@stigmer/server 3.14.0-dev.20260910084630

package/dist/domain/organization/steps.d.ts

@@ -0,0 +1,30 @@
+import type { Store } from "../../store/interface.js";
+import type { PipelineStep } from "../../pipeline/pipeline.js";
+import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
+/**
+ * Rejects a create when an organization already exists with the same slug,
+ * checked GLOBALLY by id.
+ *
+ * Organizations use their slug as their id (see newCopySlugToIdStep), so
+ * slug uniqueness must be global — not org-scoped like every other
+ * resource. The generic CheckDuplicate scopes its lookup by metadata.org,
+ * which is only safe for organizations because callers leave it empty; a
+ * direct API caller that set a non-empty metadata.org could otherwise slip
+ * a colliding slug past the scoped check and, because the store persists
+ * by id with upsert semantics, silently overwrite the existing
+ * organization. Checking existence by id (== the resolved slug) closes
+ * that hole and mirrors cloud's OrganizationCreateHandler.CheckDuplicate.
+ *
+ * Runs after ResolveSlug (slug is set) and before BuildNewState/
+ * CopySlugToId (the id is not yet minted), so it keys on the slug value
+ * that will become the id.
+ */
+export declare function newCheckOrgDuplicateStep(store: Store): PipelineStep<typeof OrganizationSchema>;
+/**
+ * Sets metadata.id to metadata.slug — the deliberate id == slug exception
+ * for the tenancy root. Runs after BuildNewState (which mints a throwaway
+ * org_<ulid>) and overwrites that id with the slug, exactly mirroring
+ * cloud's OrganizationCreateHandler.CopySlugToId.
+ */
+export declare function newCopySlugToIdStep(): PipelineStep<typeof OrganizationSchema>;
+//# sourceMappingURL=steps.d.ts.map

package/dist/domain/organization/steps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/domain/organization/steps.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAI/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAE/F;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,KAAK,GACX,YAAY,CAAC,OAAO,kBAAkB,CAAC,CA+BzC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,YAAY,CAAC,OAAO,kBAAkB,CAAC,CAgB7E"}

package/dist/domain/organization/steps.js

@@ -0,0 +1,89 @@
+/**
+ * Organization domain steps — port
+ * pkg/domain/organization/controller/steps.go.
+ *
+ * Organization is the single resource whose id equals its slug. Every
+ * other kind mints a prefixed ULID (agt_…, wfl_…) in the shared
+ * BuildNewState; Organization deliberately deviates because it is the
+ * immutable, globally unique tenancy root every child resource references
+ * by slug (metadata.org). These two steps implement that deviation and its
+ * uniqueness guarantee, mirroring cloud's OrganizationCreateHandler
+ * (CheckDuplicate + CopySlugToId) step-for-step.
+ *
+ * Proven by organization.conformance.test.ts (CONFORMANCE_TARGET=local)
+ * and __tests__/organization.test.ts.
+ */
+import { ResourceNotFoundError } from "../../store/interface.js";
+import { alreadyExistsError, internalError } from "../../pipeline/errors.js";
+import { metadataOf } from "../../pipeline/steps/shapes.js";
+import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
+/**
+ * Rejects a create when an organization already exists with the same slug,
+ * checked GLOBALLY by id.
+ *
+ * Organizations use their slug as their id (see newCopySlugToIdStep), so
+ * slug uniqueness must be global — not org-scoped like every other
+ * resource. The generic CheckDuplicate scopes its lookup by metadata.org,
+ * which is only safe for organizations because callers leave it empty; a
+ * direct API caller that set a non-empty metadata.org could otherwise slip
+ * a colliding slug past the scoped check and, because the store persists
+ * by id with upsert semantics, silently overwrite the existing
+ * organization. Checking existence by id (== the resolved slug) closes
+ * that hole and mirrors cloud's OrganizationCreateHandler.CheckDuplicate.
+ *
+ * Runs after ResolveSlug (slug is set) and before BuildNewState/
+ * CopySlugToId (the id is not yet minted), so it keys on the slug value
+ * that will become the id.
+ */
+export function newCheckOrgDuplicateStep(store) {
+    return {
+        // The shared vocabulary name — the inventory row reads straight onto
+        // the chain even though the semantics are organization-specific.
+        name: "CheckDuplicate",
+        async execute(ctx) {
+            const metadata = metadataOf(ctx.newState);
+            if (metadata === undefined) {
+                throw internalError(new Error("organization metadata is nil"), "duplicate check");
+            }
+            // ResolveSlug runs before this step, so an empty slug here is a
+            // server-side pipeline-ordering bug, not bad client input.
+            if (metadata.slug === "") {
+                throw internalError(new Error("organization slug is empty"), "duplicate check");
+            }
+            try {
+                await store.getResource(ctx.apiResourceKind, metadata.slug, OrganizationSchema);
+            }
+            catch (error) {
+                if (error instanceof ResourceNotFoundError) {
+                    return; // no holder — the create may proceed
+                }
+                throw internalError(error, "failed to check for duplicate organization");
+            }
+            throw alreadyExistsError("Organization", `slug '${metadata.slug}'`);
+        },
+    };
+}
+/**
+ * Sets metadata.id to metadata.slug — the deliberate id == slug exception
+ * for the tenancy root. Runs after BuildNewState (which mints a throwaway
+ * org_<ulid>) and overwrites that id with the slug, exactly mirroring
+ * cloud's OrganizationCreateHandler.CopySlugToId.
+ */
+export function newCopySlugToIdStep() {
+    return {
+        name: "CopySlugToId",
+        execute(ctx) {
+            const metadata = metadataOf(ctx.newState);
+            if (metadata === undefined) {
+                throw internalError(new Error("organization metadata is nil"), "copy slug to id");
+            }
+            // ResolveSlug guarantees a non-empty slug upstream; an empty slug
+            // here is a pipeline-ordering bug, not bad client input.
+            if (metadata.slug === "") {
+                throw internalError(new Error("organization slug is empty"), "copy slug to id");
+            }
+            metadata.id = metadata.slug;
+        },
+    };
+}
+//# sourceMappingURL=steps.js.map

package/dist/domain/organization/steps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/organization/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAG7E,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAE5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAE/F;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAY;IAEZ,OAAO;QACL,qEAAqE;QACrE,iEAAiE;QACjE,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,OAAO,CAAC,GAA8C;YAC1D,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,EAAE,iBAAiB,CAAC,CAAC;YACpF,CAAC;YACD,gEAAgE;YAChE,2DAA2D;YAC3D,IAAI,QAAQ,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACzB,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAClF,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,WAAW,CACrB,GAAG,CAAC,eAAe,EACnB,QAAQ,CAAC,IAAI,EACb,kBAAkB,CACnB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,OAAO,CAAC,qCAAqC;gBAC/C,CAAC;gBACD,MAAM,aAAa,CAAC,KAAK,EAAE,4CAA4C,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,kBAAkB,CAAC,cAAc,EAAE,SAAS,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,OAAO,CAAC,GAA8C;YACpD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,EAAE,iBAAiB,CAAC,CAAC;YACpF,CAAC;YACD,kEAAkE;YAClE,yDAAyD;YACzD,IAAI,QAAQ,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACzB,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAClF,CAAC;YACD,QAAQ,CAAC,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/platform/controller.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Platform controller — ports pkg/domain/platform: the server's
+ * self-description surface (NOT a resource domain — no store, no
+ * pipelines; three direct handlers on PlatformQueryController).
+ *
+ * Proven by platform.conformance.test.ts (getServerInfo +
+ * getRunnerBootstrapConfig shapes; getRunnerScopedToken is deliberately
+ * excluded there — its arms are exercised mid-execution) and
+ * __tests__/platform.test.ts (the fail-soft mint matrix, the #15
+ * composed-server pattern).
+ *
+ * getRunnerScopedToken is the mint side of the runner-token lane
+ * (oss#535) — the seam src/runnerauth/ reserved for this sub-project. OSS
+ * has no caller identity, so unlike the cloud exchange there is no
+ * credential to verify: any caller naming an execution receives a token
+ * for it. On a single-user server the token is the LANE DISCRIMINATOR that
+ * lets the EC read RPCs redact by default without breaking the runner, not
+ * a trust boundary (DD-004).
+ *
+ * The C4 capability delegation (20260827.09, gate ruling Q1): when the
+ * composed provider defines exchangeScopedToken / bootstrapCredentials,
+ * this controller delegates the exchange arms and the bootstrap
+ * credential fields to it wholesale — the cloud's per-arm caller-class
+ * gating, row authorization, and multi-lane minting are POLICY, not
+ * contract, and live behind the seam. With neither defined (the OSS
+ * default), every arm below behaves exactly as before; the conformance
+ * suites pin that byte-identity.
+ */
+import type { ConnectRouter } from "@connectrpc/connect";
+import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
+import type { Logger } from "../../boot/logger.js";
+import type { RunnerCredentialProvider } from "../../runnerauth/runner-credential-provider.js";
+export interface PlatformControllerDeps {
+    /**
+     * Temporal coordinates this server runs against, published to embedded
+     * runners. In OSS the server and its runners are co-located, so the
+     * address the server itself dials is the one runners should dial too —
+     * no internal/external split (unlike Stigmer Cloud).
+     */
+    readonly temporalHostPort: string;
+    readonly temporalNamespace: string;
+    /**
+     * Mints the execution-scoped tokens getRunnerScopedToken hands to
+     * runners for the ExecutionContext decrypt lane (oss#535). Keyless
+     * yields the presence-based "not minted" response. (Go also tolerates a
+     * nil service in tests; the composition root here always wires one — a
+     * keyless instance is the modeled disabled state.)
+     */
+    readonly runnerAuthService: RunnerCredentialProvider;
+    /**
+     * The served edition, composition-derived (DD-006; blueprint §11 item
+     * 11): the extension registry declares it and defaults to oss, so the
+     * cloud composition answers `cloud` without forking this controller.
+     */
+    readonly edition: ServerEdition;
+    readonly logger: Logger;
+}
+/** Registers the platform query service on the router (routes stage). */
+export declare function registerPlatformServices(router: ConnectRouter, deps: PlatformControllerDeps): void;
+//# sourceMappingURL=controller.d.ts.map

package/dist/domain/platform/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/platform/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAGzE,OAAO,EAKL,aAAa,EACd,MAAM,uDAAuD,CAAC;AAQ/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,KAAK,EACV,wBAAwB,EAEzB,MAAM,gDAAgD,CAAC;AAIxD,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;IACrD;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,yEAAyE;AACzE,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,sBAAsB,GAC3B,IAAI,CAQN"}

package/dist/domain/platform/controller.js

@@ -0,0 +1,172 @@
+import { create } from "@bufbuild/protobuf";
+import { GetRunnerBootstrapConfigOutputSchema, GetRunnerScopedTokenOutputSchema, GetServerInfoOutputSchema, PlatformQueryController, } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
+import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
+import { TOKEN_TYPE_EXECUTION_SCOPED } from "../../runnerauth/runnerauth.js";
+import { SERVER_VERSION } from "./version.js";
+/** Registers the platform query service on the router (routes stage). */
+export function registerPlatformServices(router, deps) {
+    router.service(PlatformQueryController, {
+        getServerInfo: () => getServerInfo(deps),
+        getRunnerBootstrapConfig: (_input, ctx) => getRunnerBootstrapConfig(deps, ctx),
+        getRunnerScopedToken: (input, ctx) => getRunnerScopedToken(deps, input, ctx),
+    });
+}
+/** Go GetServerInfo: the server edition and build version. */
+function getServerInfo(deps) {
+    return create(GetServerInfoOutputSchema, {
+        edition: deps.edition,
+        version: SERVER_VERSION,
+    });
+}
+/**
+ * Go GetRunnerBootstrapConfig: the Temporal coordinates an embedded runner
+ * should connect to so it can self-bootstrap from a token alone. The
+ * RunnerAccessToken / TokenType / RunnerAccessTokenExpiresInSeconds fields
+ * are intentionally left empty in OSS: minting an iss=stigmer proxy token
+ * is a cloud-only capability (OSS has no Cursor BiDi proxy to authenticate
+ * against), so OSS runners keep using the token they already hold. The
+ * suite pins the presence-based all-or-nothing coupling of those fields.
+ *
+ * A composed provider with the bootstrapCredentials capability populates
+ * the token and payload-key fields (module header); the coordinates are
+ * OSS-owned either way — they describe THIS deployment's Temporal, not a
+ * credential policy. Capability failures degrade to the empty fields and
+ * never fail the bootstrap the coordinates ride on (the Java handler's
+ * best-effort contract).
+ */
+async function getRunnerBootstrapConfig(deps, ctx) {
+    const output = create(GetRunnerBootstrapConfigOutputSchema, {
+        temporalAddress: deps.temporalHostPort,
+        temporalNamespace: deps.temporalNamespace,
+    });
+    const bootstrapCredentials = deps.runnerAuthService.bootstrapCredentials?.bind(deps.runnerAuthService);
+    if (bootstrapCredentials === undefined) {
+        return output;
+    }
+    try {
+        const credentials = await bootstrapCredentials(callerIdentityOf(ctx));
+        if (credentials.accessToken !== undefined) {
+            output.runnerAccessToken = credentials.accessToken.token;
+            output.tokenType = "Bearer";
+            output.runnerAccessTokenExpiresInSeconds =
+                credentials.accessToken.expiresInSeconds;
+        }
+        if (credentials.payloadKeys !== undefined) {
+            output.payloadEncryptionKey = credentials.payloadKeys.keyBase64;
+            output.payloadEncryptionKeyId = credentials.payloadKeys.keyId;
+            output.payloadEncryptionSecondaryKey =
+                credentials.payloadKeys.secondaryKeyBase64 ?? "";
+            output.payloadEncryptionSecondaryKeyId =
+                credentials.payloadKeys.secondaryKeyId ?? "";
+        }
+    }
+    catch (error) {
+        deps.logger.warn("Bootstrap credentials unavailable — answering coordinates without them", { error: error instanceof Error ? error.message : String(error) });
+    }
+    return output;
+}
+/**
+ * Go GetRunnerScopedToken (oss#535): mints a token scoped to one unit of
+ * dispatched work, accepted by the ExecutionContext getByExecutionId
+ * decrypt lane.
+ *
+ * Arms:
+ *   - agent_execution_id / workflow_execution_id: minted. Both ids ARE the
+ *     ExecutionContext's spec.execution_id, so the token binds directly to
+ *     the one EC it may decrypt. (Cloud scopes agent tokens to the parent
+ *     session for warm-pool multi-turn reuse; OSS runners exchange
+ *     immediately before each read, so the tighter per-execution binding
+ *     costs nothing.)
+ *   - pool_claim / renewal / unset scope: the presence-based "not minted"
+ *     shape — OSS has no warm pool, and per-read minting makes renewal
+ *     moot.
+ *
+ * FAIL-SOFT is the contract: empty id, keyless service, or a mint error
+ * all answer the empty output rather than a gRPC error — the runner's
+ * no-credential path treats absence as "proceed tokenless", which degrades
+ * to redacted values (a clear downstream signal), while an error here
+ * would abort the activity.
+ *
+ * With the exchangeScopedToken capability composed, EVERY arm delegates
+ * to the provider (module header): its refusals (wrong credential class,
+ * failed authorization) propagate as the gRPC errors it throws — the
+ * cloud exchange's contract — while its keyless degrade keeps the
+ * presence-based empty output.
+ */
+async function getRunnerScopedToken(deps, input, ctx) {
+    const exchange = deps.runnerAuthService.exchangeScopedToken?.bind(deps.runnerAuthService);
+    if (exchange !== undefined) {
+        const minted = await exchange(exchangeRequestOf(input), callerIdentityOf(ctx));
+        if (!minted.minted) {
+            return create(GetRunnerScopedTokenOutputSchema);
+        }
+        return create(GetRunnerScopedTokenOutputSchema, {
+            runnerScopedToken: minted.token,
+            tokenType: "Bearer",
+            expiresInSeconds: minted.expiresInSeconds,
+        });
+    }
+    let executionId;
+    switch (input.scope.case) {
+        case "agentExecutionId":
+            executionId = input.scope.value;
+            break;
+        case "workflowExecutionId":
+            executionId = input.scope.value;
+            break;
+        case "poolClaim":
+        case "renewal":
+        case undefined:
+            // pool_claim, renewal, or an unset scope: nothing OSS mints for.
+            return create(GetRunnerScopedTokenOutputSchema);
+        default: {
+            const exhaustive = input.scope;
+            throw new Error(`unhandled scope arm: ${JSON.stringify(exhaustive)}`);
+        }
+    }
+    if (executionId === "" ||
+        !deps.runnerAuthService.isEnabled(TOKEN_TYPE_EXECUTION_SCOPED)) {
+        return create(GetRunnerScopedTokenOutputSchema);
+    }
+    try {
+        const minted = deps.runnerAuthService.mint(TOKEN_TYPE_EXECUTION_SCOPED, executionId, 0);
+        return create(GetRunnerScopedTokenOutputSchema, {
+            runnerScopedToken: minted.token,
+            tokenType: "Bearer",
+            expiresInSeconds: minted.ttlSeconds,
+        });
+    }
+    catch (error) {
+        deps.logger.warn("failed to mint runner scoped token — answering not-minted", {
+            executionId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return create(GetRunnerScopedTokenOutputSchema);
+    }
+}
+/**
+ * The proto oneof, transcribed to the seam's domain shape (the provider
+ * contract deliberately imports no wire types). Every arm maps
+ * one-to-one, INCLUDING unset — the implementation owns the unset
+ * refusal (Java answers INVALID_ARGUMENT there), so this mapping must
+ * never collapse it into a real arm.
+ */
+function exchangeRequestOf(input) {
+    switch (input.scope.case) {
+        case "agentExecutionId":
+            return { arm: "agent-execution", executionId: input.scope.value };
+        case "workflowExecutionId":
+            return { arm: "workflow-execution", executionId: input.scope.value };
+        case "poolClaim":
+            return { arm: "pool-claim", sessionId: input.scope.value.sessionId };
+        case "renewal":
+            return { arm: "renewal" };
+        case undefined:
+            return { arm: "unset" };
+        default: {
+            const exhaustive = input.scope;
+            throw new Error(`unhandled scope arm: ${JSON.stringify(exhaustive)}`);
+        }
+    }
+}
+//# sourceMappingURL=controller.js.map

package/dist/domain/platform/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/platform/controller.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EACL,oCAAoC,EACpC,gCAAgC,EAChC,yBAAyB,EACzB,uBAAuB,GAExB,MAAM,uDAAuD,CAAC;AAS/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAKvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AA4B9C,yEAAyE;AACzE,MAAM,UAAU,wBAAwB,CACtC,MAAqB,EACrB,IAA4B;IAE5B,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE;QACtC,aAAa,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC;QACxC,wBAAwB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CACxC,wBAAwB,CAAC,IAAI,EAAE,GAAG,CAAC;QACrC,oBAAoB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACnC,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED,8DAA8D;AAC9D,SAAS,aAAa,CAAC,IAA4B;IACjD,OAAO,MAAM,CAAC,yBAAyB,EAAE;QACvC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,cAAc;KACxB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,wBAAwB,CACrC,IAA4B,EAC5B,GAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,CAAC,oCAAoC,EAAE;QAC1D,eAAe,EAAE,IAAI,CAAC,gBAAgB;QACtC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IACH,MAAM,oBAAoB,GACxB,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC5E,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,iBAAiB,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC;YACzD,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;YAC5B,MAAM,CAAC,iCAAiC;gBACtC,WAAW,CAAC,WAAW,CAAC,gBAAgB,CAAC;QAC7C,CAAC;QACD,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,oBAAoB,GAAG,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC;YAChE,MAAM,CAAC,sBAAsB,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC;YAC9D,MAAM,CAAC,6BAA6B;gBAClC,WAAW,CAAC,WAAW,CAAC,kBAAkB,IAAI,EAAE,CAAC;YACnD,MAAM,CAAC,+BAA+B;gBACpC,WAAW,CAAC,WAAW,CAAC,cAAc,IAAI,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wEAAwE,EACxE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAA4B,EAC5B,KAAgC,EAChC,GAAmB;IAEnB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,EAAE,IAAI,CAC/D,IAAI,CAAC,iBAAiB,CACvB,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAC3B,iBAAiB,CAAC,KAAK,CAAC,EACxB,gBAAgB,CAAC,GAAG,CAAC,CACtB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC,gCAAgC,EAAE;YAC9C,iBAAiB,EAAE,MAAM,CAAC,KAAK;YAC/B,SAAS,EAAE,QAAQ;YACnB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAmB,CAAC;IACxB,QAAQ,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,kBAAkB;YACrB,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;YAChC,MAAM;QACR,KAAK,qBAAqB;YACxB,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;YAChC,MAAM;QACR,KAAK,WAAW,CAAC;QACjB,KAAK,SAAS,CAAC;QACf,KAAK,SAAS;YACZ,iEAAiE;YACjE,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAClD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC,KAAK,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,IACE,WAAW,KAAK,EAAE;QAClB,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,2BAA2B,CAAC,EAC9D,CAAC;QACD,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CACxC,2BAA2B,EAC3B,WAAW,EACX,CAAC,CACF,CAAC;QACF,OAAO,MAAM,CAAC,gCAAgC,EAAE;YAC9C,iBAAiB,EAAE,MAAM,CAAC,KAAK;YAC/B,SAAS,EAAE,QAAQ;YACnB,gBAAgB,EAAE,MAAM,CAAC,UAAU;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2DAA2D,EAC3D;YACE,WAAW;YACX,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CACF,CAAC;QACF,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CACxB,KAAgC;IAEhC,QAAQ,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,kBAAkB;YACrB,OAAO,EAAE,GAAG,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACpE,KAAK,qBAAqB;YACxB,OAAO,EAAE,GAAG,EAAE,oBAAoB,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACvE,KAAK,WAAW;YACd,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACvE,KAAK,SAAS;YACZ,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QAC5B,KAAK,SAAS;YACZ,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC,KAAK,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/domain/platform/version.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Server build version — ports the Go platform package's
+ * `var Version = "dev"` (set at build time via -ldflags).
+ *
+ * The TS equivalent of ldflags is an esbuild `define`: release builds
+ * replace the __STIGMER_SERVER_VERSION__ identifier in scripts/
+ * bundle-slim.mjs (owner-ratified at this sub-project's plan gate), so the
+ * bundle carries its version as a compile-time constant — hermetic, no
+ * package.json read at boot. Unbundled runs (tsx dev mode, vitest) leave
+ * the identifier undefined and fall back to "dev", exactly Go's unstamped
+ * default.
+ */
+/** The version getServerInfo reports (Go platform.Version). */
+export declare const SERVER_VERSION: string;
+//# sourceMappingURL=version.d.ts.map

package/dist/domain/platform/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../../../src/domain/platform/version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,+DAA+D;AAC/D,eAAO,MAAM,cAAc,EAAE,MAIlB,CAAC"}

package/dist/domain/platform/version.js

@@ -0,0 +1,18 @@
+/**
+ * Server build version — ports the Go platform package's
+ * `var Version = "dev"` (set at build time via -ldflags).
+ *
+ * The TS equivalent of ldflags is an esbuild `define`: release builds
+ * replace the __STIGMER_SERVER_VERSION__ identifier in scripts/
+ * bundle-slim.mjs (owner-ratified at this sub-project's plan gate), so the
+ * bundle carries its version as a compile-time constant — hermetic, no
+ * package.json read at boot. Unbundled runs (tsx dev mode, vitest) leave
+ * the identifier undefined and fall back to "dev", exactly Go's unstamped
+ * default.
+ */
+/** The version getServerInfo reports (Go platform.Version). */
+export const SERVER_VERSION = typeof __STIGMER_SERVER_VERSION__ === "string" &&
+    __STIGMER_SERVER_VERSION__ !== ""
+    ? __STIGMER_SERVER_VERSION__
+    : "dev";
+//# sourceMappingURL=version.js.map

package/dist/domain/platform/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../../../src/domain/platform/version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,+DAA+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GACzB,OAAO,0BAA0B,KAAK,QAAQ;IAC9C,0BAA0B,KAAK,EAAE;IAC/B,CAAC,CAAC,0BAA0B;IAC5B,CAAC,CAAC,KAAK,CAAC"}

package/dist/domain/project/controller.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Project controller — ports pkg/domain/project/controller (command + query
+ * sides). Project is the aggregate root grouping related resources: its spec
+ * carries lightweight ApiResourceReference members the CLI derives from
+ * individual apply responses (never user-authored); apply reconciles the
+ * membership and prunes orphans through the four downstream domains'
+ * in-process clients — the widest client fan-out of any CRUD domain, which
+ * is why it ported last of Class A (D4 #16).
+ *
+ * Pipeline per RPC mirrors the Go step chains character-for-character; the
+ * create/update ASYMMETRY is contract: create runs ValidateVisibility and
+ * NormalizeReferences, update runs neither (an updated members list persists
+ * without reference normalization — Go update.go). No chain runs
+ * ValidateReferences: members referencing nonexistent resources persist
+ * silently. Delete removes ONLY the project — members are never cascaded.
+ *
+ * Proven by project.conformance.test.ts (CONFORMANCE_TARGET=local) and
+ * __tests__/{reconcile,project.composed}.test.ts (the conformance suite
+ * never touches spec.members or last_reconciliation; the composed tests own
+ * those pins).
+ *
+ * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies,
+ * Publish, and TransformResponse steps (no multi-tenant auth, IAM/FGA, or
+ * event publishing here).
+ */
+import type { ConnectRouter } from "@connectrpc/connect";
+import type { Logger } from "../../boot/logger.js";
+import type { Authorizer } from "../../extensions/authorizer.js";
+import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
+import type { Store } from "../../store/interface.js";
+import type { OrphanDeleter } from "./reconcile.js";
+export interface ProjectControllerDeps {
+    readonly store: Store;
+    readonly logger: Logger;
+    /** The composed authorization seam — the Authorize step at position 1 of every chain calls it (O2, DD-007 §3). */
+    readonly authorizer: Authorizer;
+    /** The composed tuple-lifecycle driver — undefined = the shared steps no-op (C2). */
+    readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
+    /**
+     * The four downstream delete edges (agent/workflow/mcp_server/skill),
+     * lazy per the compose root's boot-ordering idiom — the TS replacement
+     * for Go's SetReconciliationService late-bind (server.go:635-648).
+     */
+    readonly orphanDeleter: () => OrphanDeleter;
+}
+/** Registers both project services on the router (routes stage). */
+export declare function registerProjectServices(router: ConnectRouter, deps: ProjectControllerDeps): void;
+//# sourceMappingURL=controller.d.ts.map

package/dist/domain/project/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/project/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAYzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AA2CjG,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAMtD,OAAO,KAAK,EAAE,aAAa,EAAyB,MAAM,gBAAgB,CAAC;AAG3E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kHAAkH;IAClH,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,qFAAqF;IACrF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC5E;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,aAAa,CAAC;CAC7C;AAED,oEAAoE;AACpE,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,qBAAqB,GAC1B,IAAI,CAgBN"}