@stigmer/server 3.14.0-dev.20260910084630

package/dist/identity/oidc-verifier.d.ts

@@ -0,0 +1,14 @@
+import type { IdentityVerifier } from "../extensions/identity.js";
+/** Java classifyAuthError arms — byte-pinned cross-edition copy. */
+export declare const TOKEN_EXPIRED_MESSAGE = "token has expired";
+export declare const TOKEN_AUDIENCE_MESSAGE = "token audience does not match the expected audience";
+export declare const TOKEN_SIGNATURE_MESSAGE = "token signature verification failed";
+export declare const INVALID_TOKEN_MESSAGE = "invalid token";
+export interface OidcVerifierConfig {
+    /** The issuer URL (already URL-validated by the config loader). */
+    readonly issuer: string;
+    /** The audience access tokens must carry. */
+    readonly audience: string;
+}
+export declare function newOidcIdentityVerifier(config: OidcVerifierConfig): IdentityVerifier;
+//# sourceMappingURL=oidc-verifier.d.ts.map

package/dist/identity/oidc-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-verifier.d.ts","sourceRoot":"","sources":["../../src/identity/oidc-verifier.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,2BAA2B,CAAC;AAEnC,oEAAoE;AACpE,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,sBAAsB,wDACoB,CAAC;AACxD,eAAO,MAAM,uBAAuB,wCAAwC,CAAC;AAC7E,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAErD,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAMD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,GACzB,gBAAgB,CA+DlB"}

package/dist/identity/oidc-verifier.js

@@ -0,0 +1,136 @@
+/**
+ * The generic OIDC identity verifier (O3, 20260827.06; DD-003: verification
+ * is OSS, the issuer is configuration) — the second OSS entry on the
+ * chassis's verifier chain, the TS rendering of the cloud's Nimbus
+ * JwtDecoders.fromOidcIssuerLocation + audience validator stack. Stigmer
+ * Cloud points STIGMER_OIDC_ISSUER at Auth0 and registers NO code here;
+ * any self-host points it at their own issuer (Keycloak, Okta, Dex, …).
+ *
+ * Claim rule: any JWT-shaped token (three non-empty dot-separated
+ * segments). API keys never look like JWTs (`stk_` + one Base64URL run),
+ * so ordering after the apikey verifier keeps both claims disjoint; a
+ * JWT-shaped token that fails verification THROWS (identity.ts contract)
+ * with the Java classifyAuthError copy, byte-pinned:
+ *
+ *   - expiry → "token has expired"
+ *   - audience mismatch → "token audience does not match the expected audience"
+ *   - signature / JWKS-key failures → "token signature verification failed"
+ *   - everything else → "invalid token"
+ *
+ * Discovery and key handling: the issuer's /.well-known/openid-configuration
+ * is fetched once (memoized on success, retried on the next request after
+ * a failure — a flaky IdP at boot must not permanently brick the lane),
+ * its `issuer` field must match the configured issuer exactly (RFC 8414
+ * §3.3), and the JWKS rides jose's createRemoteJWKSet (cached, rotation-
+ * aware). Discovery/JWKS OUTAGES are infrastructure faults — thrown as
+ * plain errors so the chassis maps them to INTERNAL, never a credential
+ * rejection (the DD-007 unavailable doctrine).
+ *
+ * Identity: identityId = `sub` (rejected as invalid when absent), issuer =
+ * the configured issuer, email/displayName from the standard `email`/`name`
+ * claims when present (the DD-007 Q5 addendum added the fields for exactly
+ * these claims).
+ */
+import { createRemoteJWKSet, jwtVerify, errors as joseErrors } from "jose";
+import { Code, ConnectError } from "@connectrpc/connect";
+/** Java classifyAuthError arms — byte-pinned cross-edition copy. */
+export const TOKEN_EXPIRED_MESSAGE = "token has expired";
+export const TOKEN_AUDIENCE_MESSAGE = "token audience does not match the expected audience";
+export const TOKEN_SIGNATURE_MESSAGE = "token signature verification failed";
+export const INVALID_TOKEN_MESSAGE = "invalid token";
+export function newOidcIdentityVerifier(config) {
+    let discovered;
+    async function discover() {
+        if (discovered !== undefined) {
+            return discovered;
+        }
+        const url = discoveryUrl(config.issuer);
+        const response = await fetch(url);
+        if (!response.ok) {
+            throw new Error(`OIDC discovery failed: ${url} answered HTTP ${response.status}`);
+        }
+        const document = (await response.json());
+        if (document.issuer !== config.issuer) {
+            throw new Error(`OIDC discovery failed: document issuer '${document.issuer ?? ""}' does not match configured issuer '${config.issuer}'`);
+        }
+        if (typeof document.jwks_uri !== "string" || document.jwks_uri === "") {
+            throw new Error(`OIDC discovery failed: ${url} carries no jwks_uri`);
+        }
+        discovered = { jwks: createRemoteJWKSet(new URL(document.jwks_uri)) };
+        return discovered;
+    }
+    return {
+        name: "oidc",
+        async verify(token) {
+            if (!isJwtShaped(token)) {
+                return null;
+            }
+            const issuer = await discover();
+            let payload;
+            try {
+                ({ payload } = await jwtVerify(token, issuer.jwks, {
+                    issuer: config.issuer,
+                    audience: config.audience,
+                }));
+            }
+            catch (error) {
+                throw classifyJoseError(error);
+            }
+            if (typeof payload.sub !== "string" || payload.sub === "") {
+                throw new ConnectError(INVALID_TOKEN_MESSAGE, Code.Unauthenticated);
+            }
+            return {
+                identityId: payload.sub,
+                callerClass: "user",
+                issuer: config.issuer,
+                rawToken: token,
+                ...(typeof payload["email"] === "string" && payload["email"] !== ""
+                    ? { email: payload["email"] }
+                    : {}),
+                ...(typeof payload["name"] === "string" && payload["name"] !== ""
+                    ? { displayName: payload["name"] }
+                    : {}),
+            };
+        },
+    };
+}
+/** issuer + /.well-known/openid-configuration (trailing-slash tolerant). */
+function discoveryUrl(issuer) {
+    return `${issuer.replace(/\/$/, "")}/.well-known/openid-configuration`;
+}
+/** Three non-empty dot-separated segments — the JWS compact shape. */
+function isJwtShaped(token) {
+    const segments = token.split(".");
+    return segments.length === 3 && segments.every((s) => s !== "");
+}
+/**
+ * Maps jose's verification failures onto the Java classifyAuthError arms.
+ * JWKS transport failures (discovery succeeded, key fetch did not) are
+ * NOT credential rejections — they rethrow as plain errors for the
+ * chassis's INTERNAL arm.
+ */
+function classifyJoseError(error) {
+    if (error instanceof joseErrors.JWTExpired) {
+        return new ConnectError(TOKEN_EXPIRED_MESSAGE, Code.Unauthenticated);
+    }
+    if (error instanceof joseErrors.JWTClaimValidationFailed) {
+        if (error.claim === "aud") {
+            return new ConnectError(TOKEN_AUDIENCE_MESSAGE, Code.Unauthenticated);
+        }
+        return new ConnectError(INVALID_TOKEN_MESSAGE, Code.Unauthenticated);
+    }
+    if (error instanceof joseErrors.JWSSignatureVerificationFailed ||
+        error instanceof joseErrors.JWKSNoMatchingKey ||
+        error instanceof joseErrors.JWKSMultipleMatchingKeys ||
+        error instanceof joseErrors.JWKSInvalid) {
+        return new ConnectError(TOKEN_SIGNATURE_MESSAGE, Code.Unauthenticated);
+    }
+    if (error instanceof joseErrors.JWTInvalid ||
+        error instanceof joseErrors.JWSInvalid) {
+        return new ConnectError(INVALID_TOKEN_MESSAGE, Code.Unauthenticated);
+    }
+    // JWKSTimeout, fetch failures, and anything unclassified: infrastructure —
+    // the chassis maps a non-ConnectError throw to INTERNAL.
+    return error;
+}
+//# sourceMappingURL=oidc-verifier.js.map

package/dist/identity/oidc-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-verifier.js","sourceRoot":"","sources":["../../src/identity/oidc-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,MAAM,CAAC;AAE3E,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAOzD,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AACzD,MAAM,CAAC,MAAM,sBAAsB,GACjC,qDAAqD,CAAC;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,qCAAqC,CAAC;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAarD,MAAM,UAAU,uBAAuB,CACrC,MAA0B;IAE1B,IAAI,UAAwC,CAAC;IAE7C,KAAK,UAAU,QAAQ;QACrB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,0BAA0B,GAAG,kBAAkB,QAAQ,CAAC,MAAM,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGtC,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,2CAA2C,QAAQ,CAAC,MAAM,IAAI,EAAE,uCAAuC,MAAM,CAAC,MAAM,GAAG,CACxH,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,sBAAsB,CAAC,CAAC;QACvE,CAAC;QACD,UAAU,GAAG,EAAE,IAAI,EAAE,kBAAkB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACtE,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,IAAI,OAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE;oBACjD,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;gBAC1D,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,OAAO,CAAC,GAAG;gBACvB,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,KAAK;gBACf,GAAG,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE;oBACjE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;oBAC7B,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE;oBAC/D,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;oBAClC,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC;AACzE,CAAC;AAED,sEAAsE;AACtE,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3C,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,YAAY,UAAU,CAAC,wBAAwB,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,IAAI,YAAY,CAAC,sBAAsB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,IACE,KAAK,YAAY,UAAU,CAAC,8BAA8B;QAC1D,KAAK,YAAY,UAAU,CAAC,iBAAiB;QAC7C,KAAK,YAAY,UAAU,CAAC,wBAAwB;QACpD,KAAK,YAAY,UAAU,CAAC,WAAW,EACvC,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,uBAAuB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACzE,CAAC;IACD,IACE,KAAK,YAAY,UAAU,CAAC,UAAU;QACtC,KAAK,YAAY,UAAU,CAAC,UAAU,EACtC,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,2EAA2E;IAC3E,yDAAyD;IACzD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,98 @@
+/**
+ * The @stigmer/server library contract (DD-005, sub-project 20260826.09).
+ *
+ * This file IS the blessed surface: the package.json exports map resolves
+ * the bare package name here and nowhere else, so everything a consumer
+ * (the cloud composition, or any composition built on the published
+ * package) may import appears below — and nothing else does. Deep imports
+ * into dist/ internals are unsupported; anything a consumer needs that is
+ * not exported is a seam request to OSS, never a reach-around. Additions
+ * to this file are owner-visible surface changes, extended only through
+ * gates (the DD-005 review property: a surface change is a one-file diff).
+ *
+ * The surface is exactly what the ratified architecture names (blueprint
+ * 20260826.02/03 §1) and the parameter types those entries force:
+ *   - the compose entry and config loading (composeServer + its options'
+ *     required types: ServerConfig via loadConfig, Logger via createLogger)
+ *   - the extension-point types (§2 — the whole src/extensions contract)
+ *   - the pipeline primitives extensions build gates AND extension-
+ *     registered services from (PipelineStep, RequestContext, the semantic
+ *     error helpers, and the typed store not-found errors the ratified
+ *     store-fault mapping keys on; C4 Stage 3 added the dispatch-policy
+ *     configs and the loaded-execution context key its capacity gates
+ *     consume; C4 Stage 4 added the executor, the identity read idiom,
+ *     and the two chain-front steps so extension services run the SAME
+ *     request idiom OSS controllers run)
+ *   - the driver interfaces (Store, ArtifactStorage; O5 added §6a/§6b/§6c —
+ *     ModelCatalogProvider, the widened storage surface, and
+ *     RunnerCredentialProvider; O6 added §6d — SandboxProvisioner and its
+ *     factory/registration types)
+ *   - the worker factory types extension workers implement (§8)
+ *   - the Postgres driver constructor (20260910.04 ruling 4), for a
+ *     composition that shares ONE database with this chain
+ *
+ * The package publishes to npm in lockstep with every other @stigmer/*
+ * package (stigmer-cloud project 20260910.04, amending DD-005): this file
+ * is the versioned contract a consumer pins by exact version. Everything
+ * below the barrel is internal and may change between releases without
+ * notice; everything on it changes only through a gate. The same server
+ * also ships as @stigmer/server-slim — the bundled deployable `stigmer up`
+ * launches — which exports nothing and is not a library.
+ */
+export { composeServer } from "./boot/compose.js";
+export type { ComposeOptions, ComposedServer } from "./boot/compose.js";
+export { loadConfig } from "./boot/config.js";
+export type { ServerConfig } from "./boot/config.js";
+export { createLogger } from "./boot/logger.js";
+export type { LogEntry, LogFields, Logger, LoggerOptions, LogLevel, LogSink, } from "./boot/logger.js";
+export type { ExtensionServiceRegistration, ResolvedExtensions, ServerExtension, } from "./extensions/registry.js";
+export type { CallerClass, CallerIdentity, IdentityVerifier, } from "./extensions/identity.js";
+export type { CallerGuard } from "./extensions/caller-guards.js";
+export type { Authorizer, AuthzCheck, AuthzDecision, } from "./extensions/authorizer.js";
+export type { GateSlotName } from "./extensions/gate-slots.js";
+export type { AgentExecutionResponseDecorator, AgentExecutionStatusHooks, AgentExecutionStatusObserver, AgentExecutionStatusTransition, } from "./extensions/status-hooks.js";
+export type { ExtensionDrivers } from "./extensions/drivers.js";
+export type { ResolvedExtensionDrivers } from "./extensions/registry.js";
+export type { DefaultInstanceLinkedEvent, ResourceAuthorizationLifecycle, ResourceCreatedEvent, ResourceDeletedEvent, VisibilityChangedEvent, VisibilityTupleShape, ResolvedParentLink, } from "./extensions/resource-authorization.js";
+export type { OrganizationDirectory } from "./extensions/organization-directory.js";
+export { ALL_ORGANIZATIONS } from "./extensions/organization-directory.js";
+export type { ListReadScope, ListEntryMeta, } from "./extensions/list-read-scope.js";
+export type { ScheduleFireCallerMint } from "./extensions/schedule-fire-caller.js";
+export type { VisitorErrorPolicy } from "./pipeline/interceptors/error-boundary.js";
+export { createErrorBoundaryInterceptor } from "./pipeline/interceptors/error-boundary.js";
+export { diffVisibilityShapes, visibilityShapesFor, } from "./pipeline/steps/authorization-tuples.js";
+export type { PipelineStep } from "./pipeline/pipeline.js";
+export { RequestContext } from "./pipeline/request-context.js";
+export { abortedError, alreadyExistsError, failedPreconditionError, internalError, invalidArgumentError, notFoundError, unavailableError, } from "./pipeline/errors.js";
+export { generateSlug } from "./pipeline/steps/slug.js";
+export { encodeInProcessCaller, IN_PROCESS_CALLER_HEADER, } from "./pipeline/interceptors/auth.js";
+export { callerIdentityKey, callerIdentityOf, } from "./pipeline/interceptors/auth.js";
+export { createVerifierChainInterceptor } from "./pipeline/interceptors/auth.js";
+export { authenticateBearerToken, parseBearerToken, } from "./pipeline/interceptors/auth.js";
+export { newPipeline } from "./pipeline/pipeline.js";
+export { newAuthorizeStep } from "./pipeline/steps/authorize.js";
+export { newValidateProtoStep } from "./pipeline/steps/validation.js";
+export type { Store } from "./store/interface.js";
+export { AuditNotFoundError, ResourceNotFoundError, } from "./store/interface.js";
+export type { RawResourceDocument } from "./store/interface.js";
+export { PostgresStore } from "./store/postgres/store.js";
+export type { ArtifactStorage, ArtifactStorageDriverFactory, PresignedUpload, StagedUploadLane, } from "./artifactstorage/artifact-storage.js";
+export { ArtifactStorageNotFoundError } from "./artifactstorage/artifact-storage.js";
+export { newR2ArtifactStorage } from "./artifactstorage/r2-storage.js";
+export type { R2StorageConfig } from "./artifactstorage/r2-storage.js";
+export type { ModelCatalogProvider } from "./domain/workflow/registry/model-catalog-provider.js";
+export { newModelCatalogProviderFromDocument } from "./domain/workflow/registry/document-catalog.js";
+export type { RunnerCredentialProvider, RunnerBootstrapCredentials, RunnerScopedTokenExchange, RunnerScopedTokenRequest, SandboxCredentialRequest, MemoryCaptureDecision, } from "./runnerauth/runner-credential-provider.js";
+export type { MintedToken } from "./runnerauth/runnerauth.js";
+export { InvalidTokenError, MintingDisabledError, TOKEN_TYPE_EXECUTION_SCOPED, } from "./runnerauth/runnerauth.js";
+export { DecryptionFailedError, EncryptionDisabledError, EncryptionScope, EncryptionUnavailableError, InvalidCiphertextError, SecretService, } from "./encryption/encryption.js";
+export type { SecretCodec } from "./encryption/codec.js";
+export type { SandboxDriverConfig, SandboxEnvironment, SandboxProbeState, SandboxProvisioner, SandboxProvisionerFactory, SandboxScope, } from "./sandbox/provisioner.js";
+export { BUILT_IN_SANDBOX_PROVISIONER_TYPES } from "./sandbox/provisioner.js";
+export { AgentExecutionTemporalConfig, ROUTING_SESSION, newConfigFromEnv as newAgentExecutionTemporalConfigFromEnv, } from "./domain/agentexecution/temporal/config.js";
+export { WORKFLOW_ROUTING_EXECUTION, WorkflowExecutionTemporalConfig, newWorkflowExecutionConfigFromEnv, } from "./domain/workflowexecution/temporal/config.js";
+export { LOADED_EXECUTION_KEY } from "./pipeline/request-context.js";
+export type { ChannelRuntime, ChannelRuntimeConversations, ChannelRuntimeInstalls, ChannelRuntimeMessaging, } from "./domain/agentchannel/channel-runtime.js";
+export type { CreateWorkerOptions, WorkerFactory, WorkerFactoryDeps, WorkerWorkflowSource, } from "./temporal/manager.js";
+export { bundleWorkflowCode } from "@temporalio/worker";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,YAAY,EACV,QAAQ,EACR,SAAS,EACT,MAAM,EACN,aAAa,EACb,QAAQ,EACR,OAAO,GACR,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,4BAA4B,EAC5B,kBAAkB,EAClB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AASlC,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAOjE,YAAY,EACV,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAIzE,YAAY,EACV,0BAA0B,EAC1B,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAChD,YAAY,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAC3E,YAAY,EACV,aAAa,EACb,aAAa,GACd,MAAM,iCAAiC,CAAC;AAIzC,YAAY,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AASnF,YAAY,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAGlD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAKxD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAgBzC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAOjF,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAKtE,YAAY,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAK9B,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAWhE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,YAAY,EACV,eAAe,EACf,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAIrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,YAAY,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAMvE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAKjG,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AACrG,YAAY,EACV,wBAAwB,EAKxB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EAKxB,qBAAqB,GACtB,MAAM,4CAA4C,CAAC;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAcpC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAMzD,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAS9E,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAQrE,YAAY,EACV,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,0CAA0C,CAAC;AAOlD,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -0,0 +1,143 @@
+/**
+ * The @stigmer/server library contract (DD-005, sub-project 20260826.09).
+ *
+ * This file IS the blessed surface: the package.json exports map resolves
+ * the bare package name here and nowhere else, so everything a consumer
+ * (the cloud composition, or any composition built on the published
+ * package) may import appears below — and nothing else does. Deep imports
+ * into dist/ internals are unsupported; anything a consumer needs that is
+ * not exported is a seam request to OSS, never a reach-around. Additions
+ * to this file are owner-visible surface changes, extended only through
+ * gates (the DD-005 review property: a surface change is a one-file diff).
+ *
+ * The surface is exactly what the ratified architecture names (blueprint
+ * 20260826.02/03 §1) and the parameter types those entries force:
+ *   - the compose entry and config loading (composeServer + its options'
+ *     required types: ServerConfig via loadConfig, Logger via createLogger)
+ *   - the extension-point types (§2 — the whole src/extensions contract)
+ *   - the pipeline primitives extensions build gates AND extension-
+ *     registered services from (PipelineStep, RequestContext, the semantic
+ *     error helpers, and the typed store not-found errors the ratified
+ *     store-fault mapping keys on; C4 Stage 3 added the dispatch-policy
+ *     configs and the loaded-execution context key its capacity gates
+ *     consume; C4 Stage 4 added the executor, the identity read idiom,
+ *     and the two chain-front steps so extension services run the SAME
+ *     request idiom OSS controllers run)
+ *   - the driver interfaces (Store, ArtifactStorage; O5 added §6a/§6b/§6c —
+ *     ModelCatalogProvider, the widened storage surface, and
+ *     RunnerCredentialProvider; O6 added §6d — SandboxProvisioner and its
+ *     factory/registration types)
+ *   - the worker factory types extension workers implement (§8)
+ *   - the Postgres driver constructor (20260910.04 ruling 4), for a
+ *     composition that shares ONE database with this chain
+ *
+ * The package publishes to npm in lockstep with every other @stigmer/*
+ * package (stigmer-cloud project 20260910.04, amending DD-005): this file
+ * is the versioned contract a consumer pins by exact version. Everything
+ * below the barrel is internal and may change between releases without
+ * notice; everything on it changes only through a gate. The same server
+ * also ships as @stigmer/server-slim — the bundled deployable `stigmer up`
+ * launches — which exports nothing and is not a library.
+ */
+// The compose entry and config loading.
+export { composeServer } from "./boot/compose.js";
+export { loadConfig } from "./boot/config.js";
+export { createLogger } from "./boot/logger.js";
+export { ALL_ORGANIZATIONS } from "./extensions/organization-directory.js";
+export { createErrorBoundaryInterceptor } from "./pipeline/interceptors/error-boundary.js";
+export { diffVisibilityShapes, visibilityShapesFor, } from "./pipeline/steps/authorization-tuples.js";
+export { RequestContext } from "./pipeline/request-context.js";
+export { abortedError, alreadyExistsError, failedPreconditionError, internalError, invalidArgumentError, notFoundError, unavailableError, } from "./pipeline/errors.js";
+// The shared slug derivation (C2 Stage 3): extension-registered resource
+// kinds derive slugs with the SAME generator both editions pin
+// (ApiRequestResourceSlugGenerator parity) — the semantics live exactly
+// once.
+export { generateSlug } from "./pipeline/steps/slug.js";
+// The in-process caller-propagation surface (ruling R5): extension code
+// composing requests through the in-process transport AS a caller rides
+// the same header the OSS asCaller adapters use. (callerIdentityOf and
+// callerIdentityKey ride the request-idiom export block below.)
+export { encodeInProcessCaller, IN_PROCESS_CALLER_HEADER, } from "./pipeline/interceptors/auth.js";
+// The request idiom for extension-REGISTERED services (C4 Stage 4): a
+// service contributed through ServerExtension.services runs the same
+// chain shape every OSS controller runs — identity read once
+// (callerIdentityOf), then Authorize (descriptor-driven from the
+// `(ai.stigmer.commons.rpc.config)` method options, owning the ratified
+// three-arm decision mapping and the `internal`-caller skip) and
+// ValidateProto at the chain front, executed by the pipeline (which owns
+// the sanitized-Internal error contract). Blessing these keeps
+// authorization and validation semantics single-definition: an extension
+// hand-rolling either would re-derive ratified wire behavior.
+// callerIdentityKey is the stamp side of the same contract — production
+// stamping stays the interceptors' job, but an extension's OWN service
+// tests must stamp what the serving chain stamps (the auth.test.ts
+// idiom) to exercise their chains over a router transport.
+export { callerIdentityKey, callerIdentityOf, } from "./pipeline/interceptors/auth.js";
+// The serving chassis factory (20260902.02, the error-boundary
+// precedent): a composition's OWN tests must drive its caller guards
+// through the REAL stamp→guard mechanism — the walk order, the fault
+// mapping, the refusal pass-through — never a re-derivation. Production
+// wiring stays compose.ts's job.
+export { createVerifierChainInterceptor } from "./pipeline/interceptors/auth.js";
+// The interceptor's inner identity walk on its own (stigmer#991): a
+// composition's extension-owned HTTP lanes are not Connect requests and
+// cannot ride the interceptor, but they must authenticate a presented
+// bearer with the SAME composed chain — one walk, two edges, never a
+// re-instantiated verifier list. Identity only; caller guards stay the
+// serving interceptor's (RPC-shaped by contract).
+export { authenticateBearerToken, parseBearerToken, } from "./pipeline/interceptors/auth.js";
+export { newPipeline } from "./pipeline/pipeline.js";
+export { newAuthorizeStep } from "./pipeline/steps/authorize.js";
+export { newValidateProtoStep } from "./pipeline/steps/validation.js";
+export { AuditNotFoundError, ResourceNotFoundError, } from "./store/interface.js";
+// The Postgres driver constructor (stigmer-cloud 20260910.04 ruling 4;
+// the newR2ArtifactStorage precedent for blessing a driver constructor).
+// A composition that runs its own schema chain in the SAME database as
+// this chain needs the OSS tables provisioned in its DB-backed tests
+// exactly as production provisions them: PostgresStore.open runs the
+// versioned chain under its advisory lock. The migrations themselves stay
+// internal — a consumer gets the driver, never the DDL — so the chain's
+// shape is not a contract and nothing outside this package can replay it
+// piecemeal. Not for production wiring: compose.ts selects the driver from
+// config (DD-010), and a composition never opens a second store.
+export { PostgresStore } from "./store/postgres/store.js";
+export { ArtifactStorageNotFoundError } from "./artifactstorage/artifact-storage.js";
+// The R2 driver constructor (C1 seam, 20260827.04): compositions register
+// per-domain R2 drivers with their own bucket/credential config while the
+// S3 plumbing lives exactly once in OSS (the §6b registration shape).
+export { newR2ArtifactStorage } from "./artifactstorage/r2-storage.js";
+// The document-driven provider constructor (C1 seam, 20260827.04): a
+// composition whose catalog source is its own (the cloud's DB-resident
+// baseline) builds providers from documents with the SAME interpretation
+// ModelRegistryStore uses — the semantics live exactly once in OSS.
+export { newModelCatalogProviderFromDocument } from "./domain/workflow/registry/document-catalog.js";
+export { InvalidTokenError, MintingDisabledError, TOKEN_TYPE_EXECUTION_SCOPED, } from "./runnerauth/runnerauth.js";
+// The secret-sealing seam (20260830.04 Stage 1, gate rulings Q2/Q3 —
+// widening the C4-era enc:v1 block): the SecretService facade over the
+// versioned-codec registry (async, scoped, batched, with reencrypt as the
+// sweep's one upgrade door), the SecretCodec contract an extension's
+// vault-backed formats implement (drivers.secretCodecs), the
+// EncryptionScope tenancy/location record every seal site threads, and
+// the TWO-ARMED error taxonomy the skip/propagate policies branch on
+// (value-scoped InvalidCiphertextError family vs infrastructure
+// EncryptionUnavailableError family). The service and its contract types,
+// not the crypto primitives — each wire format stays defined exactly
+// once. The maintenance-surface store verbs this seam blessed ride the
+// Store interface above; RawResourceDocument is their row shape.
+export { DecryptionFailedError, EncryptionDisabledError, EncryptionScope, EncryptionUnavailableError, InvalidCiphertextError, SecretService, } from "./encryption/encryption.js";
+export { BUILT_IN_SANDBOX_PROVISIONER_TYPES } from "./sandbox/provisioner.js";
+// The C4 Stage 3 gate seams: the dispatch-policy configs a capacity gate
+// reads — the UNSPECIFIED-resolution rules and routing modes are single
+// definitions by doctrine (oss#397), and their own headers name "a future
+// policy consumer" as the reason they must be consumed, never re-derived.
+// Plus the lifecycle chains' loaded-execution context key: recover-chain
+// gate steps read the loaded resource through it (ctx.newState on those
+// chains is the input message, not the resource).
+export { AgentExecutionTemporalConfig, ROUTING_SESSION, newConfigFromEnv as newAgentExecutionTemporalConfigFromEnv, } from "./domain/agentexecution/temporal/config.js";
+export { WORKFLOW_ROUTING_EXECUTION, WorkflowExecutionTemporalConfig, newWorkflowExecutionConfigFromEnv, } from "./domain/workflowexecution/temporal/config.js";
+export { LOADED_EXECUTION_KEY } from "./pipeline/request-context.js";
+// The SDK's pure-JS workflow bundler, re-exported so factories that
+// prebuild a shared bundle (the channel sweeps' pattern) need no runtime
+// dependency on @temporalio/worker of their own.
+export { bundleWorkflowCode } from "@temporalio/worker";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,wCAAwC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA+DhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAkB3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAIlD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,yEAAyE;AACzE,+DAA+D;AAC/D,wEAAwE;AACxE,QAAQ;AACR,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,gEAAgE;AAChE,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,sEAAsE;AACtE,qEAAqE;AACrE,6DAA6D;AAC7D,iEAAiE;AACjE,wEAAwE;AACxE,iEAAiE;AACjE,yEAAyE;AACzE,+DAA+D;AAC/D,yEAAyE;AACzE,8DAA8D;AAC9D,wEAAwE;AACxE,uEAAuE;AACvE,mEAAmE;AACnE,2DAA2D;AAC3D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,+DAA+D;AAC/D,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,oEAAoE;AACpE,wEAAwE;AACxE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kDAAkD;AAClD,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAMtE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAM9B,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAO1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAQvE,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AAkBrG,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,qEAAqE;AACrE,6DAA6D;AAC7D,uEAAuE;AACvE,qEAAqE;AACrE,gEAAgE;AAChE,0EAA0E;AAC1E,qEAAqE;AACrE,uEAAuE;AACvE,iEAAiE;AACjE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AAepC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAE9E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,kDAAkD;AAClD,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AA0BrE,oEAAoE;AACpE,yEAAyE;AACzE,iDAAiD;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/main.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":""}

package/dist/main.js

@@ -0,0 +1,62 @@
+/**
+ * Process entry for stigmer-server. The CLI's daemon launches this the
+ * way it launches the runner: a node binary + bundled entry path, with the
+ * env contract from daemon/env.ts (GRPC_PORT et al.) and a TCP readiness
+ * probe on the bound port.
+ *
+ * SIGTERM/SIGINT run the composed shutdown (NOT_SERVING → drain → exit) —
+ * the daemon stops components with signals, and in-flight requests get the
+ * drain budget rather than a mid-write connection reset.
+ *
+ * The async main() wrapper (not top-level await) is load-bearing: the slim
+ * artifact bundles this entry as CJS (scripts/bundle-slim.mjs), where
+ * top-level await cannot exist.
+ */
+import { loadConfig } from "./boot/config.js";
+import { composeServer } from "./boot/compose.js";
+import { createLogger } from "./boot/logger.js";
+import { setOperatorIdentity } from "./pipeline/steps/defaults.js";
+async function main() {
+    const config = loadConfig();
+    const logger = createLogger({
+        level: config.logLevel,
+        pretty: config.env === "local",
+    });
+    // Once per process, before any writer exists (#400) — the one-shot guard
+    // makes a duplicate install a loud boot bug.
+    setOperatorIdentity(config.operatorEmail, config.operatorName);
+    const server = await composeServer({ config, logger });
+    let shuttingDown = false;
+    const shutdown = (signal) => {
+        if (shuttingDown) {
+            return;
+        }
+        shuttingDown = true;
+        logger.info("shutting down", { signal });
+        server
+            .shutdown()
+            .then(() => process.exit(0))
+            .catch((error) => {
+            logger.error("shutdown failed", { error: String(error) });
+            process.exit(1);
+        });
+    };
+    process.on("SIGTERM", () => shutdown("SIGTERM"));
+    process.on("SIGINT", () => shutdown("SIGINT"));
+    try {
+        await server.start();
+    }
+    catch (error) {
+        logger.error("boot failed", {
+            error: error instanceof Error ? error.message : String(error),
+        });
+        process.exit(1);
+    }
+}
+main().catch((error) => {
+    // The logger may not exist yet (config/compose failures) — stderr is the
+    // one channel that always does.
+    console.error("boot failed:", error instanceof Error ? error.message : String(error));
+    process.exit(1);
+});
+//# sourceMappingURL=main.js.map

package/dist/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAEnE,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,KAAK,EAAE,MAAM,CAAC,QAAQ;QACtB,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,OAAO;KAC/B,CAAC,CAAC;IACH,yEAAyE;IACzE,6CAA6C;IAC7C,mBAAmB,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAEvD,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAQ,EAAE;QACxC,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,YAAY,GAAG,IAAI,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACzC,MAAM;aACH,QAAQ,EAAE;aACV,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aAC3B,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE;YAC1B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,yEAAyE;IACzE,gCAAgC;IAChC,OAAO,CAAC,KAAK,CACX,cAAc,EACd,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/observability/rpc-metrics.d.ts

@@ -0,0 +1,89 @@
+/**
+ * The gRPC request metrics the serving chain records — Java's
+ * `stigmer.grpc.request.count` and `stigmer.grpc.request.duration`
+ * (`GrpcRequestMetricsInterceptor`, cloud `backend/libs/java/grpc/
+ * grpc-request`), names and labels verbatim: `rpc.service` (the
+ * fully-qualified service name), `rpc.method` (the bare method name) and
+ * `rpc.grpc.status_code` (the gRPC status NAME — `OK`, `NOT_FOUND`,
+ * `CANCELLED` with two Ls — never Connect's PascalCase enum key, which the
+ * SigNoz rules would not match). Three consumers read the pair under the
+ * dotted-to-underscored spelling: `telemetry-heartbeat-lost` (the absence
+ * of the count series for ten minutes), `grpc-error-rate-spike` (the
+ * share of `status_code != OK`) and `grpc-latency-regression-p95` (the
+ * duration histogram's buckets), plus the `gRPC RED` dashboard grouped by
+ * every label. Convergence entry 20260909.02.
+ *
+ * This module is library instrumentation, on `@opentelemetry/api` alone:
+ * instruments are created lazily on first use against the GLOBAL meter
+ * provider and are no-ops until a host registers one, so every call site
+ * records unconditionally (the OSS runner's otel-metrics.ts shape; the
+ * cloud composition's registries are its siblings). Lazy creation is what
+ * makes the host's boot order irrelevant — the API has no proxy meter
+ * provider, so an instrument created before registration would stay a
+ * no-op forever. Two facts a host must know:
+ *
+ *   - The counter is BORN AT ZERO by `initRpcMetrics` (Java's constructor
+ *     `add(0)`, the heartbeat's premise, cloud#255): an attribute-less
+ *     series exists from the first post-boot export, so the absence rule's
+ *     ten-minute window measures the export pipeline, not an RPC-free lull
+ *     after a restart. The histogram is deliberately NOT pre-registered —
+ *     a `record(0)` is a real sample that would pollute the percentiles,
+ *     and no rule watches its absence.
+ *   - A host that installs this package from its own `node_modules` runs a
+ *     second copy of `@opentelemetry/api`. The two share one global only
+ *     while this copy's minor version does not exceed the registering
+ *     copy's (`isCompatible`, `internal/semver.ts`); a lockfile bump here
+ *     ahead of the host's makes these instruments silently inert. The
+ *     cloud composition pins the same `^1.9.0` and proves the sharing with
+ *     a composed test on every pin.
+ *
+ * `metricsExportPosture` lets the boot say which of the two states it is
+ * in, so "nothing exported" and "nothing instrumented" stay
+ * distinguishable in the log (the guidelines' explicit-optional-
+ * infrastructure rule).
+ */
+import { Code } from "@connectrpc/connect";
+import type { Counter, Histogram } from "@opentelemetry/api";
+/** `rpc.grpc.status_code` values: the gRPC status names, Java's `Status.Code.name()`. */
+export type GrpcStatusName = "OK" | "CANCELLED" | "UNKNOWN" | "INVALID_ARGUMENT" | "DEADLINE_EXCEEDED" | "NOT_FOUND" | "ALREADY_EXISTS" | "PERMISSION_DENIED" | "RESOURCE_EXHAUSTED" | "FAILED_PRECONDITION" | "ABORTED" | "OUT_OF_RANGE" | "UNIMPLEMENTED" | "INTERNAL" | "UNAVAILABLE" | "DATA_LOSS" | "UNAUTHENTICATED";
+export declare const GRPC_STATUS_OK: GrpcStatusName;
+/**
+ * Connect's error code → the gRPC status name. Connect's `Code` enum has no
+ * OK member (success is the absence of an error), so the table covers the
+ * sixteen error codes and `GRPC_STATUS_OK` names success. Byte-exact
+ * against grpc-java's `Status.Code`; the one spelling trap is CANCELLED.
+ */
+export declare function grpcStatusName(code: Code): GrpcStatusName;
+export interface RpcInstruments {
+    /** stigmer.grpc.request.duration {rpc.service, rpc.method, rpc.grpc.status_code} — ms, fractional. */
+    readonly requestDuration: Histogram;
+    /** stigmer.grpc.request.count — same labels; the heartbeat and error-rate series. */
+    readonly requestCount: Counter;
+}
+export declare function getRpcInstruments(): Promise<RpcInstruments>;
+/**
+ * Fire-and-forget record of one finished RPC — sync so the interceptor
+ * never awaits instrument resolution on the request path. Both
+ * instruments take the same attribute set, Java's single `close` record.
+ */
+export declare function recordRpc(service: string, method: string, status: GrpcStatusName, durationMs: number): void;
+/**
+ * Births the count series at zero, attribute-less (Java's constructor
+ * posture — no fake `rpc.*` labels on a point that counts nothing).
+ * Awaited by the boot before the port binds so a boot-time provider
+ * exports the series before any traffic.
+ */
+export declare function initRpcMetrics(): Promise<void>;
+/**
+ * Whether a meter provider is registered for these instruments to record
+ * into. `exporting` is the host's doing (the cloud composition's
+ * bootstrap, or any `setGlobalMeterProvider` before the first record);
+ * `inert` is the OSS default until an export bootstrap exists. Read
+ * through the public API only: the no-op meter is a singleton the API
+ * exposes, so identity against it is the supported check.
+ */
+export type MetricsExportPosture = "exporting" | "inert";
+export declare function metricsExportPosture(): Promise<MetricsExportPosture>;
+/** Test seam: clears the memoized registry. */
+export declare function resetRpcInstruments(): void;
+//# sourceMappingURL=rpc-metrics.d.ts.map

package/dist/observability/rpc-metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc-metrics.d.ts","sourceRoot":"","sources":["../../src/observability/rpc-metrics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAI7D,yFAAyF;AACzF,MAAM,MAAM,cAAc,GACtB,IAAI,GACJ,WAAW,GACX,SAAS,GACT,kBAAkB,GAClB,mBAAmB,GACnB,WAAW,GACX,gBAAgB,GAChB,mBAAmB,GACnB,oBAAoB,GACpB,qBAAqB,GACrB,SAAS,GACT,cAAc,GACd,eAAe,GACf,UAAU,GACV,aAAa,GACb,WAAW,GACX,iBAAiB,CAAC;AAEtB,eAAO,MAAM,cAAc,EAAE,cAAqB,CAAC;AAEnD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG,cAAc,CAuCzD;AAED,MAAM,WAAW,cAAc;IAC7B,sGAAsG;IACtG,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC;IACpC,qFAAqF;IACrF,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAOD,wBAAgB,iBAAiB,IAAI,OAAO,CAAC,cAAc,CAAC,CAG3D;AAgBD;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,cAAc,EACtB,UAAU,EAAE,MAAM,GACjB,IAAI,CAUN;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAGpD;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG,OAAO,CAAC;AAEzD,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAK1E;AAED,+CAA+C;AAC/C,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C"}