@stigmer/server 3.32.0 → 3.33.0

package/src/domain/platformclient/mint.ts

@@ -44,6 +44,14 @@
  *
  * The email and name in the token and on the account are the platform's
  * assertion; nothing on the server derives authority from either.
+ *
+ * A signed token is a successful mint, so the client's use is then
+ * recorded on its status.last_used_at (identity/credential-use.ts): at most
+ * once a resolution, judged from the row authentication already read,
+ * written through the port's atomic `modifyById` — never the whole-row
+ * `update`, which could write back the secret hash a concurrent rotation
+ * just replaced — and best-effort: a failed stamp is logged and the token
+ * is still answered. A refused mint records nothing (stigmer/stigmer#1255).
  */
 import { Code, ConnectError } from "@connectrpc/connect";
 import { create } from "@bufbuild/protobuf";
@@ -54,6 +62,7 @@ import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityacc
 import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
 import { IdentityAccountSpecSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/spec_pb";
 import type { PlatformClient } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+import { PlatformClientStatusSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
 import type {
   MintUserTokenRequest,
   MintUserTokenResponse,
@@ -63,6 +72,7 @@ import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
 import type { Logger } from "../../boot/logger.js";
 import type { CallerIdentity } from "../../extensions/identity.js";
+import { recordCredentialUse } from "../../identity/credential-use.js";
 import { internalError } from "../../pipeline/errors.js";
 import { serverActingFor } from "../../pipeline/interceptors/auth.js";
 import { validator } from "../../pipeline/steps/validation.js";
@@ -164,6 +174,7 @@ export async function mintUserToken(
     user,
   );
 
+  const now = deps.now();
   const signed = signPlatformToken(
     keys,
     {
@@ -174,8 +185,9 @@ export async function mintUserToken(
       [USER_TOKEN_CLAIMS.org]: owningOrg,
       [USER_TOKEN_CLAIMS.platformClientId]: client.metadata?.id ?? "",
     },
-    { now: deps.now() },
+    { now },
   );
+  await recordClientUse(deps, client, now);
   return create(MintUserTokenResponseSchema, {
     accessToken: signed.token,
     tokenType: BEARER_TOKEN_TYPE,
@@ -223,6 +235,27 @@ async function authenticateClient(
   return client;
 }
 
+/** Stamps the minting client's last use on its own row, through the port's atomic write. */
+function recordClientUse(
+  deps: PlatformClientMintDeps,
+  client: PlatformClient,
+  now: Date,
+): Promise<void> {
+  const id = client.metadata?.id ?? "";
+  return recordCredentialUse({
+    credential: "platform client",
+    id,
+    lastUsedAt: client.status?.lastUsedAt,
+    now,
+    logger: deps.logger,
+    write: (stamp) =>
+      deps.clients.modifyById(id, (live) => {
+        live.status ??= create(PlatformClientStatusSchema);
+        stamp(live.status);
+      }),
+  });
+}
+
 /** The account id for the user: the existing platform-client account, or one provisioned now. */
 async function resolveOrProvisionAccount(
   deps: PlatformClientMintDeps,

package/src/domain/platformclient/resource-store.ts

@@ -20,6 +20,8 @@
  * (org, slug) or client_id; `update` writes nothing for an unknown id; the
  * residual window between the read and the write is the platform-wide
  * CheckDuplicate-then-upsert window, not this adapter's to close.
+ * `modifyById` has no such window: it IS Store.updateResource, the generic
+ * store's own atomic read-modify-write, its not-found read as `undefined`.
  *
  * Store faults follow the ratified mapping: a typed ResourceNotFoundError
  * reads as `undefined`; anything else propagates — an outage must never
@@ -135,6 +137,22 @@ export function newResourcePlatformClientStore(
       await store.saveResource(KIND, id, PlatformClientSchema, client);
     },
 
+    async modifyById(id, modify): Promise<PlatformClient | undefined> {
+      try {
+        return await store.updateResource(
+          KIND,
+          id,
+          PlatformClientSchema,
+          modify,
+        );
+      } catch (error) {
+        if (error instanceof ResourceNotFoundError) {
+          return undefined;
+        }
+        throw error;
+      }
+    },
+
     async deleteById(id): Promise<void> {
       await store.deleteResource(KIND, id);
     },

package/src/domain/platformclient/store-contract.ts

@@ -242,6 +242,106 @@ const CASES: ReadonlyArray<PortContractDeclaration<PlatformClientStore>> = [
       );
     },
   ],
+  [
+    "modifyById persists what modify did, answers the persisted row, and the lookups follow it",
+    async ({ store }) => {
+      await store.save(ACME_DASHBOARD);
+      const answered = await store.modifyById(
+        "pcl_contract_acme_dashboard",
+        (client) => {
+          assert.ok(client.spec, "the saved client carries a spec");
+          client.spec.allowedOrigins = ["https://app.acme.example"];
+        },
+      );
+      const expected = platformClient({
+        id: "pcl_contract_acme_dashboard",
+        org: "acme",
+        slug: "dashboard",
+        clientId: "stgm_cid_contract_acme_dashboard",
+        allowedOrigins: ["https://app.acme.example"],
+      });
+      assertSameClient(answered, expected, "modifyById must answer the persisted row");
+      assertSameClient(
+        await store.findById("pcl_contract_acme_dashboard"),
+        expected,
+        "findById must answer the modified row",
+      );
+      assertSameClient(
+        await store.findByClientId("stgm_cid_contract_acme_dashboard"),
+        expected,
+        "findByClientId must answer the modified row",
+      );
+      assertSameClient(
+        await store.findByOrgAndSlug("acme", "dashboard"),
+        expected,
+        "findByOrgAndSlug must answer the modified row",
+      );
+    },
+  ],
+  [
+    "modifyById of an unknown id answers undefined and writes nothing",
+    async ({ store }) => {
+      let called = false;
+      const answered = await store.modifyById(
+        "pcl_contract_acme_dashboard",
+        () => {
+          called = true;
+        },
+      );
+      assert.equal(answered, undefined);
+      assert.equal(called, false, "modify must not run for a row that is not held");
+      assert.equal(
+        await store.findById("pcl_contract_acme_dashboard"),
+        undefined,
+        "modifyById must modify, never create",
+      );
+    },
+  ],
+  [
+    "a modify that throws writes nothing and rejects with its error",
+    async ({ store }) => {
+      await store.save(ACME_DASHBOARD);
+      const refusal = new Error("modify refused");
+      await assert.rejects(
+        store.modifyById("pcl_contract_acme_dashboard", (client) => {
+          assert.ok(client.spec, "the saved client carries a spec");
+          client.spec.allowedOrigins = ["https://half.written.example"];
+          throw refusal;
+        }),
+        (error: unknown) => error === refusal,
+        "the modify's own error must propagate",
+      );
+      assertSameClient(
+        await store.findById("pcl_contract_acme_dashboard"),
+        ACME_DASHBOARD,
+        "nothing a throwing modify did may persist",
+      );
+    },
+  ],
+  [
+    "concurrent modifyById calls on one row lose no write",
+    async ({ store }) => {
+      await store.save(ACME_DASHBOARD);
+      const origins = Array.from(
+        { length: 8 },
+        (_, i) => `https://writer-${i}.acme.example`,
+      );
+      await Promise.all(
+        origins.map((origin) =>
+          store.modifyById("pcl_contract_acme_dashboard", (client) => {
+            assert.ok(client.spec, "the saved client carries a spec");
+            client.spec.allowedOrigins.push(origin);
+          }),
+        ),
+      );
+      const stored = await store.findById("pcl_contract_acme_dashboard");
+      assert.deepEqual(
+        [...(stored?.spec?.allowedOrigins ?? [])].sort(),
+        [...origins].sort(),
+        "every concurrent modify must see the one before it: a read-then-write driver loses edits here",
+      );
+    },
+  ],
   [
     "deleteById frees the id, the client_id and the slug; deleting an unknown id resolves",
     async ({ store }) => {

package/src/domain/platformclient/store.ts

@@ -13,6 +13,14 @@
  * duplicate check), by organization (listByOrg). A port carries nothing
  * only one edition calls.
  *
+ * One write is atomic: `modifyById`, the port's rendering of
+ * `Store.updateResource`, for the status the platform writes on its own
+ * (the mint's last-use stamp, identity/credential-use.ts). `update` stays
+ * a whole-row replace for the chains that load, edit and persist; a stamp
+ * written that way would race them and could restore a rotated secret. The
+ * driver supplies only the atomicity; what `modify` does stays the
+ * domain's, written once for every edition.
+ *
  * Contract every implementation must satisfy — proven by the port-contract
  * kit (store-contract.ts, exported), which the OSS adapter's test iterates
  * on both drivers and a composition's driver test iterates too:
@@ -21,6 +29,10 @@
  *     overwrite;
  *   - `update` replaces by id and never creates: an unknown id writes
  *     nothing;
+ *   - `modifyById` reads the row, applies `modify` and persists the result
+ *     in one atomic step, so no concurrent write is lost; it answers the
+ *     persisted row, an unknown id answers `undefined` and writes nothing,
+ *     and a `modify` that throws writes nothing and rejects with its error;
  *   - `deleteById` of an unknown id resolves;
  *   - `findByOrg` answers every client of the organization and no other,
  *     in no promised order (the chain sorts);
@@ -49,6 +61,17 @@ export interface PlatformClientStore {
   save(client: PlatformClient): Promise<void>;
   /** Full-row replace by id; an unknown id writes nothing. */
   update(client: PlatformClient): Promise<void>;
+  /**
+   * Atomic read-modify-write by id: `modify` mutates the stored client in
+   * place and the result is persisted, or nothing is. `modify` MUST be
+   * synchronous (Store.updateResource's rule: a driver may hold a write
+   * transaction or a row lock while it runs). Answers the persisted client;
+   * an unknown id answers `undefined`.
+   */
+  modifyById(
+    id: string,
+    modify: (client: PlatformClient) => void,
+  ): Promise<PlatformClient | undefined>;
   /** Removes the row; no error when it does not exist. */
   deleteById(id: string): Promise<void>;
   findById(id: string): Promise<PlatformClient | undefined>;

package/src/identity/__tests__/credential-use.test.ts

@@ -0,0 +1,186 @@
+/**
+ * Pins the credential last-use rule (credential-use.ts):
+ *   - staleness is measured against the stored stamp, a never-used
+ *     credential is stale, and exactly one resolution is stale again;
+ *   - the stamp only moves forward, and a write bumps the status audit's
+ *     updated_at + event while keeping who created the slot;
+ *   - recordCredentialUse writes only when stale, treats a row deleted
+ *     meanwhile as nothing to record, and logs any other failure without
+ *     throwing.
+ */
+import { create } from "@bufbuild/protobuf";
+import { timestampDate, timestampFromDate } from "@bufbuild/protobuf/wkt";
+import { describe, expect, it } from "vitest";
+
+import {
+  ApiResourceAuditActorSchema,
+  ApiResourceAuditInfoSchema,
+  ApiResourceAuditSchema,
+} from "@stigmer/protos/ai/stigmer/commons/apiresource/status_pb";
+
+import { createLogger } from "../../boot/logger.js";
+import { ResourceNotFoundError } from "../../store/interface.js";
+import {
+  LAST_USED_RESOLUTION_MS,
+  lastUseIsStale,
+  recordCredentialUse,
+  stampLastUsed,
+  type CredentialUseStatus,
+} from "../credential-use.js";
+
+const NOW = new Date("2026-09-28T12:00:00Z");
+
+function ago(ms: number): Date {
+  return new Date(NOW.getTime() - ms);
+}
+
+function capturingLogger(): {
+  lines: string[];
+  logger: ReturnType<typeof createLogger>;
+} {
+  const lines: string[] = [];
+  return {
+    lines,
+    logger: createLogger({
+      level: "debug",
+      pretty: false,
+      write: (line) => lines.push(line),
+    }),
+  };
+}
+
+describe("lastUseIsStale", () => {
+  it("is stale for a credential never used", () => {
+    expect(lastUseIsStale(undefined, NOW)).toBe(true);
+  });
+
+  it("is fresh inside one resolution and stale from exactly one resolution on", () => {
+    const justInside = timestampFromDate(ago(LAST_USED_RESOLUTION_MS - 1));
+    const exactly = timestampFromDate(ago(LAST_USED_RESOLUTION_MS));
+    expect(lastUseIsStale(justInside, NOW)).toBe(false);
+    expect(lastUseIsStale(exactly, NOW)).toBe(true);
+  });
+
+  it("is fresh for a stamp ahead of this replica's clock", () => {
+    expect(lastUseIsStale(timestampFromDate(new Date(NOW.getTime() + 5_000)), NOW)).toBe(false);
+  });
+});
+
+describe("stampLastUsed", () => {
+  it("stamps a never-used status and bumps the status audit", () => {
+    const status: CredentialUseStatus = {};
+    expect(stampLastUsed(status, NOW)).toBe(true);
+    expect(timestampDate(status.lastUsedAt!)).toEqual(NOW);
+    expect(status.audit?.statusAudit?.event).toBe("updated");
+    expect(status.audit?.statusAudit?.updatedAt).toBeDefined();
+  });
+
+  it("keeps who created the status-audit slot and never touches the spec audit", () => {
+    const createdBy = create(ApiResourceAuditActorSchema, { id: "ida_creator" });
+    const createdAt = timestampFromDate(ago(86_400_000));
+    const specAudit = create(ApiResourceAuditInfoSchema, { createdBy, createdAt, event: "created" });
+    const priorSlot = create(ApiResourceAuditInfoSchema, { createdBy, createdAt, event: "created" });
+    const status: CredentialUseStatus = {
+      audit: create(ApiResourceAuditSchema, { specAudit, statusAudit: priorSlot }),
+    };
+
+    stampLastUsed(status, NOW);
+
+    expect(status.audit?.statusAudit?.createdBy?.id).toBe("ida_creator");
+    expect(status.audit?.statusAudit?.createdAt).toEqual(createdAt);
+    expect(status.audit?.statusAudit?.event).toBe("updated");
+    expect(status.audit?.specAudit).toBe(specAudit);
+    expect(priorSlot.event, "a new slot is set, the old one is not mutated").toBe("created");
+  });
+
+  it("only moves forward: a stamp at or after the use is kept, audit untouched", () => {
+    const later = timestampFromDate(new Date(NOW.getTime() + 1_000));
+    const status: CredentialUseStatus = { lastUsedAt: later };
+    expect(stampLastUsed(status, NOW)).toBe(false);
+    expect(status.lastUsedAt).toBe(later);
+    expect(status.audit).toBeUndefined();
+
+    const same = timestampFromDate(NOW);
+    const atSameInstant: CredentialUseStatus = { lastUsedAt: same };
+    expect(stampLastUsed(atSameInstant, NOW)).toBe(false);
+  });
+});
+
+describe("recordCredentialUse", () => {
+  function use(overrides: {
+    lastUsedAt?: Date;
+    write: (stamp: (status: CredentialUseStatus) => void) => Promise<unknown>;
+    logger?: ReturnType<typeof createLogger>;
+  }) {
+    return {
+      credential: "api key",
+      id: "key_1",
+      lastUsedAt:
+        overrides.lastUsedAt === undefined ? undefined : timestampFromDate(overrides.lastUsedAt),
+      now: NOW,
+      logger: overrides.logger ?? capturingLogger().logger,
+      write: overrides.write,
+    };
+  }
+
+  it("writes the stamp through the kind's atomic write when stale", async () => {
+    const row: CredentialUseStatus = {};
+    let writes = 0;
+    await recordCredentialUse(
+      use({
+        write: async (stamp) => {
+          writes += 1;
+          stamp(row);
+        },
+      }),
+    );
+    expect(writes).toBe(1);
+    expect(timestampDate(row.lastUsedAt!)).toEqual(NOW);
+  });
+
+  it("does not write inside the resolution", async () => {
+    let writes = 0;
+    await recordCredentialUse(
+      use({
+        lastUsedAt: ago(LAST_USED_RESOLUTION_MS / 2),
+        write: async () => {
+          writes += 1;
+        },
+      }),
+    );
+    expect(writes).toBe(0);
+  });
+
+  it("treats a row deleted meanwhile as nothing to record, silently", async () => {
+    const { lines, logger } = capturingLogger();
+    await recordCredentialUse(
+      use({
+        logger,
+        write: async () => {
+          throw new ResourceNotFoundError("api_key/key_1");
+        },
+      }),
+    );
+    expect(lines).toEqual([]);
+  });
+
+  it("logs any other failure with the credential id and never throws", async () => {
+    const { lines, logger } = capturingLogger();
+    await expect(
+      recordCredentialUse(
+        use({
+          logger,
+          write: async () => {
+            throw new Error("database unavailable");
+          },
+        }),
+      ),
+    ).resolves.toBeUndefined();
+    expect(lines).toHaveLength(1);
+    const entry = JSON.parse(lines[0]!) as Record<string, unknown>;
+    expect(entry.level).toBe("warn");
+    expect(entry.credential).toBe("api key");
+    expect(entry.id).toBe("key_1");
+    expect(entry.error).toBe("database unavailable");
+  });
+});

package/src/identity/credential-use.ts

@@ -0,0 +1,130 @@
+/**
+ * When a credential was last used: the one rule the two credential kinds
+ * that carry `status.last_used_at` share. An API key is stamped by the
+ * identity verifier that accepts it (domain/apikey/verifier.ts), a
+ * PlatformClient by a successful mint (domain/platformclient/mint.ts). It
+ * lives here, beside the other infrastructure the credential lanes share,
+ * because neither domain owns the other (stigmer/stigmer#1255).
+ *
+ * The stamp is status the platform writes on its own, so it follows the
+ * house rule for such writes: an atomic read-modify-write on the row
+ * (`Store.updateResource`; the PlatformClient port's `modifyById`), the
+ * narrow status-audit bump (pipeline/steps/defaults.ts), and best-effort
+ * with a loud log, as `stampLastFireAt` records a schedule's manual fire
+ * (domain/schedule/trigger.ts). Never a load-then-save of the whole row:
+ * the credential's own update chains replace the row whole, and a stale
+ * copy written back by a stamp would undo them (a rotated PlatformClient
+ * secret would work again).
+ *
+ * The resolution keeps a credential that rides every request from costing
+ * a write per request, and it needs no state: the caller already holds the
+ * row it just verified, so "stamped less than a resolution ago" is one
+ * comparison with the stored value, the same answer on every replica and
+ * after every restart. Callers that pass the check at the same instant
+ * each write once; every write only moves the stamp forward, so the extra
+ * writes change nothing.
+ */
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import { timestampDate, timestampFromDate } from "@bufbuild/protobuf/wkt";
+
+import type { ApiResourceAudit } from "@stigmer/protos/ai/stigmer/commons/apiresource/status_pb";
+
+import type { Logger } from "../boot/logger.js";
+import { bumpStatusAudit } from "../pipeline/steps/defaults.js";
+import { ResourceNotFoundError } from "../store/interface.js";
+
+/**
+ * How stale a stored last use may be before a new use records again: one
+ * minute. Fresh enough that the console's "Used 3m" is true to the minute;
+ * coarse enough that a key behind every request costs at most one write a
+ * minute per replica. Both fields' proto comments state it.
+ */
+export const LAST_USED_RESOLUTION_MS = 60_000;
+
+/** The status shape both credential kinds share. */
+export interface CredentialUseStatus {
+  lastUsedAt?: Timestamp;
+  audit?: ApiResourceAudit;
+}
+
+/** True when a use at `now` should be recorded over the stored `lastUsedAt`. */
+export function lastUseIsStale(
+  lastUsedAt: Timestamp | undefined,
+  now: Date,
+): boolean {
+  return (
+    lastUsedAt === undefined ||
+    now.getTime() - timestampDate(lastUsedAt).getTime() >=
+      LAST_USED_RESOLUTION_MS
+  );
+}
+
+/**
+ * Records a use at `usedAt`, forward only: a stored stamp at or after it (a
+ * replica whose clock runs ahead, a racing caller that wrote first) is
+ * kept, and the audit is left alone. Returns whether it wrote. Synchronous,
+ * because it runs inside an atomic write's `modify`.
+ */
+export function stampLastUsed(
+  status: CredentialUseStatus,
+  usedAt: Date,
+): boolean {
+  const stored = status.lastUsedAt;
+  if (
+    stored !== undefined &&
+    timestampDate(stored).getTime() >= usedAt.getTime()
+  ) {
+    return false;
+  }
+  status.lastUsedAt = timestampFromDate(usedAt);
+  bumpStatusAudit(status);
+  return true;
+}
+
+export interface CredentialUse {
+  /** What the log calls the credential ("api key", "platform client"). */
+  readonly credential: string;
+  /** The credential's resource id: logged, never the secret. */
+  readonly id: string;
+  /** The stored stamp, as the caller read the row it just verified. */
+  readonly lastUsedAt: Timestamp | undefined;
+  readonly now: Date;
+  readonly logger: Logger;
+  /**
+   * The kind's atomic write: applies `stamp` to the row's status (created
+   * when absent) inside one read-modify-write. A row deleted since the
+   * caller read it is a typed not-found or a write that finds nothing.
+   */
+  readonly write: (
+    stamp: (status: CredentialUseStatus) => void,
+  ) => Promise<unknown>;
+}
+
+/**
+ * Records the use when the stored stamp is stale. Never throws: the
+ * credential already did its job, and a bookkeeping failure must not turn
+ * an accepted request or a minted token into an error. A row deleted
+ * meanwhile has nothing to record; any other failure is logged.
+ */
+export async function recordCredentialUse(use: CredentialUse): Promise<void> {
+  if (!lastUseIsStale(use.lastUsedAt, use.now)) {
+    return;
+  }
+  try {
+    await use.write((status) => {
+      stampLastUsed(status, use.now);
+    });
+  } catch (error) {
+    if (error instanceof ResourceNotFoundError) {
+      return;
+    }
+    use.logger.warn(
+      "Credential last_used_at not recorded (best-effort — the request is unaffected)",
+      {
+        credential: use.credential,
+        id: use.id,
+        error: error instanceof Error ? error.message : String(error),
+      },
+    );
+  }
+}

package/src/pipeline/steps/defaults.ts

@@ -15,6 +15,12 @@
  * SpecAudit for definition changes (search recency, version "pushed at"),
  * StatusAudit for operational changes (Recents, lifecycle metadata).
  *
+ * A write the PLATFORM makes on its own (a schedule's clock, a credential's
+ * last-use stamp) takes the narrower `bumpStatusAudit` instead: status-audit
+ * updated_at + event only, never an actor, because no caller made it (Go's
+ * clock bump, "the same two leaves every cloud runtime patch bumps"). Two
+ * flavors, two writers, both wire-visible — keep them distinct.
+ *
  * This module is also the one home of how an id is SPELLED. `generateId`
  * mints `{prefix}_{ulid}`; `derivedId` is its sibling for the kinds
  * metadata.proto names as deriving their id from a natural key instead
@@ -175,6 +181,27 @@ export function setAuditFieldsForUpdate(
   );
 }
 
+/**
+ * Stamps the status-audit slot for a write the platform makes on its own —
+ * updated_at + event "updated", nothing else (see the module header for why
+ * this is not setAuditFieldsForUpdate). Like that helper it SETS a newly
+ * allocated slot rather than assigning into the existing one (#540); the
+ * slot's created_by/created_at/updated_by carry over unchanged.
+ */
+export function bumpStatusAudit(status: { audit?: ApiResourceAudit }): void {
+  if (status.audit === undefined) {
+    status.audit = create(ApiResourceAuditSchema);
+  }
+  const prior = status.audit.statusAudit;
+  const next =
+    prior === undefined
+      ? create(ApiResourceAuditInfoSchema)
+      : clone(ApiResourceAuditInfoSchema, prior);
+  next.updatedAt = timestampNow();
+  next.event = "updated";
+  status.audit.statusAudit = next;
+}
+
 // Operator identity (stigmer/stigmer#400): installed once at boot — before
 // any request — and read by the identity chassis when it mints the
 // trusted-local CallerIdentity (O2; audit stamping now derives its actor

package/src/temporal/schedule/activities.ts

@@ -20,6 +20,7 @@ import type { Schedule } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/ap
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 
 import type { Logger } from "../../boot/logger.js";
+import { bumpStatusAudit } from "../../pipeline/steps/defaults.js";
 import { ResourceNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
 import type { ScheduleTemporalConfig } from "./config.js";
@@ -64,7 +65,7 @@ import {
 } from "./run-ledger.js";
 import type { RunStarter } from "./run-starter.js";
 import type { ScheduleSyncer } from "./syncer.js";
-import { bumpStatusAudit, ensureStatus } from "./status-writes.js";
+import { ensureStatus } from "./status-writes.js";
 
 export interface ScheduleTickActivityDeps {
   readonly store: Store;

package/src/temporal/schedule/run-starter.ts

@@ -49,12 +49,13 @@ import type { Logger } from "../../boot/logger.js";
 import type { CallerIdentity } from "../../extensions/identity.js";
 import type { ScheduleFireCallerMint } from "../../extensions/schedule-fire-caller.js";
 import { ScheduleFireCallerRefusedError } from "../../extensions/schedule-fire-caller.js";
+import { bumpStatusAudit } from "../../pipeline/steps/defaults.js";
 import { findResourceBySlug } from "../../pipeline/steps/helpers.js";
 import { ResourceNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
 import type { ScheduleTemporalConfig } from "./config.js";
 import { scheduleModelPinningRefusal } from "./model-pinning.js";
-import { ensureStatus, bumpStatusAudit } from "./status-writes.js";
+import { ensureStatus } from "./status-writes.js";
 
 /**
  * The scheduled session's pinned subject prefix — cross-edition contract