@stigmer/server 3.14.0-dev.20260910084630

package/dist/extensions/registry.js

@@ -0,0 +1,230 @@
+import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
+import { BUILT_IN_STORAGE_TYPES } from "../artifactstorage/artifact-storage.js";
+import { V1_VERSION } from "../encryption/v1-codec.js";
+import { BUILT_IN_SANDBOX_PROVISIONER_TYPES } from "../sandbox/provisioner.js";
+import { DECLARED_GATE_SLOTS } from "./gate-slots.js";
+/**
+ * Merges the composed units, enforcing the §2b loud-fail rules. Runs
+ * before any composition stage — a throw here aborts boot with zero side
+ * effects. Plain Errors, not ConnectErrors: these are boot faults, the
+ * same class as the composition root's wiring throws.
+ */
+export function resolveExtensions(units = []) {
+    const unitNames = [];
+    const identityVerifiers = [];
+    const callerGuards = [];
+    const gateSteps = new Map();
+    const statusObservers = [];
+    const responseDecorators = [];
+    const services = [];
+    const workers = [];
+    let edition;
+    let editionDeclaredBy;
+    let requireAuthenticationDeclaredBy;
+    let authorizer;
+    let authorizerDeclaredBy;
+    let modelCatalogProvider;
+    let catalogDeclaredBy;
+    let runnerCredentialProvider;
+    let credentialDeclaredBy;
+    let resourceAuthorizationLifecycle;
+    let authorizationLifecycleDeclaredBy;
+    let organizationDirectory;
+    let organizationDirectoryDeclaredBy;
+    let channelRuntime;
+    let channelRuntimeDeclaredBy;
+    let listReadScope;
+    let listReadScopeDeclaredBy;
+    let visitorErrorPolicy;
+    let visitorErrorPolicyDeclaredBy;
+    let scheduleFireCaller;
+    let scheduleFireCallerDeclaredBy;
+    const artifactStorageDrivers = new Map();
+    const storageDriverDeclaredBy = new Map();
+    const sandboxProvisionerDrivers = new Map();
+    const sandboxDriverDeclaredBy = new Map();
+    const secretCodecs = new Map();
+    const secretCodecDeclaredBy = new Map();
+    for (const unit of units) {
+        if (unit.name === "") {
+            throw new Error("extension unit with an empty name — every extension must be named (names carry every registration error and boot log)");
+        }
+        if (unitNames.includes(unit.name)) {
+            throw new Error(`duplicate extension name '${unit.name}' — extension names must be unique across the composed set`);
+        }
+        unitNames.push(unit.name);
+        if (unit.edition !== undefined) {
+            if (unit.edition === ServerEdition.server_edition_unspecified) {
+                throw new Error(`extension '${unit.name}' declares edition 'server_edition_unspecified' — declare a concrete edition or omit the field`);
+            }
+            if (editionDeclaredBy !== undefined) {
+                throw new Error(`extension '${unit.name}' declares the server edition, but '${editionDeclaredBy}' already did — exactly one extension may declare the edition`);
+            }
+            edition = unit.edition;
+            editionDeclaredBy = unit.name;
+        }
+        if (unit.requireAuthentication !== undefined) {
+            if (requireAuthenticationDeclaredBy !== undefined) {
+                throw new Error(`extension '${unit.name}' declares the require-authentication posture, but '${requireAuthenticationDeclaredBy}' already did — exactly one extension may declare it`);
+            }
+            requireAuthenticationDeclaredBy = unit.name;
+        }
+        if (unit.authorizer !== undefined) {
+            if (authorizerDeclaredBy !== undefined) {
+                throw new Error(`extension '${unit.name}' registers an Authorizer, but '${authorizerDeclaredBy}' already did — exactly one Authorizer may be composed`);
+            }
+            authorizer = unit.authorizer;
+            authorizerDeclaredBy = unit.name;
+        }
+        if (unit.drivers?.modelCatalogProvider !== undefined) {
+            if (catalogDeclaredBy !== undefined) {
+                throw new Error(`extension '${unit.name}' registers a ModelCatalogProvider, but '${catalogDeclaredBy}' already did — exactly one may be composed`);
+            }
+            modelCatalogProvider = unit.drivers.modelCatalogProvider;
+            catalogDeclaredBy = unit.name;
+        }
+        if (unit.drivers?.runnerCredentialProvider !== undefined) {
+            if (credentialDeclaredBy !== undefined) {
+                throw new Error(`extension '${unit.name}' registers a RunnerCredentialProvider, but '${credentialDeclaredBy}' already did — exactly one may be composed`);
+            }
+            runnerCredentialProvider = unit.drivers.runnerCredentialProvider;
+            credentialDeclaredBy = unit.name;
+        }
+        if (unit.drivers?.resourceAuthorizationLifecycle !== undefined) {
+            if (authorizationLifecycleDeclaredBy !== undefined) {
+                throw new Error(`extension '${unit.name}' registers a ResourceAuthorizationLifecycle, but '${authorizationLifecycleDeclaredBy}' already did — exactly one may be composed`);
+            }
+            resourceAuthorizationLifecycle =
+                unit.drivers.resourceAuthorizationLifecycle;
+            authorizationLifecycleDeclaredBy = unit.name;
+        }
+        if (unit.drivers?.organizationDirectory !== undefined) {
+            if (organizationDirectoryDeclaredBy !== undefined) {
+                throw new Error(`extension '${unit.name}' registers an OrganizationDirectory, but '${organizationDirectoryDeclaredBy}' already did — exactly one may be composed`);
+            }
+            organizationDirectory = unit.drivers.organizationDirectory;
+            organizationDirectoryDeclaredBy = unit.name;
+        }
+        if (unit.drivers?.channelRuntime !== undefined) {
+            if (channelRuntimeDeclaredBy !== undefined) {
+                throw new Error(`extension '${unit.name}' registers a ChannelRuntime, but '${channelRuntimeDeclaredBy}' already did — exactly one may be composed`);
+            }
+            channelRuntime = unit.drivers.channelRuntime;
+            channelRuntimeDeclaredBy = unit.name;
+        }
+        if (unit.drivers?.listReadScope !== undefined) {
+            if (listReadScopeDeclaredBy !== undefined) {
+                throw new Error(`extension '${unit.name}' registers a ListReadScope, but '${listReadScopeDeclaredBy}' already did — exactly one may be composed`);
+            }
+            listReadScope = unit.drivers.listReadScope;
+            listReadScopeDeclaredBy = unit.name;
+        }
+        if (unit.drivers?.visitorErrorPolicy !== undefined) {
+            if (visitorErrorPolicyDeclaredBy !== undefined) {
+                throw new Error(`extension '${unit.name}' registers a VisitorErrorPolicy, but '${visitorErrorPolicyDeclaredBy}' already did — exactly one may be composed`);
+            }
+            visitorErrorPolicy = unit.drivers.visitorErrorPolicy;
+            visitorErrorPolicyDeclaredBy = unit.name;
+        }
+        if (unit.drivers?.scheduleFireCaller !== undefined) {
+            if (scheduleFireCallerDeclaredBy !== undefined) {
+                throw new Error(`extension '${unit.name}' registers a ScheduleFireCallerMint, but '${scheduleFireCallerDeclaredBy}' already did — exactly one may be composed`);
+            }
+            scheduleFireCaller = unit.drivers.scheduleFireCaller;
+            scheduleFireCallerDeclaredBy = unit.name;
+        }
+        if (unit.drivers?.artifactStorageDrivers !== undefined) {
+            for (const [name, factory] of unit.drivers.artifactStorageDrivers) {
+                if (BUILT_IN_STORAGE_TYPES.includes(name)) {
+                    throw new Error(`extension '${unit.name}' registers artifact-storage driver '${name}', which shadows a built-in backend — built-in names are reserved`);
+                }
+                const declaredBy = storageDriverDeclaredBy.get(name);
+                if (declaredBy !== undefined) {
+                    throw new Error(`extension '${unit.name}' registers artifact-storage driver '${name}', but '${declaredBy}' already did — driver names must be unique across the composed set`);
+                }
+                artifactStorageDrivers.set(name, factory);
+                storageDriverDeclaredBy.set(name, unit.name);
+            }
+        }
+        if (unit.drivers?.sandboxProvisionerDrivers !== undefined) {
+            for (const [name, factory] of unit.drivers.sandboxProvisionerDrivers) {
+                if (BUILT_IN_SANDBOX_PROVISIONER_TYPES.includes(name)) {
+                    throw new Error(`extension '${unit.name}' registers sandbox provisioner '${name}', which shadows a built-in driver — built-in names are reserved`);
+                }
+                const declaredBy = sandboxDriverDeclaredBy.get(name);
+                if (declaredBy !== undefined) {
+                    throw new Error(`extension '${unit.name}' registers sandbox provisioner '${name}', but '${declaredBy}' already did — driver names must be unique across the composed set`);
+                }
+                sandboxProvisionerDrivers.set(name, factory);
+                sandboxDriverDeclaredBy.set(name, unit.name);
+            }
+        }
+        if (unit.drivers?.secretCodecs !== undefined) {
+            for (const [version, codec] of unit.drivers.secretCodecs) {
+                if (version === V1_VERSION) {
+                    throw new Error(`extension '${unit.name}' registers secret codec '${version}', which shadows the built-in static-key codec — the v1 token is reserved`);
+                }
+                if (!/^v\d+$/.test(version) || codec.version !== version) {
+                    // A registration read-dispatch could never route to must fail
+                    // loudly, not sit dark (the gateSteps rule): tokens are the
+                    // enc:v<N>: capture, and the key must equal the codec's own
+                    // version.
+                    throw new Error(`extension '${unit.name}' registers secret codec '${version}' (codec declares '${codec.version}') — version tokens must match v<digits> and key their own codec`);
+                }
+                const declaredBy = secretCodecDeclaredBy.get(version);
+                if (declaredBy !== undefined) {
+                    throw new Error(`extension '${unit.name}' registers secret codec '${version}', but '${declaredBy}' already did — codec versions must be unique across the composed set`);
+                }
+                secretCodecs.set(version, codec);
+                secretCodecDeclaredBy.set(version, unit.name);
+            }
+        }
+        if (unit.gateSteps !== undefined) {
+            for (const [slot, steps] of unit.gateSteps) {
+                if (!DECLARED_GATE_SLOTS.has(slot)) {
+                    const declared = DECLARED_GATE_SLOTS.size > 0
+                        ? [...DECLARED_GATE_SLOTS].sort().join("', '")
+                        : "";
+                    throw new Error(`extension '${unit.name}' registered gate steps into unknown slot '${slot}' — declared slots: ${declared === "" ? "(none in this build)" : `'${declared}'`}`);
+                }
+                const existing = gateSteps.get(slot) ?? [];
+                gateSteps.set(slot, [...existing, ...steps]);
+            }
+        }
+        identityVerifiers.push(...(unit.identityVerifiers ?? []));
+        callerGuards.push(...(unit.callerGuards ?? []));
+        statusObservers.push(...(unit.statusTransitionHooks?.observers ?? []));
+        responseDecorators.push(...(unit.statusTransitionHooks?.responseDecorators ?? []));
+        services.push(...(unit.services ?? []));
+        workers.push(...(unit.workers ?? []));
+    }
+    return {
+        unitNames,
+        edition: edition ?? ServerEdition.oss,
+        requireAuthentication: requireAuthenticationDeclaredBy !== undefined
+            ? { declaredBy: requireAuthenticationDeclaredBy }
+            : undefined,
+        authorizer,
+        identityVerifiers,
+        callerGuards,
+        gateSteps,
+        statusObservers,
+        responseDecorators,
+        drivers: {
+            modelCatalogProvider,
+            runnerCredentialProvider,
+            resourceAuthorizationLifecycle,
+            organizationDirectory,
+            artifactStorageDrivers,
+            sandboxProvisionerDrivers,
+            channelRuntime,
+            listReadScope,
+            visitorErrorPolicy,
+            secretCodecs,
+            scheduleFireCaller,
+        },
+        services,
+        workers,
+    };
+}
+//# sourceMappingURL=registry.js.map

package/dist/extensions/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/extensions/registry.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAGtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAGhF,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAQvD,OAAO,EAAE,kCAAkC,EAAE,MAAM,2BAA2B,CAAC;AAK/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAqLtD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAwC,EAAE;IAE1C,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,iBAAiB,GAAuB,EAAE,CAAC;IACjD,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoD,CAAC;IAC9E,MAAM,eAAe,GAAmC,EAAE,CAAC;IAC3D,MAAM,kBAAkB,GAAsC,EAAE,CAAC;IACjE,MAAM,QAAQ,GAAmC,EAAE,CAAC;IACpD,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,IAAI,OAAkC,CAAC;IACvC,IAAI,iBAAqC,CAAC;IAC1C,IAAI,+BAAmD,CAAC;IACxD,IAAI,UAAkC,CAAC;IACvC,IAAI,oBAAwC,CAAC;IAC7C,IAAI,oBAAsD,CAAC;IAC3D,IAAI,iBAAqC,CAAC;IAC1C,IAAI,wBAA8D,CAAC;IACnE,IAAI,oBAAwC,CAAC;IAC7C,IAAI,8BAES,CAAC;IACd,IAAI,gCAAoD,CAAC;IACzD,IAAI,qBAAwD,CAAC;IAC7D,IAAI,+BAAmD,CAAC;IACxD,IAAI,cAA0C,CAAC;IAC/C,IAAI,wBAA4C,CAAC;IACjD,IAAI,aAAwC,CAAC;IAC7C,IAAI,uBAA2C,CAAC;IAChD,IAAI,kBAAkD,CAAC;IACvD,IAAI,4BAAgD,CAAC;IACrD,IAAI,kBAAsD,CAAC;IAC3D,IAAI,4BAAgD,CAAC;IACrD,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAGnC,CAAC;IACJ,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1D,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAGtC,CAAC;IACJ,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IACpD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAExD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,uHAAuH,CACxH,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,CAAC,IAAI,4DAA4D,CACnG,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE1B,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,OAAO,KAAK,aAAa,CAAC,0BAA0B,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,gGAAgG,CACxH,CAAC;YACJ,CAAC;YACD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,uCAAuC,iBAAiB,+DAA+D,CAC/I,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YACvB,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC;QAChC,CAAC;QAED,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YAC7C,IAAI,+BAA+B,KAAK,SAAS,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,uDAAuD,+BAA+B,sDAAsD,CACpK,CAAC;YACJ,CAAC;YACD,+BAA+B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC9C,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,mCAAmC,oBAAoB,wDAAwD,CACvI,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YAC7B,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC;QACnC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACrD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,4CAA4C,iBAAiB,6CAA6C,CAClI,CAAC;YACJ,CAAC;YACD,oBAAoB,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;YACzD,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC;QAChC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,wBAAwB,KAAK,SAAS,EAAE,CAAC;YACzD,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,gDAAgD,oBAAoB,6CAA6C,CACzI,CAAC;YACJ,CAAC;YACD,wBAAwB,GAAG,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC;YACjE,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC;QACnC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,8BAA8B,KAAK,SAAS,EAAE,CAAC;YAC/D,IAAI,gCAAgC,KAAK,SAAS,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,sDAAsD,gCAAgC,6CAA6C,CAC3J,CAAC;YACJ,CAAC;YACD,8BAA8B;gBAC5B,IAAI,CAAC,OAAO,CAAC,8BAA8B,CAAC;YAC9C,gCAAgC,GAAG,IAAI,CAAC,IAAI,CAAC;QAC/C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,qBAAqB,KAAK,SAAS,EAAE,CAAC;YACtD,IAAI,+BAA+B,KAAK,SAAS,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,8CAA8C,+BAA+B,6CAA6C,CAClJ,CAAC;YACJ,CAAC;YACD,qBAAqB,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC;YAC3D,+BAA+B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC9C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,cAAc,KAAK,SAAS,EAAE,CAAC;YAC/C,IAAI,wBAAwB,KAAK,SAAS,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,sCAAsC,wBAAwB,6CAA6C,CACnI,CAAC;YACJ,CAAC;YACD,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YAC7C,wBAAwB,GAAG,IAAI,CAAC,IAAI,CAAC;QACvC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,aAAa,KAAK,SAAS,EAAE,CAAC;YAC9C,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,qCAAqC,uBAAuB,6CAA6C,CACjI,CAAC;YACJ,CAAC;YACD,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;YAC3C,uBAAuB,GAAG,IAAI,CAAC,IAAI,CAAC;QACtC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,4BAA4B,KAAK,SAAS,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,0CAA0C,4BAA4B,6CAA6C,CAC3I,CAAC;YACJ,CAAC;YACD,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACrD,4BAA4B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC3C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,4BAA4B,KAAK,SAAS,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,8CAA8C,4BAA4B,6CAA6C,CAC/I,CAAC;YACJ,CAAC;YACD,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACrD,4BAA4B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC3C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,sBAAsB,KAAK,SAAS,EAAE,CAAC;YACvD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;gBAClE,IAAK,sBAAgD,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrE,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,wCAAwC,IAAI,mEAAmE,CACvI,CAAC;gBACJ,CAAC;gBACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,wCAAwC,IAAI,WAAW,UAAU,qEAAqE,CAC9J,CAAC;gBACJ,CAAC;gBACD,sBAAsB,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC1C,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,yBAAyB,KAAK,SAAS,EAAE,CAAC;YAC1D,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC;gBACrE,IAEI,kCACD,CAAC,QAAQ,CAAC,IAAI,CAAC,EAChB,CAAC;oBACD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,oCAAoC,IAAI,kEAAkE,CAClI,CAAC;gBACJ,CAAC;gBACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,oCAAoC,IAAI,WAAW,UAAU,qEAAqE,CAC1J,CAAC;gBACJ,CAAC;gBACD,yBAAyB,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC7C,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;YAC7C,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBACzD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,6BAA6B,OAAO,2EAA2E,CACvI,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;oBACzD,8DAA8D;oBAC9D,4DAA4D;oBAC5D,4DAA4D;oBAC5D,WAAW;oBACX,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,6BAA6B,OAAO,sBAAsB,KAAK,CAAC,OAAO,kEAAkE,CACjK,CAAC;gBACJ,CAAC;gBACD,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACtD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,6BAA6B,OAAO,WAAW,UAAU,uEAAuE,CACxJ,CAAC;gBACJ,CAAC;gBACD,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACjC,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC3C,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,MAAM,QAAQ,GACZ,mBAAmB,CAAC,IAAI,GAAG,CAAC;wBAC1B,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;wBAC9C,CAAC,CAAC,EAAE,CAAC;oBACT,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,8CAA8C,IAAI,uBACvE,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,QAAQ,GACzD,EAAE,CACH,CAAC;gBACJ,CAAC;gBACD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC3C,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1D,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QAChD,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,kBAAkB,CAAC,IAAI,CACrB,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAC1D,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,OAAO;QACL,SAAS;QACT,OAAO,EAAE,OAAO,IAAI,aAAa,CAAC,GAAG;QACrC,qBAAqB,EACnB,+BAA+B,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE,UAAU,EAAE,+BAA+B,EAAE;YACjD,CAAC,CAAC,SAAS;QACf,UAAU;QACV,iBAAiB;QACjB,YAAY;QACZ,SAAS;QACT,eAAe;QACf,kBAAkB;QAClB,OAAO,EAAE;YACP,oBAAoB;YACpB,wBAAwB;YACxB,8BAA8B;YAC9B,qBAAqB;YACrB,sBAAsB;YACtB,yBAAyB;YACzB,cAAc;YACd,aAAa;YACb,kBAAkB;YAClB,YAAY;YACZ,kBAAkB;SACnB;QACD,QAAQ;QACR,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/extensions/resource-authorization.d.ts

@@ -0,0 +1,135 @@
+/**
+ * The resource-authorization lifecycle extension point (convergence
+ * program C2, 20260827.10; plan-gate ruling Q2). The cloud edition writes
+ * relationship tuples (OpenFGA) at three verified points of every
+ * resource's life — creation, deletion, and visibility change — through
+ * ONE driver seam, mirroring the Java service's config-driven
+ * architecture (CreateAuthorizationTuplesStepV2 + cleanupIamPolicies +
+ * VisibilityTupleReconciler, the shapes production trusts today).
+ *
+ * Division of labor (the ratified design): the OSS steps
+ * (src/pipeline/steps/authorization-tuples.ts) resolve EVERYTHING
+ * edition-neutral — the kind's AuthorizationConfig from proto metadata,
+ * parent ids from spec fields, the visibility shape set-diff — and hand
+ * the driver fully-resolved events. The driver owns only the tuple
+ * writes. No driver composed = the steps no-op = OSS behavior is
+ * byte-identical (the empty-default doctrine, DD-006 §2a).
+ *
+ * Failure semantics are part of the contract (Java parity, verified
+ * against the cloud handlers 2026-08-27):
+ *   - onResourceCreated: SYNCHRONOUS, post-persist; a throw FAILS the
+ *     request (the resource row survives — half-created resources are an
+ *     inherited real state, healed by retry).
+ *   - onResourceDeleted: best-effort — the call site logs and continues;
+ *     a throw never fails the delete (orphaned grants are inert once the
+ *     resource row is gone; the cloud side owns convergence sweeps).
+ *   - onVisibilityChanged: SYNCHRONOUS, post-persist; a throw fails the
+ *     request (metadata may be persisted with tuples lagging — retrying
+ *     the same transition converges, the set-diff is idempotent).
+ */
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { OwnerAttributionType } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
+import type { CallerIdentity } from "./identity.js";
+/**
+ * The visibility tuple shapes of the shared FGA model, named
+ * edition-neutrally. The driver maps each to its tuple:
+ *   - org-viewer:      <kind>:<id>#viewer@organization:<org>#viewer
+ *   - public-viewer:   <kind>:<id>#viewer@identity_account:* (conditional)
+ *   - platform-viewer: <kind>:<id>#platform_viewer@identity_provider:<idp>#platform_user
+ *     (fans out per IdP the org owns — the driver's lookup, not OSS's)
+ */
+export type VisibilityTupleShape = "org-viewer" | "public-viewer" | "platform-viewer";
+/**
+ * One resolved structural link from the created resource to a parent
+ * object — the scope link (relation `organization` for ORGANIZATION
+ * scope, the configured relation for PARENT scope) and every configured
+ * additional parent, in that order. Parent ids are extracted from the
+ * resource's spec fields by the OSS resolution (the proto
+ * ParentRelationConfig.spec_field contract).
+ */
+export interface ResolvedParentLink {
+    /** The FGA relation on the created resource (e.g. "organization", "session", "subject"). */
+    readonly relation: string;
+    /** The parent object's kind. */
+    readonly parentKind: ApiResourceKind;
+    /** The parent object's resource id. */
+    readonly parentId: string;
+}
+/** Fired synchronously after a resource row is first persisted. */
+export interface ResourceCreatedEvent {
+    readonly kind: ApiResourceKind;
+    readonly resourceId: string;
+    /** metadata.org — empty for kinds outside org scope (e.g. organization itself). */
+    readonly orgId: string;
+    /** The authenticated creator — owner/creator tuples derive from it. */
+    readonly caller: CallerIdentity;
+    /**
+     * The kind's owner attribution (proto AuthorizationConfig.owner_type):
+     * DIRECT → owner tuple for the caller; SELF → owner tuple for the
+     * resource's own id; INHERITED/NONE/UNSPECIFIED → no owner tuple.
+     */
+    readonly ownerAttribution: OwnerAttributionType;
+    /** True only for kinds flagged requires_creator_tuple (immutable attribution). */
+    readonly requiresCreatorTuple: boolean;
+    /** Scope link + additional parents, fully resolved. */
+    readonly parentLinks: ReadonlyArray<ResolvedParentLink>;
+    /**
+     * The creation-time visibility expansion (the Java reconciler's
+     * `unspecified → level` transition), org floor included.
+     */
+    readonly visibilityShapes: ReadonlyArray<VisibilityTupleShape>;
+}
+/** Fired after a resource row is deleted (best-effort consumption). */
+export interface ResourceDeletedEvent {
+    readonly kind: ApiResourceKind;
+    readonly resourceId: string;
+    readonly orgId: string;
+    readonly caller: CallerIdentity;
+}
+/** Fired synchronously after a visibility change is persisted. */
+export interface VisibilityChangedEvent {
+    readonly kind: ApiResourceKind;
+    readonly resourceId: string;
+    readonly orgId: string;
+    /** Shapes present in the new level but not the old — to be written. */
+    readonly shapesToCreate: ReadonlyArray<VisibilityTupleShape>;
+    /** Shapes present in the old level but not the new — to be deleted. */
+    readonly shapesToDelete: ReadonlyArray<VisibilityTupleShape>;
+}
+/**
+ * Fired synchronously after a blueprint's `status.defaultInstanceId`
+ * pointer is persisted (C2 Stage 3 — the default_of structural-
+ * inheritance arm of the Java model). The invariant the driver upholds:
+ * the `<instanceKind>:<instanceId>#default_of@<blueprintKind>:<blueprintId>`
+ * tuple exists iff the pointer names the instance — written by the SAME
+ * flows that persist the pointer, never derived from the client-
+ * suppliable default-instance label. The tuple makes the default
+ * instance exactly as reachable as its blueprint (viewer from
+ * default_of); it never transitions and dies with the instance's normal
+ * deletion cleanup.
+ */
+export interface DefaultInstanceLinkedEvent {
+    readonly instanceKind: ApiResourceKind;
+    readonly instanceId: string;
+    readonly blueprintKind: ApiResourceKind;
+    readonly blueprintId: string;
+}
+/**
+ * The driver interface (single-instance point, registered via
+ * ExtensionDrivers.resourceAuthorizationLifecycle). Implementations must
+ * be idempotent per event — the surrounding chains retry whole requests,
+ * and duplicate grants must converge, not error.
+ */
+export interface ResourceAuthorizationLifecycle {
+    onResourceCreated(event: ResourceCreatedEvent): Promise<void>;
+    onResourceDeleted(event: ResourceDeletedEvent): Promise<void>;
+    onVisibilityChanged(event: VisibilityChangedEvent): Promise<void>;
+    /**
+     * OPTIONAL (added C2 Stage 3): synchronous, post-pointer-persist; a
+     * throw fails the request (the pointer survives — retry converges, the
+     * write is idempotent). Absent method = no structural link is written
+     * (the OSS posture: local access control needs none).
+     */
+    onDefaultInstanceLinked?(event: DefaultInstanceLinkedEvent): Promise<void>;
+}
+//# sourceMappingURL=resource-authorization.d.ts.map

package/dist/extensions/resource-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-authorization.d.ts","sourceRoot":"","sources":["../../src/extensions/resource-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAC3H,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wFAAwF,CAAC;AAEnI,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAC5B,YAAY,GACZ,eAAe,GACf,iBAAiB,CAAC;AAEtB;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,4FAA4F;IAC5F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gCAAgC;IAChC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,uCAAuC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;IAChD,kFAAkF;IAClF,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,uDAAuD;IACvD,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACxD;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAChE;AAED,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;IAC7D,uEAAuE;IACvE,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9D;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,eAAe,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,8BAA8B;IAC7C,iBAAiB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,iBAAiB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,mBAAmB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;OAKG;IACH,uBAAuB,CAAC,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5E"}

package/dist/extensions/resource-authorization.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=resource-authorization.js.map

package/dist/extensions/resource-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-authorization.js","sourceRoot":"","sources":["../../src/extensions/resource-authorization.ts"],"names":[],"mappings":""}

package/dist/extensions/schedule-fire-caller.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The schedule-fire caller seam (stigmer-cloud#572) — WHO a schedule fire
+ * acts as when the RunStarter re-enters the execution create pipeline.
+ *
+ * OSS deliberately has no caller identity on this lane (DD-015 D-G: the
+ * single-user edition has no tokens to carry one), so with no driver
+ * composed every fire enters as the in-process `internal` class — today's
+ * behavior, byte-identical. The cloud edition's Java baseline instead
+ * mints a schedule JWT per fire (sub = the org's system-schedule account,
+ * claim = the firing Schedule id) so the created session and execution
+ * carry real attribution and the schedule's viewer set reaches the run
+ * (the FGA model's session#schedule link — "without it a scheduled run is
+ * invisible to every human, including the schedule's owner"). This seam
+ * lets a composition supply that identity; the fire then propagates it
+ * through the R5 caller-propagation header exactly like the other
+ * request-origin in-process creates.
+ *
+ * Single-instance point. The mint is per fire — the schedule id is a
+ * claim of the minted credential, never a cached field — and a mint
+ * failure is an infrastructure fault: the RunStarter lets it propagate,
+ * so the tick activity retries (the deterministic execution name absorbs
+ * the retry) and a manual trigger surfaces the failure to its caller.
+ */
+import type { CallerIdentity } from "./identity.js";
+export interface ScheduleFireCallerMint {
+    /**
+     * Mints the caller identity one fire acts as. `rawToken` must carry the
+     * edition's verifiable credential for the identity (compositions read
+     * fire-scoped claims — e.g. the schedule id — from it downstream).
+     */
+    mintFireCaller(org: string, scheduleId: string): Promise<CallerIdentity>;
+}
+//# sourceMappingURL=schedule-fire-caller.d.ts.map

package/dist/extensions/schedule-fire-caller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schedule-fire-caller.d.ts","sourceRoot":"","sources":["../../src/extensions/schedule-fire-caller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1E"}

package/dist/extensions/schedule-fire-caller.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schedule-fire-caller.js.map

package/dist/extensions/schedule-fire-caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schedule-fire-caller.js","sourceRoot":"","sources":["../../src/extensions/schedule-fire-caller.ts"],"names":[],"mappings":""}

package/dist/extensions/status-hooks.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Status-transition hook types — the execution-lifecycle seam of the
+ * convergence blueprint (20260826.02 blueprint/03 §7, DD-006 §3), carried
+ * by the extension registry from O1 (20260826.09) and CONSUMED by O4 at
+ * the updateStatus chokepoint (src/domain/agentexecution/update-status.ts,
+ * the single merge point every status transition funnels through).
+ *
+ * The ratified contract, verbatim: observers fire synchronously after the
+ * store write and MAY NOT mutate the execution; decorators may contribute
+ * only response fields the OSS reply schema already carries (the
+ * control-signal field exists on the shared proto); StreamBroker.broadcast
+ * stays last. The workflow `stigmer/agent-execution/invoke` stays
+ * byte-identical — no extension activities inside it (the rejected
+ * alternative in DD-006).
+ *
+ * Scope note (ratified census finding): this hook family spans the
+ * agent-execution family ONLY. Workflowexecution is unmetered in the cloud
+ * edition, and no hook is built ahead of need there.
+ */
+import type { AgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import type { ExecutionPhase } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import type { UpdateStatusResponse } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/io_pb";
+/** One observed phase transition, delivered post-merge (blueprint §7). */
+export interface AgentExecutionStatusTransition {
+    /** The merged, persisted execution snapshot. Observers may not mutate it. */
+    readonly execution: AgentExecution;
+    readonly oldPhase: ExecutionPhase;
+    readonly newPhase: ExecutionPhase;
+}
+/**
+ * Fires synchronously after the merge persists. A throwing observer is an
+ * extension bug logged by the chokepoint, never a failed transition — the
+ * cloud's expiry sweep remains the reconciliation backstop it already is.
+ */
+export type AgentExecutionStatusObserver = (transition: AgentExecutionStatusTransition) => void | Promise<void>;
+/**
+ * Runs after the merge, before the reply; may set only fields the shared
+ * reply schema carries. Decorator failure degrades the contributed fields
+ * to their defaults (the verified non-fatal posture), never the RPC.
+ */
+export type AgentExecutionResponseDecorator = (execution: AgentExecution, response: UpdateStatusResponse) => void | Promise<void>;
+/** The hook bundle one extension unit contributes (both lists optional). */
+export interface AgentExecutionStatusHooks {
+    readonly observers?: ReadonlyArray<AgentExecutionStatusObserver>;
+    readonly responseDecorators?: ReadonlyArray<AgentExecutionResponseDecorator>;
+}
+//# sourceMappingURL=status-hooks.d.ts.map

package/dist/extensions/status-hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-hooks.d.ts","sourceRoot":"","sources":["../../src/extensions/status-hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6DAA6D,CAAC;AAClG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8DAA8D,CAAC;AACnG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4DAA4D,CAAC;AAEvG,0EAA0E;AAC1E,MAAM,WAAW,8BAA8B;IAC7C,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,MAAM,4BAA4B,GAAG,CACzC,UAAU,EAAE,8BAA8B,KACvC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;;;GAIG;AACH,MAAM,MAAM,+BAA+B,GAAG,CAC5C,SAAS,EAAE,cAAc,EACzB,QAAQ,EAAE,oBAAoB,KAC3B,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B,4EAA4E;AAC5E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IACjE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,aAAa,CAAC,+BAA+B,CAAC,CAAC;CAC9E"}

package/dist/extensions/status-hooks.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=status-hooks.js.map

package/dist/extensions/status-hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-hooks.js","sourceRoot":"","sources":["../../src/extensions/status-hooks.ts"],"names":[],"mappings":""}

package/dist/gocompat/query-escape.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Byte-exact ports of Go's net/url query encoding — shared by the artifact
+ * storage's signed URLs (#17) and the github broker's authorize-URL/token
+ * exchange (#13). Promoted out of src/artifactstorage/ on its second
+ * consumer per the shared-steps guideline.
+ *
+ * WHY not URLSearchParams: it differs from Go's url.QueryEscape on two
+ * characters ('~' escaped, '*' bare), which would break URL byte parity
+ * for values carrying them. The Go server is the behavioral reference for
+ * every URL a client sees during coexistence.
+ */
+/**
+ * Go url.QueryEscape, byte-exact: unreserved [A-Za-z0-9-_.~] pass, space
+ * becomes '+', everything else percent-encodes.
+ */
+export declare function goQueryEscape(s: string): string;
+/**
+ * Go url.Values.Encode for single-valued params: keys sorted
+ * lexicographically, keys and values QueryEscape'd, joined with '&'.
+ */
+export declare function goUrlValuesEncode(values: Record<string, string>): string;
+//# sourceMappingURL=query-escape.d.ts.map

package/dist/gocompat/query-escape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-escape.d.ts","sourceRoot":"","sources":["../../src/gocompat/query-escape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAa/C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAKxE"}

package/dist/gocompat/query-escape.js

@@ -0,0 +1,42 @@
+/**
+ * Byte-exact ports of Go's net/url query encoding — shared by the artifact
+ * storage's signed URLs (#17) and the github broker's authorize-URL/token
+ * exchange (#13). Promoted out of src/artifactstorage/ on its second
+ * consumer per the shared-steps guideline.
+ *
+ * WHY not URLSearchParams: it differs from Go's url.QueryEscape on two
+ * characters ('~' escaped, '*' bare), which would break URL byte parity
+ * for values carrying them. The Go server is the behavioral reference for
+ * every URL a client sees during coexistence.
+ */
+/**
+ * Go url.QueryEscape, byte-exact: unreserved [A-Za-z0-9-_.~] pass, space
+ * becomes '+', everything else percent-encodes.
+ */
+export function goQueryEscape(s) {
+    let out = "";
+    for (const byte of Buffer.from(s, "utf-8")) {
+        const c = String.fromCharCode(byte);
+        if (/[A-Za-z0-9\-_.~]/.test(c)) {
+            out += c;
+        }
+        else if (c === " ") {
+            out += "+";
+        }
+        else {
+            out += `%${byte.toString(16).toUpperCase().padStart(2, "0")}`;
+        }
+    }
+    return out;
+}
+/**
+ * Go url.Values.Encode for single-valued params: keys sorted
+ * lexicographically, keys and values QueryEscape'd, joined with '&'.
+ */
+export function goUrlValuesEncode(values) {
+    return Object.keys(values)
+        .sort()
+        .map((key) => `${goQueryEscape(key)}=${goQueryEscape(values[key] ?? "")}`)
+        .join("&");
+}
+//# sourceMappingURL=query-escape.js.map

package/dist/gocompat/query-escape.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-escape.js","sourceRoot":"","sources":["../../src/gocompat/query-escape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,GAAG,IAAI,CAAC,CAAC;QACX,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,GAAG,IAAI,GAAG,CAAC;QACb,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA8B;IAC9D,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SACvB,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;SACzE,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC"}

package/dist/gocompat/trim.d.ts

@@ -0,0 +1,10 @@
+export declare function goTrimSpace(value: string): string;
+/**
+ * Go strings.Fields — splits around runs of unicode.IsSpace. The JS twin
+ * hazard mirrors trim's: `\s` splits on U+FEFF (Go does not) and misses
+ * U+0085 (Go splits) — a `\s+`-based split changes which search terms a
+ * query produces on exactly those inputs. Returns no empty fields; an
+ * all-space (or empty) input yields [].
+ */
+export declare function goFields(value: string): string[];
+//# sourceMappingURL=trim.d.ts.map

package/dist/gocompat/trim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trim.d.ts","sourceRoot":"","sources":["../../src/gocompat/trim.ts"],"names":[],"mappings":"AAuBA,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAGhD"}

package/dist/gocompat/trim.js

@@ -0,0 +1,31 @@
+/**
+ * Go strings.TrimSpace — trims by unicode.IsSpace, the Unicode White_Space
+ * property (ASCII spaces, U+0085, U+00A0, U+1680, U+2000–U+200A, U+2028,
+ * U+2029, U+202F, U+205F, U+3000) — which EXCLUDES U+FEFF. JS String.trim's
+ * set is White_Space PLUS U+FEFF and MINUS U+0085, so the two disagree on
+ * BOM'd and NEL-padded input: a .trim()-based port flips Go's verdict on
+ * both (first found by the #8 skill parity panel on BOM'd SKILL.md files;
+ * promoted here when search criteria became the second consumer — a
+ * .trim()'d search query of exactly "\uFEFF" reads as LIST MODE where Go
+ * runs an empty-match SEARCH, and "\u0085" the mirror image).
+ *
+ * Proven by src/gocompat/__tests__/trim.test.ts and both consumers' suites.
+ */
+const GO_SPACE_CLASS = "\\t\\n\\v\\f\\r \\u0085\\u00A0\\u1680\\u2000-\\u200A\\u2028\\u2029\\u202F\\u205F\\u3000";
+const GO_TRIM_PATTERN = new RegExp(`^[${GO_SPACE_CLASS}]+|[${GO_SPACE_CLASS}]+$`, "g");
+const GO_FIELDS_PATTERN = new RegExp(`[${GO_SPACE_CLASS}]+`);
+export function goTrimSpace(value) {
+    return value.replace(GO_TRIM_PATTERN, "");
+}
+/**
+ * Go strings.Fields — splits around runs of unicode.IsSpace. The JS twin
+ * hazard mirrors trim's: `\s` splits on U+FEFF (Go does not) and misses
+ * U+0085 (Go splits) — a `\s+`-based split changes which search terms a
+ * query produces on exactly those inputs. Returns no empty fields; an
+ * all-space (or empty) input yields [].
+ */
+export function goFields(value) {
+    const trimmed = goTrimSpace(value);
+    return trimmed === "" ? [] : trimmed.split(GO_FIELDS_PATTERN);
+}
+//# sourceMappingURL=trim.js.map

package/dist/gocompat/trim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trim.js","sourceRoot":"","sources":["../../src/gocompat/trim.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,cAAc,GAClB,yFAAyF,CAAC;AAE5F,MAAM,eAAe,GAAG,IAAI,MAAM,CAChC,KAAK,cAAc,OAAO,cAAc,KAAK,EAC7C,GAAG,CACJ,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC,IAAI,cAAc,IAAI,CAAC,CAAC;AAE7D,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;AAChE,CAAC"}