@stigmer/server 3.39.0 → 3.40.0

package/dist/domain/workflowinstance/steps.js

@@ -8,7 +8,7 @@
  * the family test ../workflow/__tests__/workflow.test.ts (the mutual edge
  * makes the two domains one testable unit).
  */
-import { ConnectError } from "@connectrpc/connect";
+import { Code, ConnectError } from "@connectrpc/connect";
 import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
@@ -22,9 +22,11 @@ import { ResourceNotFoundError } from "../../store/interface.js";
 export const PARENT_WORKFLOW_KEY = "parent_workflow";
 /**
  * LoadParentWorkflow — create.go: loads the workflow the instance
- * materializes and stashes it for the same-org rule. ANY load failure maps
- * to NotFound("Workflow", id) — Go folds every client error into that arm
- * (capital-W copy is the wire contract).
+ * materializes and stashes it for the same-org rule. The workflow is read
+ * through the in-process query client, so a missing one arrives as a Connect
+ * NotFound and answers NotFound("Workflow", id) (the capital-W copy is the
+ * wire contract); any other failure is a fault answered as Internal, never a
+ * missing parent.
  */
 export function newLoadParentWorkflowStep(loaderProvider, logger) {
     return {
@@ -37,11 +39,14 @@ export function newLoadParentWorkflowStep(loaderProvider, logger) {
                 parent = await loaderProvider().get(workflowId);
             }
             catch (error) {
-                logger.warn("Parent workflow not found", {
-                    error: error instanceof ConnectError ? error.rawMessage : String(error),
-                    workflowId,
-                });
-                throw notFoundError("Workflow", workflowId);
+                if (error instanceof ConnectError && error.code === Code.NotFound) {
+                    logger.warn("Parent workflow not found", {
+                        error: error.rawMessage,
+                        workflowId,
+                    });
+                    throw notFoundError("Workflow", workflowId);
+                }
+                throw internalError(error, "failed to load parent workflow");
             }
             ctx.set(PARENT_WORKFLOW_KEY, parent);
         },

package/dist/domain/workflowinstance/steps.js.map

@@ -1 +1 @@
-{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/workflowinstance/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGnD,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AAIvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAG1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,qCAAqC,EAAE,MAAM,6CAA6C,CAAC;AACpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAKjE,yEAAyE;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAerD;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,cAA4C,EAC5C,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAiC;YAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC;YAEpD,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YAEvD,IAAI,MAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;oBACvC,KAAK,EACH,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBAClE,UAAU;iBACX,CAAC,CAAC;gBACH,MAAM,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAC9C,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,MAAM,uCAAuC,GAClD,gEAAgE,CAAC;AAEnE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oCAAoC,CAClD,GAAiC;IAEjC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAyB,CAAC;IACpE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACvC,IACE,iBAAiB,CAAC,QAAQ,CAAC;QAC3B,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC;QAC3C,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,EACtD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL;YACE,UAAU,EAAE,aAAa,CAAC,WAAW;YACrC,YAAY,EAAE,eAAe,CAAC,QAAQ;YACtC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;YACrC,aAAa,EAAE,uCAAuC;SACvD;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kCAAkC,CAChD,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,6BAA6B;QACnC,OAAO,CAAC,GAAiC;YACvC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAyB,CAAC;YACpE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;YACnD,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;YAE/C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CACT,8EAA8E,EAC9E;oBACE,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;oBACrC,WAAW;oBACX,WAAW,EAAE,SAAS;iBACvB,CACF,CAAC;gBACF,MAAM,oBAAoB,CACxB,kEAAkE;oBAChE,4BAA4B,WAAW,8BAA8B,SAAS,IAAI,CACrF,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,6BAA6B;IAC3C,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,OAAO,CAAC,GAAiC;YACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAEjC,CAAC;YACd,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,iDAAiD,CAAC,EAC5D,iDAAiD,CAClD,CAAC;YACJ,CAAC;YAED,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,KAAK,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC;gBAC7D,MAAM,uBAAuB,CAC3B,yDAAyD,QAAQ,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,uDAAuD,CAChJ,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oDAAoD,CAElE,KAAY,EAAE,WAAmB;IACjC,OAAO;QACL,IAAI,EAAE,uCAAuC;QAC7C,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAqB,CAAC;YAE1D,IAAI,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzC,qCAAqC,EAAE,CAAC;YAC1C,CAAC;YAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC;YACjD,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;gBACpB,OAAO;YACT,CAAC;YACD,IAAI,MAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAC9B,eAAe,CAAC,QAAQ,EACxB,QAAQ,EACR,cAAc,CACf,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,OAAO;gBACT,CAAC;gBACD,MAAM,aAAa,CACjB,KAAK,EACL,2DAA2D,CAC5D,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,EAAE,iBAAiB,KAAK,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC;gBAC/D,qCAAqC,EAAE,CAAC;YAC1C,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"steps.js","sourceRoot":"","sources":["../../../src/domain/workflowinstance/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AAIvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAG1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,qCAAqC,EAAE,MAAM,6CAA6C,CAAC;AACpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAKjE,yEAAyE;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAerD;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,cAA4C,EAC5C,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAiC;YAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC;YAEpD,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YAEvD,IAAI,MAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAClE,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;wBACvC,KAAK,EAAE,KAAK,CAAC,UAAU;wBACvB,UAAU;qBACX,CAAC,CAAC;oBACH,MAAM,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;gBAC9C,CAAC;gBACD,MAAM,aAAa,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;YAC/D,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,MAAM,uCAAuC,GAClD,gEAAgE,CAAC;AAEnE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oCAAoC,CAClD,GAAiC;IAEjC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAyB,CAAC;IACpE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACvC,IACE,iBAAiB,CAAC,QAAQ,CAAC;QAC3B,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC;QAC3C,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,EACtD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL;YACE,UAAU,EAAE,aAAa,CAAC,WAAW;YACrC,YAAY,EAAE,eAAe,CAAC,QAAQ;YACtC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;YACrC,aAAa,EAAE,uCAAuC;SACvD;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kCAAkC,CAChD,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,6BAA6B;QACnC,OAAO,CAAC,GAAiC;YACvC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAyB,CAAC;YACpE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;YACnD,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;YAE/C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CACT,8EAA8E,EAC9E;oBACE,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;oBACrC,WAAW;oBACX,WAAW,EAAE,SAAS;iBACvB,CACF,CAAC;gBACF,MAAM,oBAAoB,CACxB,kEAAkE;oBAChE,4BAA4B,WAAW,8BAA8B,SAAS,IAAI,CACrF,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,6BAA6B;IAC3C,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,OAAO,CAAC,GAAiC;YACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAEjC,CAAC;YACd,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,iDAAiD,CAAC,EAC5D,iDAAiD,CAClD,CAAC;YACJ,CAAC;YAED,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,KAAK,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC;gBAC7D,MAAM,uBAAuB,CAC3B,yDAAyD,QAAQ,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,uDAAuD,CAChJ,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oDAAoD,CAElE,KAAY,EAAE,WAAmB;IACjC,OAAO;QACL,IAAI,EAAE,uCAAuC;QAC7C,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAqB,CAAC;YAE1D,IAAI,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzC,qCAAqC,EAAE,CAAC;YAC1C,CAAC;YAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC;YACjD,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;gBACpB,OAAO;YACT,CAAC;YACD,IAAI,MAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAC9B,eAAe,CAAC,QAAQ,EACxB,QAAQ,EACR,cAAc,CACf,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,OAAO;gBACT,CAAC;gBACD,MAAM,aAAa,CACjB,KAAK,EACL,2DAA2D,CAC5D,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,EAAE,iBAAiB,KAAK,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC;gBAC/D,qCAAqC,EAAE,CAAC;YAC1C,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/extensions/identity.d.ts

@@ -1,17 +1,3 @@
-/**
- * Identity extension-point types — the verifier-chain contract of the
- * convergence blueprint (20260826.02 blueprint/03 §4, DD-007), carried by
- * the extension registry from O1 (20260826.09) and consumed by the
- * verifier-chain chassis (O2, 20260827.01 — pipeline/interceptors/auth.ts).
- *
- * The shapes are transcribed from the ratified design, not invented here:
- * a verifier either CLAIMS a token (verifying it fully, throwing on
- * signature/expiry/audience failure) or PASSES (returns null → next
- * verifier) — the TS rendering of the Java ProviderManager chain. The
- * product is one typed value, CallerIdentity, threaded explicitly through
- * HandlerContext.values (never ambient state — the every-dependency-
- * explicit doctrine).
- */
 /**
  * The caller-class discriminant. OSS knows user / machine / runner plus
  * the in-process `internal` class (O2 ruling Q4: the TS rendering of the
@@ -137,4 +123,32 @@ export declare function isPlatformPipelineCaller(caller: CallerIdentity): boolea
  * instance's provenance) must key on this predicate and never on that one.
  */
 export declare function isServerComposedRequest(caller: CallerIdentity): boolean;
+/**
+ * Whether `caller` is a FIRST-PARTY HUMAN OPERATOR: a person at the
+ * console, the CLI or an SDK, speaking for themselves on the wire — the
+ * TS rendering of the Java RequestCallerIdentity.isFirstPartyHumanOperator
+ * (not machine, not impersonated, no token_type, not a PlatformClient user
+ * token). Stated once for every consumer that must tell the person from a
+ * lane acting near them: memory recall and the person's declared
+ * preferences on execution create (domain/agentexecution/create-steps.ts).
+ *
+ * An ALLOW-list, so a lane this module has never heard of is excluded by
+ * construction: the class must be `user` (every human verifier stamps it —
+ * OIDC, API key, the cloud's direct and federated logins; runners, the
+ * cloud's token lanes and the platform's own pipelines each carry their
+ * own class), the request must come from the wire (the open-source
+ * schedule fire acts as its creator with class `user` but rides the
+ * in-process transport, which is exactly what `isServerComposedRequest`
+ * reads), and the bearer must not be a PlatformClient user token (a
+ * person, but spoken for by a third-party client — DD-002 D4 as amended).
+ */
+export declare function isFirstPartyHumanOperator(caller: CallerIdentity): boolean;
+/**
+ * Whether the bearer is a platform token naming a PlatformClient. Anything
+ * that is not a platform token (no token, an API key, another issuer's
+ * JWT) is not one, whatever claims it carries (stigmer#1312). Read from
+ * the raw token, never from `platformClientId`, which is audit provenance
+ * set by one verifier and not a guard vocabulary (see its field doc).
+ */
+export declare function carriesPlatformClientClaim(rawToken: string): boolean;
 //# sourceMappingURL=identity.d.ts.map

package/dist/extensions/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/extensions/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,SAAS,GACT,QAAQ,GACR,UAAU,GACV,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,YAAY,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;CACvD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAExE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAEvE"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/extensions/identity.ts"],"names":[],"mappings":"AAoBA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,SAAS,GACT,QAAQ,GACR,UAAU,GACV,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,YAAY,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;CACvD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAExE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAEvE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAMzE;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAMpE"}

package/dist/extensions/identity.js

@@ -12,6 +12,8 @@
  * HandlerContext.values (never ambient state — the every-dependency-
  * explicit doctrine).
  */
+import { USER_TOKEN_CLAIMS } from "../domain/platformclient/constants.js";
+import { decodeVerifiedPlatformTokenPayload, stringClaim, } from "../platformtoken/envelope.js";
 /**
  * Whether `caller` is one of the platform's own pipelines — the admission
  * rule of the RPCs a person must never reach directly, stated ONCE
@@ -49,4 +51,40 @@ export function isPlatformPipelineCaller(caller) {
 export function isServerComposedRequest(caller) {
     return caller.callerClass === "internal" || caller.origin === "in-process";
 }
+/**
+ * Whether `caller` is a FIRST-PARTY HUMAN OPERATOR: a person at the
+ * console, the CLI or an SDK, speaking for themselves on the wire — the
+ * TS rendering of the Java RequestCallerIdentity.isFirstPartyHumanOperator
+ * (not machine, not impersonated, no token_type, not a PlatformClient user
+ * token). Stated once for every consumer that must tell the person from a
+ * lane acting near them: memory recall and the person's declared
+ * preferences on execution create (domain/agentexecution/create-steps.ts).
+ *
+ * An ALLOW-list, so a lane this module has never heard of is excluded by
+ * construction: the class must be `user` (every human verifier stamps it —
+ * OIDC, API key, the cloud's direct and federated logins; runners, the
+ * cloud's token lanes and the platform's own pipelines each carry their
+ * own class), the request must come from the wire (the open-source
+ * schedule fire acts as its creator with class `user` but rides the
+ * in-process transport, which is exactly what `isServerComposedRequest`
+ * reads), and the bearer must not be a PlatformClient user token (a
+ * person, but spoken for by a third-party client — DD-002 D4 as amended).
+ */
+export function isFirstPartyHumanOperator(caller) {
+    return (caller.callerClass === "user" &&
+        !isServerComposedRequest(caller) &&
+        !carriesPlatformClientClaim(caller.rawToken));
+}
+/**
+ * Whether the bearer is a platform token naming a PlatformClient. Anything
+ * that is not a platform token (no token, an API key, another issuer's
+ * JWT) is not one, whatever claims it carries (stigmer#1312). Read from
+ * the raw token, never from `platformClientId`, which is audit provenance
+ * set by one verifier and not a guard vocabulary (see its field doc).
+ */
+export function carriesPlatformClientClaim(rawToken) {
+    const payload = decodeVerifiedPlatformTokenPayload(rawToken);
+    return (payload !== undefined &&
+        stringClaim(payload, USER_TOKEN_CLAIMS.platformClientId) !== undefined);
+}
 //# sourceMappingURL=identity.js.map

package/dist/extensions/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/extensions/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAuGH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAsB;IAC7D,OAAO,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAsB;IAC5D,OAAO,MAAM,CAAC,WAAW,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,CAAC;AAC7E,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/extensions/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EACL,kCAAkC,EAClC,WAAW,GACZ,MAAM,8BAA8B,CAAC;AAuGtC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAsB;IAC7D,OAAO,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAsB;IAC5D,OAAO,MAAM,CAAC,WAAW,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAsB;IAC9D,OAAO,CACL,MAAM,CAAC,WAAW,KAAK,MAAM;QAC7B,CAAC,uBAAuB,CAAC,MAAM,CAAC;QAChC,CAAC,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAC7C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,MAAM,OAAO,GAAG,kCAAkC,CAAC,QAAQ,CAAC,CAAC;IAC7D,OAAO,CACL,OAAO,KAAK,SAAS;QACrB,WAAW,CAAC,OAAO,EAAE,iBAAiB,CAAC,gBAAgB,CAAC,KAAK,SAAS,CACvE,CAAC;AACJ,CAAC"}

package/dist/pipeline/steps/guard-memory-capture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard-memory-capture.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-memory-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAKtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAK5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAG/F,wEAAwE;AACxE,eAAO,MAAM,6BAA6B,iEACsB,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AAEvE,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,QAAQ,CAAC,EAAE,wBAAwB,GAClC,YAAY,CAAC,IAAI,CAAC,CAsDpB;AAED,4EAA4E;AAC5E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,GACxB,uBAAuB,GAAG,SAAS,CAWrC"}
+{"version":3,"file":"guard-memory-capture.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-memory-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAOtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAG/F,wEAAwE;AACxE,eAAO,MAAM,6BAA6B,iEACsB,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AAEvE,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,QAAQ,CAAC,EAAE,wBAAwB,GAClC,YAAY,CAAC,IAAI,CAAC,CAsDpB;AAED,4EAA4E;AAC5E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,GACxB,uBAAuB,GAAG,SAAS,CAWrC"}

package/dist/pipeline/steps/guard-memory-capture.js

@@ -1,7 +1,5 @@
 import { Code, ConnectError } from "@connectrpc/connect";
-import { USER_TOKEN_CLAIMS } from "../../domain/platformclient/constants.js";
-import { isServerComposedRequest } from "../../extensions/identity.js";
-import { decodeVerifiedPlatformTokenPayload, stringClaim, } from "../../platformtoken/envelope.js";
+import { carriesPlatformClientClaim, isServerComposedRequest, } from "../../extensions/identity.js";
 import { metadataOf } from "./shapes.js";
 /** The Java MemoryPolicy.MEMORY_CAPTURE_CALLER_MESSAGE, byte-pinned. */
 export const MEMORY_CAPTURE_CALLER_MESSAGE = "memory can only be captured for a first-party human operator";
@@ -71,14 +69,4 @@ export function memoryCaptureCredentialOf(ctx) {
     }
     return undefined;
 }
-/**
- * Whether the bearer is a platform token naming a PlatformClient. Anything
- * that is not a platform token (no token, an API key, another issuer's
- * JWT) is not one, whatever claims it carries.
- */
-function carriesPlatformClientClaim(rawToken) {
-    const payload = decodeVerifiedPlatformTokenPayload(rawToken);
-    return (payload !== undefined &&
-        stringClaim(payload, USER_TOKEN_CLAIMS.platformClientId) !== undefined);
-}
 //# sourceMappingURL=guard-memory-capture.js.map

package/dist/pipeline/steps/guard-memory-capture.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard-memory-capture.js","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-memory-capture.ts"],"names":[],"mappings":"AA0CA,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAGvE,OAAO,EACL,kCAAkC,EAClC,WAAW,GACZ,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,wEAAwE;AACxE,MAAM,CAAC,MAAM,6BAA6B,GACxC,8DAA8D,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAC;AAEvE,MAAM,UAAU,yBAAyB,CACvC,QAAmC;IAEnC,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC;YAClC,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,6DAA6D;gBAC7D,+DAA+D;gBAC/D,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,EAAE,sBAAsB,CAAC;YAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,gEAAgE;gBAChE,8DAA8D;gBAC9D,8DAA8D;gBAC9D,gEAAgE;gBAChE,2DAA2D;gBAC3D,4DAA4D;gBAC5D,uDAAuD;gBACvD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;gBAC1D,QAAQ,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACzB,KAAK,OAAO;wBACV,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE;4BACrC,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;4BAC3D,eAAe,EAAE,QAAQ,CAAC,eAAe;yBAC1C,CAAC,CAAC;wBACH,OAAO;oBACT,KAAK,QAAQ;wBACX,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,gBAAgB,CACtB,CAAC;oBACJ,KAAK,YAAY;wBACf,MAAM;oBACR,OAAO,CAAC,CAAC,CAAC;wBACR,MAAM,UAAU,GAAU,QAAQ,CAAC;wBACnC,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAChE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IACE,MAAM,CAAC,WAAW,KAAK,SAAS;gBAChC,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC3C,CAAC;gBACD,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,gBAAgB,CACtB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAyB;IAEzB,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACvD,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,0BAA0B,IAAI,OAAO;QACrC,iBAAiB,IAAI,OAAO,EAC5B,CAAC;QACD,OAAO,OAAkC,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,SAAS,0BAA0B,CAAC,QAAgB;IAClD,MAAM,OAAO,GAAG,kCAAkC,CAAC,QAAQ,CAAC,CAAC;IAC7D,OAAO,CACL,OAAO,KAAK,SAAS;QACrB,WAAW,CAAC,OAAO,EAAE,iBAAiB,CAAC,gBAAgB,CAAC,KAAK,SAAS,CACvE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"guard-memory-capture.js","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-memory-capture.ts"],"names":[],"mappings":"AA0CA,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,8BAA8B,CAAC;AAItC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,wEAAwE;AACxE,MAAM,CAAC,MAAM,6BAA6B,GACxC,8DAA8D,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAC;AAEvE,MAAM,UAAU,yBAAyB,CACvC,QAAmC;IAEnC,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC;YAClC,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,6DAA6D;gBAC7D,+DAA+D;gBAC/D,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,EAAE,sBAAsB,CAAC;YAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,gEAAgE;gBAChE,8DAA8D;gBAC9D,8DAA8D;gBAC9D,gEAAgE;gBAChE,2DAA2D;gBAC3D,4DAA4D;gBAC5D,uDAAuD;gBACvD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;gBAC1D,QAAQ,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACzB,KAAK,OAAO;wBACV,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE;4BACrC,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;4BAC3D,eAAe,EAAE,QAAQ,CAAC,eAAe;yBAC1C,CAAC,CAAC;wBACH,OAAO;oBACT,KAAK,QAAQ;wBACX,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,gBAAgB,CACtB,CAAC;oBACJ,KAAK,YAAY;wBACf,MAAM;oBACR,OAAO,CAAC,CAAC,CAAC;wBACR,MAAM,UAAU,GAAU,QAAQ,CAAC;wBACnC,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAChE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IACE,MAAM,CAAC,WAAW,KAAK,SAAS;gBAChC,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC3C,CAAC;gBACD,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,gBAAgB,CACtB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAyB;IAEzB,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACvD,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,0BAA0B,IAAI,OAAO;QACrC,iBAAiB,IAAI,OAAO,EAC5B,CAAC;QACD,OAAO,OAAkC,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/server",
-  "version": "3.39.0",
+  "version": "3.40.0",
   "description": "The Stigmer OSS control plane as a composable library: composeServer, the extension registry and the driver seams a composition builds on. The self-contained deployable of the same server is @stigmer/server-slim.",
   "license": "Apache-2.0",
   "type": "module",
@@ -63,11 +63,11 @@
     "@connectrpc/connect-node": "^2.0.0",
     "@kubernetes/client-node": "2.0.0",
     "@opentelemetry/api": "^1.9.0",
-    "@stigmer/outbound": "3.39.0",
-    "@stigmer/plugin-package": "3.39.0",
-    "@stigmer/protos": "3.39.0",
-    "@stigmer/temporal-codecs": "3.39.0",
-    "@stigmer/zip-structure": "3.39.0",
+    "@stigmer/outbound": "3.40.0",
+    "@stigmer/plugin-package": "3.40.0",
+    "@stigmer/protos": "3.40.0",
+    "@stigmer/temporal-codecs": "3.40.0",
+    "@stigmer/zip-structure": "3.40.0",
     "@temporalio/activity": "1.16.2",
     "@temporalio/client": "1.16.2",
     "@temporalio/common": "1.16.2",

package/src/artifactstorage/__tests__/artifact-storage.test.ts

@@ -2,7 +2,8 @@
  * Ports storage/local_storage_test.go + disposition_test.go case-for-case:
  * the containment guard (every escaping key refused on every operation,
  * contained dot-segment keys allowed), the #285 no-implicit-segment
- * layout contract, the local signed-URL shape, and the
+ * layout contract, the local signed-URL shape (a fixed serve URL, or one
+ * resolved per mint once the file server binds — stigmer#1089), and the
  * Content-Disposition builder. Adds the factory's r2/unknown refusals
  * (Go's are boot asserted; here they're the disclosed deferral), and the
  * O5 widened surface: size, the typed not-found, presigned-PUT over the
@@ -154,6 +155,19 @@ describe("LocalArtifactStorage", () => {
     expect(exotic).toBe(`http://localhost:7235/${key}?download=a~b%2Ac.md`);
   });
 
+  it("signed URL: a resolved serve URL is read at every mint, not at construction", async () => {
+    let origin = "";
+    const resolved = new LocalArtifactStorage(base, () => origin);
+    const key = "artifacts/aex_1/plan.md";
+    await expect(resolved.getSignedUrl(key, 3600_000, "")).rejects.toThrow(
+      "local serve URL not configured",
+    );
+    origin = "http://localhost:51234";
+    expect(await resolved.getSignedUrl(key, 3600_000, "")).toBe(
+      `http://localhost:51234/${key}`,
+    );
+  });
+
   it("delete removes the artifact and prunes empty parents, never the root", async () => {
     const key = "attachments/01DEL/file.txt";
     await storage.upload(key, Buffer.from("x"), "text/plain");

package/src/artifactstorage/artifact-storage.ts

@@ -157,7 +157,12 @@ export interface ArtifactStorageConfig {
   /** "local" or "r2" ("" defaults to local — Go NewArtifactStorage). */
   readonly type: string;
   readonly localBasePath: string;
-  readonly localServeUrl: string;
+  /**
+   * The download URL base: a fixed string, or a resolver read per mint when
+   * the base is only known once the artifact file server binds
+   * (boot/artifact-lane.ts). "" = not configured.
+   */
+  readonly localServeUrl: string | (() => string);
   /** Cloudflare R2 (S3-compatible) settings — required when type is "r2". */
   readonly r2Bucket: string;
   readonly r2Endpoint: string;
@@ -214,7 +219,8 @@ export function newArtifactStorage(
 export class LocalArtifactStorage implements ArtifactStorage {
   constructor(
     private readonly basePath: string,
-    private readonly serveUrl: string,
+    /** Fixed, or resolved per mint (ArtifactStorageConfig.localServeUrl). */
+    private readonly serveUrl: string | (() => string),
     /**
      * The staged-upload mechanism backing presignPut — optional because
      * only instances whose root the lane stages into can serve it (the
@@ -287,10 +293,12 @@ export class LocalArtifactStorage implements ArtifactStorage {
     _expiresInMs: number,
     downloadFilename: string,
   ): Promise<string> {
-    if (this.serveUrl === "") {
+    const serveUrl =
+      typeof this.serveUrl === "function" ? this.serveUrl() : this.serveUrl;
+    if (serveUrl === "") {
       throw new Error("local serve URL not configured");
     }
-    let url = `${this.serveUrl}/${key}`;
+    let url = `${serveUrl}/${key}`;
     if (downloadFilename !== "") {
       url += `?${LOCAL_DOWNLOAD_QUERY_PARAM}=${goQueryEscape(downloadFilename)}`;
     }

package/src/boot/__tests__/artifact-lane.test.ts

@@ -0,0 +1,71 @@
+/**
+ * Pins the artifact lane's placement rules: a configured port wins (an
+ * explicit 0 included), an ephemeral unified port makes the lane ephemeral
+ * rather than deriving port 1 (stigmer#1089), and otherwise the lane sits at
+ * the unified port + 1; a configured serve URL passes through, and the
+ * derived one follows the port the lane bound and refuses before the bind.
+ */
+import { describe, expect, it } from "vitest";
+
+import {
+  resolveArtifactLanePort,
+  resolveArtifactServeUrl,
+} from "../artifact-lane.js";
+
+describe("resolveArtifactLanePort", () => {
+  it("keeps a configured port whatever the unified port is", () => {
+    expect(
+      resolveArtifactLanePort({ configured: 9000, unifiedPort: 7234 }),
+    ).toBe(9000);
+    expect(resolveArtifactLanePort({ configured: 9000, unifiedPort: 0 })).toBe(
+      9000,
+    );
+  });
+
+  it("keeps a configured 0 as an explicit ephemeral bind", () => {
+    expect(resolveArtifactLanePort({ configured: 0, unifiedPort: 7234 })).toBe(
+      0,
+    );
+  });
+
+  it("binds ephemeral when the unified port is not known until listen, never port 1", () => {
+    expect(
+      resolveArtifactLanePort({ configured: undefined, unifiedPort: 0 }),
+    ).toBe(0);
+  });
+
+  it("takes the unified port + 1 when nothing is configured", () => {
+    expect(
+      resolveArtifactLanePort({ configured: undefined, unifiedPort: 7234 }),
+    ).toBe(7235);
+  });
+});
+
+describe("resolveArtifactServeUrl", () => {
+  it("passes a configured serve URL through as given", () => {
+    expect(
+      resolveArtifactServeUrl(
+        "https://artifacts.stigmer.test",
+        () => undefined,
+      ),
+    ).toBe("https://artifacts.stigmer.test");
+  });
+
+  it("derives the lane's localhost origin from the port it bound", () => {
+    let bound: number | undefined;
+    const serveUrl = resolveArtifactServeUrl("", () => bound);
+    if (typeof serveUrl === "string")
+      throw new Error("expected a resolver for an unset serve URL");
+    bound = 51234;
+    expect(serveUrl()).toBe("http://localhost:51234");
+  });
+
+  it("refuses to mint a URL before the lane bound", () => {
+    const serveUrl = resolveArtifactServeUrl("", () => undefined);
+    if (typeof serveUrl === "string")
+      throw new Error("expected a resolver for an unset serve URL");
+    expect(() => serveUrl()).toThrow(
+      "before the artifact file server bound its port",
+    );
+  });
+});

package/src/boot/__tests__/compose.test.ts

@@ -7,7 +7,12 @@
  *   - start() flips SERVING BEFORE the port binds, so the first probe that
  *     reaches the port already sees a serving server;
  *   - shutdown flips NOT_SERVING FIRST, then drains — and the port stops
- *     answering.
+ *     answering;
+ *   - the artifact download lane binds before SERVING, so a lane that
+ *     cannot bind fails start() with the address and the setting named and
+ *     the server never reports itself serving (stigmer#1089), and a server
+ *     on an ephemeral port gets an ephemeral lane whose minted download
+ *     URLs reach it.
  */
 import { createClient } from "@connectrpc/connect";
 import { createGrpcTransport } from "@connectrpc/connect-node";
@@ -15,7 +20,13 @@ import {
   Health,
   HealthCheckResponse_ServingStatus as ServingStatus,
 } from "@stigmer/protos/grpc/health/v1/health_pb";
-import { connect as netConnect } from "node:net";
+import { ArtifactCommandController } from "@stigmer/protos/ai/stigmer/agentic/artifact/v1/command_pb";
+import { ArtifactQueryController } from "@stigmer/protos/ai/stigmer/agentic/artifact/v1/query_pb";
+import {
+  createServer as netCreateServer,
+  connect as netConnect,
+} from "node:net";
+import type { AddressInfo } from "node:net";
 import { describe, expect, it } from "vitest";
 
 import { mkdtempSync } from "node:fs";
@@ -32,11 +43,12 @@ const silentLogger = createLogger({
   write: () => {},
 });
 
-function compose() {
+function compose(env: NodeJS.ProcessEnv = {}) {
   // Each composed server gets a throwaway database — the storage stage
   // opens DB_PATH for real (never the developer's ~/.stigmer).
   const testDir = mkdtempSync(path.join(tmpdir(), "compose-test-"));
   const config = loadConfig({
+    ...env,
     STIGMER_MODEL_REGISTRY_REFRESH: "off",
     // No engine behind composed tests: 127.0.0.1:1 is deterministically
     // closed, so boots fail the non-fatal connect fast and can never touch
@@ -95,3 +107,61 @@ describe("composition-root boot ordering", () => {
     expect(refused, "the drained port must refuse new connections").toBe(true);
   });
 });
+
+describe("the artifact download lane", () => {
+  it("fails start() when the lane cannot bind, naming the address and the setting, and never serves", async () => {
+    const holder = netCreateServer();
+    await new Promise<void>((resolve) =>
+      holder.listen(0, "127.0.0.1", resolve),
+    );
+    const held = (holder.address() as AddressInfo).port;
+    try {
+      const server = await compose({ ARTIFACT_HTTP_PORT: String(held) });
+      try {
+        await expect(server.start()).rejects.toThrow(
+          `the artifact file server could not bind '127.0.0.1:${held}' (EADDRINUSE): ARTIFACT_HTTP_PORT=${held} cannot be bound; set it to a free port`,
+        );
+        // SERVING is set before the unified port binds, so a server that is
+        // still NOT_SERVING never opened it.
+        expect(server.healthState.status("")).toBe(ServingStatus.NOT_SERVING);
+      } finally {
+        await server.shutdown();
+      }
+    } finally {
+      await new Promise<void>((resolve) => holder.close(() => resolve()));
+    }
+  });
+
+  it("binds an ephemeral lane beside an ephemeral unified port, and a minted download URL reaches it", async () => {
+    const server = await compose();
+    const port = await server.start();
+    try {
+      const transport = createGrpcTransport({
+        baseUrl: `http://127.0.0.1:${port}`,
+      });
+      const command = createClient(ArtifactCommandController, transport);
+      const query = createClient(ArtifactQueryController, transport);
+      const content = new TextEncoder().encode("ephemeral lane body\n");
+      const created = await command.create({
+        spec: {
+          displayName: "ephemeral-lane.txt",
+          contentType: "text/plain",
+          source: { agentExecutionId: "aexec_01ephemerallane" },
+        },
+        content,
+      });
+      const download = await query.getDownloadUrl({
+        value: created.metadata!.id,
+      });
+
+      // An OS-assigned port, never the privileged port 1 that +1 derived
+      // from 0; the bytes coming back prove it is THIS server's lane.
+      expect(Number(new URL(download.url).port)).toBeGreaterThan(1024);
+      const served = await fetch(download.url);
+      expect(served.status).toBe(200);
+      expect(new Uint8Array(await served.arrayBuffer())).toEqual(content);
+    } finally {
+      await server.shutdown();
+    }
+  });
+});

package/src/boot/__tests__/config.test.ts

@@ -71,6 +71,25 @@ describe("loadConfig", () => {
     );
   });
 
+  // stigmer#1089: the artifact lane's port and serve URL follow the unified
+  // port the composition binds (boot/artifact-lane.ts), so the loader keeps
+  // only what the operator set and derives nothing.
+  it("leaves an unset or malformed ARTIFACT_HTTP_PORT unset, for the lane to derive", () => {
+    expect(loadConfig({}).artifactHttpPort).toBeUndefined();
+    expect(loadConfig({ GRPC_PORT: "0" }).artifactHttpPort).toBeUndefined();
+    expect(loadConfig({ ARTIFACT_HTTP_PORT: "7300x" }).artifactHttpPort).toBeUndefined();
+    expect(loadConfig({ ARTIFACT_HTTP_PORT: "7300" }).artifactHttpPort).toBe(7300);
+    expect(loadConfig({ ARTIFACT_HTTP_PORT: "0" }).artifactHttpPort).toBe(0);
+  });
+
+  it("leaves an unset ARTIFACT_LOCAL_SERVE_URL empty, for the bound lane to answer", () => {
+    expect(loadConfig({}).artifactLocalServeUrl).toBe("");
+    expect(
+      loadConfig({ ARTIFACT_LOCAL_SERVE_URL: "https://artifacts.stigmer.test" })
+        .artifactLocalServeUrl,
+    ).toBe("https://artifacts.stigmer.test");
+  });
+
   // 20260913.02 (sp.console-login, Q-CL-1): the console's public PKCE client
   // id is lenient on purpose — a CLI-only self-host that set the issuer
   // before this knob existed must keep booting on upgrade, and the served

package/src/boot/artifact-lane.ts

@@ -0,0 +1,96 @@
+/**
+ * Where the artifact file server listens, and the URL local artifact
+ * storage mints downloads under, on a server that was not told.
+ *
+ * The artifact download lane is a second loopback listener beside the
+ * unified port (domain/artifact/file-server.ts), bound only when artifact
+ * storage is local. `ARTIFACT_HTTP_PORT` and `ARTIFACT_LOCAL_SERVE_URL`
+ * place it explicitly; unset, both follow the unified port, and this module
+ * is the one place that says how.
+ *
+ * The port rules, in order: a configured port always wins (0 included — an
+ * explicit ephemeral bind); a unified port of 0 (`GRPC_PORT=0`, and the
+ * `portOverride: 0` test seam) is not known until listen, so the lane binds
+ * ephemeral too; otherwise the lane takes the unified port + 1, the default
+ * every install has always had. Deriving +1 from an ephemeral 0 gave port 1,
+ * a privileged port, and a server that reported healthy with a dead download
+ * lane (stigmer#1089). The caller passes the port the unified listener will
+ * bind (`portOverride ?? grpcPort`), the input the OAuth redirect derivation
+ * reads (boot/oauth-redirect-uri.ts).
+ *
+ * The serve URL: a configured value always wins; unset, it is the lane's own
+ * origin on localhost, read from the port the lane actually bound. The
+ * composition binds the lane before the unified port opens, so no request can
+ * mint a URL before that port exists; a read before the bind is a
+ * construction-order fault and throws rather than minting a URL for a port
+ * nothing listens on.
+ *
+ * A lane that cannot bind fails the boot, beside the storage probe it
+ * belongs with; artifactLaneBindError is the copy the operator reads, naming
+ * the address, the cause and the setting that moves the lane.
+ *
+ * Proven by __tests__/artifact-lane.test.ts and the lane cases of
+ * __tests__/compose.test.ts.
+ */
+
+export interface ArtifactLanePortInputs {
+  /** `ARTIFACT_HTTP_PORT` as loaded; undefined when unset. */
+  readonly configured: number | undefined;
+  /** The port the unified listener binds; 0 means "not known until listen". */
+  readonly unifiedPort: number;
+}
+
+/** The port the artifact file server binds; 0 asks the OS for an ephemeral one. */
+export function resolveArtifactLanePort(
+  inputs: ArtifactLanePortInputs,
+): number {
+  if (inputs.configured !== undefined) return inputs.configured;
+  if (inputs.unifiedPort === 0) return 0;
+  return inputs.unifiedPort + 1;
+}
+
+/**
+ * The serve URL local artifact storage mints download URLs under: the
+ * configured value as given, or a resolver over the lane's bound port.
+ */
+export function resolveArtifactServeUrl(
+  configured: string,
+  boundPort: () => number | undefined,
+): string | (() => string) {
+  if (configured !== "") return configured;
+  return () => {
+    const port = boundPort();
+    if (port === undefined) {
+      throw new Error(
+        "artifact download URL requested before the artifact file server bound its port",
+      );
+    }
+    return `http://localhost:${port}`;
+  };
+}
+
+/**
+ * The boot failure for a lane that could not bind: the address, the socket
+ * error's code, and the setting that moves the lane — named as the value
+ * that failed when the operator set it, as the default's escape hatch when
+ * the port was derived.
+ */
+export function artifactLaneBindError(
+  cause: unknown,
+  host: string,
+  port: number,
+  configured: boolean,
+): Error {
+  const code =
+    cause instanceof Error &&
+    typeof (cause as NodeJS.ErrnoException).code === "string"
+      ? ` (${(cause as NodeJS.ErrnoException).code})`
+      : "";
+  const remedy = configured
+    ? `ARTIFACT_HTTP_PORT=${port} cannot be bound; set it to a free port`
+    : "set ARTIFACT_HTTP_PORT to a free port (unset, the lane takes the unified port + 1)";
+  return new Error(
+    `the artifact file server could not bind '${host}:${port}'${code}: ${remedy}`,
+    { cause },
+  );
+}