@stigmer/server 3.14.0-dev.20260910084630

package/dist/domain/environment/steps.js

@@ -0,0 +1,445 @@
+/**
+ * Environment domain steps — port
+ * pkg/domain/environment/controller/steps/ (the create/update sentinel
+ * guard, the encrypt-at-rest step, personal-environment uniqueness, the
+ * single-key reveal extractor, the environment_id loader, and the two
+ * self-contained write-boundary steps for incremental variable management).
+ *
+ * The ordering contracts these steps embody (the cloud "sentinels →
+ * encrypt" doc, oss#395/oss#405):
+ *   1. PreserveRedactedSecrets runs BEFORE EncryptSecretValues — the
+ *      marker arm restores stored ciphertext, whose idempotent encrypt
+ *      pass-through must leave it unchanged (never double-encrypted).
+ *   2. Within the guard, the marker arm runs BEFORE the forged-ciphertext
+ *      arm — after preservation, legitimate stored ciphertext is present
+ *      by design and must not hit the forgery rejection.
+ *   3. Redaction (redact.ts) runs AFTER Persist, outside the pipeline.
+ *
+ * Proven by environment.conformance.test.ts (CONFORMANCE_TARGET=local)
+ * and __tests__/environment.test.ts.
+ */
+import { create } from "@bufbuild/protobuf";
+import { Code, ConnectError } from "@connectrpc/connect";
+import { EnvironmentSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
+import { EnvironmentSpecSchema, EnvironmentValueSchema, } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/spec_pb";
+import { isCiphertextShaped } from "../../encryption/encryption.js";
+import { EncryptionScope } from "../../encryption/encryption.js";
+import { internalError, invalidArgumentError, notFoundError, } from "../../pipeline/errors.js";
+import { setAuditFieldsForUpdate } from "../../pipeline/steps/defaults.js";
+import { findResourceByLabelAndOrg } from "../../pipeline/steps/helpers.js";
+import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
+import { TARGET_RESOURCE_KEY } from "../../pipeline/steps/load-target.js";
+import { destroySecretBackingState } from "../../pipeline/steps/secret-cleanup.js";
+import { PERSONAL_LABEL_KEY, PERSONAL_LABEL_VALUE, forgedCiphertextMessage, markerRejectionMessage, personalEnvironmentExistsMessage, REDACTED_MARKER, } from "./constants.js";
+/** Context key for the decrypted single-key result — Go SecretValueKey. */
+export const SECRET_VALUE_KEY = "secretValue";
+/**
+ * Context key for the modified environment after a merge/remove variables
+ * operation — Go UpdatedEnvironmentKey.
+ */
+export const UPDATED_ENVIRONMENT_KEY = "updatedEnvironment";
+/**
+ * PreserveRedactedSecrets — Go preserve_redacted_secrets.go. Handles
+ * client-supplied secret SENTINELS on write, serving both the create and
+ * full-resource update pipelines:
+ *
+ *   - A secret whose incoming value is the ***REDACTED*** marker is
+ *     restored from the existing resource (update). When there is nothing
+ *     to preserve — a create, or an update for a key that had no prior
+ *     secret — the marker is meaningless and rejected with
+ *     INVALID_ARGUMENT rather than stored literally.
+ *   - A secret carrying the ciphertext-shaped enc:v<N>: prefix is rejected
+ *     with INVALID_ARGUMENT (oss#395): the prefix is server-reserved. The
+ *     marker arm must run FIRST — after preservation, legitimate stored
+ *     ciphertext is present by design and must not hit this arm.
+ *   - Non-secret values pass through untouched. They are exempt from the
+ *     prefix rejection deliberately: every decrypt path gates on
+ *     is_secret && isEncrypted, so a non-secret prefixed string is inert,
+ *     and flipping it to secret later re-enters this guard.
+ *
+ * Runs while spec.data is still raw client input: after BuildUpdateState
+ * (update; requires LoadExisting) or after BuildNewState (create, where
+ * EXISTING_RESOURCE_KEY is absent and every marker is rejected).
+ */
+export function newPreserveRedactedSecretsStep() {
+    return {
+        name: "PreserveRedactedSecrets",
+        execute(ctx) {
+            const data = ctx.newState.spec?.data;
+            if (data === undefined || Object.keys(data).length === 0) {
+                return;
+            }
+            // Absent existing resource (the create pipeline) means there is
+            // nothing to preserve: fall through with an empty map so every
+            // marker is rejected instead of silently skipping the guards.
+            const existing = ctx.get(EXISTING_RESOURCE_KEY);
+            const existingData = existing?.spec?.data ?? {};
+            for (const [key, value] of Object.entries(data)) {
+                if (!value.isSecret) {
+                    continue;
+                }
+                if (value.value === REDACTED_MARKER) {
+                    const existingEntry = existingData[key];
+                    if (existingEntry !== undefined && existingEntry.isSecret) {
+                        data[key] = existingEntry;
+                        continue;
+                    }
+                    throw invalidArgumentError(markerRejectionMessage(key));
+                }
+                // Unconditional (not gated on encryption being enabled): the
+                // prefix is server-reserved regardless of key state.
+                if (isCiphertextShaped(value.value)) {
+                    throw invalidArgumentError(forgedCiphertextMessage(key));
+                }
+            }
+        },
+    };
+}
+/**
+ * EncryptSecretValues — Go encrypt_secret_values.go: encrypts every
+ * is_secret value in spec.data before persistence (oss#405 — environment
+ * secrets rested plaintext while oauthapp/channelapp secrets were
+ * encrypted in the same store).
+ *
+ * MUST run after PreserveRedactedSecrets ("sentinels → encrypt"): by this
+ * point every secret value is either fresh client plaintext (encrypt it)
+ * or marker-restored stored ciphertext (the idempotent pass-through leaves
+ * it unchanged, so a round-tripped secret is never double-encrypted).
+ *
+ * Keyless mode: values pass through plaintext with one WARN per request,
+ * emitted only when a non-empty secret would actually rest plaintext (the
+ * oss#394 convention shared with oauthapp and channelapp). Non-secret
+ * values are never touched: the decrypt paths gate on is_secret, so
+ * encrypting a non-secret value would strand it as unreadable ciphertext.
+ */
+export function newEncryptSecretValuesStep(secretService, logger) {
+    return {
+        name: "EncryptSecretValues",
+        async execute(ctx) {
+            const env = ctx.newState;
+            const data = env.spec?.data;
+            if (data === undefined || Object.keys(data).length === 0) {
+                return;
+            }
+            if (!secretService.isEnabled()) {
+                if (hasNonEmptySecret(data)) {
+                    logger.warn("Encryption disabled: environment secret values will be stored in plaintext", { environmentId: env.metadata?.id ?? "" });
+                }
+                return;
+            }
+            for (const [key, value] of Object.entries(data)) {
+                if (!value.isSecret || value.value === "") {
+                    continue;
+                }
+                try {
+                    // Tenancy-only scope, the pre-v3 write posture: environment is
+                    // an org-scoped kind, so metadata.org is validated non-empty
+                    // long before this step. The v1 codec ignores the scope; a
+                    // vault-backed write codec keys the per-org KEK by it.
+                    value.value = await secretService.encrypt(value.value, EncryptionScope.forOrganization(env.metadata?.org ?? ""));
+                }
+                catch (error) {
+                    throw internalError(error, `failed to encrypt secret value for variable '${key}'`);
+                }
+            }
+        },
+    };
+}
+/** Whether any entry would have been encrypted — keeps the WARN honest. */
+function hasNonEmptySecret(data) {
+    return Object.values(data).some((v) => v.isSecret && v.value !== "");
+}
+/**
+ * EnforcePersonalEnvUniqueness — Go enforce_personal_uniqueness.go: at
+ * most one personal environment (stigmer.ai/personal=true) per ORG →
+ * ALREADY_EXISTS. Non-personal environments are a no-op.
+ *
+ * Contract note: cloud enforces per (org, owner) — it also scopes by the
+ * creating identity. OSS has no caller identity yet (audit created_by is
+ * the "system" actor), so per-(org, owner) collapses to per-org here — a
+ * faithful specialization of the shared contract, not a divergence.
+ *
+ * Create-time only, before the resource has an id, so it never matches
+ * the in-flight resource against itself; update deliberately omits it.
+ */
+export function newEnforcePersonalUniquenessStep(store) {
+    return {
+        // The Go step's registered name — note "Env", not the type name.
+        name: "EnforcePersonalEnvUniqueness",
+        async execute(ctx) {
+            const metadata = ctx.newState.metadata;
+            if (metadata === undefined) {
+                return;
+            }
+            if (metadata.labels[PERSONAL_LABEL_KEY] !== PERSONAL_LABEL_VALUE) {
+                return;
+            }
+            let existing;
+            try {
+                existing = await findResourceByLabelAndOrg(store, ctx.apiResourceKind, EnvironmentSchema, PERSONAL_LABEL_KEY, PERSONAL_LABEL_VALUE, metadata.org);
+            }
+            catch (error) {
+                throw internalError(error, "failed to check personal environment uniqueness");
+            }
+            if (existing !== undefined) {
+                // Go raises this via status.Errorf(codes.AlreadyExists, "<copy>"),
+                // NOT the grpclib helper's "%s already exists: %s" format — the
+                // wire message is the bare pinned copy, so the ConnectError is
+                // constructed directly rather than through alreadyExistsError().
+                throw new ConnectError(personalEnvironmentExistsMessage(existing.metadata?.id ?? ""), Code.AlreadyExists);
+            }
+        },
+    };
+}
+/**
+ * LoadEnvironmentByID — Go load_environment_by_id.go: loads by the
+ * environment_id field (the standard LoadTarget expects a `value` id
+ * field, but EnvironmentSecretValueInput / Update-/RemoveEnvironment-
+ * VariablesRequest carry `environment_id`). Stores under
+ * TARGET_RESOURCE_KEY.
+ */
+export function newLoadEnvironmentByIdStep(store) {
+    return {
+        name: "LoadEnvironmentByID",
+        async execute(ctx) {
+            const environmentId = ctx.input
+                .environmentId;
+            if (typeof environmentId !== "string" || environmentId === "") {
+                throw invalidArgumentError("environment_id is required");
+            }
+            let env;
+            try {
+                env = await store.getResource(ctx.apiResourceKind, environmentId, EnvironmentSchema);
+            }
+            catch {
+                // Go maps EVERY load failure to NotFound here (store errors
+                // included) — ported as-is.
+                throw notFoundError("environment", environmentId);
+            }
+            ctx.set(TARGET_RESOURCE_KEY, env);
+        },
+    };
+}
+/**
+ * ExtractAndDecryptSingleKey — Go extract_and_decrypt_single_key.go: the
+ * getSecretValue reveal path. Missing key → NotFound; non-secret → the
+ * value as-is; secret → decrypted via the SecretService (a decrypt failure
+ * — including keyless-with-ciphertext — is Internal; the loud path, never
+ * a silent marker).
+ */
+export function newExtractAndDecryptSingleKeyStep(secretService, logger) {
+    return {
+        name: "ExtractAndDecryptSingleKey",
+        async execute(ctx) {
+            const key = ctx.input.key;
+            const env = ctx.get(TARGET_RESOURCE_KEY);
+            if (env === undefined) {
+                throw internalError(new Error("targetResource missing or wrong type"), "environment not loaded in context");
+            }
+            const envValue = env.spec?.data[key];
+            if (envValue === undefined) {
+                throw notFoundError("environment key", key);
+            }
+            if (envValue.isSecret && envValue.value !== "") {
+                let decrypted;
+                try {
+                    decrypted = await secretService.decrypt(envValue.value);
+                }
+                catch (error) {
+                    logger.error("Failed to decrypt secret value", {
+                        key,
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                    throw internalError(error, "failed to decrypt secret value");
+                }
+                ctx.set(SECRET_VALUE_KEY, create(EnvironmentValueSchema, {
+                    value: decrypted,
+                    isSecret: true,
+                    description: envValue.description,
+                }));
+                return;
+            }
+            ctx.set(SECRET_VALUE_KEY, envValue);
+        },
+    };
+}
+/**
+ * MergeVariablesAndPersist — Go merge_variables_and_persist.go: merges
+ * incoming variables into the loaded environment's spec.data and persists.
+ * Request keys overwrite; absent keys are preserved.
+ *
+ * This step is its OWN write boundary (sentinel guard, merge, encrypt, and
+ * persist all live here — same ordering contract as create/update:
+ * sentinels first, then encrypt). This is the path OAuth-managed vendor
+ * tokens take, so they rest encrypted too. Deliberately NO search
+ * re-index: variables are not indexed fields (mirror, don't fix).
+ *
+ * Requires LoadEnvironmentByID first (reads TARGET_RESOURCE_KEY); stores
+ * the modified environment under UPDATED_ENVIRONMENT_KEY. Stamps the
+ * SpecAudit slot (#540 — a definition change).
+ */
+export function newMergeVariablesAndPersistStep(store, secretService, logger) {
+    return {
+        name: "MergeVariablesAndPersist",
+        async execute(ctx) {
+            const env = ctx.get(TARGET_RESOURCE_KEY);
+            if (env === undefined) {
+                throw internalError(new Error("targetResource missing or wrong type"), "environment not loaded in context");
+            }
+            if (env.spec === undefined) {
+                env.spec = create(EnvironmentSpecSchema, {});
+            }
+            const incoming = ctx.input.variables;
+            for (const [key, incomingValue] of Object.entries(incoming)) {
+                let value = incomingValue;
+                if (value.isSecret && value.value === REDACTED_MARKER) {
+                    const existing = env.spec.data[key];
+                    if (existing !== undefined && existing.isSecret) {
+                        continue; // preserved — the round-trip contract
+                    }
+                    throw invalidArgumentError(markerRejectionMessage(key));
+                }
+                // Ciphertext-shaped client input is rejected at every secret write
+                // boundary (oss#395); see newPreserveRedactedSecretsStep for the
+                // full rationale. Non-secret values are deliberately exempt.
+                if (value.isSecret && isCiphertextShaped(value.value)) {
+                    throw invalidArgumentError(forgedCiphertextMessage(key));
+                }
+                if (value.isSecret && value.value !== "") {
+                    if (!secretService.isEnabled()) {
+                        logger.warn("Encryption disabled: environment secret value will be stored in plaintext", { key });
+                    }
+                    else {
+                        let encrypted;
+                        try {
+                            encrypted = await secretService.encrypt(value.value, EncryptionScope.forOrganization(env.metadata?.org ?? ""));
+                        }
+                        catch (error) {
+                            throw internalError(error, `failed to encrypt secret value for variable '${key}'`);
+                        }
+                        value = create(EnvironmentValueSchema, {
+                            value: encrypted,
+                            isSecret: true,
+                            description: value.description,
+                        });
+                    }
+                }
+                env.spec.data[key] = value;
+            }
+            try {
+                setAuditFieldsForUpdate(EnvironmentSchema, env, "spec_audit", ctx.callerIdentity);
+            }
+            catch (error) {
+                throw internalError(error, "failed to set audit fields");
+            }
+            try {
+                await store.saveResource(ctx.apiResourceKind, env.metadata?.id ?? "", EnvironmentSchema, env);
+            }
+            catch (error) {
+                throw internalError(error, "failed to persist environment after merging variables");
+            }
+            ctx.set(UPDATED_ENVIRONMENT_KEY, env);
+        },
+    };
+}
+/**
+ * RemoveVariableKeysAndPersist — Go remove_variable_keys_and_persist.go:
+ * deletes the named keys from spec.data (unknown keys silently ignored)
+ * and persists. Requires LoadEnvironmentByID first; stores the modified
+ * environment under UPDATED_ENVIRONMENT_KEY; stamps SpecAudit. No search
+ * re-index, as in Go.
+ *
+ * The removed keys' sealed values have their external backing state
+ * destroyed AFTER the persist (the Java RemoveAndPersist site, wired by
+ * convergence 20260830.04 Stage 3): the old values must be captured
+ * BEFORE the deletion mutates the loaded resource, and destruction is
+ * best-effort — a failure never fails the remove (secret-cleanup.ts
+ * carries the full contract). A no-op under the OSS v1-only codec set.
+ */
+export function newRemoveVariableKeysAndPersistStep(store, secretService, logger) {
+    return {
+        name: "RemoveVariableKeysAndPersist",
+        async execute(ctx) {
+            const env = ctx.get(TARGET_RESOURCE_KEY);
+            if (env === undefined) {
+                throw internalError(new Error("targetResource missing or wrong type"), "environment not loaded in context");
+            }
+            const keys = ctx.input.keys;
+            const removedSecretValues = [];
+            if (env.spec?.data !== undefined) {
+                for (const key of keys) {
+                    const removed = env.spec.data[key];
+                    if (removed !== undefined && removed.isSecret) {
+                        removedSecretValues.push(removed.value);
+                    }
+                    delete env.spec.data[key];
+                }
+            }
+            try {
+                setAuditFieldsForUpdate(EnvironmentSchema, env, "spec_audit", ctx.callerIdentity);
+            }
+            catch (error) {
+                throw internalError(error, "failed to set audit fields");
+            }
+            try {
+                await store.saveResource(ctx.apiResourceKind, env.metadata?.id ?? "", EnvironmentSchema, env);
+            }
+            catch (error) {
+                throw internalError(error, "failed to persist environment after removing variables");
+            }
+            await destroySecretBackingState(secretService, logger, {
+                kind: "environment",
+                resourceId: env.metadata?.id ?? "",
+                operation: "removeVariables",
+            }, removedSecretValues);
+            ctx.set(UPDATED_ENVIRONMENT_KEY, env);
+        },
+    };
+}
+/**
+ * DestroyDroppedEnvironmentSecrets — the Java
+ * DestroyDroppedEnvironmentSecrets step (wired by convergence
+ * 20260830.04 Stage 3): post-persist in the full-resource update chain,
+ * destroys the external backing state of secret keys the update DROPPED.
+ * Strictly dropped keys only — a key that survives with a rotated value
+ * keeps its KV path (superseded versions age out via the store's
+ * max_versions retention), and marker-preserved keys carry their stored
+ * ciphertext forward unchanged. Best-effort by the secret-cleanup
+ * contract; a no-op under the OSS v1-only codec set.
+ *
+ * Requires LoadExisting (the pre-update state) and runs after Persist —
+ * destroying before the row is written would dangle stored pointers on
+ * a persist failure.
+ */
+export function newDestroyDroppedEnvironmentSecretsStep(secretService, logger) {
+    return {
+        name: "DestroyDroppedEnvironmentSecrets",
+        async execute(ctx) {
+            const existing = ctx.get(EXISTING_RESOURCE_KEY);
+            const oldData = existing?.spec?.data;
+            if (oldData === undefined) {
+                return;
+            }
+            const newData = ctx.newState.spec?.data ?? {};
+            const droppedSecretValues = Object.entries(oldData)
+                .filter(([key, value]) => value.isSecret && newData[key] === undefined)
+                .map(([, value]) => value.value);
+            await destroySecretBackingState(secretService, logger, {
+                kind: "environment",
+                resourceId: existing?.metadata?.id ?? "",
+                operation: "update",
+            }, droppedSecretValues);
+        },
+    };
+}
+/**
+ * The sealed values an environment carries — the delete chain's
+ * extractor for DestroySecretBackingState (every is_secret entry;
+ * blank values are skipped by the destroyer).
+ */
+export function secretValuesOfEnvironment(env) {
+    return Object.values(env.spec?.data ?? {})
+        .filter((value) => value.isSecret)
+        .map((value) => value.value);
+}
+//# sourceMappingURL=steps.js.map

package/dist/domain/environment/steps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/environment/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAE7F,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,2DAA2D,CAAC;AASnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEpE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AAEnF,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,gCAAgC,EAChC,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAExB,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAE9C;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,8BAA8B;IAG5C,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,OAAO,CAAC,GAA6C;YACnD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;YACrC,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzD,OAAO;YACT,CAAC;YAED,gEAAgE;YAChE,+DAA+D;YAC/D,8DAA8D;YAC9D,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAEjC,CAAC;YACd,MAAM,YAAY,GAAG,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;YAEhD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;oBACpB,SAAS;gBACX,CAAC;gBAED,IAAI,KAAK,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;oBACpC,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;oBACxC,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;wBAC1D,IAAI,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC;wBAC1B,SAAS;oBACX,CAAC;oBACD,MAAM,oBAAoB,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1D,CAAC;gBAED,6DAA6D;gBAC7D,qDAAqD;gBACrD,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBACpC,MAAM,oBAAoB,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,0BAA0B,CACxC,aAA4B,EAC5B,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,KAAK,CAAC,OAAO,CACX,GAA6C;YAE7C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC;YACzB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC;YAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzD,OAAO;YACT,CAAC;YAED,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC/B,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5B,MAAM,CAAC,IAAI,CACT,4EAA4E,EAC5E,EAAE,aAAa,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAC1C,CAAC;gBACJ,CAAC;gBACD,OAAO;YACT,CAAC;YAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;oBAC1C,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC;oBACH,+DAA+D;oBAC/D,6DAA6D;oBAC7D,2DAA2D;oBAC3D,uDAAuD;oBACvD,KAAK,CAAC,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CACvC,KAAK,CAAC,KAAK,EACX,eAAe,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,CACzD,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,aAAa,CACjB,KAAK,EACL,gDAAgD,GAAG,GAAG,CACvD,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,iBAAiB,CAAC,IAAsC;IAC/D,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gCAAgC,CAC9C,KAAY;IAEZ,OAAO;QACL,iEAAiE;QACjE,IAAI,EAAE,8BAA8B;QACpC,KAAK,CAAC,OAAO,CACX,GAA6C;YAE7C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACvC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,oBAAoB,EAAE,CAAC;gBACjE,OAAO;YACT,CAAC;YAED,IAAI,QAAiC,CAAC;YACtC,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,yBAAyB,CACxC,KAAK,EACL,GAAG,CAAC,eAAe,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,QAAQ,CAAC,GAAG,CACb,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CACjB,KAAK,EACL,iDAAiD,CAClD,CAAC;YACJ,CAAC;YAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,mEAAmE;gBACnE,gEAAgE;gBAChE,+DAA+D;gBAC/D,iEAAiE;gBACjE,MAAM,IAAI,YAAY,CACpB,gCAAgC,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,EAC7D,IAAI,CAAC,aAAa,CACnB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAY;IAEZ,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,aAAa,GAAI,GAAG,CAAC,KAAqC;iBAC7D,aAAa,CAAC;YACjB,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,EAAE,EAAE,CAAC;gBAC9D,MAAM,oBAAoB,CAAC,4BAA4B,CAAC,CAAC;YAC3D,CAAC;YAED,IAAI,GAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,CAC3B,GAAG,CAAC,eAAe,EACnB,aAAa,EACb,iBAAiB,CAClB,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;gBAC5D,4BAA4B;gBAC5B,MAAM,aAAa,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;YACpD,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iCAAiC,CAC/C,aAA4B,EAC5B,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,4BAA4B;QAClC,KAAK,CAAC,OAAO,CACX,GAA6D;YAE7D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YAE1B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAA4B,CAAC;YACpE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,sCAAsC,CAAC,EACjD,mCAAmC,CACpC,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;YAC9C,CAAC;YAED,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;gBAC/C,IAAI,SAAiB,CAAC;gBACtB,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC1D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;wBAC7C,GAAG;wBACH,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;oBACH,MAAM,aAAa,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;gBAC/D,CAAC;gBACD,GAAG,CAAC,GAAG,CACL,gBAAgB,EAChB,MAAM,CAAC,sBAAsB,EAAE;oBAC7B,KAAK,EAAE,SAAS;oBAChB,QAAQ,EAAE,IAAI;oBACd,WAAW,EAAE,QAAQ,CAAC,WAAW;iBAClC,CAAC,CACH,CAAC;gBACF,OAAO;YACT,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,+BAA+B,CAC7C,KAAY,EACZ,aAA4B,EAC5B,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,KAAK,CAAC,OAAO,CACX,GAAmE;YAEnE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAA4B,CAAC;YACpE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,sCAAsC,CAAC,EACjD,mCAAmC,CACpC,CAAC;YACJ,CAAC;YAED,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;YAC/C,CAAC;YAED,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;YACrC,KAAK,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5D,IAAI,KAAK,GAAG,aAAa,CAAC;gBAC1B,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;oBACtD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;wBAChD,SAAS,CAAC,sCAAsC;oBAClD,CAAC;oBACD,MAAM,oBAAoB,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1D,CAAC;gBACD,mEAAmE;gBACnE,iEAAiE;gBACjE,6DAA6D;gBAC7D,IAAI,KAAK,CAAC,QAAQ,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBACtD,MAAM,oBAAoB,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC3D,CAAC;gBACD,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;oBACzC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC;wBAC/B,MAAM,CAAC,IAAI,CACT,2EAA2E,EAC3E,EAAE,GAAG,EAAE,CACR,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,IAAI,SAAiB,CAAC;wBACtB,IAAI,CAAC;4BACH,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,CACrC,KAAK,CAAC,KAAK,EACX,eAAe,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,CACzD,CAAC;wBACJ,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,MAAM,aAAa,CACjB,KAAK,EACL,gDAAgD,GAAG,GAAG,CACvD,CAAC;wBACJ,CAAC;wBACD,KAAK,GAAG,MAAM,CAAC,sBAAsB,EAAE;4BACrC,KAAK,EAAE,SAAS;4BAChB,QAAQ,EAAE,IAAI;4BACd,WAAW,EAAE,KAAK,CAAC,WAAW;yBAC/B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC7B,CAAC;YAED,IAAI,CAAC;gBACH,uBAAuB,CACrB,iBAAiB,EACjB,GAAG,EACH,YAAY,EACZ,GAAG,CAAC,cAAc,CACnB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;YAC3D,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,YAAY,CACtB,GAAG,CAAC,eAAe,EACnB,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EACtB,iBAAiB,EACjB,GAAG,CACJ,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CACjB,KAAK,EACL,uDAAuD,CACxD,CAAC;YACJ,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mCAAmC,CACjD,KAAY,EACZ,aAA4B,EAC5B,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,KAAK,CAAC,OAAO,CACX,GAAmE;YAEnE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAA4B,CAAC;YACpE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,sCAAsC,CAAC,EACjD,mCAAmC,CACpC,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAC5B,MAAM,mBAAmB,GAAa,EAAE,CAAC;YACzC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBACjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACnC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;wBAC9C,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;oBAC1C,CAAC;oBACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;YAED,IAAI,CAAC;gBACH,uBAAuB,CACrB,iBAAiB,EACjB,GAAG,EACH,YAAY,EACZ,GAAG,CAAC,cAAc,CACnB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;YAC3D,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,YAAY,CACtB,GAAG,CAAC,eAAe,EACnB,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EACtB,iBAAiB,EACjB,GAAG,CACJ,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CACjB,KAAK,EACL,wDAAwD,CACzD,CAAC;YACJ,CAAC;YAED,MAAM,yBAAyB,CAC7B,aAAa,EACb,MAAM,EACN;gBACE,IAAI,EAAE,aAAa;gBACnB,UAAU,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;gBAClC,SAAS,EAAE,iBAAiB;aAC7B,EACD,mBAAmB,CACpB,CAAC;YAEF,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uCAAuC,CACrD,aAA4B,EAC5B,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,kCAAkC;QACxC,KAAK,CAAC,OAAO,CACX,GAA6C;YAE7C,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAEjC,CAAC;YACd,MAAM,OAAO,GAAG,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC;YACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;YAC9C,MAAM,mBAAmB,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;iBAChD,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;iBACtE,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,yBAAyB,CAC7B,aAAa,EACb,MAAM,EACN;gBACE,IAAI,EAAE,aAAa;gBACnB,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE;gBACxC,SAAS,EAAE,QAAQ;aACpB,EACD,mBAAmB,CACpB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAgB;IACxD,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;SACvC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;SACjC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC"}

package/dist/domain/executioncontext/constants.d.ts

@@ -0,0 +1,36 @@
+/**
+ * ExecutionContext domain constants — the byte-pinned wire copy shared
+ * with the Go server. Every string here reaches clients verbatim (the
+ * conformance suite and the runner's error surfaces read them), so none
+ * is editable without an owner-ratified wire change.
+ *
+ * The redaction marker itself is NOT defined here: it is imported from
+ * the environment domain's constants (the single source of truth both Go
+ * domains share — Go's redact_secret_values.go imports
+ * envsteps.RedactedMarker the same way).
+ */
+/**
+ * InvalidArgument copy for client-supplied enc:v<N>: input — Go
+ * encrypt_secret_values.go's rejectCiphertextShapedStep, byte-pinned.
+ * Note the copy differs from the environment domain's forged-ciphertext
+ * message: each domain pins its own Go string.
+ */
+export declare function ciphertextShapedMessage(key: string): string;
+/**
+ * Internal copy for an encrypt failure at write. Replaced the ported
+ * per-key `failed to encrypt secret value for '<key>'` (Go
+ * encrypt_secret_values.go) when EC sealing became one batch through the
+ * v2-capped verb (20260830.04 Stage 1) — a batch failure has no single
+ * failing key. Unreachable for the local v1 codec; a vault-backed write
+ * codec reaches it on KEK-provider failure, with the real error logged.
+ */
+export declare const ENCRYPT_BATCH_FAILURE_MESSAGE = "failed to encrypt secret values";
+/**
+ * Internal copy for the fail-loud decrypt arm: the row holds ciphertext
+ * but the server has no key (key file lost). Dropping the value would
+ * start the execution silently missing a credential — a confusing
+ * downstream failure instead of a clear one here (the oss#405 doctrine).
+ * Go resolve_values_for_caller.go, byte-pinned.
+ */
+export declare function encryptionKeyMissingMessage(executionId: string, key: string): string;
+//# sourceMappingURL=constants.d.ts.map

package/dist/domain/executioncontext/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/executioncontext/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAK3D;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,oCAAoC,CAAC;AAE/E;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,GACV,MAAM,CAKR"}

package/dist/domain/executioncontext/constants.js

@@ -0,0 +1,42 @@
+/**
+ * ExecutionContext domain constants — the byte-pinned wire copy shared
+ * with the Go server. Every string here reaches clients verbatim (the
+ * conformance suite and the runner's error surfaces read them), so none
+ * is editable without an owner-ratified wire change.
+ *
+ * The redaction marker itself is NOT defined here: it is imported from
+ * the environment domain's constants (the single source of truth both Go
+ * domains share — Go's redact_secret_values.go imports
+ * envsteps.RedactedMarker the same way).
+ */
+/**
+ * InvalidArgument copy for client-supplied enc:v<N>: input — Go
+ * encrypt_secret_values.go's rejectCiphertextShapedStep, byte-pinned.
+ * Note the copy differs from the environment domain's forged-ciphertext
+ * message: each domain pins its own Go string.
+ */
+export function ciphertextShapedMessage(key) {
+    return (`value for '${key}' looks like stored ciphertext (enc:v<N>: prefix); ` +
+        "supply the plaintext value");
+}
+/**
+ * Internal copy for an encrypt failure at write. Replaced the ported
+ * per-key `failed to encrypt secret value for '<key>'` (Go
+ * encrypt_secret_values.go) when EC sealing became one batch through the
+ * v2-capped verb (20260830.04 Stage 1) — a batch failure has no single
+ * failing key. Unreachable for the local v1 codec; a vault-backed write
+ * codec reaches it on KEK-provider failure, with the real error logged.
+ */
+export const ENCRYPT_BATCH_FAILURE_MESSAGE = "failed to encrypt secret values";
+/**
+ * Internal copy for the fail-loud decrypt arm: the row holds ciphertext
+ * but the server has no key (key file lost). Dropping the value would
+ * start the execution silently missing a credential — a confusing
+ * downstream failure instead of a clear one here (the oss#405 doctrine).
+ * Go resolve_values_for_caller.go, byte-pinned.
+ */
+export function encryptionKeyMissingMessage(executionId, key) {
+    return (`execution context for ${executionId} holds encrypted secret '${key}' ` +
+        "but no encryption key is configured");
+}
+//# sourceMappingURL=constants.js.map

package/dist/domain/executioncontext/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/executioncontext/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,OAAO,CACL,cAAc,GAAG,qDAAqD;QACtE,4BAA4B,CAC7B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,iCAAiC,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,WAAmB,EACnB,GAAW;IAEX,OAAO,CACL,yBAAyB,WAAW,4BAA4B,GAAG,IAAI;QACvE,qCAAqC,CACtC,CAAC;AACJ,CAAC"}

package/dist/domain/executioncontext/controller.d.ts

@@ -0,0 +1,63 @@
+/**
+ * ExecutionContext controller — ports pkg/domain/executioncontext
+ * (command + query sides): the create-only, secret-bearing resource the
+ * execution engine mints to carry one run's merged runtime configuration
+ * and secrets, deleted when the execution completes.
+ *
+ * The domain diverges from the other flat domains in two
+ * contract-significant ways:
+ *   - There is NO update RPC and NO list RPC. Reads are by id, by
+ *     reference (org + slug), or by the parent execution_id.
+ *   - apply is create-or-FAIL: applying over an existing slug returns a
+ *     real AlreadyExists, not an update.
+ *
+ * Secret handling (oss#535, the stigmer-cloud#152 contract ported):
+ * is_secret values rest encrypted (enc:v1:), leave the server as
+ * ***REDACTED*** markers on EVERY user-shaped boundary — get,
+ * getByReference, the create/apply and delete echoes — and are revealed
+ * only through getByExecutionId to a caller presenting an
+ * execution-scoped runner token bound to this very EC (see
+ * resolve-values-for-caller.ts).
+ *
+ * Pipeline per RPC mirrors the Go step chains character-for-character.
+ * Proven by executioncontext.conformance.test.ts
+ * (CONFORMANCE_TARGET=local) and __tests__/executioncontext.test.ts
+ * (the decrypt-lane matrix conformance deliberately never exercises —
+ * its harness authenticates as a user).
+ *
+ * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies,
+ * and Publish steps (no multi-tenant auth, IAM/FGA, or event publishing
+ * here); the redaction and decrypt-lane contracts run in BOTH editions,
+ * keeping the error contract identical.
+ */
+import type { ConnectRouter } from "@connectrpc/connect";
+import type { Logger } from "../../boot/logger.js";
+import type { Authorizer } from "../../extensions/authorizer.js";
+import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
+import type { SecretService } from "../../encryption/encryption.js";
+import type { RunnerCredentialProvider } from "../../runnerauth/runner-credential-provider.js";
+import type { Store } from "../../store/interface.js";
+export interface ExecutionContextControllerDeps {
+    readonly store: Store;
+    readonly logger: Logger;
+    /** The composed authorization seam — the Authorize step at position 1 of every chain calls it (O2, DD-007 §3). */
+    readonly authorizer: Authorizer;
+    /** The composed tuple-lifecycle driver — undefined = the shared steps no-op (C2). */
+    readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
+    /**
+     * Shared with the Environment/OAuthApp controllers so the
+     * encrypt-on-write / decrypt-on-read key pair always matches.
+     */
+    readonly secretService: SecretService;
+    /**
+     * Verifies the execution-scoped tokens that gate getByExecutionId's
+     * decrypt lane. REQUIRED: the composition root always constructs one
+     * (boot-fatal otherwise); the keyless state — verify rejects every
+     * token, every read redacts — is the modeled "disabled" arm, the TS
+     * shape of Go's nil-service check.
+     */
+    readonly runnerAuthService: RunnerCredentialProvider;
+}
+/** Registers both executioncontext services on the router (routes stage). */
+export declare function registerExecutionContextServices(router: ConnectRouter, deps: ExecutionContextControllerDeps): void;
+//# sourceMappingURL=controller.d.ts.map

package/dist/domain/executioncontext/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/executioncontext/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAgBzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AACjG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAsCpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAC/F,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAWtD,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kHAAkH;IAClH,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,qFAAqF;IACrF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC5E;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;CACtD;AAED,6EAA6E;AAC7E,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,8BAA8B,GACnC,IAAI,CAWN"}