@stigmer/server 3.24.0 → 3.26.0

package/dist/domain/platformclient/store.js

@@ -0,0 +1,13 @@
+/**
+ * Raised by `save` when the id, the (org, slug) pair or the client_id is
+ * already held, so the create chain answers ALREADY_EXISTS. `cause`
+ * carries a driver's own error (the cloud's SQLSTATE 23505) for the logs;
+ * the message is the port's.
+ */
+export class DuplicatePlatformClientError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "DuplicatePlatformClientError";
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/domain/platformclient/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/domain/platformclient/store.ts"],"names":[],"mappings":"AAiCA;;;;;GAKG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF"}

package/dist/domain/platformclient/system-managed.d.ts

@@ -0,0 +1,18 @@
+import type { PlatformClient } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+export interface SystemManagedPlatformClientInput {
+    /** The owning organization. */
+    readonly org: string;
+    /** A reserved slug (RESERVED_PLATFORM_CLIENT_SLUGS); anything else throws. */
+    readonly slug: string;
+    /** The display name a console would show. */
+    readonly name: string;
+    /** The creation instant stamped on both audit slots; defaults to the wall clock. */
+    readonly now?: Date;
+}
+/**
+ * A new system-managed client, ready for a store's `save`. Throws on an
+ * empty organization or a slug that is not reserved — an edition's
+ * programming error, never a request's.
+ */
+export declare function newSystemManagedPlatformClient(input: SystemManagedPlatformClientInput): PlatformClient;
+//# sourceMappingURL=system-managed.d.ts.map

package/dist/domain/platformclient/system-managed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-managed.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/system-managed.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAsB9F,MAAM,WAAW,gCAAgC;IAC/C,+BAA+B;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,gCAAgC,GACtC,cAAc,CAuChB"}

package/dist/domain/platformclient/system-managed.js

@@ -0,0 +1,80 @@
+/**
+ * The one builder of a system-managed PlatformClient: the row an edition
+ * creates for itself, never through the create chain, so the tokens it
+ * signs on the platform's own behalf (a guest's, a schedule fire's) name a
+ * client that exists. Stigmer Cloud keeps one per organization under
+ * SYSTEM_SHARE_CLIENT_SLUG and persists it through its store driver.
+ *
+ * The domain already owns what such a client is — the create chain refuses
+ * its reserved slug (RefuseReservedSlug) and every mutation refuses its
+ * label (RefuseSystemManaged) — so the row is built here too, and the
+ * rules that make it safe hold by construction:
+ *   - it lives only under a reserved slug, which no user can create, so a
+ *     user client can never be mistaken for one;
+ *   - it carries the reserved `stigmer.ai/system-managed` label, so update,
+ *     delete and rotate refuse it;
+ *   - its credentials are real (a `client_id` unique like any other, a
+ *     hash, a fingerprint), but the secret is discarded here: nobody ever
+ *     authenticates as the platform's own client;
+ *   - its id is spelled like every other (`pcl_` + ULID, generateId);
+ *   - its audit names no actor, because no caller made it: the platform did.
+ *
+ * Who decides when one exists, and where it is stored, is the edition's:
+ * this function writes nothing. It writes no authorization tuples either —
+ * nothing authorizes against a system-managed client, and with none it
+ * stays out of every list and reference read a person makes.
+ */
+import { create } from "@bufbuild/protobuf";
+import { timestampFromDate } from "@bufbuild/protobuf/wkt";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiResourceAuditInfoSchema, ApiResourceAuditSchema, } from "@stigmer/protos/ai/stigmer/commons/apiresource/status_pb";
+import { PlatformClientSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+import { RESERVED_LABEL_TRUE, SYSTEM_MANAGED_LABEL, } from "../../pipeline/apiresource-labels.js";
+import { defaultVisibilityFor, getIdPrefix, } from "../../pipeline/apiresource-meta.js";
+import { generateId } from "../../pipeline/steps/defaults.js";
+import { PLATFORM_CLIENT_KIND_NAME, RESERVED_PLATFORM_CLIENT_SLUGS, } from "./constants.js";
+import { generateClientId, generateClientSecret, hashClientSecret, secretFingerprint, } from "./credentials.js";
+/**
+ * A new system-managed client, ready for a store's `save`. Throws on an
+ * empty organization or a slug that is not reserved — an edition's
+ * programming error, never a request's.
+ */
+export function newSystemManagedPlatformClient(input) {
+    if (input.org === "") {
+        throw new Error("a system-managed platform client needs an organization");
+    }
+    if (!RESERVED_PLATFORM_CLIENT_SLUGS.has(input.slug)) {
+        throw new Error(`'${input.slug}' is not a reserved platform-client slug; a system-managed client lives only under one (${[...RESERVED_PLATFORM_CLIENT_SLUGS].join(", ")})`);
+    }
+    const secret = generateClientSecret();
+    const created = timestampFromDate(input.now ?? new Date());
+    const audit = create(ApiResourceAuditInfoSchema, {
+        createdAt: created,
+        updatedAt: created,
+        event: "created",
+    });
+    return create(PlatformClientSchema, {
+        apiVersion: "iam.stigmer.ai/v1",
+        kind: PLATFORM_CLIENT_KIND_NAME,
+        metadata: {
+            id: generateId(getIdPrefix(ApiResourceKind.platform_client)),
+            org: input.org,
+            name: input.name,
+            slug: input.slug,
+            labels: { [SYSTEM_MANAGED_LABEL]: RESERVED_LABEL_TRUE },
+            visibility: defaultVisibilityFor(ApiResourceKind.platform_client),
+        },
+        spec: {
+            clientId: generateClientId(),
+            clientSecretHash: hashClientSecret(secret),
+            secretFingerprint: secretFingerprint(secret),
+        },
+        status: {
+            audit: create(ApiResourceAuditSchema, {
+                specAudit: audit,
+                statusAudit: audit,
+            }),
+        },
+    });
+}
+//# sourceMappingURL=system-managed.js.map

package/dist/domain/platformclient/system-managed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-managed.js","sourceRoot":"","sources":["../../../src/domain/platformclient/system-managed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,0DAA0D,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yDAAyD,CAAC;AAG/F,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,WAAW,GACZ,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAC9D,OAAO,EACL,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAa1B;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAAuC;IAEvC,IAAI,KAAK,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,IAAI,KAAK,CAAC,IAAI,2FAA2F,CAAC,GAAG,8BAA8B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3J,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,0BAA0B,EAAE;QAC/C,SAAS,EAAE,OAAO;QAClB,SAAS,EAAE,OAAO;QAClB,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,oBAAoB,EAAE;QAClC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE;YACR,EAAE,EAAE,UAAU,CAAC,WAAW,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;YAC5D,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,EAAE,CAAC,oBAAoB,CAAC,EAAE,mBAAmB,EAAE;YACvD,UAAU,EAAE,oBAAoB,CAAC,eAAe,CAAC,eAAe,CAAC;SAClE;QACD,IAAI,EAAE;YACJ,QAAQ,EAAE,gBAAgB,EAAE;YAC5B,gBAAgB,EAAE,gBAAgB,CAAC,MAAM,CAAC;YAC1C,iBAAiB,EAAE,iBAAiB,CAAC,MAAM,CAAC;SAC7C;QACD,MAAM,EAAE;YACN,KAAK,EAAE,MAAM,CAAC,sBAAsB,EAAE;gBACpC,SAAS,EAAE,KAAK;gBAChB,WAAW,EAAE,KAAK;aACnB,CAAC;SACH;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/domain/platformclient/token-controller.d.ts

@@ -0,0 +1,11 @@
+import type { ConnectRouter } from "@connectrpc/connect";
+import type { GuestTokenMinting } from "../../extensions/guest-token-minting.js";
+import type { PlatformClientMintDeps } from "./mint.js";
+export interface PlatformClientTokenControllerDeps {
+    readonly mint: PlatformClientMintDeps;
+    /** The composed capability; undefined = mintGuestToken refuses UNIMPLEMENTED. */
+    readonly guestTokenMinting: GuestTokenMinting | undefined;
+}
+/** Registers the token service on the router (routes stage). */
+export declare function registerPlatformClientTokenService(router: ConnectRouter, deps: PlatformClientTokenControllerDeps): void;
+//# sourceMappingURL=token-controller.d.ts.map

package/dist/domain/platformclient/token-controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-controller.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/token-controller.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAGjF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAExD,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,iFAAiF;IACjF,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,GAAG,SAAS,CAAC;CAC3D;AAED,gEAAgE;AAChE,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,iCAAiC,GACtC,IAAI,CAaN"}

package/dist/domain/platformclient/token-controller.js

@@ -0,0 +1,32 @@
+/**
+ * PlatformClientTokenController — the two public token RPCs, registered in
+ * every composition so the service has one owner (the routes stage refuses
+ * an extension that registers it again, boot/route-shadowing.ts):
+ *
+ *   - mintUserToken: the PlatformClient mint (mint.ts). Public on the wire
+ *     — the client authenticates with its credentials in the body, not a
+ *     bearer token — so there is no annotation to evaluate; the mint never
+ *     reads the chain's caller.
+ *   - mintGuestToken: the credential-free mint for anonymous visitors of a
+ *     shared agent's hosted page, dispatched to the composed guest-token
+ *     capability (extensions/guest-token-minting.ts). Without one — open
+ *     source hosts no shared-agent pages — it answers UNIMPLEMENTED with
+ *     the edition sentence, the identityFederation absent shape.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { PlatformClientTokenController } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/token_pb";
+import { GUEST_MINT_UNIMPLEMENTED_MESSAGE } from "./constants.js";
+import { mintUserToken } from "./mint.js";
+/** Registers the token service on the router (routes stage). */
+export function registerPlatformClientTokenService(router, deps) {
+    router.service(PlatformClientTokenController, {
+        mintUserToken: (request) => mintUserToken(deps.mint, request),
+        mintGuestToken: (request, ctx) => {
+            if (deps.guestTokenMinting === undefined) {
+                throw new ConnectError(GUEST_MINT_UNIMPLEMENTED_MESSAGE, Code.Unimplemented);
+            }
+            return deps.guestTokenMinting.mintGuestToken(request, ctx.requestHeader);
+        },
+    });
+}
+//# sourceMappingURL=token-controller.js.map

package/dist/domain/platformclient/token-controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-controller.js","sourceRoot":"","sources":["../../../src/domain/platformclient/token-controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,6BAA6B,EAAE,MAAM,2DAA2D,CAAC;AAG1G,OAAO,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAS1C,gEAAgE;AAChE,MAAM,UAAU,kCAAkC,CAChD,MAAqB,EACrB,IAAuC;IAEvC,MAAM,CAAC,OAAO,CAAC,6BAA6B,EAAE;QAC5C,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QAC7D,cAAc,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;YAC/B,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACzC,MAAM,IAAI,YAAY,CACpB,gCAAgC,EAChC,IAAI,CAAC,aAAa,CACnB,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;QAC3E,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/domain/platformclient/verifier.d.ts

@@ -0,0 +1,10 @@
+import type { IdentityVerifier } from "../../extensions/identity.js";
+import type { PlatformTokenKeyRing } from "../../platformtoken/key-ring.js";
+import type { PlatformClientStore } from "./store.js";
+export interface PlatformClientTokenVerifierDeps {
+    readonly keys: PlatformTokenKeyRing;
+    readonly clients: Pick<PlatformClientStore, "findById">;
+    readonly now?: () => Date;
+}
+export declare function newPlatformClientTokenVerifier(deps: PlatformClientTokenVerifierDeps): IdentityVerifier;
+//# sourceMappingURL=verifier.d.ts.map

package/dist/domain/platformclient/verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../src/domain/platformclient/verifier.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AAOtC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAM5E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;IACxD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,+BAA+B,GACpC,gBAAgB,CA8ClB"}

package/dist/domain/platformclient/verifier.js

@@ -0,0 +1,76 @@
+/**
+ * The PlatformClient user-token verifier: open source's one platform-token
+ * lane. It claims a token with `iss: "stigmer"` and NO `token_type` — the
+ * user token the mint signs — and passes every other token on:
+ *   - a token that is not a platform token is another verifier's (the
+ *     OIDC verifier's, an API key's);
+ *   - a typed platform token (guest, schedule, channel, the sandbox
+ *     family) belongs to the edition that mints it; open source verifies
+ *     only its own vocabulary, and on a server with no verifier for that
+ *     lane the chain refuses it as unclaimed.
+ * A platform token whose signature, expiry, audience or subject fails is
+ * refused here with the envelope's pinned copy, whichever lane it names —
+ * the refusal the cloud's verifier has always answered for it.
+ *
+ * Liveness is the verifier's (not a guard's), so every lane that
+ * authenticates — the serving chain and the extension HTTP edges that run
+ * the verifier chain without guards — refuses a deleted client's tokens on
+ * the next request, with the cloud's copy. A store fault propagates as the
+ * infrastructure fault it is, never as a revocation.
+ *
+ * Composed between `apikey` and `oidc`, only under an authentication
+ * posture (compose.ts): the OIDC verifier claims every JWT-shaped token and
+ * throws on one it cannot verify, so a platform token must be claimed
+ * before it gets there (stigmer#1137's lesson).
+ *
+ * The identity is the account the token was minted for: `sub` IS the
+ * account id (the mint signs it), so no account read is needed; class
+ * `user`, issuer "stigmer", the token carried (the memory-capture gate and
+ * the origin guard read its `platform_client_id`), and the email and name
+ * the platform asserted, for display only.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { PLATFORM_TOKEN_ISSUER, platformTokenRefusalError, stringClaim, verifyPlatformToken, } from "../../platformtoken/envelope.js";
+import { DELETED_CLIENT_MESSAGE, TOKEN_NAMES_NO_CLIENT_MESSAGE, USER_TOKEN_CLAIMS, } from "./constants.js";
+export function newPlatformClientTokenVerifier(deps) {
+    return {
+        name: "platform-client",
+        async verify(token) {
+            const result = verifyPlatformToken(deps.keys, token, deps.now?.());
+            switch (result.outcome) {
+                case "foreign":
+                    return null;
+                case "refused":
+                    throw platformTokenRefusalError(result.refusal);
+                case "verified":
+                    break;
+                default: {
+                    const exhaustive = result;
+                    throw new Error(`unknown verification ${JSON.stringify(exhaustive)}`);
+                }
+            }
+            const verified = result.token;
+            if (verified.tokenType !== undefined) {
+                return null;
+            }
+            const platformClientId = stringClaim(verified.payload, USER_TOKEN_CLAIMS.platformClientId);
+            if (platformClientId === undefined) {
+                throw new ConnectError(TOKEN_NAMES_NO_CLIENT_MESSAGE, Code.Unauthenticated);
+            }
+            if ((await deps.clients.findById(platformClientId)) === undefined) {
+                throw new ConnectError(DELETED_CLIENT_MESSAGE, Code.Unauthenticated);
+            }
+            const email = stringClaim(verified.payload, USER_TOKEN_CLAIMS.email);
+            const displayName = stringClaim(verified.payload, USER_TOKEN_CLAIMS.name);
+            return {
+                identityId: verified.subject,
+                callerClass: "user",
+                issuer: PLATFORM_TOKEN_ISSUER,
+                rawToken: token,
+                ...(email !== undefined ? { email } : {}),
+                ...(displayName !== undefined ? { displayName } : {}),
+            };
+        },
+    };
+}
+//# sourceMappingURL=verifier.js.map

package/dist/domain/platformclient/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../src/domain/platformclient/verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAMzD,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,WAAW,EACX,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AASxB,MAAM,UAAU,8BAA8B,CAC5C,IAAqC;IAErC,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACnE,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;gBACvB,KAAK,SAAS;oBACZ,OAAO,IAAI,CAAC;gBACd,KAAK,SAAS;oBACZ,MAAM,yBAAyB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClD,KAAK,UAAU;oBACb,MAAM;gBACR,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,UAAU,GAAU,MAAM,CAAC;oBACjC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;gBACxE,CAAC;YACH,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC;YAC9B,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,gBAAgB,GAAG,WAAW,CAClC,QAAQ,CAAC,OAAO,EAChB,iBAAiB,CAAC,gBAAgB,CACnC,CAAC;YACF,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBAClE,MAAM,IAAI,YAAY,CAAC,sBAAsB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACrE,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC1E,OAAO;gBACL,UAAU,EAAE,QAAQ,CAAC,OAAO;gBAC5B,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,qBAAqB;gBAC7B,QAAQ,EAAE,KAAK;gBACf,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/session/list-index.d.ts

@@ -0,0 +1,4 @@
+/** The label the channel lanes stamp on every session they open. */
+export declare const SESSION_CHANNEL_ID_LABEL = "stigmer.ai/channel-id";
+export declare const sessionListIndex: import("../../store/list-index.js").ListIndexDeclaration<"agent_instance" | "channel">;
+//# sourceMappingURL=list-index.d.ts.map

package/dist/domain/session/list-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-index.d.ts","sourceRoot":"","sources":["../../../src/domain/session/list-index.ts"],"names":[],"mappings":"AAgBA,oEAAoE;AACpE,eAAO,MAAM,wBAAwB,0BAA0B,CAAC;AAEhE,eAAO,MAAM,gBAAgB,wFAQ3B,CAAC"}

package/dist/domain/session/list-index.js

@@ -0,0 +1,26 @@
+/**
+ * The session list index (store/list-index.ts): `agent_instance` is the
+ * key `listByAgentInstance` reads, `channel` the one `listByChannel` reads
+ * (the channel's id is stamped as a label by the channel lanes, not held
+ * in the spec). A session belongs to one organization, which is every
+ * declaration's first fact, so `session.list` narrows by it when the
+ * request names one.
+ *
+ * A change to `keys` bumps `revision` (boot/__tests__/list-indexes.test.ts
+ * pins the pair).
+ */
+import { SessionSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { declareListIndex, field, label } from "../../store/list-index.js";
+/** The label the channel lanes stamp on every session they open. */
+export const SESSION_CHANNEL_ID_LABEL = "stigmer.ai/channel-id";
+export const sessionListIndex = declareListIndex({
+    kind: ApiResourceKind.session,
+    schema: SessionSchema,
+    revision: 1,
+    keys: {
+        agent_instance: field("spec.agent_instance_id"),
+        channel: label(SESSION_CHANNEL_ID_LABEL),
+    },
+});
+//# sourceMappingURL=list-index.js.map

package/dist/domain/session/list-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-index.js","sourceRoot":"","sources":["../../../src/domain/session/list-index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,sDAAsD,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAC;AAE3E,oEAAoE;AACpE,MAAM,CAAC,MAAM,wBAAwB,GAAG,uBAAuB,CAAC;AAEhE,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;IAC/C,IAAI,EAAE,eAAe,CAAC,OAAO;IAC7B,MAAM,EAAE,aAAa;IACrB,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE;QACJ,cAAc,EAAE,KAAK,CAAC,wBAAwB,CAAC;QAC/C,OAAO,EAAE,KAAK,CAAC,wBAAwB,CAAC;KACzC;CACF,CAAC,CAAC"}

package/dist/domain/session/steps.d.ts

@@ -31,14 +31,13 @@ export declare function newRejectDeleteWithActiveExecutionsStep<Desc extends Des
  */
 export declare function newCascadeDeleteAgentExecutionsStep<Desc extends DescMessage>(store: Store, logger: Logger): PipelineStep<Desc>;
 /**
- * ListAllSessions — all sessions, newest first by spec-audit created_at
- * (seconds then nanos; timestamped entries before untimestamped ones).
- * Malformed rows warn and are skipped.
+ * ListAllSessions — one page of sessions, the request's organization when
+ * it names one, newest first. Malformed rows warn and are skipped.
  */
 export declare function newListAllSessionsStep(store: Store, logger: Logger, listReadScope: ListReadScope | undefined): PipelineStep<typeof SessionQueryController.method.list.input>;
 /**
- * FilterByAgentInstance — steps/filter_by_agent_instance.go: sessions
- * whose spec.agent_instance_id matches. No sorting (Go doesn't sort here).
+ * FilterByAgentInstance — steps/filter_by_agent_instance.go: one page of
+ * the sessions whose spec.agent_instance_id matches, newest first.
  */
 export declare function newFilterByAgentInstanceStep(store: Store, logger: Logger, listReadScope: ListReadScope | undefined): PipelineStep<typeof SessionQueryController.method.listByAgentInstance.input>;
 /**
@@ -54,9 +53,9 @@ export declare function newFilterByAgentInstanceStep(store: Store, logger: Logge
  */
 export declare function newAuthorizeChannelAccessStep(authorizer: Authorizer): PipelineStep<typeof SessionQueryController.method.listByChannel.input>;
 /**
- * FilterByChannel — steps/filter_by_channel.go: sessions whose
- * metadata.labels carry the channel's stigmer.ai/channel-id stamp. No
- * sorting. Channel sessions are created by the cloud channel runtime
+ * FilterByChannel — steps/filter_by_channel.go: one page of the sessions
+ * whose metadata.labels carry the channel's stigmer.ai/channel-id stamp,
+ * newest first. Channel sessions are created by the cloud channel runtime
  * (Slack/WhatsApp inbound turns), which stamps the label at create time;
  * the OSS runtime has no channel broker, so this filter typically matches
  * nothing — the RPC exists for contract parity with Stigmer Cloud (which

package/dist/domain/session/steps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/domain/session/steps.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAKtD,OAAO,EAAE,aAAa,EAAE,MAAM,sDAAsD,CAAC;AAOrF,OAAO,EAAE,sBAAsB,EAAE,MAAM,wDAAwD,CAAC;AAIhG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAMzF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAOzE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,KAAK,WAAW,GAAG,OAAO,aAAa,CAAC;AAExC,0DAA0D;AAC1D,eAAO,MAAM,eAAe,eAAe,CAAC;AAoB5C,wBAAgB,kCAAkC,IAAI,YAAY,CAAC,WAAW,CAAC,CAyC9E;AAkCD,wBAAgB,0CAA0C,CACxD,cAAc,EAAE,4BAA4B,GAC3C,YAAY,CAAC,WAAW,CAAC,CAqC3B;AAuBD,wBAAgB,gCAAgC,IAAI,YAAY,CAAC,WAAW,CAAC,CA+B5E;AAiED;;;;;;;GAOG;AACH,wBAAgB,uCAAuC,CACrD,IAAI,SAAS,WAAW,EACxB,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CA8BlD;AAED;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CAAC,IAAI,SAAS,WAAW,EAC1E,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CAiDpB;AA4BD;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,GAAG,SAAS,GACvC,YAAY,CAAC,OAAO,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CA6B/D;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,GAAG,SAAS,GACvC,YAAY,CACb,OAAO,sBAAsB,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAC/D,CA2CA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,UAAU,GACrB,YAAY,CAAC,OAAO,sBAAsB,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAgBxE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,GAAG,SAAS,GACvC,YAAY,CAAC,OAAO,sBAAsB,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CA2CxE"}
+{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/domain/session/steps.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAKtD,OAAO,EAAE,aAAa,EAAE,MAAM,sDAAsD,CAAC;AAQrF,OAAO,EAAE,sBAAsB,EAAE,MAAM,wDAAwD,CAAC;AAIhG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAMzF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAWzE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAKtD,KAAK,WAAW,GAAG,OAAO,aAAa,CAAC;AAExC,0DAA0D;AAC1D,eAAO,MAAM,eAAe,eAAe,CAAC;AAa5C,wBAAgB,kCAAkC,IAAI,YAAY,CAAC,WAAW,CAAC,CAyC9E;AAkCD,wBAAgB,0CAA0C,CACxD,cAAc,EAAE,4BAA4B,GAC3C,YAAY,CAAC,WAAW,CAAC,CAqC3B;AAuBD,wBAAgB,gCAAgC,IAAI,YAAY,CAAC,WAAW,CAAC,CA+B5E;AA+DD;;;;;;;GAOG;AACH,wBAAgB,uCAAuC,CACrD,IAAI,SAAS,WAAW,EACxB,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CA8BlD;AAED;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CAAC,IAAI,SAAS,WAAW,EAC1E,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CAiDpB;AA6BD;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,GAAG,SAAS,GACvC,YAAY,CAAC,OAAO,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAyB/D;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,GAAG,SAAS,GACvC,YAAY,CACb,OAAO,sBAAsB,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAC/D,CA+BA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,UAAU,GACrB,YAAY,CAAC,OAAO,sBAAsB,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAgBxE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,GAAG,SAAS,GACvC,YAAY,CAAC,OAAO,sBAAsB,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CA4BxE"}

package/dist/domain/session/steps.js

@@ -28,16 +28,12 @@ import { failedPreconditionError, internalError, invalidArgumentError, } from ".
 import { restrictListByReadScope } from "../../extensions/list-read-scope.js";
 import { newAuthorizeResolvedTargetStep } from "../../pipeline/steps/authorize-resolved-target.js";
 import { RESOURCE_ID_KEY } from "../../pipeline/steps/delete.js";
-import { compareCreatedAtDesc } from "../../pipeline/steps/helpers.js";
+import { listPageFingerprint, readListPage, } from "../../pipeline/steps/list-page.js";
 import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
+import { agentExecutionListIndex } from "../agentexecution/list-index.js";
+import { sessionListIndex } from "./list-index.js";
 /** Context key for the list result (Go listResultKey). */
 export const LIST_RESULT_KEY = "listResult";
-/**
- * The session label the channel runtime stamps at create time to record
- * which agent channel originated the conversation. Mirrors
- * ChannelRuntimeConstants.CHANNEL_ID_METADATA_KEY in Stigmer Cloud.
- */
-const CHANNEL_ID_LABEL_KEY = "stigmer.ai/channel-id";
 // ---------------------------------------------------------------------------
 // ValidateHarnessImmutability — validate_harness_immutability.go: rejects
 // session updates that attempt to change the harness after the session has
@@ -213,32 +209,30 @@ function isActiveExecutionPhase(phase) {
     }
 }
 /**
- * Loads every agent execution whose spec.session_id matches the given
- * session; malformed rows warn and are skipped. Shared by the guard and
- * cascade steps (Go listExecutionsBySession).
+ * Every agent execution of the given session, through the list index's
+ * session key (exact whoever wrote the rows, store/interface.ts); malformed
+ * rows warn and are skipped. Shared by the guard and cascade steps (Go
+ * listExecutionsBySession).
  */
 async function listExecutionsBySession(store, logger, sessionId) {
     let rows;
     try {
-        rows = await store.listResources(ApiResourceKind.agent_execution);
+        rows = await store.queryResources(agentExecutionListIndex, {
+            anyKey: [{ name: "session", value: sessionId }],
+        });
     }
     catch (error) {
         throw internalError(error, "failed to list agent executions");
     }
     const executions = [];
-    for (const data of rows) {
-        let execution;
+    for (const row of rows) {
         try {
-            execution = fromBinary(AgentExecutionSchema, data);
+            executions.push(fromBinary(AgentExecutionSchema, row.data));
         }
         catch (error) {
             logger.warn("Failed to unmarshal execution, skipping", {
                 error: error instanceof Error ? error.message : String(error),
             });
-            continue;
-        }
-        if ((execution.spec?.sessionId ?? "") === sessionId) {
-            executions.push(execution);
         }
     }
     return executions;
@@ -320,33 +314,39 @@ function requireSessionId(ctx) {
     return sessionId;
 }
 // ---------------------------------------------------------------------------
-// List steps — list.go and the steps/ package. Full scans with client-side
-// filtering, exactly Go (no pagination; no scope composed = no authorization
-// filtering, the OSS single-user posture). With a composed ListReadScope
-// (20260830.01) each lane narrows to the caller's authorized sessions —
+// List steps — list.go and the steps/ package. Each lane reads its page
+// through the list index (pipeline/steps/list-page.ts): the store narrows
+// by the request's organization or parent key and orders newest first
+// (spec-audit created_at, unstamped last, ties by id); the read scope, when
+// composed, narrows each batch to the caller's authorized sessions last —
 // the Java list handlers' FGA-ids pattern, guest cookie rule included
-// driver-side; the request org is deliberately NOT intersected (the Java
-// session lanes never consult it — census lanes 1–3).
+// driver-side. No scope composed = the OSS single-user posture, every
+// matching session.
 // ---------------------------------------------------------------------------
 /**
- * ListAllSessions — all sessions, newest first by spec-audit created_at
- * (seconds then nanos; timestamped entries before untimestamped ones).
- * Malformed rows warn and are skipped.
+ * ListAllSessions — one page of sessions, the request's organization when
+ * it names one, newest first. Malformed rows warn and are skipped.
  */
 export function newListAllSessionsStep(store, logger, listReadScope) {
     return {
         name: "ListAllSessions",
         async execute(ctx) {
-            const sessions = await restrictListByReadScope(listReadScope, ctx.callerIdentity, ApiResourceKind.session, await loadAllSessions(store, logger, ctx.apiResourceKind), "");
-            sessions.sort((a, b) => compareCreatedAtDesc(a.status?.audit?.specAudit?.createdAt, b.status?.audit?.specAudit?.createdAt));
-            logger.info("Loaded sessions from database", { count: sessions.length });
-            ctx.set(LIST_RESULT_KEY, create(SessionListSchema, { entries: sessions }));
+            const input = ctx.input;
+            const page = await readSessionPage(store, logger, listReadScope, ctx.callerIdentity, ctx.input, {
+                query: { org: input.org },
+                fingerprint: {
+                    lane: "session.list",
+                    org: input.org,
+                    tags: input.tags,
+                },
+            });
+            ctx.set(LIST_RESULT_KEY, page);
         },
     };
 }
 /**
- * FilterByAgentInstance — steps/filter_by_agent_instance.go: sessions
- * whose spec.agent_instance_id matches. No sorting (Go doesn't sort here).
+ * FilterByAgentInstance — steps/filter_by_agent_instance.go: one page of
+ * the sessions whose spec.agent_instance_id matches, newest first.
  */
 export function newFilterByAgentInstanceStep(store, logger, listReadScope) {
     return {
@@ -356,16 +356,15 @@ export function newFilterByAgentInstanceStep(store, logger, listReadScope) {
             if (agentInstanceId === "") {
                 throw invalidArgumentError("agent_instance_id is required");
             }
-            // The instance's sessions first, the scope last (census lane 2): a
-            // composed driver is asked about one instance's rows, not the kind.
-            const sessions = await loadAllSessions(store, logger, ctx.apiResourceKind);
-            const filtered = await restrictListByReadScope(listReadScope, ctx.callerIdentity, ApiResourceKind.session, sessions.filter((session) => (session.spec?.agentInstanceId ?? "") === agentInstanceId), "");
-            logger.info("Filtered sessions by agent instance", {
-                agentInstanceId,
-                totalSessions: sessions.length,
-                filteredSessions: filtered.length,
+            // The instance's sessions through its key, the scope last (census
+            // lane 2): a composed driver is asked about one instance's rows.
+            const page = await readSessionPage(store, logger, listReadScope, ctx.callerIdentity, ctx.input, {
+                query: {
+                    anyKey: [{ name: "agent_instance", value: agentInstanceId }],
+                },
+                fingerprint: { lane: "session.listByAgentInstance", agentInstanceId },
             });
-            ctx.set(LIST_RESULT_KEY, create(SessionListSchema, { entries: filtered }));
+            ctx.set(LIST_RESULT_KEY, page);
         },
     };
 }
@@ -393,9 +392,9 @@ export function newAuthorizeChannelAccessStep(authorizer) {
         ], "AuthorizeChannelAccess");
 }
 /**
- * FilterByChannel — steps/filter_by_channel.go: sessions whose
- * metadata.labels carry the channel's stigmer.ai/channel-id stamp. No
- * sorting. Channel sessions are created by the cloud channel runtime
+ * FilterByChannel — steps/filter_by_channel.go: one page of the sessions
+ * whose metadata.labels carry the channel's stigmer.ai/channel-id stamp,
+ * newest first. Channel sessions are created by the cloud channel runtime
  * (Slack/WhatsApp inbound turns), which stamps the label at create time;
  * the OSS runtime has no channel broker, so this filter typically matches
  * nothing — the RPC exists for contract parity with Stigmer Cloud (which
@@ -410,42 +409,41 @@ export function newFilterByChannelStep(store, logger, listReadScope) {
             if (channelId === "") {
                 throw invalidArgumentError("channel_id is required");
             }
-            // The channel's sessions first, the scope last (census lane 3).
-            const sessions = await loadAllSessions(store, logger, ctx.apiResourceKind);
-            const filtered = await restrictListByReadScope(listReadScope, ctx.callerIdentity, ApiResourceKind.session, sessions.filter((session) => (session.metadata?.labels ?? {})[CHANNEL_ID_LABEL_KEY] ===
-                channelId), "");
-            logger.info("Filtered sessions by channel", {
-                channelId,
-                totalSessions: sessions.length,
-                filteredSessions: filtered.length,
+            // The channel's sessions through its key, the scope last (census lane 3).
+            const page = await readSessionPage(store, logger, listReadScope, ctx.callerIdentity, ctx.input, {
+                query: { anyKey: [{ name: "channel", value: channelId }] },
+                fingerprint: { lane: "session.listByChannel", channelId },
             });
-            ctx.set(LIST_RESULT_KEY, create(SessionListSchema, { entries: filtered }));
+            ctx.set(LIST_RESULT_KEY, page);
         },
     };
 }
-/** Full-scan session load shared by the list steps; malformed rows warn + skip. */
-async function loadAllSessions(store, logger, kind) {
-    let rows;
-    try {
-        rows = await store.listResources(kind);
-    }
-    catch (error) {
-        throw internalError(error, "failed to list sessions");
-    }
-    const sessions = [];
-    for (const data of rows) {
-        let session;
-        try {
-            session = fromBinary(SessionSchema, data);
-        }
-        catch (error) {
-            logger.warn("Failed to unmarshal session, skipping", {
-                error: error instanceof Error ? error.message : String(error),
-            });
-            continue;
-        }
-        sessions.push(session);
-    }
-    return sessions;
+/** The three session lanes' shared read: one page, the scope last, as a SessionList. */
+async function readSessionPage(store, logger, listReadScope, caller, request, lane) {
+    const page = await readListPage({
+        store,
+        declaration: sessionListIndex,
+        query: lane.query,
+        request,
+        fingerprint: listPageFingerprint(lane.fingerprint),
+        decode: (data) => {
+            try {
+                return fromBinary(SessionSchema, data);
+            }
+            catch (error) {
+                logger.warn("Failed to unmarshal session, skipping", {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                return undefined;
+            }
+        },
+        scope: (sessions) => restrictListByReadScope(listReadScope, caller, ApiResourceKind.session, sessions, ""),
+        failure: "failed to list sessions",
+    });
+    return create(SessionListSchema, {
+        entries: page.entries,
+        nextPageToken: page.nextPageToken,
+        totalPages: page.nextPageToken === "" ? 1 : 0,
+    });
 }
 //# sourceMappingURL=steps.js.map