@lumi.ai/runner 0.15.3 → 0.15.5

package/dist/cli.js

@@ -299,6 +299,21 @@ var COLLECTIONS = {
    * test that exists to catch a forgotten credential-bearing collection.
    */
   mcpServers: "mcp_servers",
+  /**
+   * `ships/{shipId}/oauth_grants/{grantId}` — a person's standing authorization for one OAuth
+   * client to reach this Ship's Workspace MCP (PRD §15.46).
+   *
+   * SHIP-SCOPED, unlike the three root-level collections the flow also uses, and for one reason:
+   * it must die with the Ship. The pending request and the authorization code both live at the
+   * root because neither has a Ship yet (choosing one is what consent is FOR) or lives longer than
+   * a minute; a grant is the durable half and outlives both.
+   *
+   * The row here is the NON-SECRET half — who, which client, when last used — so a member can see
+   * "connected apps" without a privileged read. The refresh token's hash lives beside it in
+   * `secrets/oauth_grant_{grantId}`, which no client may read at all, exactly the way a registered
+   * MCP connection splits from `secrets/mcp_srv_{key}`.
+   */
+  oauthGrants: "oauth_grants",
   /** Top-level `users/{uid}/...` — per-user docs (runner machine registry). */
   users: "users",
   /** Top-level `githubInstallStates/{stateId}` — single-use install-flow nonces (backend only). */
@@ -923,7 +938,7 @@ function mcpUrl(config2) {
 }
 
 // src/version.ts
-var RUNNER_VERSION = true ? "0.15.3" : "0.0.0-dev";
+var RUNNER_VERSION = true ? "0.15.5" : "0.0.0-dev";
 
 // src/auth.ts
 import { signInWithCustomToken } from "firebase/auth";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumi.ai/runner",
-  "version": "0.15.3",
+  "version": "0.15.5",
   "type": "module",
   "description": "Lumi Crew runner daemon — claims jobs from your Ships and executes them as headless Claude sessions on your own machine.",
   "//name": "The ONLY package in this monorepo published to the public registry, so it is the one that does not follow the internal @lumi/crew-* convention: `@lumi` is not a scope we own, `@lumi.ai` is (the npm org). The workspace DIRECTORY stays packages/crew/runner — renaming the package is not renaming the folder.",