@stigmer/runner 3.11.0 → 3.11.1-dev.20260812192248

package/dist/shared/runner-credential-keys.js

@@ -0,0 +1,47 @@
+/**
+ * Env var names of the runner's own credentials — the single source of truth
+ * for every surface that isolates agent-spawned processes from the runner's
+ * process env (issue #385).
+ *
+ * Inclusion rule: a name belongs here iff the runner reads it from its own
+ * `process.env` to authenticate the runner's own outbound calls. User-supplied
+ * credentials resolved from ExecutionContext (e.g. GITHUB_TOKEN, read only
+ * from mergedEnvVars) must NEVER be listed — the ExecutionContext overlay is
+ * their sanctioned delivery channel, and denying them here would break it.
+ *
+ * Consumers:
+ * - shell-env.ts: SHELL_ENV_DENYLIST for the native harness `execute` tool.
+ * - mcp-manager.test.ts: leak-tripwire canaries for MCP stdio subprocesses
+ *   (that path passes NO runner env by construction; the test plants these
+ *   names to prove none leak through).
+ *
+ * Ambient cloud-SDK chain vars (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY,
+ * GOOGLE_APPLICATION_CREDENTIALS, ...) are deliberately absent: they are
+ * dual-use on local runners (operators expect agent shells to keep their
+ * ambient aws/gcloud auth), and on a local backend the shell can read the
+ * credential files off disk regardless (owner ruling on #385).
+ */
+export const RUNNER_CREDENTIAL_ENV_KEYS = [
+    // Derives HITL approval fingerprints (fingerprint-secret.ts) — an agent
+    // that reads this could forge approval receipts.
+    "STIGMER_RUNNER_HITL_SECRET",
+    // Stigmer control-plane auth (config.ts; rotated at runtime by
+    // runner-manager.ts). Executions receive theirs via ExecutionContext.
+    "STIGMER_TOKEN",
+    // Fallback bearer token for model-registry/pricing fetches when
+    // STIGMER_TOKEN is unset (registry-endpoint.ts).
+    "STIGMER_AUTH_TOKEN",
+    // Cursor harness credential (config.ts) — agent-spawned processes never
+    // need direct Cursor API access.
+    "CURSOR_API_KEY",
+    // Direct-mode Anthropic key for the native harness (model-client.ts).
+    "ANTHROPIC_API_KEY",
+    // Direct-mode OpenAI key for the native harness (model-client.ts).
+    "OPENAI_API_KEY",
+    // Azure AI Foundry backend key (model-client.ts).
+    "ANTHROPIC_FOUNDRY_API_KEY",
+    // Bedrock backend bearer credential, read by the AWS SDK's chain
+    // (llm-backend.ts documents it as a supported auth path).
+    "AWS_BEARER_TOKEN_BEDROCK",
+];
+//# sourceMappingURL=runner-credential-keys.js.map

package/dist/shared/runner-credential-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-credential-keys.js","sourceRoot":"","sources":["../../src/shared/runner-credential-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,wEAAwE;IACxE,iDAAiD;IACjD,4BAA4B;IAC5B,+DAA+D;IAC/D,sEAAsE;IACtE,eAAe;IACf,gEAAgE;IAChE,iDAAiD;IACjD,oBAAoB;IACpB,wEAAwE;IACxE,iCAAiC;IACjC,gBAAgB;IAChB,sEAAsE;IACtE,mBAAmB;IACnB,mEAAmE;IACnE,gBAAgB;IAChB,kDAAkD;IAClD,2BAA2B;IAC3B,iEAAiE;IACjE,0DAA0D;IAC1D,0BAA0B;CAC3B,CAAC"}

package/dist/workflow-engine/resolve.d.ts

@@ -53,11 +53,29 @@ export declare function substituteResults(obj: Record<string, unknown>, results:
 export declare function isRuntimePlaceholder(value: string): boolean;
 /**
  * Resolves runtime placeholders (`${.secrets.KEY}`, `${.env_vars.KEY}`)
- * in a string using values from the runtime environment map.
+ * in a string using values from the runtime environment map. Missing
+ * keys resolve to `""` — callers that must fail loudly instead use
+ * {@link resolveRuntimePlaceholdersStrict}.
  *
  * This runs in activities only — never in the workflow sandbox.
  */
 export declare function resolveRuntimePlaceholders(value: string, runtimeEnv: Record<string, unknown>): string;
+/** Thrown by {@link resolveRuntimePlaceholdersStrict} for a missing key. */
+export declare class RuntimePlaceholderResolutionError extends Error {
+    readonly variableName: string;
+    readonly context?: string | undefined;
+    constructor(variableName: string, context?: string | undefined);
+}
+/**
+ * Strict variant of {@link resolveRuntimePlaceholders}: a placeholder
+ * whose key is missing from the runtime environment throws instead of
+ * resolving to `""` — a silently-empty credential produces cryptic
+ * downstream failures, so declared-value consumers (the run task's env
+ * contract) fail fast with the variable named.
+ *
+ * This runs in activities only — never in the workflow sandbox.
+ */
+export declare function resolveRuntimePlaceholdersStrict(value: string, runtimeEnv: Record<string, unknown>, context?: string): string;
 /**
  * Recursively resolves all runtime placeholders in a nested object.
  * Walks maps, arrays, and strings. Non-string leaves pass through.

package/dist/workflow-engine/resolve.js

@@ -124,6 +124,8 @@ function parsePath(path) {
     return parts;
 }
 const RUNTIME_PLACEHOLDER_RE = /\$\{\.(secrets|env_vars)\.\w+\}/;
+/** Substitution form of {@link RUNTIME_PLACEHOLDER_RE} (global, capturing). */
+const RUNTIME_PLACEHOLDER_SUB_RE = /\$\{\.(secrets|env_vars)\.(\w+)\}/g;
 /**
  * Checks whether a string contains a runtime placeholder that should
  * NOT be evaluated in the workflow (deterministic) phase. These are
@@ -137,16 +139,49 @@ export function isRuntimePlaceholder(value) {
 }
 /**
  * Resolves runtime placeholders (`${.secrets.KEY}`, `${.env_vars.KEY}`)
- * in a string using values from the runtime environment map.
+ * in a string using values from the runtime environment map. Missing
+ * keys resolve to `""` — callers that must fail loudly instead use
+ * {@link resolveRuntimePlaceholdersStrict}.
  *
  * This runs in activities only — never in the workflow sandbox.
  */
 export function resolveRuntimePlaceholders(value, runtimeEnv) {
-    return value.replace(/\$\{\.(secrets|env_vars)\.(\w+)\}/g, (_match, _ns, key) => {
+    return value.replace(RUNTIME_PLACEHOLDER_SUB_RE, (_match, _ns, key) => {
         const resolved = runtimeEnv[key];
         return resolved !== undefined ? String(resolved) : "";
     });
 }
+/** Thrown by {@link resolveRuntimePlaceholdersStrict} for a missing key. */
+export class RuntimePlaceholderResolutionError extends Error {
+    variableName;
+    context;
+    constructor(variableName, context) {
+        const where = context ? ` in ${context}` : "";
+        super(`Unresolved runtime placeholder for "${variableName}"${where}: ` +
+            `variable is not present in the workflow's runtime environment`);
+        this.variableName = variableName;
+        this.context = context;
+        this.name = "RuntimePlaceholderResolutionError";
+    }
+}
+/**
+ * Strict variant of {@link resolveRuntimePlaceholders}: a placeholder
+ * whose key is missing from the runtime environment throws instead of
+ * resolving to `""` — a silently-empty credential produces cryptic
+ * downstream failures, so declared-value consumers (the run task's env
+ * contract) fail fast with the variable named.
+ *
+ * This runs in activities only — never in the workflow sandbox.
+ */
+export function resolveRuntimePlaceholdersStrict(value, runtimeEnv, context) {
+    return value.replace(RUNTIME_PLACEHOLDER_SUB_RE, (_match, _ns, key) => {
+        const resolved = runtimeEnv[key];
+        if (resolved === undefined) {
+            throw new RuntimePlaceholderResolutionError(key, context);
+        }
+        return String(resolved);
+    });
+}
 /**
  * Recursively resolves all runtime placeholders in a nested object.
  * Walks maps, arrays, and strings. Non-string leaves pass through.

package/dist/workflow-engine/resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/workflow-engine/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EACL,0BAA0B,EAC1B,YAAY,EACZ,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAA+B,EAC/B,KAAc,EACd,KAAoB,EACpB,mBAAwC;IAExC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAEnC,wDAAwD;IACxD,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,WAAW,GAAgB,IAAI,GAAG,EAAE,CAAC;IACzC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAC/E,iBAAiB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACzC,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,+DAA+D;IAC/D,2EAA2E;IAC3E,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,0BAA0B,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,WAAW,CAAC,CAAC;IAE7F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAA4B,EAC5B,MAAM,GAAG,EAAE;IAEX,MAAM,WAAW,GAA2B,EAAE,CAAC;IAE/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAE/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACjF,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;aAAM,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,CAAC,MAAM,CACX,WAAW,EACX,kBAAkB,CAAC,KAAgC,EAAE,IAAI,CAAC,CAC3D,CAAC;QACJ,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;gBACjC,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1F,WAAW,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChD,CAAC;qBAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;oBAC7D,MAAM,CAAC,MAAM,CACX,WAAW,EACX,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAA4B,EAAE,QAAQ,CAAC,CAClE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAA4B,EAC5B,OAAgC;IAEhC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B,EAAE,IAAY,EAAE,KAAc;IAChF,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAY,GAAG,CAAC;IAE3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,GAAI,OAAqB,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAqB,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;IAC3C,CAAC;SAAM,CAAC;QACL,OAAmC,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEjC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACvD,IAAI,YAAY,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,sBAAsB,GAAG,iCAAiC,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAa,EACb,UAAmC;IAEnC,OAAO,KAAK,CAAC,OAAO,CAClB,oCAAoC,EACpC,CAAC,MAAM,EAAE,GAAW,EAAE,GAAW,EAAE,EAAE;QACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAY,EACZ,UAAmC;IAEnC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,0BAA0B,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;YAC1E,MAAM,CAAC,GAAG,CAAC,GAAG,yBAAyB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAaD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,GAA4B,EAC5B,KAAc,EACd,SAAkC,EAClC,mBAAwC,EACxC,YAAyB,IAAI,GAAG,EAAE;IAElC,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAC3C,MAAM,UAAU,GAA2B,EAAE,CAAC;IAE9C,0BAA0B,CAAC,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAErE,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEjD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAExE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAW,CAAC;QAC7D,IAAI,YAAY,GAAG,EAAE,CAAC;QACtB,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YACxC,qFAAqF;YACrF,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;YACnC,YAAY,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YACxD,YAAY,IAAI,0BAA0B,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YACzD,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC;QACzB,CAAC;QAED,YAAY,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,0BAA0B,CACjC,GAA4B,EAC5B,MAAc,EACd,QAA+B,EAC/B,UAAkC,EAClC,SAAsB;IAEtB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/C,wBAAwB,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAc,EACd,IAAY,EACZ,QAA+B,EAC/B,UAAkC,EAClC,SAAsB;IAEtB,kEAAkE;IAClE,qEAAqE;IACrE,uEAAuE;IACvE,+DAA+D;IAC/D,uEAAuE;IACvE,sEAAsE;IACtE,yDAAyD;IACzD,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO;IAEhC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,YAAY,CAAC,KAAK,CAAC;YAAE,OAAO;QAChC,MAAM,WAAW,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAErC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,UAAU,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnD,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvD,0BAA0B,CACxB,KAAgC,EAChC,IAAI,EACJ,QAAQ,EACR,UAAU,EACV,SAAS,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B,EAAE,IAAY;IAChE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAY,GAAG,CAAC;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,GAAI,OAAqB,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/workflow-engine/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EACL,0BAA0B,EAC1B,YAAY,EACZ,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAA+B,EAC/B,KAAc,EACd,KAAoB,EACpB,mBAAwC;IAExC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAEnC,wDAAwD;IACxD,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,WAAW,GAAgB,IAAI,GAAG,EAAE,CAAC;IACzC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAC/E,iBAAiB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACzC,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,+DAA+D;IAC/D,2EAA2E;IAC3E,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,0BAA0B,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,WAAW,CAAC,CAAC;IAE7F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAA4B,EAC5B,MAAM,GAAG,EAAE;IAEX,MAAM,WAAW,GAA2B,EAAE,CAAC;IAE/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAE/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACjF,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;aAAM,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,CAAC,MAAM,CACX,WAAW,EACX,kBAAkB,CAAC,KAAgC,EAAE,IAAI,CAAC,CAC3D,CAAC;QACJ,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;gBACjC,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1F,WAAW,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChD,CAAC;qBAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;oBAC7D,MAAM,CAAC,MAAM,CACX,WAAW,EACX,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAA4B,EAAE,QAAQ,CAAC,CAClE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAA4B,EAC5B,OAAgC;IAEhC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B,EAAE,IAAY,EAAE,KAAc;IAChF,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAY,GAAG,CAAC;IAE3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,GAAI,OAAqB,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAqB,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;IAC3C,CAAC;SAAM,CAAC;QACL,OAAmC,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEjC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACvD,IAAI,YAAY,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,sBAAsB,GAAG,iCAAiC,CAAC;AAEjE,+EAA+E;AAC/E,MAAM,0BAA0B,GAAG,oCAAoC,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAa,EACb,UAAmC;IAEnC,OAAO,KAAK,CAAC,OAAO,CAClB,0BAA0B,EAC1B,CAAC,MAAM,EAAE,GAAW,EAAE,GAAW,EAAE,EAAE;QACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,CAAC,CACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IAExC;IACA;IAFlB,YACkB,YAAoB,EACpB,OAAgB;QAEhC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,KAAK,CACH,uCAAuC,YAAY,IAAI,KAAK,IAAI;YAC9D,+DAA+D,CAClE,CAAC;QAPc,iBAAY,GAAZ,YAAY,CAAQ;QACpB,YAAO,GAAP,OAAO,CAAS;QAOhC,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gCAAgC,CAC9C,KAAa,EACb,UAAmC,EACnC,OAAgB;IAEhB,OAAO,KAAK,CAAC,OAAO,CAClB,0BAA0B,EAC1B,CAAC,MAAM,EAAE,GAAW,EAAE,GAAW,EAAE,EAAE;QACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,iCAAiC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAY,EACZ,UAAmC;IAEnC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,0BAA0B,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;YAC1E,MAAM,CAAC,GAAG,CAAC,GAAG,yBAAyB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAaD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,GAA4B,EAC5B,KAAc,EACd,SAAkC,EAClC,mBAAwC,EACxC,YAAyB,IAAI,GAAG,EAAE;IAElC,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAC3C,MAAM,UAAU,GAA2B,EAAE,CAAC;IAE9C,0BAA0B,CAAC,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAErE,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEjD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAExE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAW,CAAC;QAC7D,IAAI,YAAY,GAAG,EAAE,CAAC;QACtB,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YACxC,qFAAqF;YACrF,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;YACnC,YAAY,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YACxD,YAAY,IAAI,0BAA0B,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YACzD,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC;QACzB,CAAC;QAED,YAAY,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,0BAA0B,CACjC,GAA4B,EAC5B,MAAc,EACd,QAA+B,EAC/B,UAAkC,EAClC,SAAsB;IAEtB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/C,wBAAwB,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAc,EACd,IAAY,EACZ,QAA+B,EAC/B,UAAkC,EAClC,SAAsB;IAEtB,kEAAkE;IAClE,qEAAqE;IACrE,uEAAuE;IACvE,+DAA+D;IAC/D,uEAAuE;IACvE,sEAAsE;IACtE,yDAAyD;IACzD,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO;IAEhC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,YAAY,CAAC,KAAK,CAAC;YAAE,OAAO;QAChC,MAAM,WAAW,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAErC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,UAAU,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnD,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvD,0BAA0B,CACxB,KAAgC,EAChC,IAAI,EACJ,QAAQ,EACR,UAAU,EACV,SAAS,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B,EAAE,IAAY;IAChE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAY,GAAG,CAAC;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,GAAI,OAAqB,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/workflows/connect-mcp-server.js

@@ -151,6 +151,7 @@ export async function connectMcpServer(input) {
     const discovery = await discover.DiscoverMcpServerCapabilities({
         mcpServerId: input.mcp_server_id,
         executionContextId: input.execution_context_id ?? null,
+        executionContextToken: input.execution_context_token ?? null,
         invokerIdentityAccountId: input.invoker_identity_account_id ?? null,
     });
     // Content-addressed incremental classification: reuse prior decisions for
@@ -215,6 +216,7 @@ export async function discoverMcpServerLegacy(input) {
     const discovery = await discover.DiscoverMcpServerCapabilities({
         mcpServerId: input.mcp_server_id,
         executionContextId: input.execution_context_id ?? null,
+        executionContextToken: input.execution_context_token ?? null,
         invokerIdentityAccountId: input.invoker_identity_account_id ?? null,
     });
     return {

package/dist/workflows/connect-mcp-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-mcp-server.js","sourceRoot":"","sources":["../../src/workflows/connect-mcp-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAC;AAyB5D,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,4BAA4B;AAC5B,MAAM,QAAQ,GAAG,eAAe,CAAqB;IACnD,mBAAmB,EAAE,MAAM;IAC3B,gBAAgB,EAAE,KAAK;IACvB,KAAK,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;CAC9B,CAAC,CAAC;AAEH,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACvE,OAAO,eAAe,CAAqB;QACzC,mBAAmB,EAAE,GAAG,UAAU,GAAG;QACrC,KAAK,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,yEAAyE;AACzE,gFAAgF;AAEhF;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,IAA0B;IAC/C,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;KACvC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,6BAA6B,CAC3C,aAAqC,EACrC,qBAAyC,EACzC,YAAoC;IAEpC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC5D,KAAK,MAAM,QAAQ,IAAI,qBAAqB,EAAE,CAAC;QAC7C,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,eAAe,GAA2B,EAAE,CAAC;IACnD,MAAM,cAAc,GAAyB,EAAE,CAAC;IAEhD,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,aAAa,CAAC,IAAI,CAAC,CAAC;QAE3E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,KAAK,EAAE,CAAC;YACV,cAAc,CAAC,IAAI,CAAC;gBAClB,SAAS,EAAE,KAAK,CAAC,QAAQ;gBACzB,iBAAiB,EAAE,IAAI;gBACvB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;QACD,2EAA2E;IAC7E,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;AAC7C,CAAC;AAED,gFAAgF;AAChF,4EAA4E;AAC5E,gFAAgF;AAEhF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,6BAA6B,CAC3C,KAA2B,EAC3B,YAAoC;IAEpC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IAC7B,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,WAAW,EAAE,eAAe,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7E,SAAS,CAAC,IAAI,CAAC;gBACb,SAAS,EAAE,IAAI,CAAC,IAAI;gBACpB,iBAAiB,EAAE,IAAI;gBACvB,OAAO,EAAE,WAAW,IAAI,CAAC,IAAI,EAAE;gBAC/B,qBAAqB,EAAE,IAAI;aAC5B,CAAC,CAAC;YACH,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,UAAU,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AACnC,CAAC;AAED,gFAAgF;AAChF,kDAAkD;AAClD,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAoC;IAEpC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,6BAA6B,CAAC;QAC7D,WAAW,EAAE,KAAK,CAAC,aAAa;QAChC,kBAAkB,EAAE,KAAK,CAAC,oBAAoB,IAAI,IAAI;QACtD,wBAAwB,EAAE,KAAK,CAAC,2BAA2B,IAAI,IAAI;KACpE,CAAC,CAAC;IAEH,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,8EAA8E;IAC9E,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,6BAA6B,CACvE,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,qBAAqB,EAC/B,SAAS,CAAC,KAAK,CAChB,CAAC;IAEF,IAAI,aAAmC,CAAC;IAExC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,IAAI,CACN,wBAAwB,KAAK,CAAC,aAAa,cAAc;YACvD,GAAG,cAAc,CAAC,MAAM,iDAAiD,CAC5E,CAAC;QACF,aAAa,GAAG,cAAc,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CACN,eAAe,eAAe,CAAC,MAAM,2BAA2B;YAC9D,IAAI,KAAK,CAAC,aAAa,cAAc,cAAc,CAAC,MAAM,oBAAoB,CACjF,CAAC;QAEF,MAAM,aAAa,GAAG;YACpB,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACjC,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,YAAY,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;aACpC,CAAC,CAAC;YACH,UAAU,EAAE,KAAK,CAAC,aAAa;YAC/B,iBAAiB,EAAE,EAAE;YACrB,WAAW,EAAE,KAAK,CAAC,aAAa;SACjC,CAAC;QAEF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;QACvE,aAAa,GAAG,CAAC,GAAG,cAAc,EAAE,GAAG,UAAU,CAAC,CAAC;IACrD,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,8EAA8E;IAC9E,sEAAsE;IACtE,8DAA8D;IAC9D,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,6BAA6B,CAC7D,aAAa,EACb,SAAS,CAAC,KAAK,CAChB,CAAC;IACF,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CACN,eAAe,UAAU,8CAA8C;YACrE,IAAI,KAAK,CAAC,aAAa,GAAG,CAC7B,CAAC;IACJ,CAAC;IACD,aAAa,GAAG,SAAS,CAAC;IAE1B,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,YAAY,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;SACpC,CAAC,CAAC;QACH,kBAAkB,EAAE,SAAS,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3D,YAAY,EAAE,EAAE,CAAC,WAAW;YAC5B,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,SAAS,EAAE,EAAE,CAAC,QAAQ;SACvB,CAAC,CAAC;QACH,cAAc,EAAE,aAAa;KAC9B,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,iEAAiE;AACjE,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAoC;IAEpC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,6BAA6B,CAAC;QAC7D,WAAW,EAAE,KAAK,CAAC,aAAa;QAChC,kBAAkB,EAAE,KAAK,CAAC,oBAAoB,IAAI,IAAI;QACtD,wBAAwB,EAAE,KAAK,CAAC,2BAA2B,IAAI,IAAI;KACpE,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,YAAY,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;SACpC,CAAC,CAAC;QACH,kBAAkB,EAAE,SAAS,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3D,YAAY,EAAE,EAAE,CAAC,WAAW;YAC5B,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,SAAS,EAAE,EAAE,CAAC,QAAQ;SACvB,CAAC,CAAC;QACH,0BAA0B,EAAE,SAAS,CAAC,wBAAwB;QAC9D,uBAAuB,EAAE,SAAS,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnE,SAAS,EAAE,CAAC,CAAC,QAAQ;YACrB,iBAAiB,EAAE,CAAC,CAAC,gBAAgB;YACrC,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC,CAAC;QACH,qBAAqB,EAAE,SAAS,CAAC,mBAAmB;KACrD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"connect-mcp-server.js","sourceRoot":"","sources":["../../src/workflows/connect-mcp-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAC;AAyB5D,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,4BAA4B;AAC5B,MAAM,QAAQ,GAAG,eAAe,CAAqB;IACnD,mBAAmB,EAAE,MAAM;IAC3B,gBAAgB,EAAE,KAAK;IACvB,KAAK,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;CAC9B,CAAC,CAAC;AAEH,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACvE,OAAO,eAAe,CAAqB;QACzC,mBAAmB,EAAE,GAAG,UAAU,GAAG;QACrC,KAAK,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,yEAAyE;AACzE,gFAAgF;AAEhF;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,IAA0B;IAC/C,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;KACvC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,6BAA6B,CAC3C,aAAqC,EACrC,qBAAyC,EACzC,YAAoC;IAEpC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC5D,KAAK,MAAM,QAAQ,IAAI,qBAAqB,EAAE,CAAC;QAC7C,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,eAAe,GAA2B,EAAE,CAAC;IACnD,MAAM,cAAc,GAAyB,EAAE,CAAC;IAEhD,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,aAAa,CAAC,IAAI,CAAC,CAAC;QAE3E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,KAAK,EAAE,CAAC;YACV,cAAc,CAAC,IAAI,CAAC;gBAClB,SAAS,EAAE,KAAK,CAAC,QAAQ;gBACzB,iBAAiB,EAAE,IAAI;gBACvB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;QACD,2EAA2E;IAC7E,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;AAC7C,CAAC;AAED,gFAAgF;AAChF,4EAA4E;AAC5E,gFAAgF;AAEhF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,6BAA6B,CAC3C,KAA2B,EAC3B,YAAoC;IAEpC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IAC7B,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,WAAW,EAAE,eAAe,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7E,SAAS,CAAC,IAAI,CAAC;gBACb,SAAS,EAAE,IAAI,CAAC,IAAI;gBACpB,iBAAiB,EAAE,IAAI;gBACvB,OAAO,EAAE,WAAW,IAAI,CAAC,IAAI,EAAE;gBAC/B,qBAAqB,EAAE,IAAI;aAC5B,CAAC,CAAC;YACH,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,UAAU,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AACnC,CAAC;AAED,gFAAgF;AAChF,kDAAkD;AAClD,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAoC;IAEpC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,6BAA6B,CAAC;QAC7D,WAAW,EAAE,KAAK,CAAC,aAAa;QAChC,kBAAkB,EAAE,KAAK,CAAC,oBAAoB,IAAI,IAAI;QACtD,qBAAqB,EAAE,KAAK,CAAC,uBAAuB,IAAI,IAAI;QAC5D,wBAAwB,EAAE,KAAK,CAAC,2BAA2B,IAAI,IAAI;KACpE,CAAC,CAAC;IAEH,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,8EAA8E;IAC9E,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,6BAA6B,CACvE,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,qBAAqB,EAC/B,SAAS,CAAC,KAAK,CAChB,CAAC;IAEF,IAAI,aAAmC,CAAC;IAExC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,IAAI,CACN,wBAAwB,KAAK,CAAC,aAAa,cAAc;YACvD,GAAG,cAAc,CAAC,MAAM,iDAAiD,CAC5E,CAAC;QACF,aAAa,GAAG,cAAc,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CACN,eAAe,eAAe,CAAC,MAAM,2BAA2B;YAC9D,IAAI,KAAK,CAAC,aAAa,cAAc,cAAc,CAAC,MAAM,oBAAoB,CACjF,CAAC;QAEF,MAAM,aAAa,GAAG;YACpB,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACjC,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,YAAY,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;aACpC,CAAC,CAAC;YACH,UAAU,EAAE,KAAK,CAAC,aAAa;YAC/B,iBAAiB,EAAE,EAAE;YACrB,WAAW,EAAE,KAAK,CAAC,aAAa;SACjC,CAAC;QAEF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;QACvE,aAAa,GAAG,CAAC,GAAG,cAAc,EAAE,GAAG,UAAU,CAAC,CAAC;IACrD,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,8EAA8E;IAC9E,sEAAsE;IACtE,8DAA8D;IAC9D,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,6BAA6B,CAC7D,aAAa,EACb,SAAS,CAAC,KAAK,CAChB,CAAC;IACF,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CACN,eAAe,UAAU,8CAA8C;YACrE,IAAI,KAAK,CAAC,aAAa,GAAG,CAC7B,CAAC;IACJ,CAAC;IACD,aAAa,GAAG,SAAS,CAAC;IAE1B,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,YAAY,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;SACpC,CAAC,CAAC;QACH,kBAAkB,EAAE,SAAS,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3D,YAAY,EAAE,EAAE,CAAC,WAAW;YAC5B,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,SAAS,EAAE,EAAE,CAAC,QAAQ;SACvB,CAAC,CAAC;QACH,cAAc,EAAE,aAAa;KAC9B,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,iEAAiE;AACjE,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAoC;IAEpC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,6BAA6B,CAAC;QAC7D,WAAW,EAAE,KAAK,CAAC,aAAa;QAChC,kBAAkB,EAAE,KAAK,CAAC,oBAAoB,IAAI,IAAI;QACtD,qBAAqB,EAAE,KAAK,CAAC,uBAAuB,IAAI,IAAI;QAC5D,wBAAwB,EAAE,KAAK,CAAC,2BAA2B,IAAI,IAAI;KACpE,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,YAAY,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;SACpC,CAAC,CAAC;QACH,kBAAkB,EAAE,SAAS,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3D,YAAY,EAAE,EAAE,CAAC,WAAW;YAC5B,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,SAAS,EAAE,EAAE,CAAC,QAAQ;SACvB,CAAC,CAAC;QACH,0BAA0B,EAAE,SAAS,CAAC,wBAAwB;QAC9D,uBAAuB,EAAE,SAAS,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnE,SAAS,EAAE,CAAC,CAAC,QAAQ;YACrB,iBAAiB,EAAE,CAAC,CAAC,gBAAgB;YACrC,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC,CAAC;QACH,qBAAqB,EAAE,SAAS,CAAC,mBAAmB;KACrD,CAAC;AACJ,CAAC"}

package/dist/workflows/types.d.ts

@@ -14,6 +14,14 @@
 export interface ConnectMcpServerWorkflowInput {
     mcp_server_id: string;
     execution_context_id?: string | null;
+    /**
+     * Execution-scoped token for reading the connect ExecutionContext's
+     * decrypted credentials (oss#535). Populated by the OSS Go handler, whose
+     * EC read RPCs redact secrets for tokenless callers; absent on cloud,
+     * where the discovery activity's ambient connect_sandbox credential
+     * decrypts on its own.
+     */
+    execution_context_token?: string | null;
     invoker_identity_account_id?: string | null;
 }
 export interface ConnectMcpServerWorkflowOutput {

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@stigmer/runner",
-  "version": "3.11.0",
+  "version": "3.11.1-dev.20260812192248",
   "description": "Embeddable Temporal worker for the Stigmer AI agent platform — handles agent execution, workflow orchestration, and MCP server management",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {
-    "node": ">=22.13"
+    "node": "^22.13.0 || >=23.4.0"
   },
   "bin": {
     "stigmer-runner": "./dist/main.js"
@@ -90,9 +90,8 @@
     "@opentelemetry/sdk-metrics": "^2.0.0",
     "@opentelemetry/sdk-trace-base": "^2.0.0",
     "@opentelemetry/sdk-trace-node": "^2.0.0",
-    "@stigmer/protos": "3.11.0",
+    "@stigmer/protos": "3.11.1-dev.20260812192248",
     "@temporalio/activity": "^1.11.0",
-    "@temporalio/client": "^1.11.0",
     "@temporalio/common": "^1.11.0",
     "@temporalio/interceptors-opentelemetry": "~1.16.0",
     "@temporalio/proto": "^1.11.0",

package/src/__test-utils__/__tests__/vitest-global-setup.test.ts

@@ -0,0 +1,37 @@
+/**
+ * Suite-gate tests (oss#257).
+ *
+ * The gate is what turns "three sqlite-importing files die at collection
+ * with a raw ERR_UNKNOWN_BUILTIN_MODULE" into one immediate, actionable
+ * failure. Both arms are pinned around an injected preflight (the
+ * preflightNodeRuntime idiom), so the failure arm is testable on a
+ * supported Node. The preflight MESSAGE contract itself is pinned in
+ * __tests__/preflight.test.ts — here we pin only what the gate adds: the
+ * throw/pass behavior and the test-context fix hint.
+ */
+
+import { describe, expect, it } from "vitest";
+import { assertNodeCanRunSuite } from "../vitest-global-setup.js";
+
+describe("assertNodeCanRunSuite", () => {
+  it("returns cleanly when the preflight passes", () => {
+    expect(() => assertNodeCanRunSuite(() => null)).not.toThrow();
+  });
+
+  it("throws the preflight diagnosis verbatim when it fails", () => {
+    // The diagnosis must arrive unwrapped — it is the single source of what
+    // is wrong (found version, missing capability, both floors).
+    expect(() => assertNodeCanRunSuite(() => "diagnosis from preflight")).toThrow(
+      /diagnosis from preflight/,
+    );
+  });
+
+  it("appends the test-context fix hint", () => {
+    // Both escape hatches: the repo's pinned Node, and the experimental flag
+    // for Nodes where the builtin is flag-gated.
+    expect(() => assertNodeCanRunSuite(() => "boom")).toThrow(/\.nvmrc/);
+    expect(() => assertNodeCanRunSuite(() => "boom")).toThrow(
+      /--experimental-sqlite/,
+    );
+  });
+});

package/src/__test-utils__/vitest-global-setup.ts

@@ -0,0 +1,50 @@
+/**
+ * Vitest globalSetup: refuse to run the suite on a Node that cannot run the
+ * runner.
+ *
+ * Why this exists: the durable checkpointer imports Node's built-in
+ * `node:sqlite` at module load time, so on a Node without it (below 22.13,
+ * or 23.0–23.3 — the 23.x line only gained it unflagged in 23.4) the
+ * sqlite-importing test files die at COLLECTION with a raw
+ * `ERR_UNKNOWN_BUILTIN_MODULE` while the rest of the suite grinds on
+ * (oss#257). globalSetup runs once in the main process before any file is
+ * collected, so the whole run fails immediately with the same actionable
+ * message the runner itself prints at boot (src/preflight.ts).
+ *
+ * Deliberately fails the WHOLE suite rather than skipping the sqlite tests:
+ * a Node that cannot load `node:sqlite` cannot run the runner at all, and a
+ * green-with-skips suite on such a Node would be a false signal. The gate is
+ * a capability probe, not a version check — on Nodes where the builtin is
+ * flag-gated (22.5–22.12, 23.0–23.3), `NODE_OPTIONS=--experimental-sqlite`
+ * satisfies the probe and the suite runs (vitest workers inherit
+ * NODE_OPTIONS, so the flag reaches every fork).
+ *
+ * Lives in src/__test-utils__/ so `tsc --noEmit` covers it (the dev tsconfig
+ * only includes src/) while tsconfig.build.json's exclusion keeps it out of
+ * dist/.
+ */
+
+import { preflightNodeRuntime } from "../preflight.js";
+
+/**
+ * Throw an actionable error when this Node cannot run the runner (and hence
+ * its test suite). The preflight message is reused verbatim — single source
+ * of the diagnosis, contract pinned by __tests__/preflight.test.ts — with a
+ * test-context fix hint appended (the check-runner-node Makefile idiom).
+ */
+export function assertNodeCanRunSuite(
+  preflight: () => string | null = preflightNodeRuntime,
+): void {
+  const failure = preflight();
+  if (failure === null) return;
+  throw new Error(
+    `${failure}\n` +
+      `  fix: nvm use (the repo's .nvmrc pins a supported Node), or on a Node\n` +
+      `  where node:sqlite is flag-gated (22.5-22.12, 23.0-23.3) run the suite\n` +
+      `  with NODE_OPTIONS=--experimental-sqlite.`,
+  );
+}
+
+export default function globalSetup(): void {
+  assertNodeCanRunSuite();
+}

package/src/__tests__/bootstrap.test.ts

@@ -161,6 +161,49 @@ describe("resolveRunnerBootstrap", () => {
     );
 
     expect(result.runnerAccessToken).toBeUndefined();
+    expect(result.payloadEncryption).toBeUndefined();
+  });
+
+  it("surfaces server-managed payload-encryption keys from the discovery branch", async () => {
+    const factory: BootstrapClientFactory = async () => ({
+      getRunnerBootstrapConfig: () =>
+        Promise.resolve({
+          temporalAddress: "t:7233",
+          temporalNamespace: "default",
+          payloadEncryption: {
+            key: "a".repeat(44),
+            keyId: "identity-key-v2",
+            secondaryKey: "b".repeat(44),
+            secondaryKeyId: "identity-key-v1",
+          },
+        }),
+    });
+
+    const result = await resolveRunnerBootstrap(
+      { token: "tok", stigmerEndpoint: "https://api.stigmer.ai" },
+      factory,
+    );
+
+    expect(result.payloadEncryption).toEqual({
+      key: "a".repeat(44),
+      keyId: "identity-key-v2",
+      secondaryKey: "b".repeat(44),
+      secondaryKeyId: "identity-key-v1",
+    });
+  });
+
+  it("omits payload-encryption keys when the server does not manage them", async () => {
+    const factory: BootstrapClientFactory = async () => ({
+      getRunnerBootstrapConfig: () =>
+        Promise.resolve({ temporalAddress: "t:7233", temporalNamespace: "default" }),
+    });
+
+    const result = await resolveRunnerBootstrap(
+      { token: "tok", stigmerEndpoint: "https://api.stigmer.ai" },
+      factory,
+    );
+
+    expect(result.payloadEncryption).toBeUndefined();
   });
 });
 

package/src/__tests__/encryption-codec.test.ts

@@ -195,6 +195,59 @@ describe("loadPayloadEncryptionConfig", () => {
     process.env.STIGMER_PAYLOAD_ENCRYPTION_KEY_ID = "k1";
     expect(() => loadPayloadEncryptionConfig()).toThrow(/must decode to 32 bytes/);
   });
+
+  // Server-managed key material from getRunnerBootstrapConfig (stigmer#398):
+  // desktop-class runners receive a per-identity key at bootstrap instead of
+  // env config. The env key is the operator's explicit choice and must win.
+  describe("bootstrap-delivered keys", () => {
+    const bootstrapKeys = () => ({
+      key: randomBytes(32).toString("base64"),
+      keyId: "identity-key-v1",
+      secondaryKey: randomBytes(32).toString("base64"),
+      secondaryKeyId: "identity-key-v0",
+    });
+
+    it("enables encryption from bootstrap material when no env key is set", () => {
+      const config = loadPayloadEncryptionConfig(bootstrapKeys());
+      expect(config?.primary.keyId).toBe("identity-key-v1");
+      expect(config?.primary.key.length).toBe(32);
+      expect(config?.secondary?.keyId).toBe("identity-key-v0");
+    });
+
+    it("env-configured key wins over bootstrap material", () => {
+      process.env.STIGMER_PAYLOAD_ENCRYPTION_KEY = randomBytes(32).toString("base64");
+      process.env.STIGMER_PAYLOAD_ENCRYPTION_KEY_ID = "env-key";
+
+      const config = loadPayloadEncryptionConfig(bootstrapKeys());
+      expect(config?.primary.keyId).toBe("env-key");
+      expect(config?.secondary).toBeUndefined();
+    });
+
+    it("fails the boot on a bootstrap key without its id (server contract violation)", () => {
+      expect(() =>
+        loadPayloadEncryptionConfig({ key: randomBytes(32).toString("base64") }),
+      ).toThrow(/payload_encryption_key_id/);
+    });
+
+    it("fails the boot on a malformed bootstrap key rather than running plaintext", () => {
+      expect(() =>
+        loadPayloadEncryptionConfig({
+          key: randomBytes(16).toString("base64"),
+          keyId: "identity-key-v1",
+        }),
+      ).toThrow(/must decode to 32 bytes/);
+    });
+
+    it("fails the boot on a bootstrap secondary key without its id", () => {
+      expect(() =>
+        loadPayloadEncryptionConfig({
+          key: randomBytes(32).toString("base64"),
+          keyId: "identity-key-v1",
+          secondaryKey: randomBytes(32).toString("base64"),
+        }),
+      ).toThrow(/payload_encryption_secondary_key_id/);
+    });
+  });
 });
 
 describe("cross-language conformance fixture", () => {

package/src/__tests__/preflight.test.ts

@@ -11,6 +11,7 @@
  *   the desktop Run dialog via the IPC handshake.
  */
 
+import { readFileSync } from "node:fs";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import {
   isNodeSqliteAvailable,
@@ -42,6 +43,20 @@ describe("preflightNodeRuntime", () => {
     // case BOTH sides must report unsupported.
     expect(preflightNodeRuntime() === null).toBe(isNodeSqliteAvailable());
   });
+
+  it("package.json engines matches the floors this preflight documents", () => {
+    // The published engines range and the preflight message describe the same
+    // two floors (node:sqlite is unflagged from 22.13 in the 22.x line and
+    // only from 23.4 after that). engines is the only one of the two that a
+    // future edit can silently loosen — `>=22.13` once re-admitted the
+    // 23.0–23.3 gap (oss#257) — so pin it byte-for-byte to the range that
+    // excludes that gap. If the floors genuinely move, update the preflight
+    // message, this pin, and package.json together.
+    const pkg = JSON.parse(
+      readFileSync(new URL("../../package.json", import.meta.url), "utf8"),
+    ) as { engines: { node: string } };
+    expect(pkg.engines.node).toBe("^22.13.0 || >=23.4.0");
+  });
 });
 
 describe("assertLlmBackendsPreflight", () => {

package/src/activities/__tests__/discover-mcp-server.test.ts

@@ -416,7 +416,45 @@ describe("DiscoverMcpServer activity", () => {
       );
 
       expect(result.tools).toEqual([]);
-      expect(mockClient.getExecutionContextByExecutionId).toHaveBeenCalledWith("ctx-abc");
+      // No payload-carried token -> the read goes out without a per-call
+      // credential (the cloud shape, where the ambient credential applies).
+      expect(mockClient.getExecutionContextByExecutionId).toHaveBeenCalledWith("ctx-abc", undefined);
+    });
+
+    it("presents the payload-carried EC token on the ExecutionContext read (oss#535)", async () => {
+      const { discoverMcpServer } = await import("../discover-mcp-server.js");
+
+      const mockClient = makeMockStigmerClient({
+        mcpServer: makeMcpServer({
+          metadata: { slug: "with-token" },
+          spec: makeStdioSpec("npx", ["server"]),
+        }),
+        executionContext: {
+          spec: {
+            data: {
+              API_KEY: { value: "secret-123", isSecret: true },
+            },
+          },
+        },
+      });
+
+      const mockMcpClient = makeMockMcpClient({ tools: [] });
+      mockInitializeConnections.mockResolvedValue({});
+      mockGetClient.mockResolvedValue(mockMcpClient);
+
+      await discoverMcpServer(
+        {
+          mcpServerId: "mcp-env",
+          executionContextId: "ctx-abc",
+          executionContextToken: "scoped-ec-token",
+        },
+        { stigmerClient: mockClient as any, transportPosture: "stdio-allowed" },
+      );
+
+      expect(mockClient.getExecutionContextByExecutionId).toHaveBeenCalledWith(
+        "ctx-abc",
+        "scoped-ec-token",
+      );
     });
 
     it("discovers a caller-identity-templating server via the anonymous sentinel", async () => {