@stigmer/server 3.14.0-dev.20260910084630

package/dist/extensions/list-read-scope.d.ts

@@ -0,0 +1,108 @@
+/**
+ * The list-read-scope extension point (convergence program, pre-X1 entry
+ * 20260830.01.sp.list-read-scoping; generalizes and ABSORBS the C2
+ * Stage-4 ExecutionReadScope, whose two summary consumers now ride the
+ * enumeration verb below). OSS list-shaped reads — the list/getByAgent
+ * chains, apikey findAll, search, recent activity, the two dashboard
+ * summaries — are deliberate full scans on OSS (single-user: everything
+ * is yours). On a multi-tenant edition the same scans serve OTHER
+ * tenants' rows, so the cloud baseline (the Java list handlers) narrows
+ * every one of them to the caller's FGA-authorized id set (ListObjects
+ * on can_view, public wildcards suppressed), with a second guest
+ * cookie-label rule on the session and agent-execution lanes.
+ *
+ * This port is the ONE seam for that fork (DD-007 addendum 3: every
+ * list-shaped fork rides a driver; the Authorizer keeps one verb — the
+ * organizationDirectory precedent, never a second registration of an
+ * OSS-served RPC). Two verbs, each with a distinct consumer family:
+ *
+ *   - `authorizedResourceIds` — pure enumeration, for consumers that
+ *     need the id set BEFORE or WITHOUT scanned rows: the search lane
+ *     (ids go into the engine query as a hard filter — pagination is
+ *     engine-side, post-filtering would break it), the recent-activity
+ *     merge, and the two getExecutionSummary aggregates.
+ *   - `restrictListEntries` — candidates in, kept ids out, for every
+ *     post-scan list lane through `restrictListByReadScope` below. The
+ *     candidate metadata lets a driver apply per-row rules the id set
+ *     cannot express (the cloud's guest cookie-label rule — label-driven
+ *     and therefore self-limiting: it only bites rows carrying the guest
+ *     label, so the uniform call is correct on every lane).
+ *
+ * The contract, ratified at this entry's plan gate (T01_1_review.md):
+ *
+ *   - No scope composed = the OSS full scan, byte-identical (the four
+ *     local conformance rosters pin it; the org argument is then not
+ *     consulted either).
+ *   - A scope only NARROWS. It never reorders, never adds; sort/filter
+ *     tails, per-lane org intersection, and empty-set semantics (empty
+ *     list, proto default instance, kind-skipped) stay consumer-owned
+ *     and edition-neutral.
+ *   - A scope that cannot answer THROWS — never an empty set. An empty
+ *     set is a REAL answer ("authorized to see nothing"); an
+ *     authorization-backend outage surfaces as the pipeline's sanitized
+ *     INTERNAL, exactly the Java baseline (DD-007: unavailable is never
+ *     softened).
+ *   - The scope receives whatever identity the call carries, including
+ *     the in-process `internal` class — the driver owns that arm's
+ *     semantics (the Java baseline propagates the original caller
+ *     through in-process calls, so a composed driver normally never
+ *     sees `internal` on these lanes).
+ */
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { CallerIdentity } from "./identity.js";
+/**
+ * The candidate metadata a post-scan lane offers the scope — the three
+ * fields the cloud driver's rules key on (id for the FGA intersection,
+ * labels for the guest cookie rule; org rides along for symmetry with
+ * the consumer-owned intersection, so a driver can log or assert on it).
+ */
+export interface ListEntryMeta {
+    readonly id: string;
+    readonly org: string;
+    readonly labels: Readonly<Record<string, string>>;
+}
+/** The scope contract (single-instance point, ExtensionDrivers.listReadScope). */
+export interface ListReadScope {
+    /**
+     * The resource ids `caller` may read for `kind` (the Java baseline:
+     * FGA listAuthorizedResourceIds on can_view). An empty set is a real
+     * answer — consumers map it to their lane's empty shape without
+     * touching the store. A scope may throw on a kind it was never ruled
+     * to serve (a consumer bug by contract).
+     */
+    authorizedResourceIds(caller: CallerIdentity, kind: ApiResourceKind): Promise<ReadonlySet<string>>;
+    /**
+     * The subset of `entries` ids `caller` may read for `kind` (the Java
+     * baseline: the authorized-ids intersection plus the guest
+     * cookie-label rule where the lane carries it). The result must be a
+     * subset of the offered ids — a scope only narrows.
+     */
+    restrictListEntries(caller: CallerIdentity, kind: ApiResourceKind, entries: ReadonlyArray<ListEntryMeta>): Promise<ReadonlySet<string>>;
+}
+/**
+ * The shape every stored API resource message presents to the shared
+ * helper — the metadata fields the scope's candidates are built from.
+ */
+export interface ScopedListResource {
+    metadata?: {
+        id?: string;
+        org?: string;
+        labels?: Record<string, string>;
+    };
+}
+/**
+ * The ONE consumption idiom for post-scan lanes (the shared-step
+ * discipline of pipeline/steps/authorization-tuples.ts, rendered as a
+ * helper because half the lanes are direct handlers):
+ *
+ *   - no scope composed → the input array unchanged (byte-identity;
+ *     `requestOrg` deliberately not consulted — the OSS single-tenant
+ *     posture treats the org field as a no-op, and new filtering on a
+ *     scope-less server would be a silent wire change);
+ *   - scope composed → entries narrowed to the kept ids, then to
+ *     `requestOrg` when non-blank (the Java repos' uniform posture:
+ *     blank org = permission-bounded across orgs, verified per lane in
+ *     the entry's census — lanes Java does not org-narrow pass "").
+ */
+export declare function restrictListByReadScope<T extends ScopedListResource>(scope: ListReadScope | undefined, caller: CallerIdentity, kind: ApiResourceKind, resources: ReadonlyArray<T>, requestOrg: string): Promise<T[]>;
+//# sourceMappingURL=list-read-scope.d.ts.map

package/dist/extensions/list-read-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-read-scope.d.ts","sourceRoot":"","sources":["../../src/extensions/list-read-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAE3H,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACnD;AAED,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,qBAAqB,CACnB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAEhC;;;;;OAKG;IACH,mBAAmB,CACjB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,GACpC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE;QACT,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,CAAC;CACH;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,uBAAuB,CAAC,CAAC,SAAS,kBAAkB,EACxE,KAAK,EAAE,aAAa,GAAG,SAAS,EAChC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,eAAe,EACrB,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,EAC3B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,EAAE,CAAC,CAiBd"}

package/dist/extensions/list-read-scope.js

@@ -0,0 +1,31 @@
+/**
+ * The ONE consumption idiom for post-scan lanes (the shared-step
+ * discipline of pipeline/steps/authorization-tuples.ts, rendered as a
+ * helper because half the lanes are direct handlers):
+ *
+ *   - no scope composed → the input array unchanged (byte-identity;
+ *     `requestOrg` deliberately not consulted — the OSS single-tenant
+ *     posture treats the org field as a no-op, and new filtering on a
+ *     scope-less server would be a silent wire change);
+ *   - scope composed → entries narrowed to the kept ids, then to
+ *     `requestOrg` when non-blank (the Java repos' uniform posture:
+ *     blank org = permission-bounded across orgs, verified per lane in
+ *     the entry's census — lanes Java does not org-narrow pass "").
+ */
+export async function restrictListByReadScope(scope, caller, kind, resources, requestOrg) {
+    if (scope === undefined) {
+        return [...resources];
+    }
+    const entries = resources.map((resource) => ({
+        id: resource.metadata?.id ?? "",
+        org: resource.metadata?.org ?? "",
+        labels: resource.metadata?.labels ?? {},
+    }));
+    const keptIds = await scope.restrictListEntries(caller, kind, entries);
+    let kept = resources.filter((resource) => keptIds.has(resource.metadata?.id ?? ""));
+    if (requestOrg !== "") {
+        kept = kept.filter((resource) => resource.metadata?.org === requestOrg);
+    }
+    return kept;
+}
+//# sourceMappingURL=list-read-scope.js.map

package/dist/extensions/list-read-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-read-scope.js","sourceRoot":"","sources":["../../src/extensions/list-read-scope.ts"],"names":[],"mappings":"AAyGA;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAgC,EAChC,MAAsB,EACtB,IAAqB,EACrB,SAA2B,EAC3B,UAAkB;IAElB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,OAAO,GAAoB,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5D,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;QAC/B,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE;KACxC,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACvE,IAAI,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CACvC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CACzC,CAAC;IACF,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACtB,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/extensions/organization-directory.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The organization-directory extension point (convergence program C2,
+ * 20260827.10; plan-gate ruling Q7). Three organization query behaviors
+ * fork between editions — the forks are ratified vocabulary as the
+ * conformance capability flags, and this port is their ONE seam:
+ *
+ *   - `find` (org enumeration; capability `organizationEnumeration`):
+ *     single-tenant OSS enumerates freely; the cloud refuses with
+ *     UNIMPLEMENTED (tenant isolation — no caller may list orgs it does
+ *     not belong to).
+ *   - `findMyOrganizations` (capability `multiTenant`): OSS answers ALL
+ *     organizations (single-user semantics); the cloud filters to the
+ *     caller's authorized set.
+ *   - `getByExternalOrgId` (capability `externalOrgLookup`): deliberately
+ *     absent from the OSS partial registration (UNIMPLEMENTED by
+ *     construction); the cloud resolves external IdP org ids.
+ *
+ * No directory composed = the controller's OSS behavior, byte-identical.
+ * The controller stays the ONE owner of its chains — the directory
+ * answers policy questions and id lookups; it never handles RPCs.
+ */
+import type { CallerIdentity } from "./identity.js";
+/**
+ * The "no filtering" answer for listMyOrganizationIds — the OSS
+ * single-user semantics, also expressible by a composed directory.
+ */
+export declare const ALL_ORGANIZATIONS = "all";
+/** The directory contract (single-instance point, ExtensionDrivers.organizationDirectory). */
+export interface OrganizationDirectory {
+    /**
+     * When true, `find` refuses org enumeration with UNIMPLEMENTED before
+     * any store read (the cloud posture).
+     */
+    readonly refusesEnumeration: boolean;
+    /**
+     * The org ids the caller may see in findMyOrganizations, or
+     * ALL_ORGANIZATIONS for unfiltered results. Ids the store no longer
+     * holds are skipped by the controller (grants can outlive rows).
+     */
+    listMyOrganizationIds(caller: CallerIdentity): Promise<ReadonlyArray<string> | typeof ALL_ORGANIZATIONS>;
+    /**
+     * Resolves an external IdP organization id to the org's resource id;
+     * undefined = no mapping. When this method is present, the controller
+     * registers `getByExternalOrgId` (its chain stays controller-owned);
+     * when absent, the RPC stays unregistered and answers UNIMPLEMENTED.
+     */
+    getOrganizationIdByExternalOrgId?(externalOrgId: string): Promise<string | undefined>;
+}
+//# sourceMappingURL=organization-directory.d.ts.map

package/dist/extensions/organization-directory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization-directory.d.ts","sourceRoot":"","sources":["../../src/extensions/organization-directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;GAGG;AACH,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC,8FAA8F;AAC9F,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;OAIG;IACH,qBAAqB,CACnB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,OAAO,iBAAiB,CAAC,CAAC;IAC7D;;;;;OAKG;IACH,gCAAgC,CAAC,CAC/B,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAChC"}

package/dist/extensions/organization-directory.js

@@ -0,0 +1,6 @@
+/**
+ * The "no filtering" answer for listMyOrganizationIds — the OSS
+ * single-user semantics, also expressible by a composed directory.
+ */
+export const ALL_ORGANIZATIONS = "all";
+//# sourceMappingURL=organization-directory.js.map

package/dist/extensions/organization-directory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization-directory.js","sourceRoot":"","sources":["../../src/extensions/organization-directory.ts"],"names":[],"mappings":"AAuBA;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC"}

package/dist/extensions/registry.d.ts

@@ -0,0 +1,221 @@
+/**
+ * The extension registry — the ONE extension surface of the convergence
+ * program (20260826.02 blueprint/03 §2, DD-006; built by sub-project
+ * 20260826.09 / O1). `composeServer` gains an optional `extensions` list
+ * of named contribution units; this module merges them into the resolved
+ * registry the composition stages consume. With no units, OSS behaves
+ * byte-identically to today — every point resolves to an explicit empty
+ * default, never a nullable surprise (the composition doctrine).
+ *
+ * Why a LIST of named units and not one flat object: the cloud composes
+ * MANY extension packages (billing, IAM lifecycle, channel delivery, the
+ * FGA authorizer, drivers — blueprint §10), each contributing its piece.
+ * Units give the §2b collision rules something real to enforce — a second
+ * Authorizer is representable and therefore rejectable — and every boot
+ * error names its offending unit(s). Single-instance points share one
+ * uniform merge rule (at most one declaring unit; a second throws naming
+ * both); list points concatenate in unit order.
+ *
+ * Loud-fail discipline (DD-006 §2b): resolution runs FIRST in
+ * composeServer, before any stage has side effects. Registering into a
+ * gate slot that does not exist, duplicating a unit name, or doubling a
+ * single-instance point is a boot throw. Nothing degrades silently.
+ *
+ * Consumption map (each point's consumer entry): services + workers +
+ * edition are consumed here in O1; identity verifiers + authorizer land
+ * with O2; gate steps are consumed at the chain splice sites (the
+ * gate-slots.ts slot table) and status hooks at the agentexecution
+ * transition sites (status-observers.ts), both O4; the O5 driver kinds
+ * (catalog provider, artifact-storage registration, runner-credential
+ * provider) and O6's sandbox provisioners are consumed at their
+ * compose.ts construction sites; the require-authentication posture
+ * (20260904.02) is consumed where compose.ts builds the serving chain's
+ * identity source, OR'd with the OIDC-issuer arm.
+ */
+import type { DescMessage } from "@bufbuild/protobuf";
+import type { ConnectRouter } from "@connectrpc/connect";
+import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
+import type { ArtifactStorageDriverFactory } from "../artifactstorage/artifact-storage.js";
+import type { ChannelRuntime } from "../domain/agentchannel/channel-runtime.js";
+import type { SecretCodec } from "../encryption/codec.js";
+import type { ListReadScope } from "./list-read-scope.js";
+import type { ModelCatalogProvider } from "../domain/workflow/registry/model-catalog-provider.js";
+import type { VisitorErrorPolicy } from "../pipeline/interceptors/error-boundary.js";
+import type { PipelineStep } from "../pipeline/pipeline.js";
+import type { RunnerCredentialProvider } from "../runnerauth/runner-credential-provider.js";
+import type { SandboxProvisionerFactory } from "../sandbox/provisioner.js";
+import type { ScheduleFireCallerMint } from "./schedule-fire-caller.js";
+import type { WorkerFactory } from "../temporal/manager.js";
+import type { Authorizer } from "./authorizer.js";
+import type { CallerGuard } from "./caller-guards.js";
+import type { ExtensionDrivers } from "./drivers.js";
+import type { GateSlotName, ResolvedGateSteps } from "./gate-slots.js";
+import type { IdentityVerifier } from "./identity.js";
+import type { OrganizationDirectory } from "./organization-directory.js";
+import type { ResourceAuthorizationLifecycle } from "./resource-authorization.js";
+import type { AgentExecutionResponseDecorator, AgentExecutionStatusHooks, AgentExecutionStatusObserver } from "./status-hooks.js";
+/**
+ * Registers one or more ConnectRPC services on a router. Runs inside the
+ * ONE `routes` closure, so both the serving router and the in-process
+ * transport see the services automatically (blueprint §2a — a missed
+ * in-process wiring silently skipping extension services on cross-domain
+ * calls is exactly the bug this placement makes impossible).
+ */
+export type ExtensionServiceRegistration = (router: ConnectRouter) => void;
+/**
+ * One named extension unit — a package's whole contribution to the server
+ * composition. All fields but `name` are optional; an omitted field is
+ * the point's empty state.
+ */
+export interface ServerExtension {
+    /**
+     * Unique across the composed set; names the unit in boot logs and every
+     * registration error (`extension 'billing' …`).
+     */
+    readonly name: string;
+    /**
+     * The served edition (single-declaration point). Exactly one unit may
+     * declare it; undeclared compositions serve ServerEdition.oss. The
+     * cloud composition's first-party unit declares `cloud` — the D4
+     * addendum on blueprint §11 item 11.
+     */
+    readonly edition?: ServerEdition;
+    /**
+     * The require-authentication admission posture (single-declaration
+     * point, the edition's shape; entry 20260904.02). Declaring it turns
+     * the serving chain's tokenless-refusal arm on INDEPENDENTLY of the OSS
+     * OIDC issuer: a request with no credential on a non-`is_public` method
+     * is UNAUTHENTICATED "authentication token missing" (the Java
+     * interceptor's copy), instead of falling to the trusted-local
+     * single-operator identity. A composition whose own identity verifiers
+     * resolve its users declares this — the OSS issuer arm cannot be reused
+     * for it, because configuring the issuer also registers the OSS OIDC
+     * verifier ahead of the composition's own (compose.ts). Declaring the
+     * posture DOES compose the OSS API-key verifier, first in the chain
+     * (stigmer#984): the apikey domain mints `stk_` keys in every
+     * composition, and a server with an authentication posture honors the
+     * keys it issues.
+     *
+     * Typed as the literal `true`: the field is declared or omitted, never
+     * set to `false` — there is no "declared lenient" state to validate at
+     * boot. Exactly one unit may declare it (a second throws naming both);
+     * the declaring unit is named in the boot log and in the compose.ts
+     * invariant that refuses a posture whose unit registers no verifier of
+     * its own (the API-key lane alone cannot mint the first key).
+     */
+    readonly requireAuthentication?: true;
+    /** The authorization decision seam (single-instance point; consumed by O2). */
+    readonly authorizer?: Authorizer;
+    /** Ordered verifier-chain entries, appended in unit order (consumed by O2). */
+    readonly identityVerifiers?: ReadonlyArray<IdentityVerifier>;
+    /**
+     * Post-authentication caller guards, appended in unit order (entry
+     * 20260902.02 ruling Q1) — run by the serving chain's identity source
+     * after the stamp, never by the in-process chain (caller-guards.ts).
+     */
+    readonly callerGuards?: ReadonlyArray<CallerGuard>;
+    /**
+     * Gate-step registrations per declared slot (consumed by O4). Every key
+     * must name a declared slot — an unknown slot is a boot throw, the §2b
+     * contract that keeps a composition and its pinned server honest.
+     */
+    readonly gateSteps?: ReadonlyMap<GateSlotName, ReadonlyArray<PipelineStep<DescMessage>>>;
+    /** Agent-execution status observers/decorators (consumed by O4). */
+    readonly statusTransitionHooks?: AgentExecutionStatusHooks;
+    /** Driver substitutions (the O5 kinds — see drivers.ts). */
+    readonly drivers?: ExtensionDrivers;
+    /** Service registrations, appended to the routes closure after the OSS set. */
+    readonly services?: ReadonlyArray<ExtensionServiceRegistration>;
+    /** Temporal worker factories, appended to the manager's OSS factory list. */
+    readonly workers?: ReadonlyArray<WorkerFactory>;
+}
+/**
+ * The merged registry the composition stages consume. Every point is
+ * present with its explicit empty/default state — consumers never test
+ * for undefined, they iterate or read.
+ */
+export interface ResolvedExtensions {
+    /** Composed unit names, in order (boot-log material). */
+    readonly unitNames: ReadonlyArray<string>;
+    /** Defaults to ServerEdition.oss when no unit declares one. */
+    readonly edition: ServerEdition;
+    /**
+     * The unit-declared require-authentication posture, or undefined when
+     * no unit declares it (the OSS trusted-local posture — unless the OIDC
+     * issuer arm turns it on; compose.ts ORs the two). Carries the
+     * declaring unit's name: the boot log and the zero-verifier invariant
+     * both name it.
+     */
+    readonly requireAuthentication: {
+        readonly declaredBy: string;
+    } | undefined;
+    /**
+     * The single composed Authorizer, or undefined when none is registered —
+     * O2's consumption site installs the OSS permissive single-team default
+     * for the undefined arm (the default lives with the consumer that
+     * defines its semantics, not with this data holder).
+     */
+    readonly authorizer: Authorizer | undefined;
+    readonly identityVerifiers: ReadonlyArray<IdentityVerifier>;
+    readonly callerGuards: ReadonlyArray<CallerGuard>;
+    /** Slot name → steps, validated against DECLARED_GATE_SLOTS. */
+    readonly gateSteps: ResolvedGateSteps;
+    readonly statusObservers: ReadonlyArray<AgentExecutionStatusObserver>;
+    readonly responseDecorators: ReadonlyArray<AgentExecutionResponseDecorator>;
+    readonly drivers: ResolvedExtensionDrivers;
+    readonly services: ReadonlyArray<ExtensionServiceRegistration>;
+    readonly workers: ReadonlyArray<WorkerFactory>;
+}
+/**
+ * The merged driver points. The two providers follow the authorizer
+ * shape — undefined when no unit declares one, and the compose.ts
+ * consumption site installs the OSS default (the default lives with the
+ * consumer that defines its semantics, not with this data holder).
+ */
+export interface ResolvedExtensionDrivers {
+    readonly modelCatalogProvider: ModelCatalogProvider | undefined;
+    readonly runnerCredentialProvider: RunnerCredentialProvider | undefined;
+    /** The C2 tuple-lifecycle driver — undefined = the shared steps no-op. */
+    readonly resourceAuthorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
+    /** The C2 organization query directory — undefined = OSS behavior. */
+    readonly organizationDirectory: OrganizationDirectory | undefined;
+    /** Registered name → factory, validated against the built-in names. */
+    readonly artifactStorageDrivers: ReadonlyMap<string, ArtifactStorageDriverFactory>;
+    /** Registered name → factory, validated against the built-in names (§6d). */
+    readonly sandboxProvisionerDrivers: ReadonlyMap<string, SandboxProvisionerFactory>;
+    /**
+     * The composed channel runtime, or undefined when none is registered —
+     * the agentchannel consumption sites serve the byte-pinned refusal
+     * posture for the undefined arm (the default lives with the consumer
+     * that defines its semantics, not with this data holder).
+     */
+    readonly channelRuntime: ChannelRuntime | undefined;
+    /** The 20260830.01 list read scope — undefined = the OSS full scan. */
+    readonly listReadScope: ListReadScope | undefined;
+    /**
+     * The 20260830.03 visitor error policy — undefined = the error
+     * boundary runs only its structural raw-error conversion.
+     */
+    readonly visitorErrorPolicy: VisitorErrorPolicy | undefined;
+    /**
+     * The stigmer-cloud#572 schedule-fire caller mint — undefined =
+     * schedule fires enter the create pipeline as the `internal` class,
+     * OSS behavior byte-identical.
+     */
+    readonly scheduleFireCaller: ScheduleFireCallerMint | undefined;
+    /**
+     * Registered version token → codec (20260830.04 Stage 1), validated
+     * against the built-in v1. Empty = the facade is v1-only, OSS behavior
+     * byte-identical. The compose.ts keys stage merges the built-in v1
+     * codec in and resolves the write version fail-fast.
+     */
+    readonly secretCodecs: ReadonlyMap<string, SecretCodec>;
+}
+/**
+ * Merges the composed units, enforcing the §2b loud-fail rules. Runs
+ * before any composition stage — a throw here aborts boot with zero side
+ * effects. Plain Errors, not ConnectErrors: these are boot faults, the
+ * same class as the composition root's wiring throws.
+ */
+export declare function resolveExtensions(units?: ReadonlyArray<ServerExtension>): ResolvedExtensions;
+//# sourceMappingURL=registry.d.ts.map

package/dist/extensions/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/extensions/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAE3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,KAAK,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC7B,MAAM,mBAAmB,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;AAE3E;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAC9B,YAAY,EACZ,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CACzC,CAAC;IACF,oEAAoE;IACpE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,yBAAyB,CAAC;IAC3D,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IAChE,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CACjD;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC5E;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC5D,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAClD,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IACtE,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,+BAA+B,CAAC,CAAC;IAC5E,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IAC/D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,wBAAwB,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACxE,0EAA0E;IAC1E,QAAQ,CAAC,8BAA8B,EACnC,8BAA8B,GAC9B,SAAS,CAAC;IACd,sEAAsE;IACtE,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAClE,uEAAuE;IACvE,QAAQ,CAAC,sBAAsB,EAAE,WAAW,CAC1C,MAAM,EACN,4BAA4B,CAC7B,CAAC;IACF,6EAA6E;IAC7E,QAAQ,CAAC,yBAAyB,EAAE,WAAW,CAC7C,MAAM,EACN,yBAAyB,CAC1B,CAAC;IACF;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,SAAS,CAAC;IACpD,uEAAuE;IACvE,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC5D;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAChE;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACzD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,GAAE,aAAa,CAAC,eAAe,CAAM,GACzC,kBAAkB,CA0SpB"}