@stigmer/server 3.14.0-dev.20260910084630

package/dist/envmerge/envmerge.js

@@ -0,0 +1,88 @@
+import { ExecutionValueSchema } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/spec_pb";
+import { create } from "@bufbuild/protobuf";
+/**
+ * Merges two layers of environment configuration into a single map of
+ * ExecutionValue entries, suitable for persisting in an ExecutionContext.
+ *
+ * Merge priority (lowest to highest):
+ *  1. environments — resolved Environment resources from instance
+ *     environment_refs (in order; later overrides earlier; empty values
+ *     skipped)
+ *  2. runtimeEnv — execution-scoped runtime_env overrides
+ */
+export function mergeEnvironmentLayers(environments, runtimeEnv) {
+    const merged = new Map();
+    for (const env of environments) {
+        // Go skips nil slice elements; the defensive twin for a hole smuggled
+        // past the type system (Go merge_test.go pins this).
+        if (env === undefined) {
+            continue;
+        }
+        for (const [key, ev] of Object.entries(env.spec?.data ?? {})) {
+            if (ev.value === "") {
+                continue;
+            }
+            merged.set(key, create(ExecutionValueSchema, {
+                value: ev.value,
+                isSecret: ev.isSecret,
+            }));
+        }
+    }
+    for (const [key, ev] of Object.entries(runtimeEnv)) {
+        // Go skips nil entries; the TS analogue is an explicitly-undefined
+        // value in the record.
+        if (ev === undefined) {
+            continue;
+        }
+        merged.set(key, ev);
+    }
+    return merged;
+}
+/**
+ * Restricts a merged environment map to only the keys declared in the
+ * blueprint's env field (least-privilege): a blueprint only receives the
+ * variables it explicitly declared, even if the linked environments carry
+ * additional secrets. Empty declarations return the merged map unchanged
+ * (backward compatibility for blueprints declaring no env vars). Returns
+ * the filtered map and a sorted list of excluded keys for observability.
+ */
+export function filterByDeclaredKeys(merged, declarations) {
+    const declared = Object.keys(declarations);
+    if (declared.length === 0) {
+        return { filtered: merged, excludedKeys: [] };
+    }
+    const filtered = new Map();
+    const excludedKeys = [];
+    for (const [key, val] of merged) {
+        // Own-key membership only: `in` would answer true for inherited
+        // Object.prototype names (constructor, toString, __proto__, …),
+        // letting an undeclared secret with an exotic name slip the
+        // least-privilege filter. Go's map lookup is exact.
+        if (Object.hasOwn(declarations, key)) {
+            filtered.set(key, val);
+        }
+        else {
+            excludedKeys.push(key);
+        }
+    }
+    excludedKeys.sort();
+    return { filtered, excludedKeys };
+}
+/**
+ * Checks that every required (non-optional) declared key has an entry in
+ * the filtered map; returns the sorted missing keys (empty = passed).
+ */
+export function validateRequiredKeys(filtered, declarations) {
+    const missingRequired = [];
+    for (const [key, decl] of Object.entries(declarations)) {
+        if (decl.optional) {
+            continue;
+        }
+        if (!filtered.has(key)) {
+            missingRequired.push(key);
+        }
+    }
+    missingRequired.sort();
+    return missingRequired;
+}
+//# sourceMappingURL=envmerge.js.map

package/dist/envmerge/envmerge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envmerge.js","sourceRoot":"","sources":["../../src/envmerge/envmerge.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,oBAAoB,EAAE,MAAM,gEAAgE,CAAC;AACtG,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAA2B,EAC3B,UAA6C;IAE7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEjD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,sEAAsE;QACtE,qDAAqD;QACrD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7D,IAAI,EAAE,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,MAAM,CAAC,GAAG,CACR,GAAG,EACH,MAAM,CAAC,oBAAoB,EAAE;gBAC3B,KAAK,EAAE,EAAE,CAAC,KAAK;gBACf,QAAQ,EAAE,EAAE,CAAC,QAAQ;aACtB,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACnD,mEAAmE;QACnE,uBAAuB;QACvB,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAmC,EACnC,YAAkD;IAElD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IACnD,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QAChC,gEAAgE;QAChE,gEAAgE;QAChE,4DAA4D;QAC5D,oDAAoD;QACpD,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC;YACrC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,YAAY,CAAC,IAAI,EAAE,CAAC;IACpB,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAqC,EACrC,YAAkD;IAElD,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACvD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,eAAe,CAAC,IAAI,EAAE,CAAC;IACvB,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/extensions/authorizer.d.ts

@@ -0,0 +1,70 @@
+/**
+ * The Authorizer extension point — the one authorization decision seam of
+ * the convergence blueprint (20260826.02 blueprint/03 §5, DD-007), carried
+ * by the extension registry from O1 (20260826.09) and CONSUMED by O2,
+ * which splices the shared Authorize step at position 1 of every chain and
+ * installs the OSS permissive single-team default.
+ *
+ * The interface is transcribed verbatim from the ratified design. The
+ * `unavailable` arm is deliberate: the Java StepResult distinguishes
+ * denial from evaluation error so an authorization-backend outage surfaces
+ * as an INTERNAL fault, never a silent lockout dressed as
+ * PERMISSION_DENIED. An interface without that distinction would be wrong
+ * on day one — the deny/unavailable mapping is wire contract (deny →
+ * PERMISSION_DENIED; unavailable → INTERNAL), unit-tested both arms when
+ * O2 lands the step.
+ */
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import type { CallerIdentity } from "./identity.js";
+/**
+ * One authorization check: may `caller` exercise `permission` on the named
+ * resource? Permission names are the shared IamPermission enum verbatim —
+ * in the cloud they are the FGA relation vocabulary.
+ */
+export interface AuthzCheck {
+    readonly permission: IamPermission;
+    readonly resourceKind: ApiResourceKind;
+    readonly resourceId: string;
+}
+/**
+ * The decision arms (blueprint §5a — deny and unavailable are distinct).
+ *
+ * `not-found` is the C2 ruling-Q1 refinement (DD-007 addendum,
+ * 20260827.10): for RESOURCE-SCOPED checks, an authorizer that has
+ * verified the target does not exist answers not-found instead of deny —
+ * the Authorize step maps it to NOT_FOUND with the domain copy, matching
+ * the Java edition's deliberate load-before-authorize order
+ * (stigmer#224: a nonexistent id answers NOT_FOUND, never
+ * PERMISSION_DENIED). Only meaningful with a known kind and a non-empty
+ * resource id — anything else is an authorizer contract bug and surfaces
+ * as INTERNAL. The OSS permissive default never emits it.
+ */
+export type AuthzDecision = {
+    readonly kind: "allow";
+}
+/** A genuine denial — maps to PERMISSION_DENIED on the wire. */
+ | {
+    readonly kind: "deny";
+    readonly reason: string;
+}
+/** The resource-scoped target does not exist — maps to NOT_FOUND. */
+ | {
+    readonly kind: "not-found";
+}
+/** An evaluation failure — maps to INTERNAL on the wire, never a denial. */
+ | {
+    readonly kind: "unavailable";
+    readonly cause: Error;
+};
+/**
+ * The pure decision interface. Exactly ONE implementation is composed per
+ * server (the resolver enforces it): OSS's permissive single-team default
+ * (O2) or an extension's (the cloud registers OpenFGA). Write concerns —
+ * tuple seeding on create — are NOT authorization checks; they ride the
+ * post-persist gate slots (blueprint §5b item 4).
+ */
+export interface Authorizer {
+    authorize(caller: CallerIdentity, check: AuthzCheck): Promise<AuthzDecision>;
+}
+//# sourceMappingURL=authorizer.d.ts.map

package/dist/extensions/authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizer.d.ts","sourceRoot":"","sources":["../../src/extensions/authorizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAC3H,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAE/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE;AAC5B,gEAAgE;GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACpD,qEAAqE;GACnE;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE;AAChC,4EAA4E;GAC1E;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC9E"}

package/dist/extensions/authorizer.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=authorizer.js.map

package/dist/extensions/authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizer.js","sourceRoot":"","sources":["../../src/extensions/authorizer.ts"],"names":[],"mappings":""}

package/dist/extensions/caller-guards.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The post-authentication caller-guard seam (convergence entry
+ * 20260902.02, gate ruling Q1) — enforcement of the MINTING CLIENT's
+ * contract, run by the serving chassis after the position-1 identity
+ * stamp. The TS rendering of the cloud Java
+ * PlatformClientEnforcementInterceptor's home: verification says who the
+ * caller IS (the IdentityVerifier chain, deliberately token-only); a
+ * guard says whether the client that minted the credential may still be
+ * served (deletion-revocation liveness, cloud#342; Origin vs
+ * allowed_origins, oss#375). Java separates the two classes the same way.
+ *
+ * List point — guards concatenate in unit order and run in composed
+ * order; the first throw wins. OSS composes zero guards, so with none
+ * registered the serving chain behaves byte-identically to before the
+ * point existed (the conformance rosters pin that).
+ *
+ * The in-process exemption is STRUCTURAL, not policed: guards are a
+ * parameter of the serving chain's identity source only
+ * (createVerifierChainInterceptor); the in-process interceptor has no
+ * guard parameter to forget — the TS rendering of the Java
+ * InProcessCallContextHolder skip.
+ *
+ * Skip logic is the guard's own business. OSS runs every composed guard
+ * on every serving request with the FINAL stamped identity (claimed or
+ * trusted-local): which tokens a guard exempts (claim-less tokens, the
+ * load-bearing token_type skip, health/reflection services) is edition
+ * policy, decoded by the guard from CallerIdentity.rawToken — never OSS
+ * type widening (the O5 Q4 vocabulary doctrine).
+ *
+ * Fault doctrine (the verifier-chain doctrine applied to admission): a
+ * guard that REFUSES throws a ConnectError — its own wire mapping, and
+ * deliberate-refusal codes pass the position-0 error boundary untouched,
+ * so byte-pinned refusal copy survives to the wire. Any other throw is
+ * an infrastructure fault — INTERNAL, never softened into a denial (a
+ * store outage during a liveness read must not read as "client
+ * deleted"). The chassis logs both arms with the guard's name: position
+ * 1 sits outside the logging interceptor, so a guard's refusal would
+ * otherwise leave no operator record.
+ */
+import type { DescMethod } from "@bufbuild/protobuf";
+import type { CallerIdentity } from "./identity.js";
+export interface CallerGuard {
+    /** Names the guard in refusal and fault logs (e.g. 'platform-client'). */
+    readonly name: string;
+    /**
+     * Admits by returning; refuses by throwing a ConnectError (the guard's
+     * own wire mapping). Runs on unary AND stream calls, once per call at
+     * admission, before the handler and before validation. `method` carries
+     * its parent service descriptor (service-level skips need no extra
+     * parameter); `headers` is the request's wire metadata (the Origin
+     * check reads the plain lowercase `origin` key, the verified
+     * guest-mint-lane idiom).
+     */
+    guard(caller: CallerIdentity, method: DescMethod, headers: Headers): Promise<void>;
+}
+//# sourceMappingURL=caller-guards.d.ts.map

package/dist/extensions/caller-guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-guards.d.ts","sourceRoot":"","sources":["../../src/extensions/caller-guards.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;;OAQG;IACH,KAAK,CACH,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB"}

package/dist/extensions/caller-guards.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=caller-guards.js.map

package/dist/extensions/caller-guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-guards.js","sourceRoot":"","sources":["../../src/extensions/caller-guards.ts"],"names":[],"mappings":""}

package/dist/extensions/drivers.d.ts

@@ -0,0 +1,140 @@
+/**
+ * The drivers extension point — infrastructure substitution seams of the
+ * convergence blueprint (20260826.02 blueprint/03 §6, DD-006 §2a). The
+ * point exists from O1 (20260826.09); the registrable KINDS join with
+ * their extraction entries, each adding a field here as an owner-visible
+ * surface change:
+ *
+ *   - model-catalog provider (§6a) and artifact-storage driver
+ *     registration + runner-credential provider (§6b/§6c) — landed, O5
+ *     (20260827.02)
+ *   - sandbox provisioners (§6d) — landed, O6 (20260827.05)
+ *   - resource-authorization lifecycle + organization directory —
+ *     landed with C2 (20260827.10, rulings Q2/Q7)
+ *   - channel runtime (DD-004's serving seam) — landed with C3
+ *     (20260827.11, plan-gate ruling Q1)
+ *   - list read scope (the list-shaped tenant-isolation fork) — landed
+ *     with 20260830.01.sp.list-read-scoping, generalizing C2 Stage 4's
+ *     ExecutionReadScope (absorbed, gate ruling Q2)
+ *   - visitor error policy (the transport-boundary sanitizer's
+ *     edition semantics) — landed with 20260830.03, gate ruling Q1
+ *   - secret codecs (the versioned secret-value wire formats) — landed
+ *     with 20260830.04 Stage 1, gate ruling Q2
+ *   - schedule-fire caller (who a schedule fire acts as) — landed with
+ *     the stigmer-cloud#572 fix (the Java schedule-token mechanism's
+ *     seam; ruled 2026-09-01)
+ *
+ * Merge rules (enforced by resolveExtensions, DD-006 §2b): the two
+ * provider kinds are single-instance points — a second declaring unit is
+ * a boot throw naming both units (the authorizer rule); artifact-storage
+ * and sandbox-provisioner drivers merge as name-keyed maps — a
+ * duplicated name, or a name shadowing a built-in, is a boot throw (the
+ * gateSteps rule: a registration the factory could never reach must fail
+ * loudly, not sit dark). OSS defaults install at the boot/compose.ts
+ * consumption sites, never here (the default-lives-with-the-consumer
+ * doctrine).
+ */
+import type { ArtifactStorageDriverFactory } from "../artifactstorage/artifact-storage.js";
+import type { ChannelRuntime } from "../domain/agentchannel/channel-runtime.js";
+import type { SecretCodec } from "../encryption/codec.js";
+import type { ModelCatalogProvider } from "../domain/workflow/registry/model-catalog-provider.js";
+import type { VisitorErrorPolicy } from "../pipeline/interceptors/error-boundary.js";
+import type { RunnerCredentialProvider } from "../runnerauth/runner-credential-provider.js";
+import type { SandboxProvisionerFactory } from "../sandbox/provisioner.js";
+import type { ListReadScope } from "./list-read-scope.js";
+import type { OrganizationDirectory } from "./organization-directory.js";
+import type { ResourceAuthorizationLifecycle } from "./resource-authorization.js";
+import type { ScheduleFireCallerMint } from "./schedule-fire-caller.js";
+/** The driver contributions of one extension unit. */
+export interface ExtensionDrivers {
+    /**
+     * The model-catalog data source (DD-008; single-instance point). When
+     * composed, it replaces the OSS ModelRegistryStore everywhere — the
+     * OSS store and its upstream refresh are then never constructed.
+     */
+    readonly modelCatalogProvider?: ModelCatalogProvider;
+    /**
+     * The runner-credential mint/verify seam (§6c; single-instance point).
+     * When composed, it replaces the OSS execution-scoped HS256 default at
+     * every consumer (platform exchange, mcpserver connect, the
+     * executioncontext decrypt lane).
+     */
+    readonly runnerCredentialProvider?: RunnerCredentialProvider;
+    /**
+     * Blob-storage backends registrable by name (§6b), selectable through
+     * the ARTIFACT_STORAGE_TYPE / SKILL_ARTIFACT_STORAGE_TYPE config knobs.
+     * Factories, not instances — an unselected driver constructs nothing.
+     */
+    readonly artifactStorageDrivers?: ReadonlyMap<string, ArtifactStorageDriverFactory>;
+    /**
+     * Sandbox provisioners registrable by name (§6d), selectable through
+     * the SANDBOX_PROVISIONER_TYPE config knob. Factories, not instances —
+     * an unselected driver constructs nothing. The built-in names
+     * (local-process, docker, kubernetes — src/sandbox/provisioner.ts) are
+     * reserved.
+     */
+    readonly sandboxProvisionerDrivers?: ReadonlyMap<string, SandboxProvisionerFactory>;
+    /**
+     * The resource-authorization lifecycle seam (C2, ruling Q2;
+     * single-instance point). When composed, the three shared tuple steps
+     * (CreateAuthorizationTuples / CleanupIamPolicies /
+     * UpdateVisibilityTuples) deliver resolved events to it; when absent,
+     * those steps no-op — OSS behavior byte-identical.
+     */
+    readonly resourceAuthorizationLifecycle?: ResourceAuthorizationLifecycle;
+    /**
+     * The organization query directory (C2, ruling Q7; single-instance
+     * point). When composed, the organization controller consults it for
+     * the three edition forks (enumeration posture, my-orgs filtering,
+     * external-org lookup); when absent, OSS behavior byte-identical.
+     */
+    readonly organizationDirectory?: OrganizationDirectory;
+    /**
+     * The channel delivery runtime (DD-004's serving seam; single-instance
+     * point). When composed, the agentchannel install arms, the whole
+     * messaging and conversation surfaces, and the two write/delete hooks
+     * delegate to it; with none, the byte-pinned refusal posture serves
+     * (src/domain/agentchannel/channel-runtime.ts carries the contract).
+     */
+    readonly channelRuntime?: ChannelRuntime;
+    /**
+     * The list read scope (20260830.01; single-instance point; absorbs C2
+     * Stage 4's ExecutionReadScope). When composed, every ruled list-shaped
+     * read — the census of docs/authorization-coverage.md — narrows to the
+     * caller's authorized rows: post-scan lanes through
+     * restrictListByReadScope, the search/activity/summary lanes through
+     * the enumeration verb. When absent, the OSS full scan — byte-identical.
+     */
+    readonly listReadScope?: ListReadScope;
+    /**
+     * The visitor error policy (20260830.03; single-instance point) — the
+     * edition semantics of the serving chain's error boundary: WHO is on
+     * the anonymous surface and WHAT copy replaces a leak-prone
+     * description. When absent, the boundary runs only its structural
+     * raw-error conversion — OSS wire behavior otherwise byte-identical.
+     */
+    readonly visitorErrorPolicy?: VisitorErrorPolicy;
+    /**
+     * Secret codecs registrable by wire-format version token (20260830.04
+     * Stage 1, gate ruling Q2) — one entry per enc:v<N>: format the
+     * composition can read and (when selected by
+     * STIGMER_ENCRYPTION_WRITE_VERSION) write. Instances, not factories:
+     * the Java posture is "registration IS the ability to encrypt" — a
+     * codec exists exactly when its key machinery does. The built-in "v1"
+     * token is reserved (the OSS static-key codec installs at the
+     * compose.ts consumption site); registering it, or duplicating a
+     * version across units, is a boot throw. When absent, the facade is
+     * v1-only — OSS behavior byte-identical.
+     */
+    readonly secretCodecs?: ReadonlyMap<string, SecretCodec>;
+    /**
+     * The schedule-fire caller mint (stigmer-cloud#572; single-instance
+     * point) — the identity a schedule fire acts as when it re-enters the
+     * execution create pipeline. When composed, the RunStarter propagates
+     * the minted caller through the R5 in-process header on every fire
+     * (cron tick and manual trigger alike); when absent, fires enter as
+     * the `internal` class — OSS behavior byte-identical.
+     */
+    readonly scheduleFireCaller?: ScheduleFireCallerMint;
+}
+//# sourceMappingURL=drivers.d.ts.map

package/dist/extensions/drivers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drivers.d.ts","sourceRoot":"","sources":["../../src/extensions/drivers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,WAAW,CAC3C,MAAM,EACN,4BAA4B,CAC7B,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,WAAW,CAC9C,MAAM,EACN,yBAAyB,CAC1B,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC;IACzE;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACzD;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;CACtD"}

package/dist/extensions/drivers.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=drivers.js.map

package/dist/extensions/drivers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"drivers.js","sourceRoot":"","sources":["../../src/extensions/drivers.ts"],"names":[],"mappings":""}

package/dist/extensions/gate-slots.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Named gate slots — the pipeline injection mechanism of the convergence
+ * blueprint (20260826.02 blueprint/03 §3, DD-006 §2). A slot is a point in
+ * a shared per-RPC chain where the builder splices extension-registered
+ * gate steps: zero steps in OSS, the cloud's gates in the cloud
+ * composition. Slot names are PROTECTED VOCABULARY (never renamed,
+ * byte-stable), scoped `<chain-name>:<position>`.
+ *
+ * O1 (20260826.09) shipped the mechanism; O4 (20260827.07) declared the
+ * first five ratified slots at their Java-verified semantic positions,
+ * deferring `sandbox-acquisition:gate` to the entry that builds its
+ * splice sites (ruling Q1: a declared slot whose steps can never run
+ * would be a silent no-op, the exact failure §2b exists to prevent). C4
+ * (20260827.09) declares it: the workflow-execution chains have no
+ * generic pre-side-effect slot, and their Java-verified capacity-gate
+ * position (post-authorize, before any side effect, pre-provision —
+ * cloud#355's 7c/3b) is where the cloud's sandbox-capacity gate rides on
+ * BOTH the create and recover chains. The session lane needs no sixth
+ * splice — its capacity gates ride the two declared agent-execution
+ * slots, whose positions coincide exactly with the Java session gate.
+ *
+ * Two enforcement layers, deliberately redundant, both derived from the
+ * ONE literal tuple below (lockstep by construction):
+ *   - GateSlotName (compile time): the union of declared slot literals.
+ *     A TS consumer cannot express a registration into an unknown slot.
+ *   - DECLARED_GATE_SLOTS (boot time): the load-bearing §2b contract. A JS
+ *     consumer, or a composition built against a pin where a slot has
+ *     since moved, must throw loudly at boot — never no-op silently.
+ *
+ * Slot semantics for gate authors (recorded facts, not mechanisms —
+ * details in the ts-server guidelines' slot table):
+ *   - Slots run wherever their chain runs, INCLUDING in-process
+ *     invocations (the Java baseline: internal creations traverse the
+ *     full nested handler chains). In-process callers carry
+ *     `callerClass: "internal"` (O2's ratified identity semantics), where
+ *     the Java edition propagated the original caller — gates keying on
+ *     caller class must account for the `internal` arm.
+ *   - Slots do not honor chain-internal skip shortcuts (e.g. the
+ *     lifecycle already-in-target idempotent flag): a gate runs on every
+ *     traversal of its position and owns its own idempotency.
+ */
+import type { DescMessage } from "@bufbuild/protobuf";
+import type { PipelineStep } from "../pipeline/pipeline.js";
+/**
+ * The ratified slot names (blueprint 03 §3a). Grows only with
+ * owner-visible slot additions — each entry cites its chain position in
+ * the guidelines' slot table, which must match the splice sites exactly.
+ */
+export declare const GATE_SLOT_NAMES: readonly ["agent-execution-create:pre-side-effect-gate", "agent-execution-recover:pre-side-effect-gate", "agent-execution-submit-approval:gate", "session-create:pre-side-effect-gate", "org-create:post-persist", "sandbox-acquisition:gate"];
+/** The declared slot-name union — a registration outside it fails tsc. */
+export type GateSlotName = (typeof GATE_SLOT_NAMES)[number];
+/**
+ * The boot-time declared-slot set — resolveExtensions validates every
+ * registration against it (the §2b unknown-slot throw).
+ */
+export declare const DECLARED_GATE_SLOTS: ReadonlySet<string>;
+/**
+ * The merged slot registrations the chains consume — slot name → steps in
+ * unit order (registry.ts builds it; keys are validated slot names).
+ */
+export type ResolvedGateSteps = ReadonlyMap<string, ReadonlyArray<PipelineStep<DescMessage>>>;
+/**
+ * The steps registered into one slot, typed for the consuming chain — the
+ * ONE place the empty-slot default lives, so splice sites never scatter
+ * `?? []` and a slot-name typo is a compile error.
+ */
+export declare function stepsForSlot<Desc extends DescMessage>(gateSteps: ResolvedGateSteps, slot: GateSlotName): ReadonlyArray<PipelineStep<Desc>>;
+//# sourceMappingURL=gate-slots.d.ts.map

package/dist/extensions/gate-slots.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-slots.d.ts","sourceRoot":"","sources":["../../src/extensions/gate-slots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,eAAe,gPAOlB,CAAC;AAEX,0EAA0E;AAC1E,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAEnD,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,WAAW,CACzC,MAAM,EACN,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CACzC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAS,WAAW,EACnD,SAAS,EAAE,iBAAiB,EAC5B,IAAI,EAAE,YAAY,GACjB,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAOnC"}

package/dist/extensions/gate-slots.js

@@ -0,0 +1,32 @@
+/**
+ * The ratified slot names (blueprint 03 §3a). Grows only with
+ * owner-visible slot additions — each entry cites its chain position in
+ * the guidelines' slot table, which must match the splice sites exactly.
+ */
+export const GATE_SLOT_NAMES = [
+    "agent-execution-create:pre-side-effect-gate",
+    "agent-execution-recover:pre-side-effect-gate",
+    "agent-execution-submit-approval:gate",
+    "session-create:pre-side-effect-gate",
+    "org-create:post-persist",
+    "sandbox-acquisition:gate",
+];
+/**
+ * The boot-time declared-slot set — resolveExtensions validates every
+ * registration against it (the §2b unknown-slot throw).
+ */
+export const DECLARED_GATE_SLOTS = new Set(GATE_SLOT_NAMES);
+/**
+ * The steps registered into one slot, typed for the consuming chain — the
+ * ONE place the empty-slot default lives, so splice sites never scatter
+ * `?? []` and a slot-name typo is a compile error.
+ */
+export function stepsForSlot(gateSteps, slot) {
+    const steps = gateSteps.get(slot) ?? [];
+    // Sound narrowing: a gate step is written against
+    // RequestContext<DescMessage> and consumes only the context surface
+    // every specialization shares. Centralized here so no chain carries a
+    // local cast.
+    return steps;
+}
+//# sourceMappingURL=gate-slots.js.map

package/dist/extensions/gate-slots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-slots.js","sourceRoot":"","sources":["../../src/extensions/gate-slots.ts"],"names":[],"mappings":"AA6CA;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,6CAA6C;IAC7C,8CAA8C;IAC9C,sCAAsC;IACtC,qCAAqC;IACrC,yBAAyB;IACzB,0BAA0B;CAClB,CAAC;AAKX;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAC7D,eAAe,CAChB,CAAC;AAWF;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,SAA4B,EAC5B,IAAkB;IAElB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACxC,kDAAkD;IAClD,oEAAoE;IACpE,sEAAsE;IACtE,cAAc;IACd,OAAO,KAA0C,CAAC;AACpD,CAAC"}

package/dist/extensions/identity.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Identity extension-point types — the verifier-chain contract of the
+ * convergence blueprint (20260826.02 blueprint/03 §4, DD-007), carried by
+ * the extension registry from O1 (20260826.09) and consumed by the
+ * verifier-chain chassis (O2, 20260827.01 — pipeline/interceptors/auth.ts).
+ *
+ * The shapes are transcribed from the ratified design, not invented here:
+ * a verifier either CLAIMS a token (verifying it fully, throwing on
+ * signature/expiry/audience failure) or PASSES (returns null → next
+ * verifier) — the TS rendering of the Java ProviderManager chain. The
+ * product is one typed value, CallerIdentity, threaded explicitly through
+ * HandlerContext.values (never ambient state — the every-dependency-
+ * explicit doctrine).
+ */
+/**
+ * The caller-class discriminant. OSS knows user / machine / runner plus
+ * the in-process `internal` class (O2 ruling Q4: the TS rendering of the
+ * Java in-process authorization skip); the cloud composition extends the
+ * vocabulary (guest / channel / schedule) without an OSS enum change —
+ * hence the open string arm. `string & {}` keeps literal autocomplete
+ * while admitting extension values (a plain `string` would erase the
+ * known classes from the type surface).
+ *
+ * `internal` is ratified contract with a structural guarantee: it is
+ * minted ONLY by the in-process chain's identity interceptor
+ * (boot/inprocess.ts). No IdentityVerifier may produce it — the serving
+ * chain always overwrites the position-1 identity from the wire, so a
+ * spoofed internal class cannot enter through a transport.
+ */
+export type CallerClass = "user" | "machine" | "runner" | "internal" | (string & {});
+/**
+ * How the request reached the chain — the transport-trust discriminant
+ * the reserved-label guard keys on (C2 Stage 3, ruling R5; the TS
+ * rendering of the Java isInProcessCall arm, cloud#386). `in-process` is
+ * stamped ONLY by the in-process chain's identity interceptor — only
+ * server code can reach that transport, so the marker is unspoofable —
+ * and it survives caller PROPAGATION: a request-origin in-process call
+ * carries the ORIGINAL caller's identity with this origin, letting the
+ * server compose requests as the user (default-instance factories,
+ * managed environments) without those requests being mistaken for
+ * client-boundary writes. Absent means the wire.
+ */
+export type CallOrigin = "wire" | "in-process";
+/**
+ * The authenticated caller, produced by the verifier chain and read by the
+ * Authorizer and the audit-actor seam. Org membership is DELIBERATELY not
+ * carried (blueprint §4b): it is authorization data, resolved by the
+ * Authorizer per check, never cached on the identity.
+ */
+export interface CallerIdentity {
+    /** The principal the Authorizer sees (e.g. an identity-account id). */
+    readonly identityId: string;
+    readonly callerClass: CallerClass;
+    /** The issuer that vouched for the token (empty for local postures). */
+    readonly issuer: string;
+    /** The raw presented token, carried for downstream propagation. */
+    readonly rawToken: string;
+    /**
+     * Optional display identity for the audit-actor seam (O2 ruling Q5, the
+     * ratified DD-007 amendment): OIDC-class verifiers carry the caller's
+     * email/name claims here; the trusted-local identity carries the #400
+     * operator identity. Absent on identities whose issuer provides no
+     * display claims — the audit actor then falls back to identityId alone.
+     */
+    readonly email?: string;
+    readonly displayName?: string;
+    /**
+     * The transport the request entered through (C2 Stage 3, ruling R5).
+     * Absent = the wire; the in-process interceptor stamps `in-process` on
+     * every identity it forwards — minted internal AND propagated caller
+     * alike.
+     */
+    readonly origin?: CallOrigin;
+}
+/**
+ * One entry in the ordered token-verifier chain (claim-or-pass semantics,
+ * blueprint §4a). Order is composition order: OSS entries first, extension
+ * entries after, in extension-unit order.
+ */
+export interface IdentityVerifier {
+    /** Names the verifier in boot logs and auth failures (e.g. 'oidc'). */
+    readonly name: string;
+    /**
+     * Claims the token (returns the identity), passes (returns null so the
+     * next verifier runs), or throws — a verifier that RECOGNIZES a token
+     * but cannot verify it must throw, never pass (a pass would let a forged
+     * token fall through to a laxer verifier).
+     */
+    verify(token: string): Promise<CallerIdentity | null>;
+}
+//# sourceMappingURL=identity.d.ts.map

package/dist/extensions/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/extensions/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,SAAS,GACT,QAAQ,GACR,UAAU,GACV,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,YAAY,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;CACvD"}

package/dist/extensions/identity.js

@@ -0,0 +1,16 @@
+/**
+ * Identity extension-point types — the verifier-chain contract of the
+ * convergence blueprint (20260826.02 blueprint/03 §4, DD-007), carried by
+ * the extension registry from O1 (20260826.09) and consumed by the
+ * verifier-chain chassis (O2, 20260827.01 — pipeline/interceptors/auth.ts).
+ *
+ * The shapes are transcribed from the ratified design, not invented here:
+ * a verifier either CLAIMS a token (verifying it fully, throwing on
+ * signature/expiry/audience failure) or PASSES (returns null → next
+ * verifier) — the TS rendering of the Java ProviderManager chain. The
+ * product is one typed value, CallerIdentity, threaded explicitly through
+ * HandlerContext.values (never ambient state — the every-dependency-
+ * explicit doctrine).
+ */
+export {};
+//# sourceMappingURL=identity.js.map

package/dist/extensions/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/extensions/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}