@stigmer/server 3.14.0-dev.20260910084630

package/dist/domain/workflowexecution/constants.d.ts

@@ -0,0 +1,83 @@
+/**
+ * WorkflowExecution byte-pinned wire copy and identifiers — every string a
+ * client or the Temporal wire can observe from this domain, copied
+ * character-for-character from the Go controller
+ * (pkg/domain/workflowexecution/controller). Coexistence rule: the Go
+ * server is the behavioral reference; do not "improve" copy here
+ * (guidelines §2).
+ */
+/**
+ * create's engine-gate refusal (create.go engineUnavailableMessage) —
+ * deliberately identical across AgentExecution and WorkflowExecution so
+ * both domains present one symmetric create-boundary contract. Pinned by
+ * the Class A conformance engine-gate test.
+ */
+export declare const ENGINE_UNAVAILABLE_MESSAGE = "The execution engine is temporarily unavailable. Please try again shortly.";
+/**
+ * The lifecycle steps' engineless refusal (lifecycle_steps.go, five
+ * sites: pause/resume/cancel/terminate signal steps and recover's
+ * terminate-existing). FailedPrecondition, not Unavailable — the ratified
+ * Go asymmetry between the create gate and the lifecycle surface.
+ */
+export declare const TEMPORAL_UNAVAILABLE_MESSAGE = "Temporal is not available";
+/**
+ * Recover's fresh-start refusal (lifecycle_steps.go
+ * StartFreshWorkflowStep) — the creator-specific variant of the message
+ * above, also FailedPrecondition.
+ */
+export declare const TEMPORAL_UNAVAILABLE_CREATOR_MESSAGE = "Temporal is not available (workflow creator not set)";
+/**
+ * sendSignal's engineless refusal (send_signal.go SendSignalToWorkflowStep)
+ * — FailedPrecondition with its own copy, distinct from both messages
+ * above.
+ */
+export declare const WORKFLOW_CREATOR_UNAVAILABLE_MESSAGE = "workflow creator is not available";
+/**
+ * The Go orchestrator workflow name (temporal/workflows
+ * InvokeWorkflowExecutionWorkflowName) — a cross-edition Temporal wire
+ * constant; the orchestrator's workflow ID is `{name}/{executionId}`.
+ */
+export declare const INVOKE_WORKFLOW_EXECUTION_WORKFLOW_NAME = "stigmer/workflow-execution/invoke";
+/** The orchestrator workflow ID for an execution (lifecycle_steps.go). */
+export declare function orchestratorWorkflowId(executionId: string): string;
+/**
+ * The TS runner child workflow ID (lifecycle_steps.go
+ * TerminateExistingWorkflowStep: "workflow-exec-" + executionID). The
+ * child has ParentClosePolicy=REQUEST_CANCEL, so recover terminates it
+ * explicitly for a hard ID-reuse guarantee.
+ */
+export declare function childWorkflowId(executionId: string): string;
+/**
+ * Signal channel names on the orchestrator (temporal/workflows). pause and
+ * resume are handled by Go's single selector goroutine; every other signal
+ * rides the generic relaySignal envelope (June DD-013).
+ */
+export declare const PAUSE_SIGNAL_NAME = "pause";
+export declare const RESUME_SIGNAL_NAME = "resume";
+export declare const RELAY_SIGNAL_CHANNEL_NAME = "relaySignal";
+/**
+ * submitWorkflowTaskApproval's signal-name prefix
+ * (submit_workflow_task_approval.go humanInputSignalPrefix): the runner
+ * listens on `human_input_{taskName}`.
+ */
+export declare const HUMAN_INPUT_SIGNAL_PREFIX = "human_input_";
+/**
+ * getEventLog pagination bounds (get_event_log.go): requests default to
+ * 100 events and are capped at 500 — the pinned CW-7 pagination contract.
+ */
+export declare const DEFAULT_EVENT_PAGE_SIZE = 100;
+export declare const MAX_EVENT_PAGE_SIZE = 500;
+/**
+ * listPendingApprovals pagination bounds (list_pending_approvals.go):
+ * default 20, cap 100.
+ */
+export declare const DEFAULT_PENDING_APPROVALS_PAGE_SIZE = 20;
+export declare const MAX_PENDING_APPROVALS_PAGE_SIZE = 100;
+/**
+ * subscribeEvents' live-tail poll interval (subscribe_events.go
+ * eventPollInterval = 500ms): the latency floor Go chose for event
+ * delivery after replay; faster polling buys little (the runner batches
+ * updates through updateStatus) and multiplies read load per subscriber.
+ */
+export declare const EVENT_POLL_INTERVAL_MS = 500;
+//# sourceMappingURL=constants.d.ts.map

package/dist/domain/workflowexecution/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/domain/workflowexecution/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,+EACuC,CAAC;AAE/E;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,8BAA8B,CAAC;AAExE;;;;GAIG;AACH,eAAO,MAAM,oCAAoC,yDACO,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,oCAAoC,sCACZ,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,sCACf,CAAC;AAEtC,0EAA0E;AAC1E,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,UAAU,CAAC;AACzC,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAC3C,eAAO,MAAM,yBAAyB,gBAAgB,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,iBAAiB,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC;;;GAGG;AACH,eAAO,MAAM,mCAAmC,KAAK,CAAC;AACtD,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,MAAM,CAAC"}

package/dist/domain/workflowexecution/constants.js

@@ -0,0 +1,87 @@
+/**
+ * WorkflowExecution byte-pinned wire copy and identifiers — every string a
+ * client or the Temporal wire can observe from this domain, copied
+ * character-for-character from the Go controller
+ * (pkg/domain/workflowexecution/controller). Coexistence rule: the Go
+ * server is the behavioral reference; do not "improve" copy here
+ * (guidelines §2).
+ */
+/**
+ * create's engine-gate refusal (create.go engineUnavailableMessage) —
+ * deliberately identical across AgentExecution and WorkflowExecution so
+ * both domains present one symmetric create-boundary contract. Pinned by
+ * the Class A conformance engine-gate test.
+ */
+export const ENGINE_UNAVAILABLE_MESSAGE = "The execution engine is temporarily unavailable. Please try again shortly.";
+/**
+ * The lifecycle steps' engineless refusal (lifecycle_steps.go, five
+ * sites: pause/resume/cancel/terminate signal steps and recover's
+ * terminate-existing). FailedPrecondition, not Unavailable — the ratified
+ * Go asymmetry between the create gate and the lifecycle surface.
+ */
+export const TEMPORAL_UNAVAILABLE_MESSAGE = "Temporal is not available";
+/**
+ * Recover's fresh-start refusal (lifecycle_steps.go
+ * StartFreshWorkflowStep) — the creator-specific variant of the message
+ * above, also FailedPrecondition.
+ */
+export const TEMPORAL_UNAVAILABLE_CREATOR_MESSAGE = "Temporal is not available (workflow creator not set)";
+/**
+ * sendSignal's engineless refusal (send_signal.go SendSignalToWorkflowStep)
+ * — FailedPrecondition with its own copy, distinct from both messages
+ * above.
+ */
+export const WORKFLOW_CREATOR_UNAVAILABLE_MESSAGE = "workflow creator is not available";
+/**
+ * The Go orchestrator workflow name (temporal/workflows
+ * InvokeWorkflowExecutionWorkflowName) — a cross-edition Temporal wire
+ * constant; the orchestrator's workflow ID is `{name}/{executionId}`.
+ */
+export const INVOKE_WORKFLOW_EXECUTION_WORKFLOW_NAME = "stigmer/workflow-execution/invoke";
+/** The orchestrator workflow ID for an execution (lifecycle_steps.go). */
+export function orchestratorWorkflowId(executionId) {
+    return `${INVOKE_WORKFLOW_EXECUTION_WORKFLOW_NAME}/${executionId}`;
+}
+/**
+ * The TS runner child workflow ID (lifecycle_steps.go
+ * TerminateExistingWorkflowStep: "workflow-exec-" + executionID). The
+ * child has ParentClosePolicy=REQUEST_CANCEL, so recover terminates it
+ * explicitly for a hard ID-reuse guarantee.
+ */
+export function childWorkflowId(executionId) {
+    return `workflow-exec-${executionId}`;
+}
+/**
+ * Signal channel names on the orchestrator (temporal/workflows). pause and
+ * resume are handled by Go's single selector goroutine; every other signal
+ * rides the generic relaySignal envelope (June DD-013).
+ */
+export const PAUSE_SIGNAL_NAME = "pause";
+export const RESUME_SIGNAL_NAME = "resume";
+export const RELAY_SIGNAL_CHANNEL_NAME = "relaySignal";
+/**
+ * submitWorkflowTaskApproval's signal-name prefix
+ * (submit_workflow_task_approval.go humanInputSignalPrefix): the runner
+ * listens on `human_input_{taskName}`.
+ */
+export const HUMAN_INPUT_SIGNAL_PREFIX = "human_input_";
+/**
+ * getEventLog pagination bounds (get_event_log.go): requests default to
+ * 100 events and are capped at 500 — the pinned CW-7 pagination contract.
+ */
+export const DEFAULT_EVENT_PAGE_SIZE = 100;
+export const MAX_EVENT_PAGE_SIZE = 500;
+/**
+ * listPendingApprovals pagination bounds (list_pending_approvals.go):
+ * default 20, cap 100.
+ */
+export const DEFAULT_PENDING_APPROVALS_PAGE_SIZE = 20;
+export const MAX_PENDING_APPROVALS_PAGE_SIZE = 100;
+/**
+ * subscribeEvents' live-tail poll interval (subscribe_events.go
+ * eventPollInterval = 500ms): the latency floor Go chose for event
+ * delivery after replay; faster polling buys little (the runner batches
+ * updates through updateStatus) and multiplies read load per subscriber.
+ */
+export const EVENT_POLL_INTERVAL_MS = 500;
+//# sourceMappingURL=constants.js.map

package/dist/domain/workflowexecution/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/workflowexecution/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,4EAA4E,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,2BAA2B,CAAC;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAC/C,sDAAsD,CAAC;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAC/C,mCAAmC,CAAC;AAEtC;;;;GAIG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAClD,mCAAmC,CAAC;AAEtC,0EAA0E;AAC1E,MAAM,UAAU,sBAAsB,CAAC,WAAmB;IACxD,OAAO,GAAG,uCAAuC,IAAI,WAAW,EAAE,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB;IACjD,OAAO,iBAAiB,WAAW,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AACzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAC3C,MAAM,CAAC,MAAM,yBAAyB,GAAG,aAAa,CAAC;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,cAAc,CAAC;AAExD;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,CAAC;AACtD,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC"}

package/dist/domain/workflowexecution/controller.d.ts

@@ -0,0 +1,95 @@
+/**
+ * WorkflowExecution controller — ports pkg/domain/workflowexecution/
+ * controller (command + query sides): the workflow-run record surface.
+ * One Go controller implements both services; this module mirrors that
+ * with one deps object and one registration function.
+ *
+ * Pipeline per RPC mirrors the Go step chains character-for-character;
+ * the list/summary/pending-approval reads are direct handlers, exactly as
+ * Go writes them (no pipeline in list.go / list_by_workflow.go /
+ * get_execution_summary.go / list_pending_approvals.go).
+ *
+ * Proven by workflowexecution.conformance.test.ts
+ * (CONFORMANCE_TARGET=local) and __tests__/.
+ *
+ * Versus Stigmer Cloud, OSS excludes the Authorize, Publish,
+ * PublishToRedis, and TransformResponse steps (no multi-tenant auth,
+ * event publishing, or Redis here — subscribe streams ride in-memory
+ * channels per ADR 011).
+ */
+import type { ConnectRouter } from "@connectrpc/connect";
+import type { Logger } from "../../boot/logger.js";
+import type { Authorizer } from "../../extensions/authorizer.js";
+import type { ResolvedGateSteps } from "../../extensions/gate-slots.js";
+import type { ListReadScope } from "../../extensions/list-read-scope.js";
+import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
+import type { Store } from "../../store/interface.js";
+import type { AgentExecutionApprovalForwarderProvider } from "./submit-approval.js";
+import type { AgentExecutionFileDecisionForwarderProvider } from "./submit-file-decision.js";
+import type { ExecutionWorkflowInstanceCreatorProvider } from "./create-steps.js";
+import type { WorkflowExecutionContextBuilderDeps } from "./create-execution-context-step.js";
+import type { WorkflowExecutionEngineStateProvider } from "./engine.js";
+import type { SandboxLane } from "../../sandbox/lane.js";
+import type { WorkflowSandboxTerminalObserver } from "../../sandbox/steps.js";
+import type { WorkflowExecutionTemporalConfig } from "./temporal/config.js";
+import type { StreamBroker } from "./stream-broker.js";
+export interface WorkflowExecutionControllerDeps {
+    readonly store: Store;
+    readonly logger: Logger;
+    /** The composed authorization seam — the Authorize step at position 1 of every chain calls it (O2, DD-007 §3). */
+    readonly authorizer: Authorizer;
+    /** The composed tuple-lifecycle driver — undefined = the shared steps no-op (C2). */
+    readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
+    /** The composed summary read scope — undefined = the OSS full scan (C2 Stage 4). */
+    readonly listReadScope: ListReadScope | undefined;
+    /**
+     * The merged slot registrations (O1/O4; DD-006 §2). This domain
+     * carries `sandbox-acquisition:gate` on the create and recover chains
+     * at the Java-verified capacity-gate position (C4, 20260827.09) —
+     * empty in OSS.
+     */
+    readonly gateSteps: ResolvedGateSteps;
+    /**
+     * The workflow-execution engine seam (engine.ts): permanently
+     * disconnected until #21's TemporalManager flips it. Consumed by the
+     * create gate, the lifecycle RPCs, sendSignal, and
+     * submitWorkflowTaskApproval.
+     */
+    readonly engineState: WorkflowExecutionEngineStateProvider;
+    /**
+     * The shared broadcast fabric for subscribe streams. ONE instance spans
+     * both routers (serving + in-process) — see stream-broker.ts; the
+     * composition root owns it (Go: NewStreamBroker in the controller
+     * constructor + GetStreamBroker for #21's Temporal activities).
+     */
+    readonly broker: StreamBroker;
+    /**
+     * The in-process edges (lazy providers — the routes↔clients cycle
+     * resolves at request time): the default-instance creator, the two
+     * HITL forwarding edges into the agentexecution controller, and the
+     * EC-builder loaders.
+     */
+    readonly workflowInstanceCreator: ExecutionWorkflowInstanceCreatorProvider;
+    readonly approvalForwarder: AgentExecutionApprovalForwarderProvider;
+    readonly fileDecisionForwarder: AgentExecutionFileDecisionForwarderProvider;
+    /** The shared EC-builder deps (create's step 12 + recover's recreate). */
+    readonly executionContextBuilder: WorkflowExecutionContextBuilderDeps;
+    /**
+     * The sandbox lane (§6d, O6): disabled on the OSS default. Create and
+     * recover ensure the per-execution sandbox CRITICALLY (pre-persist /
+     * pre-start — a refusal orphans nothing); the terminal observer below
+     * tears it down.
+     */
+    readonly sandboxLane: SandboxLane;
+    /** Dispatch config — the sandbox ensure resolves target/queue through it. */
+    readonly temporalConfig: WorkflowExecutionTemporalConfig;
+    /**
+     * Fired after every persisted status write that transitions the phase
+     * (gate ruling Q3b) — updateStatus and the lifecycle persists call it;
+     * the worker's activity carries its own copy of the same observer.
+     */
+    readonly sandboxTerminalObserver: WorkflowSandboxTerminalObserver;
+}
+/** Registers both workflowexecution services on the router (routes stage). */
+export declare function registerWorkflowExecutionServices(router: ConnectRouter, deps: WorkflowExecutionControllerDeps): void;
+//# sourceMappingURL=controller.d.ts.map

package/dist/domain/workflowexecution/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/workflowexecution/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAkBzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAExE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAGzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAqCjG,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,sBAAsB,CAAC;AAEpF,OAAO,KAAK,EAAE,2CAA2C,EAAE,MAAM,2BAA2B,CAAC;AAG7F,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,mBAAmB,CAAC;AAOlF,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AAE9F,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAsBxE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAE9E,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAKvD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kHAAkH;IAClH,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,qFAAqF;IACrF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC5E,oFAAoF;IACpF,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;IAClD;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,oCAAoC,CAAC;IAC3D;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,uBAAuB,EAAE,wCAAwC,CAAC;IAC3E,QAAQ,CAAC,iBAAiB,EAAE,uCAAuC,CAAC;IACpE,QAAQ,CAAC,qBAAqB,EAAE,2CAA2C,CAAC;IAC5E,0EAA0E;IAC1E,QAAQ,CAAC,uBAAuB,EAAE,mCAAmC,CAAC;IACtE;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,6EAA6E;IAC7E,QAAQ,CAAC,cAAc,EAAE,+BAA+B,CAAC;IACzD;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,EAAE,+BAA+B,CAAC;CACnE;AAED,8EAA8E;AAC9E,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,+BAA+B,GACpC,IAAI,CAiDN"}

package/dist/domain/workflowexecution/controller.js

@@ -0,0 +1,270 @@
+import { WorkflowExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
+import { WorkflowExecutionCommandController } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/command_pb";
+import { ExecutionSortField } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/io_pb";
+import { WorkflowExecutionListSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/io_pb";
+import { WorkflowExecutionQueryController } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/query_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { create } from "@bufbuild/protobuf";
+import { stepsForSlot } from "../../extensions/gate-slots.js";
+import { restrictListByReadScope } from "../../extensions/list-read-scope.js";
+import { internalError, invalidArgumentError } from "../../pipeline/errors.js";
+import { apiResourceKindKey } from "../../pipeline/interceptors/apiresource.js";
+import { newPipeline } from "../../pipeline/pipeline.js";
+import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
+import { RequestContext } from "../../pipeline/request-context.js";
+import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
+import { newBuildUpdateStateStep } from "../../pipeline/steps/build-update-state.js";
+import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
+import { newCheckDuplicateStep } from "../../pipeline/steps/duplicate.js";
+import { newValidateVisibilityStep } from "../../pipeline/steps/validate-visibility.js";
+import { newDeleteResourceStep, newExtractResourceIdStep, newLoadExistingForDeleteStep, } from "../../pipeline/steps/delete.js";
+import { newDeleteSearchIndexStep, newIndexSearchStep, } from "../../pipeline/steps/index-search.js";
+import { EXISTING_RESOURCE_KEY, newLoadExistingStep, } from "../../pipeline/steps/load-existing.js";
+import { TARGET_RESOURCE_KEY, newLoadTargetStep, } from "../../pipeline/steps/load-target.js";
+import { newNormalizeReferencesStep } from "../../pipeline/steps/references.js";
+import { newCleanupIamPoliciesStep, newCreateAuthorizationTuplesStep, } from "../../pipeline/steps/authorization-tuples.js";
+import { newPersistStep } from "../../pipeline/steps/persist.js";
+import { newResolveSlugStep } from "../../pipeline/steps/slug.js";
+import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
+import { submitApproval } from "./submit-approval.js";
+import { submitFileDecision } from "./submit-file-decision.js";
+import { submitWorkflowTaskApproval } from "./submit-workflow-task-approval.js";
+import { newCreateDefaultInstanceIfNeededStep, newSetInitialPhaseStep, newStartWorkflowStep, newValidateWorkflowOrInstanceStep, } from "./create-steps.js";
+import { newCreateExecutionContextStep } from "./create-execution-context-step.js";
+import { newEnsureEngineAvailableStep } from "./engine.js";
+import { applyFilterCriteria, applyLegacyPhaseFilter, applySortField, } from "./execution-filter.js";
+import { cancelExecution, pauseExecution, recoverExecution, resumeExecution, terminateExecution, } from "./lifecycle.js";
+import { newNormalizeWorkflowRefStep } from "./normalize-workflow-ref-step.js";
+import { newPinWorkflowVersionStep } from "./pin-workflow-version-step.js";
+import { sendSignal } from "./send-signal.js";
+import { getEventLog } from "./get-event-log.js";
+import { getExecutionSummary } from "./get-execution-summary.js";
+import { listPendingApprovals } from "./list-pending-approvals.js";
+import { loadAllWorkflowExecutions } from "./queries.js";
+import { workflowExecutionSearchExtractor } from "./search-extractor.js";
+import { newEnsureWorkflowSandboxStep } from "../../sandbox/steps.js";
+import { subscribeExecution } from "./subscribe.js";
+import { subscribeEvents } from "./subscribe-events.js";
+import { updateStatus } from "./update-status.js";
+/** Registers both workflowexecution services on the router (routes stage). */
+export function registerWorkflowExecutionServices(router, deps) {
+    const lifecycleDeps = {
+        store: deps.store,
+        logger: deps.logger,
+        authorizer: deps.authorizer,
+        broker: deps.broker,
+        engineState: deps.engineState,
+        executionContextBuilder: deps.executionContextBuilder,
+        sandboxLane: deps.sandboxLane,
+        temporalConfig: deps.temporalConfig,
+        sandboxTerminalObserver: deps.sandboxTerminalObserver,
+        gateSteps: deps.gateSteps,
+    };
+    router.service(WorkflowExecutionCommandController, {
+        create: (execution, ctx) => createExecution(deps, execution, ctx),
+        update: (execution, ctx) => update(deps, execution, ctx),
+        updateStatus: (input, ctx) => updateStatus(deps, input, callerIdentityOf(ctx)),
+        submitApproval: (input, ctx) => submitApproval(deps, input, callerIdentityOf(ctx)),
+        submitFileDecision: (input, ctx) => submitFileDecision(deps, input, callerIdentityOf(ctx)),
+        submitWorkflowTaskApproval: (input, ctx) => submitWorkflowTaskApproval(deps, input, callerIdentityOf(ctx)),
+        delete: (id, ctx) => deleteExecution(deps, id, ctx),
+        sendSignal: (input, ctx) => sendSignal(deps, input, callerIdentityOf(ctx)),
+        cancel: (input, ctx) => cancelExecution(lifecycleDeps, input, callerIdentityOf(ctx)),
+        terminate: (input, ctx) => terminateExecution(lifecycleDeps, input, callerIdentityOf(ctx)),
+        recover: (input, ctx) => recoverExecution(lifecycleDeps, input, callerIdentityOf(ctx)),
+        pause: (input, ctx) => pauseExecution(lifecycleDeps, input, callerIdentityOf(ctx)),
+        resume: (input, ctx) => resumeExecution(lifecycleDeps, input, callerIdentityOf(ctx)),
+    });
+    router.service(WorkflowExecutionQueryController, {
+        get: (id, ctx) => get(deps, id, ctx),
+        list: (req, ctx) => list(deps, req, callerIdentityOf(ctx)),
+        listByWorkflow: (req, ctx) => listByWorkflow(deps, req, callerIdentityOf(ctx)),
+        subscribe: (req, ctx) => subscribeExecution(deps, req, ctx),
+        getEventLog: (req, ctx) => getEventLog(deps, req, callerIdentityOf(ctx)),
+        subscribeEvents: (req, ctx) => subscribeEvents(deps, req, ctx),
+        getExecutionSummary: (req, ctx) => getExecutionSummary(deps, req, callerIdentityOf(ctx)),
+        listPendingApprovals: (req, ctx) => listPendingApprovals(deps, req, callerIdentityOf(ctx)),
+    });
+}
+/**
+ * Create — create.go buildCreatePipeline, step-for-step (the numbered
+ * 15-step chain): validation (proto → visibility → slug →
+ * workflow-or-instance presence, the #196 InvalidArgument contrast) →
+ * the ENGINE GATE at its pinned position (before every side effect — a
+ * down engine orphans nothing; Go's unit test pins that it precedes even
+ * the workflow lookup) → default-instance resolution → the standard
+ * build → PENDING phase → workflow-ref denormalization → version pin →
+ * the ExecutionContext with merged env (runtime_env consumed and
+ * cleared) → Persist → IndexSearch → StartWorkflow (after persist; a
+ * start failure marks the execution FAILED, recoverable via Recover).
+ */
+async function createExecution(deps, execution, ctx) {
+    const reqCtx = new RequestContext(WorkflowExecutionSchema, execution, callerIdentityOf(ctx), kindOf(ctx));
+    const builder = newPipeline("workflowexecution-create", deps.logger)
+        .addStep(newAuthorizeStep(WorkflowExecutionCommandController.method.create, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newValidateVisibilityStep())
+        .addStep(newResolveSlugStep())
+        .addStep(newValidateWorkflowOrInstanceStep())
+        .addStep(newEnsureEngineAvailableStep(deps.engineState))
+        .addStep(newCreateDefaultInstanceIfNeededStep({
+        store: deps.store,
+        logger: deps.logger,
+        workflowInstanceCreator: deps.workflowInstanceCreator,
+        authorizationLifecycle: deps.authorizationLifecycle,
+    }))
+        .addStep(newCheckDuplicateStep(deps.store))
+        .addStep(newBuildNewStateStep())
+        .addStep(newGuardReservedLabelsStep(deps.authorizer))
+        .addStep(newNormalizeReferencesStep());
+    // The ratified sandbox-acquisition gate slot (blueprint 03 §3a; C4):
+    // the Java-verified capacity-gate position — after Authorize and every
+    // resolution step (the default instance, like Java's, side-effects
+    // pre-gate: orphan-on-refusal is inherited semantics), before the
+    // phase stamp and every later side effect, pre-provision. Empty in OSS.
+    for (const step of stepsForSlot(deps.gateSteps, "sandbox-acquisition:gate")) {
+        builder.addStep(step);
+    }
+    await builder
+        .addStep(newSetInitialPhaseStep())
+        .addStep(newNormalizeWorkflowRefStep(deps.store, deps.logger))
+        .addStep(newPinWorkflowVersionStep(deps.store, deps.logger))
+        .addStep(newCreateExecutionContextStep(deps.executionContextBuilder))
+        // The workflow-lane sandbox ensure (§6d, O6): CRITICAL and
+        // pre-persist — a provisioning refusal answers Unavailable with zero
+        // orphaned state (no row, no Temporal workflow), the verified Java
+        // ordering. Skips instantly when no provisioner is composed.
+        .addStep(newEnsureWorkflowSandboxStep({
+        logger: deps.logger,
+        lane: deps.sandboxLane,
+        temporalConfig: deps.temporalConfig,
+    }))
+        .addStep(newPersistStep(deps.store))
+        .addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle, deps.logger))
+        .addStep(newIndexSearchStep(deps.store, workflowExecutionSearchExtractor, deps.logger))
+        .addStep(newStartWorkflowStep({
+        store: deps.store,
+        logger: deps.logger,
+        engineState: deps.engineState,
+    }))
+        .build()
+        .execute(reqCtx);
+    return reqCtx.newState;
+}
+function kindOf(ctx) {
+    return ctx.values.get(apiResourceKindKey);
+}
+/**
+ * Update — update.go buildUpdatePipeline: USER-initiated spec updates
+ * (status updates from the runner use UpdateStatus instead). Standard
+ * chain; BuildUpdateState clears status per the shared pattern.
+ */
+async function update(deps, execution, ctx) {
+    const reqCtx = new RequestContext(WorkflowExecutionSchema, execution, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("workflowexecution-update", deps.logger)
+        .addStep(newAuthorizeStep(WorkflowExecutionCommandController.method.update, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newResolveSlugStep())
+        .addStep(newLoadExistingStep(deps.store))
+        .addStep(newBuildUpdateStateStep())
+        .addStep(newGuardReservedLabelsStep(deps.authorizer))
+        .addStep(newNormalizeReferencesStep())
+        .addStep(newPersistStep(deps.store))
+        .addStep(newIndexSearchStep(deps.store, workflowExecutionSearchExtractor, deps.logger))
+        .build()
+        .execute(reqCtx);
+    return reqCtx.newState;
+}
+/**
+ * Delete — delete.go buildDeletePipeline; returns the deleted execution
+ * for the audit trail (gRPC convention). Executions and audit rows of the
+ * parent workflow are untouched — only this record and its search-index
+ * row go.
+ */
+async function deleteExecution(deps, id, ctx) {
+    const reqCtx = new RequestContext(WorkflowExecutionCommandController.method.delete.input, id, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("workflowexecution-delete", deps.logger)
+        .addStep(newAuthorizeStep(WorkflowExecutionCommandController.method.delete, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newExtractResourceIdStep())
+        .addStep(newLoadExistingForDeleteStep(deps.store, WorkflowExecutionSchema))
+        .addStep(newDeleteResourceStep(deps.store))
+        .addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle, deps.logger))
+        .addStep(newDeleteSearchIndexStep(deps.store, deps.logger))
+        .build()
+        .execute(reqCtx);
+    const deleted = reqCtx.get(EXISTING_RESOURCE_KEY);
+    if (deleted === undefined) {
+        throw internalError(new Error("deleted workflow execution not found in context"), "deleted workflow execution not found in context");
+    }
+    return deleted;
+}
+/** Get — get.go buildGetPipeline: ValidateProto → LoadTarget. */
+async function get(deps, id, ctx) {
+    const reqCtx = new RequestContext(WorkflowExecutionQueryController.method.get.input, id, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("workflowexecution-get", deps.logger)
+        .addStep(newAuthorizeStep(WorkflowExecutionQueryController.method.get, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadTargetStep(deps.store, WorkflowExecutionSchema))
+        .build()
+        .execute(reqCtx);
+    return reqCtx.get(TARGET_RESOURCE_KEY);
+}
+/**
+ * List — list.go: full scan, the legacy top-level phase filter (only when
+ * filter.phases is absent), structured filter criteria (T13), and the
+ * sort default started_at descending. No pagination (total_pages
+ * placeholder 1). With a composed ListReadScope (20260830.01, census
+ * lane 6) the scan narrows to the caller's authorized executions and the
+ * request `org` narrows when non-blank (the Java
+ * WorkflowExecutionListHandler baseline: blank = permission-bounded
+ * across orgs); no scope = the full scan with `org` a deliberate no-op
+ * on this single-tenant edition — byte-identical.
+ */
+async function list(deps, req, identity) {
+    let executions = await restrictListByReadScope(deps.listReadScope, identity, ApiResourceKind.workflow_execution, await loadAllWorkflowExecutions(deps.store, deps.logger, "failed to list workflow executions"), req.org);
+    if (req.filter === undefined || req.filter.phases.length === 0) {
+        executions = applyLegacyPhaseFilter(executions, req.phase);
+    }
+    executions = applyFilterCriteria(executions, req.filter);
+    let sortField = req.sortField;
+    let ascending = req.sortAscending;
+    if (sortField === ExecutionSortField.UNSPECIFIED) {
+        sortField = ExecutionSortField.STARTED_AT;
+        ascending = false;
+    }
+    applySortField(executions, sortField, ascending);
+    return create(WorkflowExecutionListSchema, {
+        entries: executions,
+        totalPages: 1,
+    });
+}
+/**
+ * ListByWorkflow — list_by_workflow.go: the request field accepts either
+ * a Workflow ID or a WorkflowInstance ID, so both spec fields are
+ * matched. Same filter/sort tail as list; no pagination.
+ */
+async function listByWorkflow(deps, req, identity) {
+    if (req.workflowId === "") {
+        throw invalidArgumentError("workflow_id is required");
+    }
+    // Census lane 7: authorized ids ∩ workflow filter; the Java handler
+    // never consults org on this lane (bounded by the workflow id).
+    const all = await restrictListByReadScope(deps.listReadScope, identity, ApiResourceKind.workflow_execution, await loadAllWorkflowExecutions(deps.store, deps.logger, "failed to list workflow executions"), "");
+    let executions = all.filter((execution) => execution.spec?.workflowInstanceId === req.workflowId ||
+        execution.spec?.workflowId === req.workflowId);
+    executions = applyFilterCriteria(executions, req.filter);
+    let sortField = req.sortField;
+    let ascending = req.sortAscending;
+    if (sortField === ExecutionSortField.UNSPECIFIED) {
+        sortField = ExecutionSortField.STARTED_AT;
+        ascending = false;
+    }
+    applySortField(executions, sortField, ascending);
+    return create(WorkflowExecutionListSchema, {
+        entries: executions,
+        totalPages: 1,
+    });
+}
+//# sourceMappingURL=controller.js.map

package/dist/domain/workflowexecution/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/workflowexecution/controller.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,uBAAuB,EAAE,MAAM,gEAAgE,CAAC;AAEzG,OAAO,EAAE,kCAAkC,EAAE,MAAM,oEAAoE,CAAC;AACxH,OAAO,EAAE,kBAAkB,EAAE,MAAM,+DAA+D,CAAC;AACnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,+DAA+D,CAAC;AAO5G,OAAO,EAAE,gCAAgC,EAAE,MAAM,kEAAkE,CAAC;AAEpH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAK5C,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAG9E,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAI1E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAEhF,OAAO,EACL,oCAAoC,EACpC,sBAAsB,EACtB,oBAAoB,EACpB,iCAAiC,GAClC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AAEnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AAGzE,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AAGtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AA4DlD,8EAA8E;AAC9E,MAAM,UAAU,iCAAiC,CAC/C,MAAqB,EACrB,IAAqC;IAErC,MAAM,aAAa,GAAG;QACpB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;IACF,MAAM,CAAC,OAAO,CAAC,kCAAkC,EAAE;QACjD,MAAM,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC;QACjE,MAAM,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC;QACxD,YAAY,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC3B,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAClD,cAAc,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC7B,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACpD,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACjC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxD,0BAA0B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACzC,0BAA0B,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACnD,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC1E,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACrB,eAAe,CAAC,aAAa,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC9D,SAAS,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxB,kBAAkB,CAAC,aAAa,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACtB,gBAAgB,CAAC,aAAa,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC/D,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACpB,cAAc,CAAC,aAAa,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACrB,eAAe,CAAC,aAAa,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;KAC/D,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,gCAAgC,EAAE;QAC/C,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC1D,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC9E,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC3D,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxE,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC9D,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAChC,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACvD,oBAAoB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CACjC,oBAAoB,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;KACzD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,eAAe,CAC5B,IAAqC,EACrC,SAA4B,EAC5B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,uBAAuB,EACvB,SAAS,EACT,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,OAAO,GAAG,WAAW,CACzB,0BAA0B,EAC1B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,kCAAkC,CAAC,MAAM,CAAC,MAAM,EAChD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,iCAAiC,EAAE,CAAC;SAC5C,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;SACvD,OAAO,CACN,oCAAoC,CAAC;QACnC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC,CACH;SACA,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAAC;IACzC,qEAAqE;IACrE,uEAAuE;IACvE,mEAAmE;IACnE,kEAAkE;IAClE,wEAAwE;IACxE,KAAK,MAAM,IAAI,IAAI,YAAY,CAC7B,IAAI,CAAC,SAAS,EACd,0BAA0B,CAC3B,EAAE,CAAC;QACF,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,OAAO;SACV,OAAO,CAAC,sBAAsB,EAAE,CAAC;SACjC,OAAO,CAAC,2BAA2B,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SAC7D,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SAC3D,OAAO,CAAC,6BAA6B,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACrE,2DAA2D;QAC3D,qEAAqE;QACrE,mEAAmE;QACnE,6DAA6D;SAC5D,OAAO,CACN,4BAA4B,CAAC;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,WAAW;QACtB,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC,CACH;SACA,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,OAAO,CACN,kBAAkB,CAChB,IAAI,CAAC,KAAK,EACV,gCAAgC,EAChC,IAAI,CAAC,MAAM,CACZ,CACF;SACA,OAAO,CACN,oBAAoB,CAAC;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CACH;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,MAAM,CACnB,IAAqC,EACrC,SAA4B,EAC5B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,uBAAuB,EACvB,SAAS,EACT,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,0BAA0B,EAC1B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,kCAAkC,CAAC,MAAM,CAAC,MAAM,EAChD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,0BAA0B,EAAE,CAAC;SACrC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,kBAAkB,CAChB,IAAI,CAAC,KAAK,EACV,gCAAgC,EAChC,IAAI,CAAC,MAAM,CACZ,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAC5B,IAAqC,EACrC,EAAiB,EACjB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,kCAAkC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EACtD,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,0BAA0B,EAAE,IAAI,CAAC,MAAM,CAAC;SACvC,OAAO,CACN,gBAAgB,CACd,kCAAkC,CAAC,MAAM,CAAC,MAAM,EAChD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,wBAAwB,EAAE,CAAC;SACnC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;SAC1E,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SAC1D,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,iDAAiD,CAAC,EAC5D,iDAAiD,CAClD,CAAC;IACJ,CAAC;IACD,OAAO,OAA4B,CAAC;AACtC,CAAC;AAED,iEAAiE;AACjE,KAAK,UAAU,GAAG,CAChB,IAAqC,EACrC,EAAuB,EACvB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,gCAAgC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EACjD,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,uBAAuB,EACvB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,gCAAgC,CAAC,MAAM,CAAC,GAAG,EAC3C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;SAC/D,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAsB,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,IAAI,CACjB,IAAqC,EACrC,GAAkC,EAClC,QAAwB;IAExB,IAAI,UAAU,GAAG,MAAM,uBAAuB,CAC5C,IAAI,CAAC,aAAa,EAClB,QAAQ,EACR,eAAe,CAAC,kBAAkB,EAClC,MAAM,yBAAyB,CAC7B,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,MAAM,EACX,oCAAoC,CACrC,EACD,GAAG,CAAC,GAAG,CACR,CAAC;IAEF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,UAAU,GAAG,sBAAsB,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;IACD,UAAU,GAAG,mBAAmB,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAEzD,IAAI,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IAC9B,IAAI,SAAS,GAAG,GAAG,CAAC,aAAa,CAAC;IAClC,IAAI,SAAS,KAAK,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACjD,SAAS,GAAG,kBAAkB,CAAC,UAAU,CAAC;QAC1C,SAAS,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,cAAc,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAEjD,OAAO,MAAM,CAAC,2BAA2B,EAAE;QACzC,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,CAAC;KACd,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAC3B,IAAqC,EACrC,GAA4C,EAC5C,QAAwB;IAExB,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC1B,MAAM,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;IACxD,CAAC;IAED,oEAAoE;IACpE,gEAAgE;IAChE,MAAM,GAAG,GAAG,MAAM,uBAAuB,CACvC,IAAI,CAAC,aAAa,EAClB,QAAQ,EACR,eAAe,CAAC,kBAAkB,EAClC,MAAM,yBAAyB,CAC7B,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,MAAM,EACX,oCAAoC,CACrC,EACD,EAAE,CACH,CAAC;IACF,IAAI,UAAU,GAAG,GAAG,CAAC,MAAM,CACzB,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,IAAI,EAAE,kBAAkB,KAAK,GAAG,CAAC,UAAU;QACrD,SAAS,CAAC,IAAI,EAAE,UAAU,KAAK,GAAG,CAAC,UAAU,CAChD,CAAC;IAEF,UAAU,GAAG,mBAAmB,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAEzD,IAAI,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IAC9B,IAAI,SAAS,GAAG,GAAG,CAAC,aAAa,CAAC;IAClC,IAAI,SAAS,KAAK,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACjD,SAAS,GAAG,kBAAkB,CAAC,UAAU,CAAC;QAC1C,SAAS,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,cAAc,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAEjD,OAAO,MAAM,CAAC,2BAA2B,EAAE;QACzC,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,CAAC;KACd,CAAC,CAAC;AACL,CAAC"}

package/dist/domain/workflowexecution/create-execution-context-step.d.ts

@@ -0,0 +1,30 @@
+import type { ExecutionContext } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/api_pb";
+import type { WorkflowInstance } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/api_pb";
+import { WorkflowExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
+import type { Logger } from "../../boot/logger.js";
+import type { RuntimeResolutionService } from "../../domain/environment/resolution/resolution.js";
+import type { PipelineStep } from "../../pipeline/pipeline.js";
+import type { Store } from "../../store/interface.js";
+/**
+ * The narrow workflowinstance READ edge (Go workflowInstanceClient.Get)
+ * — consumer-defined, satisfied by the in-process query client.
+ */
+export interface ExecutionWorkflowInstanceLoader {
+    get(instanceId: string): Promise<WorkflowInstance>;
+}
+export type ExecutionWorkflowInstanceLoaderProvider = () => ExecutionWorkflowInstanceLoader;
+/** The narrow executioncontext CREATE edge (Go executionCtxClient.Create). */
+export interface WorkflowExecutionContextCreator {
+    create(executionContext: ExecutionContext): Promise<ExecutionContext>;
+}
+export type WorkflowExecutionContextCreatorProvider = () => WorkflowExecutionContextCreator;
+export interface WorkflowExecutionContextBuilderDeps {
+    readonly store: Store;
+    readonly logger: Logger;
+    readonly workflowInstanceLoader: ExecutionWorkflowInstanceLoaderProvider;
+    /** The decrypt-for-execution path (oss#405); a direct service, no RPC. */
+    readonly environmentResolution: RuntimeResolutionService;
+    readonly executionContextCreator: WorkflowExecutionContextCreatorProvider;
+}
+export declare function newCreateExecutionContextStep(deps: WorkflowExecutionContextBuilderDeps): PipelineStep<typeof WorkflowExecutionSchema>;
+//# sourceMappingURL=create-execution-context-step.d.ts.map

package/dist/domain/workflowexecution/create-execution-context-step.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-execution-context-step.d.ts","sourceRoot":"","sources":["../../../src/domain/workflowexecution/create-execution-context-step.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+DAA+D,CAAC;AAItG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+DAA+D,CAAC;AACtG,OAAO,EAAE,uBAAuB,EAAE,MAAM,gEAAgE,CAAC;AAIzG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mDAAmD,CAAC;AAUlG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD;;;GAGG;AACH,MAAM,WAAW,+BAA+B;IAC9C,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACpD;AACD,MAAM,MAAM,uCAAuC,GACjD,MAAM,+BAA+B,CAAC;AAExC,8EAA8E;AAC9E,MAAM,WAAW,+BAA+B;IAC9C,MAAM,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACvE;AACD,MAAM,MAAM,uCAAuC,GACjD,MAAM,+BAA+B,CAAC;AAExC,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,sBAAsB,EAAE,uCAAuC,CAAC;IACzE,0EAA0E;IAC1E,QAAQ,CAAC,qBAAqB,EAAE,wBAAwB,CAAC;IACzD,QAAQ,CAAC,uBAAuB,EAAE,uCAAuC,CAAC;CAC3E;AAED,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,mCAAmC,GACxC,YAAY,CAAC,OAAO,uBAAuB,CAAC,CA8H9C"}