@stigmer/server 3.41.0 → 3.41.1-dev.20261003133619.g58ac1f23a411

package/dist/authorization/model/data/authorization-model.json

@@ -8,14 +8,11 @@
                     "can_bootstrap_iam": {},
                     "can_execute_billing_ops": {},
                     "can_grant_access": {},
-                    "can_impersonate": {},
                     "can_issue_license": {},
                     "can_manage_credits": {},
                     "can_manage_cursor_accounts": {},
-                    "can_manage_identity_accounts": {},
                     "can_manage_model_pricing": {},
                     "can_manage_plans": {},
-                    "can_update_usage": {},
                     "can_view_access": {},
                     "can_view_provider_standing": {},
                     "can_write_reserved_labels": {},
@@ -54,11 +51,6 @@
                         "relation": "operator"
                     }
                 },
-                "can_impersonate": {
-                    "computedUserset": {
-                        "relation": "operator"
-                    }
-                },
                 "can_issue_license": {
                     "computedUserset": {
                         "relation": "operator"
@@ -85,11 +77,6 @@
                         "relation": "operator"
                     }
                 },
-                "can_manage_identity_accounts": {
-                    "computedUserset": {
-                        "relation": "operator"
-                    }
-                },
                 "can_manage_model_pricing": {
                     "computedUserset": {
                         "relation": "operator"
@@ -100,11 +87,6 @@
                         "relation": "operator"
                     }
                 },
-                "can_update_usage": {
-                    "computedUserset": {
-                        "relation": "operator"
-                    }
-                },
                 "can_view_access": {
                     "computedUserset": {
                         "relation": "operator"
@@ -401,9 +383,6 @@
                     "can_delete": {},
                     "can_edit": {},
                     "can_grant_access": {},
-                    "can_revoke": {},
-                    "can_rotate": {},
-                    "can_use": {},
                     "can_view": {},
                     "can_view_access": {},
                     "owner": {
@@ -434,21 +413,6 @@
                         "relation": "owner"
                     }
                 },
-                "can_revoke": {
-                    "computedUserset": {
-                        "relation": "owner"
-                    }
-                },
-                "can_rotate": {
-                    "computedUserset": {
-                        "relation": "owner"
-                    }
-                },
-                "can_use": {
-                    "computedUserset": {
-                        "relation": "owner"
-                    }
-                },
                 "can_view": {
                     "computedUserset": {
                         "relation": "owner"
@@ -874,7 +838,6 @@
                     "can_edit": {},
                     "can_grant_access": {},
                     "can_manage_billing": {},
-                    "can_manage_members": {},
                     "can_view": {},
                     "can_view_access": {},
                     "can_view_billing": {},
@@ -1056,11 +1019,6 @@
                         "relation": "admin"
                     }
                 },
-                "can_manage_members": {
-                    "computedUserset": {
-                        "relation": "admin"
-                    }
-                },
                 "can_view": {
                     "computedUserset": {
                         "relation": "viewer"
@@ -1117,7 +1075,6 @@
             "metadata": {
                 "module": "agentic",
                 "relations": {
-                    "can_clone": {},
                     "can_create_instance": {},
                     "can_delete": {},
                     "can_edit": {},
@@ -1164,10 +1121,6 @@
                             {
                                 "type": "identity_account"
                             },
-                            {
-                                "relation": "member",
-                                "type": "organization"
-                            },
                             {
                                 "relation": "viewer",
                                 "type": "organization"
@@ -1184,11 +1137,6 @@
                 }
             },
             "relations": {
-                "can_clone": {
-                    "computedUserset": {
-                        "relation": "viewer"
-                    }
-                },
                 "can_create_instance": {
                     "computedUserset": {
                         "relation": "can_execute"
@@ -1803,10 +1751,6 @@
                             {
                                 "type": "identity_account"
                             },
-                            {
-                                "relation": "member",
-                                "type": "organization"
-                            },
                             {
                                 "relation": "viewer",
                                 "type": "organization"
@@ -2169,10 +2113,6 @@
                             {
                                 "type": "identity_account"
                             },
-                            {
-                                "relation": "member",
-                                "type": "organization"
-                            },
                             {
                                 "relation": "viewer",
                                 "type": "organization"
@@ -2333,13 +2273,11 @@
             "metadata": {
                 "module": "agentic",
                 "relations": {
-                    "can_clone": {},
                     "can_connect": {},
                     "can_delete": {},
                     "can_edit": {},
                     "can_grant_access": {},
                     "can_manage_audience": {},
-                    "can_use": {},
                     "can_view": {},
                     "can_view_access": {},
                     "editor": {
@@ -2380,10 +2318,6 @@
                             {
                                 "type": "identity_account"
                             },
-                            {
-                                "relation": "member",
-                                "type": "organization"
-                            },
                             {
                                 "relation": "viewer",
                                 "type": "organization"
@@ -2400,11 +2334,6 @@
                 }
             },
             "relations": {
-                "can_clone": {
-                    "computedUserset": {
-                        "relation": "viewer"
-                    }
-                },
                 "can_connect": {
                     "computedUserset": {
                         "relation": "viewer"
@@ -2441,11 +2370,6 @@
                         "relation": "owner"
                     }
                 },
-                "can_use": {
-                    "computedUserset": {
-                        "relation": "viewer"
-                    }
-                },
                 "can_view": {
                     "computedUserset": {
                         "relation": "viewer"
@@ -2640,7 +2564,6 @@
                     "can_edit": {},
                     "can_grant_access": {},
                     "can_manage_audience": {},
-                    "can_use": {},
                     "can_view": {},
                     "can_view_access": {},
                     "organization": {
@@ -2670,10 +2593,6 @@
                             {
                                 "type": "identity_account"
                             },
-                            {
-                                "relation": "member",
-                                "type": "organization"
-                            },
                             {
                                 "relation": "viewer",
                                 "type": "organization"
@@ -2710,11 +2629,6 @@
                         "relation": "owner"
                     }
                 },
-                "can_use": {
-                    "computedUserset": {
-                        "relation": "viewer"
-                    }
-                },
                 "can_view": {
                     "computedUserset": {
                         "relation": "viewer"
@@ -3122,12 +3036,10 @@
             "metadata": {
                 "module": "agentic",
                 "relations": {
-                    "can_clone": {},
                     "can_delete": {},
                     "can_edit": {},
                     "can_grant_access": {},
                     "can_manage_audience": {},
-                    "can_use": {},
                     "can_view": {},
                     "can_view_access": {},
                     "organization": {
@@ -3157,10 +3069,6 @@
                             {
                                 "type": "identity_account"
                             },
-                            {
-                                "relation": "member",
-                                "type": "organization"
-                            },
                             {
                                 "relation": "viewer",
                                 "type": "organization"
@@ -3177,11 +3085,6 @@
                 }
             },
             "relations": {
-                "can_clone": {
-                    "computedUserset": {
-                        "relation": "viewer"
-                    }
-                },
                 "can_delete": {
                     "computedUserset": {
                         "relation": "owner"
@@ -3202,11 +3105,6 @@
                         "relation": "owner"
                     }
                 },
-                "can_use": {
-                    "computedUserset": {
-                        "relation": "viewer"
-                    }
-                },
                 "can_view": {
                     "computedUserset": {
                         "relation": "viewer"
@@ -3300,7 +3198,6 @@
             "metadata": {
                 "module": "agentic",
                 "relations": {
-                    "can_clone": {},
                     "can_delete": {},
                     "can_edit": {},
                     "can_execute": {},
@@ -3346,10 +3243,6 @@
                             {
                                 "type": "identity_account"
                             },
-                            {
-                                "relation": "member",
-                                "type": "organization"
-                            },
                             {
                                 "relation": "viewer",
                                 "type": "organization"
@@ -3366,11 +3259,6 @@
                 }
             },
             "relations": {
-                "can_clone": {
-                    "computedUserset": {
-                        "relation": "viewer"
-                    }
-                },
                 "can_delete": {
                     "computedUserset": {
                         "relation": "owner"
@@ -3543,10 +3431,6 @@
                             {
                                 "type": "identity_account"
                             },
-                            {
-                                "relation": "member",
-                                "type": "organization"
-                            },
                             {
                                 "relation": "viewer",
                                 "type": "organization"
@@ -3572,10 +3456,6 @@
                             {
                                 "type": "identity_account"
                             },
-                            {
-                                "relation": "member",
-                                "type": "organization"
-                            },
                             {
                                 "relation": "viewer",
                                 "type": "organization"

package/dist/authorization/model/execution-viewer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-viewer.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/execution-viewer.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,eAAO,MAAM,eAAe,EAAE,eA8B7B,CAAC"}
+{"version":3,"file":"execution-viewer.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/execution-viewer.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,eAAO,MAAM,eAAe,EAAE,eA8B7B,CAAC"}

package/dist/authorization/model/execution-viewer.js

@@ -9,8 +9,7 @@
  * It is derived from `spec.execution_visibility`, which `kind_meta`
  * cannot express: `organization` derives
  * `#execution_viewer@organization:<org>#viewer`, the organization's full
- * read audience (the relation also admits `#member`, the legacy shape),
- * and `private` or unset derives nothing, so each run stays its
+ * read audience, and `private` or unset derives nothing, so each run stays its
  * triggerer's. Pure over the row; no related row is read. Which level
  * names which audience is `executionAudienceShapes`
  * (pipeline/steps/authorization-tuples.ts), the one mapping this

package/dist/authorization/model/execution-viewer.js.map

@@ -1 +1 @@
-{"version":3,"file":"execution-viewer.js","sourceRoot":"","sources":["../../../src/authorization/model/execution-viewer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,gEAAgE,CAAC;AAE7G,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAMvF,MAAM,CAAC,MAAM,eAAe,GAAoB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC9D,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GACT,GAAG,CAAC,IAAI,EAAE,mBAAmB,IAAI,2BAA2B,CAAC,WAAW,CAAC;IAC3E,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;IACpC,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CACpB,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAS,EAAE;QACvD,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,YAAY;gBACf,OAAO;oBACL,MAAM;oBACN,QAAQ,EAAE,kBAAkB;oBAC5B,OAAO,EAAE;wBACP,IAAI,EAAE,SAAS;wBACf,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,EAAE;wBACzC,QAAQ,EAAE,QAAQ;qBACnB;iBACF,CAAC;YACJ,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,UAAU,GAAU,KAAK,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"execution-viewer.js","sourceRoot":"","sources":["../../../src/authorization/model/execution-viewer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,gEAAgE,CAAC;AAE7G,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAMvF,MAAM,CAAC,MAAM,eAAe,GAAoB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC9D,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GACT,GAAG,CAAC,IAAI,EAAE,mBAAmB,IAAI,2BAA2B,CAAC,WAAW,CAAC;IAC3E,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;IACpC,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CACpB,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAS,EAAE;QACvD,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,YAAY;gBACf,OAAO;oBACL,MAAM;oBACN,QAAQ,EAAE,kBAAkB;oBAC5B,OAAO,EAAE;wBACP,IAAI,EAAE,SAAS;wBACf,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,EAAE;wBACzC,QAAQ,EAAE,QAAQ;qBACnB;iBACF,CAAC;YACJ,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,UAAU,GAAU,KAAK,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC"}

package/dist/authorization/organization-directory.d.ts

@@ -26,7 +26,7 @@
  * subject. The `internal` class — the server acting as itself over the
  * in-process transport — is answered `ALL_ORGANIZATIONS`: the Authorize
  * step treats that class as the in-process authorization skip (pipeline/
- * interceptors/auth.ts, ruling Q4), and a directory answer IS an
+ * interceptors/auth.ts), and a directory answer IS an
  * authorization answer, so a server-internal hop sees what the permissive
  * default showed it. `findMyOrganizations` is skip-authorization by
  * annotation, which is why this driver meets that caller at all: a

package/dist/authorization/organization-directory.js

@@ -26,7 +26,7 @@
  * subject. The `internal` class — the server acting as itself over the
  * in-process transport — is answered `ALL_ORGANIZATIONS`: the Authorize
  * step treats that class as the in-process authorization skip (pipeline/
- * interceptors/auth.ts, ruling Q4), and a directory answer IS an
+ * interceptors/auth.ts), and a directory answer IS an
  * authorization answer, so a server-internal hop sees what the permissive
  * default showed it. `findMyOrganizations` is skip-authorization by
  * annotation, which is why this driver meets that caller at all: a

package/dist/authorization/stored-resources.d.ts

@@ -0,0 +1,4 @@
+import type { StoredResources } from "../domain/iampolicy/grant-path.js";
+import type { Store } from "../store/interface.js";
+export declare function newStoredResources(store: Store): StoredResources;
+//# sourceMappingURL=stored-resources.d.ts.map

package/dist/authorization/stored-resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stored-resources.d.ts","sourceRoot":"","sources":["../../src/authorization/stored-resources.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAIzE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAInD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,GAAG,eAAe,CAoChE"}

package/dist/authorization/stored-resources.js

@@ -0,0 +1,39 @@
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { kindByEnumName } from "../pipeline/apiresource-meta.js";
+import { createdByOf } from "../pipeline/steps/authorization-facts.js";
+import { metadataOf } from "../pipeline/steps/shapes.js";
+import { ResourceNotFoundError } from "../store/interface.js";
+import { builtInModel } from "./model/index.js";
+export function newStoredResources(store) {
+    /** The stored row of that kind and id, or undefined when this server holds none the grant path may read. */
+    async function rowOf(kindName, id) {
+        const kind = kindByEnumName(kindName);
+        const schema = builtInModel.byKind(kind)?.schema;
+        if (kind === ApiResourceKind.api_resource_kind_unknown ||
+            kind === ApiResourceKind.identity_account ||
+            schema === undefined ||
+            id === "") {
+            return undefined;
+        }
+        try {
+            return await store.getResource(kind, id, schema);
+        }
+        catch (error) {
+            if (error instanceof ResourceNotFoundError) {
+                return undefined;
+            }
+            throw error;
+        }
+    }
+    return {
+        async creatorOf(kindName, id) {
+            const row = await rowOf(kindName, id);
+            return row === undefined ? undefined : createdByOf(row);
+        },
+        async organizationOf(kindName, id) {
+            const row = await rowOf(kindName, id);
+            return row === undefined ? "" : (metadataOf(row)?.org ?? "");
+        },
+    };
+}
+//# sourceMappingURL=stored-resources.js.map

package/dist/authorization/stored-resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stored-resources.js","sourceRoot":"","sources":["../../src/authorization/stored-resources.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,MAAM,UAAU,kBAAkB,CAAC,KAAY;IAC7C,4GAA4G;IAC5G,KAAK,UAAU,KAAK,CAClB,QAAgB,EAChB,EAAU;QAEV,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACjD,IACE,IAAI,KAAK,eAAe,CAAC,yBAAyB;YAClD,IAAI,KAAK,eAAe,CAAC,gBAAgB;YACzC,MAAM,KAAK,SAAS;YACpB,EAAE,KAAK,EAAE,EACT,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE;YAC1B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACtC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE;YAC/B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACtC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/authorization/trusted-local-authorizer.js

@@ -19,7 +19,7 @@
  * usage report) are answered the same way, as they are under sign-in.
  *
  * Why the Organization alone. Every org-scoped lane authorizes on it (a
- * create by `metadata.org`, a list or report by `org`/`org_id`), and its
+ * create by `metadata.org`, a list or report by `org`), and its
  * absence is the one no later step catches. The other kinds' update, get
  * and delete chains load their target first and answer NOT_FOUND
  * themselves, and a general existence read would refuse the rowless
@@ -37,7 +37,7 @@
  * driver's guard: an outage is never softened into a refusal of a
  * different kind, and the driver never throws.
  *
- * Proven by __tests__/trusted-local-authorizer.test.ts (the arms, on both
+ * Proven by __tests__/trusted-local-authorizer.postgres.test.ts (the arms, on both
  * store drivers) and extensions/__tests__/built-in-authorization-
  * composed.test.ts (the wire, beside the same sentence under sign-in).
  */

package/dist/boot/compose.d.ts

@@ -19,10 +19,9 @@ export interface ComposedServer {
      * domain seals and opens with (one facade per composition, the Go
      * one-pointer posture). Exposed for compositions whose extensions run
      * maintenance lanes over stored ciphertext — the secret-convergence
-     * sweep's reencrypt door and the encryption-state census (convergence
-     * 20260830.04 Stage 3, gate ruling G2): a twin facade built from the
-     * same codec map would duplicate KEK caches and silently drift from
-     * the boot-resolved write version.
+     * sweep's reencrypt door and the encryption-state census: a twin
+     * facade built from the same codec map would duplicate KEK caches and
+     * silently drift from the boot-resolved write version.
      */
     secrets: SecretService;
     /**
@@ -35,19 +34,19 @@ export interface ComposedServer {
     /**
      * The runner-token service (exposed for boot tests and for the
      * executioncontext decrypt-lane tests, which mint scope-bound tokens
-     * against the SAME key the server verifies with; the platform exchange
-     * RPC — the mint side — lands with its own sub-project).
+     * against the SAME key the server verifies with; the mint side is the
+     * platform controller's getRunnerScopedToken).
      */
     runnerAuthService: RunnerAuthService;
     /**
-     * The agentexecution broadcast fabric (exposed for tests and, with #18,
-     * the Temporal worker's recovery broadcasts — Go's GetStreamBroker).
+     * The agentexecution broadcast fabric (exposed for tests and for the
+     * Temporal worker's recovery broadcasts — Go's GetStreamBroker).
      * UpdateStatus is the production writer.
      */
     agentExecutionStreamBroker: StreamBroker;
     /**
      * The workflowexecution broadcast fabric (exposed for tests and for the
-     * Temporal worker's persist broadcasts, #21 — Go's GetStreamBroker).
+     * Temporal worker's persist broadcasts — Go's GetStreamBroker).
      * UpdateStatus, the lifecycle RPCs, and the worker's activities are the
      * production writers.
      */
@@ -55,12 +54,12 @@ export interface ComposedServer {
     /**
      * The in-process router transport — the same routes and interceptor
      * chain as the serving router EXCEPT the position-1 identity source
-     * (DD-002's bufconn shape; O2 ruling Q4: this lane stamps the internal
+     * (Go's bufconn shape: this lane stamps the internal
      * caller class, the serving chain runs the verifier chassis). Exposed
      * because it is the one lane that reaches EVERY registered service,
-     * extension services included (blueprint 20260826.02/03 §8):
+     * extension services included:
      * compositions build clients to their extension services over it, and
-     * the O1 extension suite proves both-router visibility through it.
+     * the extension suite proves both-router visibility through it.
      */
     inProcessTransport: Transport;
     /**
@@ -70,7 +69,8 @@ export interface ComposedServer {
      * through `authenticateBearerToken` (stigmer#991). Exposed rather than
      * rebuilt at the edge because the OSS entries are constructed HERE from
      * the store and the config; an edge that rebuilt the list would drop
-     * them or reorder them, and both are the drift DD-007 rules out.
+     * them or reorder them, and the edge would then authenticate
+     * differently from the server it fronts.
      */
     identityVerifiers: ReadonlyArray<IdentityVerifier>;
     /**
@@ -82,14 +82,30 @@ export interface ComposedServer {
     routes: (router: ConnectRouter) => void;
     /** Completes wiring, flips SERVING, binds the port; returns the bound port. */
     start(): Promise<number>;
+    /**
+     * The ports the listeners actually bound, once start() has resolved;
+     * undefined before. An ephemeral bind (`GRPC_PORT=0`, `ARTIFACT_HTTP_PORT=0`)
+     * is known only here, and the process entry announces it on request
+     * (boot/ready-line.ts).
+     */
+    boundPorts(): BoundPorts | undefined;
     /** NOT_SERVING first, stop background work, drain connections. */
     shutdown(): Promise<void>;
 }
+export interface BoundPorts {
+    /** The unified transport listener's port. */
+    readonly grpc: number;
+    /**
+     * The artifact download lane's port; undefined when artifact storage is
+     * not local and the lane never binds (domain/artifact/file-server.ts).
+     */
+    readonly artifactHttp: number | undefined;
+}
 export interface ComposeOptions {
     config: ServerConfig;
     logger: Logger;
     /**
-     * Named extension units composed into this server (DD-006). Omitted or
+     * Named extension units composed into this server. Omitted or
      * empty means plain OSS — byte-identical wire behavior, pinned by the
      * conformance rosters.
      */

package/dist/boot/compose.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../src/boot/compose.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAoCpE,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AAIzE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAsCzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AA2ClE,OAAO,EAKL,aAAa,EAEd,MAAM,6BAA6B,CAAC;AAyBrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAYnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAWjE,OAAO,EAAE,YAAY,IAAI,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAW7G,OAAO,EAAE,WAAW,EAAyB,MAAM,wBAAwB,CAAC;AAS5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIhD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,WAAW,CAAC;IACzB,+EAA+E;IAC/E,KAAK,EAAE,KAAK,CAAC;IACb;;;;;;;;;OASG;IACH,OAAO,EAAE,aAAa,CAAC;IACvB;;;;;OAKG;IACH,eAAe,EAAE,eAAe,CAAC;IACjC;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IACrC;;;;OAIG;IACH,0BAA0B,EAAE,YAAY,CAAC;IACzC;;;;;OAKG;IACH,6BAA6B,EAAE,6BAA6B,CAAC;IAC7D;;;;;;;;;OASG;IACH,kBAAkB,EAAE,SAAS,CAAC;IAC9B;;;;;;;;OAQG;IACH,iBAAiB,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACnD;;;;;OAKG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IACxC,+EAA+E;IAC/E,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACzB,kEAAkE;IAClE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,UAAU,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC5C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAirDzB"}
+{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../src/boot/compose.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAoCpE,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AAIzE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAsCzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AA2ClE,OAAO,EAKL,aAAa,EAEd,MAAM,6BAA6B,CAAC;AA0BrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAYnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAWjE,OAAO,EAAE,YAAY,IAAI,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAe7G,OAAO,EAAE,WAAW,EAAyB,MAAM,wBAAwB,CAAC;AAS5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIhD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,WAAW,CAAC;IACzB,+EAA+E;IAC/E,KAAK,EAAE,KAAK,CAAC;IACb;;;;;;;;OAQG;IACH,OAAO,EAAE,aAAa,CAAC;IACvB;;;;;OAKG;IACH,eAAe,EAAE,eAAe,CAAC;IACjC;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IACrC;;;;OAIG;IACH,0BAA0B,EAAE,YAAY,CAAC;IACzC;;;;;OAKG;IACH,6BAA6B,EAAE,6BAA6B,CAAC;IAC7D;;;;;;;;;OASG;IACH,kBAAkB,EAAE,SAAS,CAAC;IAC9B;;;;;;;;;OASG;IACH,iBAAiB,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACnD;;;;;OAKG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IACxC,+EAA+E;IAC/E,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACzB;;;;;OAKG;IACH,UAAU,IAAI,UAAU,GAAG,SAAS,CAAC;IACrC,kEAAkE;IAClE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,UAAU,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC5C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAutDzB"}