@stigmer/runner 3.10.0 → 3.11.1-dev.20260812192248

package/README.md

@@ -173,9 +173,22 @@ All configuration is environment-driven. Names and defaults below are verified a
 | `LOCAL_ARTIFACT_PATH` | Local storage | No | `~/.stigmer/data/artifacts` | Filesystem root of the local artifact store. **Must equal the stigmer-server's `ARTIFACT_LOCAL_BASE_PATH`** — in local mode the server writes an artifact to `<ARTIFACT_LOCAL_BASE_PATH>/<key>` and the runner reads it from `<LOCAL_ARTIFACT_PATH>/<key>`, so a mismatch makes every storage-key attachment and offload fail to resolve. The defaults align out of the box; the CLI local daemon sets both explicitly. |
 | `LOCAL_ARTIFACT_SERVE_URL` | Local storage | No | `http://localhost:7235` | Base URL of the server's artifact HTTP file server (its `ARTIFACT_HTTP_PORT`, default `GRPC_PORT + 1`). Used for blob downloads; the runner's own read-back goes straight to disk. |
 
+### Payload encryption (Temporal history at rest)
+
+The encryption codec encrypts every Temporal payload the runner produces (AES-256-GCM), so decrypted execution-context secrets never rest in workflow history or the Temporal UI. Payloads the runner did not encrypt (orchestrator inputs, signals, pre-rollout histories) pass through untouched. A key without its id — or a malformed key — fails the boot rather than silently running plaintext.
+
+Keys come from two sources with strict precedence: the env vars below (the operator's explicit choice — self-hosted deployments and cloud sandboxes), or, when the env is silent, server-managed per-identity keys delivered by `getRunnerBootstrapConfig` (desktop-class runners on cloud; held in memory only, re-fetched each boot). See `src/encryption/config.ts`.
+
+| Variable | Applies to | Required | Default | Purpose |
+|----------|-----------|----------|---------|---------|
+| `STIGMER_PAYLOAD_ENCRYPTION_KEY` | All | No | _(unset — encryption off)_ | Base64-encoded 32-byte AES-256 key. Setting it enables the codec. |
+| `STIGMER_PAYLOAD_ENCRYPTION_KEY_ID` | Payload encryption | With the key | _(none)_ | Identifier stamped on every encrypted payload so rotation can tell keys apart. Required when the key is set. |
+| `STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY` | Payload encryption | No | _(unset)_ | Decrypt-only key accepted during rotation windows (payloads written under the previous key stay readable). |
+| `STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY_ID` | Payload encryption | With the secondary key | _(none)_ | Key id of the secondary key. |
+
 ### Claim-check (large Temporal payloads)
 
-The claim-check codec offloads oversized Temporal payloads to artifact storage and passes a reference instead.
+The claim-check codec offloads oversized Temporal payloads to artifact storage and passes a reference instead. When payload encryption is enabled, encryption runs first, so offloaded blobs are ciphertext.
 
 | Variable | Applies to | Required | Default | Purpose |
 |----------|-----------|----------|---------|---------|

package/dist/.build-fingerprint

@@ -1 +1 @@
-{"hash":"a2b4e31e40541bd8","builtAt":"2026-08-10T13:04:56.756Z","fileCount":275}
+{"hash":"25c3d77a6cc06f15","builtAt":"2026-08-12T19:27:53.336Z","fileCount":290}

package/dist/activities/call-llm.js

@@ -23,6 +23,7 @@ import { inferProvider, stripProviderPrefix, } from "../shared/llm-proxy.js";
 import { computeLlmCostMicros, ensureLoaded as ensurePricingLoaded } from "../shared/model-pricing.js";
 import { resolveToApiModelId } from "../shared/model-registry.js";
 import { buildChatModel } from "../shared/model-client.js";
+import { checkDirectCredentials } from "../shared/llm-backend.js";
 import { classifyModelCallError } from "../shared/model-error.js";
 /**
  * Stream a chat model invocation and collect the response.
@@ -108,17 +109,15 @@ export async function callLlmAction(config, runtimeEnv, executionId) {
     const proxyActive = !!(proxyEndpoint && stigmerToken);
     console.log(`[call-llm] model=${modelId} provider=${provider} proxy=${proxyActive} ` +
         `structured=${!!config.response_schema} execution=${executionId}`);
-    // Direct mode (no proxy) requires the provider's own API key. Validated here
-    // rather than in buildChatModel so the shared module stays free of Temporal
-    // failure types.
+    // Direct mode (no proxy) requires a usable credential path — the provider's
+    // own API key, or a configured model backend that authenticates itself
+    // (vertex uses Google ADC; requiring an Anthropic key there would reject a
+    // correctly-configured deployment). Validated here rather than in
+    // buildChatModel so the shared module stays free of Temporal failure types.
     if (!proxyActive) {
-        if (provider === "openai" && !process.env.OPENAI_API_KEY) {
-            throw ApplicationFailure.nonRetryable(`OPENAI_API_KEY is not set and no proxy is configured. ` +
-                `Set the API key in your environment or connect to a Stigmer Cloud deployment.`, "LLM_MISSING_API_KEY");
-        }
-        if (provider === "anthropic" && !process.env.ANTHROPIC_API_KEY) {
-            throw ApplicationFailure.nonRetryable(`ANTHROPIC_API_KEY is not set and no proxy is configured. ` +
-                `Set the API key in your environment or connect to a Stigmer Cloud deployment.`, "LLM_MISSING_API_KEY");
+        const missing = checkDirectCredentials(provider);
+        if (missing !== null) {
+            throw ApplicationFailure.nonRetryable(missing, "LLM_MISSING_API_KEY");
         }
     }
     // Anthropic requires an explicit maxTokens; preserve the 4096 default here

package/dist/activities/call-llm.js.map

@@ -1 +1 @@
-{"version":3,"file":"call-llm.js","sourceRoot":"","sources":["../../src/activities/call-llm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGvE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EACL,aAAa,EACb,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,YAAY,IAAI,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACvG,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAqBlE;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC7B,KAAoB,EACpB,QAA0C;IAE1C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE5C,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,KAAyB,CAAC;QAC/C,IAAI,OAAO,YAAY,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC7C,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC;QAClC,CAAC;QAED,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,0EAA0E;QAC1E,uEAAuE;QACvE,gDAAgD;QAChD,MAAM,KAAK,GAAI,YAAkG,CAAC,cAAc,CAAC;QACjI,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;gBAC3C,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;gBAC5C,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,wBAAwB,CAC/B,GAAY,EACZ,OAAe,EACf,QAAqB,EACrB,SAAkB;IAElB,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,aAAa,GAAG,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;QACxE,MAAM,kBAAkB,CAAC,YAAY,CACnC,iCAAiC,OAAO,MAAM,aAAa,uCAAuC;YAClG,sBAAsB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3F,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,qEAAqE;IACrE,uDAAuD;IACvD,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACxG,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,kBAAkB,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;IACxE,MAAM,kBAAkB,CAAC,YAAY,CACnC,8BAA8B,OAAO,MAAM,aAAa,MAAM,UAAU,EAAE,EAC1E,mBAAmB,CACpB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAqB,EACrB,UAAmC,EACnC,WAAmB;IAEnB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAE5C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACzD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/C,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,aAAa,IAAI,YAAY,CAAC,CAAC;IAEtD,OAAO,CAAC,GAAG,CACT,oBAAoB,OAAO,aAAa,QAAQ,UAAU,WAAW,GAAG;QACxE,cAAc,CAAC,CAAC,MAAM,CAAC,eAAe,cAAc,WAAW,EAAE,CAClE,CAAC;IAEF,6EAA6E;IAC7E,4EAA4E;IAC5E,iBAAiB;IACjB,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,IAAI,QAAQ,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACzD,MAAM,kBAAkB,CAAC,YAAY,CACnC,wDAAwD;gBACxD,+EAA+E,EAC/E,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;YAC/D,MAAM,kBAAkB,CAAC,YAAY,CACnC,2DAA2D;gBAC3D,+EAA+E,EAC/E,qBAAqB,CACtB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,cAAc,CAAC;QACrC,SAAS,EAAE,aAAa;QACxB,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;QACtD,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QACpD,WAAW,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE;QACjD,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU;KACtF,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAqC,EAAE,CAAC;IACtD,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/C,IAAI,MAAqB,CAAC;IAE1B,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAC1D,MAAM,UAAU,GAAG,KAAK,CAAC,oBAAoB,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAEnD,MAAM,QAAQ,GAAI,QAAQ,CAAC,GAEzB,CAAC,cAAc,CAAC;YAElB,MAAM,GAAG;gBACP,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,CAAC;gBACzC,aAAa,EAAE,QAAQ,EAAE,aAAa,IAAI,CAAC;gBAC3C,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,KAAK,EAAE,OAAO;gBACd,QAAQ;aACT,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAEvF,MAAM,GAAG;gBACP,YAAY,EAAE,WAAW;gBACzB,aAAa,EAAE,YAAY;gBAC3B,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,OAAO;gBACd,QAAQ;aACT,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wBAAwB,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IACjG,MAAM,cAAc,GAAG,UAAU,GAAG,CAAC;QACnC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,qBAAqB,EAAE,UAAU,EAAE;QAClD,CAAC,CAAC,MAAM,CAAC;IAEX,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,cAA+B,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,UAAkB,EAAE,MAAqB;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC9D,MAAM,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG;YACZ,sBAAsB,EAAE,MAAM,CAAC,QAAQ;YACvC,mBAAmB,EAAE,MAAM,CAAC,KAAK;SAClC,CAAC;QACF,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC7C,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,YAAY;YAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC3E,IAAI,MAAM,CAAC,aAAa;YAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,OAAO,EAAE,KAAK,EACZ,MAAqB,EACrB,UAAmC,EACnC,WAAmB,EACK,EAAE;YAC1B,OAAO,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"call-llm.js","sourceRoot":"","sources":["../../src/activities/call-llm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGvE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EACL,aAAa,EACb,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,YAAY,IAAI,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACvG,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAqBlE;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC7B,KAAoB,EACpB,QAA0C;IAE1C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE5C,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,KAAyB,CAAC;QAC/C,IAAI,OAAO,YAAY,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC7C,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC;QAClC,CAAC;QAED,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,0EAA0E;QAC1E,uEAAuE;QACvE,gDAAgD;QAChD,MAAM,KAAK,GAAI,YAAkG,CAAC,cAAc,CAAC;QACjI,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;gBAC3C,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;gBAC5C,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,wBAAwB,CAC/B,GAAY,EACZ,OAAe,EACf,QAAqB,EACrB,SAAkB;IAElB,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,aAAa,GAAG,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;QACxE,MAAM,kBAAkB,CAAC,YAAY,CACnC,iCAAiC,OAAO,MAAM,aAAa,uCAAuC;YAClG,sBAAsB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3F,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,qEAAqE;IACrE,uDAAuD;IACvD,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACxG,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,kBAAkB,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;IACxE,MAAM,kBAAkB,CAAC,YAAY,CACnC,8BAA8B,OAAO,MAAM,aAAa,MAAM,UAAU,EAAE,EAC1E,mBAAmB,CACpB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAqB,EACrB,UAAmC,EACnC,WAAmB;IAEnB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,MAAM,mBAAmB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAE5C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACzD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/C,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,aAAa,IAAI,YAAY,CAAC,CAAC;IAEtD,OAAO,CAAC,GAAG,CACT,oBAAoB,OAAO,aAAa,QAAQ,UAAU,WAAW,GAAG;QACxE,cAAc,CAAC,CAAC,MAAM,CAAC,eAAe,cAAc,WAAW,EAAE,CAClE,CAAC;IAEF,4EAA4E;IAC5E,uEAAuE;IACvE,2EAA2E;IAC3E,kEAAkE;IAClE,4EAA4E;IAC5E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,kBAAkB,CAAC,YAAY,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,cAAc,CAAC;QACrC,SAAS,EAAE,aAAa;QACxB,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;QACtD,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QACpD,WAAW,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE;QACjD,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU;KACtF,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAqC,EAAE,CAAC;IACtD,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/C,IAAI,MAAqB,CAAC;IAE1B,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAC1D,MAAM,UAAU,GAAG,KAAK,CAAC,oBAAoB,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAEnD,MAAM,QAAQ,GAAI,QAAQ,CAAC,GAEzB,CAAC,cAAc,CAAC;YAElB,MAAM,GAAG;gBACP,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,CAAC;gBACzC,aAAa,EAAE,QAAQ,EAAE,aAAa,IAAI,CAAC;gBAC3C,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,KAAK,EAAE,OAAO;gBACd,QAAQ;aACT,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAEvF,MAAM,GAAG;gBACP,YAAY,EAAE,WAAW;gBACzB,aAAa,EAAE,YAAY;gBAC3B,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,OAAO;gBACd,QAAQ;aACT,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wBAAwB,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IACjG,MAAM,cAAc,GAAG,UAAU,GAAG,CAAC;QACnC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,qBAAqB,EAAE,UAAU,EAAE;QAClD,CAAC,CAAC,MAAM,CAAC;IAEX,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,cAA+B,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,UAAkB,EAAE,MAAqB;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC9D,MAAM,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG;YACZ,sBAAsB,EAAE,MAAM,CAAC,QAAQ;YACvC,mBAAmB,EAAE,MAAM,CAAC,KAAK;SAClC,CAAC;QACF,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC7C,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,YAAY;YAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC3E,IAAI,MAAM,CAAC,aAAa;YAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,OAAO,EAAE,KAAK,EACZ,MAAqB,EACrB,UAAmC,EACnC,WAAmB,EACK,EAAE;YAC1B,OAAO,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/activities/classify-tool-approvals.d.ts

@@ -44,7 +44,8 @@ export interface ToolApprovalResult {
     from_destructive_hint?: boolean;
 }
 export interface ClassifyToolsOptions {
-    proxyEndpoint: string;
+    /** Null when the deployment has no proxy — the runner calls providers directly. */
+    proxyEndpoint: string | null;
     stigmerToken: string | null;
     primaryModel: string;
 }

package/dist/activities/classify-tool-approvals.js

@@ -22,6 +22,8 @@ import { SystemMessage, HumanMessage } from "@langchain/core/messages";
 import { activityStarted, activityFinished } from "../idle-watchdog.js";
 import { getSummarizationModel } from "../shared/model-registry.js";
 import { buildChatModel } from "../shared/model-client.js";
+import { checkDirectCredentials } from "../shared/llm-backend.js";
+import { tryInferProvider } from "../shared/llm-proxy.js";
 const BATCH_SIZE = 40;
 const MAX_TOKENS_PER_TOOL = 60;
 const MIN_MAX_TOKENS = 4096;
@@ -88,6 +90,23 @@ export async function classifyTools(input, options) {
         return [];
     }
     const model = await getSummarizationModel(options.primaryModel);
+    // Direct mode with no credential path fails closed up front, with one
+    // actionable message instead of a provider 401 per batch. The message
+    // names the economy model and its provider because classification's
+    // provider follows the economy-model resolution, not the operator's key:
+    // "OPENAI_API_KEY is missing" is baffling to an operator holding an
+    // Anthropic key unless the log says which model classification wanted.
+    if (!options.proxyEndpoint) {
+        const provider = tryInferProvider(model);
+        const missing = provider === null ? null : checkDirectCredentials(provider);
+        if (missing !== null) {
+            console.warn(`[ClassifyToolApprovals] Cannot classify ${tools.length} tool(s) for ` +
+                `'${serverName}': the classifier model '${model}' (${provider}) has no ` +
+                `credential path — failing closed, every tool requires approval until ` +
+                `a reconnect re-classifies it. ${missing}`);
+            return fallbackApprovals(tools);
+        }
+    }
     const batches = [];
     for (let i = 0; i < tools.length; i += BATCH_SIZE) {
         batches.push(tools.slice(i, i + BATCH_SIZE));
@@ -141,7 +160,7 @@ async function classifyBatch(params) {
     // primary this routes to Claude, not the hardcoded OpenAI path it used to.
     const { model: llm } = await buildChatModel({
         modelName: model,
-        proxyEndpoint,
+        proxyEndpoint: proxyEndpoint ?? undefined,
         stigmerToken: stigmerToken ?? undefined,
         headerScope: { mcpServerId: mcpServerId ?? undefined },
         maxTokens,
@@ -244,8 +263,15 @@ export function createClassifyToolApprovalsActivities(config) {
             activityStarted();
             try {
                 console.log(`[ClassifyToolApprovals] Activity started: ${input.tools.length} tools for '${input.serverName}'`);
+                // Only a real proxy is an LLM proxy. stigmerBackendEndpoint (the
+                // gRPC control plane) serves no /v1/proxy/llm route — coercing it
+                // into one here used to 404 every classification in unproxied OSS
+                // and silently disable the vertex backend for this activity. (The
+                // registry fetch legitimately falls back to the backend endpoint —
+                // see shared/registry-endpoint.ts — because the control plane DOES
+                // serve /v1/proxy/model-registry; that fallback does not port here.)
                 return await classifyTools(input, {
-                    proxyEndpoint: config.proxyEndpoint ?? config.stigmerBackendEndpoint,
+                    proxyEndpoint: config.proxyEndpoint,
                     stigmerToken: config.stigmerToken,
                     primaryModel: config.primaryModel,
                 });

package/dist/activities/classify-tool-approvals.js.map

@@ -1 +1 @@
-{"version":3,"file":"classify-tool-approvals.js","sourceRoot":"","sources":["../../src/activities/classify-tool-approvals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAG3D,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,cAAc,GAAG,IAAI,CAAC;AAkC5B,gFAAgF;AAChF,iCAAiC;AACjC,gFAAgF;AAEhF,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;IAC/E,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CACrC,0DAA0D,CAC3D;IACD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAC1B,oDAAoD;QACpD,sDAAsD;QACtD,wCAAwC,CACzC;CACF,CAAC,CAAC;AAEH,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC,QAAQ,CAC3D,kDAAkD,CACnD;CACF,CAAC,CAAC;AAIH,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iEAwC2C,CAAC;AAyBlE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAiC,EACjC,OAA6B;IAE7B,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAEpE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAEhE,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,CAAC,GAAG,CACT,uCAAuC,KAAK,CAAC,MAAM,eAAe,UAAU,IAAI;QAChF,gBAAgB,KAAK,MAAM,OAAO,CAAC,MAAM,uBAAuB,UAAU,GAAG,CAC9E,CAAC;IAEF,MAAM,YAAY,GAAyB,EAAE,CAAC;IAE9C,KAAK,IAAI,QAAQ,GAAG,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC;gBACtC,KAAK;gBACL,UAAU;gBACV,iBAAiB;gBACjB,KAAK;gBACL,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,WAAW,EAAE,WAAW,IAAI,IAAI;gBAChC,QAAQ;gBACR,YAAY,EAAE,OAAO,CAAC,MAAM;aAC7B,CAAC,CAAC;YACH,wEAAwE;YACxE,yEAAyE;YACzE,mCAAmC;YACnC,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,6BAA6B,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAC5F,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,IAAI,CACV,iCAAiC,QAAQ,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,SAAS,UAAU,KAAK;oBACvF,GAAG,iBAAiB,mFAAmF,CACxG,CAAC;YACJ,CAAC;YACD,YAAY,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,iCAAiC,QAAQ,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,UAAU;gBACzE,QAAQ,UAAU,MAAM,KAAK,CAAC,MAAM,kDAAkD,EACtF,GAAG,CACJ,CAAC;YACF,YAAY,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,8EAA8E;IAC9E,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAEjE,OAAO,CAAC,GAAG,CACT,wDAAwD,UAAU,KAAK;QACvE,GAAG,QAAQ,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,yBAAyB,CACnE,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAkBD,KAAK,UAAU,aAAa,CAAC,MAA2B;IACtD,MAAM,EACJ,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAC3C,aAAa,EAAE,YAAY,EAAE,WAAW,EACxC,QAAQ,EAAE,YAAY,GACvB,GAAG,MAAM,CAAC;IAEX,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,GAAG,mBAAmB,CAAC,CAAC;IAE/E,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,cAAc,CAAC;QAC1C,SAAS,EAAE,KAAK;QAChB,aAAa;QACb,YAAY,EAAE,YAAY,IAAI,SAAS;QACvC,WAAW,EAAE,EAAE,WAAW,EAAE,WAAW,IAAI,SAAS,EAAE;QACtD,SAAS;KACV,CAAC,CAAC;IAEH,oEAAoE;IACpE,8EAA8E;IAC9E,oBAAoB;IACpB,MAAM,aAAa,GAAG,GAAG,CAAC,oBAAoB,CAC5C,iCAAiC,CAClC,CAAC;IAEF,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,UAAU,GACd,eAAe,UAAU,IAAI;QAC7B,gBAAgB,iBAAiB,IAAI,yBAAyB,MAAM;QACpE,sBAAsB,KAAK,CAAC,MAAM,QAAQ;QAC1C,YAAY,CAAC;IAEf,OAAO,CAAC,GAAG,CACT,6CAA6C,QAAQ,GAAG,CAAC,IAAI,YAAY,GAAG;QAC5E,IAAI,KAAK,CAAC,MAAM,sBAAsB,SAAS,UAAU,UAAU,GAAG,CACvE,CAAC;IAEF,MAAM,MAAM,GAAgC,MAAM,aAAa,CAAC,MAAM,CAAC;QACrE,IAAI,aAAa,CAAC,aAAa,CAAC;QAChC,IAAI,YAAY,CAAC,UAAU,CAAC;KAC7B,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CACT,iCAAiC,QAAQ,GAAG,CAAC,IAAI,YAAY,YAAY;QACzE,QAAQ,UAAU,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,6BAA6B,CAC7E,CAAC;IAEF,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;QACtC,OAAO,EAAE,CAAC,CAAC,OAAO;KACnB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,6BAA6B,CAC3C,KAAuB,EACvB,UAAgC;IAEhC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,UAAU,GAAyB,EAAE,CAAC;IAC5C,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,UAAU,CAAC,IAAI,CAAC;YACd,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,iBAAiB,EAAE,IAAI;YACvB,OAAO,EAAE,WAAW,IAAI,CAAC,IAAI,EAAE;SAChC,CAAC,CAAC;QACH,iBAAiB,EAAE,CAAC;IACtB,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAuB;IACvD,0EAA0E;IAC1E,+EAA+E;IAC/E,0EAA0E;IAC1E,8EAA8E;IAC9E,yEAAyE;IACzE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1B,SAAS,EAAE,IAAI,CAAC,IAAI;QACpB,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,WAAW,IAAI,CAAC,IAAI,EAAE;KAChC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAuB;IACvD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACnC,MAAM,KAAK,GAA4B;YACrC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC;QACjC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,KAAK,GAAI,MAAkC,CAAC,UAAU,CAAC;YAC7D,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvC,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF,MAAM,UAAU,qCAAqC,CAAC,MAAc;IAClE,OAAO;QACL,qBAAqB,EAAE,KAAK,EAC1B,KAAiC,EACF,EAAE;YACjC,eAAe,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,OAAO,CAAC,GAAG,CACT,6CAA6C,KAAK,CAAC,KAAK,CAAC,MAAM,eAAe,KAAK,CAAC,UAAU,GAAG,CAClG,CAAC;gBAEF,OAAO,MAAM,aAAa,CAAC,KAAK,EAAE;oBAChC,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,sBAAsB;oBACpE,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,YAAY,EAAE,MAAM,CAAC,YAAY;iBAClC,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,gBAAgB,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"classify-tool-approvals.js","sourceRoot":"","sources":["../../src/activities/classify-tool-approvals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,cAAc,GAAG,IAAI,CAAC;AAkC5B,gFAAgF;AAChF,iCAAiC;AACjC,gFAAgF;AAEhF,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;IAC/E,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CACrC,0DAA0D,CAC3D;IACD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAC1B,oDAAoD;QACpD,sDAAsD;QACtD,wCAAwC,CACzC;CACF,CAAC,CAAC;AAEH,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC,QAAQ,CAC3D,kDAAkD,CACnD;CACF,CAAC,CAAC;AAIH,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iEAwC2C,CAAC;AA0BlE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAiC,EACjC,OAA6B;IAE7B,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAEpE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAEhE,sEAAsE;IACtE,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,oEAAoE;IACpE,uEAAuE;IACvE,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAC5E,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CACV,2CAA2C,KAAK,CAAC,MAAM,eAAe;gBACtE,IAAI,UAAU,4BAA4B,KAAK,MAAM,QAAQ,WAAW;gBACxE,uEAAuE;gBACvE,iCAAiC,OAAO,EAAE,CAC3C,CAAC;YACF,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,CAAC,GAAG,CACT,uCAAuC,KAAK,CAAC,MAAM,eAAe,UAAU,IAAI;QAChF,gBAAgB,KAAK,MAAM,OAAO,CAAC,MAAM,uBAAuB,UAAU,GAAG,CAC9E,CAAC;IAEF,MAAM,YAAY,GAAyB,EAAE,CAAC;IAE9C,KAAK,IAAI,QAAQ,GAAG,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC;gBACtC,KAAK;gBACL,UAAU;gBACV,iBAAiB;gBACjB,KAAK;gBACL,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,WAAW,EAAE,WAAW,IAAI,IAAI;gBAChC,QAAQ;gBACR,YAAY,EAAE,OAAO,CAAC,MAAM;aAC7B,CAAC,CAAC;YACH,wEAAwE;YACxE,yEAAyE;YACzE,mCAAmC;YACnC,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,6BAA6B,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAC5F,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,IAAI,CACV,iCAAiC,QAAQ,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,SAAS,UAAU,KAAK;oBACvF,GAAG,iBAAiB,mFAAmF,CACxG,CAAC;YACJ,CAAC;YACD,YAAY,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,iCAAiC,QAAQ,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,UAAU;gBACzE,QAAQ,UAAU,MAAM,KAAK,CAAC,MAAM,kDAAkD,EACtF,GAAG,CACJ,CAAC;YACF,YAAY,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,8EAA8E;IAC9E,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAEjE,OAAO,CAAC,GAAG,CACT,wDAAwD,UAAU,KAAK;QACvE,GAAG,QAAQ,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,yBAAyB,CACnE,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAkBD,KAAK,UAAU,aAAa,CAAC,MAA2B;IACtD,MAAM,EACJ,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAC3C,aAAa,EAAE,YAAY,EAAE,WAAW,EACxC,QAAQ,EAAE,YAAY,GACvB,GAAG,MAAM,CAAC;IAEX,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,GAAG,mBAAmB,CAAC,CAAC;IAE/E,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,cAAc,CAAC;QAC1C,SAAS,EAAE,KAAK;QAChB,aAAa,EAAE,aAAa,IAAI,SAAS;QACzC,YAAY,EAAE,YAAY,IAAI,SAAS;QACvC,WAAW,EAAE,EAAE,WAAW,EAAE,WAAW,IAAI,SAAS,EAAE;QACtD,SAAS;KACV,CAAC,CAAC;IAEH,oEAAoE;IACpE,8EAA8E;IAC9E,oBAAoB;IACpB,MAAM,aAAa,GAAG,GAAG,CAAC,oBAAoB,CAC5C,iCAAiC,CAClC,CAAC;IAEF,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,UAAU,GACd,eAAe,UAAU,IAAI;QAC7B,gBAAgB,iBAAiB,IAAI,yBAAyB,MAAM;QACpE,sBAAsB,KAAK,CAAC,MAAM,QAAQ;QAC1C,YAAY,CAAC;IAEf,OAAO,CAAC,GAAG,CACT,6CAA6C,QAAQ,GAAG,CAAC,IAAI,YAAY,GAAG;QAC5E,IAAI,KAAK,CAAC,MAAM,sBAAsB,SAAS,UAAU,UAAU,GAAG,CACvE,CAAC;IAEF,MAAM,MAAM,GAAgC,MAAM,aAAa,CAAC,MAAM,CAAC;QACrE,IAAI,aAAa,CAAC,aAAa,CAAC;QAChC,IAAI,YAAY,CAAC,UAAU,CAAC;KAC7B,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CACT,iCAAiC,QAAQ,GAAG,CAAC,IAAI,YAAY,YAAY;QACzE,QAAQ,UAAU,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,6BAA6B,CAC7E,CAAC;IAEF,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;QACtC,OAAO,EAAE,CAAC,CAAC,OAAO;KACnB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,6BAA6B,CAC3C,KAAuB,EACvB,UAAgC;IAEhC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,UAAU,GAAyB,EAAE,CAAC;IAC5C,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,UAAU,CAAC,IAAI,CAAC;YACd,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,iBAAiB,EAAE,IAAI;YACvB,OAAO,EAAE,WAAW,IAAI,CAAC,IAAI,EAAE;SAChC,CAAC,CAAC;QACH,iBAAiB,EAAE,CAAC;IACtB,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAuB;IACvD,0EAA0E;IAC1E,+EAA+E;IAC/E,0EAA0E;IAC1E,8EAA8E;IAC9E,yEAAyE;IACzE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1B,SAAS,EAAE,IAAI,CAAC,IAAI;QACpB,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,WAAW,IAAI,CAAC,IAAI,EAAE;KAChC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAuB;IACvD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACnC,MAAM,KAAK,GAA4B;YACrC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC;QACjC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,KAAK,GAAI,MAAkC,CAAC,UAAU,CAAC;YAC7D,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvC,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF,MAAM,UAAU,qCAAqC,CAAC,MAAc;IAClE,OAAO;QACL,qBAAqB,EAAE,KAAK,EAC1B,KAAiC,EACF,EAAE;YACjC,eAAe,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,OAAO,CAAC,GAAG,CACT,6CAA6C,KAAK,CAAC,KAAK,CAAC,MAAM,eAAe,KAAK,CAAC,UAAU,GAAG,CAClG,CAAC;gBAEF,iEAAiE;gBACjE,kEAAkE;gBAClE,kEAAkE;gBAClE,kEAAkE;gBAClE,mEAAmE;gBACnE,mEAAmE;gBACnE,qEAAqE;gBACrE,OAAO,MAAM,aAAa,CAAC,KAAK,EAAE;oBAChC,aAAa,EAAE,MAAM,CAAC,aAAa;oBACnC,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,YAAY,EAAE,MAAM,CAAC,YAAY;iBAClC,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,gBAAgB,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/activities/discover-mcp-server.d.ts

@@ -18,12 +18,20 @@
  *   Output: DiscoverMcpServerOutput
  */
 import { StigmerClient } from "../client/stigmer-client.js";
+import { type ResolvedMcpServer } from "../shared/mcp-resolver.js";
 import { type McpTransportPosture } from "../shared/mcp-transport-guard.js";
 import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
 import type { Config } from "../config.js";
 export interface DiscoverMcpServerInput {
     mcpServerId: string;
     executionContextId?: string | null;
+    /**
+     * Execution-scoped token unlocking the connect EC's decrypted credentials
+     * (oss#535). Minted by the OSS handler and carried with the work item —
+     * discovery has no execution of its own to exchange for one. Absent on
+     * cloud, where the ambient connect_sandbox credential decrypts.
+     */
+    executionContextToken?: string | null;
     invokerIdentityAccountId?: string | null;
 }
 export interface DiscoveredToolResult {
@@ -55,6 +63,24 @@ export interface ToolApprovalDict {
     requiresApproval: boolean;
     message: string;
 }
+/**
+ * Raised when the credentials a server declares could not be delivered to
+ * discovery — the ExecutionContext read failed, came back empty, or returned
+ * redacted values (issue #239).
+ *
+ * Exists because the alternative is strictly worse: proceeding without the
+ * declared credentials either dies later as an opaque
+ * PlaceholderResolutionError (when a header/arg templates the missing var) or
+ * dials the endpoint with a garbage credential and strands the connect in the
+ * 4xx → SSE-fallback limbo this file's init bounds exist to contain. Failing
+ * here names the ROOT cause — credential delivery — instead of its downstream
+ * symptom. The message is user-facing and self-contained: it survives the
+ * Temporal boundary and the Go/Java connect wrappers include it in the
+ * user-facing failure text.
+ */
+export declare class CredentialResolutionError extends Error {
+    constructor(message: string);
+}
 export declare function toolsFingerprint(tools: DiscoveredToolResult[]): string;
 interface PreviousState {
     fingerprint: string;
@@ -75,6 +101,19 @@ export interface DiscoverDeps {
     transportPosture: McpTransportPosture;
 }
 export declare function discoverMcpServer(input: DiscoverMcpServerInput, deps: DiscoverDeps): Promise<DiscoverMcpServerOutput>;
+/**
+ * Pick the session-init bound for a resolved server's transport.
+ *
+ * Exported for tests; pure so the timeout choice (the load-bearing half of
+ * the issue-#239 fix) can be pinned without wiring a slow clock.
+ */
+export declare function initTimeoutMsFor(connectionType: ResolvedMcpServer["connectionType"]): number;
+/**
+ * The user-facing message for a session-init timeout. Names the endpoint (or
+ * command) so the failure is diagnosable from the message alone, and explains
+ * the known silent-hang shape for HTTP endpoints — issue #239's mechanism.
+ */
+export declare function initTimeoutMessageFor(slug: string, resolved: ResolvedMcpServer): string;
 export declare function createDiscoverMcpServerActivities(config: Config): {
     DiscoverMcpServerCapabilities: (input: DiscoverMcpServerInput) => Promise<DiscoverMcpServerOutput>;
 };

package/dist/activities/discover-mcp-server.js

@@ -26,11 +26,63 @@ import { toMcpClientConfig } from "../shared/mcp-manager.js";
 import { assertTransportAllowed, resolveMcpTransportPosture, } from "../shared/mcp-transport-guard.js";
 import { detectOAuthChallenge } from "../shared/mcp-oauth-detect.js";
 import { injectAnonymousCallerIdentityForDiscovery } from "../shared/caller-identity.js";
+import { startHeartbeat } from "../shared/heartbeat.js";
 import { withTimeout } from "../shared/with-timeout.js";
-const SESSION_INIT_TIMEOUT_MS = 270_000;
+/**
+ * MCP session-init bounds, per transport (issue #239).
+ *
+ * A remote endpoint that accepts a connection but never completes the MCP
+ * handshake would otherwise hang initialization forever: the MCP SDK's SSE
+ * transport resolves only on the server's `endpoint` event, with no timer of
+ * its own, and mcp-adapters silently falls back to SSE whenever the
+ * streamable-HTTP POST is answered with a 4xx (monday.com's endpoint did
+ * exactly this — 4xx on POST, then a silently-open SSE stream).
+ *
+ * HTTP endpoints get a short bound: there is nothing to install or compile,
+ * so a healthy endpoint completes the handshake in seconds — a short bound is
+ * what converts the silent hang into a fast, actionable failure (with room for
+ * the 10s OAuth re-probe on the failure path). stdio servers keep the generous
+ * bound because their first run may compile or install packages (`go run`,
+ * `npx`) — the cold-start case (issue #243). The OSS server's connect-workflow
+ * run timeout (connectTimeout, controller/connect.go) is derived from the
+ * stdio bound + the classification floor, so both errors stay reachable.
+ */
+const HTTP_INIT_TIMEOUT_MS = 30_000;
+const STDIO_INIT_TIMEOUT_MS = 270_000;
+/**
+ * The server-side secret-redaction sentinel. Byte-for-byte the value both
+ * editions substitute for secret values a caller may not decrypt
+ * (`SecretEncryptionService.REDACTED_MARKER` in stigmer-cloud,
+ * `RedactedMarker` in the OSS Go server). Discovery dialing an
+ * endpoint with a redacted credential is guaranteed to fail confusingly
+ * (e.g. `Authorization: Bearer ***REDACTED***` → 401 → SSE-fallback limbo),
+ * so it is refused up front with an actionable error instead.
+ */
+const REDACTED_MARKER = "***REDACTED***";
 const PLATFORM_INJECTABLE_MAP = {
     STIGMER_SERVER_ADDRESS: "STIGMER_MCP_PUBLIC_ENDPOINT",
 };
+/**
+ * Raised when the credentials a server declares could not be delivered to
+ * discovery — the ExecutionContext read failed, came back empty, or returned
+ * redacted values (issue #239).
+ *
+ * Exists because the alternative is strictly worse: proceeding without the
+ * declared credentials either dies later as an opaque
+ * PlaceholderResolutionError (when a header/arg templates the missing var) or
+ * dials the endpoint with a garbage credential and strands the connect in the
+ * 4xx → SSE-fallback limbo this file's init bounds exist to contain. Failing
+ * here names the ROOT cause — credential delivery — instead of its downstream
+ * symptom. The message is user-facing and self-contained: it survives the
+ * Temporal boundary and the Go/Java connect wrappers include it in the
+ * user-facing failure text.
+ */
+export class CredentialResolutionError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "CredentialResolutionError";
+    }
+}
 // ─────────────────────────────────────────────────────────────────────────────
 // Tools Fingerprint (pure, deterministic, safe in workflow code)
 // ─────────────────────────────────────────────────────────────────────────────
@@ -120,7 +172,7 @@ export function injectPlatformEnv(declaredEnvKeys, envVars) {
     return result ?? envVars;
 }
 export async function discoverMcpServer(input, deps) {
-    const { mcpServerId, executionContextId } = input;
+    const { mcpServerId, executionContextId, executionContextToken } = input;
     const { stigmerClient } = deps;
     console.log(`[DiscoverMcpServer] Discovery started for mcp_server_id=${mcpServerId}`);
     const mcpServer = await stigmerClient.getMcpServer(mcpServerId);
@@ -129,10 +181,9 @@ export async function discoverMcpServer(input, deps) {
     }
     const slug = mcpServer.metadata?.slug || mcpServerId;
     const previousState = extractPreviousState(mcpServer);
-    const envVars = await resolveEnvVarsForDiscovery(stigmerClient, executionContextId ?? null);
-    const declaredEnvKeys = mcpServer.spec.env
-        ? new Set(Object.keys(mcpServer.spec.env))
-        : new Set();
+    const declaredEnv = mcpServer.spec.env ?? {};
+    const envVars = await resolveEnvVarsForDiscovery(stigmerClient, executionContextId ?? null, executionContextToken ?? null, slug, declaredEnv);
+    const declaredEnvKeys = new Set(Object.keys(declaredEnv));
     const platformEnv = injectPlatformEnv(declaredEnvKeys, envVars);
     // Discovery runs with no session, so every declared caller-identity key
     // resolves to the anonymous sentinel — without it, a server templating
@@ -148,7 +199,7 @@ export async function discoverMcpServer(input, deps) {
     }
     assertTransportAllowed(resolved.slug, resolved.connectionType, deps.transportPosture);
     const connectionConfig = toMcpClientConfig([resolved]);
-    const { tools, resourceTemplates } = await connectAndDiscover(slug, connectionConfig);
+    const { tools, resourceTemplates } = await connectAndDiscover(slug, connectionConfig, resolved);
     const newFp = toolsFingerprint(tools);
     console.log(`[DiscoverMcpServer] Discovery complete for '${slug}': ` +
         `${tools.length} tool(s), ${resourceTemplates.length} resource template(s)`);
@@ -164,43 +215,119 @@ export async function discoverMcpServer(input, deps) {
 // ─────────────────────────────────────────────────────────────────────────────
 // Env Var Resolution
 // ─────────────────────────────────────────────────────────────────────────────
-async function resolveEnvVarsForDiscovery(client, executionContextId) {
+/**
+ * Resolve the discovery env from the connect flow's ExecutionContext,
+ * failing CLOSED when a server's declared credentials cannot be delivered.
+ *
+ * The strictness is keyed on whether the server declares any NON-OPTIONAL
+ * env var ("credentials expected"):
+ *
+ * - Credentials expected + the EC read errors, or the EC is missing/empty →
+ *   {@link CredentialResolutionError}. The backend only creates a connect EC
+ *   when it resolved credentials to deliver, so an unreadable or empty EC is
+ *   a delivery failure (auth/scope refusal, transient backend error), never a
+ *   normal state. Limping ahead was issue #239's failure mode: discovery died
+ *   later as an opaque PlaceholderResolutionError or a doomed dial.
+ * - Any delivered value equal to the redaction sentinel →
+ *   {@link CredentialResolutionError}, regardless of optionality. A redacted
+ *   value means the server-side decrypt gate refused THIS runner's credential
+ *   class/scope and fell closed to redaction — dialing with the literal
+ *   sentinel can only produce a misleading 401.
+ * - No non-optional declarations → the old lenient path (warn and continue):
+ *   servers declaring nothing (or only optional/injected keys like the
+ *   caller-identity family) legitimately discover without an EC.
+ */
+async function resolveEnvVarsForDiscovery(client, executionContextId, executionContextToken, slug, declaredEnv) {
+    const requiredKeys = Object.entries(declaredEnv)
+        .filter(([, decl]) => !decl.optional)
+        .map(([key]) => key);
+    const credentialsExpected = requiredKeys.length > 0;
     if (!executionContextId)
         return {};
+    let execCtx;
     try {
-        const execCtx = await client.getExecutionContextByExecutionId(executionContextId);
-        if (!execCtx?.spec?.data || Object.keys(execCtx.spec.data).length === 0) {
-            console.warn(`[DiscoverMcpServer] ExecutionContext '${executionContextId}' not found ` +
-                `or empty — MCP server may not require environment variables`);
-            return {};
-        }
-        const envVars = {};
-        for (const [key, execValue] of Object.entries(execCtx.spec.data)) {
-            envVars[key] = execValue.value;
-        }
-        console.log(`[DiscoverMcpServer] Resolved ${Object.keys(envVars).length} env var(s) ` +
-            `from ExecutionContext '${executionContextId}'`);
-        return envVars;
+        // The payload-carried token authenticates the read on OSS (oss#535);
+        // undefined on cloud, where the ambient credential applies instead.
+        execCtx = await client.getExecutionContextByExecutionId(executionContextId, executionContextToken ?? undefined);
     }
     catch (err) {
+        const cause = err instanceof Error ? err.message : String(err);
+        if (credentialsExpected) {
+            throw new CredentialResolutionError(`Could not resolve the credentials MCP server '${slug}' requires ` +
+                `(${requiredKeys.join(", ")}): the connect credential store was ` +
+                `unreadable (${cause}). This is a platform-side delivery failure, ` +
+                `not a problem with your credentials — retry the connect, and if it ` +
+                `persists, re-run the OAuth sign-in or re-enter the credentials.`);
+        }
         console.warn(`[DiscoverMcpServer] Failed to resolve ExecutionContext '${executionContextId}': ` +
-            `${err instanceof Error ? err.message : err}`);
+            `${cause}`);
+        return {};
+    }
+    const data = execCtx?.spec?.data ?? {};
+    if (Object.keys(data).length === 0) {
+        if (credentialsExpected) {
+            throw new CredentialResolutionError(`MCP server '${slug}' requires ${requiredKeys.join(", ")}, but the ` +
+                `connect flow delivered no credentials. Re-run the OAuth sign-in ` +
+                `(or re-enter the credentials) and connect again.`);
+        }
+        console.warn(`[DiscoverMcpServer] ExecutionContext '${executionContextId}' not found ` +
+            `or empty — MCP server may not require environment variables`);
         return {};
     }
+    const redactedKeys = Object.entries(data)
+        .filter(([, execValue]) => execValue.value === REDACTED_MARKER)
+        .map(([key]) => key);
+    if (redactedKeys.length > 0) {
+        throw new CredentialResolutionError(`The credentials for MCP server '${slug}' were delivered redacted ` +
+            `(${redactedKeys.join(", ")}): the platform refused to decrypt them ` +
+            `for this runner. This is a platform-side authorization failure — ` +
+            `retry the connect, and report it if it persists.`);
+    }
+    const envVars = {};
+    for (const [key, execValue] of Object.entries(data)) {
+        envVars[key] = execValue.value;
+    }
+    console.log(`[DiscoverMcpServer] Resolved ${Object.keys(envVars).length} env var(s) ` +
+        `from ExecutionContext '${executionContextId}'`);
+    return envVars;
 }
 // ─────────────────────────────────────────────────────────────────────────────
 // MCP Connection + Enumeration
 // ─────────────────────────────────────────────────────────────────────────────
-async function connectAndDiscover(slug, connectionConfig) {
+/**
+ * Pick the session-init bound for a resolved server's transport.
+ *
+ * Exported for tests; pure so the timeout choice (the load-bearing half of
+ * the issue-#239 fix) can be pinned without wiring a slow clock.
+ */
+export function initTimeoutMsFor(connectionType) {
+    return connectionType === "stdio" ? STDIO_INIT_TIMEOUT_MS : HTTP_INIT_TIMEOUT_MS;
+}
+/**
+ * The user-facing message for a session-init timeout. Names the endpoint (or
+ * command) so the failure is diagnosable from the message alone, and explains
+ * the known silent-hang shape for HTTP endpoints — issue #239's mechanism.
+ */
+export function initTimeoutMessageFor(slug, resolved) {
+    const seconds = Math.round(initTimeoutMsFor(resolved.connectionType) / 1000);
+    if (resolved.connectionType === "stdio") {
+        return (`MCP server '${slug}' (command: ${resolved.command}) did not complete ` +
+            `MCP initialization within ${seconds}s. If this server requires ` +
+            `compilation or package installation on first run (e.g. go run, npx), ` +
+            `the cold start may have exceeded the discovery timeout.`);
+    }
+    return (`MCP server '${slug}' at ${resolved.url} did not complete MCP ` +
+        `initialization within ${seconds}s. The endpoint accepted the connection ` +
+        `but never finished the handshake — commonly an endpoint that rejects ` +
+        `streamable HTTP while leaving its SSE fallback stream silently open. ` +
+        `Verify the URL points at a live streamable-HTTP MCP endpoint.`);
+}
+async function connectAndDiscover(slug, connectionConfig, resolved) {
     const client = new MultiServerMCPClient(connectionConfig);
     const tools = [];
     const resourceTemplates = [];
     try {
-        const timeoutMessage = `MCP server '${slug}' did not respond within ` +
-            `${Math.round(SESSION_INIT_TIMEOUT_MS / 1000)}s. If this server requires compilation or ` +
-            `package installation on first run (e.g. go run, npx), the cold ` +
-            `start may have exceeded the discovery timeout.`;
-        await withTimeout(SESSION_INIT_TIMEOUT_MS, timeoutMessage, async () => {
+        await withTimeout(initTimeoutMsFor(resolved.connectionType), () => initTimeoutMessageFor(slug, resolved), async () => {
             await client.initializeConnections();
             const mcpClient = await client.getClient(slug);
             if (!mcpClient) {
@@ -287,6 +414,15 @@ export function createDiscoverMcpServerActivities(config) {
     return {
         DiscoverMcpServerCapabilities: async (input) => {
             activityStarted();
+            // The connect workflow proxies this activity with a 60s heartbeatTimeout,
+            // so it MUST heartbeat: before this loop existed, any discovery slower
+            // than 60s (stdio cold start — issue #243) or wedged on a silent remote
+            // (issue #239) was killed by Temporal with an opaque heartbeat timeout
+            // instead of reaching this file's actionable init-timeout errors.
+            const hb = startHeartbeat(15_000, () => ({
+                phase: "discovering_mcp_server",
+                mcpServerId: input.mcpServerId,
+            }));
             try {
                 return await discoverMcpServer(input, {
                     stigmerClient,
@@ -294,6 +430,7 @@ export function createDiscoverMcpServerActivities(config) {
                 });
             }
             finally {
+                hb.stop();
                 activityFinished();
             }
         },

package/dist/activities/discover-mcp-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"discover-mcp-server.js","sourceRoot":"","sources":["../../src/activities/discover-mcp-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAE3B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,yCAAyC,EAAE,MAAM,8BAA8B,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAIxD,MAAM,uBAAuB,GAAG,OAAO,CAAC;AAExC,MAAM,uBAAuB,GAA2B;IACtD,sBAAsB,EAAE,6BAA6B;CACtD,CAAC;AAwDF,gFAAgF;AAChF,iEAAiE;AACjE,gFAAgF;AAEhF,MAAM,UAAU,gBAAgB,CAAC,KAA6B;IAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAElC,MAAM,SAAS,GAAG,KAAK;SACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,YAAY,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;KACpC,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhD,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;SACjC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAYD,MAAM,UAAU,oBAAoB,CAAC,SAAoB;IACvD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;IAChC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAEtE,MAAM,IAAI,GAAG,MAAM,CAAC,sBAAsB,CAAC;IAC3C,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,MAAM,GAAmC,IAAI,CAAC;YAClD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjD,CAAC;YACD,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,MAAM;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAuB,EAAE,CAAC;IAC7C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAC5C,aAAa,CAAC,IAAI,CAAC;YACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,gBAAgB,EAAE,IAAI;YACtB,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,WAAW,EAAE,gBAAgB,CAAC,SAAS,CAAC;QACxC,aAAa;QACb,KAAK,EAAE,SAAS;KACjB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,MAAe;IAC1C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF,MAAM,UAAU,iBAAiB,CAC/B,eAA4B,EAC5B,OAA+B;IAE/B,IAAI,eAAe,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAE/C,IAAI,MAA0C,CAAC;IAE/C,KAAK,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,IAAI,CAAC,MAAM;YAAE,MAAM,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QACrC,IAAI,SAAS,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,KAAK,EAAE,CAAC;YACvD,OAAO,CAAC,IAAI,CACV,qBAAqB,SAAS,0CAA0C;gBACxE,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;IAC5B,CAAC;IAED,OAAO,MAAM,IAAI,OAAO,CAAC;AAC3B,CAAC;AAkBD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAA6B,EAC7B,IAAkB;IAElB,MAAM,EAAE,WAAW,EAAE,kBAAkB,EAAE,GAAG,KAAK,CAAC;IAClD,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAE/B,OAAO,CAAC,GAAG,CACT,2DAA2D,WAAW,EAAE,CACzE,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAChE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,eAAe,WAAW,4BAA4B,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,IAAI,WAAW,CAAC;IACrD,MAAM,aAAa,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAC9C,aAAa,EACb,kBAAkB,IAAI,IAAI,CAC3B,CAAC;IAEF,MAAM,eAAe,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG;QACxC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC;IACtB,MAAM,WAAW,GAAG,iBAAiB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAEhE,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,+DAA+D;IAC/D,gEAAgE;IAChE,iCAAiC;IACjC,MAAM,QAAQ,GAAG,yCAAyC,CACxD,eAAe,EACf,WAAW,CACZ,CAAC;IAEF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,wCAAwC;YAC3D,qDAAqD,CACtD,CAAC;IACJ,CAAC;IAED,sBAAsB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAEtF,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvD,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,MAAM,kBAAkB,CAC3D,IAAI,EACJ,gBAAgB,CACjB,CAAC;IAEF,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAEtC,OAAO,CAAC,GAAG,CACT,+CAA+C,IAAI,KAAK;QACxD,GAAG,KAAK,CAAC,MAAM,aAAa,iBAAiB,CAAC,MAAM,uBAAuB,CAC5E,CAAC;IAEF,OAAO;QACL,KAAK;QACL,iBAAiB;QACjB,wBAAwB,EAAE,aAAa,CAAC,WAAW;QACnD,qBAAqB,EAAE,aAAa,CAAC,aAAa;QAClD,mBAAmB,EAAE,KAAK;QAC1B,aAAa,EAAE,aAAa,CAAC,KAAK;KACnC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF,KAAK,UAAU,0BAA0B,CACvC,MAAqB,EACrB,kBAAiC;IAEjC,IAAI,CAAC,kBAAkB;QAAE,OAAO,EAAE,CAAC;IAEnC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAC3D,kBAAkB,CACnB,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO,CAAC,IAAI,CACV,yCAAyC,kBAAkB,cAAc;gBACzE,6DAA6D,CAC9D,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;QACjC,CAAC;QAED,OAAO,CAAC,GAAG,CACT,gCAAgC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,cAAc;YACzE,0BAA0B,kBAAkB,GAAG,CAChD,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,2DAA2D,kBAAkB,KAAK;YAClF,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAC9C,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,+BAA+B;AAC/B,gFAAgF;AAEhF,KAAK,UAAU,kBAAkB,CAC/B,IAAY,EACZ,gBAAsD;IAKtD,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAC1D,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,iBAAiB,GAAuC,EAAE,CAAC;IAEjE,IAAI,CAAC;QACH,MAAM,cAAc,GAClB,eAAe,IAAI,2BAA2B;YAC9C,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC,4CAA4C;YACzF,iEAAiE;YACjE,gDAAgD,CAAC;QACnD,MAAM,WAAW,CAAC,uBAAuB,EAAE,cAAc,EAAE,KAAK,IAAI,EAAE;YACpE,MAAM,MAAM,CAAC,qBAAqB,EAAE,CAAC;YAErC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,wCAAwC,IAAI,wBAAwB,CACrE,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,CAAC;YAChD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;gBACrC,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;oBACnC,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC3B,CAAC,CAAE,IAAI,CAAC,WAAuC;wBAC/C,CAAC,CAAC,IAAI;oBACR,sEAAsE;oBACtE,2DAA2D;oBAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC3B,CAAC,CAAC;4BACE,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,YAAY;4BAC3C,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe;yBAClD;wBACH,CAAC,CAAC,IAAI;iBACT,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,SAAS,CAAC,qBAAqB,EAAE,CAAC;gBACvD,IAAI,YAAY,EAAE,SAAS,EAAE,CAAC;oBAC5B,MAAM,eAAe,GAAG,MAAM,SAAS,CAAC,qBAAqB,EAAE,CAAC;oBAChE,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,iBAAiB,EAAE,CAAC;wBACpD,iBAAiB,CAAC,IAAI,CAAC;4BACrB,WAAW,EAAE,GAAG,CAAC,WAAW;4BAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;4BACd,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;4BAClC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE;yBAC7B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CACV,+BAA+B,IAAI,qBAAqB;oBACxD,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAClE,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAC1E,IAAI,UAAU;YAAE,MAAM,UAAU,CAAC;QACjC,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YAC1C,OAAO,CAAC,IAAI,CACV,qDAAqD,IAAI,KAAK;gBAC9D,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAC9C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,wBAAwB,CACrC,IAAY,EACZ,gBAAsD;IAEtD,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,oBAAoB,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACxE,CAAC;AAED,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF,MAAM,UAAU,iCAAiC,CAAC,MAAc;IAC9D,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC;QACtC,QAAQ,EAAE,MAAM,CAAC,sBAAsB;QACvC,KAAK,EAAE,MAAM,CAAC,YAAY;QAC1B,QAAQ,EAAE,MAAM,CAAC,eAAe;QAChC,cAAc,EAAE,MAAM,CAAC,qBAAqB;KAC7C,CAAC,CAAC;IAEH,OAAO;QACL,6BAA6B,EAAE,KAAK,EAClC,KAA6B,EACK,EAAE;YACpC,eAAe,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,OAAO,MAAM,iBAAiB,CAAC,KAAK,EAAE;oBACpC,aAAa;oBACb,gBAAgB,EAAE,0BAA0B,CAAC,MAAM,CAAC,IAAI,CAAC;iBAC1D,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,gBAAgB,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"discover-mcp-server.js","sourceRoot":"","sources":["../../src/activities/discover-mcp-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAA0B,MAAM,2BAA2B,CAAC;AACxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAE3B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,yCAAyC,EAAE,MAAM,8BAA8B,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAKxD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAEtC;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAEzC,MAAM,uBAAuB,GAA2B;IACtD,sBAAsB,EAAE,6BAA6B;CACtD,CAAC;AA+DF;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,gFAAgF;AAChF,iEAAiE;AACjE,gFAAgF;AAEhF,MAAM,UAAU,gBAAgB,CAAC,KAA6B;IAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAElC,MAAM,SAAS,GAAG,KAAK;SACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,YAAY,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;KACpC,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhD,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;SACjC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAYD,MAAM,UAAU,oBAAoB,CAAC,SAAoB;IACvD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;IAChC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAEtE,MAAM,IAAI,GAAG,MAAM,CAAC,sBAAsB,CAAC;IAC3C,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,MAAM,GAAmC,IAAI,CAAC;YAClD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjD,CAAC;YACD,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,MAAM;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAuB,EAAE,CAAC;IAC7C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAC5C,aAAa,CAAC,IAAI,CAAC;YACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,gBAAgB,EAAE,IAAI;YACtB,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,WAAW,EAAE,gBAAgB,CAAC,SAAS,CAAC;QACxC,aAAa;QACb,KAAK,EAAE,SAAS;KACjB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,MAAe;IAC1C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF,MAAM,UAAU,iBAAiB,CAC/B,eAA4B,EAC5B,OAA+B;IAE/B,IAAI,eAAe,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAE/C,IAAI,MAA0C,CAAC;IAE/C,KAAK,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,IAAI,CAAC,MAAM;YAAE,MAAM,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QACrC,IAAI,SAAS,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,KAAK,EAAE,CAAC;YACvD,OAAO,CAAC,IAAI,CACV,qBAAqB,SAAS,0CAA0C;gBACxE,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;IAC5B,CAAC;IAED,OAAO,MAAM,IAAI,OAAO,CAAC;AAC3B,CAAC;AAkBD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAA6B,EAC7B,IAAkB;IAElB,MAAM,EAAE,WAAW,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,GAAG,KAAK,CAAC;IACzE,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAE/B,OAAO,CAAC,GAAG,CACT,2DAA2D,WAAW,EAAE,CACzE,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAChE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,eAAe,WAAW,4BAA4B,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,IAAI,WAAW,CAAC;IACrD,MAAM,aAAa,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAEtD,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAC9C,aAAa,EACb,kBAAkB,IAAI,IAAI,EAC1B,qBAAqB,IAAI,IAAI,EAC7B,IAAI,EACJ,WAAW,CACZ,CAAC;IAEF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,iBAAiB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAEhE,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,+DAA+D;IAC/D,gEAAgE;IAChE,iCAAiC;IACjC,MAAM,QAAQ,GAAG,yCAAyC,CACxD,eAAe,EACf,WAAW,CACZ,CAAC;IAEF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,wCAAwC;YAC3D,qDAAqD,CACtD,CAAC;IACJ,CAAC;IAED,sBAAsB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAEtF,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvD,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,MAAM,kBAAkB,CAC3D,IAAI,EACJ,gBAAgB,EAChB,QAAQ,CACT,CAAC;IAEF,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAEtC,OAAO,CAAC,GAAG,CACT,+CAA+C,IAAI,KAAK;QACxD,GAAG,KAAK,CAAC,MAAM,aAAa,iBAAiB,CAAC,MAAM,uBAAuB,CAC5E,CAAC;IAEF,OAAO;QACL,KAAK;QACL,iBAAiB;QACjB,wBAAwB,EAAE,aAAa,CAAC,WAAW;QACnD,qBAAqB,EAAE,aAAa,CAAC,aAAa;QAClD,mBAAmB,EAAE,KAAK;QAC1B,aAAa,EAAE,aAAa,CAAC,KAAK;KACnC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,KAAK,UAAU,0BAA0B,CACvC,MAAqB,EACrB,kBAAiC,EACjC,qBAAoC,EACpC,IAAY,EACZ,WAA8C;IAE9C,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;SAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,mBAAmB,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IAEpD,IAAI,CAAC,kBAAkB;QAAE,OAAO,EAAE,CAAC;IAEnC,IAAI,OAA4E,CAAC;IACjF,IAAI,CAAC;QACH,qEAAqE;QACrE,oEAAoE;QACpE,OAAO,GAAG,MAAM,MAAM,CAAC,gCAAgC,CACrD,kBAAkB,EAClB,qBAAqB,IAAI,SAAS,CACnC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,IAAI,yBAAyB,CACjC,iDAAiD,IAAI,aAAa;gBAClE,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,sCAAsC;gBACjE,eAAe,KAAK,+CAA+C;gBACnE,qEAAqE;gBACrE,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CACV,2DAA2D,kBAAkB,KAAK;YAClF,GAAG,KAAK,EAAE,CACX,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;IACvC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,IAAI,yBAAyB,CACjC,eAAe,IAAI,cAAc,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY;gBACpE,kEAAkE;gBAClE,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CACV,yCAAyC,kBAAkB,cAAc;YACzE,6DAA6D,CAC9D,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,eAAe,CAAC;SAC9D,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,yBAAyB,CACjC,mCAAmC,IAAI,4BAA4B;YACnE,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,0CAA0C;YACrE,mEAAmE;YACnE,kDAAkD,CACnD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;IACjC,CAAC;IAED,OAAO,CAAC,GAAG,CACT,gCAAgC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,cAAc;QACzE,0BAA0B,kBAAkB,GAAG,CAChD,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gFAAgF;AAChF,+BAA+B;AAC/B,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,cAAmD;IAClF,OAAO,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,oBAAoB,CAAC;AACnF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,QAA2B;IAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7E,IAAI,QAAQ,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;QACxC,OAAO,CACL,eAAe,IAAI,eAAe,QAAQ,CAAC,OAAO,qBAAqB;YACvE,6BAA6B,OAAO,6BAA6B;YACjE,uEAAuE;YACvE,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,OAAO,CACL,eAAe,IAAI,QAAQ,QAAQ,CAAC,GAAG,wBAAwB;QAC/D,yBAAyB,OAAO,0CAA0C;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,+DAA+D,CAChE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAAY,EACZ,gBAAsD,EACtD,QAA2B;IAK3B,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAC1D,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,iBAAiB,GAAuC,EAAE,CAAC;IAEjE,IAAI,CAAC;QACH,MAAM,WAAW,CACf,gBAAgB,CAAC,QAAQ,CAAC,cAAc,CAAC,EACzC,GAAG,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAC3C,KAAK,IAAI,EAAE;YACX,MAAM,MAAM,CAAC,qBAAqB,EAAE,CAAC;YAErC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,wCAAwC,IAAI,wBAAwB,CACrE,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,CAAC;YAChD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;gBACrC,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;oBACnC,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC3B,CAAC,CAAE,IAAI,CAAC,WAAuC;wBAC/C,CAAC,CAAC,IAAI;oBACR,sEAAsE;oBACtE,2DAA2D;oBAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC3B,CAAC,CAAC;4BACE,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,YAAY;4BAC3C,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe;yBAClD;wBACH,CAAC,CAAC,IAAI;iBACT,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,SAAS,CAAC,qBAAqB,EAAE,CAAC;gBACvD,IAAI,YAAY,EAAE,SAAS,EAAE,CAAC;oBAC5B,MAAM,eAAe,GAAG,MAAM,SAAS,CAAC,qBAAqB,EAAE,CAAC;oBAChE,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,iBAAiB,EAAE,CAAC;wBACpD,iBAAiB,CAAC,IAAI,CAAC;4BACrB,WAAW,EAAE,GAAG,CAAC,WAAW;4BAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;4BACd,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;4BAClC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE;yBAC7B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CACV,+BAA+B,IAAI,qBAAqB;oBACxD,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAClE,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAC1E,IAAI,UAAU;YAAE,MAAM,UAAU,CAAC;QACjC,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YAC1C,OAAO,CAAC,IAAI,CACV,qDAAqD,IAAI,KAAK;gBAC9D,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAC9C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,wBAAwB,CACrC,IAAY,EACZ,gBAAsD;IAEtD,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,oBAAoB,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACxE,CAAC;AAED,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF,MAAM,UAAU,iCAAiC,CAAC,MAAc;IAC9D,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC;QACtC,QAAQ,EAAE,MAAM,CAAC,sBAAsB;QACvC,KAAK,EAAE,MAAM,CAAC,YAAY;QAC1B,QAAQ,EAAE,MAAM,CAAC,eAAe;QAChC,cAAc,EAAE,MAAM,CAAC,qBAAqB;KAC7C,CAAC,CAAC;IAEH,OAAO;QACL,6BAA6B,EAAE,KAAK,EAClC,KAA6B,EACK,EAAE;YACpC,eAAe,EAAE,CAAC;YAClB,0EAA0E;YAC1E,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,kEAAkE;YAClE,MAAM,EAAE,GAAG,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACvC,KAAK,EAAE,wBAAwB;gBAC/B,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CAAC,CAAC;YACJ,IAAI,CAAC;gBACH,OAAO,MAAM,iBAAiB,CAAC,KAAK,EAAE;oBACpC,aAAa;oBACb,gBAAgB,EAAE,0BAA0B,CAAC,MAAM,CAAC,IAAI,CAAC;iBAC1D,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,EAAE,CAAC,IAAI,EAAE,CAAC;gBACV,gBAAgB,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/activities/emit-event.d.ts

@@ -9,7 +9,17 @@
  *
  * Supported delivery targets:
  * - webhook: HTTP POST with Content-Type: application/cloudevents+json
- * - signal:  Temporal signal to another running workflow's listen task
+ * - signal:  signal to another workflow execution's listen task, routed
+ *            through the server's SendSignal lane
+ *
+ * Signal delivery is deliberately server-mediated (oss#517): a direct
+ * Temporal client here would bypass the authorization boundary (any
+ * workflow could signal any workflow id in the namespace) and is
+ * structurally incompatible with payload encryption — emit→listen is
+ * the platform's only runner-to-runner channel, and under per-identity
+ * runner keys a sender-encrypted signal fails closed at a receiver
+ * holding a different key. The server re-produces the payload, so each
+ * side's codec passes it through.
  *
  * CloudEvents spec: https://github.com/cloudevents/spec/blob/v1.0.2/cloudevents/spec.md
  */
@@ -18,7 +28,9 @@ export interface WebhookDeliveryTarget {
     readonly headers?: Readonly<Record<string, string>>;
 }
 export interface SignalDeliveryTarget {
-    readonly workflow_id: string;
+    /** Target workflow execution id ("wfx_..."), as returned by run/create. */
+    readonly execution_id: string;
+    /** Signal name matching the target's listen task event id (verbatim). */
     readonly signal_name: string;
 }
 export type DeliveryTarget = {