@bugmole/cli 0.5.0 → 0.6.0

package/src/registry-worker/feature-flags/routes.ts

@@ -0,0 +1,102 @@
+// GET /api/workspaces/:id/features — what the dashboard may show a member:
+// every feature, whether it is on for this workspace, why, and the plan that
+// would unlock it. Read-only; changes go through the platform routes in admin.ts.
+import { PLANS } from "../../billing/plan-catalog.js";
+import { memberOfWorkspace, response } from "../core.js";
+import type { Env } from "../core.js";
+import { entitlementMode } from "../billing/enforcement.js";
+import { usageSummary } from "../billing/ledger.js";
+import {
+  type EffectiveFeatures,
+  type FeatureState,
+  type LimitKey,
+  type LimitState,
+  effectiveFeatures,
+  limitsFor,
+  planSource,
+} from "../feature-access.js";
+import { FEATURES, FEATURE_DEFS, type Feature } from "../flags.js";
+import { type AuthedRouteContext, matchPath, registerRoutes } from "../routes/index.js";
+
+export type FeatureView = {
+  feature: Feature;
+  label: string;
+  enabled: boolean;
+  reason: FeatureState["reason"];
+  /** Cheapest plan that includes it; null when it isn't plan-gated. */
+  requiredPlan: string | null;
+  /** The plan-catalog key (as in GET /usage limits.features), when plan-gated. */
+  planFeature: string | null;
+  /** Set when a workspace override decided and it lapses. */
+  expiresAt: string | null;
+};
+
+export function featureView(state: FeatureState): FeatureView {
+  const def = FEATURE_DEFS[state.feature];
+  return {
+    feature: state.feature,
+    label: def.label,
+    enabled: state.enabled,
+    reason: state.reason,
+    requiredPlan: state.requiredPlan ?? null,
+    planFeature: def.planFeature ?? null,
+    expiresAt: state.reason === "workspace_override" ? state.overrideExpiresAt ?? null : null,
+  };
+}
+
+export type LimitUsage = Partial<Record<LimitKey, number>>;
+
+export function featuresBody(workspaceId: string, evaluated: EffectiveFeatures, used: LimitUsage = {}, limitsEnforced: "enforce" | "shadow" | "off" = "enforce") {
+  const features = Object.fromEntries(FEATURES.map((feature) => [feature, featureView(evaluated.features[feature])])) as Record<Feature, FeatureView>;
+  const planFeatures = Object.fromEntries(
+    Object.values(features).filter((view) => view.planFeature).map((view) => [view.planFeature, view]),
+  ) as Record<string, FeatureView>;
+  return {
+    workspaceId,
+    plan: { id: evaluated.plan.plan, name: PLANS[evaluated.plan.plan].name, status: evaluated.plan.status },
+    source: planSource(evaluated.plan),
+    features,
+    planFeatures,
+    limits: Object.fromEntries(Object.entries(limitsFor(evaluated.plan)).map(([key, state]) => {
+      const usedValue = used[key as LimitKey];
+      return [key, usedValue === undefined ? state : { ...state, used: usedValue }];
+    })) as Record<LimitKey, LimitState>,
+    /** "enforce" unless FEATURE_ENTITLEMENTS (or an override) has limits in shadow mode or off. */
+    limitsEnforced,
+  };
+}
+
+/** Current usage against the limits that have a meter: projects, cloud minutes and AI credits this period. */
+export async function limitUsage(env: Env, workspaceId: string): Promise<LimitUsage> {
+  const [{ summary }, projects] = await Promise.all([
+    usageSummary(env, workspaceId),
+    // Paused (inactive) projects don't count toward the limit.
+    env.DB.prepare("SELECT COUNT(*) AS count FROM projects WHERE workspace_id = ? AND deleted_at IS NULL AND inactive_at IS NULL")
+      .bind(workspaceId).first<{ count: number }>(),
+  ]);
+  return {
+    projects: projects?.count ?? 0,
+    cloudMinutes: summary.lines.browser_minute.used,
+    aiCredits: summary.lines.ai_credit.used,
+  };
+}
+
+export async function workspaceFeatures(env: Env, workspaceId: string) {
+  const [evaluated, used, mode] = await Promise.all([
+    effectiveFeatures(env, workspaceId),
+    limitUsage(env, workspaceId),
+    entitlementMode(env, workspaceId),
+  ]);
+  return featuresBody(workspaceId, evaluated, used, mode);
+}
+
+async function getFeatures({ env, principal }: AuthedRouteContext, workspaceId: string): Promise<Response> {
+  if (!(await memberOfWorkspace(env, principal, workspaceId))) return response({ error: "Workspace scope is not allowed" }, 403);
+  return response(await workspaceFeatures(env, workspaceId));
+}
+
+registerRoutes(async (context) => {
+  const params = matchPath(context.url.pathname, "/api/workspaces/:workspaceId/features");
+  if (params && context.request.method === "GET") return getFeatures(context, params.workspaceId);
+  return null;
+});

package/src/registry-worker/features.ts

@@ -5,6 +5,7 @@ import "./billing/routes.js";
 import "./jobs/retention.js";
 import "./ai/routes.js";
 import "./runner/routes.js";
+import "./proposals/routes.js";
 import "./signup/routes.js";
 import "./signup/attribution.js";
 import "./billing/checkout-routes.js";
@@ -14,9 +15,17 @@ import "./notifications/routes.js";
 import "./github/checks.js";
 import "./gitlab/checks.js";
 import "./personas/routes.js";
+import "./roles/routes.js";
+import "./secrets/routes.js";
+import "./identity/oidc.js";
 import "./feedback/routes.js";
 import "./feedback/website.js";
 import "./devices/routes.js";
 import "./domains/routes.js";
 import "./sso/routes.js";
 import "./mcp/routes.js";
+import "./jira/routes.js";
+import "./feature-flags/routes.js";
+import "./feature-flags/admin.js";
+import "./projects/identity.js";
+import "./projects/inactivity.js";

package/src/registry-worker/feedback/routes.ts

@@ -6,7 +6,7 @@ import { githubAppConfigured, githubRequest, GithubAppError, type GithubAppEnv }
 import type { Env, Principal } from "../core.js";
 import { constantTimeEqual, newId, requestJson, response, sha256 } from "../core.js";
 import { getWorkspacePlan } from "../billing/entitlements.js";
-import { flagOn } from "../flags.js";
+import { featureEnabled } from "../feature-access.js";
 import { recordAudit } from "../org/audit.js";
 import { drainSoon, enqueue, PermanentDeliveryError, registerOutboxHandler } from "../notifications/outbox.js";
 import { matchPath, registerPublicRoutes, registerRoutes, type AuthedRouteContext } from "../routes/index.js";
@@ -174,7 +174,7 @@ async function submit({ env, principal, request, ctx }: AuthedRouteContext): Pro
     await recordAudit(env, { type: "user", id: principal.aegisId }, { workspaceId: workspace.id, projectId: project?.id ?? null, action: "feedback.submitted", targetType: "feedback", targetId: id, data: { kind } }, request);
   }
 
-  if (await flagOn(env, workspace?.id ?? null, "feedback")) {
+  if (await featureEnabled(env, workspace?.id ?? null, "feedback")) {
     const since = new Date(Date.now() - DUPLICATE_WINDOW_MS).toISOString().replace("T", " ").slice(0, 19);
     const original = await env.DB.prepare(`
       SELECT id, github_issue_number AS issue FROM feedback_reports

package/src/registry-worker/flags.ts

@@ -1,8 +1,15 @@
-// Feature flags for the gap-closing rollout. A global var turns a feature on
-// for everyone ("on"), or leaves it to per-workspace opt-in ("beta", the
-// default); "off" disables it even for opted-in workspaces.
+// The feature catalog and its global rollout switches. A FEATURE_<NAME> var
+// turns a feature on for everyone ("on"), leaves it to per-workspace opt-in
+// ("beta"), or kills it everywhere ("off"; "shadow" also counts as off for
+// access, and only changes how the entitlements feature enforces limits).
+//
+// Whether a feature is usable by a workspace is decided in one place,
+// feature-access.ts: kill switch → beta opt-in → workspace override → plan.
+// See docs/feature-flags.md.
+import type { PlanFeatures } from "../billing/plan-catalog.js";
 
 export const FEATURES = [
+  // Rollout flags from the gap-closing launch. Unset, they default to "beta".
   "entitlements",
   "cloud_runners",
   "billing",
@@ -13,27 +20,82 @@ export const FEATURES = [
   "sso",
   "feedback",
   "mcp",
+  // Plan features from the pricing matrix. Unset, they default to "on": the
+  // plan decides, and the var exists only as a kill switch.
+  "ai_fixes",
+  "scim",
+  "audit_export",
+  "priority_support",
+  "self_hosted_workers",
+  // Included in every plan (the pricing page's all-plans rows). Always on
+  // unless killed; no gate reads them yet beyond the evaluator.
+  "unlimited_users",
+  "unlimited_local_runs",
+  "desktop_browsers",
+  "emulated_mobile",
+  "ai_failure_analysis",
 ] as const;
 export type Feature = (typeof FEATURES)[number];
 
-export type FlagEnv = {
-  DB: D1Database;
-  [key: `FEATURE_${string}`]: string | undefined;
+export type FlagMode = "on" | "beta" | "off" | "shadow";
+
+export type FeatureDef = {
+  label: string;
+  /** Mode when FEATURE_<NAME> is unset. */
+  defaultMode: FlagMode;
+  /** The plan-catalog feature that gates it; features without one are on every plan. */
+  planFeature?: keyof PlanFeatures;
 };
 
-export type FlagMode = "on" | "beta" | "off" | "shadow";
+export const FEATURE_DEFS: Record<Feature, FeatureDef> = {
+  entitlements: { label: "Plan limits", defaultMode: "beta" },
+  cloud_runners: { label: "Bugmole Cloud runs", defaultMode: "beta" },
+  billing: { label: "Self-serve billing", defaultMode: "beta" },
+  pr_checks: { label: "Pull and merge request checks", defaultMode: "beta", planFeature: "prChecks" },
+  slack: { label: "Slack alerts", defaultMode: "beta", planFeature: "slack" },
+  teams: { label: "Microsoft Teams alerts", defaultMode: "beta", planFeature: "teams" },
+  device_clouds: { label: "Real devices and device clouds", defaultMode: "beta", planFeature: "deviceClouds" },
+  sso: { label: "Single sign-on", defaultMode: "beta", planFeature: "sso" },
+  feedback: { label: "Feedback to GitHub issues", defaultMode: "beta" },
+  mcp: { label: "Hosted MCP", defaultMode: "beta" },
+  ai_fixes: { label: "AI test repair", defaultMode: "on", planFeature: "aiFixes" },
+  scim: { label: "SCIM provisioning", defaultMode: "on", planFeature: "scim" },
+  audit_export: { label: "Audit log export and full history", defaultMode: "on", planFeature: "auditLogExport" },
+  priority_support: { label: "Priority support", defaultMode: "on", planFeature: "prioritySupport" },
+  self_hosted_workers: { label: "Self-hosted cloud workers", defaultMode: "on", planFeature: "selfHostedWorkers" },
+  unlimited_users: { label: "Unlimited users", defaultMode: "on", planFeature: "unlimitedUsers" },
+  unlimited_local_runs: { label: "Unlimited local & CI runs", defaultMode: "on", planFeature: "unlimitedLocalRuns" },
+  desktop_browsers: { label: "Chrome, Firefox, Safari & Edge", defaultMode: "on", planFeature: "desktopBrowsers" },
+  emulated_mobile: { label: "Emulated iPhone & Android", defaultMode: "on", planFeature: "emulatedMobile" },
+  ai_failure_analysis: { label: "AI failure analysis", defaultMode: "on", planFeature: "aiFailureAnalysis" },
+};
+
+/**
+ * Operational flags: rollout and platform switches with no pricing-table row.
+ * The catalog's `extras.*` (Enterprise contract terms) are descriptive and
+ * never enforced, so they have no flags.
+ * Every other feature maps 1:1 to a plan-catalog `features.*` key through
+ * FEATURE_DEFS[feature].planFeature — this table is the one mapping between
+ * flag names and catalog keys (flags.test.ts fails if either side drifts).
+ */
+export const OPERATIONAL_FEATURES = ["entitlements", "cloud_runners", "billing", "feedback", "mcp"] as const satisfies readonly Feature[];
 
-export function flagMode(env: FlagEnv, feature: Feature): FlagMode {
-  const raw = (env[`FEATURE_${feature.toUpperCase()}`] ?? "beta").trim().toLowerCase();
-  return raw === "on" || raw === "off" || raw === "shadow" ? raw : "beta";
+export function isFeature(value: unknown): value is Feature {
+  return typeof value === "string" && (FEATURES as readonly string[]).includes(value);
 }
 
-export async function flagOn(env: FlagEnv, workspaceId: string | null | undefined, feature: Feature): Promise<boolean> {
-  const mode = flagMode(env, feature);
-  if (mode === "on") return true;
-  if (mode === "off" || mode === "shadow" || !workspaceId) return false;
-  const row = await env.DB.prepare(
-    "SELECT enabled FROM workspace_flags WHERE workspace_id = ? AND flag = ?",
-  ).bind(workspaceId, feature).first<{ enabled: number }>();
-  return row?.enabled === 1;
+/** The feature a plan-catalog key belongs to (e.g. "auditLogExport" → "audit_export"). */
+export function featureForPlanKey(key: string): Feature | null {
+  return FEATURES.find((feature) => FEATURE_DEFS[feature].planFeature === key) ?? null;
+}
+
+export type FlagEnv = {
+  DB: D1Database;
+  [key: `FEATURE_${string}`]: string | undefined;
+};
+
+export function flagMode(env: Omit<FlagEnv, "DB">, feature: Feature): FlagMode {
+  const raw = env[`FEATURE_${feature.toUpperCase()}`]?.trim().toLowerCase();
+  if (raw === "on" || raw === "off" || raw === "shadow" || raw === "beta") return raw;
+  return FEATURE_DEFS[feature].defaultMode;
 }

package/src/registry-worker/github/checks.ts

@@ -7,8 +7,8 @@
 import { createCheckRun, githubAppConfigured, GithubAppError, updateCheckRun, type CheckRunUpdate, type GithubAppEnv } from "../../integrations/github-app.js";
 import type { Env, Principal } from "../core.js";
 import { memberOfProject, newId, requestJson, response } from "../core.js";
-import { getEntitlements, workspaceOfProject } from "../billing/entitlements.js";
-import { flagOn } from "../flags.js";
+import { workspaceOfProject } from "../billing/entitlements.js";
+import { featureEnabled } from "../feature-access.js";
 import { runChangedHooks, runService, type InternalRunFields } from "../hooks.js";
 import { auditProject } from "../org/audit.js";
 import { enqueue, PermanentDeliveryError, registerOutboxHandler } from "../notifications/outbox.js";
@@ -52,8 +52,8 @@ export { previewUrl };
 /** GitLab's merge request checks share this gate — one PR/MR checks feature regardless of provider. */
 export async function prChecksOn(env: Env, projectId: string): Promise<boolean> {
   const workspaceId = await workspaceOfProject(env, projectId);
-  if (!workspaceId || !(await flagOn(env, workspaceId, "pr_checks"))) return false;
-  return (await getEntitlements(env, workspaceId)).features.prChecks;
+  if (!workspaceId) return false;
+  return featureEnabled(env, workspaceId, "pr_checks");
 }
 
 /** The binding's installation must still be connected to its project and cover the repo. */

package/src/registry-worker/hooks.ts

@@ -45,7 +45,16 @@ export type InternalRunFields = {
   prNumber?: number;
   githubInstallationId?: number;
   gitlabBindingId?: string;
+  /** A retest limited to some cases of one case set (a Jira ticket's case). */
+  caseScope?: RunCaseScope;
 };
+
+/** Which cases a run judges; absent for a run of the whole flow. */
+export type RunCaseScope = { caseSetId: string; caseIds: string[]; jiraIssueKey?: string };
+
+/** A test case proposal was accepted, rejected, or applied to storage. */
+export type ProposalDecided = { projectId: string; proposalId: string; status: string; applied: boolean };
+export const proposalDecidedHooks: Array<(env: Env, event: ProposalDecided) => Promise<void>> = [];
 export type RunCreator = (request: Request, env: Env, principal: import("./core.js").Principal, projectId: string, ctx: ExecutionContext, internal?: InternalRunFields) => Promise<Response>;
 /** Set by index.ts, so integrations can create runs through the same checks as the API. */
 export const runService: { create?: RunCreator } = {};

package/src/registry-worker/identity/oidc.test.ts

@@ -0,0 +1,103 @@
+import assert from "node:assert/strict";
+import { createPublicKey, createVerify, generateKeyPairSync } from "node:crypto";
+import test from "node:test";
+import { call, createTestEnv, seedPlan, seedProject, seedVerifiedDomain } from "../testing/harness.js";
+import { runnerLauncher, type LaunchRequest } from "../runner/dispatch.js";
+import { runnerMayCall } from "../runner/tokens.js";
+import { validAudience } from "./oidc.js";
+
+const { privateKey } = generateKeyPairSync("rsa", { modulusLength: 2048 });
+const PEM = privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+const BASE = { RUNNER_TOKEN_SECRET: "runner-test-secret", FEATURE_CLOUD_RUNNERS: "on", REGISTRY_PUBLIC_URL: "https://registry.test" };
+const PROVIDER = "//iam.googleapis.com/projects/123456/locations/global/workloadIdentityPools/bugmole/providers/bugmole";
+
+async function exploringProject(overrides: Record<string, string>) {
+  const launches: LaunchRequest[] = [];
+  const original = runnerLauncher.start;
+  runnerLauncher.start = async (_env, launch) => { launches.push(launch); };
+  const setup = createTestEnv({ ...BASE, ...overrides });
+  const project = await seedProject(setup.env, { storageProvider: "bugmole" });
+  await seedPlan(setup.env, project.projectId, project.owner);
+  seedVerifiedDomain(setup.db, project.workspaceId, "shop.test");
+  const created = await call(setup.env, "POST", `/api/projects/${project.projectId}/tasks`, {
+    as: project.owner,
+    body: { title: "Explore https://shop.test", description: "Explore https://shop.test", taskType: "discovery", idempotencyKey: "d1", executionMode: "cloud" },
+  });
+  assert.equal(created.status, 201);
+  return { ...setup, ...project, taskId: created.json.task.id as string, token: launches[0].token, restore: () => { runnerLauncher.start = original; } };
+}
+
+const decode = (part: string) => JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
+
+test("Bugmole publishes OIDC discovery and its signing key, and nothing when no key is set", async () => {
+  const { env } = createTestEnv({ ...BASE, OIDC_SIGNING_KEY: PEM });
+  const discovery = await call(env, "GET", "/.well-known/openid-configuration");
+  assert.equal(discovery.status, 200);
+  assert.equal(discovery.json.issuer, "https://api.bugmole.com");
+  assert.equal(discovery.json.jwks_uri, "https://api.bugmole.com/.well-known/jwks.json");
+  assert.deepEqual(discovery.json.id_token_signing_alg_values_supported, ["RS256"]);
+  const jwks = await call(env, "GET", "/.well-known/jwks.json");
+  assert.equal(jwks.json.keys.length, 1);
+  const [key] = jwks.json.keys;
+  assert.deepEqual(Object.keys(key).sort(), ["alg", "e", "kid", "kty", "n", "use"], "the public half only");
+  assert.equal(key.alg, "RS256");
+
+  const bare = createTestEnv(BASE).env;
+  assert.notEqual((await call(bare, "GET", "/.well-known/jwks.json")).status, 200);
+});
+
+test("a cloud runner gets a token its project's cloud can verify, for its own job only", async () => {
+  const { env, projectId, workspaceId, taskId, token, restore } = await exploringProject({ OIDC_SIGNING_KEY: PEM });
+  try {
+    const issued = await call(env, "GET", `/api/runner/tasks/${taskId}/identity-token?audience=${encodeURIComponent(PROVIDER)}`, { token });
+    assert.equal(issued.status, 200, JSON.stringify(issued.json));
+    const [header, payload, signature] = issued.json.token.split(".");
+    const claims = decode(payload);
+    assert.equal(claims.iss, "https://api.bugmole.com");
+    assert.equal(claims.sub, `project:${projectId}`);
+    assert.equal(claims.aud, PROVIDER);
+    assert.equal(claims.project_id, projectId);
+    assert.equal(claims.workspace_id, workspaceId);
+    assert.equal(claims.job_kind, "task");
+    assert.equal(claims.job_id, taskId);
+    assert.equal(claims.exp - claims.iat, 600, "ten minutes");
+
+    // Verified the way Google and AWS do: with the published JWKS, by kid.
+    const jwks = (await call(env, "GET", "/.well-known/jwks.json")).json.keys;
+    const jwk = jwks.find((key: { kid: string }) => key.kid === decode(header).kid);
+    assert.ok(jwk, "the token's kid is published");
+    const verifier = createVerify("RSA-SHA256").update(`${header}.${payload}`);
+    assert.equal(verifier.verify(createPublicKey({ key: jwk, format: "jwk" }), Buffer.from(signature, "base64url")), true);
+
+    assert.equal((await call(env, "GET", `/api/runner/tasks/${taskId}/identity-token?audience=sts.amazonaws.com`, { token })).status, 200);
+    assert.equal((await call(env, "GET", `/api/runner/tasks/${taskId}/identity-token?audience=ftp://nope`, { token })).status, 422);
+    assert.equal((await call(env, "GET", `/api/runner/tasks/${taskId}/identity-token`, { token })).status, 422);
+    assert.equal((await call(env, "GET", `/api/runner/tasks/other/identity-token?audience=sts.amazonaws.com`, { token })).status, 403);
+  } finally {
+    restore();
+  }
+});
+
+test("no signing key: the token route says so instead of failing", async () => {
+  const { env, taskId, token, restore } = await exploringProject({});
+  try {
+    const reply = await call(env, "GET", `/api/runner/tasks/${taskId}/identity-token?audience=sts.amazonaws.com`, { token });
+    assert.equal(reply.status, 503);
+    assert.equal(reply.json.code, "oidc_unconfigured");
+  } finally {
+    restore();
+  }
+});
+
+test("only the runner's own job may ask, and only the audiences a cloud uses", () => {
+  const run = { kind: "run" as const, id: "run_1", projectId: "shop", workspaceId: "acme" };
+  assert.equal(runnerMayCall(run, "GET", new URL("https://r/api/runner/runs/run_1/identity-token?audience=x")), true);
+  assert.equal(runnerMayCall(run, "GET", new URL("https://r/api/runner/runs/run_2/identity-token?audience=x")), false);
+  assert.equal(runnerMayCall(run, "POST", new URL("https://r/api/runner/runs/run_1/identity-token")), false);
+  assert.equal(validAudience(PROVIDER), true);
+  assert.equal(validAudience("sts.amazonaws.com"), true);
+  assert.equal(validAudience("https://vault.example.com"), true);
+  assert.equal(validAudience("//iam.googleapis.com/projects/abc/locations/global/workloadIdentityPools/x/providers/y"), false);
+  assert.equal(validAudience("http://insecure.example.com"), false);
+  assert.equal(validAudience(""), false);
+});

package/src/registry-worker/identity/oidc.ts

@@ -0,0 +1,176 @@
+// Bugmole Cloud as an OpenID Connect identity provider, so a cloud runner can
+// read a customer's own vault without anyone storing a key for it.
+//
+// The registry signs a short-lived token (RS256, ten minutes) for the one run
+// or exploration a runner holds: subject `project:<projectId>`, with the
+// audience the customer's cloud expects. The customer trusts this issuer once
+// (a Google Workload Identity pool, or an AWS IAM OIDC provider and role) and
+// the runner trades the token for credentials scoped to their secrets:
+//
+//   GET /.well-known/openid-configuration   discovery (public)
+//   GET /.well-known/jwks.json              the signing key's public half (public)
+//   GET /api/runner/{runs|tasks}/:id/identity-token?audience=…   the runner's token
+//
+// The private key is OIDC_SIGNING_KEY (an RSA PKCS#8 PEM, a Worker secret).
+// The key id is its RFC 7638 thumbprint, so rotating the key needs nothing
+// else: clouds fetch the JWKS again when they meet an unknown kid.
+import type { Env } from "../core.js";
+import { response } from "../core.js";
+import { auditProject } from "../org/audit.js";
+import { matchPath, registerPublicRoutes, registerRoutes, type AuthedRouteContext } from "../routes/index.js";
+import { cloudWorkerId } from "../runner/jobs.js";
+
+export const IDENTITY_TOKEN_TTL_SECONDS = 600;
+const DEFAULT_ISSUER = "https://api.bugmole.com";
+
+type OidcEnv = Env;
+
+export function oidcIssuer(env: OidcEnv): string {
+  return (env.OIDC_ISSUER || DEFAULT_ISSUER).replace(/\/+$/, "");
+}
+
+const encoder = new TextEncoder();
+
+function base64Url(bytes: Uint8Array | ArrayBuffer): string {
+  let binary = "";
+  for (const byte of new Uint8Array(bytes)) binary += String.fromCharCode(byte);
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+
+function pemBody(pem: string): Uint8Array {
+  const body = pem.replace(/-----(BEGIN|END) [A-Z ]+-----/g, "").replace(/\s+/g, "");
+  return Uint8Array.from(atob(body), (char) => char.charCodeAt(0));
+}
+
+type SigningKey = { privateKey: CryptoKey; publicJwk: JsonWebKey & { kid: string; use: string; alg: string } };
+
+let cached: { pem: string; key: Promise<SigningKey> } | null = null;
+
+/** The signing key and its public JWK, from OIDC_SIGNING_KEY; null when it isn't configured. */
+export function signingKey(env: OidcEnv): Promise<SigningKey> | null {
+  const pem = env.OIDC_SIGNING_KEY;
+  if (!pem) return null;
+  if (cached?.pem === pem) return cached.key;
+  const key = (async () => {
+    const algorithm = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" };
+    // Imported once extractable, only to publish its public half.
+    const extractable = await crypto.subtle.importKey("pkcs8", pemBody(pem), algorithm, true, ["sign"]);
+    const jwk = await crypto.subtle.exportKey("jwk", extractable) as JsonWebKey;
+    const { n, e } = jwk;
+    if (!n || !e) throw new Error("OIDC_SIGNING_KEY isn't an RSA key");
+    // RFC 7638 thumbprint: SHA-256 of the required members in lexical order.
+    const thumbprint = await crypto.subtle.digest("SHA-256", encoder.encode(JSON.stringify({ e, kty: "RSA", n })));
+    const privateKey = await crypto.subtle.importKey("pkcs8", pemBody(pem), algorithm, false, ["sign"]);
+    return { privateKey, publicJwk: { kty: "RSA", n, e, kid: base64Url(thumbprint), use: "sig", alg: "RS256" } };
+  })();
+  cached = { pem, key };
+  return key;
+}
+
+export type IdentityClaims = {
+  sub: string;
+  aud: string;
+  project_id: string;
+  workspace_id: string | null;
+  job_kind: "run" | "task";
+  job_id: string;
+};
+
+/** Signs an identity token for a runner's job. */
+export async function signIdentityToken(env: OidcEnv, claims: IdentityClaims, now = Date.now()): Promise<{ token: string; expiresAt: string }> {
+  const key = signingKey(env);
+  if (!key) throw new Error("OIDC_SIGNING_KEY is not configured");
+  const { privateKey, publicJwk } = await key;
+  const iat = Math.floor(now / 1000);
+  const header = { alg: "RS256", typ: "JWT", kid: publicJwk.kid };
+  const payload = { iss: oidcIssuer(env), iat, nbf: iat - 30, exp: iat + IDENTITY_TOKEN_TTL_SECONDS, jti: crypto.randomUUID(), ...claims };
+  const unsigned = `${base64Url(encoder.encode(JSON.stringify(header)))}.${base64Url(encoder.encode(JSON.stringify(payload)))}`;
+  const signature = await crypto.subtle.sign("RSASSA-PKCS1-v1_5", privateKey, encoder.encode(unsigned));
+  return { token: `${unsigned}.${base64Url(signature)}`, expiresAt: new Date((iat + IDENTITY_TOKEN_TTL_SECONDS) * 1000).toISOString() };
+}
+
+/**
+ * Audiences a cloud accepts: Google's Workload Identity provider
+ * (//iam.googleapis.com/projects/…/providers/…), AWS STS
+ * (sts.amazonaws.com), or an https URL of the customer's choosing.
+ */
+export function validAudience(audience: string): boolean {
+  if (!audience || audience.length > 512 || /\s/.test(audience)) return false;
+  if (audience === "sts.amazonaws.com") return true;
+  if (/^\/\/iam\.googleapis\.com\/projects\/\d+\/locations\/global\/workloadIdentityPools\/[a-z0-9-]+\/providers\/[a-z0-9-]+$/.test(audience)) return true;
+  try {
+    return new URL(audience).protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+
+const json = (body: unknown, cacheSeconds: number) =>
+  new Response(JSON.stringify(body), {
+    headers: { "content-type": "application/json", "cache-control": `public, max-age=${cacheSeconds}`, "access-control-allow-origin": "*" },
+  });
+
+registerPublicRoutes(async ({ request, env, url }) => {
+  if (request.method !== "GET") return null;
+  const issuer = oidcIssuer(env as OidcEnv);
+  if (url.pathname === "/.well-known/openid-configuration") {
+    if (!signingKey(env as OidcEnv)) return null;
+    return json({
+      issuer,
+      jwks_uri: `${issuer}/.well-known/jwks.json`,
+      response_types_supported: ["id_token"],
+      subject_types_supported: ["public"],
+      id_token_signing_alg_values_supported: ["RS256"],
+      claims_supported: ["iss", "sub", "aud", "iat", "nbf", "exp", "jti", "project_id", "workspace_id", "job_kind", "job_id"],
+    }, 3600);
+  }
+  if (url.pathname === "/.well-known/jwks.json") {
+    const key = signingKey(env as OidcEnv);
+    if (!key) return null;
+    return json({ keys: [(await key).publicJwk] }, 300);
+  }
+  return null;
+});
+
+/** A token for the one job a cloud runner holds, while it holds it. */
+async function issueToRunner({ env, principal, request, url }: AuthedRouteContext, kind: "run" | "task", jobId: string): Promise<Response> {
+  const runner = principal.runner;
+  if (!runner || runner.kind !== kind || runner.id !== jobId) return response({ error: "Not found" }, 404);
+  const audience = url.searchParams.get("audience") ?? "";
+  if (!validAudience(audience)) {
+    return response({ error: "audience must be sts.amazonaws.com, a Google Workload Identity provider (//iam.googleapis.com/projects/…/providers/…), or an https URL" }, 422);
+  }
+  const table = kind === "run" ? "runs" : "agent_tasks";
+  const job = await env.DB.prepare(`SELECT project_id AS projectId, status, worker_id AS workerId FROM ${table} WHERE id = ?`)
+    .bind(jobId).first<{ projectId: string; status: string; workerId: string | null }>();
+  if (!job || job.projectId !== runner.projectId) return response({ error: "Not found" }, 404);
+  if (job.status !== "running" || job.workerId !== cloudWorkerId({ kind, id: jobId })) {
+    return response({ error: `This ${kind} isn't held by a cloud runner`, status: job.status }, 409);
+  }
+  if (!signingKey(env as OidcEnv)) return response({ error: "Identity tokens aren't configured on this registry", code: "oidc_unconfigured" }, 503);
+  const issued = await signIdentityToken(env as OidcEnv, {
+    sub: `project:${runner.projectId}`,
+    aud: audience,
+    project_id: runner.projectId,
+    workspace_id: runner.workspaceId,
+    job_kind: kind,
+    job_id: jobId,
+  });
+  await auditProject(env, principal, runner.projectId, {
+    action: "identity_token.issued",
+    targetType: kind,
+    targetId: jobId,
+    data: { audience },
+  }, request);
+  return response(issued);
+}
+
+registerRoutes(async (context) => {
+  const { request, url } = context;
+  if (request.method !== "GET") return null;
+  let params = matchPath(url.pathname, "/api/runner/runs/:runId/identity-token");
+  if (params) return issueToRunner(context, "run", params.runId);
+  params = matchPath(url.pathname, "/api/runner/tasks/:taskId/identity-token");
+  if (params) return issueToRunner(context, "task", params.taskId);
+  return null;
+});