@stigmer/server 3.24.0 → 3.26.0

package/dist/domain/workflowexecution/list-pending-approvals.js

@@ -1,8 +1,12 @@
 /**
  * ListPendingApprovals — ports list_pending_approvals.go (T14 dashboard):
- * scans IN_PROGRESS executions for tasks in WORKFLOW_TASK_WAITING_APPROVAL
- * and projects them into PendingApproval entries. total_count is the
- * pre-truncation total; only the entries list is trimmed to the page.
+ * reads the org's IN_PROGRESS executions for tasks in
+ * WORKFLOW_TASK_WAITING_APPROVAL and projects them into PendingApproval
+ * entries, newest execution first. total_count is the whole set's; the
+ * entries are one page (default 20, at most 100), continued by a token
+ * whose position is an execution's list-index cursor plus the approval's
+ * place among its waiting tasks — stable while approvals land and resolve
+ * between pages, where an offset would skip or repeat them.
  */
 import { create } from "@bufbuild/protobuf";
 import { timestampFromMs } from "@bufbuild/protobuf/wkt";
@@ -10,54 +14,87 @@ import { ExecutionPhase, WorkflowTaskStatus, } from "@stigmer/protos/ai/stigmer/
 import { PendingApprovalSchema, PendingApprovalsListSchema, } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/io_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { restrictListByReadScope } from "../../extensions/list-read-scope.js";
+import { invalidArgumentError } from "../../pipeline/errors.js";
+import { decodeListPageToken, encodeListPageToken, listPageFingerprint, } from "../../pipeline/steps/list-page.js";
+import { compareListIndexOrder, listIndexInstant, } from "../../store/list-index.js";
 import { DEFAULT_PENDING_APPROVALS_PAGE_SIZE, MAX_PENDING_APPROVALS_PAGE_SIZE, } from "./constants.js";
 import { parseRfc3339Ms } from "./execution-filter.js";
-import { loadAllWorkflowExecutions } from "./queries.js";
+import { loadWorkflowExecutions } from "./queries.js";
 export async function listPendingApprovals(deps, req, identity) {
-    // Census lane 8 (20260830.01): the scope narrows the EXECUTIONS — before
-    // the approvals projection and its pagination, the Java
-    // WorkflowExecutionListPendingApprovalsHandler order — and the request
-    // org narrows when non-blank (blank = permission-bounded across orgs).
-    // It runs over the executions that CAN carry a pending approval (in
-    // progress, a task waiting) rather than the org's whole history: the
-    // predicate is per-row, so the scope is last (stigmer-cloud 20260913.04
-    // T02) and a composed driver is asked about a handful of rows.
-    const executions = await restrictListByReadScope(deps.listReadScope, identity, ApiResourceKind.workflow_execution, (await loadAllWorkflowExecutions(deps.store, deps.logger, "failed to list workflow executions for pending approvals")).filter(mayHavePendingApproval), req.org);
+    // Census lane 8: the org's executions that CAN carry a
+    // pending approval (in progress, a task waiting) through the list index,
+    // then the scope — the last per-row predicate, so a composed driver is
+    // asked about a handful of rows — before the approvals projection and
+    // its pagination, the Java WorkflowExecutionListPendingApprovalsHandler
+    // order.
+    if (req.pageSize < 0) {
+        throw invalidArgumentError("page_size must not be negative");
+    }
+    const fingerprint = listPageFingerprint({
+        lane: "workflowExecution.listPendingApprovals",
+        org: req.org,
+    });
+    const after = req.pageToken === ""
+        ? undefined
+        : decodeListPageToken(req.pageToken, fingerprint);
+    const executions = await restrictListByReadScope(deps.listReadScope, identity, ApiResourceKind.workflow_execution, (await loadWorkflowExecutions(deps.store, deps.logger, { org: req.org }, "failed to list workflow executions for pending approvals")).filter(mayHavePendingApproval), "");
     let pageSize = req.pageSize;
-    if (pageSize <= 0) {
+    if (pageSize === 0) {
         pageSize = DEFAULT_PENDING_APPROVALS_PAGE_SIZE;
     }
     if (pageSize > MAX_PENDING_APPROVALS_PAGE_SIZE) {
         pageSize = MAX_PENDING_APPROVALS_PAGE_SIZE;
     }
-    let approvals = [];
+    // Newest execution first (the index's order), an execution's waiting
+    // tasks in their order; each approval's position is its execution's
+    // cursor and its place among that execution's waiting tasks.
+    const approvals = [];
     for (const execution of executions) {
+        const cursor = {
+            createdAt: listIndexInstant(execution.status?.audit?.specAudit?.createdAt),
+            id: execution.metadata?.id ?? "",
+        };
+        let position = 0;
         for (const task of execution.status?.tasks ?? []) {
             if (task.status !== WorkflowTaskStatus.WORKFLOW_TASK_WAITING_APPROVAL) {
                 continue;
             }
-            approvals.push(create(PendingApprovalSchema, {
-                executionId: execution.metadata?.id ?? "",
-                workflowName: execution.metadata?.name ?? "",
-                // task_name, not task_id: the composite task_id ("gate:2")
-                // would break submitWorkflowTaskApproval, whose runner-side
-                // signal is keyed by the plain task name.
-                taskName: task.taskName,
-                requester: execution.status?.audit?.specAudit?.createdBy?.id ?? "",
-                requestedAt: parseTimestampString(task.startedAt),
-                uiHint: task.uiHint,
-            }));
+            approvals.push({
+                approval: create(PendingApprovalSchema, {
+                    executionId: execution.metadata?.id ?? "",
+                    workflowName: execution.metadata?.name ?? "",
+                    // task_name, not task_id: the composite task_id ("gate:2")
+                    // would break submitWorkflowTaskApproval, whose runner-side
+                    // signal is keyed by the plain task name.
+                    taskName: task.taskName,
+                    requester: execution.status?.audit?.specAudit?.createdBy?.id ?? "",
+                    requestedAt: parseTimestampString(task.startedAt),
+                    uiHint: task.uiHint,
+                }),
+                at: { cursor, position },
+            });
+            position += 1;
         }
     }
-    const totalCount = approvals.length;
-    if (approvals.length > pageSize) {
-        approvals = approvals.slice(0, pageSize);
-    }
+    const start = after === undefined
+        ? 0
+        : approvals.findIndex((a) => comesAfter(a.at, after));
+    const remaining = start < 0 ? [] : approvals.slice(start);
+    const page = remaining.slice(0, pageSize);
+    const last = page[page.length - 1];
     return create(PendingApprovalsListSchema, {
-        entries: approvals,
-        totalCount,
+        entries: page.map((a) => a.approval),
+        totalCount: approvals.length,
+        nextPageToken: remaining.length > pageSize && last !== undefined
+            ? encodeListPageToken(last.at.cursor, fingerprint, last.at.position)
+            : "",
     });
 }
+/** Whether an approval comes strictly after a token's position. */
+function comesAfter(at, after) {
+    const order = compareListIndexOrder(at.cursor, after.cursor);
+    return order > 0 || (order === 0 && at.position > (after.position ?? -1));
+}
 /** Go parseTimestampString: RFC3339 or nothing (nil on parse failure). */
 function parseTimestampString(value) {
     const ms = parseRfc3339Ms(value);

package/dist/domain/workflowexecution/list-pending-approvals.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-pending-approvals.js","sourceRoot":"","sources":["../../../src/domain/workflowexecution/list-pending-approvals.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGzD,OAAO,EACL,cAAc,EACd,kBAAkB,GACnB,MAAM,iEAAiE,CAAC;AACzE,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,+DAA+D,CAAC;AAOvE,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAKtH,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAG9E,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AASzD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAA0B,EAC1B,GAAgC,EAChC,QAAwB;IAExB,yEAAyE;IACzE,wDAAwD;IACxD,uEAAuE;IACvE,uEAAuE;IACvE,oEAAoE;IACpE,qEAAqE;IACrE,wEAAwE;IACxE,+DAA+D;IAC/D,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAC9C,IAAI,CAAC,aAAa,EAClB,QAAQ,EACR,eAAe,CAAC,kBAAkB,EAClC,CACE,MAAM,yBAAyB,CAC7B,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,MAAM,EACX,0DAA0D,CAC3D,CACF,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAChC,GAAG,CAAC,GAAG,CACR,CAAC;IAEF,IAAI,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC5B,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,QAAQ,GAAG,mCAAmC,CAAC;IACjD,CAAC;IACD,IAAI,QAAQ,GAAG,+BAA+B,EAAE,CAAC;QAC/C,QAAQ,GAAG,+BAA+B,CAAC;IAC7C,CAAC;IAED,IAAI,SAAS,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;YACjD,IAAI,IAAI,CAAC,MAAM,KAAK,kBAAkB,CAAC,8BAA8B,EAAE,CAAC;gBACtE,SAAS;YACX,CAAC;YACD,SAAS,CAAC,IAAI,CACZ,MAAM,CAAC,qBAAqB,EAAE;gBAC5B,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;gBACzC,YAAY,EAAE,SAAS,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE;gBAC5C,2DAA2D;gBAC3D,4DAA4D;gBAC5D,0CAA0C;gBAC1C,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE;gBAClE,WAAW,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC;gBACjD,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC;IACpC,IAAI,SAAS,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAChC,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,MAAM,CAAC,0BAA0B,EAAE;QACxC,OAAO,EAAE,SAAS;QAClB,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,eAAe,CAAC,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,SAA4B;IAC1D,MAAM,KAAK,GACT,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,cAAc,CAAC,2BAA2B,CAAC;IACxE,OAAO,CACL,KAAK,KAAK,cAAc,CAAC,qBAAqB;QAC9C,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAClC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,MAAM,KAAK,kBAAkB,CAAC,8BAA8B,CACpE,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"list-pending-approvals.js","sourceRoot":"","sources":["../../../src/domain/workflowexecution/list-pending-approvals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGzD,OAAO,EACL,cAAc,EACd,kBAAkB,GACnB,MAAM,iEAAiE,CAAC;AACzE,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,+DAA+D,CAAC;AAOvE,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAKtH,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAG3C,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAStD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAA0B,EAC1B,GAAgC,EAChC,QAAwB;IAExB,uDAAuD;IACvD,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,wEAAwE;IACxE,SAAS;IACT,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,oBAAoB,CAAC,gCAAgC,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,WAAW,GAAG,mBAAmB,CAAC;QACtC,IAAI,EAAE,wCAAwC;QAC9C,GAAG,EAAE,GAAG,CAAC,GAAG;KACb,CAAC,CAAC;IACH,MAAM,KAAK,GACT,GAAG,CAAC,SAAS,KAAK,EAAE;QAClB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAEtD,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAC9C,IAAI,CAAC,aAAa,EAClB,QAAQ,EACR,eAAe,CAAC,kBAAkB,EAClC,CACE,MAAM,sBAAsB,CAC1B,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,MAAM,EACX,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAChB,0DAA0D,CAC3D,CACF,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAChC,EAAE,CACH,CAAC;IAEF,IAAI,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC5B,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,QAAQ,GAAG,mCAAmC,CAAC;IACjD,CAAC;IACD,IAAI,QAAQ,GAAG,+BAA+B,EAAE,CAAC;QAC/C,QAAQ,GAAG,+BAA+B,CAAC;IAC7C,CAAC;IAED,qEAAqE;IACrE,oEAAoE;IACpE,6DAA6D;IAC7D,MAAM,SAAS,GAGV,EAAE,CAAC;IACR,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG;YACb,SAAS,EAAE,gBAAgB,CACzB,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAC9C;YACD,EAAE,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;SACjC,CAAC;QACF,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;YACjD,IAAI,IAAI,CAAC,MAAM,KAAK,kBAAkB,CAAC,8BAA8B,EAAE,CAAC;gBACtE,SAAS;YACX,CAAC;YACD,SAAS,CAAC,IAAI,CAAC;gBACb,QAAQ,EAAE,MAAM,CAAC,qBAAqB,EAAE;oBACtC,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;oBACzC,YAAY,EAAE,SAAS,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE;oBAC5C,2DAA2D;oBAC3D,4DAA4D;oBAC5D,0CAA0C;oBAC1C,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE;oBAClE,WAAW,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC;oBACjD,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC;gBACF,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;aACzB,CAAC,CAAC;YACH,QAAQ,IAAI,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GACT,KAAK,KAAK,SAAS;QACjB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAEnC,OAAO,MAAM,CAAC,0BAA0B,EAAE;QACxC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QACpC,UAAU,EAAE,SAAS,CAAC,MAAM;QAC5B,aAAa,EACX,SAAS,CAAC,MAAM,GAAG,QAAQ,IAAI,IAAI,KAAK,SAAS;YAC/C,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC;YACpE,CAAC,CAAC,EAAE;KACT,CAAC,CAAC;AACL,CAAC;AAED,mEAAmE;AACnE,SAAS,UAAU,CACjB,EAAuD,EACvD,KAA0B;IAE1B,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,0EAA0E;AAC1E,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,eAAe,CAAC,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,SAA4B;IAC1D,MAAM,KAAK,GACT,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,cAAc,CAAC,2BAA2B,CAAC;IACxE,OAAO,CACL,KAAK,KAAK,cAAc,CAAC,qBAAqB;QAC9C,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAClC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,MAAM,KAAK,kBAAkB,CAAC,8BAA8B,CACpE,CACF,CAAC;AACJ,CAAC"}

package/dist/domain/workflowexecution/queries.d.ts

@@ -1,10 +1,36 @@
 import type { WorkflowExecution } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
+import { ExecutionSortField } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/io_pb";
+import type { WorkflowExecutionList } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/io_pb";
 import type { Logger } from "../../boot/logger.js";
+import type { CallerIdentity } from "../../extensions/identity.js";
+import type { ListReadScope } from "../../extensions/list-read-scope.js";
+import type { ListPageRequest } from "../../pipeline/steps/list-page.js";
 import type { Store } from "../../store/interface.js";
+import type { ListIndexQuery } from "../../store/list-index.js";
+/** The keys the workflow-execution index declares. */
+export type WorkflowExecutionListKey = "workflow" | "workflow_instance";
+/** A stored row, or undefined (logged) when it does not decode. */
+export declare function decodeWorkflowExecution(data: Uint8Array, logger: Logger): WorkflowExecution | undefined;
 /**
- * Loads every workflow execution. The Internal message varies by caller in
- * Go (each handler wraps the same store error with its own text), so the
- * caller supplies it.
+ * Every workflow execution the query matches, newest created first. The
+ * Internal message varies by caller in Go (each handler wraps the same
+ * store error with its own text), so the caller supplies it.
  */
-export declare function loadAllWorkflowExecutions(store: Store, logger: Logger, internalMessage: string): Promise<WorkflowExecution[]>;
+export declare function loadWorkflowExecutions(store: Store, logger: Logger, query: ListIndexQuery<WorkflowExecutionListKey>, internalMessage: string): Promise<WorkflowExecution[]>;
+export interface WorkflowExecutionListRead {
+    readonly store: Store;
+    readonly logger: Logger;
+    readonly listReadScope: ListReadScope | undefined;
+    readonly identity: CallerIdentity;
+    readonly query: ListIndexQuery<WorkflowExecutionListKey>;
+    readonly request: ListPageRequest;
+    readonly sortField: ExecutionSortField;
+    readonly sortAscending: boolean;
+    /** The lane's filters beyond the indexed predicates. */
+    readonly keep: (execution: WorkflowExecution) => boolean;
+    /** The request's other fields, which its token is bound to. */
+    readonly fingerprint: Readonly<Record<string, unknown>>;
+}
+/** One list response: a page in the default order, or the whole set sorted by another field. */
+export declare function readWorkflowExecutionList(read: WorkflowExecutionListRead): Promise<WorkflowExecutionList>;
 //# sourceMappingURL=queries.d.ts.map

package/dist/domain/workflowexecution/queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"queries.d.ts","sourceRoot":"","sources":["../../../src/domain/workflowexecution/queries.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gEAAgE,CAAC;AAIxG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAsB9B"}
+{"version":3,"file":"queries.d.ts","sourceRoot":"","sources":["../../../src/domain/workflowexecution/queries.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gEAAgE,CAAC;AAExG,OAAO,EACL,kBAAkB,EAEnB,MAAM,+DAA+D,CAAC;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+DAA+D,CAAC;AAG3G,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAQzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,2BAA2B,CAAC;AAI9E,sDAAsD;AACtD,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,mBAAmB,CAAC;AAExE,mEAAmE;AACnE,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,MAAM,GACb,iBAAiB,GAAG,SAAS,CAS/B;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,cAAc,CAAC,wBAAwB,CAAC,EAC/C,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAe9B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,wBAAwB,CAAC,CAAC;IACzD,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,iBAAiB,KAAK,OAAO,CAAC;IACzD,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzD;AAED,gGAAgG;AAChG,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAsDhC"}

package/dist/domain/workflowexecution/queries.js

@@ -1,40 +1,94 @@
 /**
- * Shared full-scan load for the workflowexecution read surfaces (list,
- * listByWorkflow, getExecutionSummary, listPendingApprovals) — Go's
- * store.ListResources + proto.Unmarshal-continue loop, where malformed
- * rows are skipped rather than failing the read.
+ * The workflowexecution read surfaces' shared reads (list,
+ * listByWorkflow, getExecutionSummary, listPendingApprovals), all through
+ * the list index (list-index.ts beside this file; the store's contract in
+ * store/interface.ts) — the request's org or workflow key narrows in the
+ * store, newest created first. Malformed rows are skipped rather than
+ * failing the read, Go's proto.Unmarshal-continue loop.
+ *
+ * The two lists share one reader: the default order pages
+ * (pipeline/steps/list-page.ts), with the lane's filters and then the read
+ * scope on each batch; another sort field sorts the whole matching set and
+ * returns its first page_size entries with no token, because only the
+ * creation order is an index order.
  */
-import { fromBinary } from "@bufbuild/protobuf";
+import { create, fromBinary } from "@bufbuild/protobuf";
 import { WorkflowExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
+import { ExecutionSortField, WorkflowExecutionListSchema, } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/io_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { internalError } from "../../pipeline/errors.js";
+import { restrictListByReadScope } from "../../extensions/list-read-scope.js";
+import { internalError, invalidArgumentError } from "../../pipeline/errors.js";
+import { LIST_PAGE_MAX_SIZE, listPageFingerprint, readListPage, } from "../../pipeline/steps/list-page.js";
+import { applySortField } from "./execution-filter.js";
+import { workflowExecutionListIndex } from "./list-index.js";
+/** A stored row, or undefined (logged) when it does not decode. */
+export function decodeWorkflowExecution(data, logger) {
+    try {
+        return fromBinary(WorkflowExecutionSchema, data);
+    }
+    catch (error) {
+        logger.warn("Failed to unmarshal workflow execution, skipping", {
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return undefined;
+    }
+}
 /**
- * Loads every workflow execution. The Internal message varies by caller in
- * Go (each handler wraps the same store error with its own text), so the
- * caller supplies it.
+ * Every workflow execution the query matches, newest created first. The
+ * Internal message varies by caller in Go (each handler wraps the same
+ * store error with its own text), so the caller supplies it.
  */
-export async function loadAllWorkflowExecutions(store, logger, internalMessage) {
+export async function loadWorkflowExecutions(store, logger, query, internalMessage) {
     let rows;
     try {
-        rows = await store.listResources(ApiResourceKind.workflow_execution);
+        rows = await store.queryResources(workflowExecutionListIndex, query);
     }
     catch (error) {
         throw internalError(error, internalMessage);
     }
     const executions = [];
-    for (const data of rows) {
-        let execution;
-        try {
-            execution = fromBinary(WorkflowExecutionSchema, data);
+    for (const row of rows) {
+        const execution = decodeWorkflowExecution(row.data, logger);
+        if (execution !== undefined) {
+            executions.push(execution);
         }
-        catch (error) {
-            logger.warn("Failed to unmarshal workflow execution, skipping", {
-                error: error instanceof Error ? error.message : String(error),
-            });
-            continue;
-        }
-        executions.push(execution);
     }
     return executions;
 }
+/** One list response: a page in the default order, or the whole set sorted by another field. */
+export async function readWorkflowExecutionList(read) {
+    const scope = (executions) => restrictListByReadScope(read.listReadScope, read.identity, ApiResourceKind.workflow_execution, executions, "");
+    if (read.sortField === ExecutionSortField.UNSPECIFIED) {
+        const page = await readListPage({
+            store: read.store,
+            declaration: workflowExecutionListIndex,
+            query: read.query,
+            request: read.request,
+            fingerprint: listPageFingerprint(read.fingerprint),
+            decode: (data) => decodeWorkflowExecution(data, read.logger),
+            keep: read.keep,
+            scope,
+            failure: "failed to list workflow executions",
+        });
+        return create(WorkflowExecutionListSchema, {
+            entries: page.entries,
+            nextPageToken: page.nextPageToken,
+            totalPages: page.nextPageToken === "" ? 1 : 0,
+        });
+    }
+    // Another sort field never issues a token, so none can be continued.
+    if (read.request.pageToken !== "") {
+        throw invalidArgumentError("invalid page_token");
+    }
+    if (read.request.pageSize < 0) {
+        throw invalidArgumentError("page_size must not be negative");
+    }
+    const executions = await scope((await loadWorkflowExecutions(read.store, read.logger, read.query, "failed to list workflow executions")).filter(read.keep));
+    applySortField(executions, read.sortField, read.sortAscending);
+    const size = Math.min(read.request.pageSize, LIST_PAGE_MAX_SIZE);
+    return create(WorkflowExecutionListSchema, {
+        entries: size === 0 ? executions : executions.slice(0, size),
+        totalPages: 1,
+    });
+}
 //# sourceMappingURL=queries.js.map

package/dist/domain/workflowexecution/queries.js.map

@@ -1 +1 @@
-{"version":3,"file":"queries.js","sourceRoot":"","sources":["../../../src/domain/workflowexecution/queries.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gEAAgE,CAAC;AACzG,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGzD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAY,EACZ,MAAc,EACd,eAAuB;IAEvB,IAAI,IAAkB,CAAC;IACvB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,UAAU,GAAwB,EAAE,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,SAA4B,CAAC;QACjC,IAAI,CAAC;YACH,SAAS,GAAG,UAAU,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE;gBAC9D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}
+{"version":3,"file":"queries.js","sourceRoot":"","sources":["../../../src/domain/workflowexecution/queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gEAAgE,CAAC;AACzG,OAAO,EACL,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,+DAA+D,CAAC;AAEvE,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAKtH,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,GACb,MAAM,mCAAmC,CAAC;AAI3C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAK7D,mEAAmE;AACnE,MAAM,UAAU,uBAAuB,CACrC,IAAgB,EAChB,MAAc;IAEd,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE;YAC9D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAY,EACZ,MAAc,EACd,KAA+C,EAC/C,eAAuB;IAEvB,IAAI,IAAoB,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,UAAU,GAAwB,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAiBD,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAA+B;IAE/B,MAAM,KAAK,GAAG,CACZ,UAA+B,EACD,EAAE,CAChC,uBAAuB,CACrB,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,QAAQ,EACb,eAAe,CAAC,kBAAkB,EAClC,UAAU,EACV,EAAE,CACH,CAAC;IAEJ,IAAI,IAAI,CAAC,SAAS,KAAK,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC;YAC9B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,0BAA0B;YACvC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,WAAW,EAAE,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC;YAClD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;YAC5D,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK;YACL,OAAO,EAAE,oCAAoC;SAC9C,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,2BAA2B,EAAE;YACzC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QAClC,MAAM,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,oBAAoB,CAAC,gCAAgC,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,KAAK,CAC5B,CACE,MAAM,sBAAsB,CAC1B,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,KAAK,EACV,oCAAoC,CACrC,CACF,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CACpB,CAAC;IACF,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,2BAA2B,EAAE;QACzC,OAAO,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;QAC5D,UAAU,EAAE,CAAC;KACd,CAAC,CAAC;AACL,CAAC"}

package/dist/encryption/key-manager.d.ts

@@ -13,11 +13,28 @@ export interface KeyLoaderOptions {
     readonly homeDir?: string;
 }
 /**
- * Go GetOrCreateNamedKey: env var → key file → auto-generate. Throws only
- * on unusable EXPLICIT configuration (bad env value) or when no key can be
- * produced at all.
+ * What one kind of key is, for the ladder. `fromEnv` receives the env
+ * value already strictly Base64-decoded and THROWS when the bytes are not
+ * a usable key (explicit configuration is never silently ignored);
+ * `fromFile` answers `undefined` for content it does not accept, so the
+ * ladder falls through exactly as it does for a wrong-sized raw key.
+ */
+export interface KeyCodec<Key> {
+    fromEnv(envVar: string, decoded: Buffer): Key;
+    fromFile(content: Buffer): Key | undefined;
+    generate(): Key;
+    toFile(key: Key): Buffer;
+}
+/** The 32 raw bytes the encryption and runner-token keys are. */
+export declare const RAW_32_BYTE_KEY: KeyCodec<Buffer>;
+/**
+ * Go GetOrCreateNamedKey: env var → key file → auto-generate, for a 32-byte
+ * raw key. Throws only on unusable EXPLICIT configuration (bad env value)
+ * or when no key can be produced at all.
  */
 export declare function getOrCreateNamedKey(envVar: string, fileName: string, options?: KeyLoaderOptions): Buffer;
+/** The ladder over any codec: env var → key file → auto-generate. */
+export declare function getOrCreateKey<Key>(codec: KeyCodec<Key>, envVar: string, fileName: string, options?: KeyLoaderOptions): Key;
 /** Path to a named key file under <home>/.stigmer. */
 export declare function namedKeyFilePath(fileName: string, options?: KeyLoaderOptions): string;
 //# sourceMappingURL=key-manager.d.ts.map

package/dist/encryption/key-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"key-manager.d.ts","sourceRoot":"","sources":["../../src/encryption/key-manager.ts"],"names":[],"mappings":"AAgCA,yEAAyE;AACzE,eAAO,MAAM,QAAQ,KAAK,CAAC;AAE3B,0DAA0D;AAC1D,eAAO,MAAM,YAAY,aAAa,CAAC;AAEvC,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,MAAQ,CAAC;AAE1C,wDAAwD;AACxD,eAAO,MAAM,mBAAmB,MAAQ,CAAC;AAEzC,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,gBAAqB,GAC7B,MAAM,CA2BR;AAoBD,sDAAsD;AACtD,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,gBAAqB,GAC7B,MAAM,CAGR"}
+{"version":3,"file":"key-manager.d.ts","sourceRoot":"","sources":["../../src/encryption/key-manager.ts"],"names":[],"mappings":"AAsCA,yEAAyE;AACzE,eAAO,MAAM,QAAQ,KAAK,CAAC;AAE3B,0DAA0D;AAC1D,eAAO,MAAM,YAAY,aAAa,CAAC;AAEvC,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,MAAQ,CAAC;AAE1C,wDAAwD;AACxD,eAAO,MAAM,mBAAmB,MAAQ,CAAC;AAEzC,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ,CAAC,GAAG;IAC3B,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC;IAC3C,QAAQ,IAAI,GAAG,CAAC;IAChB,MAAM,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC;CAC1B;AAED,iEAAiE;AACjE,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAkB5C,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,gBAAqB,GAC7B,MAAM,CAER;AAED,qEAAqE;AACrE,wBAAgB,cAAc,CAAC,GAAG,EAChC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,gBAAqB,GAC7B,GAAG,CA6BL;AAeD,sDAAsD;AACtD,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,gBAAqB,GAC7B,MAAM,CAGR"}

package/dist/encryption/key-manager.js

@@ -1,20 +1,26 @@
 /**
  * Named-key loader — ports pkg/encryption/keymanager.go.
  *
- * One convention for every 32-byte key the server holds (sub-project
- * DD-002): env var (Base64) → ~/.stigmer/<file> (raw bytes, 0600) →
- * auto-generate and persist. The loader is generalized over the env var
- * and file name so sibling key material (the runner-token signing key,
- * oss#535) rides the same ladder instead of growing a divergent loader.
+ * One convention for every key the server holds: env var (Base64) →
+ * ~/.stigmer/<file> (0600) → auto-generate and persist. The
+ * loader is generalized over the env var, the file name and a KeyCodec so
+ * sibling key material rides the same ladder instead of growing a
+ * divergent loader: the runner-token signing key (oss#535) and the
+ * encryption key are 32 raw bytes (RAW_32_BYTE_KEY); the platform-token
+ * signing key is an RSA private key (platformtoken/key-ring.ts). The codec
+ * says what a key IS — how an env value and a file decode, how one is
+ * generated and written — and nothing about the ladder, which stays one.
  *
- * Ladder semantics, exactly Go's:
+ * Ladder semantics, exactly Go's, for every codec:
  *   - An EXPLICITLY configured env key that is unusable (bad Base64, wrong
- *     length) is an ERROR, never a degrade — silently ignoring deliberate
- *     configuration would be worse than refusing to boot.
+ *     length, not the key type the codec holds) is an ERROR, never a
+ *     degrade — silently ignoring deliberate configuration would be worse
+ *     than refusing to boot.
  *   - A key file that fails its load checks (permissions other than 0600,
- *     wrong size) is never adopted; the ladder FALLS THROUGH to
- *     auto-generate, which overwrites the file's content — Go's shipped
- *     behavior (loadKeyFromFile error → generate → save), ported as-is.
+ *     content the codec does not accept) is never adopted; the ladder
+ *     FALLS THROUGH to auto-generate, which overwrites the file's content —
+ *     Go's shipped behavior (loadKeyFromFile error → generate → save),
+ *     ported as-is.
  *   - Auto-generation persists for future boots; a persist FAILURE is a
  *     stderr warning only — the key is still usable for this process.
  *
@@ -37,28 +43,52 @@ export const KEY_FILE_DIR = ".stigmer";
 export const KEY_FILE_PERMISSIONS = 0o600;
 /** Key directory permissions — Go KeyDirPermissions. */
 export const KEY_DIR_PERMISSIONS = 0o700;
+/** The 32 raw bytes the encryption and runner-token keys are. */
+export const RAW_32_BYTE_KEY = {
+    fromEnv(envVar, decoded) {
+        if (decoded.length !== KEY_SIZE) {
+            throw new Error(`${envVar} must be exactly 32 bytes (256 bits) when decoded, got ${decoded.length} bytes`);
+        }
+        return decoded;
+    },
+    fromFile(content) {
+        return content.length === KEY_SIZE ? content : undefined;
+    },
+    generate() {
+        return randomBytes(KEY_SIZE);
+    },
+    toFile(key) {
+        return key;
+    },
+};
 /**
- * Go GetOrCreateNamedKey: env var → key file → auto-generate. Throws only
- * on unusable EXPLICIT configuration (bad env value) or when no key can be
- * produced at all.
+ * Go GetOrCreateNamedKey: env var → key file → auto-generate, for a 32-byte
+ * raw key. Throws only on unusable EXPLICIT configuration (bad env value)
+ * or when no key can be produced at all.
  */
 export function getOrCreateNamedKey(envVar, fileName, options = {}) {
+    return getOrCreateKey(RAW_32_BYTE_KEY, envVar, fileName, options);
+}
+/** The ladder over any codec: env var → key file → auto-generate. */
+export function getOrCreateKey(codec, envVar, fileName, options = {}) {
     const env = options.env ?? process.env;
-    // 1. Environment variable (highest priority) — Base64-encoded 32 bytes.
+    // 1. Environment variable (highest priority) — Base64-encoded.
     const envValue = env[envVar];
     if (envValue !== undefined && envValue !== "") {
-        return decodeEnvKey(envVar, envValue);
+        return codec.fromEnv(envVar, decodeEnvBase64(envVar, envValue));
     }
-    // 2. Local key file — raw 32 bytes, refused on insecure permissions.
+    // 2. Local key file — refused on insecure permissions or content the
+    //    codec does not accept.
     const keyPath = namedKeyFilePath(fileName, options);
-    const fromFile = loadKeyFromFile(keyPath);
+    const content = readKeyFile(keyPath);
+    const fromFile = content === undefined ? undefined : codec.fromFile(content);
     if (fromFile !== undefined) {
         return fromFile;
     }
     // 3. Auto-generate (local development); persist for future boots.
-    const key = randomBytes(KEY_SIZE);
+    const key = codec.generate();
     try {
-        saveKeyToFile(keyPath, key);
+        saveKeyToFile(keyPath, codec.toFile(key));
     }
     catch (error) {
         // Warn but don't fail — the key is still usable (Go's posture).
@@ -66,20 +96,17 @@ export function getOrCreateNamedKey(envVar, fileName, options = {}) {
     }
     return key;
 }
-/** Strict Base64 decode + length check for an env-configured key. */
-function decodeEnvKey(envVar, value) {
-    const key = Buffer.from(value, "base64");
+/** Strict Base64 decode for an env-configured key. */
+function decodeEnvBase64(envVar, value) {
+    const decoded = Buffer.from(value, "base64");
     // Node's base64 decoder is lenient (skips invalid characters, accepts
     // missing padding) and never throws; Go's StdEncoding errors on any
     // non-canonical input. Round-tripping — Buffer always re-emits the
     // canonical padded form — restores Go's strictness.
-    if (key.toString("base64") !== value) {
+    if (decoded.toString("base64") !== value) {
         throw new Error(`invalid Base64 encoding in ${envVar}`);
     }
-    if (key.length !== KEY_SIZE) {
-        throw new Error(`${envVar} must be exactly 32 bytes (256 bits) when decoded, got ${key.length} bytes`);
-    }
-    return key;
+    return decoded;
 }
 /** Path to a named key file under <home>/.stigmer. */
 export function namedKeyFilePath(fileName, options = {}) {
@@ -87,13 +114,13 @@ export function namedKeyFilePath(fileName, options = {}) {
     return path.join(home, KEY_FILE_DIR, fileName);
 }
 /**
- * Reads raw key bytes, mirroring Go loadKeyFromFile: missing file →
- * undefined (fall through the ladder); present-but-wrong (insecure
- * permissions, wrong size) also falls through — exactly Go's behavior,
- * where any load error falls to auto-generate. The 0600 check is skipped
- * on Windows, where POSIX modes are not meaningful.
+ * Reads a key file's bytes, mirroring Go loadKeyFromFile: missing file →
+ * undefined (fall through the ladder); present with insecure permissions
+ * also falls through — exactly Go's behavior, where any load error falls
+ * to auto-generate. The 0600 check is skipped on Windows, where POSIX
+ * modes are not meaningful.
  */
-function loadKeyFromFile(keyPath) {
+function readKeyFile(keyPath) {
     let stat;
     try {
         stat = fs.statSync(keyPath);
@@ -107,24 +134,19 @@ function loadKeyFromFile(keyPath) {
             return undefined;
         }
     }
-    let key;
     try {
-        key = fs.readFileSync(keyPath);
+        return fs.readFileSync(keyPath);
     }
     catch {
         return undefined;
     }
-    if (key.length !== KEY_SIZE) {
-        return undefined;
-    }
-    return key;
 }
 /** Writes the key with secure permissions (dir 0700, file 0600). */
-function saveKeyToFile(keyPath, key) {
+function saveKeyToFile(keyPath, content) {
     fs.mkdirSync(path.dirname(keyPath), {
         recursive: true,
         mode: KEY_DIR_PERMISSIONS,
     });
-    fs.writeFileSync(keyPath, key, { mode: KEY_FILE_PERMISSIONS });
+    fs.writeFileSync(keyPath, content, { mode: KEY_FILE_PERMISSIONS });
 }
 //# sourceMappingURL=key-manager.js.map

package/dist/encryption/key-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"key-manager.js","sourceRoot":"","sources":["../../src/encryption/key-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,yEAAyE;AACzE,MAAM,CAAC,MAAM,QAAQ,GAAG,EAAE,CAAC;AAE3B,0DAA0D;AAC1D,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC;AAEvC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C,wDAAwD;AACxD,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AASzC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,QAAgB,EAChB,UAA4B,EAAE;IAE9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAEvC,wEAAwE;IACxE,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,OAAO,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,qEAAqE;IACrE,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,kEAAkE;IAClE,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gEAAgE;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kCAAkC,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CACzG,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qEAAqE;AACrE,SAAS,YAAY,CAAC,MAAc,EAAE,KAAa;IACjD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACzC,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,oDAAoD;IACpD,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,0DAA0D,GAAG,CAAC,MAAM,QAAQ,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,UAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAC/B,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,SAAS,aAAa,CAAC,OAAe,EAAE,GAAW;IACjD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAClC,SAAS,EAAE,IAAI;QACf,IAAI,EAAE,mBAAmB;KAC1B,CAAC,CAAC;IACH,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;AACjE,CAAC"}
+{"version":3,"file":"key-manager.js","sourceRoot":"","sources":["../../src/encryption/key-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,yEAAyE;AACzE,MAAM,CAAC,MAAM,QAAQ,GAAG,EAAE,CAAC;AAE3B,0DAA0D;AAC1D,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC;AAEvC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C,wDAAwD;AACxD,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAuBzC,iEAAiE;AACjE,MAAM,CAAC,MAAM,eAAe,GAAqB;IAC/C,OAAO,CAAC,MAAM,EAAE,OAAO;QACrB,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,0DAA0D,OAAO,CAAC,MAAM,QAAQ,CAC1F,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,QAAQ,CAAC,OAAO;QACd,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,CAAC;IACD,QAAQ;QACN,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,CAAC,GAAG;QACR,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,QAAgB,EAChB,UAA4B,EAAE;IAE9B,OAAO,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,cAAc,CAC5B,KAAoB,EACpB,MAAc,EACd,QAAgB,EAChB,UAA4B,EAAE;IAE9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAEvC,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,qEAAqE;IACrE,4BAA4B;IAC5B,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC7E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,kEAAkE;IAClE,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gEAAgE;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kCAAkC,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CACzG,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sDAAsD;AACtD,SAAS,eAAe,CAAC,MAAc,EAAE,KAAa;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7C,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,oDAAoD;IACpD,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,UAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAC/B,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,SAAS,aAAa,CAAC,OAAe,EAAE,OAAe;IACrD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAClC,SAAS,EAAE,IAAI;QACf,IAAI,EAAE,mBAAmB;KAC1B,CAAC,CAAC;IACH,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;AACrE,CAAC"}

package/dist/extensions/caller-guards.d.ts

@@ -10,9 +10,14 @@
  * allowed_origins, oss#375). Java separates the two classes the same way.
  *
  * List point — guards concatenate in unit order and run in composed
- * order; the first throw wins. OSS composes zero guards, so with none
- * registered the serving chain behaves byte-identically to before the
- * point existed (the conformance rosters pin that).
+ * order; the first throw wins. Open source's own guards run first (the
+ * verifier list's "OSS entries first" rule): today the PlatformClient
+ * origin guard (domain/platformclient/origin-guard.ts), composed only
+ * under an authentication posture, where PlatformClient tokens exist.
+ * Liveness is not a guard in open source: the PlatformClient verifier
+ * refuses a deleted client's tokens itself, so verifier-only lanes (the
+ * extension HTTP edges) refuse them too. With no posture and no unit
+ * guards, the serving chain runs no guard at all.
  *
  * The in-process exemption is STRUCTURAL, not policed: guards are a
  * parameter of the serving chain's identity source only

package/dist/extensions/caller-guards.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caller-guards.d.ts","sourceRoot":"","sources":["../../src/extensions/caller-guards.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;;OAQG;IACH,KAAK,CACH,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB"}
+{"version":3,"file":"caller-guards.d.ts","sourceRoot":"","sources":["../../src/extensions/caller-guards.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;;OAQG;IACH,KAAK,CACH,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB"}