dominus-sdk-nodejs 11.0.2 → 11.0.5

package/docs/architecture.md

@@ -1,119 +1,119 @@
-# SDK Architecture
-
-This document describes how `dominus-sdk-nodejs` is structured and how requests flow from namespace methods to backend services.
-
-## 1. Public Surface
-
-- Entry point: `src/index.ts`
-- Singleton export: `dominus`
-- Public API composition:
-  - Namespace properties (`dominus.auth`, `dominus.db`, `dominus.ai`, ...)
-  - Root shortcuts for common operations (`get`, `upsert`, `listTables`, `queryTable`, `addTable`, etc.)
-  - Utility exports (errors, crypto helpers, cache utilities, JWT helpers)
-
-## 2. Layering
-
-- Namespace layer (`src/namespaces/*`)
-  - Maps method calls to concrete API routes
-  - Translates ergonomic SDK params to backend payload shape
-  - Minimal orchestration and convenience wrappers
-- Transport layer (`src/lib/client.ts`)
-  - Auth token selection (service JWT vs user JWT)
-  - Request encoding/decoding protocol
-  - Retries, timeout handling, circuit breaker checks
-  - SSE streaming and binary upload/download support
-- Support libraries (`src/lib/*`)
-  - `cache.ts`: encrypted in-memory cache + circuit breaker primitives
-  - `errors.ts`: typed SDK errors
-  - `config.ts`: env/config resolution
-  - `console-capture.ts`: optional console forwarding to logs
-  - `page-rules.ts`, `user-session.ts`: local portal/session acceleration
-
-## 2a. Storage layer positioning
-
-`dominus.stash.*` is the **primary storage surface**. Applications store named-kind data through Stash and the kind registry routes each kind to the right backend; callers address data by what it *is* (`kind` + `scope` + `key`), not by which primitive holds it. The primitive namespaces (`redis`, `db`, `files`) and the addressed `artifacts` helpers remain as building blocks — they are not deprecated and are never removed — but they are rarely targeted directly for application data.
-
-This is the **Two-Layer Storage Rule**: applications store named-kind data via Stash; primitives are used directly only for ephemera (locks, queues, cache) or when building a kernel backend.
-
-| Your data | Use | Why |
-|---|---|---|
-| Named, durable data of a registered kind (artifacts, conversations, configs, recipes, secrets) | `dominus.stash.*` | Primary surface; the kind registry routes to the right backend and policy. |
-| A direct `ar://`-addressed artifact workflow (you already hold a canonical ref) | `dominus.artifacts.*` | Escape hatch for explicit Artifact V2 addressing; prefer a Stash `artifact-v2`-backed kind for new code. |
-| Locks, queues, rate counters, short-lived cache — ephemera | `dominus.redis.*` | Building block for ephemeral state; named data belongs in Stash. |
-| Building a new kernel backend or a documented migration fallback | primitives (`redis`, `db`, `files`) | The lowest layer; not the place for ordinary application data. |
-
-## 3. Request Lifecycle
-
-1. Caller invokes namespace method.
-2. Namespace builds request options (`endpoint`, `method`, `body`, `useGateway`, optional `userToken`).
-3. `DominusClient` resolves auth context:
-   - if `userToken` provided: uses caller token
-   - otherwise: ensures service JWT exists (PSK -> `/jwt/mint`, cached)
-4. Request payload is serialized to JSON, then base64-encoded for Dominus wire protocol.
-5. HTTP request is sent.
-6. Response body is decoded from base64 and parsed.
-7. Errors are mapped to SDK error types.
-
-## 4. Routing Model
-
-- Namespace code generally targets `/api/*` endpoints.
-- For methods with `useGateway: true`, client route transform maps `/api/*` to gateway `/svc/*` dispatch paths.
-- Some methods intentionally use direct fetch paths (for example health checks/JWKS fetch).
-
-See [routes-services.md](./routes-services.md) for full route/service assessment.
-
-## 5. Auth and Token Handling
-
-### Service token flow
-
-- Input: `DOMINUS_TOKEN` (PSK)
-- Client exchanges PSK for short-lived JWT via gateway auth route.
-- JWT is cached with refresh buffer and refresh mutex to avoid thundering herd under concurrency.
-
-### User token flow
-
-- Methods that accept `userToken` pass caller JWT through unchanged.
-- Backend performs authorization checks for the user context.
-
-### Local JWT utilities
-
-- `verifyJwtLocally`, `isJwtValid`, and `mintSelectedScopeJwt` are exported from `src/lib/client.ts`. Selected-scope targeting is now the only supported SDK helper vocabulary.
-- `mintSelectedScopeJwt(targetOrgId, targetEnv)` is the canonical selected-scope mint helper; the live `/jwt/mint` contract keys selected scope off org plus environment, not a shared-routing flag.
-- `auth.getJwks` fetches public keys and caches them.
-- `auth.validateJwt` performs local payload checks/expiry validation.
-
-## 6. Caching and Resilience
-
-- Encrypted in-memory cache used for selected short-lived values (JWT, portal/session-related caches).
-- Circuit breaker support exists in transport/cache layer.
-- Retry with backoff is applied for transient request failures and mint flow.
-
-## 7. Streaming and Binary Paths
-
-- SSE: `streamRequest()` in client, used by AI streaming methods.
-- Multipart binary upload: `binaryUpload()`.
-- Binary download to `Buffer`: `binaryDownload()`.
-
-## 8. Speech APIs
-
-Speech routes are owned by agent-runtime through the `dominus.ai` namespace:
-
-- `dominus.ai.stt(audio, options?)` -> `POST /api/agent/stt`
-- `dominus.ai.tts(text, options?)` -> `POST /api/agent/tts`
-
-The legacy streaming STT namespace (`dominus.stt`) is retired in hard cutover.
-
-## 9. Documentation Topology
-
-Canonical documentation set for this repository:
-
-- [README.md](../README.md): overview and usage entry
-- [CLAUDE.md](../CLAUDE.md): agent conventions for this repo
-- [usage-reference.md](./usage-reference.md): exhaustive namespaced command reference
-- [routes-services.md](./routes-services.md): service and endpoint assessment
-
-## 10. Known Gaps
-
-- The hand-maintained command/namespace counts in `routes-services.md` and
-  `usage-reference.md` can drift from source; re-derive from `src/namespaces/*.ts`
-  and `src/index.ts` before quoting them.
+# SDK Architecture
+
+This document describes how `dominus-sdk-nodejs` is structured and how requests flow from namespace methods to backend services.
+
+## 1. Public Surface
+
+- Entry point: `src/index.ts`
+- Singleton export: `dominus`
+- Public API composition:
+  - Namespace properties (`dominus.auth`, `dominus.db`, `dominus.ai`, ...)
+  - Root shortcuts for common operations (`get`, `upsert`, `listTables`, `queryTable`, `addTable`, etc.)
+  - Utility exports (errors, crypto helpers, cache utilities, JWT helpers)
+
+## 2. Layering
+
+- Namespace layer (`src/namespaces/*`)
+  - Maps method calls to concrete API routes
+  - Translates ergonomic SDK params to backend payload shape
+  - Minimal orchestration and convenience wrappers
+- Transport layer (`src/lib/client.ts`)
+  - Auth token selection (service JWT vs user JWT)
+  - Request encoding/decoding protocol
+  - Retries, timeout handling, circuit breaker checks
+  - SSE streaming and binary upload/download support
+- Support libraries (`src/lib/*`)
+  - `cache.ts`: encrypted in-memory cache + circuit breaker primitives
+  - `errors.ts`: typed SDK errors
+  - `config.ts`: env/config resolution
+  - `console-capture.ts`: optional console forwarding to logs
+  - `page-rules.ts`, `user-session.ts`: local portal/session acceleration
+
+## 2a. Storage layer positioning
+
+`dominus.stash.*` is the **primary storage surface**. Applications store named-kind data through Stash and the kind registry routes each kind to the right backend; callers address data by what it *is* (`kind` + `scope` + `key`), not by which primitive holds it. The primitive namespaces (`redis`, `db`, `files`) and the addressed `artifacts` helpers remain as building blocks — they are not deprecated and are never removed — but they are rarely targeted directly for application data.
+
+This is the **Two-Layer Storage Rule**: applications store named-kind data via Stash; primitives are used directly only for ephemera (locks, queues, cache) or when building a kernel backend.
+
+| Your data | Use | Why |
+|---|---|---|
+| Named, durable data of a registered kind (artifacts, conversations, configs, recipes, secrets) | `dominus.stash.*` | Primary surface; the kind registry routes to the right backend and policy. |
+| A direct `ar://`-addressed artifact workflow (you already hold a canonical ref) | `dominus.artifacts.*` | Escape hatch for explicit Artifact V2 addressing; prefer a Stash `artifact-v2`-backed kind for new code. |
+| Locks, queues, rate counters, short-lived cache — ephemera | `dominus.redis.*` | Building block for ephemeral state; named data belongs in Stash. |
+| Building a new kernel backend or a documented migration fallback | primitives (`redis`, `db`, `files`) | The lowest layer; not the place for ordinary application data. |
+
+## 3. Request Lifecycle
+
+1. Caller invokes namespace method.
+2. Namespace builds request options (`endpoint`, `method`, `body`, `useGateway`, optional `userToken`).
+3. `DominusClient` resolves auth context:
+   - if `userToken` provided: uses caller token
+   - otherwise: ensures service JWT exists (PSK -> `/jwt/mint`, cached)
+4. Request payload is serialized to JSON, then base64-encoded for Dominus wire protocol.
+5. HTTP request is sent.
+6. Response body is decoded from base64 and parsed.
+7. Errors are mapped to SDK error types.
+
+## 4. Routing Model
+
+- Namespace code generally targets `/api/*` endpoints.
+- For methods with `useGateway: true`, client route transform maps `/api/*` to gateway `/svc/*` dispatch paths.
+- Some methods intentionally use direct fetch paths (for example health checks/JWKS fetch).
+
+See [routes-services.md](./routes-services.md) for full route/service assessment.
+
+## 5. Auth and Token Handling
+
+### Service token flow
+
+- Input: `DOMINUS_TOKEN` (PSK)
+- Client exchanges PSK for short-lived JWT via gateway auth route.
+- JWT is cached with refresh buffer and refresh mutex to avoid thundering herd under concurrency.
+
+### User token flow
+
+- Methods that accept `userToken` pass caller JWT through unchanged.
+- Backend performs authorization checks for the user context.
+
+### Local JWT utilities
+
+- `verifyJwtLocally`, `isJwtValid`, and `mintSelectedScopeJwt` are exported from `src/lib/client.ts`. Selected-scope targeting is now the only supported SDK helper vocabulary.
+- `mintSelectedScopeJwt(targetOrgId, targetEnv)` is the canonical selected-scope mint helper; the live `/jwt/mint` contract keys selected scope off org plus environment, not a shared-routing flag.
+- `auth.getJwks` fetches public keys and caches them.
+- `auth.validateJwt` performs local payload checks/expiry validation.
+
+## 6. Caching and Resilience
+
+- Encrypted in-memory cache used for selected short-lived values (JWT, portal/session-related caches).
+- Circuit breaker support exists in transport/cache layer.
+- Retry with backoff is applied for transient request failures and mint flow.
+
+## 7. Streaming and Binary Paths
+
+- SSE: `streamRequest()` in client, used by AI streaming methods.
+- Multipart binary upload: `binaryUpload()`.
+- Binary download to `Buffer`: `binaryDownload()`.
+
+## 8. Speech APIs
+
+Speech routes are owned by agent-runtime through the `dominus.ai` namespace:
+
+- `dominus.ai.stt(audio, options?)` -> `POST /api/agent/stt`
+- `dominus.ai.tts(text, options?)` -> `POST /api/agent/tts`
+
+The legacy streaming STT namespace (`dominus.stt`) is retired in hard cutover.
+
+## 9. Documentation Topology
+
+Canonical documentation set for this repository:
+
+- [README.md](../README.md): overview and usage entry
+- [CLAUDE.md](../CLAUDE.md): agent conventions for this repo
+- [usage-reference.md](./usage-reference.md): exhaustive namespaced command reference
+- [routes-services.md](./routes-services.md): service and endpoint assessment
+
+## 10. Known Gaps
+
+- The hand-maintained command/namespace counts in `routes-services.md` and
+  `usage-reference.md` can drift from source; re-derive from `src/namespaces/*.ts`
+  and `src/index.ts` before quoting them.

package/docs/atlas/2026-07-24-1231-sdk-nodejs-blockers.md

@@ -1,15 +1,15 @@
-# Atlas Blockers: dominus-sdk-nodejs
-
-Generated: 2026-07-24 12:31 EDT
-
-## Blockers
-
-| ID | Blocker | Evidence | Likely owner | Workaround | Attack with |
-|---|---|---|---|---|---|
-| B1 | Docs/agent-guide may lag HEAD | Agent-guide snapshot(s) 2026-06-27-0849 — verify vs HEAD commits.; HEAD `8f41170` | `kyle-janitor` | Prefer code + CLAUDE | `kyle-janitor` |
-| B2 | Local tests not executed this pass | Docs-only atlas | CI | Run before behavior changes | Local/CI |
-
-## Recommended next skill
-
-1. `kyle-janitor` — refresh agent-guide if stale vs HEAD.
-2. Behavior defects → `kyle-diagnose` / owning expert skill.
+# Atlas Blockers: dominus-sdk-nodejs
+
+Generated: 2026-07-24 12:31 EDT
+
+## Blockers
+
+| ID | Blocker | Evidence | Likely owner | Workaround | Attack with |
+|---|---|---|---|---|---|
+| B1 | Docs/agent-guide may lag HEAD | Agent-guide snapshot(s) 2026-06-27-0849 — verify vs HEAD commits.; HEAD `8f41170` | `kyle-janitor` | Prefer code + CLAUDE | `kyle-janitor` |
+| B2 | Local tests not executed this pass | Docs-only atlas | CI | Run before behavior changes | Local/CI |
+
+## Recommended next skill
+
+1. `kyle-janitor` — refresh agent-guide if stale vs HEAD.
+2. Behavior defects → `kyle-diagnose` / owning expert skill.

package/docs/atlas/2026-07-24-1231-sdk-nodejs-proof-ladder.md

@@ -1,25 +1,25 @@
-# Atlas Proof Ladder: dominus-sdk-nodejs
-
-## Local Proof
-
-| Command | Expected signal | Status |
-|---|---|---|
-| `git status -sb` | Clean production branch @ `8f41170` | Observed via gather |
-| Test / typecheck | Pass | NOT RUN this pass |
-
-## CI / Release Proof
-
-| Surface | Expected signal | Status |
-|---|---|---|
-| Repo deploy workflows | Green on production branch pushes | Not re-run this pass |
-
-## Deploy / Live Proof
-
-| Surface | Expected signal | Status |
-|---|---|---|
-| Service health / package publish | Live or published artifact | Not probed this pass |
-
-## Positive vs No-Regression
-
-- **Positive:** Atlas pack exists at HEAD `8f41170` with dated proof pointers.
-- **No-regression:** Do not “fix” docs by reverting recent behavioral commits listed in the truthmap log.
+# Atlas Proof Ladder: dominus-sdk-nodejs
+
+## Local Proof
+
+| Command | Expected signal | Status |
+|---|---|---|
+| `git status -sb` | Clean production branch @ `8f41170` | Observed via gather |
+| Test / typecheck | Pass | NOT RUN this pass |
+
+## CI / Release Proof
+
+| Surface | Expected signal | Status |
+|---|---|---|
+| Repo deploy workflows | Green on production branch pushes | Not re-run this pass |
+
+## Deploy / Live Proof
+
+| Surface | Expected signal | Status |
+|---|---|---|
+| Service health / package publish | Live or published artifact | Not probed this pass |
+
+## Positive vs No-Regression
+
+- **Positive:** Atlas pack exists at HEAD `8f41170` with dated proof pointers.
+- **No-regression:** Do not “fix” docs by reverting recent behavioral commits listed in the truthmap log.

package/docs/atlas/2026-07-24-1231-sdk-nodejs-truthmap.md

@@ -1,43 +1,43 @@
-# Atlas Truthmap: dominus-sdk-nodejs
-
-Generated: 2026-07-24 12:31 EDT
-
-Target repo: `C:\developer\codingroot\repos\dominus_active\dominus-sdk-nodejs`
-
-Branch/status: `## production...origin/production [behind 4]
-?? _worktrees/`
-HEAD: `8f41170dc3bf2eda08195031ab2d956c127a7a34`
-
-## Executive Truth
-
-- TypeScript/ESM SDK for Dominus platform services.
-- Production truth checked at `8f41170` on the repo's production branch after ff-pull when available.
-- Sample code surfaces: `src/index.ts`, `src/contracts/versioned-storage.ts`, `src/lib/cache.ts`, `src/lib/client.ts`, `src/lib/config.ts`, `src/lib/console-capture.ts`, `src/lib/conversation-format.ts`, `src/lib/crypto.ts`, `src/lib/errors.ts`, `src/lib/page-rules.ts`, `src/lib/schema-builder.ts`, `src/lib/trace.ts`.
-- Recent commits:
-- `8f41170 feat(db): hard-cut provisioning verify to capabilities`
-- `3d60ff8 Release SDK 7.3.0: dominus.db.verifyProvisioning (required-provisioning probe)`
-- `cd35f90 feat: browser session-capture fields on ensureRun (storageState, sessionSlotId, sessionArtifactRef)`
-- `563eca4 Release SDK 7.1.0: per-call seed/bootstrap timeouts + service-JWT force refresh`
-- `2a2d4d7 Release Node SDK Authority verdict API`
-- `ffaef8a docs: clarify routes-services.md namespace counts (#2)`
-- Agent-guide snapshot(s) 2026-06-27-0849 — verify vs HEAD commits.
-
-## Claim Map
-
-| Claim | Status | Strongest evidence | Freshness | Disproves / weakens |
-|---|---|---|---|---|
-| Repo purpose matches README/CLAUDE | PRESENT | README/CLAUDE heads | HEAD | — |
-| Agent-guide fully current vs HEAD | STALE/CHECK | dated guide vs recent log | guide dates | Prefer code |
-| Local test matrix green | UNKNOWN | not run this pass | — | Do not claim green |
-
-## Source Graph
-
-| Area | Code | Tests | Docs | Live/CI/deploy | Owner |
-|---|---|---|---|---|---|
-| Primary | code roots above | tests/ if present | README, CLAUDE, agent-guide | deploy workflows / wrangler / Cloud Run as applicable | maintainers |
-
-## Agent Read Order
-
-1. `CLAUDE.md` / `README.md`
-2. Primary entry module(s)
-3. This atlas when docs disagree with code
+# Atlas Truthmap: dominus-sdk-nodejs
+
+Generated: 2026-07-24 12:31 EDT
+
+Target repo: `C:\developer\codingroot\repos\dominus_active\dominus-sdk-nodejs`
+
+Branch/status: `## production...origin/production [behind 4]
+?? _worktrees/`
+HEAD: `8f41170dc3bf2eda08195031ab2d956c127a7a34`
+
+## Executive Truth
+
+- TypeScript/ESM SDK for Dominus platform services.
+- Production truth checked at `8f41170` on the repo's production branch after ff-pull when available.
+- Sample code surfaces: `src/index.ts`, `src/contracts/versioned-storage.ts`, `src/lib/cache.ts`, `src/lib/client.ts`, `src/lib/config.ts`, `src/lib/console-capture.ts`, `src/lib/conversation-format.ts`, `src/lib/crypto.ts`, `src/lib/errors.ts`, `src/lib/page-rules.ts`, `src/lib/schema-builder.ts`, `src/lib/trace.ts`.
+- Recent commits:
+- `8f41170 feat(db): hard-cut provisioning verify to capabilities`
+- `3d60ff8 Release SDK 7.3.0: dominus.db.verifyProvisioning (required-provisioning probe)`
+- `cd35f90 feat: browser session-capture fields on ensureRun (storageState, sessionSlotId, sessionArtifactRef)`
+- `563eca4 Release SDK 7.1.0: per-call seed/bootstrap timeouts + service-JWT force refresh`
+- `2a2d4d7 Release Node SDK Authority verdict API`
+- `ffaef8a docs: clarify routes-services.md namespace counts (#2)`
+- Agent-guide snapshot(s) 2026-06-27-0849 — verify vs HEAD commits.
+
+## Claim Map
+
+| Claim | Status | Strongest evidence | Freshness | Disproves / weakens |
+|---|---|---|---|---|
+| Repo purpose matches README/CLAUDE | PRESENT | README/CLAUDE heads | HEAD | — |
+| Agent-guide fully current vs HEAD | STALE/CHECK | dated guide vs recent log | guide dates | Prefer code |
+| Local test matrix green | UNKNOWN | not run this pass | — | Do not claim green |
+
+## Source Graph
+
+| Area | Code | Tests | Docs | Live/CI/deploy | Owner |
+|---|---|---|---|---|---|
+| Primary | code roots above | tests/ if present | README, CLAUDE, agent-guide | deploy workflows / wrangler / Cloud Run as applicable | maintainers |
+
+## Agent Read Order
+
+1. `CLAUDE.md` / `README.md`
+2. Primary entry module(s)
+3. This atlas when docs disagree with code

package/docs/atlas/2026-08-04-sdk-nodejs-blockers.md

@@ -1,12 +1,12 @@
-# Blocker map: dominus-sdk-nodejs
-
-Generated: 2026-08-04 local.
-
-| Item | Status | Interpretation |
-|---|---|---|
-| Linked worktree reconciliation | Open | Timeline v9 and secret-presence v10 branches need one explicit candidate selection. |
-| Production branch freshness | Addressed for snapshot | Docs are based on current `origin/production` tip `0e68c79`; main checkout remains preserved. |
-| Package release version | Candidate-dependent | Class D publication requires a new version not already present in the registry. |
-| Hosted service parity | Ongoing | SDK contract proof should be paired with the corresponding Gateway/worker contracts. |
-
-This is a coordination map, not a negative judgment on the feature branches.
+# Blocker map: dominus-sdk-nodejs
+
+Generated: 2026-08-04 local.
+
+| Item | Status | Interpretation |
+|---|---|---|
+| Linked worktree reconciliation | Open | Timeline v9 and secret-presence v10 branches need one explicit candidate selection. |
+| Production branch freshness | Addressed for snapshot | Docs are based on current `origin/production` tip `0e68c79`; main checkout remains preserved. |
+| Package release version | Candidate-dependent | Class D publication requires a new version not already present in the registry. |
+| Hosted service parity | Ongoing | SDK contract proof should be paired with the corresponding Gateway/worker contracts. |
+
+This is a coordination map, not a negative judgment on the feature branches.

package/docs/atlas/2026-08-04-sdk-nodejs-proof-ladder.md

@@ -1,9 +1,9 @@
-# Proof ladder: dominus-sdk-nodejs
-
-| Layer | Evidence | Audit result / next proof |
-|---|---|---|
-| Source map | README, package entry, namespaces, tests, publish workflow | Production snapshot mapped at `0e68c79`. |
-| Build/type proof | `npm run build`; `npm run test:types` | Passed on the production snapshot with the temporary release version. |
-| Runtime suite | `npm test` | 106 Node tests passed after `npm ci` in the isolated snapshot. Linked worktree feature lines were not merged in this pass. |
-| Registry publish | `publish-production.yml` | Production push targets new package version 10.0.1; registry check found that version absent. |
-| Service behavior | Gateway/worker contract evidence | SDK tests do not establish current hosted server behavior. |
+# Proof ladder: dominus-sdk-nodejs
+
+| Layer | Evidence | Audit result / next proof |
+|---|---|---|
+| Source map | README, package entry, namespaces, tests, publish workflow | Production snapshot mapped at `0e68c79`. |
+| Build/type proof | `npm run build`; `npm run test:types` | Passed on the production snapshot with the temporary release version. |
+| Runtime suite | `npm test` | 106 Node tests passed after `npm ci` in the isolated snapshot. Linked worktree feature lines were not merged in this pass. |
+| Registry publish | `publish-production.yml` | Production push targets new package version 10.0.1; registry check found that version absent. |
+| Service behavior | Gateway/worker contract evidence | SDK tests do not establish current hosted server behavior. |

package/docs/atlas/2026-08-04-sdk-nodejs-truthmap.md

@@ -1,21 +1,21 @@
-# Atlas truth map: dominus-sdk-nodejs
-
-Generated: 2026-08-04 local. Production snapshot: `0e68c79`.
-
-| Concern | Strongest source | Current truth |
-|---|---|---|
-| Package contract | `package.json`, `src/index.ts` | ESM package version 10.0.0 in the production snapshot, root export only, Node >=18. |
-| Namespace surface | `src/` and public export tests | Broad typed facades for gateway-first Dominus services. |
-| Workflow | workflow namespace and tests | Authority-backed `ensure` lifecycle is preferred over the retired saved-workflow chain. |
-| Timeline/archive | Authority and Logs namespaces | Timeline truth, archive status, bounded archive/repair/verify/prune helpers. |
-| Secret/admin | secret and admin namespaces | Safe presence grids/previews and persisted root-role reads without secret values. |
-| Gateway contracts | client/transport helpers and contract tests | Base64/text envelope, route transforms, typed errors, actor/per-call controls. |
-| Release | `publish-production.yml` | Production branch publishes the package to the configured registry. |
-
-## Preserved local work
-
-Repo-local worktrees cover a timeline contract v9 line that retires the company
-query option after adding a target filter, and a secret-presence-grid v10 line
-that adds safe presence data, persisted root-role exposure, and code-point-aware
-preview counting. Reconciled/release branches carry those changes, while the
-main checkout was left untouched for this docs pass.
+# Atlas truth map: dominus-sdk-nodejs
+
+Generated: 2026-08-04 local. Production snapshot: `0e68c79`.
+
+| Concern | Strongest source | Current truth |
+|---|---|---|
+| Package contract | `package.json`, `src/index.ts` | ESM package version 10.0.0 in the production snapshot, root export only, Node >=18. |
+| Namespace surface | `src/` and public export tests | Broad typed facades for gateway-first Dominus services. |
+| Workflow | workflow namespace and tests | Authority-backed `ensure` lifecycle is preferred over the retired saved-workflow chain. |
+| Timeline/archive | Authority and Logs namespaces | Timeline truth, archive status, bounded archive/repair/verify/prune helpers. |
+| Secret/admin | secret and admin namespaces | Safe presence grids/previews and persisted root-role reads without secret values. |
+| Gateway contracts | client/transport helpers and contract tests | Base64/text envelope, route transforms, typed errors, actor/per-call controls. |
+| Release | `publish-production.yml` | Production branch publishes the package to the configured registry. |
+
+## Preserved local work
+
+Repo-local worktrees cover a timeline contract v9 line that retires the company
+query option after adding a target filter, and a secret-presence-grid v10 line
+that adds safe presence data, persisted root-role exposure, and code-point-aware
+preview counting. Reconciled/release branches carry those changes, while the
+main checkout was left untouched for this docs pass.

package/docs/atlas/INDEX.md

@@ -1,26 +1,26 @@
-# Atlas Index
-
-Last updated: 2026-08-04 local
-
-Latest snapshot:
-[truthmap](2026-08-04-sdk-nodejs-truthmap.md),
-[proof ladder](2026-08-04-sdk-nodejs-proof-ladder.md), and
-[blockers](2026-08-04-sdk-nodejs-blockers.md).
-
-## Current Truth Owners
-
-| Area | Strongest source | Notes |
-|---|---|---|
-| Public package | `package.json`, `src/index.ts`, `dist/` build | One root export: `dominus-sdk-nodejs`; no subpath exports. |
-| Namespace APIs | `src/` | Auth, DB/DDL, files/stash, AI/runtime, browser, jobs, workflow, Authority, logs, platform, publisher, admin, and control-plane facades. |
-| Workflow lifecycle | `src/namespaces/workflow*`, Authority namespace | Authority-backed `workflow.ensure` is preferred; saved-workflow legacy chain is retired. |
-| Secret/admin surfaces | `src/namespaces/secrets*`, admin namespace | Safe presence/preview and persisted root-role surfaces avoid returning secret values. |
-| Runtime transport | shared gateway/client helpers in `src/` | Gateway-first route transforms, typed error/wire contracts, and per-call controls. |
-| Publish | `.github/workflows/publish-production.yml` | Registry package publication on the `production` lane. |
-
-## Preserved local work
-
-The main checkout is clean in tracked files but has four repo-local linked
-worktrees: Authority timeline contract v9 and three secret-presence-grid
-reconciled/release lines. The high-level path for that work is in the pending
-summary; the implementation was not merged or modified here.
+# Atlas Index
+
+Last updated: 2026-08-04 local
+
+Latest snapshot:
+[truthmap](2026-08-04-sdk-nodejs-truthmap.md),
+[proof ladder](2026-08-04-sdk-nodejs-proof-ladder.md), and
+[blockers](2026-08-04-sdk-nodejs-blockers.md).
+
+## Current Truth Owners
+
+| Area | Strongest source | Notes |
+|---|---|---|
+| Public package | `package.json`, `src/index.ts`, `dist/` build | One root export: `dominus-sdk-nodejs`; no subpath exports. |
+| Namespace APIs | `src/` | Auth, DB/DDL, files/stash, AI/runtime, browser, jobs, workflow, Authority, logs, platform, publisher, admin, and control-plane facades. |
+| Workflow lifecycle | `src/namespaces/workflow*`, Authority namespace | Authority-backed `workflow.ensure` is preferred; saved-workflow legacy chain is retired. |
+| Secret/admin surfaces | `src/namespaces/secrets*`, admin namespace | Safe presence/preview and persisted root-role surfaces avoid returning secret values. |
+| Runtime transport | shared gateway/client helpers in `src/` | Gateway-first route transforms, typed error/wire contracts, and per-call controls. |
+| Publish | `.github/workflows/publish-production.yml` | Registry package publication on the `production` lane. |
+
+## Preserved local work
+
+The main checkout is clean in tracked files but has four repo-local linked
+worktrees: Authority timeline contract v9 and three secret-presence-grid
+reconciled/release lines. The high-level path for that work is in the pending
+summary; the implementation was not merged or modified here.