@stigmer/server 3.14.0-dev.20260910084630 → 3.14.1

package/dist/domain/workflowexecution/run-target.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The workflow-execution run-target resolver (P1 sp.run-gate): the chain's
+ * own precedence — an explicit workflow_instance_id fully names the target
+ * (CreateDefaultInstanceIfNeeded returns early on it):
+ * workflow_instance#can_execute; else workflow_id names the blueprint whose
+ * default instance the chain resolves (or mints) only AFTER the gate:
+ * workflow#can_execute (the model derives the default instance's viewers
+ * from the blueprint's, so asking the blueprint's question is what lets the
+ * gate precede the side effect).
+ *
+ * Neither set is ValidateWorkflowOrInstance's INVALID_ARGUMENT, thrown
+ * before this resolver runs — never a check. Pure over the record being
+ * built.
+ */
+import type { WorkflowExecution } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
+import { type RunTarget } from "../../pipeline/steps/authorize-run-target.js";
+export declare function workflowExecutionRunTarget(execution: WorkflowExecution): RunTarget | undefined;
+//# sourceMappingURL=run-target.d.ts.map

package/dist/domain/workflowexecution/run-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-target.d.ts","sourceRoot":"","sources":["../../../src/domain/workflowexecution/run-target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gEAAgE,CAAC;AAExG,OAAO,EAEL,KAAK,SAAS,EACf,MAAM,8CAA8C,CAAC;AAMtD,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,iBAAiB,GAC3B,SAAS,GAAG,SAAS,CAmBvB"}

package/dist/domain/workflowexecution/run-target.js

@@ -0,0 +1,23 @@
+import { RUN_GATE_CHECKS, } from "../../pipeline/steps/authorize-run-target.js";
+import { runWorkflowDeniedMessage, runWorkflowInstanceDeniedMessage, } from "./constants.js";
+export function workflowExecutionRunTarget(execution) {
+    const spec = execution.spec;
+    const workflowInstanceId = spec?.workflowInstanceId ?? "";
+    if (workflowInstanceId !== "") {
+        return {
+            ...RUN_GATE_CHECKS.workflowInstance,
+            resourceId: workflowInstanceId,
+            deniedMessage: runWorkflowInstanceDeniedMessage(workflowInstanceId),
+        };
+    }
+    const workflowId = spec?.workflowId ?? "";
+    if (workflowId !== "") {
+        return {
+            ...RUN_GATE_CHECKS.workflow,
+            resourceId: workflowId,
+            deniedMessage: runWorkflowDeniedMessage(workflowId),
+        };
+    }
+    return undefined;
+}
+//# sourceMappingURL=run-target.js.map

package/dist/domain/workflowexecution/run-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-target.js","sourceRoot":"","sources":["../../../src/domain/workflowexecution/run-target.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,eAAe,GAEhB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,wBAAwB,EACxB,gCAAgC,GACjC,MAAM,gBAAgB,CAAC;AAExB,MAAM,UAAU,0BAA0B,CACxC,SAA4B;IAE5B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;IAC5B,MAAM,kBAAkB,GAAG,IAAI,EAAE,kBAAkB,IAAI,EAAE,CAAC;IAC1D,IAAI,kBAAkB,KAAK,EAAE,EAAE,CAAC;QAC9B,OAAO;YACL,GAAG,eAAe,CAAC,gBAAgB;YACnC,UAAU,EAAE,kBAAkB;YAC9B,aAAa,EAAE,gCAAgC,CAAC,kBAAkB,CAAC;SACpE,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC;IAC1C,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACtB,OAAO;YACL,GAAG,eAAe,CAAC,QAAQ;YAC3B,UAAU,EAAE,UAAU;YACtB,aAAa,EAAE,wBAAwB,CAAC,UAAU,CAAC;SACpD,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/index.d.ts

@@ -71,6 +71,7 @@ export { createVerifierChainInterceptor } from "./pipeline/interceptors/auth.js"
 export { authenticateBearerToken, parseBearerToken, } from "./pipeline/interceptors/auth.js";
 export { newPipeline } from "./pipeline/pipeline.js";
 export { newAuthorizeStep } from "./pipeline/steps/authorize.js";
+export { isRunGateCheck } from "./pipeline/steps/authorize-run-target.js";
 export { newValidateProtoStep } from "./pipeline/steps/validation.js";
 export type { Store } from "./store/interface.js";
 export { AuditNotFoundError, ResourceNotFoundError, } from "./store/interface.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,YAAY,EACV,QAAQ,EACR,SAAS,EACT,MAAM,EACN,aAAa,EACb,QAAQ,EACR,OAAO,GACR,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,4BAA4B,EAC5B,kBAAkB,EAClB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AASlC,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAOjE,YAAY,EACV,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAIzE,YAAY,EACV,0BAA0B,EAC1B,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAChD,YAAY,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAC3E,YAAY,EACV,aAAa,EACb,aAAa,GACd,MAAM,iCAAiC,CAAC;AAIzC,YAAY,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AASnF,YAAY,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAGlD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAKxD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAgBzC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAOjF,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAKtE,YAAY,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAK9B,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAWhE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,YAAY,EACV,eAAe,EACf,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAIrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,YAAY,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAMvE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAKjG,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AACrG,YAAY,EACV,wBAAwB,EAKxB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EAKxB,qBAAqB,GACtB,MAAM,4CAA4C,CAAC;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAcpC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAMzD,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAS9E,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAQrE,YAAY,EACV,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,0CAA0C,CAAC;AAOlD,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,YAAY,EACV,QAAQ,EACR,SAAS,EACT,MAAM,EACN,aAAa,EACb,QAAQ,EACR,OAAO,GACR,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,4BAA4B,EAC5B,kBAAkB,EAClB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AASlC,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAOjE,YAAY,EACV,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAIzE,YAAY,EACV,0BAA0B,EAC1B,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAChD,YAAY,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAC3E,YAAY,EACV,aAAa,EACb,aAAa,GACd,MAAM,iCAAiC,CAAC;AAIzC,YAAY,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AASnF,YAAY,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAGlD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAKxD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAgBzC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAOjF,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAKtE,YAAY,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAK9B,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAWhE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,YAAY,EACV,eAAe,EACf,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAIrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,YAAY,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAMvE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAKjG,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AACrG,YAAY,EACV,wBAAwB,EAKxB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EAKxB,qBAAqB,GACtB,MAAM,4CAA4C,CAAC;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAcpC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAMzD,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAS9E,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAQrE,YAAY,EACV,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,0CAA0C,CAAC;AAOlD,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -88,6 +88,13 @@ export { createVerifierChainInterceptor } from "./pipeline/interceptors/auth.js"
 export { authenticateBearerToken, parseBearerToken, } from "./pipeline/interceptors/auth.js";
 export { newPipeline } from "./pipeline/pipeline.js";
 export { newAuthorizeStep } from "./pipeline/steps/authorize.js";
+// The run gate's check set (P1 sp.run-gate): an edition's Authorizer keys
+// its lane admission on this predicate — the runtime lanes it mints (a
+// guest share, a channel, a schedule fire, a workflow sandbox) were
+// admitted upstream by their own gate steps and are not re-asked here.
+// OSS defines the gate, so OSS defines which checks are the gate; a
+// composition never re-derives the set.
+export { isRunGateCheck } from "./pipeline/steps/authorize-run-target.js";
 export { newValidateProtoStep } from "./pipeline/steps/validation.js";
 export { AuditNotFoundError, ResourceNotFoundError, } from "./store/interface.js";
 // The Postgres driver constructor (stigmer-cloud 20260910.04 ruling 4;

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,wCAAwC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA+DhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAkB3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAIlD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,yEAAyE;AACzE,+DAA+D;AAC/D,wEAAwE;AACxE,QAAQ;AACR,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,gEAAgE;AAChE,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,sEAAsE;AACtE,qEAAqE;AACrE,6DAA6D;AAC7D,iEAAiE;AACjE,wEAAwE;AACxE,iEAAiE;AACjE,yEAAyE;AACzE,+DAA+D;AAC/D,yEAAyE;AACzE,8DAA8D;AAC9D,wEAAwE;AACxE,uEAAuE;AACvE,mEAAmE;AACnE,2DAA2D;AAC3D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,+DAA+D;AAC/D,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,oEAAoE;AACpE,wEAAwE;AACxE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kDAAkD;AAClD,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAMtE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAM9B,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAO1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAQvE,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AAkBrG,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,qEAAqE;AACrE,6DAA6D;AAC7D,uEAAuE;AACvE,qEAAqE;AACrE,gEAAgE;AAChE,0EAA0E;AAC1E,qEAAqE;AACrE,uEAAuE;AACvE,iEAAiE;AACjE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AAepC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAE9E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,kDAAkD;AAClD,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AA0BrE,oEAAoE;AACpE,yEAAyE;AACzE,iDAAiD;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,wCAAwC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA+DhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAkB3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAIlD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,yEAAyE;AACzE,+DAA+D;AAC/D,wEAAwE;AACxE,QAAQ;AACR,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,gEAAgE;AAChE,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,sEAAsE;AACtE,qEAAqE;AACrE,6DAA6D;AAC7D,iEAAiE;AACjE,wEAAwE;AACxE,iEAAiE;AACjE,yEAAyE;AACzE,+DAA+D;AAC/D,yEAAyE;AACzE,8DAA8D;AAC9D,wEAAwE;AACxE,uEAAuE;AACvE,mEAAmE;AACnE,2DAA2D;AAC3D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,+DAA+D;AAC/D,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,oEAAoE;AACpE,wEAAwE;AACxE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kDAAkD;AAClD,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,0EAA0E;AAC1E,uEAAuE;AACvE,oEAAoE;AACpE,uEAAuE;AACvE,oEAAoE;AACpE,wCAAwC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAMtE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAM9B,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAO1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAQvE,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AAkBrG,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,qEAAqE;AACrE,6DAA6D;AAC7D,uEAAuE;AACvE,qEAAqE;AACrE,gEAAgE;AAChE,0EAA0E;AAC1E,qEAAqE;AACrE,uEAAuE;AACvE,iEAAiE;AACjE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AAepC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAE9E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,kDAAkD;AAClD,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AA0BrE,oEAAoE;AACpE,yEAAyE;AACzE,iDAAiD;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/pipeline/steps/authorize-run-target.d.ts

@@ -0,0 +1,105 @@
+/**
+ * AuthorizeRunTarget — the run gate (P1 sp.run-gate, 2026-09-11;
+ * stigmer-cloud#709): may this caller RUN what this record targets?
+ *
+ * Every create that starts or continues a run names a target — a blueprint
+ * (`agent`, `workflow`), an instance (`agent_instance`, `workflow_instance`)
+ * or a conversation (`session`) — and until this step nothing asked whether
+ * the caller may use it: session-create authorized only the organization's
+ * `can_create_session`, agent- and workflow-execution create are
+ * `is_skip_authorization`, and `can_execute` was defined on every blueprint
+ * and instance type of the FGA model and checked nowhere. The invariant the
+ * model states ("you can run what you can read") is enforced here.
+ *
+ * One shared step, one domain resolver: the shape of IndexSearch (a shared
+ * step over a domain extractor). The resolver is a PURE function of the
+ * record being built (`ctx.newState`, where the chain's own resolution
+ * steps write) that names the target and the domain's byte-pinned deny
+ * copy; this step hands it to authorizeResolvedResource — the ratified
+ * mid-chain resolved-id form (DD-007; the ListVersions and listByChannel
+ * precedent) for lanes the position-1 annotation cannot express. A
+ * resolver that answers no target makes NO check: the chain's own
+ * invariant guards (EnsureSessionOrAgentResolved,
+ * ValidateWorkflowOrInstance) own the shape-less arm, and this step never
+ * second-guesses them.
+ *
+ * Position, in every chain: immediately after the step that guarantees the
+ * target reference exists — before EnsureEngineAvailable (a denied caller
+ * learns nothing about engine state), before every gate slot, before every
+ * side effect the chain owns. The chains' own convention, Authorize before
+ * Validate, is what places it there.
+ *
+ * Admission has one owner per lane. This step asks for EVERY caller but the
+ * `internal` class (authorizeResolvedResource's contract): a direct
+ * principal is admitted by the Authorizer; a runtime lane (a guest share, a
+ * channel, a schedule fire, a workflow sandbox's child run) is admitted by
+ * the gate step that vouches for it, and the edition's Authorizer says so
+ * for the lanes it mints — the OSS chain stays policy-free. RUN_GATE_CHECKS
+ * is the one definition of "the run-gate checks" that such an Authorizer
+ * keys on (isRunGateCheck, exported on the barrel); the resolvers draw their
+ * (kind, permission) pairs from the same table, so the predicate cannot
+ * drift from what the step actually asks.
+ */
+import type { DescMessage, MessageShape } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import type { Authorizer, AuthzCheck } from "../../extensions/authorizer.js";
+import type { PipelineStep } from "../pipeline.js";
+/** One (kind, permission) pair the run gate asks about. */
+export interface RunGateCheck {
+    readonly permission: IamPermission;
+    readonly resourceKind: ApiResourceKind;
+}
+/**
+ * The run-gate check set — exactly the pairs a resolver can produce. Each
+ * is the FGA model's own relation for "may run this": `can_execute` on the
+ * blueprints and instances (`agent.fga` `can_execute: viewer`;
+ * `agent_instance.fga` `can_execute: can_view`; the workflow twins), and
+ * `can_create_execution_in` on a session (`session.fga`: adding a turn to a
+ * conversation is the session's own permission, not the agent's).
+ */
+export declare const RUN_GATE_CHECKS: {
+    readonly agent: {
+        readonly permission: IamPermission.can_execute;
+        readonly resourceKind: ApiResourceKind.agent;
+    };
+    readonly agentInstance: {
+        readonly permission: IamPermission.can_execute;
+        readonly resourceKind: ApiResourceKind.agent_instance;
+    };
+    readonly session: {
+        readonly permission: IamPermission.can_create_execution_in;
+        readonly resourceKind: ApiResourceKind.session;
+    };
+    readonly workflow: {
+        readonly permission: IamPermission.can_execute;
+        readonly resourceKind: ApiResourceKind.workflow;
+    };
+    readonly workflowInstance: {
+        readonly permission: IamPermission.can_execute;
+        readonly resourceKind: ApiResourceKind.workflow_instance;
+    };
+};
+/**
+ * Whether `check` is one of the run gate's — the predicate an edition's
+ * Authorizer keys its lane admission on. Reads only the pair (an AuthzCheck
+ * is one); the resource id is the target's identity, not part of the
+ * question.
+ */
+export declare function isRunGateCheck(check: RunGateCheck | AuthzCheck): boolean;
+/**
+ * A resolved run target: the check plus the domain's byte-pinned deny copy
+ * for it (the lane's error_msg, in the position-1 annotation's terms).
+ */
+export interface RunTarget extends RunGateCheck {
+    readonly resourceId: string;
+    readonly deniedMessage: string;
+}
+/**
+ * Names a record's run target, or `undefined` when the record names none
+ * (a state the chain's own guards refuse; never this step's arm). Pure over
+ * the record being built — no store, no clock, no caller.
+ */
+export type RunTargetResolver<Desc extends DescMessage> = (record: MessageShape<Desc>) => RunTarget | undefined;
+export declare function newAuthorizeRunTargetStep<Desc extends DescMessage>(authorizer: Authorizer, resolveRunTarget: RunTargetResolver<Desc>): PipelineStep<Desc>;
+//# sourceMappingURL=authorize-run-target.d.ts.map

package/dist/pipeline/steps/authorize-run-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-run-target.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/authorize-run-target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEpE,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAE1E,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAInD,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;CACxC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;CAqBqB,CAAC;AAKlD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,UAAU,GAAG,OAAO,CAMxE;AAED;;;GAGG;AACH,MAAM,WAAW,SAAU,SAAQ,YAAY;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,CAAC,IAAI,SAAS,WAAW,IAAI,CACxD,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,KACvB,SAAS,GAAG,SAAS,CAAC;AAE3B,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,UAAU,EAAE,UAAU,EACtB,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,GACxC,YAAY,CAAC,IAAI,CAAC,CAoBpB"}

package/dist/pipeline/steps/authorize-run-target.js

@@ -0,0 +1,61 @@
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { authorizeResolvedResource } from "./authorize.js";
+/**
+ * The run-gate check set — exactly the pairs a resolver can produce. Each
+ * is the FGA model's own relation for "may run this": `can_execute` on the
+ * blueprints and instances (`agent.fga` `can_execute: viewer`;
+ * `agent_instance.fga` `can_execute: can_view`; the workflow twins), and
+ * `can_create_execution_in` on a session (`session.fga`: adding a turn to a
+ * conversation is the session's own permission, not the agent's).
+ */
+export const RUN_GATE_CHECKS = {
+    agent: {
+        permission: IamPermission.can_execute,
+        resourceKind: ApiResourceKind.agent,
+    },
+    agentInstance: {
+        permission: IamPermission.can_execute,
+        resourceKind: ApiResourceKind.agent_instance,
+    },
+    session: {
+        permission: IamPermission.can_create_execution_in,
+        resourceKind: ApiResourceKind.session,
+    },
+    workflow: {
+        permission: IamPermission.can_execute,
+        resourceKind: ApiResourceKind.workflow,
+    },
+    workflowInstance: {
+        permission: IamPermission.can_execute,
+        resourceKind: ApiResourceKind.workflow_instance,
+    },
+};
+const RUN_GATE_CHECK_LIST = Object.values(RUN_GATE_CHECKS);
+/**
+ * Whether `check` is one of the run gate's — the predicate an edition's
+ * Authorizer keys its lane admission on. Reads only the pair (an AuthzCheck
+ * is one); the resource id is the target's identity, not part of the
+ * question.
+ */
+export function isRunGateCheck(check) {
+    return RUN_GATE_CHECK_LIST.some((candidate) => candidate.permission === check.permission &&
+        candidate.resourceKind === check.resourceKind);
+}
+export function newAuthorizeRunTargetStep(authorizer, resolveRunTarget) {
+    return {
+        name: "AuthorizeRunTarget",
+        async execute(ctx) {
+            const target = resolveRunTarget(ctx.newState);
+            if (target === undefined) {
+                return;
+            }
+            await authorizeResolvedResource(authorizer, ctx.callerIdentity, {
+                permission: target.permission,
+                resourceKind: target.resourceKind,
+                resourceId: target.resourceId,
+            }, target.deniedMessage);
+        },
+    };
+}
+//# sourceMappingURL=authorize-run-target.js.map

package/dist/pipeline/steps/authorize-run-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-run-target.js","sourceRoot":"","sources":["../../../src/pipeline/steps/authorize-run-target.ts"],"names":[],"mappings":"AA4CA,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAK1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAQ3D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,KAAK,EAAE;QACL,UAAU,EAAE,aAAa,CAAC,WAAW;QACrC,YAAY,EAAE,eAAe,CAAC,KAAK;KACpC;IACD,aAAa,EAAE;QACb,UAAU,EAAE,aAAa,CAAC,WAAW;QACrC,YAAY,EAAE,eAAe,CAAC,cAAc;KAC7C;IACD,OAAO,EAAE;QACP,UAAU,EAAE,aAAa,CAAC,uBAAuB;QACjD,YAAY,EAAE,eAAe,CAAC,OAAO;KACtC;IACD,QAAQ,EAAE;QACR,UAAU,EAAE,aAAa,CAAC,WAAW;QACrC,YAAY,EAAE,eAAe,CAAC,QAAQ;KACvC;IACD,gBAAgB,EAAE;QAChB,UAAU,EAAE,aAAa,CAAC,WAAW;QACrC,YAAY,EAAE,eAAe,CAAC,iBAAiB;KAChD;CAC8C,CAAC;AAElD,MAAM,mBAAmB,GACvB,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAgC;IAC7D,OAAO,mBAAmB,CAAC,IAAI,CAC7B,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QACzC,SAAS,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,CAChD,CAAC;AACJ,CAAC;AAoBD,MAAM,UAAU,yBAAyB,CACvC,UAAsB,EACtB,gBAAyC;IAEzC,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,MAAM,yBAAyB,CAC7B,UAAU,EACV,GAAG,CAAC,cAAc,EAClB;gBACE,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,EACD,MAAM,CAAC,aAAa,CACrB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/query/search/criteria.d.ts

@@ -5,7 +5,7 @@
  * discover).
  *
  * The searchable-kind set is DERIVED from the proto kind_meta extension
- * (not_search_indexed: false, tier != cloud_only) — Go's
+ * (not_search_indexed: false, tier == open_source) — Go's
  * SearchIndexedKinds() posture since stigmer/stigmer#439, where hand-copied
  * kind lists drifted from the proto and from each other. Go still carries a
  * hand map (SearchableKinds) pinned to the derivation by an invariant test;
@@ -13,6 +13,13 @@
  * registry unit test pins the registered extractors against this same
  * derivation (the #439 invariant's TS home).
  *
+ * The tier clause admits open_source alone, not "anything but cloud_only":
+ * the index is the core's, and a kind tiered enterprise (editions program,
+ * DD-001) must not enter it by accident. This derivation is edition-blind
+ * by design (the same code runs in every composition); an edition-aware
+ * derivation is a design act with a named trigger — the first searchable
+ * kind above open_source.
+ *
  * kinds are kept VERBATIM from the request; filtering to the searchable set
  * happens in effectiveKinds(). Keeping the raw request is what
  * distinguishes "no kinds requested" (discover mode) from "kinds requested
@@ -33,8 +40,8 @@ export declare const MAX_PAGE_SIZE = 100;
 export declare const MAX_QUERY_LENGTH = 500;
 /**
  * Go SearchIndexedKinds(): every kind this edition's search read side
- * serves — kind_meta declares it search-indexed and servable outside the
- * cloud. Sorted ascending by enum value, exactly Go's sort. Kinds whose
+ * serves — kind_meta declares it search-indexed and open_source-tier.
+ * Sorted ascending by enum value, exactly Go's sort. Kinds whose
  * kind_meta cannot be read are skipped (Go's contract; the registry unit
  * test separately fails on such a defect).
  */

package/dist/query/search/criteria.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"criteria.d.ts","sourceRoot":"","sources":["../../../src/query/search/criteria.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EACL,eAAe,EAGhB,MAAM,qFAAqF,CAAC;AAK7F,0BAA0B;AAC1B,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,sBAAsB;AACtB,eAAO,MAAM,aAAa,MAAM,CAAC;AACjC,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAKpC;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,SAAS,eAAe,EAAE,CAuB/D;AAUD;;GAEG;AACH,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAPhC,OAAO;IAUP;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,MAAM,CACX,KAAK,EAAE,SAAS,eAAe,EAAE,EACjC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,OAAO,EACtB,cAAc,EAAE,OAAO,EACvB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,cAAc;IAkBjB,oEAAoE;IACpE,KAAK,IAAI,SAAS,eAAe,EAAE;IAInC,KAAK,IAAI,MAAM;IAIf,SAAS,IAAI,MAAM;IAInB,aAAa,IAAI,OAAO;IAIxB,cAAc,IAAI,OAAO;IAIzB,UAAU,IAAI,MAAM;IAIpB,QAAQ,IAAI,MAAM;IAIlB;;;OAGG;IACH,cAAc,IAAI,OAAO;IAIzB,iEAAiE;IACjE,QAAQ,IAAI,OAAO;IAInB,YAAY,IAAI,OAAO;IAIvB;;;;;;OAMG;IACH,cAAc,IAAI,SAAS,eAAe,EAAE;IAQ5C,wDAAwD;IACxD,MAAM,IAAI,MAAM;CAGjB"}
+{"version":3,"file":"criteria.d.ts","sourceRoot":"","sources":["../../../src/query/search/criteria.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EACL,eAAe,EAGhB,MAAM,qFAAqF,CAAC;AAK7F,0BAA0B;AAC1B,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,sBAAsB;AACtB,eAAO,MAAM,aAAa,MAAM,CAAC;AACjC,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAKpC;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,SAAS,eAAe,EAAE,CAuB/D;AAUD;;GAEG;AACH,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAPhC,OAAO;IAUP;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,MAAM,CACX,KAAK,EAAE,SAAS,eAAe,EAAE,EACjC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,OAAO,EACtB,cAAc,EAAE,OAAO,EACvB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,cAAc;IAkBjB,oEAAoE;IACpE,KAAK,IAAI,SAAS,eAAe,EAAE;IAInC,KAAK,IAAI,MAAM;IAIf,SAAS,IAAI,MAAM;IAInB,aAAa,IAAI,OAAO;IAIxB,cAAc,IAAI,OAAO;IAIzB,UAAU,IAAI,MAAM;IAIpB,QAAQ,IAAI,MAAM;IAIlB;;;OAGG;IACH,cAAc,IAAI,OAAO;IAIzB,iEAAiE;IACjE,QAAQ,IAAI,OAAO;IAInB,YAAY,IAAI,OAAO;IAIvB;;;;;;OAMG;IACH,cAAc,IAAI,SAAS,eAAe,EAAE;IAQ5C,wDAAwD;IACxD,MAAM,IAAI,MAAM;CAGjB"}

package/dist/query/search/criteria.js

@@ -5,7 +5,7 @@
  * discover).
  *
  * The searchable-kind set is DERIVED from the proto kind_meta extension
- * (not_search_indexed: false, tier != cloud_only) — Go's
+ * (not_search_indexed: false, tier == open_source) — Go's
  * SearchIndexedKinds() posture since stigmer/stigmer#439, where hand-copied
  * kind lists drifted from the proto and from each other. Go still carries a
  * hand map (SearchableKinds) pinned to the derivation by an invariant test;
@@ -13,6 +13,13 @@
  * registry unit test pins the registered extractors against this same
  * derivation (the #439 invariant's TS home).
  *
+ * The tier clause admits open_source alone, not "anything but cloud_only":
+ * the index is the core's, and a kind tiered enterprise (editions program,
+ * DD-001) must not enter it by accident. This derivation is edition-blind
+ * by design (the same code runs in every composition); an edition-aware
+ * derivation is a design act with a named trigger — the first searchable
+ * kind above open_source.
+ *
  * kinds are kept VERBATIM from the request; filtering to the searchable set
  * happens in effectiveKinds(). Keeping the raw request is what
  * distinguishes "no kinds requested" (discover mode) from "kinds requested
@@ -37,8 +44,8 @@ let searchIndexedKindsCache;
 let searchableKindSetCache;
 /**
  * Go SearchIndexedKinds(): every kind this edition's search read side
- * serves — kind_meta declares it search-indexed and servable outside the
- * cloud. Sorted ascending by enum value, exactly Go's sort. Kinds whose
+ * serves — kind_meta declares it search-indexed and open_source-tier.
+ * Sorted ascending by enum value, exactly Go's sort. Kinds whose
  * kind_meta cannot be read are skipped (Go's contract; the registry unit
  * test separately fails on such a defect).
  */
@@ -57,7 +64,7 @@ export function searchIndexedKinds() {
             catch {
                 continue;
             }
-            if (meta.notSearchIndexed || meta.tier === ResourceTier.cloud_only) {
+            if (meta.notSearchIndexed || meta.tier !== ResourceTier.open_source) {
                 continue;
             }
             kinds.push(kind);

package/dist/query/search/criteria.js.map

@@ -1 +1 @@
-{"version":3,"file":"criteria.js","sourceRoot":"","sources":["../../../src/query/search/criteria.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,YAAY,GACb,MAAM,qFAAqF,CAAC;AAE7F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAEjE,0BAA0B;AAC1B,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,sBAAsB;AACtB,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AACjC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAEpC,IAAI,uBAA+D,CAAC;AACpE,IAAI,sBAAgE,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAsB,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,qBAAqB,CAAC,MAAM,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAyB,CAAC;YAC7C,IAAI,IAAI,KAAK,eAAe,CAAC,yBAAyB,EAAE,CAAC;gBACvD,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;gBACnE,SAAS;YACX,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,uBAAuB,GAAG,KAAK,CAAC;IAClC,CAAC;IACD,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAED,6EAA6E;AAC7E,SAAS,iBAAiB;IACxB,IAAI,sBAAsB,KAAK,SAAS,EAAE,CAAC;QACzC,sBAAsB,GAAG,IAAI,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,cAAc;IAEN;IACA;IACA;IACA;IACA;IACA;IACA;IAPnB,YACmB,cAA0C,EAC1C,SAAiB,EACjB,cAAsB,EACtB,iBAA0B,EAC1B,kBAA2B,EAC3B,eAAuB,EACvB,aAAqB;QANrB,mBAAc,GAAd,cAAc,CAA4B;QAC1C,cAAS,GAAT,SAAS,CAAQ;QACjB,mBAAc,GAAd,cAAc,CAAQ;QACtB,sBAAiB,GAAjB,iBAAiB,CAAS;QAC1B,uBAAkB,GAAlB,kBAAkB,CAAS;QAC3B,oBAAe,GAAf,eAAe,CAAQ;QACvB,kBAAa,GAAb,aAAa,CAAQ;IACrC,CAAC;IAEJ;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,MAAM,CACX,KAAiC,EACjC,KAAa,EACb,SAAiB,EACjB,aAAsB,EACtB,cAAuB,EACvB,UAAkB,EAClB,QAAgB;QAEhB,MAAM,eAAe,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,eAAe,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,0CAA0C,gBAAgB,aAAa,CACxE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,cAAc,CACvB,CAAC,GAAG,KAAK,CAAC,EACV,eAAe,EACf,WAAW,CAAC,SAAS,CAAC,EACtB,aAAa,EACb,cAAc,EACd,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAC/B,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CACrE,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,KAAK;QACH,OAAO,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IAClC,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,iEAAiE;IACjE,QAAQ;QACN,OAAO,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,cAAc,KAAK,EAAE,CAAC;IACpC,CAAC;IAED;;;;;;OAMG;IACH,cAAc;QACZ,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,kBAAkB,EAAE,CAAC;QAC9B,CAAC;QACD,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,wDAAwD;IACxD,MAAM;QACJ,OAAO,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC;IACzD,CAAC;CACF"}
+{"version":3,"file":"criteria.js","sourceRoot":"","sources":["../../../src/query/search/criteria.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,YAAY,GACb,MAAM,qFAAqF,CAAC;AAE7F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAEjE,0BAA0B;AAC1B,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,sBAAsB;AACtB,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AACjC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAEpC,IAAI,uBAA+D,CAAC;AACpE,IAAI,sBAAgE,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAsB,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,qBAAqB,CAAC,MAAM,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAyB,CAAC;YAC7C,IAAI,IAAI,KAAK,eAAe,CAAC,yBAAyB,EAAE,CAAC;gBACvD,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC,WAAW,EAAE,CAAC;gBACpE,SAAS;YACX,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,uBAAuB,GAAG,KAAK,CAAC;IAClC,CAAC;IACD,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAED,6EAA6E;AAC7E,SAAS,iBAAiB;IACxB,IAAI,sBAAsB,KAAK,SAAS,EAAE,CAAC;QACzC,sBAAsB,GAAG,IAAI,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,cAAc;IAEN;IACA;IACA;IACA;IACA;IACA;IACA;IAPnB,YACmB,cAA0C,EAC1C,SAAiB,EACjB,cAAsB,EACtB,iBAA0B,EAC1B,kBAA2B,EAC3B,eAAuB,EACvB,aAAqB;QANrB,mBAAc,GAAd,cAAc,CAA4B;QAC1C,cAAS,GAAT,SAAS,CAAQ;QACjB,mBAAc,GAAd,cAAc,CAAQ;QACtB,sBAAiB,GAAjB,iBAAiB,CAAS;QAC1B,uBAAkB,GAAlB,kBAAkB,CAAS;QAC3B,oBAAe,GAAf,eAAe,CAAQ;QACvB,kBAAa,GAAb,aAAa,CAAQ;IACrC,CAAC;IAEJ;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,MAAM,CACX,KAAiC,EACjC,KAAa,EACb,SAAiB,EACjB,aAAsB,EACtB,cAAuB,EACvB,UAAkB,EAClB,QAAgB;QAEhB,MAAM,eAAe,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,eAAe,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,0CAA0C,gBAAgB,aAAa,CACxE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,cAAc,CACvB,CAAC,GAAG,KAAK,CAAC,EACV,eAAe,EACf,WAAW,CAAC,SAAS,CAAC,EACtB,aAAa,EACb,cAAc,EACd,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAC/B,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CACrE,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,KAAK;QACH,OAAO,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IAClC,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,iEAAiE;IACjE,QAAQ;QACN,OAAO,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,cAAc,KAAK,EAAE,CAAC;IACpC,CAAC;IAED;;;;;;OAMG;IACH,cAAc;QACZ,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,kBAAkB,EAAE,CAAC;QAC9B,CAAC;QACD,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,wDAAwD;IACxD,MAAM;QACJ,OAAO,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC;IACzD,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/server",
-  "version": "3.14.0-dev.20260910084630",
+  "version": "3.14.1",
   "description": "The Stigmer OSS control plane as a composable library: composeServer, the extension registry and the driver seams a composition builds on. The self-contained deployable of the same server is @stigmer/server-slim.",
   "license": "Apache-2.0",
   "type": "module",
@@ -62,9 +62,9 @@
     "@connectrpc/connect-node": "^2.0.0",
     "@kubernetes/client-node": "2.0.0",
     "@opentelemetry/api": "^1.9.0",
-    "@stigmer/protos": "3.14.0-dev.20260910084630",
-    "@stigmer/temporal-codecs": "3.14.0-dev.20260910084630",
-    "@stigmer/zip-structure": "3.14.0-dev.20260910084630",
+    "@stigmer/protos": "3.14.1",
+    "@stigmer/temporal-codecs": "3.14.1",
+    "@stigmer/zip-structure": "3.14.1",
     "@temporalio/activity": "1.16.2",
     "@temporalio/client": "1.16.2",
     "@temporalio/common": "1.16.2",