@stigmer/server 3.20.0 → 3.21.0

package/src/domain/session/run-target.ts

@@ -1,13 +1,14 @@
 /**
- * The session run-target resolver (P1 sp.run-gate): a session is a
- * conversation bound to ONE agent instance, so its run target is that
- * instance — agent_instance#can_execute on spec.agent_instance_id.
+ * The session run-target resolver (P1 sp.run-gate): a session bound to an
+ * agent instance has that instance as its run target —
+ * agent_instance#can_execute on spec.agent_instance_id.
  *
- * Pure over the record being built. ResolveDefaultAgentInstance runs before
- * the gate and guarantees the id (the caller's, or the platform default
- * agent's default instance), so an empty id here is that step's own
- * refusal already thrown, never a check to make. Read from newState, where
- * the resolution writes — the same clone gotcha steps.ts records.
+ * Pure over the record being built. An empty id is the built-in assistant
+ * (session/v1/spec.proto): there is no blueprint to spend, so the answer is
+ * "no target" and the gate makes no check. What admits the conversation is
+ * the Authorize step ahead of the gate — can_create_session on the
+ * organization — and each turn is admitted by the session's own
+ * can_create_execution_in on the execution chain.
  */
 import type { Session } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
 

package/src/domain/session/steps.ts

@@ -6,22 +6,22 @@
  * record_harness_state_history.go) and its steps/ package
  * (filter_by_agent_instance.go, filter_by_channel.go). Shared steps stay
  * in src/pipeline/steps/; these exist because they embody
- * session-specific contracts: the default-agent-instance resolution, the
- * harness/execution-target immutability sentinels, the server-owned
- * harness-state history, the active-execution delete guard with its
- * execution cascade, and the list filters.
+ * session-specific contracts: the harness/execution-target immutability
+ * sentinels, the server-owned harness-state history, the active-execution
+ * delete guard with its execution cascade, and the list filters.
+ *
+ * An empty spec.agent_instance_id is a legal shape and stays empty: the
+ * session runs the built-in assistant (session/v1/spec.proto). No step here
+ * resolves it into an instance, and no step guards it on update, because
+ * a conversation may gain an agent or drop back to the assistant; the
+ * immutable fields are the harness and the execution target below.
  */
-import { Code, ConnectError } from "@connectrpc/connect";
 import { create, fromBinary } from "@bufbuild/protobuf";
 import type { DescMessage } from "@bufbuild/protobuf";
 
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import type { Agent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { AgentStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/status_pb";
 import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import type { AgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import { ExecutionPhase } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
-import type { AgentInstance } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/api_pb";
 import { SessionSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
 import type { Session } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
 import {
@@ -30,7 +30,6 @@ import {
 } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
 import { SessionListSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/io_pb";
 import { SessionQueryController } from "@stigmer/protos/ai/stigmer/agentic/session/v1/query_pb";
-import { SessionSpecSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/spec_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
@@ -38,29 +37,19 @@ import type { Logger } from "../../boot/logger.js";
 import type { AgentExecutionTemporalConfig } from "../agentexecution/temporal/config.js";
 import {
   failedPreconditionError,
-  goWrappedStatusError,
   internalError,
   invalidArgumentError,
 } from "../../pipeline/errors.js";
 import type { PipelineStep } from "../../pipeline/pipeline.js";
-import type { CallerIdentity } from "../../extensions/identity.js";
 import type { Authorizer } from "../../extensions/authorizer.js";
 import type { ListReadScope } from "../../extensions/list-read-scope.js";
 import { restrictListByReadScope } from "../../extensions/list-read-scope.js";
-import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
 import { authorizeResolvedResource } from "../../pipeline/steps/authorize.js";
-import { notifyDefaultInstanceLinked } from "../../pipeline/steps/authorization-tuples.js";
 import type { RequestContext } from "../../pipeline/request-context.js";
 import { RESOURCE_ID_KEY } from "../../pipeline/steps/delete.js";
 import { compareCreatedAtDesc } from "../../pipeline/steps/helpers.js";
 import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
 import type { Store } from "../../store/interface.js";
-import { buildDefaultInstanceRequest } from "../agentinstance/defaultinstance.js";
-import {
-  DefaultAgentNotConfiguredError,
-  DefaultAgentNotPublicError,
-  findDefaultAgent,
-} from "../agent/defaultagent.js";
 
 type SessionDesc = typeof SessionSchema;
 
@@ -74,221 +63,6 @@ export const LIST_RESULT_KEY = "listResult";
  */
 const CHANNEL_ID_LABEL_KEY = "stigmer.ai/channel-id";
 
-/**
- * The narrow in-process surface the session domain needs from
- * agentinstance — consumer-defined so the dependency reads at the domain
- * boundary (the Go twin is pkg/downstream/agentinstance.Client). This is
- * the CREATE RPC (Go CreateAsSystem), not apply: the resolve step only
- * reaches it when the default instance is known to be missing, and a
- * duplicate-slug collision must surface as AlreadyExists, not silently
- * update. Calls ride the in-process router transport, traversing the full
- * interceptor chain (DD-002).
- */
-export interface AgentInstanceCreator {
-  /**
-   * Creates AS THE ORIGINAL CALLER (C2 Stage 3, ruling R5 — the Java
-   * createAsCaller posture): the propagated identity gives the created
-   * instance real owner attribution under an enforcing Authorizer.
-   */
-  createAsCaller(
-    instance: AgentInstance,
-    caller: CallerIdentity,
-  ): Promise<AgentInstance>;
-}
-
-/**
- * Lazy provider for the in-process agentinstance edge — resolved at call
- * time, never at construction (the ratified DI story, D2 §2).
- */
-export type AgentInstanceCreatorProvider = () => AgentInstanceCreator;
-
-// ---------------------------------------------------------------------------
-// ResolveDefaultAgentInstance — create.go:62-182: when agent_instance_id is
-// not provided, resolve the platform default agent (shared defaultagent
-// implementation: label stigmer.ai/default-agent=true, visibility_public,
-// deterministic incumbent-wins tie-break), get or create its default
-// instance, and set agent_instance_id on the session spec. This enables the
-// session-first UX where users create a session (with workspace entries)
-// without knowing the agent instance — the backend resolves it
-// automatically.
-//
-// Runs FIRST in the create chain, before ValidateProto — resolution must
-// fill agent_instance_id before validation sees the spec.
-//
-// The id lands on ctx.newState.spec, NEVER on input: the pipeline cloned
-// input into newState at construction and Persist saves newState, so
-// mutating input does not propagate (Go's documented clone gotcha,
-// create.go:168-170).
-// ---------------------------------------------------------------------------
-
-export function newResolveDefaultAgentInstanceStep(
-  store: Store,
-  creator: AgentInstanceCreatorProvider,
-  logger: Logger,
-  authorizationLifecycle?: ResourceAuthorizationLifecycle,
-): PipelineStep<SessionDesc> {
-  return {
-    name: "ResolveDefaultAgentInstance",
-    async execute(ctx: RequestContext<SessionDesc>): Promise<void> {
-      if ((ctx.input.spec?.agentInstanceId ?? "") !== "") {
-        return;
-      }
-
-      logger.info(
-        "agent_instance_id not provided on session, resolving platform default agent",
-      );
-
-      // 1. Resolve the default agent. The error copy is Go WrapError's
-      // "%s: %v" — the sentinel's text RIDES the wire message, and the
-      // NotFound arm carries Go's DOUBLE wrap (fmt.Errorf("no default
-      // agent available on this platform: %w", err) inside WrapError).
-      // Byte-pinned.
-      let defaultAgent: Agent;
-      try {
-        defaultAgent = await findDefaultAgent(store, logger);
-      } catch (error) {
-        if (error instanceof DefaultAgentNotConfiguredError) {
-          logger.error("No platform default agent configured", {
-            error: error.message,
-          });
-          throw new ConnectError(
-            `No default agent available. Ensure an agent with label stigmer.ai/default-agent=true and visibility_public exists: no default agent available on this platform: ${error.message}`,
-            Code.NotFound,
-          );
-        }
-        if (error instanceof DefaultAgentNotPublicError) {
-          logger.error("Default agent is not visibility_public", {
-            error: error.message,
-          });
-          throw new ConnectError(
-            `Default agent exists but is not visibility_public: ${error.message}`,
-            Code.FailedPrecondition,
-          );
-        }
-        // Store/decode failure — an internal fault, not "no default
-        // agent". InternalError keeps the cause off the wire
-        // (stigmer/stigmer#478).
-        logger.error("Failed to resolve platform default agent", {
-          error: error instanceof Error ? error.message : String(error),
-        });
-        throw internalError(
-          error,
-          "failed to resolve the platform default agent",
-        );
-      }
-
-      const metadata = defaultAgent.metadata;
-      if (metadata === undefined) {
-        // Unreachable: findDefaultAgent only returns public-visibility
-        // candidates, whose metadata is necessarily set.
-        throw internalError(
-          new Error("default agent metadata is nil"),
-          "failed to resolve the platform default agent",
-        );
-      }
-      const agentId = metadata.id;
-      logger.info("Resolved platform default agent", {
-        agentId,
-        agentName: metadata.name,
-      });
-
-      // 2. Get or create the default instance.
-      let defaultInstanceId = defaultAgent.status?.defaultInstanceId ?? "";
-      if (defaultInstanceId === "") {
-        logger.info("Default instance missing, creating one", { agentId });
-
-        const instanceRequest = buildDefaultInstanceRequest(metadata);
-
-        // Go create.go:144-148 wraps the downstream error with fmt.Errorf
-        // ("failed to create default instance for default agent: %w") and
-        // PipelineError.GRPCStatus's errors.As branch keeps the inner
-        // CODE but rewrites the wire MESSAGE to the wrapped text —
-        // transport formatting (`rpc error: code = X desc = ...`)
-        // included. Mirrored byte-for-byte via goWrappedStatusError; the
-        // leak is stigmer/stigmer#852 (both-editions post-cutover fix).
-        // Unstatused failures fall to the pipeline's Internal fallback,
-        // exactly Go's plain-error path.
-        let createdInstance: AgentInstance;
-        try {
-          createdInstance = await creator().createAsCaller(
-            instanceRequest,
-            ctx.callerIdentity,
-          );
-        } catch (error) {
-          logger.error("Failed to create default instance", {
-            agentId,
-            error: error instanceof Error ? error.message : String(error),
-          });
-          if (error instanceof ConnectError) {
-            throw goWrappedStatusError(
-              "failed to create default instance for default agent",
-              error,
-            );
-          }
-          throw new Error(
-            `failed to create default instance for default agent: ${error instanceof Error ? error.message : String(error)}`,
-          );
-        }
-
-        defaultInstanceId = createdInstance.metadata?.id ?? "";
-
-        // Persist default_instance_id on the agent — EXPLICITLY the agent
-        // kind: this pipeline's ctx kind is session (Go hardcodes
-        // ApiResourceKind_agent here too).
-        if (defaultAgent.status === undefined) {
-          defaultAgent.status = create(AgentStatusSchema, {});
-        }
-        defaultAgent.status.defaultInstanceId = defaultInstanceId;
-        try {
-          await store.saveResource(
-            ApiResourceKind.agent,
-            agentId,
-            AgentSchema,
-            defaultAgent,
-          );
-        } catch (error) {
-          logger.error("Failed to persist agent with default_instance_id", {
-            agentId,
-            error: error instanceof Error ? error.message : String(error),
-          });
-          // Go wraps as a plain error → the pipeline's Internal fallback.
-          throw new Error(
-            `failed to persist agent with default instance: ${error instanceof Error ? error.message : String(error)}`,
-          );
-        }
-
-        // The default_of invariant rides the pointer persist (C2 Stage 3).
-        await notifyDefaultInstanceLinked(authorizationLifecycle, {
-          instanceKind: ApiResourceKind.agent_instance,
-          instanceId: defaultInstanceId,
-          blueprintKind: ApiResourceKind.agent,
-          blueprintId: agentId,
-        });
-
-        logger.info("Created default instance for default agent", {
-          instanceId: defaultInstanceId,
-          agentId,
-        });
-      }
-
-      // 3. Set agent_instance_id on the session's newState (not input) —
-      // see the module-level clone gotcha note.
-      const newState = ctx.newState;
-      if (newState.spec === undefined) {
-        newState.spec = create(SessionSpecSchema, {});
-      }
-      newState.spec.agentInstanceId = defaultInstanceId;
-
-      logger.info(
-        "Set agent_instance_id on session from platform default agent",
-        {
-          agentInstanceId: defaultInstanceId,
-        },
-      );
-    },
-  };
-}
-
 // ---------------------------------------------------------------------------
 // ValidateHarnessImmutability — validate_harness_immutability.go: rejects
 // session updates that attempt to change the harness after the session has

package/src/domain/workflowexecution/create-steps.ts

@@ -62,9 +62,10 @@ export type ExecutionWorkflowInstanceCreatorProvider =
 /**
  * ValidateWorkflowOrInstance — at least one of workflow_id /
  * workflow_instance_id must be provided. Matches the cloud
- * WorkflowExecutionCreateHandler. AgentExecution differs: it has a
- * ResolveDefaultAgent step, so its guard is an unreachable invariant
- * (Internal), not reachable InvalidArgument validation (issue #196).
+ * WorkflowExecutionCreateHandler. AgentExecution differs on purpose: its
+ * all-empty shape is legal (the built-in assistant), so it has no such
+ * step; a workflow execution has no built-in workflow to fall back to
+ * (issue #196).
  */
 export function newValidateWorkflowOrInstanceStep(): PipelineStep<ExecutionDesc> {
   return {

package/src/pipeline/apiresource-labels.ts

@@ -23,8 +23,8 @@ import type { ApiResourceMetadata } from "@stigmer/protos/ai/stigmer/commons/api
 
 /**
  * The platform-reserved label key namespace. Keys under this prefix carry
- * platform semantics (default-agent resolution, personal-environment
- * uniqueness, default-instance marking) and are written by the server —
+ * platform semantics (personal-environment uniqueness, default-instance
+ * marking, plugin membership and lineage) and are written by the server —
  * never introduced by ordinary client requests on the cloud edition.
  */
 export const RESERVED_LABEL_PREFIX = "stigmer.ai/";

package/src/pipeline/errors.ts

@@ -100,8 +100,8 @@ export function grpcCodeName(code: Code): string {
  * errors.As branch keeps the INNER code but rewrites the message to the
  * full wrapped text — and the inner client error's Error() renders as
  * `rpc error: code = <CodeName> desc = <message>`. Byte-parity with Go on
- * the two arms that hit this (agent create's CreateDefaultInstance,
- * session create's ResolveDefaultAgentInstance). The transport-formatting
+ * the arms that hit this (agent create's CreateDefaultInstance, agent
+ * execution create's default-instance and session bootstrap). The transport-formatting
  * leak is filed as stigmer/stigmer#852 for a both-editions post-cutover
  * fix; until then this shim IS the wire contract.
  *

package/src/pipeline/steps/guard-reserved-labels.ts

@@ -3,11 +3,12 @@
  * `stigmer.ai/*` label namespace (the Java GuardReservedLabelsStep port,
  * cloud#320/#386; C2 Stage 3, 20260827.10).
  *
- * Reserved labels carry platform semantics — the motivating one is
- * `stigmer.ai/default-agent`, which the default-agent resolution reads
- * GLOBALLY (label + visibility_public), so a tenant labeling its own
- * public agent would enter every organization's default-agent candidate
- * set. Only rejecting the write closes that.
+ * Reserved labels carry platform semantics the server reads and acts on
+ * (the personal-environment marker, the default-instance marker, the
+ * membership and lineage labels): a client that could write one would be
+ * writing a platform decision, and any reader trusting the label would be
+ * trusting the client. Only rejecting the write closes that; the label is
+ * not authorization, the server is.
  *
  * Behavior (the Java matrix verbatim):
  *   - ECHOES pass — clients read-modify-write whole resources, so a

package/dist/domain/agent/defaultagent.d.ts

@@ -1,37 +0,0 @@
-import type { Agent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import type { Logger } from "../../boot/logger.js";
-import type { Store } from "../../store/interface.js";
-/** Marks the platform default agent; the value must be DEFAULT_AGENT_LABEL_VALUE. */
-export declare const DEFAULT_AGENT_LABEL = "stigmer.ai/default-agent";
-/** The only value of DEFAULT_AGENT_LABEL that marks an agent as the default. */
-export declare const DEFAULT_AGENT_LABEL_VALUE = "true";
-/**
- * No agent carries the default-agent label. Call sites map this to
- * NotFound with their own caller-facing copy (Go ErrNotConfigured).
- */
-export declare class DefaultAgentNotConfiguredError extends Error {
-    constructor();
-}
-/**
- * Labeled agents exist but none is visibility_public. Call sites map this
- * to FailedPrecondition — a deliberate divergence from the cloud edition,
- * whose SQL predicate collapses this state into "not found": the distinct
- * code tells a self-hosting operator the label is present but the
- * visibility is wrong (Go ErrNotPublic).
- */
-export declare class DefaultAgentNotPublicError extends Error {
-    constructor();
-}
-/**
- * Resolves the platform default agent per the module contract: candidates
- * are all agents labeled DEFAULT_AGENT_LABEL=true, only visibility_public
- * candidates are eligible, and among those the lowest metadata.id wins.
- *
- * Throws DefaultAgentNotConfiguredError when nothing carries the label,
- * DefaultAgentNotPublicError when labeled agents exist but none is public,
- * and lets store/decode failures propagate (a store failure is an internal
- * fault, not a "no default agent" condition — callers must not map it to
- * NotFound).
- */
-export declare function findDefaultAgent(store: Store, logger: Logger): Promise<Agent>;
-//# sourceMappingURL=defaultagent.d.ts.map

package/dist/domain/agent/defaultagent.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"defaultagent.d.ts","sourceRoot":"","sources":["../../../src/domain/agent/defaultagent.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oDAAoD,CAAC;AAIhF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,qFAAqF;AACrF,eAAO,MAAM,mBAAmB,6BAA6B,CAAC;AAE9D,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,SAAS,CAAC;AAEhD;;;GAGG;AACH,qBAAa,8BAA+B,SAAQ,KAAK;;CAOxD;AAED;;;;;;GAMG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;;CAOpD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,KAAK,CAAC,CAkDhB"}

package/dist/domain/agent/defaultagent.js

@@ -1,104 +0,0 @@
-/**
- * Platform default-agent resolution — ports
- * pkg/domain/agent/defaultagent/defaultagent.go: the single resolution
- * implementation behind Agent.GetDefault, AgentExecution create (#17), and
- * Session create.
- *
- * The default agent is a platform-level singleton: the agent labeled
- * stigmer.ai/default-agent: "true" with visibility_public, seeded in the
- * system org and served to callers of every org. Resolution is deliberately
- * GLOBAL — GetDefaultAgentRequest.org exists for authorization scoping only
- * (see apis/ai/stigmer/agentic/agent/v1/io.proto). It powers the
- * session-first UX where a user starts a conversation without picking an
- * agent. The cloud twin is AgentRepo.findDefault(); keep the two in sync.
- *
- * Determinism contract (stigmer/stigmer#356): multiple labeled agents is a
- * reachable state, not an error — safe label rotation applies the new
- * default before retiring the old one. Among public candidates the winner
- * is the one with the LOWEST metadata.id — the incumbent. Rejected
- * alternatives (recorded in the Go package doc): first-match depends on row
- * insertion order; newest-wins lets any newly labeled public agent capture
- * the platform-wide default (nothing guards the reserved stigmer.ai/*
- * namespace at OSS write boundaries); creation time is not trustworthy as
- * an ordering key (pre-#453 rows may carry rewritten timestamps).
- * metadata.id never changes and is time-ordered for server-generated ULIDs.
- */
-import { fromBinary } from "@bufbuild/protobuf";
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-/** Marks the platform default agent; the value must be DEFAULT_AGENT_LABEL_VALUE. */
-export const DEFAULT_AGENT_LABEL = "stigmer.ai/default-agent";
-/** The only value of DEFAULT_AGENT_LABEL that marks an agent as the default. */
-export const DEFAULT_AGENT_LABEL_VALUE = "true";
-/**
- * No agent carries the default-agent label. Call sites map this to
- * NotFound with their own caller-facing copy (Go ErrNotConfigured).
- */
-export class DefaultAgentNotConfiguredError extends Error {
-    constructor() {
-        super(`no agent labeled ${DEFAULT_AGENT_LABEL}=${DEFAULT_AGENT_LABEL_VALUE}`);
-        this.name = "DefaultAgentNotConfiguredError";
-    }
-}
-/**
- * Labeled agents exist but none is visibility_public. Call sites map this
- * to FailedPrecondition — a deliberate divergence from the cloud edition,
- * whose SQL predicate collapses this state into "not found": the distinct
- * code tells a self-hosting operator the label is present but the
- * visibility is wrong (Go ErrNotPublic).
- */
-export class DefaultAgentNotPublicError extends Error {
-    constructor() {
-        super(`agents labeled ${DEFAULT_AGENT_LABEL}=${DEFAULT_AGENT_LABEL_VALUE} exist but none is visibility_public`);
-        this.name = "DefaultAgentNotPublicError";
-    }
-}
-/**
- * Resolves the platform default agent per the module contract: candidates
- * are all agents labeled DEFAULT_AGENT_LABEL=true, only visibility_public
- * candidates are eligible, and among those the lowest metadata.id wins.
- *
- * Throws DefaultAgentNotConfiguredError when nothing carries the label,
- * DefaultAgentNotPublicError when labeled agents exist but none is public,
- * and lets store/decode failures propagate (a store failure is an internal
- * fault, not a "no default agent" condition — callers must not map it to
- * NotFound).
- */
-export async function findDefaultAgent(store, logger) {
-    const raws = await store.findAllByLabel(ApiResourceKind.agent, DEFAULT_AGENT_LABEL, DEFAULT_AGENT_LABEL_VALUE, AgentSchema);
-    if (raws.length === 0) {
-        throw new DefaultAgentNotConfiguredError();
-    }
-    let publicCount = 0;
-    let winner;
-    for (const raw of raws) {
-        // findAllByLabel already unmarshaled every returned row to match the
-        // label, so a decode failure here is store corruption. Fail loudly
-        // (propagate): skipping a row could silently change which agent wins.
-        const candidate = fromBinary(AgentSchema, raw);
-        if (candidate.metadata?.visibility !==
-            ApiResourceVisibility.visibility_public) {
-            continue;
-        }
-        publicCount++;
-        if (winner === undefined ||
-            (candidate.metadata?.id ?? "") < (winner.metadata?.id ?? "")) {
-            winner = candidate;
-        }
-    }
-    if (winner === undefined) {
-        throw new DefaultAgentNotPublicError();
-    }
-    if (publicCount > 1) {
-        // Expected briefly mid-rotation; persistent duplicates mean someone
-        // forgot to retire the old label after applying the new default.
-        logger.warn("Multiple public agents carry the default-agent label; serving the incumbent (lowest id). Retire the stale label to complete rotation.", {
-            publicLabeledAgents: publicCount,
-            winnerId: winner.metadata?.id ?? "",
-            winnerName: winner.metadata?.name ?? "",
-        });
-    }
-    return winner;
-}
-//# sourceMappingURL=defaultagent.js.map

package/dist/domain/agent/defaultagent.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"defaultagent.js","sourceRoot":"","sources":["../../../src/domain/agent/defaultagent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AAEjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAKtH,qFAAqF;AACrF,MAAM,CAAC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAE9D,gFAAgF;AAChF,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEhD;;;GAGG;AACH,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACvD;QACE,KAAK,CACH,oBAAoB,mBAAmB,IAAI,yBAAyB,EAAE,CACvE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD;QACE,KAAK,CACH,kBAAkB,mBAAmB,IAAI,yBAAyB,sCAAsC,CACzG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAY,EACZ,MAAc;IAEd,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,cAAc,CACrC,eAAe,CAAC,KAAK,EACrB,mBAAmB,EACnB,yBAAyB,EACzB,WAAW,CACZ,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,8BAA8B,EAAE,CAAC;IAC7C,CAAC;IAED,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,MAAyB,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,qEAAqE;QACrE,mEAAmE;QACnE,sEAAsE;QACtE,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC/C,IACE,SAAS,CAAC,QAAQ,EAAE,UAAU;YAC9B,qBAAqB,CAAC,iBAAiB,EACvC,CAAC;YACD,SAAS;QACX,CAAC;QACD,WAAW,EAAE,CAAC;QACd,IACE,MAAM,KAAK,SAAS;YACpB,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,EAC5D,CAAC;YACD,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,0BAA0B,EAAE,CAAC;IACzC,CAAC;IAED,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;QACpB,oEAAoE;QACpE,iEAAiE;QACjE,MAAM,CAAC,IAAI,CACT,uIAAuI,EACvI;YACE,mBAAmB,EAAE,WAAW;YAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;YACnC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE;SACxC,CACF,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}