@stigmer/server 3.20.0 → 3.22.0

package/src/pipeline/steps/version-history.ts

@@ -31,6 +31,7 @@ import type { DescMessage, Message, MessageShape } from "@bufbuild/protobuf";
 
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { ApiResourceReferenceSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
 import {
   internalError,
@@ -42,6 +43,7 @@ import type { RequestContext } from "../request-context.js";
 import { AuditNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
 import { findResourceBySlug, requireOrgForReference } from "./helpers.js";
+import type { ResolvedTargetResolver } from "./authorize-resolved-target.js";
 import { TARGET_RESOURCE_KEY } from "./load-target.js";
 import { metadataOf } from "./shapes.js";
 
@@ -192,6 +194,38 @@ export const LIST_VERSIONS_RESOURCE_ID_KEY = "listVersionsResourceId";
 export const LIST_VERSIONS_HEAD_HASH_KEY = "listVersionsHeadHash";
 export const LIST_VERSIONS_RESPONSE_KEY = "listVersionsResponse";
 
+/**
+ * The ListVersions lanes' authorization question, for the
+ * AuthorizeResolvedTarget step placed after the slug resolver: `can_view`
+ * on the resolved head's id (the version history of a row is readable by
+ * whoever may read the row), with the lane's byte-pinned copy. The id key
+ * is the resolver's own — the shared resolver stashes under
+ * LIST_VERSIONS_RESOURCE_ID_KEY; a domain resolver with its own key names
+ * it. An id the chain did not stash is a broken invariant and throws.
+ */
+export function versionHistoryTarget<Desc extends DescMessage>(
+  kind: ApiResourceKind,
+  deniedMessage: string,
+  idKey: string = LIST_VERSIONS_RESOURCE_ID_KEY,
+): ResolvedTargetResolver<Desc> {
+  return (ctx) => {
+    const resourceId = ctx.get(idKey);
+    if (typeof resourceId !== "string" || resourceId === "") {
+      throw new Error(
+        `ListVersions: no resolved resource id under ${idKey}; the slug resolver must run first`,
+      );
+    }
+    return [
+      {
+        permission: IamPermission.can_view,
+        resourceKind: kind,
+        resourceId,
+        deniedMessage,
+      },
+    ];
+  };
+}
+
 /** The fields every ListVersions input carries; the binding reads them off its own message. */
 export interface ListVersionsInputShape {
   readonly org: string;

package/dist/domain/agent/defaultagent.d.ts

@@ -1,37 +0,0 @@
-import type { Agent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import type { Logger } from "../../boot/logger.js";
-import type { Store } from "../../store/interface.js";
-/** Marks the platform default agent; the value must be DEFAULT_AGENT_LABEL_VALUE. */
-export declare const DEFAULT_AGENT_LABEL = "stigmer.ai/default-agent";
-/** The only value of DEFAULT_AGENT_LABEL that marks an agent as the default. */
-export declare const DEFAULT_AGENT_LABEL_VALUE = "true";
-/**
- * No agent carries the default-agent label. Call sites map this to
- * NotFound with their own caller-facing copy (Go ErrNotConfigured).
- */
-export declare class DefaultAgentNotConfiguredError extends Error {
-    constructor();
-}
-/**
- * Labeled agents exist but none is visibility_public. Call sites map this
- * to FailedPrecondition — a deliberate divergence from the cloud edition,
- * whose SQL predicate collapses this state into "not found": the distinct
- * code tells a self-hosting operator the label is present but the
- * visibility is wrong (Go ErrNotPublic).
- */
-export declare class DefaultAgentNotPublicError extends Error {
-    constructor();
-}
-/**
- * Resolves the platform default agent per the module contract: candidates
- * are all agents labeled DEFAULT_AGENT_LABEL=true, only visibility_public
- * candidates are eligible, and among those the lowest metadata.id wins.
- *
- * Throws DefaultAgentNotConfiguredError when nothing carries the label,
- * DefaultAgentNotPublicError when labeled agents exist but none is public,
- * and lets store/decode failures propagate (a store failure is an internal
- * fault, not a "no default agent" condition — callers must not map it to
- * NotFound).
- */
-export declare function findDefaultAgent(store: Store, logger: Logger): Promise<Agent>;
-//# sourceMappingURL=defaultagent.d.ts.map

package/dist/domain/agent/defaultagent.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"defaultagent.d.ts","sourceRoot":"","sources":["../../../src/domain/agent/defaultagent.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oDAAoD,CAAC;AAIhF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,qFAAqF;AACrF,eAAO,MAAM,mBAAmB,6BAA6B,CAAC;AAE9D,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,SAAS,CAAC;AAEhD;;;GAGG;AACH,qBAAa,8BAA+B,SAAQ,KAAK;;CAOxD;AAED;;;;;;GAMG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;;CAOpD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,KAAK,CAAC,CAkDhB"}

package/dist/domain/agent/defaultagent.js

@@ -1,104 +0,0 @@
-/**
- * Platform default-agent resolution — ports
- * pkg/domain/agent/defaultagent/defaultagent.go: the single resolution
- * implementation behind Agent.GetDefault, AgentExecution create (#17), and
- * Session create.
- *
- * The default agent is a platform-level singleton: the agent labeled
- * stigmer.ai/default-agent: "true" with visibility_public, seeded in the
- * system org and served to callers of every org. Resolution is deliberately
- * GLOBAL — GetDefaultAgentRequest.org exists for authorization scoping only
- * (see apis/ai/stigmer/agentic/agent/v1/io.proto). It powers the
- * session-first UX where a user starts a conversation without picking an
- * agent. The cloud twin is AgentRepo.findDefault(); keep the two in sync.
- *
- * Determinism contract (stigmer/stigmer#356): multiple labeled agents is a
- * reachable state, not an error — safe label rotation applies the new
- * default before retiring the old one. Among public candidates the winner
- * is the one with the LOWEST metadata.id — the incumbent. Rejected
- * alternatives (recorded in the Go package doc): first-match depends on row
- * insertion order; newest-wins lets any newly labeled public agent capture
- * the platform-wide default (nothing guards the reserved stigmer.ai/*
- * namespace at OSS write boundaries); creation time is not trustworthy as
- * an ordering key (pre-#453 rows may carry rewritten timestamps).
- * metadata.id never changes and is time-ordered for server-generated ULIDs.
- */
-import { fromBinary } from "@bufbuild/protobuf";
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-/** Marks the platform default agent; the value must be DEFAULT_AGENT_LABEL_VALUE. */
-export const DEFAULT_AGENT_LABEL = "stigmer.ai/default-agent";
-/** The only value of DEFAULT_AGENT_LABEL that marks an agent as the default. */
-export const DEFAULT_AGENT_LABEL_VALUE = "true";
-/**
- * No agent carries the default-agent label. Call sites map this to
- * NotFound with their own caller-facing copy (Go ErrNotConfigured).
- */
-export class DefaultAgentNotConfiguredError extends Error {
-    constructor() {
-        super(`no agent labeled ${DEFAULT_AGENT_LABEL}=${DEFAULT_AGENT_LABEL_VALUE}`);
-        this.name = "DefaultAgentNotConfiguredError";
-    }
-}
-/**
- * Labeled agents exist but none is visibility_public. Call sites map this
- * to FailedPrecondition — a deliberate divergence from the cloud edition,
- * whose SQL predicate collapses this state into "not found": the distinct
- * code tells a self-hosting operator the label is present but the
- * visibility is wrong (Go ErrNotPublic).
- */
-export class DefaultAgentNotPublicError extends Error {
-    constructor() {
-        super(`agents labeled ${DEFAULT_AGENT_LABEL}=${DEFAULT_AGENT_LABEL_VALUE} exist but none is visibility_public`);
-        this.name = "DefaultAgentNotPublicError";
-    }
-}
-/**
- * Resolves the platform default agent per the module contract: candidates
- * are all agents labeled DEFAULT_AGENT_LABEL=true, only visibility_public
- * candidates are eligible, and among those the lowest metadata.id wins.
- *
- * Throws DefaultAgentNotConfiguredError when nothing carries the label,
- * DefaultAgentNotPublicError when labeled agents exist but none is public,
- * and lets store/decode failures propagate (a store failure is an internal
- * fault, not a "no default agent" condition — callers must not map it to
- * NotFound).
- */
-export async function findDefaultAgent(store, logger) {
-    const raws = await store.findAllByLabel(ApiResourceKind.agent, DEFAULT_AGENT_LABEL, DEFAULT_AGENT_LABEL_VALUE, AgentSchema);
-    if (raws.length === 0) {
-        throw new DefaultAgentNotConfiguredError();
-    }
-    let publicCount = 0;
-    let winner;
-    for (const raw of raws) {
-        // findAllByLabel already unmarshaled every returned row to match the
-        // label, so a decode failure here is store corruption. Fail loudly
-        // (propagate): skipping a row could silently change which agent wins.
-        const candidate = fromBinary(AgentSchema, raw);
-        if (candidate.metadata?.visibility !==
-            ApiResourceVisibility.visibility_public) {
-            continue;
-        }
-        publicCount++;
-        if (winner === undefined ||
-            (candidate.metadata?.id ?? "") < (winner.metadata?.id ?? "")) {
-            winner = candidate;
-        }
-    }
-    if (winner === undefined) {
-        throw new DefaultAgentNotPublicError();
-    }
-    if (publicCount > 1) {
-        // Expected briefly mid-rotation; persistent duplicates mean someone
-        // forgot to retire the old label after applying the new default.
-        logger.warn("Multiple public agents carry the default-agent label; serving the incumbent (lowest id). Retire the stale label to complete rotation.", {
-            publicLabeledAgents: publicCount,
-            winnerId: winner.metadata?.id ?? "",
-            winnerName: winner.metadata?.name ?? "",
-        });
-    }
-    return winner;
-}
-//# sourceMappingURL=defaultagent.js.map

package/dist/domain/agent/defaultagent.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"defaultagent.js","sourceRoot":"","sources":["../../../src/domain/agent/defaultagent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AAEjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAKtH,qFAAqF;AACrF,MAAM,CAAC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAE9D,gFAAgF;AAChF,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEhD;;;GAGG;AACH,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACvD;QACE,KAAK,CACH,oBAAoB,mBAAmB,IAAI,yBAAyB,EAAE,CACvE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD;QACE,KAAK,CACH,kBAAkB,mBAAmB,IAAI,yBAAyB,sCAAsC,CACzG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAY,EACZ,MAAc;IAEd,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,cAAc,CACrC,eAAe,CAAC,KAAK,EACrB,mBAAmB,EACnB,yBAAyB,EACzB,WAAW,CACZ,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,8BAA8B,EAAE,CAAC;IAC7C,CAAC;IAED,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,MAAyB,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,qEAAqE;QACrE,mEAAmE;QACnE,sEAAsE;QACtE,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC/C,IACE,SAAS,CAAC,QAAQ,EAAE,UAAU;YAC9B,qBAAqB,CAAC,iBAAiB,EACvC,CAAC;YACD,SAAS;QACX,CAAC;QACD,WAAW,EAAE,CAAC;QACd,IACE,MAAM,KAAK,SAAS;YACpB,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,EAC5D,CAAC;YACD,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,0BAA0B,EAAE,CAAC;IACzC,CAAC;IAED,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;QACpB,oEAAoE;QACpE,iEAAiE;QACjE,MAAM,CAAC,IAAI,CACT,uIAAuI,EACvI;YACE,mBAAmB,EAAE,WAAW;YAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;YACnC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE;SACxC,CACF,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/src/domain/agent/defaultagent.ts

@@ -1,135 +0,0 @@
-/**
- * Platform default-agent resolution — ports
- * pkg/domain/agent/defaultagent/defaultagent.go: the single resolution
- * implementation behind Agent.GetDefault, AgentExecution create (#17), and
- * Session create.
- *
- * The default agent is a platform-level singleton: the agent labeled
- * stigmer.ai/default-agent: "true" with visibility_public, seeded in the
- * system org and served to callers of every org. Resolution is deliberately
- * GLOBAL — GetDefaultAgentRequest.org exists for authorization scoping only
- * (see apis/ai/stigmer/agentic/agent/v1/io.proto). It powers the
- * session-first UX where a user starts a conversation without picking an
- * agent. The cloud twin is AgentRepo.findDefault(); keep the two in sync.
- *
- * Determinism contract (stigmer/stigmer#356): multiple labeled agents is a
- * reachable state, not an error — safe label rotation applies the new
- * default before retiring the old one. Among public candidates the winner
- * is the one with the LOWEST metadata.id — the incumbent. Rejected
- * alternatives (recorded in the Go package doc): first-match depends on row
- * insertion order; newest-wins lets any newly labeled public agent capture
- * the platform-wide default (nothing guards the reserved stigmer.ai/*
- * namespace at OSS write boundaries); creation time is not trustworthy as
- * an ordering key (pre-#453 rows may carry rewritten timestamps).
- * metadata.id never changes and is time-ordered for server-generated ULIDs.
- */
-import { fromBinary } from "@bufbuild/protobuf";
-
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import type { Agent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import type { Logger } from "../../boot/logger.js";
-import type { Store } from "../../store/interface.js";
-
-/** Marks the platform default agent; the value must be DEFAULT_AGENT_LABEL_VALUE. */
-export const DEFAULT_AGENT_LABEL = "stigmer.ai/default-agent";
-
-/** The only value of DEFAULT_AGENT_LABEL that marks an agent as the default. */
-export const DEFAULT_AGENT_LABEL_VALUE = "true";
-
-/**
- * No agent carries the default-agent label. Call sites map this to
- * NotFound with their own caller-facing copy (Go ErrNotConfigured).
- */
-export class DefaultAgentNotConfiguredError extends Error {
-  constructor() {
-    super(
-      `no agent labeled ${DEFAULT_AGENT_LABEL}=${DEFAULT_AGENT_LABEL_VALUE}`,
-    );
-    this.name = "DefaultAgentNotConfiguredError";
-  }
-}
-
-/**
- * Labeled agents exist but none is visibility_public. Call sites map this
- * to FailedPrecondition — a deliberate divergence from the cloud edition,
- * whose SQL predicate collapses this state into "not found": the distinct
- * code tells a self-hosting operator the label is present but the
- * visibility is wrong (Go ErrNotPublic).
- */
-export class DefaultAgentNotPublicError extends Error {
-  constructor() {
-    super(
-      `agents labeled ${DEFAULT_AGENT_LABEL}=${DEFAULT_AGENT_LABEL_VALUE} exist but none is visibility_public`,
-    );
-    this.name = "DefaultAgentNotPublicError";
-  }
-}
-
-/**
- * Resolves the platform default agent per the module contract: candidates
- * are all agents labeled DEFAULT_AGENT_LABEL=true, only visibility_public
- * candidates are eligible, and among those the lowest metadata.id wins.
- *
- * Throws DefaultAgentNotConfiguredError when nothing carries the label,
- * DefaultAgentNotPublicError when labeled agents exist but none is public,
- * and lets store/decode failures propagate (a store failure is an internal
- * fault, not a "no default agent" condition — callers must not map it to
- * NotFound).
- */
-export async function findDefaultAgent(
-  store: Store,
-  logger: Logger,
-): Promise<Agent> {
-  const raws = await store.findAllByLabel(
-    ApiResourceKind.agent,
-    DEFAULT_AGENT_LABEL,
-    DEFAULT_AGENT_LABEL_VALUE,
-    AgentSchema,
-  );
-  if (raws.length === 0) {
-    throw new DefaultAgentNotConfiguredError();
-  }
-
-  let publicCount = 0;
-  let winner: Agent | undefined;
-  for (const raw of raws) {
-    // findAllByLabel already unmarshaled every returned row to match the
-    // label, so a decode failure here is store corruption. Fail loudly
-    // (propagate): skipping a row could silently change which agent wins.
-    const candidate = fromBinary(AgentSchema, raw);
-    if (
-      candidate.metadata?.visibility !==
-      ApiResourceVisibility.visibility_public
-    ) {
-      continue;
-    }
-    publicCount++;
-    if (
-      winner === undefined ||
-      (candidate.metadata?.id ?? "") < (winner.metadata?.id ?? "")
-    ) {
-      winner = candidate;
-    }
-  }
-  if (winner === undefined) {
-    throw new DefaultAgentNotPublicError();
-  }
-
-  if (publicCount > 1) {
-    // Expected briefly mid-rotation; persistent duplicates mean someone
-    // forgot to retire the old label after applying the new default.
-    logger.warn(
-      "Multiple public agents carry the default-agent label; serving the incumbent (lowest id). Retire the stale label to complete rotation.",
-      {
-        publicLabeledAgents: publicCount,
-        winnerId: winner.metadata?.id ?? "",
-        winnerName: winner.metadata?.name ?? "",
-      },
-    );
-  }
-
-  return winner;
-}