { SearchHandler } from "../query/search/handler.js";
 import { SqliteSearchQueryStore } from "../query/search/query-store.js";
 import { newSearchableResourceRegistry } from "../query/search/registry.js";
 import { initRpcMetrics, metricsExportPosture, } from "../observability/rpc-metrics.js";
+import { kindEnumName } from "../pipeline/apiresource-meta.js";
+import { quoteJoin } from "../domain/mcpserver/enabledtools/enabledtools.js";
 import { buildInterceptorChain } from "../pipeline/chain.js";
 import { createVerifierChainInterceptor } from "../pipeline/interceptors/auth.js";
 import { operatorIdentitySnapshot } from "../pipeline/steps/defaults.js";
 import { createErrorBoundaryInterceptor } from "../pipeline/interceptors/error-boundary.js";
 import { createRequestMetricsInterceptor } from "../pipeline/interceptors/request-metrics.js";
-import { newPermissiveSingleTeamAuthorizer } from "../pipeline/steps/authorize.js";
-import { isWorkflowBoundRunner, newBuiltInRunnerCredentialProvider, } from "../runnerauth/built-in-runner-credential-provider.js";
+import { newBuiltInRunnerCredentialProvider } from "../runnerauth/built-in-runner-credential-provider.js";
 import { newExecutionScopedRunnerCredentialProvider } from "../runnerauth/runner-credential-provider.js";
 import { newRunnerSubjectIdentityVerifier } from "../runnerauth/runner-subject-verifier.js";
 import { RunnerAuthService } from "../runnerauth/runnerauth.js";
@@ -130,7 +134,7 @@ import { SqliteStore } from "../store/sqlite/store.js";
 import { resolveExtensions } from "../extensions/registry.js";
 import { artifactLaneBindError, resolveArtifactLanePort, resolveArtifactServeUrl, } from "./artifact-lane.js";
 import { resolveOAuthRedirectUri } from "./oauth-redirect-uri.js";
-import { assessSkillTransferOrigin } from "./skill-transfer-origin.js";
+import { assessSkillTransferOrigin, resolveSkillTransferBaseUrl, } from "./skill-transfer-origin.js";
 import { registerWorkflowServices } from "../domain/workflow/controller.js";
 import { bundledModelRegistryDocument, bundledTaskKindRegistryDocument, } from "../domain/workflow/registry/bundled.js";
 import { ModelRegistryStore } from "../domain/workflow/registry/model-registry-store.js";
@@ -208,23 +212,36 @@ export async function composeServer(options) {
     // authorizer, so the identity stage installs the built-in role
     // lifecycle and the membership rules under both; a composition with its
     // own Authorizer has its own onboarding and gets neither.
+    // An edition above open source serves many organizations; without the
+    // require-authentication posture a request carrying no credential would
+    // act as the laptop's one operator on every one of them. Refused at boot,
+    // before any side effect, whichever authorizer the composition runs.
+    if (!requireAuthentication && extensions.edition !== ServerEdition.oss) {
+        throw new Error(`the composition serves edition '${ServerEdition[extensions.edition]}' without the require-authentication posture — an edition above open source must sign its callers in: declare requireAuthentication on a unit that registers a verifier, or configure STIGMER_OIDC_ISSUER`);
+    }
     const authorizationPosture = authorizationPostureOf({
         unitAuthorizer: extensions.authorizer !== undefined,
         requireAuthentication,
     });
     const builtInAuthorization = authorizationPosture !== "unit-authorizer";
     // The built-in authorizer evaluates the one model every edition reads,
-    // but it derives each resource's tuples from the rows in this server's
-    // store. A wider edition's kinds are served by extensions that keep
-    // their rows in stores of their own, which the built-in tuple source
-    // cannot read, so a composition that serves a wider edition must bring
-    // its own Authorizer rather than get answers derived from rows that are
-    // not there. Refused at boot, the same class as a misconfigured
-    // registry and the verifierless posture below: caught before any side
-    // effect.
-    if (authorizationPosture === "built-in" &&
-        extensions.edition !== ServerEdition.oss) {
-        throw new Error(`the composition serves edition '${ServerEdition[extensions.edition]}' under the require-authentication posture but registers no Authorizer — the built-in authorizer enforces the open-source kinds only; register an Authorizer or serve the open-source edition`);
+    // and derives each resource's tuples from its row. A wider edition's
+    // kinds are served by units that keep their rows in stores of their own,
+    // so each such unit registers a reader for its kinds
+    // (drivers.resourceRowReaders), and the built-in posture serves a wider
+    // edition only when every kind it serves has rows the derivation can
+    // read — never answers derived from rows that are not there. Refused at
+    // boot, the same class as a misconfigured registry and the verifierless
+    // posture below: caught before any side effect.
+    if (authorizationPosture === "built-in") {
+        const unreadable = kindsWithoutRows({
+            edition: extensions.edition,
+            model: builtInModel,
+            readers: extensions.drivers.resourceRowReaders,
+        });
+        if (unreadable.length > 0) {
+            throw new Error(`the composition serves edition '${ServerEdition[extensions.edition]}' under the built-in authorizer but registers no row reader for ${quoteJoin(unreadable.map(kindEnumName))} — register a reader for each kind a unit serves (drivers.resourceRowReaders), or register an Authorizer`);
+        }
     }
     // Stage: identity accounts (20260911.11) — the first domain whose
     // persistence is a PORT rather than the generic Store. The composed
@@ -255,6 +272,7 @@ export async function composeServer(options) {
         newResourcePlatformClientStore(store);
     const iamPolicyGrantPath = newIamPolicyGrantPath({
         policies: iamPolicies,
+        creators: newStoreResourceCreators(store),
         lifecycle: extensions.drivers.resourceAuthorizationLifecycle,
         logger,
     });
@@ -307,15 +325,13 @@ export async function composeServer(options) {
     // source's built-in provider (runnerauth/built-in-runner-credential-
     // provider.ts — the execution-scoped default plus the lineage-vouching,
     // memory-capture and exchange-gating capabilities an enforcing
-    // self-host needs, and the one reading of a runner's binding the
-    // Authorizer below admits a workflow-bound runner on); otherwise the
+    // self-host needs); otherwise the
     // execution-scoped default, byte-identical to the wiring this seam
     // replaced. Both open-source providers also mint the RUN credential the
     // two execution engines put on every dispatch (the engines below take
     // this object; runnerauth/dispatch-credential.ts) — a composed driver
     // that leaves that capability undefined dispatches without one, its
-    // runners being credentialed another way. Bound HERE, before the
-    // Authorizer, because the lane admission reads the binding.
+    // runners being credentialed another way.
     const runnerAuthService = RunnerAuthService.fromEnv();
     const runnerCredentials = extensions.drivers.runnerCredentialProvider ??
         (authorizationPosture === "built-in"
@@ -330,32 +346,37 @@ export async function composeServer(options) {
     // controller as an explicit dependency; the Authorize step at position 1
     // of every chain calls it (O2). By posture: an extension's registration;
     // open source's built-in Authorizer (authorization/authorizer.ts — the
-    // cloud's model evaluated over the tuples the row would have had),
-    // decorated with the lane admission (authorization/lane-admission.ts) so
-    // a runner acting for a WORKFLOW execution passes the run gate on the
-    // child executions its `agent_call` creates — the parent workflow
-    // already passed its own, the cloud's `workflow_sandbox` posture; or
-    // the permissive single-team default. The organization directory and the
+    // cloud's model evaluated over the tuples the row would have had), which
+    // checks every caller on the run gate as the person it acts for: a
+    // runner acting for a workflow creates the workflow's child executions
+    // as the workflow's person, who must be able to view the agents the
+    // workflow calls (the runner's own read of each callee already asks
+    // that); or, trusted-local, open source's permissive driver
+    // (authorization/trusted-local-authorizer.ts), which separates no callers
+    // and answers only whether a named Organization exists, as the other two
+    // do (stigmer#1163). The organization directory and the
     // schedule fire caller are bound beside it under the same posture, so
     // `findMyOrganizations` lists what a person may view and a scheduled run
     // belongs to the person who scheduled it — a fire the internal lane
     // would otherwise hand to nobody an enforcing evaluator recognizes.
     const authorizer = extensions.authorizer ??
         (authorizationPosture === "built-in"
-            ? newLaneAdmittedAuthorizer(newBuiltInAuthorizer({
+            ? newBuiltInAuthorizer({
                 store,
                 policies: iamPolicies,
                 accounts: identityAccounts,
+                rowReaders: extensions.drivers.resourceRowReaders,
                 edition: extensions.edition,
                 logger,
-            }), (caller) => isWorkflowBoundRunner(runnerAuthService, caller))
-            : newPermissiveSingleTeamAuthorizer());
+            })
+            : newTrustedLocalAuthorizer({ store }));
     const organizationDirectory = extensions.drivers.organizationDirectory ??
         (authorizationPosture === "built-in"
             ? newBuiltInOrganizationDirectory({
                 store,
                 policies: iamPolicies,
                 accounts: identityAccounts,
+                rowReaders: extensions.drivers.resourceRowReaders,
             })
             : undefined);
     const scheduleFireCaller = extensions.drivers.scheduleFireCaller ??
@@ -376,6 +397,7 @@ export async function composeServer(options) {
                 store,
                 policies: iamPolicies,
                 accounts: identityAccounts,
+                rowReaders: extensions.drivers.resourceRowReaders,
                 logger,
             })
             : undefined);
@@ -561,6 +583,7 @@ export async function composeServer(options) {
     const sandboxProvisioner = newSandboxProvisioner(config.sandboxProvisionerType, {
         config: {
             backendEndpoint: config.sandboxBackendEndpoint,
+            mcpPublicEndpoint: config.sandboxMcpPublicEndpoint,
             temporalAddress: config.sandboxTemporalAddress,
             temporalNamespace: config.temporalNamespace,
             temporalConnectionEnv: temporalConnectionEnv(config.temporalConnection),
@@ -773,6 +796,20 @@ export async function composeServer(options) {
     // controllers cannot tell which. The slots are constructed on every
     // arm so the HTTP lane always has a registry to consult; on a bucket
     // arm nothing is ever reserved in it.
+    //
+    // Both URLs render from one base (boot/skill-transfer-origin.ts): the
+    // configured SKILL_TRANSFER_BASE_URL, or the unified port's loopback
+    // origin, read from the port the listener actually bound in start() when
+    // that port is ephemeral (stigmer#1386).
+    let unifiedBoundPort;
+    const skillTransferBase = resolveSkillTransferBaseUrl({
+        configured: config.skillTransferBaseUrl,
+        unifiedPort: options.portOverride ?? config.grpcPort,
+        boundPort: () => unifiedBoundPort,
+    });
+    const renderSkillTransferBase = () => typeof skillTransferBase === "function"
+        ? skillTransferBase()
+        : skillTransferBase;
     const skillUploadSlots = new UploadSlots(config.storagePath, STAGING_KEY_PREFIX, DEFAULT_SLOT_TTL_MS, MAX_ZIP_SIZE);
     const skillType = config.skillArtifactStorageType === ""
         ? "local"
@@ -792,11 +829,13 @@ export async function composeServer(options) {
             // key, so download(key) reads back what the lane received; the
             // serve URL is the lane's download route, so getSignedUrl renders
             // the very URL the lane dispatches.
-            return new LocalArtifactStorage(config.storagePath, transferServeUrl(config.skillTransferBaseUrl), {
+            return new LocalArtifactStorage(config.storagePath, typeof skillTransferBase === "function"
+                ? () => transferServeUrl(skillTransferBase())
+                : transferServeUrl(skillTransferBase), {
                 reserve: (key, declaredSizeBytes) => {
                     const { ttlMs } = skillUploadSlots.reserve(key, declaredSizeBytes);
                     return {
-                        url: skillUploadUrl(config.skillTransferBaseUrl, uploadRefOf(key)),
+                        url: skillUploadUrl(renderSkillTransferBase(), uploadRefOf(key)),
                         ttlMs,
                     };
                 },
@@ -832,7 +871,7 @@ export async function composeServer(options) {
     // inline push and every other RPC work, and a self-host behind a tunnel
     // it forgot to name deserves a pointer, not an outage.
     const transferOrigin = assessSkillTransferOrigin({
-        baseUrl: config.skillTransferBaseUrl,
+        configured: config.skillTransferBaseUrl,
         relaysThroughServer: skillType === "local",
         requireAuthentication,
     });
@@ -918,14 +957,17 @@ export async function composeServer(options) {
         logger,
     });
     // The OAuth callback: configured, or derived from the served console's
-    // own origin when it serves one on a known port (boot/oauth-redirect-uri.ts
-    // carries the posture). Absent is WARN-degrade, not boot-fatal (Go
+    // own origin when it serves one — the public origin the skill transfer
+    // lane already renders on, else the known port's loopback
+    // (boot/oauth-redirect-uri.ts carries the posture; stigmer#1200). Absent
+    // is WARN-degrade, not boot-fatal (Go
     // server.go:722-729): every OAuth RPC except initiateOAuthConnect works
     // without the redirect URI, and initiate refuses with the pinned
     // FailedPrecondition copy.
     const oauthRedirect = resolveOAuthRedirectUri({
         configured: config.oauthRedirectUri,
         servesConsole: consoleAssets !== undefined,
+        publicOrigin: config.skillTransferBaseUrl,
         port: options.portOverride ?? config.grpcPort,
     });
     switch (oauthRedirect.kind) {
@@ -934,6 +976,7 @@ export async function composeServer(options) {
         case "derived":
             logger.info("STIGMER_OAUTH_REDIRECT_URI is not set — deriving the served console's callback for MCP server OAuth Connect", {
                 redirectUri: oauthRedirect.uri,
+                from: oauthRedirect.from,
             });
             break;
         case "absent":
@@ -1150,6 +1193,7 @@ export async function composeServer(options) {
             authorizer,
             secretService,
             authorizationLifecycle,
+            listReadScope,
         });
         // Schedule registers between channelapp and memory (Go server.go
         // 417 → 426 → 436). The clock and runner ride constant providers —
@@ -1182,6 +1226,7 @@ export async function composeServer(options) {
             authorizationLifecycle,
             listReadScope,
             personAccounts,
+            visitorClassifier: extensions.drivers.visitorClassifier,
             runnerCredentialProvider: runnerCredentials,
             broker: agentExecutionStreamBroker,
             engineState: executionEngineState,
@@ -1283,6 +1328,7 @@ export async function composeServer(options) {
                 pendingOAuthStates: store.pendingOAuthStates,
                 secretService,
                 oauthRedirectUri,
+                sandboxLane,
                 outboundFetch,
             },
         });
@@ -1366,10 +1412,12 @@ export async function composeServer(options) {
     //     the issuer left a posture-declaring composition minting keys
     //     nothing verified.
     //   - the OIDC verifier rides the ISSUER alone: it is open source's
-    //     single-issuer lane, and a composition with verifiers of its own
-    //     names their issuers and audiences itself and declares the posture
-    //     instead — so the knob and the extension entries never both claim
-    //     one JWT.
+    //     operator lane, and it claims only tokens its issuer signed
+    //     (identity/oidc-verifier.ts), passing every other JWT on. So the
+    //     knob and a composition's own lanes for other issuers compose side
+    //     by side: the operator signs in through the knob, and a unit's lane
+    //     claims the tokens of the issuers it names. A unit lane must refuse
+    //     to route the operator's issuer (it is claimed here first).
     //   - both OSS verifiers resolve their subject through the identity-
     //     account domain (20260911.11 Q-IA-2, A6): a provisioned user is
     //     stamped with the account id whichever credential they present,
@@ -1382,11 +1430,13 @@ export async function composeServer(options) {
     //     admits the bearer of the server's own execution-scoped runner
     //     token as the human whose run it is, which only means something
     //     when the server enforces who may report on a run. Its place in
-    //     the chain is the contract: BETWEEN `apikey` and `oidc`, because
-    //     the OIDC verifier claims any JWT-shaped token and throws on one
-    //     it cannot verify — composed after it, ours would never see its
-    //     own token, and every runner call would fail as the OIDC verifier's
-    //     fault (stigmer#1137). Until 2026-09-16 this comment read "the
+    //     the chain is the contract: BETWEEN `apikey` and `oidc`. Until
+    //     2026-09-29 the OIDC verifier claimed any JWT-shaped token and threw
+    //     on one it could not verify, so composed after it, ours never saw
+    //     its own token and every runner call failed as the OIDC verifier's
+    //     fault (stigmer#1137); it now claims only its own issuer's tokens,
+    //     and the server's own token is still claimed first, by its own
+    //     lane, whatever issuer an operator configures. Until 2026-09-16 this comment read "the
     //     runner's credential in either posture is an operator-minted API
     //     token via STIGMER_TOKEN — no runner-specific verifier"; that
     //     described a server whose Authorizer was permissive. The operator's
@@ -1497,6 +1547,30 @@ export async function composeServer(options) {
         skillTransferLane,
         consoleLane,
     });
+    // The hand-over (extensions/composed-services.ts): every unit receives
+    // the composition's own instances — the one Authorizer the Authorize
+    // step calls, the list read scope, the policy check, the tuple lifecycle
+    // and the in-process transport — before composeServer returns, because a
+    // unit's lanes may be called by anyone from then on. The policy check is
+    // the registered engine's, or under the built-in posture the evaluator's.
+    const composedServices = {
+        authorizer,
+        listReadScope,
+        authorizationQueries: extensions.drivers.authorizationQueries ??
+            (authorizationPosture === "built-in"
+                ? newBuiltInPolicyCheck({
+                    store,
+                    policies: iamPolicies,
+                    accounts: identityAccounts,
+                    rowReaders: extensions.drivers.resourceRowReaders,
+                })
+                : undefined),
+        resourceAuthorizationLifecycle: authorizationLifecycle,
+        inProcessTransport: inProcessWiring.transport,
+    };
+    for (const { hook } of extensions.onComposed) {
+        hook(composedServices);
+    }
     return {
         healthState,
         store,
@@ -1509,6 +1583,18 @@ export async function composeServer(options) {
         identityVerifiers,
         routes,
         async start() {
+            // The units' own boot work first, in unit order, before any worker,
+            // reconciler or listener can reach their lanes: a repair of a unit's
+            // rows must finish before anything serves, and a failed one fails
+            // the start, naming its unit.
+            for (const { unit, hook } of extensions.start) {
+                try {
+                    await hook();
+                }
+                catch (error) {
+                    throw new Error(`extension '${unit}' failed to start: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+                }
+            }
             // Temporal boot is NON-fatal end to end (Go server.go): a failed
             // initial connect leaves the engine unavailable and the monitor
             // retrying; a failed worker start is a warning. Health below flips
@@ -1576,6 +1662,10 @@ export async function composeServer(options) {
             // that implementation owns its own freshness.
             ossModelRegistryStore?.startRefresh();
             const port = await server.listen(options.portOverride ?? config.grpcPort, options.host);
+            // Recorded in the listen continuation, a microtask that runs before
+            // the first accepted connection is dispatched, so no wire request
+            // can mint a skill transfer URL before the port it names is known.
+            unifiedBoundPort = port;
             logger.info("stigmer-server listening", { port });
             return port;
         },