@nocobase/app-plugin-agents 0.1.0-beta.1 → 0.1.0-beta.11

package/dist/server/core/runs/extensions.d.ts

@@ -13,7 +13,10 @@
  *
  * - Repository access is asked per run (`forRun`, in the claim's transaction) once the run has repositories to check
  *   out. Its credentials are minted in `prepare` (a network call is fine there), handed to the runner in the payload
- *   and never stored; the claim remembers them as secrets, so nothing the run reports carries them.
+ *   and never stored; the claim remembers them as secrets, so nothing the run reports carries them. When the runner
+ *   asks for credentials on demand (the `gitCredentials` feature, `RepoAccessContext.onDemand`), a provider that can
+ *   `issue` one lists its repositories in `RunGit.onDemand` instead and mints nothing at the claim: the runner asks
+ *   for each credential whenever git needs one, for as long as it holds the run (`git-credentials.ts`).
  *
  * Inside the claim's transaction a provider reads through the claim's connection only: on SQLite that transaction
  * holds the one connection there is, so anything else (a person's permissions, another plugin's services) would wait
@@ -100,13 +103,63 @@ export interface RepoAccessContext {
     readonly claim: ClaimContext;
     /** The run's checkouts, as the runner receives them. */
     readonly repos: readonly RepoDir[];
+    /**
+     * Whether the runner asks for credentials on demand (the `gitCredentials` feature). Then a provider that implements
+     * `issue` answers `onDemand` with the URLs it issues for, and no `credentials`.
+     */
+    readonly onDemand: boolean;
+}
+/** What a repository access provider's `prepare` is told besides the run. */
+export interface RepoPrepareOptions {
+    /** As `RepoAccessContext.onDemand`: when true, a provider that implements `issue` has nothing to mint now. */
+    readonly onDemand: boolean;
+}
+/** A runner asks for the credential of one of its run's on-demand repositories. */
+export interface RepoCredentialRequest {
+    /** The run, held by `runnerId` under a live lease: the server checked before asking. */
+    readonly run: Run;
+    readonly runnerId: string;
+    readonly attempt: number;
+    /** Exactly as the run's `RepoDir` names it, and listed in `RunGit.onDemand` at the claim. */
+    readonly url: string;
+    /** The runner's last credential for it was refused by the remote: issue a new one rather than a cached one. */
+    readonly refresh: boolean;
+    /** Aborted when the server stops waiting (`ISSUE_TIMEOUT_MS`). */
+    readonly signal: AbortSignal;
+}
+/** A credential for one repository and when it stops working. */
+export interface RepoCredentialGrant {
+    readonly username: string;
+    readonly password: string;
+    /** RFC 3339, in the future. */
+    readonly expiresAt: string;
+}
+/**
+ * What a provider throws from `issue` when it cannot give a credential, with a message safe to show the run's people
+ * and the agent (no credential, no internal detail): `unavailable` when its code host is down or slow and asking again
+ * later may work, `denied` when it will not issue one (no access to the repository, an installation gone).
+ */
+export declare class RepoAccessError extends Error {
+    name: string;
+    readonly kind: 'unavailable' | 'denied';
+    constructor(kind: 'unavailable' | 'denied', message: string);
 }
 export interface RepoAccessProvider {
     /** Unique among the providers. */
     readonly key: string;
-    readonly prepare?: ExtensionPrepare;
+    readonly prepare?: (run: Run, options: RepoPrepareOptions) => Promise<unknown>;
+    /** Outside the transaction: revoke credentials prepared for a claim that was not delivered. Required when prepare mints credentials; idempotent. */
+    readonly discard?: (run: Run, prepared: unknown) => Promise<void>;
     /** In the claim's transaction, through its connection: database reads only. Null gives nothing. */
     forRun(conn: DatabaseConnection, context: RepoAccessContext, prepared: unknown): Promise<RunGit | null>;
+    /**
+     * Outside any transaction (a network call is fine): a credential for `request.url`, a repository this provider listed
+     * in `onDemand`, or null when it is not this provider's. Throws `RepoAccessError` when it cannot issue one. Called
+     * whenever the run's git needs a credential the runner does not hold, so a provider decides itself whether to answer
+     * from a cache (and for how long a cached credential still has to last) or to issue a new one; with `refresh` it
+     * issues a new one.
+     */
+    readonly issue?: (request: RepoCredentialRequest) => Promise<RepoCredentialGrant | null>;
 }
 export interface RepoAccessRegistry {
     /** Returns what removes the provider. */
@@ -116,7 +169,9 @@ export interface RepoAccessRegistry {
 export declare function createRepoAccessRegistry(): RepoAccessRegistry;
 /**
  * The run's git, from every provider: the first author given, every trailer and credential in order (one credential
- * per URL, the first).
+ * per URL, the first). With `context.onDemand`, the URLs any provider lists in `onDemand` (only repositories of the
+ * run) are asked for on demand, and no credential of the claim is handed out for them; without it, `onDemand` is
+ * dropped.
  */
 export declare function repoAccessFor(conn: DatabaseConnection, registry: RepoAccessRegistry | undefined, context: RepoAccessContext, prepared: Prepared): Promise<RunGit | null>;
 /** What the providers prepared for one run, by `section:<key>`, `mount:<name>` and `repo:<key>`. */
@@ -125,5 +180,5 @@ export type Prepared = ReadonlyMap<string, unknown>;
  * Runs every provider's `prepare` for `run`, outside any transaction. A provider whose preparation fails gets
  * undefined, and is told so by its own absent answer; the claim goes on.
  */
-export declare function prepareExtensions(run: Run, sections: BriefSectionRegistry | undefined, mounts: RunMountRegistry | undefined, onError?: (error: unknown) => void, repoAccess?: RepoAccessRegistry): Promise<Prepared>;
+export declare function prepareExtensions(run: Run, sections: BriefSectionRegistry | undefined, mounts: RunMountRegistry | undefined, onError?: (error: unknown) => void, repoAccess?: RepoAccessRegistry, repoOptions?: RepoPrepareOptions): Promise<Prepared>;
 //# sourceMappingURL=extensions.d.ts.map

package/dist/server/core/runs/extensions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extensions.d.ts","sourceRoot":"","sources":["../../../../server/core/runs/extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,KAAK,MAAM,EACX,KAAK,QAAQ,EACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEhE,iGAAiG;AACjG,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE9D,MAAM,WAAW,oBAAoB;IACnC,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IACpC,+EAA+E;IAC/E,OAAO,CACL,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,YAAY,EACnB,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,OAAO,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI,CAAC;IACrD,IAAI,IAAI,SAAS,oBAAoB,EAAE,CAAC;CACzC;AAED,wBAAgB,0BAA0B,IAAI,oBAAoB,CAuBjE;AAED,2GAA2G;AAC3G,wBAAsB,YAAY,CAChC,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,oBAAoB,GAAG,SAAS,EAC1C,KAAK,EAAE,YAAY,EACnB,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,eAAe,CAAC,CAkB1B;AAED,mDAAmD;AACnD,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,wCAAwC;AACxC,MAAM,WAAW,UAAU;IACzB,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gDAAgD;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,oHAAoH;IACpH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IACpC;;;OAGG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,OAAO,GAChB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC9B,qFAAqF;IACrF,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAClC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,yCAAyC;IACzC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,IAAI,CAAC;IACjD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAAC;IAChD,IAAI,IAAI,SAAS,gBAAgB,EAAE,CAAC;CACrC;AAED,wBAAgB,sBAAsB,IAAI,gBAAgB,CAiBzD;AAED,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG,MAAM,CAI7D;AAED,uEAAuE;AACvE,wBAAsB,SAAS,CAC7B,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,gBAAgB,GAAG,SAAS,EACtC,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC;IAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAyBxD;AAED,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,wDAAwD;IACxD,QAAQ,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,kCAAkC;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IACpC,mGAAmG;IACnG,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,OAAO,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,IAAI,CAAC;IACnD,IAAI,IAAI,SAAS,kBAAkB,EAAE,CAAC;CACvC;AAED,wBAAgB,wBAAwB,IAAI,kBAAkB,CAgB7D;AAED;;;GAGG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,kBAAkB,GAAG,SAAS,EACxC,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4BxB;AAED,oGAAoG;AACpG,MAAM,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,oBAAoB,GAAG,SAAS,EAC1C,MAAM,EAAE,gBAAgB,GAAG,SAAS,EACpC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,EAClC,UAAU,CAAC,EAAE,kBAAkB,GAC9B,OAAO,CAAC,QAAQ,CAAC,CAyCnB"}
+{"version":3,"file":"extensions.d.ts","sourceRoot":"","sources":["../../../../server/core/runs/extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,KAAK,MAAM,EACX,KAAK,QAAQ,EACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEhE,iGAAiG;AACjG,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE9D,MAAM,WAAW,oBAAoB;IACnC,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IACpC,+EAA+E;IAC/E,OAAO,CACL,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,YAAY,EACnB,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,OAAO,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI,CAAC;IACrD,IAAI,IAAI,SAAS,oBAAoB,EAAE,CAAC;CACzC;AAED,wBAAgB,0BAA0B,IAAI,oBAAoB,CAuBjE;AAED,2GAA2G;AAC3G,wBAAsB,YAAY,CAChC,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,oBAAoB,GAAG,SAAS,EAC1C,KAAK,EAAE,YAAY,EACnB,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,eAAe,CAAC,CAkB1B;AAED,mDAAmD;AACnD,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,wCAAwC;AACxC,MAAM,WAAW,UAAU;IACzB,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gDAAgD;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,oHAAoH;IACpH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IACpC;;;OAGG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,OAAO,GAChB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC9B,qFAAqF;IACrF,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAClC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,yCAAyC;IACzC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,IAAI,CAAC;IACjD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAAC;IAChD,IAAI,IAAI,SAAS,gBAAgB,EAAE,CAAC;CACrC;AAED,wBAAgB,sBAAsB,IAAI,gBAAgB,CAiBzD;AAED,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG,MAAM,CAI7D;AAED,uEAAuE;AACvE,wBAAsB,SAAS,CAC7B,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,gBAAgB,GAAG,SAAS,EACtC,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC;IAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAyBxD;AAED,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,wDAAwD;IACxD,QAAQ,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,8GAA8G;IAC9G,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,mFAAmF;AACnF,MAAM,WAAW,qBAAqB;IACpC,wFAAwF;IACxF,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6FAA6F;IAC7F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,+GAA+G;IAC/G,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED,iEAAiE;AACjE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+BAA+B;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IAC/B,IAAI,SAAqB;IAClC,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,QAAQ,CAAC;gBAE5B,IAAI,EAAE,aAAa,GAAG,QAAQ,EAAE,OAAO,EAAE,MAAM;CAI5D;AAED,MAAM,WAAW,kBAAkB;IACjC,kCAAkC;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,CACjB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,kBAAkB,KACxB,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB,oJAAoJ;IACpJ,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,mGAAmG;IACnG,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,OAAO,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,CACf,OAAO,EAAE,qBAAqB,KAC3B,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,IAAI,CAAC;IACnD,IAAI,IAAI,SAAS,kBAAkB,EAAE,CAAC;CACvC;AAED,wBAAgB,wBAAwB,IAAI,kBAAkB,CAgB7D;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,kBAAkB,GAAG,SAAS,EACxC,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAyCxB;AAED,oGAAoG;AACpG,MAAM,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,oBAAoB,GAAG,SAAS,EAC1C,MAAM,EAAE,gBAAgB,GAAG,SAAS,EACpC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,EAClC,UAAU,CAAC,EAAE,kBAAkB,EAC/B,WAAW,GAAE,kBAAwC,GACpD,OAAO,CAAC,QAAQ,CAAC,CA0CnB"}

package/dist/server/core/runs/extensions.js

@@ -13,7 +13,10 @@
  *
  * - Repository access is asked per run (`forRun`, in the claim's transaction) once the run has repositories to check
  *   out. Its credentials are minted in `prepare` (a network call is fine there), handed to the runner in the payload
- *   and never stored; the claim remembers them as secrets, so nothing the run reports carries them.
+ *   and never stored; the claim remembers them as secrets, so nothing the run reports carries them. When the runner
+ *   asks for credentials on demand (the `gitCredentials` feature, `RepoAccessContext.onDemand`), a provider that can
+ *   `issue` one lists its repositories in `RunGit.onDemand` instead and mints nothing at the claim: the runner asks
+ *   for each credential whenever git needs one, for as long as it holds the run (`git-credentials.ts`).
  *
  * Inside the claim's transaction a provider reads through the claim's connection only: on SQLite that transaction
  * holds the one connection there is, so anything else (a person's permissions, another plugin's services) would wait
@@ -104,6 +107,19 @@ export async function mountsFor(conn, registry, context, prepared) {
     }
     return { mounts, resumeNotes };
 }
+/**
+ * What a provider throws from `issue` when it cannot give a credential, with a message safe to show the run's people
+ * and the agent (no credential, no internal detail): `unavailable` when its code host is down or slow and asking again
+ * later may work, `denied` when it will not issue one (no access to the repository, an installation gone).
+ */
+export class RepoAccessError extends Error {
+    name = 'RepoAccessError';
+    kind;
+    constructor(kind, message) {
+        super(message);
+        this.kind = kind;
+    }
+}
 export function createRepoAccessRegistry() {
     const providers = new Map();
     return {
@@ -121,7 +137,9 @@ export function createRepoAccessRegistry() {
 }
 /**
  * The run's git, from every provider: the first author given, every trailer and credential in order (one credential
- * per URL, the first).
+ * per URL, the first). With `context.onDemand`, the URLs any provider lists in `onDemand` (only repositories of the
+ * run) are asked for on demand, and no credential of the claim is handed out for them; without it, `onDemand` is
+ * dropped.
  */
 export async function repoAccessFor(conn, registry, context, prepared) {
     if (context.repos.length === 0)
@@ -129,6 +147,8 @@ export async function repoAccessFor(conn, registry, context, prepared) {
     let author;
     const trailers = [];
     const credentials = new Map();
+    const repoUrls = new Set(context.repos.map((repo) => repo.url));
+    const onDemand = new Set();
     for (const provider of registry?.list() ?? []) {
         const given = await provider.forRun(conn, context, prepared.get(`repo:${provider.key}`));
         if (!given)
@@ -140,20 +160,30 @@ export async function repoAccessFor(conn, registry, context, prepared) {
         for (const credential of given.credentials ?? [])
             if (!credentials.has(credential.url))
                 credentials.set(credential.url, credential);
+        if (context.onDemand)
+            for (const url of given.onDemand ?? [])
+                if (repoUrls.has(url))
+                    onDemand.add(url);
     }
-    if (!author && trailers.length === 0 && credentials.size === 0)
+    for (const url of onDemand)
+        credentials.delete(url);
+    if (!author &&
+        trailers.length === 0 &&
+        credentials.size === 0 &&
+        onDemand.size === 0)
         return null;
     return {
         ...(author ? { author } : {}),
         ...(trailers.length > 0 ? { trailers } : {}),
         ...(credentials.size > 0 ? { credentials: [...credentials.values()] } : {}),
+        ...(onDemand.size > 0 ? { onDemand: [...onDemand] } : {}),
     };
 }
 /**
  * Runs every provider's `prepare` for `run`, outside any transaction. A provider whose preparation fails gets
  * undefined, and is told so by its own absent answer; the claim goes on.
  */
-export async function prepareExtensions(run, sections, mounts, onError, repoAccess) {
+export async function prepareExtensions(run, sections, mounts, onError, repoAccess, repoOptions = { onDemand: false }) {
     const prepared = new Map();
     const hooks = [
         ...(sections?.list() ?? []).flatMap((provider) => provider.prepare
@@ -166,11 +196,17 @@ export async function prepareExtensions(run, sections, mounts, onError, repoAcce
                 [`mount:${provider.name}`, provider.prepare],
             ]
             : []),
-        ...(repoAccess?.list() ?? []).flatMap((provider) => provider.prepare
-            ? [
-                [`repo:${provider.key}`, provider.prepare],
-            ]
-            : []),
+        ...(repoAccess?.list() ?? []).flatMap((provider) => {
+            const prepare = provider.prepare;
+            return prepare
+                ? [
+                    [
+                        `repo:${provider.key}`,
+                        (each) => prepare(each, repoOptions),
+                    ],
+                ]
+                : [];
+        }),
     ];
     for (const [key, prepare] of hooks)
         try {

package/dist/server/core/runs/extensions.js.map

@@ -1 +1 @@
-{"version":3,"file":"extensions.js","sourceRoot":"","sources":["../../../../server/core/runs/extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,aAAa,GAKd,MAAM,0BAA0B,CAAC;AA8BlC,MAAM,UAAU,0BAA0B;IACxC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAgC,CAAC;IAC1D,OAAO;QACL,QAAQ,CAAC,QAAQ;YACf,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;YACvE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACtC,OAAO,GAAG,EAAE;gBACV,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,QAAQ;oBAC1C,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CACT,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;aACpB,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;aAC/C,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,iBAAiB,CAAC;YAC5C,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,iBAAiB,CAAC;YAChD,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CACpB;aACA,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAwB,EACxB,QAA0C,EAC1C,KAAmB,EACnB,QAAyB,EACzB,QAAkB;IAElB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CACjC,IAAI,EACJ,KAAK,EACL,QAAQ,EACR,QAAQ,CAAC,GAAG,CAAC,WAAW,QAAQ,CAAC,GAAG,EAAE,CAAC,CACxC,CAAC;QACF,IAAI,IAAI,EAAE,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxC,OAAO;QACL,GAAG,QAAQ;QACX,OAAO,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC;aACzC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;aAC7B,IAAI,CAAC,MAAM,CAAC;KAChB,CAAC;AACJ,CAAC;AAuDD,MAAM,UAAU,sBAAsB;IACpC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;IACtD,OAAO;QACL,QAAQ,CAAC,QAAQ;YACf,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAChE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACvC,OAAO,GAAG,EAAE;gBACV,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ;oBAC3C,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC,CAAC;QACJ,CAAC;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;QAClC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,GAAwB;IACnD,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAC1E,IAAI,CACL,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAwB,EACxB,QAAsC,EACtC,OAAqB,EACrB,QAAkB;IAElB,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CACjC,IAAI,EACJ,OAAO,EACP,QAAQ,CAAC,GAAG,CAAC,SAAS,QAAQ,CAAC,IAAI,EAAE,CAAC,CACvC,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,uGAAuG;YACvG,SAAS,EAAE,SAAS,CAAC,aAAa,CAAC,KAAK,EAAE;gBACxC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;gBAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;aACpB,CAAC;YACF,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;YAC1D,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACjC,CAAC;AA2BD,MAAM,UAAU,wBAAwB;IACtC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8B,CAAC;IACxD,OAAO;QACL,QAAQ,CAAC,QAAQ;YACf,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,yCAAyC,QAAQ,CAAC,GAAG,EAAE,CACxD,CAAC;YACJ,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACtC,OAAO,GAAG,EAAE;gBACV,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,QAAQ;oBAC1C,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAwB,EACxB,QAAwC,EACxC,OAA0B,EAC1B,QAAkB;IAElB,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,MAAwB,CAAC;IAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,IAAI,GAAG,EAGxB,CAAC;IACJ,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CACjC,IAAI,EACJ,OAAO,EACP,QAAQ,CAAC,GAAG,CAAC,QAAQ,QAAQ,CAAC,GAAG,EAAE,CAAC,CACrC,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE;YACxC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1D,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE;YAC9C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;gBAClC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC;AACJ,CAAC;AAKD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,QAA0C,EAC1C,MAAoC,EACpC,OAAkC,EAClC,UAA+B;IAE/B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC5C,MAAM,KAAK,GAAiC;QAC1C,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC/C,QAAQ,CAAC,OAAO;YACd,CAAC,CAAC;gBACE,CAAC,WAAW,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,OAAO,CAG3C;aACF;YACH,CAAC,CAAC,EAAE,CACP;QACD,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC7C,QAAQ,CAAC,OAAO;YACd,CAAC,CAAC;gBACE,CAAC,SAAS,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,OAAO,CAG1C;aACF;YACH,CAAC,CAAC,EAAE,CACP;QACD,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CACjD,QAAQ,CAAC,OAAO;YACd,CAAC,CAAC;gBACE,CAAC,QAAQ,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,OAAO,CAGxC;aACF;YACH,CAAC,CAAC,EAAE,CACP;KACF,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,KAAK;QAChC,IAAI,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"extensions.js","sourceRoot":"","sources":["../../../../server/core/runs/extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,aAAa,GAKd,MAAM,0BAA0B,CAAC;AA8BlC,MAAM,UAAU,0BAA0B;IACxC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAgC,CAAC;IAC1D,OAAO;QACL,QAAQ,CAAC,QAAQ;YACf,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;YACvE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACtC,OAAO,GAAG,EAAE;gBACV,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,QAAQ;oBAC1C,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CACT,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;aACpB,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;aAC/C,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,iBAAiB,CAAC;YAC5C,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,iBAAiB,CAAC;YAChD,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CACpB;aACA,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAwB,EACxB,QAA0C,EAC1C,KAAmB,EACnB,QAAyB,EACzB,QAAkB;IAElB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CACjC,IAAI,EACJ,KAAK,EACL,QAAQ,EACR,QAAQ,CAAC,GAAG,CAAC,WAAW,QAAQ,CAAC,GAAG,EAAE,CAAC,CACxC,CAAC;QACF,IAAI,IAAI,EAAE,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxC,OAAO;QACL,GAAG,QAAQ;QACX,OAAO,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC;aACzC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;aAC7B,IAAI,CAAC,MAAM,CAAC;KAChB,CAAC;AACJ,CAAC;AAuDD,MAAM,UAAU,sBAAsB;IACpC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;IACtD,OAAO;QACL,QAAQ,CAAC,QAAQ;YACf,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAChE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACvC,OAAO,GAAG,EAAE;gBACV,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ;oBAC3C,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC,CAAC;QACJ,CAAC;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;QAClC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,GAAwB;IACnD,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAC1E,IAAI,CACL,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAwB,EACxB,QAAsC,EACtC,OAAqB,EACrB,QAAkB;IAElB,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CACjC,IAAI,EACJ,OAAO,EACP,QAAQ,CAAC,GAAG,CAAC,SAAS,QAAQ,CAAC,IAAI,EAAE,CAAC,CACvC,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,uGAAuG;YACvG,SAAS,EAAE,SAAS,CAAC,aAAa,CAAC,KAAK,EAAE;gBACxC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;gBAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;aACpB,CAAC;YACF,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;YAC1D,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACjC,CAAC;AA0CD;;;;GAIG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,GAAG,iBAAiB,CAAC;IACzB,IAAI,CAA2B;IAExC,YAAY,IAA8B,EAAE,OAAe;QACzD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAmCD,MAAM,UAAU,wBAAwB;IACtC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8B,CAAC;IACxD,OAAO;QACL,QAAQ,CAAC,QAAQ;YACf,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,yCAAyC,QAAQ,CAAC,GAAG,EAAE,CACxD,CAAC;YACJ,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACtC,OAAO,GAAG,EAAE;gBACV,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,QAAQ;oBAC1C,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAwB,EACxB,QAAwC,EACxC,OAA0B,EAC1B,QAAkB;IAElB,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,MAAwB,CAAC;IAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,IAAI,GAAG,EAGxB,CAAC;IACJ,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CACjC,IAAI,EACJ,OAAO,EACP,QAAQ,CAAC,GAAG,CAAC,QAAQ,QAAQ,CAAC,GAAG,EAAE,CAAC,CACrC,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE;YACxC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1D,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE;YAC9C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;gBAClC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,QAAQ;YAClB,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE;gBACpC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ;QAAE,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpD,IACE,CAAC,MAAM;QACP,QAAQ,CAAC,MAAM,KAAK,CAAC;QACrB,WAAW,CAAC,IAAI,KAAK,CAAC;QACtB,QAAQ,CAAC,IAAI,KAAK,CAAC;QAEnB,OAAO,IAAI,CAAC;IACd,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC;AAKD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,QAA0C,EAC1C,MAAoC,EACpC,OAAkC,EAClC,UAA+B,EAC/B,cAAkC,EAAE,QAAQ,EAAE,KAAK,EAAE;IAErD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC5C,MAAM,KAAK,GAAiC;QAC1C,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC/C,QAAQ,CAAC,OAAO;YACd,CAAC,CAAC;gBACE,CAAC,WAAW,QAAQ,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,OAAO,CAG3C;aACF;YACH,CAAC,CAAC,EAAE,CACP;QACD,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC7C,QAAQ,CAAC,OAAO;YACd,CAAC,CAAC;gBACE,CAAC,SAAS,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,OAAO,CAG1C;aACF;YACH,CAAC,CAAC,EAAE,CACP;QACD,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;YACjD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;YACjC,OAAO,OAAO;gBACZ,CAAC,CAAC;oBACE;wBACE,QAAQ,QAAQ,CAAC,GAAG,EAAE;wBACtB,CAAC,IAAS,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC;qBACZ;iBAChC;gBACH,CAAC,CAAC,EAAE,CAAC;QACT,CAAC,CAAC;KACH,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,KAAK;QAChC,IAAI,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/server/core/runs/git-credentials.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Repository credentials on demand (`RUNNER_ROUTES.gitCredential`, the `gitCredentials` feature): a runner asks for the
+ * credential of one of its run's repositories whenever git needs one, instead of keeping the one a claim handed out
+ * for the whole run, which a long run outlives.
+ *
+ * The answer is given only while the asking runner holds the run (`reports.holds`), for the attempt it names, under a
+ * lease that has not run out, and for a URL the claim listed in `RunGit.onDemand` (`agRuns.gitCredentialUrls`),
+ * compared exactly: case, a trailing `.git` and anything else the runner sends must match what it was given. Anything
+ * else is refused, so a run that ended, went back to the queue or was taken by another attempt gets nothing.
+ *
+ * The application issues the credential (`RepoAccessProvider.issue`), outside any transaction, within
+ * `ISSUE_TIMEOUT_MS`; whether a cached one is still good enough is its decision. Every credential handed out is added
+ * to the run's remembered secrets, so what the run reports afterwards is redacted of it too. A failure is answered
+ * with a reason the runner can act on and a message safe to show: `REPO_ACCESS_UNAVAILABLE` (try again later) or
+ * `REPO_ACCESS_DENIED` (the application will not issue one).
+ */
+import { type GitCredential, type GitCredentialRequest } from '@nocobase/agent-protocol';
+import type { Clock } from '../../kernel/clock.js';
+import { type SecretMemory } from '../../kernel/redaction.js';
+import type { TxRunner } from '../../kernel/tx.js';
+import type { Runner } from '../../../shared/runners.js';
+import { type RepoAccessRegistry } from './extensions.js';
+import type { RunnerReports } from './lifecycle.js';
+import { type RunRecord } from './run.store.js';
+/** How long the server waits for the application to issue a credential before answering `REPO_ACCESS_UNAVAILABLE`. */
+export declare const ISSUE_TIMEOUT_MS = 15000;
+export interface GitCredentialService {
+    issue(runner: Pick<Runner, 'id'>, runId: string, request: GitCredentialRequest): Promise<GitCredential>;
+}
+export interface GitCredentialDeps {
+    readonly tx: TxRunner;
+    readonly clock: Clock;
+    readonly reports: Pick<RunnerReports, 'holds'>;
+    readonly repoAccess: RepoAccessRegistry;
+    readonly secrets?: SecretMemory;
+    /** Told what went wrong when a provider failed in a way it did not explain (`RepoAccessError`). */
+    readonly onError?: (message: string, error: unknown) => void;
+    readonly timeoutMs?: number;
+}
+/** The URLs a claim listed for on-demand credentials, as stored on the run. */
+export declare function gitCredentialUrls(run: Pick<RunRecord, 'gitCredentialUrls'>): string[];
+export declare function createGitCredentialService(deps: GitCredentialDeps): GitCredentialService;
+//# sourceMappingURL=git-credentials.d.ts.map

package/dist/server/core/runs/git-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-credentials.d.ts","sourceRoot":"","sources":["../../../../server/core/runs/git-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,oBAAoB,EAC1B,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAwB,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEtE,sHAAsH;AACtH,eAAO,MAAM,gBAAgB,QAAS,CAAC;AAEvC,MAAM,WAAW,oBAAoB;IACnC,KAAK,CACH,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,aAAa,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAChC,mGAAmG;IACnG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,GACxC,MAAM,EAAE,CAEV;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,iBAAiB,GACtB,oBAAoB,CAwJtB"}

package/dist/server/core/runs/git-credentials.js

@@ -0,0 +1,129 @@
+/**
+ * Repository credentials on demand (`RUNNER_ROUTES.gitCredential`, the `gitCredentials` feature): a runner asks for the
+ * credential of one of its run's repositories whenever git needs one, instead of keeping the one a claim handed out
+ * for the whole run, which a long run outlives.
+ *
+ * The answer is given only while the asking runner holds the run (`reports.holds`), for the attempt it names, under a
+ * lease that has not run out, and for a URL the claim listed in `RunGit.onDemand` (`agRuns.gitCredentialUrls`),
+ * compared exactly: case, a trailing `.git` and anything else the runner sends must match what it was given. Anything
+ * else is refused, so a run that ended, went back to the queue or was taken by another attempt gets nothing.
+ *
+ * The application issues the credential (`RepoAccessProvider.issue`), outside any transaction, within
+ * `ISSUE_TIMEOUT_MS`; whether a cached one is still good enough is its decision. Every credential handed out is added
+ * to the run's remembered secrets, so what the run reports afterwards is redacted of it too. A failure is answered
+ * with a reason the runner can act on and a message safe to show: `REPO_ACCESS_UNAVAILABLE` (try again later) or
+ * `REPO_ACCESS_DENIED` (the application will not issue one).
+ */
+import { ProtocolError, } from '@nocobase/agent-protocol';
+import { runSecretsKey } from '../../kernel/redaction.js';
+import { stringArray } from '../../kernel/values.js';
+import { RepoAccessError, } from './extensions.js';
+import { findRunRecord, toRun } from './run.store.js';
+/** How long the server waits for the application to issue a credential before answering `REPO_ACCESS_UNAVAILABLE`. */
+export const ISSUE_TIMEOUT_MS = 15_000;
+/** The URLs a claim listed for on-demand credentials, as stored on the run. */
+export function gitCredentialUrls(run) {
+    return stringArray(run.gitCredentialUrls);
+}
+export function createGitCredentialService(deps) {
+    const timeoutMs = deps.timeoutMs ?? ISSUE_TIMEOUT_MS;
+    const lost = (message, status) => new ProtocolError('LEASE_LOST', message, { status });
+    async function withTimeout(issue) {
+        const controller = new AbortController();
+        let timer;
+        const timeout = new Promise((_, reject) => {
+            timer = setTimeout(() => {
+                controller.abort();
+                reject(new RepoAccessError('unavailable', 'The application did not issue a credential in time.'));
+            }, timeoutMs);
+        });
+        try {
+            return await Promise.race([issue(controller.signal), timeout]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    function checked(grant, now) {
+        const expires = Date.parse(grant.expiresAt);
+        if (typeof grant.username !== 'string' ||
+            grant.username === '' ||
+            typeof grant.password !== 'string' ||
+            grant.password === '' ||
+            Number.isNaN(expires) ||
+            expires <= now.getTime())
+            throw new RepoAccessError('unavailable', 'The application issued a credential that is incomplete or already expired.');
+        return grant;
+    }
+    /**
+     * The run while `runner` still holds this attempt of it under a live lease and the claim listed `url`; the protocol
+     * reason otherwise. Checked before the application is asked and again once it answered, since issuing may take long
+     * enough for the run to end, be taken back or move to another attempt.
+     */
+    async function held(runner, runId, request) {
+        await deps.reports.holds(runner, runId);
+        const run = await findRunRecord(deps.tx.read(), runId);
+        if (!run)
+            throw new ProtocolError('RUN_NOT_FOUND', 'No such run.');
+        if (Number(run.attempt) !== request.attempt)
+            throw lost(`Attempt ${request.attempt} of the run is over; it is on attempt ${Number(run.attempt)}.`, run.status);
+        if (run.leaseExpiresAt === null ||
+            Date.parse(run.leaseExpiresAt) <= deps.clock.now().getTime())
+            throw lost('The run’s lease ran out.', run.status);
+        if (!gitCredentialUrls(run).includes(request.url))
+            throw new ProtocolError('INVALID_REQUEST', 'This repository is not one the run asks credentials for on demand.', { url: request.url });
+        return run;
+    }
+    /** The first answer of a provider that issues for the URL; null when none does. */
+    async function ask(run, runner, request) {
+        const providers = deps.repoAccess
+            .list()
+            .filter((provider) => provider.issue !== undefined);
+        try {
+            for (const provider of providers) {
+                const grant = await withTimeout((signal) => provider.issue({
+                    run: toRun(run),
+                    runnerId: runner.id,
+                    attempt: request.attempt,
+                    url: request.url,
+                    refresh: request.refresh === true,
+                    signal,
+                }));
+                if (grant)
+                    return grant;
+            }
+            return null;
+        }
+        catch (error) {
+            if (error instanceof RepoAccessError)
+                throw new ProtocolError(error.kind === 'denied'
+                    ? 'REPO_ACCESS_DENIED'
+                    : 'REPO_ACCESS_UNAVAILABLE', error.message, { url: request.url });
+            deps.onError?.(`Agents could not issue a repository credential for run ${run.id}.`, error);
+            throw new ProtocolError('REPO_ACCESS_UNAVAILABLE', 'The application could not issue a credential for this repository.', { url: request.url });
+        }
+    }
+    return {
+        async issue(runner, runId, request) {
+            const run = await held(runner, runId, request);
+            const grant = await ask(run, runner, request);
+            if (!grant)
+                throw new ProtocolError('REPO_ACCESS_DENIED', 'The application issues no credential for this repository.', { url: request.url });
+            // The run may have ended, been taken back or moved to another attempt while the application issued: then the
+            // credential is dropped, never remembered, and the runner told why.
+            await held(runner, runId, request);
+            let valid;
+            try {
+                // Checked against the time it came back, not the time it was asked for.
+                valid = checked(grant, deps.clock.now());
+            }
+            catch (error) {
+                throw new ProtocolError('REPO_ACCESS_UNAVAILABLE', error instanceof Error ? error.message : String(error), { url: request.url });
+            }
+            const { username, password, expiresAt } = valid;
+            deps.secrets?.add(runSecretsKey(run.id), [password]);
+            return { username, password, expiresAt };
+        },
+    };
+}
+//# sourceMappingURL=git-credentials.js.map

package/dist/server/core/runs/git-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-credentials.js","sourceRoot":"","sources":["../../../../server/core/runs/git-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,aAAa,GAGd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,aAAa,EAAqB,MAAM,2BAA2B,CAAC;AAE7E,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EACL,eAAe,GAGhB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,aAAa,EAAE,KAAK,EAAkB,MAAM,gBAAgB,CAAC;AAEtE,sHAAsH;AACtH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAqBvC,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAC/B,GAAyC;IAEzC,OAAO,WAAW,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,IAAuB;IAEvB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;IAErD,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,MAAc,EAAE,EAAE,CAC/C,IAAI,aAAa,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAEvD,KAAK,UAAU,WAAW,CACxB,KAAmE;QAEnE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,KAAiC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YAC/C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,CACJ,IAAI,eAAe,CACjB,aAAa,EACb,qDAAqD,CACtD,CACF,CAAC;YACJ,CAAC,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACjE,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,SAAS,OAAO,CAAC,KAA0B,EAAE,GAAS;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5C,IACE,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAClC,KAAK,CAAC,QAAQ,KAAK,EAAE;YACrB,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAClC,KAAK,CAAC,QAAQ,KAAK,EAAE;YACrB,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;YACrB,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE;YAExB,MAAM,IAAI,eAAe,CACvB,aAAa,EACb,4EAA4E,CAC7E,CAAC;QACJ,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,IAAI,CACjB,MAA0B,EAC1B,KAAa,EACb,OAA6B;QAE7B,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;QACnE,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO;YACzC,MAAM,IAAI,CACR,WAAW,OAAO,CAAC,OAAO,yCAAyC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EACzF,GAAG,CAAC,MAAM,CACX,CAAC;QACJ,IACE,GAAG,CAAC,cAAc,KAAK,IAAI;YAC3B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;YAE5D,MAAM,IAAI,CAAC,0BAA0B,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC;YAC/C,MAAM,IAAI,aAAa,CACrB,iBAAiB,EACjB,oEAAoE,EACpE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CACrB,CAAC;QACJ,OAAO,GAAG,CAAC;IACb,CAAC;IAED,mFAAmF;IACnF,KAAK,UAAU,GAAG,CAChB,GAAc,EACd,MAA0B,EAC1B,OAA6B;QAE7B,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU;aAC9B,IAAI,EAAE;aACN,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,CAAC,MAAM,EAAE,EAAE,CACzC,QAAQ,CAAC,KAAM,CAAC;oBACd,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;oBACf,QAAQ,EAAE,MAAM,CAAC,EAAE;oBACnB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI;oBACjC,MAAM;iBACP,CAAC,CACH,CAAC;gBACF,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;YAC1B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,eAAe;gBAClC,MAAM,IAAI,aAAa,CACrB,KAAK,CAAC,IAAI,KAAK,QAAQ;oBACrB,CAAC,CAAC,oBAAoB;oBACtB,CAAC,CAAC,yBAAyB,EAC7B,KAAK,CAAC,OAAO,EACb,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CACrB,CAAC;YACJ,IAAI,CAAC,OAAO,EAAE,CACZ,0DAA0D,GAAG,CAAC,EAAE,GAAG,EACnE,KAAK,CACN,CAAC;YACF,MAAM,IAAI,aAAa,CACrB,yBAAyB,EACzB,mEAAmE,EACnE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CACrB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO;YAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK;gBACR,MAAM,IAAI,aAAa,CACrB,oBAAoB,EACpB,2DAA2D,EAC3D,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CACrB,CAAC;YACJ,6GAA6G;YAC7G,oEAAoE;YACpE,MAAM,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACnC,IAAI,KAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,wEAAwE;gBACxE,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,aAAa,CACrB,yBAAyB,EACzB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACtD,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CACrB,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;YAChD,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/core/runs/identity.d.ts

@@ -0,0 +1,9 @@
+/** Subject-selected identities, refreshed before a queued run can borrow a runner or credentials. */
+import type { DatabaseConnection } from '@nocobase/db';
+import type { Tx } from '../../kernel/tx.js';
+import type { TransitionDeps } from './transitions.js';
+import { type RunRecord } from './run.store.js';
+/** Whether a queued run's identity is current; a claim refreshes it in a transaction only when it is not. */
+export declare function queuedIdentityCurrent(conn: DatabaseConnection, deps: TransitionDeps, run: RunRecord): Promise<boolean>;
+export declare function refreshQueuedIdentity(unit: Tx, deps: TransitionDeps, run: RunRecord): Promise<RunRecord | null>;
+//# sourceMappingURL=identity.d.ts.map

package/dist/server/core/runs/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../../server/core/runs/identity.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGvD,OAAO,EAML,KAAK,SAAS,EACf,MAAM,gBAAgB,CAAC;AAsDxB,6GAA6G;AAC7G,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,EAAE,EACR,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAwB3B"}

package/dist/server/core/runs/identity.js

@@ -0,0 +1,75 @@
+import { currentCommentOwner } from './comment-consent.js';
+import { finishRun } from './transitions.js';
+import { inputsRepo, findRunRecord, runsRepo, toInput, toExecutions, } from './run.store.js';
+/** What refreshing would do, read without writing, so a claim poll opens no transaction for current work. */
+async function planQueuedIdentity(conn, deps, run) {
+    if (run.commentRootRunId && run.status === 'queued') {
+        const root = await findRunRecord(conn, run.commentRootRunId);
+        if (!root || !(await currentCommentOwner(conn, deps.subjects, root)))
+            return {
+                kind: 'cancel',
+                detail: 'The comment belongs to an earlier owner assignment.',
+            };
+    }
+    const resolve = deps.subjects.get(run.subjectKind)?.actsAs;
+    // A run returned to the queue after a lease loss has already fixed its identity.
+    if (!resolve ||
+        run.status !== 'queued' ||
+        run.dispatchedAt ||
+        Number(run.attempt) > 1 ||
+        toExecutions(run).length > 0)
+        return { kind: 'keep' };
+    const inputs = await inputsRepo(conn).findMany({
+        filter: { runId: run.id },
+    });
+    const identity = await resolve(conn, {
+        subjectId: run.subjectId,
+        agentId: run.agentId,
+        causedByRunId: run.retryOfRunId ?? undefined,
+        commentExecution: run.commentExecution,
+        actorUserId: run.actorUserId,
+        inputs: inputs.map(toInput),
+    });
+    if (!identity)
+        return { kind: 'keep' };
+    if (!identity.actorUserId)
+        return { kind: 'cancel', detail: identity.reason ?? 'noOwner' };
+    if (run.commentExecution === 'requester')
+        return { kind: 'keep' };
+    if (run.actorUserId === identity.actorUserId &&
+        run.ownerUserId === identity.actorUserId)
+        return { kind: 'keep' };
+    return { kind: 'update', actorUserId: identity.actorUserId };
+}
+/** Whether a queued run's identity is current; a claim refreshes it in a transaction only when it is not. */
+export async function queuedIdentityCurrent(conn, deps, run) {
+    return (await planQueuedIdentity(conn, deps, run)).kind === 'keep';
+}
+export async function refreshQueuedIdentity(unit, deps, run) {
+    const plan = await planQueuedIdentity(unit.conn, deps, run);
+    if (plan.kind === 'keep')
+        return run;
+    if (plan.kind === 'cancel') {
+        await finishRun(unit, deps, run, {
+            status: 'cancelled',
+            reason: null,
+            detail: plan.detail,
+        });
+        return null;
+    }
+    const values = {
+        actorUserId: plan.actorUserId,
+        ownerUserId: plan.actorUserId,
+        requestedByUserId: run.requestedByUserId ?? run.actorUserId,
+        updatedAt: deps.clock.now().toISOString(),
+    };
+    const updated = await runsRepo(unit.conn).updateMany({
+        filter: { id: run.id, status: 'queued', actorUserId: run.actorUserId },
+        values,
+    });
+    if (updated.updatedCount !== 1)
+        return null;
+    unit.emit({ type: 'run.changed', runId: run.id, status: 'queued' });
+    return { ...run, ...values };
+}
+//# sourceMappingURL=identity.js.map

package/dist/server/core/runs/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../../server/core/runs/identity.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EACL,UAAU,EACV,aAAa,EACb,QAAQ,EACR,OAAO,EACP,YAAY,GAEb,MAAM,gBAAgB,CAAC;AAOxB,6GAA6G;AAC7G,KAAK,UAAU,kBAAkB,CAC/B,IAAwB,EACxB,IAAoB,EACpB,GAAc;IAEd,IAAI,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAClE,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,qDAAqD;aAC9D,CAAC;IACN,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC3D,iFAAiF;IACjF,IACE,CAAC,OAAO;QACR,GAAG,CAAC,MAAM,KAAK,QAAQ;QACvB,GAAG,CAAC,YAAY;QAChB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;QACvB,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;QAE5B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QAC7C,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE;KAC1B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE;QACnC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,aAAa,EAAE,GAAG,CAAC,YAAY,IAAI,SAAS;QAC5C,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,WAAW;QACvB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;IAClE,IAAI,GAAG,CAAC,gBAAgB,KAAK,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClE,IACE,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QACxC,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAExC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;AAC/D,CAAC;AAED,6GAA6G;AAC7G,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAwB,EACxB,IAAoB,EACpB,GAAc;IAEd,OAAO,CAAC,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAQ,EACR,IAAoB,EACpB,GAAc;IAEd,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC;IACrC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YAC/B,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG;QACb,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,WAAW;QAC3D,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;KAC1C,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;QACnD,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE;QACtE,MAAM;KACP,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,YAAY,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpE,OAAO,EAAE,GAAG,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;AAC/B,CAAC"}

package/dist/server/core/runs/index.d.ts

@@ -1,15 +1,19 @@
-export { briefOf, createClaimService, fits, hasTool, onlineEntryOf, pickEntry, isServerHolder, payloadDirs, payloadRequires, skillTargets, variableTargets, type ClaimService, type RenderedBrief, type ServerClaim, type ServerHolder, } from './claim.js';
+export { briefOf, createClaimService, fits, fitsActor, hasTool, pickEntry, payloadDirs, payloadRequires, skillTargets, variableTargets, type ClaimService, type RenderedBrief, } from './claim.js';
 export { resolveAgentCli, type AgentCli } from './policy.js';
-export { createBriefSectionRegistry, createRepoAccessRegistry, createRunMountRegistry, sessionKeyOf, type BriefSectionProvider, type BriefSectionRegistry, type ExtensionPrepare, type MountContext, type MountOffer, type RepoAccessContext, type RepoAccessProvider, type RepoAccessRegistry, type RunMountProvider, type RunMountRegistry, } from './extensions.js';
+export { createClaimEligibility, type ClaimEligibility, type EligibilityRequest, } from './eligibility.js';
+export { createBriefSectionRegistry, createRepoAccessRegistry, createRunMountRegistry, sessionKeyOf, type BriefSectionProvider, type BriefSectionRegistry, type ExtensionPrepare, type MountContext, type MountOffer, RepoAccessError, type RepoAccessContext, type RepoAccessProvider, type RepoAccessRegistry, type RepoCredentialGrant, type RepoCredentialRequest, type RepoPrepareOptions, type RunMountProvider, type RunMountRegistry, } from './extensions.js';
+export { createGitCredentialService, ISSUE_TIMEOUT_MS, type GitCredentialService, } from './git-credentials.js';
 export { createBriefPreviewer, type BriefPreviewer } from './preview.js';
 export { findBrief, requestReset } from './workspace.store.js';
-export { createRunnerReports, type OnlineUsageRecord, type RunnerReports, } from './lifecycle.js';
-export { commandRef, createSubjectRegistry, dialectOf, takesType, type ClaimContext, type CommandDialect, type ContextProvider, type SubjectAssembly, type SubjectSample, type SubjectBinding, type SubjectDir, type SubjectFacts, type SubjectRegistry, type SubjectReports, type SubjectScope, type WorkSink, } from './ports.js';
+export { createRunnerReports, type RunnerReports } from './lifecycle.js';
+export { commandRef, createSubjectRegistry, type ClaimContext, type ContextProvider, type SubjectAssembly, type SubjectSample, type SubjectBinding, type SubjectDir, type SubjectFacts, type SubjectRegistry, type SubjectReports, type SubjectWorkspaces, type SubjectScope, type WorkSink, } from './ports.js';
 export { DEFAULT_TOOL_POLICY, MAX_CLAIM_FAILURES, retryDelayMs, toolPolicyFor, } from './policy.js';
 export type { RunTokenIdentity } from './run-tokens.js';
 export { countActive, eventsAfter, hasSession, inputsOnSince, lastSummary, openCounts, openRunsOn, openRunsOnEach, pendingInputs, type EventRecord, } from './run.store.js';
-export { createRunService, DEFAULT_THREAD, type EnqueueRequest, type EnqueueResult, type NewInput, type RunFilter, type RunService, } from './run.service.js';
+export { createRunService, DEFAULT_THREAD, queuedRun, type EnqueueRequest, type EnqueueResult, type NewInput, type RunEnqueued, type RunFilter, type RunRequestPending, type RunService, } from './run.service.js';
+export { RUN_REQUEST_TTL_MS, type RequestedRun, type RunRequestFilter, type RunRequestReassignment, type RunRequestService, } from './run-requests.js';
 export { createSweeper, type Sweeper, type SweepReport } from './sweeper.js';
+export { executionForViewer, runForViewer, type RunMachineViewer, } from './execution-view.js';
 export { createAvailability, type AgentAvailability, type Availability, } from './availability.js';
 export { cliPackageFor, type AgentCliSource } from './cli-package.js';
 export { createRunnerView, runsHeldBy, runsHeldByTool, type RunnerView, } from './runner-view.js';

package/dist/server/core/runs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/core/runs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,kBAAkB,EAClB,IAAI,EACJ,OAAO,EACP,aAAa,EACb,SAAS,EACT,cAAc,EACd,WAAW,EACX,eAAe,EACf,YAAY,EACZ,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,YAAY,EACZ,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EACL,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,SAAS,EACT,SAAS,EACT,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,QAAQ,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,WAAW,EACX,UAAU,EACV,UAAU,EACV,cAAc,EACd,aAAa,EACb,KAAK,WAAW,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,KAAK,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,KAAK,UAAU,GAChB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/core/runs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,kBAAkB,EAClB,IAAI,EACJ,SAAS,EACT,OAAO,EACP,SAAS,EACT,WAAW,EACX,eAAe,EACf,YAAY,EACZ,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,YAAY,EACZ,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,QAAQ,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,WAAW,EACX,UAAU,EACV,UAAU,EACV,cAAc,EACd,aAAa,EACb,KAAK,WAAW,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,SAAS,EACT,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,UAAU,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,KAAK,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,KAAK,gBAAgB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,KAAK,UAAU,GAChB,MAAM,kBAAkB,CAAC"}

package/dist/server/core/runs/index.js

@@ -1,14 +1,18 @@
-export { briefOf, createClaimService, fits, hasTool, onlineEntryOf, pickEntry, isServerHolder, payloadDirs, payloadRequires, skillTargets, variableTargets, } from './claim.js';
+export { briefOf, createClaimService, fits, fitsActor, hasTool, pickEntry, payloadDirs, payloadRequires, skillTargets, variableTargets, } from './claim.js';
 export { resolveAgentCli } from './policy.js';
-export { createBriefSectionRegistry, createRepoAccessRegistry, createRunMountRegistry, sessionKeyOf, } from './extensions.js';
+export { createClaimEligibility, } from './eligibility.js';
+export { createBriefSectionRegistry, createRepoAccessRegistry, createRunMountRegistry, sessionKeyOf, RepoAccessError, } from './extensions.js';
+export { createGitCredentialService, ISSUE_TIMEOUT_MS, } from './git-credentials.js';
 export { createBriefPreviewer } from './preview.js';
 export { findBrief, requestReset } from './workspace.store.js';
-export { createRunnerReports, } from './lifecycle.js';
-export { commandRef, createSubjectRegistry, dialectOf, takesType, } from './ports.js';
+export { createRunnerReports } from './lifecycle.js';
+export { commandRef, createSubjectRegistry, } from './ports.js';
 export { DEFAULT_TOOL_POLICY, MAX_CLAIM_FAILURES, retryDelayMs, toolPolicyFor, } from './policy.js';
 export { countActive, eventsAfter, hasSession, inputsOnSince, lastSummary, openCounts, openRunsOn, openRunsOnEach, pendingInputs, } from './run.store.js';
-export { createRunService, DEFAULT_THREAD, } from './run.service.js';
+export { createRunService, DEFAULT_THREAD, queuedRun, } from './run.service.js';
+export { RUN_REQUEST_TTL_MS, } from './run-requests.js';
 export { createSweeper } from './sweeper.js';
+export { executionForViewer, runForViewer, } from './execution-view.js';
 export { createAvailability, } from './availability.js';
 export { cliPackageFor } from './cli-package.js';
 export { createRunnerView, runsHeldBy, runsHeldByTool, } from './runner-view.js';