@stigmer/runner 3.11.0 → 3.12.0

package/dist/client/stigmer-client.js

@@ -29,12 +29,12 @@ import { ExecutionValueSchema } from "@stigmer/protos/ai/stigmer/agentic/executi
 import { AgentExecutionUpdateStatusInputSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/io_pb";
 import { WorkflowExecutionCommandController } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/command_pb";
 import { WorkflowExecutionQueryController } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/query_pb";
-import { WorkflowExecutionUpdateStatusInputSchema, GetEventLogRequestSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/io_pb";
+import { WorkflowExecutionUpdateStatusInputSchema, GetEventLogRequestSchema, SendSignalInputSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/io_pb";
 import { WorkflowQueryController } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/query_pb";
 import { WorkflowInstanceQueryController } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/query_pb";
 import { PlatformQueryController, GetRunnerScopedTokenInputSchema, TokenRenewalSchema } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
 import { ChannelMessageQueryController } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/message_query_pb";
-import { isEmbeddedRunnerToken } from "./token-claims.js";
+import { TOKEN_TYPE_EMBEDDED_RUNNER, tokenTypeOf } from "./token-claims.js";
 import { assertCreateRequirements, assertReferenceRequirements } from "./server-contracts.js";
 /**
  * Map the scope union onto the proto oneof init shape. The narrowing chain is
@@ -173,6 +173,18 @@ export class StigmerClient {
             // callers branch on presence rather than emptiness.
             runnerAccessToken: res.runnerAccessToken || undefined,
             runnerAccessTokenExpiresInSeconds: res.runnerAccessTokenExpiresInSeconds || undefined,
+            // Same presence contract, grouped so callers make ONE presence check.
+            // Key without id (or vice versa) is a server contract violation the
+            // encryption config loader rejects — not silently dropped here, so the
+            // breakage is diagnosable at the fail-closed boundary.
+            payloadEncryption: res.payloadEncryptionKey
+                ? {
+                    key: res.payloadEncryptionKey,
+                    keyId: res.payloadEncryptionKeyId,
+                    secondaryKey: res.payloadEncryptionSecondaryKey || undefined,
+                    secondaryKeyId: res.payloadEncryptionSecondaryKeyId || undefined,
+                }
+                : undefined,
         };
     }
     async getExecution(executionId) {
@@ -201,14 +213,16 @@ export class StigmerClient {
             : undefined);
     }
     /**
-     * Exchange this runner's bootstrap credential for a token scoped to one
-     * unit of dispatched work (issue #156).
+     * Exchange this runner's credential for a token scoped to one unit of
+     * dispatched work (issue #156).
      *
-     * The call authenticates with the runner credential (see the interceptor);
-     * the server verifies it is an embedded_runner token and that its identity
-     * can view the named execution, then mints the same session/execution-scoped
-     * sandbox token a cloud sandbox runner receives at provisioning. Returns
-     * undefined when the server does not mint (OSS, or no signing key) —
+     * The call authenticates with the runner credential (see the interceptor).
+     * Cloud verifies it is an embedded_runner token and that its identity can
+     * view the named execution, then mints the same session/execution-scoped
+     * sandbox token a cloud sandbox runner receives at provisioning. OSS mints
+     * an execution-scoped token for any caller (oss#535 — a lane discriminator
+     * on a single-user server, not a trust boundary). Returns undefined when
+     * the server does not mint (pre-oss#535 OSS, or an unserved scope arm) —
      * presence-based, like the bootstrap token fields.
      *
      * `callerToken` authenticates the exchange per-call instead of the
@@ -235,24 +249,40 @@ export class StigmerClient {
      * Acquire a scoped runner token for an ExecutionContext read, if this
      * runner's credential situation calls for one.
      *
-     * The gate is the credential itself: only an unscoped embedded_runner
-     * bootstrap token needs exchanging. A cloud sandbox runner's credential is
-     * already scoped (skip — the exchange would rightly refuse it), and an
-     * OSS/local runner holds no runner-class credential at all (skip — the
-     * server neither mints nor redacts).
+     * The gate is the credential itself, three ways:
      *
-     * A failed exchange is a hard error, not a fallback: since the #156 item-3
-     * flip (stigmer-cloud#218) the bootstrap credential no longer decrypts, so
-     * a read that "fell back" would silently receive redacted placeholders and
-     * the execution would run against junk secret values — strictly worse than
-     * failing here with the real reason. The secret-delivery call sites let
-     * this error fail the activity; opportunistic consumers that can genuinely
-     * proceed without a scoped token (attachment credential, channel
-     * discovery) catch it at the call site, where their degrade-to-empty
-     * contract lives.
+     * 1. An unscoped embedded_runner bootstrap token MUST be exchanged, and a
+     *    failed exchange is a hard error, not a fallback: since the #156
+     *    item-3 flip (stigmer-cloud#218) the bootstrap credential no longer
+     *    decrypts, so a read that "fell back" would silently receive redacted
+     *    placeholders and the execution would run against junk secret values —
+     *    strictly worse than failing here with the real reason. The
+     *    secret-delivery call sites let this error fail the activity;
+     *    opportunistic consumers that can genuinely proceed without a scoped
+     *    token (attachment credential, channel discovery) catch it at the
+     *    call site, where their degrade-to-empty contract lives.
+     *
+     * 2. Any other runner-class credential is already scoped (a cloud
+     *    sandbox/pool/connect token) — skip; the exchange would rightly
+     *    refuse it and the ambient credential decrypts on its own.
+     *
+     * 3. No runner-class credential at all (OSS/local, where the process
+     *    token is absent or carries no token_type claim) — attempt the
+     *    exchange best-effort (oss#535): a current OSS server mints an
+     *    execution-scoped token here, which is the ONLY way this runner can
+     *    read decrypted secrets from its redact-by-default EC RPCs. A server
+     *    that answers "not minted" (pre-oss#535 OSS, which also does not
+     *    redact) or refuses the exchange (cloud refusing a non-runner
+     *    credential — the legacy desktop degrade, which reads redacted today
+     *    regardless) falls through to the tokenless read, preserving each
+     *    old pairing's exact behavior.
      */
     async acquireScopedRunnerToken(scope) {
-        if (!isEmbeddedRunnerToken(this.runnerTokenRef?.current)) {
+        // Inspect the same credential chain the EC read's interceptor would use.
+        const ambientTokenType = tokenTypeOf(this.runnerTokenRef?.current ?? this.tokenRef?.current ?? this.currentToken);
+        const isEmbeddedRunner = ambientTokenType === TOKEN_TYPE_EMBEDDED_RUNNER;
+        if (ambientTokenType !== undefined && !isEmbeddedRunner) {
+            // Case 2: an already-scoped runner-class credential.
             return undefined;
         }
         const scopeDescription = "agentExecutionId" in scope
@@ -265,6 +295,11 @@ export class StigmerClient {
             scoped = await this.getRunnerScopedToken(scope);
         }
         catch (err) {
+            if (!isEmbeddedRunner) {
+                // Case 3: best-effort — a refusal means the server does not serve
+                // this credential class; the tokenless read is today's behavior.
+                return undefined;
+            }
             throw new Error(`Scoped runner token exchange failed for ${scopeDescription}: ` +
                 `${err instanceof Error ? err.message : String(err)}. ` +
                 "The bootstrap credential cannot read ExecutionContext secrets " +
@@ -272,6 +307,11 @@ export class StigmerClient {
                 "until the exchange succeeds.");
         }
         if (!scoped) {
+            if (!isEmbeddedRunner) {
+                // Case 3: a server that mints nothing for this scope also does not
+                // redact for this runner (pre-oss#535 OSS) — proceed tokenless.
+                return undefined;
+            }
             throw new Error(`Server minted no scoped runner token for ${scopeDescription}. ` +
                 "The bootstrap credential cannot read ExecutionContext secrets " +
                 "(stigmer-cloud#218), so this runner cannot serve the execution " +
@@ -387,6 +427,30 @@ export class StigmerClient {
         });
         return this.workflowExecutionCommand.updateStatus(input);
     }
+    /**
+     * Deliver a named signal to another workflow execution through the
+     * server's SendSignal lane (validate → phase gate → relay via the
+     * outer orchestrator). This is the ONLY sanctioned path for
+     * runner-originated signals: a direct Temporal client would bypass
+     * both the authorization boundary and the payload-encryption design
+     * (per-identity runner keys make sender-side encryption fail closed
+     * at receivers holding a different key — see oss#517).
+     *
+     * Deliberately sends no idempotency_key: the server's dedupe claim is
+     * not released when delivery fails (oss#442), so a key here would
+     * poison the exact retry it exists to protect — and emit envelope ids
+     * regenerate per activity attempt anyway. Revisit once oss#442 lands.
+     */
+    async sendWorkflowSignal(executionId, signalName, payload, options) {
+        const input = create(SendSignalInputSchema, {
+            executionId,
+            signalName,
+            payload,
+        });
+        return this.workflowExecutionCommand.sendSignal(input, {
+            timeoutMs: options?.timeoutMs,
+        });
+    }
     async getWorkflowExecution(executionId) {
         return this.workflowExecutionQuery.get({ value: executionId });
     }

package/dist/client/stigmer-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"stigmer-client.js","sourceRoot":"","sources":["../../src/client/stigmer-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAA+B,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,+BAA+B,EAAE,MAAM,iEAAiE,CAAC;AAClH,OAAO,EAAE,6BAA6B,EAAE,MAAM,+DAA+D,CAAC;AAC9G,OAAO,EAAE,+BAA+B,EAAE,MAAM,iEAAiE,CAAC;AAClH,OAAO,EAAE,wBAAwB,EAAE,MAAM,0DAA0D,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,wDAAwD,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAC5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,8DAA8D,CAAC;AAC5G,OAAO,EAAE,wBAAwB,EAAE,MAAM,0DAA0D,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4DAA4D,CAAC;AACxG,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AAGtG,OAAO,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,kDAAkD,CAAC;AAI5F,OAAO,EAAE,sCAAsC,EAAE,MAAM,8DAA8D,CAAC;AAQtH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uDAAuD,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,gEAAgE,CAAC;AACtG,OAAO,EAAE,qCAAqC,EAAE,MAAM,4DAA4D,CAAC;AAEnH,OAAO,EAAE,kCAAkC,EAAE,MAAM,oEAAoE,CAAC;AACxH,OAAO,EAAE,gCAAgC,EAAE,MAAM,kEAAkE,CAAC;AAEpH,OAAO,EAAE,wCAAwC,EAAE,wBAAwB,EAAE,MAAM,+DAA+D,CAAC;AACnJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AAElG,OAAO,EAAE,+BAA+B,EAAE,MAAM,iEAAiE,CAAC;AAElH,OAAO,EAAE,uBAAuB,EAAE,+BAA+B,EAAE,kBAAkB,EAAE,MAAM,uDAAuD,CAAC;AACrJ,OAAO,EAAE,6BAA6B,EAAE,MAAM,qEAAqE,CAAC;AAEpH,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAoD9F;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,KAA6B;IAC7D,IAAI,kBAAkB,IAAI,KAAK,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,KAAK,CAAC,gBAAgB,EAAW,CAAC;IAC9E,CAAC;IACD,IAAI,qBAAqB,IAAI,KAAK,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,KAAK,CAAC,mBAAmB,EAAW,CAAC;IACpF,CAAC;IACD,IAAI,oBAAoB,IAAI,KAAK,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,kBAAkB,EAAE,EAAW,CAAC;IACxF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,kBAAkB,CAAC,EAAW,CAAC;AACzE,CAAC;AAwBD,MAAM,OAAO,aAAa;IACf,SAAS,CAAY;IACtB,YAAY,CAAgB;IACnB,cAAc,CAA+C;IAC7D,gBAAgB,CAAiD;IACjE,qBAAqB,CAAiD;IACtE,YAAY,CAAwC;IACpD,cAAc,CAA0C;IACxD,UAAU,CAAsC;IAChD,kBAAkB,CAA8C;IAChE,cAAc,CAA0C;IACxD,gBAAgB,CAA4C;IAC5D,UAAU,CAAsC;IAChD,cAAc,CAA0C;IACxD,eAAe,CAA2C;IAClE,wBAAwB,CAAoD;IACpE,sBAAsB,CAAkD;IACxE,aAAa,CAAyC;IACtD,qBAAqB,CAAiD;IACtE,aAAa,CAAyC;IACtD,mBAAmB,CAA+C;IAElE,QAAQ,CAAkB;IAC1B,cAAc,CAAkB;IAEjD,YAAY,OAA6B;QACvC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;QACzC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;QACrD,IAAI,CAAC,SAAS,GAAG,mBAAmB,CAAC;YACnC,OAAO,EAAE,OAAO,CAAC,QAAQ;YACzB,YAAY,EAAE;gBACZ,oEAAoE;gBACpE,oEAAoE;gBACpE,kEAAkE;gBAClE,mEAAmE;gBACnE,mEAAmE;gBACnE,qEAAqE;gBACrE,oCAAoC;gBACpC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;oBACtB,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE;wBACnD,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC;qBACtD,CAAC,CAAC;oBACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;gBACnB,CAAC;gBACD,uEAAuE;gBACvE,kCAAkC;gBAClC,EAAE;gBACF,sEAAsE;gBACtE,kEAAkE;gBAClE,sEAAsE;gBACtE,wEAAwE;gBACxE,oEAAoE;gBACpE,+CAA+C;gBAC/C,EAAE;gBACF,uEAAuE;gBACvE,oEAAoE;gBACpE,uEAAuE;gBACvE,mEAAmE;gBACnE,+DAA+D;gBAC/D,qEAAqE;gBACrE,sEAAsE;gBACtE,uBAAuB;gBACvB,EAAE;gBACF,iEAAiE;gBACjE,iEAAiE;gBACjE,+BAA+B;gBAC/B,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;oBACtB,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;wBACpC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;oBACnB,CAAC;oBACD,MAAM,oBAAoB,GACxB,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,+BAA+B,CAAC,QAAQ;wBACjE,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,uBAAuB,CAAC,QAAQ;4BACxD,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,uBAAuB,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;oBAClF,MAAM,KAAK,GACT,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;2BACzD,IAAI,CAAC,QAAQ,EAAE,OAAO;2BACtB,IAAI,CAAC,YAAY,CAAC;oBACvB,IAAI,KAAK,EAAE,CAAC;wBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;oBACrD,CAAC;oBACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;gBACnB,CAAC;aACF;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC,6BAA6B,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAClF,IAAI,CAAC,gBAAgB,GAAG,YAAY,CAAC,+BAA+B,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACtF,IAAI,CAAC,qBAAqB,GAAG,YAAY,CAAC,+BAA+B,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3F,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACzE,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC,wBAAwB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,kBAAkB,GAAG,YAAY,CAAC,4BAA4B,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrF,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC,wBAAwB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,gBAAgB,GAAG,YAAY,CAAC,0BAA0B,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACjF,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC,wBAAwB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,eAAe,GAAG,YAAY,CAAC,yBAAyB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/E,IAAI,CAAC,wBAAwB,GAAG,YAAY,CAAC,kCAAkC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACjG,IAAI,CAAC,sBAAsB,GAAG,YAAY,CAAC,gCAAgC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7F,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC,uBAAuB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3E,IAAI,CAAC,qBAAqB,GAAG,YAAY,CAAC,+BAA+B,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3F,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC,uBAAuB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3E,IAAI,CAAC,mBAAmB,GAAG,YAAY,CAAC,6BAA6B,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACzF,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,wBAAwB;QAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO;YACL,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,sEAAsE;YACtE,oDAAoD;YACpD,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,IAAI,SAAS;YACrD,iCAAiC,EAC/B,GAAG,CAAC,iCAAiC,IAAI,SAAS;SACrD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,WAAmB;QACpC,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,WAAmB,EACnB,MAA4B;QAE5B,MAAM,KAAK,GAAG,MAAM,CAAC,qCAAqC,EAAE;YAC1D,WAAW;YACX,MAAM;SACP,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,gCAAgC,CACpC,WAAmB,EACnB,WAAoB;QAEpB,OAAO,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,CAChD,MAAM,CAAC,sCAAsC,EAAE,EAAE,WAAW,EAAE,CAAC,EAC/D,WAAW;YACT,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE;YACzD,CAAC,CAAC,SAAS,CACd,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,oBAAoB,CACxB,KAA6B,EAC7B,WAAoB;QAEpB,MAAM,KAAK,GAAG,MAAM,CAAC,+BAA+B,EAAE;YACpD,KAAK,EAAE,wBAAwB,CAAC,KAAK,CAAC;SACvC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,oBAAoB,CACvD,KAAK,EACL,WAAW;YACT,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE;YACzD,CAAC,CAAC,SAAS,CACd,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,iBAAiB;YAC5B,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,IAAI,SAAS;SACpD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,wBAAwB,CAC5B,KAA6B;QAE7B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,CAAC;YACzD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,gBAAgB,GACpB,kBAAkB,IAAI,KAAK;YACzB,CAAC,CAAC,mBAAmB,KAAK,CAAC,gBAAgB,EAAE;YAC7C,CAAC,CAAC,qBAAqB,IAAI,KAAK;gBAC9B,CAAC,CAAC,sBAAsB,KAAK,CAAC,mBAAmB,EAAE;gBACnD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,2CAA2C,gBAAgB,IAAI;gBAC/D,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI;gBACvD,gEAAgE;gBAChE,iEAAiE;gBACjE,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,4CAA4C,gBAAgB,IAAI;gBAChE,gEAAgE;gBAChE,iEAAiE;gBACjE,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,qBAAqB,CAAC,WAAoB;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,qBAAqB,CAC9D,EAAE,EACF,WAAW;YACT,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE;YACzD,CAAC,CAAC,SAAS,CACd,CAAC;QACF,OAAO,GAAG,CAAC,OAAO,CAAC;IACrB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAAe,EAAE,WAAoB;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,aAAa,CACtD,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,EAC/B,WAAW;YACT,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE;YACzD,CAAC,CAAC,SAAS,CACd,CAAC;QACF,OAAO,GAAG,CAAC,OAAO,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,SAAiB;QAChC,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAgB;QAClC,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,UAAkB;QACvC,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,GAAyB;QACrD,OAAO,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,WAAmB,EACnB,GAAW,EACX,UAAiE;QAEjE,MAAM,KAAK,GAAG,MAAM,CAAC,kBAAkB,EAAE;YACvC,WAAW;YACX,GAAG;SACJ,CAAC,CAAC;QACH,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,oBAAoB,EAAE;oBACnD,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,GAAyB;QACjD,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,kBAA0B;QAC/C,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAA0B;QAC7C,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAA8B;QACrD,OAAO,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,GAAyB;QACjD,2BAA2B,CAAC,GAAG,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAgB;QAClC,wBAAwB,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAgB;QACjC,wBAAwB,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,SAAyB;QAClD,wBAAwB,CAAC,SAAS,EAAE,gBAAgB,EAAE,sBAAsB,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,WAAmB,EACnB,MAA+B,EAC/B,OAMC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,wCAAwC,EAAE;YAC7D,WAAW;YACX,MAAM;YACN,sBAAsB,EAAE,OAAO,EAAE,sBAAsB,IAAI,KAAK;YAChE,wBAAwB,EAAE,OAAO,EAAE,wBAAwB,IAAI,KAAK;YACpE,kCAAkC,EAAE,OAAO,EAAE,kCAAkC,IAAI,EAAE;SACtF,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,wBAAwB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,WAAmB;QAC5C,OAAO,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,wBAAwB,CAAC,WAAmB;QAChD,IAAI,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAE9B,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CACxD,MAAM,CAAC,wBAAwB,EAAE;gBAC/B,WAAW;gBACX,aAAa;gBACb,QAAQ,EAAE,GAAG;aACd,CAAC,CACH,CAAC;YAEF,IAAI,IAAI,CAAC,cAAc,GAAG,aAAa,EAAE,CAAC;gBACxC,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC;YACtC,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClB,OAAO,aAAa,CAAC;YACvB,CAAC;YAED,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC;QACtC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,UAAkB;QAClC,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,UAAkB,EAAE,WAAmB;QAC9D,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,UAAkB;QAC1C,OAAO,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,WAAW,CAAC,KAAoB;QAC9B,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;IAC5B,CAAC;CACF"}
+{"version":3,"file":"stigmer-client.js","sourceRoot":"","sources":["../../src/client/stigmer-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAA+B,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,+BAA+B,EAAE,MAAM,iEAAiE,CAAC;AAClH,OAAO,EAAE,6BAA6B,EAAE,MAAM,+DAA+D,CAAC;AAC9G,OAAO,EAAE,+BAA+B,EAAE,MAAM,iEAAiE,CAAC;AAClH,OAAO,EAAE,wBAAwB,EAAE,MAAM,0DAA0D,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,wDAAwD,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAC5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,8DAA8D,CAAC;AAC5G,OAAO,EAAE,wBAAwB,EAAE,MAAM,0DAA0D,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4DAA4D,CAAC;AACxG,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AAGtG,OAAO,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,kDAAkD,CAAC;AAI5F,OAAO,EAAE,sCAAsC,EAAE,MAAM,8DAA8D,CAAC;AAQtH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uDAAuD,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,gEAAgE,CAAC;AACtG,OAAO,EAAE,qCAAqC,EAAE,MAAM,4DAA4D,CAAC;AAEnH,OAAO,EAAE,kCAAkC,EAAE,MAAM,oEAAoE,CAAC;AACxH,OAAO,EAAE,gCAAgC,EAAE,MAAM,kEAAkE,CAAC;AAEpH,OAAO,EAAE,wCAAwC,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,+DAA+D,CAAC;AAE1K,OAAO,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AAElG,OAAO,EAAE,+BAA+B,EAAE,MAAM,iEAAiE,CAAC;AAElH,OAAO,EAAE,uBAAuB,EAAE,+BAA+B,EAAE,kBAAkB,EAAE,MAAM,uDAAuD,CAAC;AACrJ,OAAO,EAAE,6BAA6B,EAAE,MAAM,qEAAqE,CAAC;AAEpH,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AA8E9F;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,KAA6B;IAC7D,IAAI,kBAAkB,IAAI,KAAK,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,KAAK,CAAC,gBAAgB,EAAW,CAAC;IAC9E,CAAC;IACD,IAAI,qBAAqB,IAAI,KAAK,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,KAAK,CAAC,mBAAmB,EAAW,CAAC;IACpF,CAAC;IACD,IAAI,oBAAoB,IAAI,KAAK,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,kBAAkB,EAAE,EAAW,CAAC;IACxF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,kBAAkB,CAAC,EAAW,CAAC;AACzE,CAAC;AAwBD,MAAM,OAAO,aAAa;IACf,SAAS,CAAY;IACtB,YAAY,CAAgB;IACnB,cAAc,CAA+C;IAC7D,gBAAgB,CAAiD;IACjE,qBAAqB,CAAiD;IACtE,YAAY,CAAwC;IACpD,cAAc,CAA0C;IACxD,UAAU,CAAsC;IAChD,kBAAkB,CAA8C;IAChE,cAAc,CAA0C;IACxD,gBAAgB,CAA4C;IAC5D,UAAU,CAAsC;IAChD,cAAc,CAA0C;IACxD,eAAe,CAA2C;IAClE,wBAAwB,CAAoD;IACpE,sBAAsB,CAAkD;IACxE,aAAa,CAAyC;IACtD,qBAAqB,CAAiD;IACtE,aAAa,CAAyC;IACtD,mBAAmB,CAA+C;IAElE,QAAQ,CAAkB;IAC1B,cAAc,CAAkB;IAEjD,YAAY,OAA6B;QACvC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;QACzC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;QACrD,IAAI,CAAC,SAAS,GAAG,mBAAmB,CAAC;YACnC,OAAO,EAAE,OAAO,CAAC,QAAQ;YACzB,YAAY,EAAE;gBACZ,oEAAoE;gBACpE,oEAAoE;gBACpE,kEAAkE;gBAClE,mEAAmE;gBACnE,mEAAmE;gBACnE,qEAAqE;gBACrE,oCAAoC;gBACpC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;oBACtB,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE;wBACnD,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC;qBACtD,CAAC,CAAC;oBACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;gBACnB,CAAC;gBACD,uEAAuE;gBACvE,kCAAkC;gBAClC,EAAE;gBACF,sEAAsE;gBACtE,kEAAkE;gBAClE,sEAAsE;gBACtE,wEAAwE;gBACxE,oEAAoE;gBACpE,+CAA+C;gBAC/C,EAAE;gBACF,uEAAuE;gBACvE,oEAAoE;gBACpE,uEAAuE;gBACvE,mEAAmE;gBACnE,+DAA+D;gBAC/D,qEAAqE;gBACrE,sEAAsE;gBACtE,uBAAuB;gBACvB,EAAE;gBACF,iEAAiE;gBACjE,iEAAiE;gBACjE,+BAA+B;gBAC/B,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;oBACtB,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;wBACpC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;oBACnB,CAAC;oBACD,MAAM,oBAAoB,GACxB,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,+BAA+B,CAAC,QAAQ;wBACjE,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,uBAAuB,CAAC,QAAQ;4BACxD,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,uBAAuB,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;oBAClF,MAAM,KAAK,GACT,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;2BACzD,IAAI,CAAC,QAAQ,EAAE,OAAO;2BACtB,IAAI,CAAC,YAAY,CAAC;oBACvB,IAAI,KAAK,EAAE,CAAC;wBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;oBACrD,CAAC;oBACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;gBACnB,CAAC;aACF;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC,6BAA6B,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAClF,IAAI,CAAC,gBAAgB,GAAG,YAAY,CAAC,+BAA+B,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACtF,IAAI,CAAC,qBAAqB,GAAG,YAAY,CAAC,+BAA+B,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3F,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACzE,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC,wBAAwB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,kBAAkB,GAAG,YAAY,CAAC,4BAA4B,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrF,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC,wBAAwB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,gBAAgB,GAAG,YAAY,CAAC,0BAA0B,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACjF,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC,wBAAwB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,eAAe,GAAG,YAAY,CAAC,yBAAyB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/E,IAAI,CAAC,wBAAwB,GAAG,YAAY,CAAC,kCAAkC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACjG,IAAI,CAAC,sBAAsB,GAAG,YAAY,CAAC,gCAAgC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7F,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC,uBAAuB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3E,IAAI,CAAC,qBAAqB,GAAG,YAAY,CAAC,+BAA+B,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3F,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC,uBAAuB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3E,IAAI,CAAC,mBAAmB,GAAG,YAAY,CAAC,6BAA6B,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACzF,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,wBAAwB;QAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO;YACL,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,sEAAsE;YACtE,oDAAoD;YACpD,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,IAAI,SAAS;YACrD,iCAAiC,EAC/B,GAAG,CAAC,iCAAiC,IAAI,SAAS;YACpD,sEAAsE;YACtE,oEAAoE;YACpE,uEAAuE;YACvE,uDAAuD;YACvD,iBAAiB,EAAE,GAAG,CAAC,oBAAoB;gBACzC,CAAC,CAAC;oBACE,GAAG,EAAE,GAAG,CAAC,oBAAoB;oBAC7B,KAAK,EAAE,GAAG,CAAC,sBAAsB;oBACjC,YAAY,EAAE,GAAG,CAAC,6BAA6B,IAAI,SAAS;oBAC5D,cAAc,EAAE,GAAG,CAAC,+BAA+B,IAAI,SAAS;iBACjE;gBACH,CAAC,CAAC,SAAS;SACd,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,WAAmB;QACpC,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,WAAmB,EACnB,MAA4B;QAE5B,MAAM,KAAK,GAAG,MAAM,CAAC,qCAAqC,EAAE;YAC1D,WAAW;YACX,MAAM;SACP,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,gCAAgC,CACpC,WAAmB,EACnB,WAAoB;QAEpB,OAAO,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,CAChD,MAAM,CAAC,sCAAsC,EAAE,EAAE,WAAW,EAAE,CAAC,EAC/D,WAAW;YACT,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE;YACzD,CAAC,CAAC,SAAS,CACd,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,oBAAoB,CACxB,KAA6B,EAC7B,WAAoB;QAEpB,MAAM,KAAK,GAAG,MAAM,CAAC,+BAA+B,EAAE;YACpD,KAAK,EAAE,wBAAwB,CAAC,KAAK,CAAC;SACvC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,oBAAoB,CACvD,KAAK,EACL,WAAW;YACT,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE;YACzD,CAAC,CAAC,SAAS,CACd,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,iBAAiB;YAC5B,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,IAAI,SAAS;SACpD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,KAAK,CAAC,wBAAwB,CAC5B,KAA6B;QAE7B,yEAAyE;QACzE,MAAM,gBAAgB,GAAG,WAAW,CAClC,IAAI,CAAC,cAAc,EAAE,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,IAAI,CAAC,YAAY,CAC5E,CAAC;QACF,MAAM,gBAAgB,GAAG,gBAAgB,KAAK,0BAA0B,CAAC;QACzE,IAAI,gBAAgB,KAAK,SAAS,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACxD,qDAAqD;YACrD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,gBAAgB,GACpB,kBAAkB,IAAI,KAAK;YACzB,CAAC,CAAC,mBAAmB,KAAK,CAAC,gBAAgB,EAAE;YAC7C,CAAC,CAAC,qBAAqB,IAAI,KAAK;gBAC9B,CAAC,CAAC,sBAAsB,KAAK,CAAC,mBAAmB,EAAE;gBACnD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,kEAAkE;gBAClE,iEAAiE;gBACjE,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,IAAI,KAAK,CACb,2CAA2C,gBAAgB,IAAI;gBAC/D,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI;gBACvD,gEAAgE;gBAChE,iEAAiE;gBACjE,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,mEAAmE;gBACnE,gEAAgE;gBAChE,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,IAAI,KAAK,CACb,4CAA4C,gBAAgB,IAAI;gBAChE,gEAAgE;gBAChE,iEAAiE;gBACjE,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,qBAAqB,CAAC,WAAoB;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,qBAAqB,CAC9D,EAAE,EACF,WAAW;YACT,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE;YACzD,CAAC,CAAC,SAAS,CACd,CAAC;QACF,OAAO,GAAG,CAAC,OAAO,CAAC;IACrB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAAe,EAAE,WAAoB;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,aAAa,CACtD,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,EAC/B,WAAW;YACT,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE;YACzD,CAAC,CAAC,SAAS,CACd,CAAC;QACF,OAAO,GAAG,CAAC,OAAO,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,SAAiB;QAChC,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAgB;QAClC,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,UAAkB;QACvC,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,GAAyB;QACrD,OAAO,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,WAAmB,EACnB,GAAW,EACX,UAAiE;QAEjE,MAAM,KAAK,GAAG,MAAM,CAAC,kBAAkB,EAAE;YACvC,WAAW;YACX,GAAG;SACJ,CAAC,CAAC;QACH,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,oBAAoB,EAAE;oBACnD,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,GAAyB;QACjD,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,kBAA0B;QAC/C,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAA0B;QAC7C,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAA8B;QACrD,OAAO,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,GAAyB;QACjD,2BAA2B,CAAC,GAAG,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAgB;QAClC,wBAAwB,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAgB;QACjC,wBAAwB,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,SAAyB;QAClD,wBAAwB,CAAC,SAAS,EAAE,gBAAgB,EAAE,sBAAsB,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,WAAmB,EACnB,MAA+B,EAC/B,OAMC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,wCAAwC,EAAE;YAC7D,WAAW;YACX,MAAM;YACN,sBAAsB,EAAE,OAAO,EAAE,sBAAsB,IAAI,KAAK;YAChE,wBAAwB,EAAE,OAAO,EAAE,wBAAwB,IAAI,KAAK;YACpE,kCAAkC,EAAE,OAAO,EAAE,kCAAkC,IAAI,EAAE;SACtF,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,wBAAwB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,kBAAkB,CACtB,WAAmB,EACnB,UAAkB,EAClB,OAA+B,EAC/B,OAAgC;QAEhC,MAAM,KAAK,GAAG,MAAM,CAAC,qBAAqB,EAAE;YAC1C,WAAW;YACX,UAAU;YACV,OAAO;SACR,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,KAAK,EAAE;YACrD,SAAS,EAAE,OAAO,EAAE,SAAS;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,WAAmB;QAC5C,OAAO,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,wBAAwB,CAAC,WAAmB;QAChD,IAAI,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAE9B,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CACxD,MAAM,CAAC,wBAAwB,EAAE;gBAC/B,WAAW;gBACX,aAAa;gBACb,QAAQ,EAAE,GAAG;aACd,CAAC,CACH,CAAC;YAEF,IAAI,IAAI,CAAC,cAAc,GAAG,aAAa,EAAE,CAAC;gBACxC,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC;YACtC,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClB,OAAO,aAAa,CAAC;YACvB,CAAC;YAED,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC;QACtC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,UAAkB;QAClC,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,UAAkB,EAAE,WAAmB;QAC9D,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,UAAkB;QAC1C,OAAO,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,WAAW,CAAC,KAAoB;QAC9B,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;IAC5B,CAAC;CACF"}

package/dist/config.d.ts

@@ -49,11 +49,12 @@ export interface Config {
     readonly stigmerBackendEndpoint: string;
     readonly stigmerToken: string | null;
     /**
-     * The MCP bridge endpoint for the runner-synthesized datastore
-     * records attachment (STIGMER_MCP_BRIDGE_ENDPOINT, e.g.
-     * https://mcp.stigmer.ai). Null selects the OSS/local shape: a
-     * spawned `stigmer mcp-server` stdio child against the local backend.
-     * See shared/datastore-attachment.ts.
+     * The MCP bridge endpoint for the runner-synthesized attachments —
+     * channel messaging and conversation participation
+     * (STIGMER_MCP_BRIDGE_ENDPOINT, e.g. https://mcp.stigmer.ai). Null
+     * selects the OSS/local shape: a spawned `stigmer mcp-server` stdio
+     * child against the local backend. See shared/channel-attachment.ts
+     * and shared/conversation-attachment.ts.
      */
     readonly mcpBridgeEndpoint: string | null;
     /**

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,OAAO,CAAC;AAE9D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,OAAO,CAAC;AAE/D,0EAA0E;AAC1E,yEAAyE;AACzE,8EAA8E;AAC9E,OAAO,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AACzF,OAAO,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AAiFzF,MAAM,UAAU,UAAU;IACxB,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAsB,CAAC;IAChE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,IAAI,CAAC;IACjE,MAAM,WAAW,GAAG,CAAC,CAAC,aAAa,CAAC;IAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB;WAC3C,OAAO,CAAC,GAAG,CAAC,0CAA0C;WACtD,gBAAgB,CAAC;IAEtB,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,kEAAkE;IAClE,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC;IAEnE,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,SAAS,CAAC;IAEtE,MAAM,sBAAsB,GAAG,iBAAiB,CAC9C,IAAI,KAAK,OAAO;QACd,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,uBAAuB,CAAC;QACnE,CAAC,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAC3C,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,WAAW,CAAC;QACpD,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC;QAC7B,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC;IAExC,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,IAAI,CAAC;IAE1E,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,4BAA4B;IAC5B,MAAM,YAAY,GAAG,WAAW;QAC9B,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,YAAY,IAAI,eAAe,CAAC;QACjE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IAEvC,MAAM,gBAAgB,GAAG,uBAAuB,EAAE,CAAC;IAEnD,MAAM,uBAAuB,GAAG,QAAQ,CACtC,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,GAAG,EAC3C,EAAE,CACH,CAAC;IAEF,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IAChE,MAAM,kBAAkB,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEhF,iFAAiF;IACjF,gFAAgF;IAChF,iFAAiF;IACjF,2CAA2C;IAC3C,MAAM,gBAAgB,GACnB,OAAO,CAAC,GAAG,CAAC,yBAAsE;WAChF,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,yBAAyB,GAAG,OAAO,CAAC,GAAG,CAAC,mCAAmC;WAC5E,aAAa,CAAC;IAEnB,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,SAAS,CAAC;IAEpE,MAAM,0BAA0B,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B;QAC3E,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,EAAE,CAAC;QAC1D,CAAC,CAAC,sCAAsC,CAAC;IAE3C,MAAM,sBAAsB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAClE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,EAAE,CAAC;QACrD,CAAC,CAAC,iCAAiC,CAAC;IAEtC,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B;QACvE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,EAAE,CAAC;QAC3D,CAAC,CAAC,uCAAuC,CAAC;IAE5C,OAAO;QACL,SAAS;QACT,eAAe;QACf,iBAAiB;QACjB,sBAAsB;QACtB,YAAY;QACZ,iBAAiB;QACjB,YAAY;QACZ,gBAAgB;QAChB,IAAI;QACJ,aAAa;QACb,uBAAuB;QACvB,kBAAkB;QAClB,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,iCAAiC,KAAK,MAAM;QAC1E,gBAAgB;QAChB,yBAAyB;QACzB,YAAY;QACZ,0BAA0B;QAC1B,qBAAqB;QACrB,sBAAsB;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAChD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,IAAI,CACV,wEAAwE;QACxE,kEAAkE,CACnE,CAAC;IAEF,MAAM,WAAW,GAAG,qBAAqB,EAAE,CAAC;IAC5C,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,qBAAqB;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,aAAa,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,WAAW,QAAQ,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,UAAU,QAAQ,EAAE,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,OAAO,CAAC;AAE9D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,OAAO,CAAC;AAE/D,0EAA0E;AAC1E,yEAAyE;AACzE,8EAA8E;AAC9E,OAAO,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AACzF,OAAO,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AAkFzF,MAAM,UAAU,UAAU;IACxB,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAsB,CAAC;IAChE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,IAAI,CAAC;IACjE,MAAM,WAAW,GAAG,CAAC,CAAC,aAAa,CAAC;IAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB;WAC3C,OAAO,CAAC,GAAG,CAAC,0CAA0C;WACtD,gBAAgB,CAAC;IAEtB,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,kEAAkE;IAClE,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC;IAEnE,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,SAAS,CAAC;IAEtE,MAAM,sBAAsB,GAAG,iBAAiB,CAC9C,IAAI,KAAK,OAAO;QACd,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,uBAAuB,CAAC;QACnE,CAAC,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAC3C,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,WAAW,CAAC;QACpD,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC;QAC7B,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC;IAExC,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,IAAI,CAAC;IAE1E,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,4BAA4B;IAC5B,MAAM,YAAY,GAAG,WAAW;QAC9B,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,YAAY,IAAI,eAAe,CAAC;QACjE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IAEvC,MAAM,gBAAgB,GAAG,uBAAuB,EAAE,CAAC;IAEnD,MAAM,uBAAuB,GAAG,QAAQ,CACtC,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,GAAG,EAC3C,EAAE,CACH,CAAC;IAEF,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IAChE,MAAM,kBAAkB,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEhF,iFAAiF;IACjF,gFAAgF;IAChF,iFAAiF;IACjF,2CAA2C;IAC3C,MAAM,gBAAgB,GACnB,OAAO,CAAC,GAAG,CAAC,yBAAsE;WAChF,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,yBAAyB,GAAG,OAAO,CAAC,GAAG,CAAC,mCAAmC;WAC5E,aAAa,CAAC;IAEnB,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,SAAS,CAAC;IAEpE,MAAM,0BAA0B,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B;QAC3E,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,EAAE,CAAC;QAC1D,CAAC,CAAC,sCAAsC,CAAC;IAE3C,MAAM,sBAAsB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAClE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,EAAE,CAAC;QACrD,CAAC,CAAC,iCAAiC,CAAC;IAEtC,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B;QACvE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,EAAE,CAAC;QAC3D,CAAC,CAAC,uCAAuC,CAAC;IAE5C,OAAO;QACL,SAAS;QACT,eAAe;QACf,iBAAiB;QACjB,sBAAsB;QACtB,YAAY;QACZ,iBAAiB;QACjB,YAAY;QACZ,gBAAgB;QAChB,IAAI;QACJ,aAAa;QACb,uBAAuB;QACvB,kBAAkB;QAClB,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,iCAAiC,KAAK,MAAM;QAC1E,gBAAgB;QAChB,yBAAyB;QACzB,YAAY;QACZ,0BAA0B;QAC1B,qBAAqB;QACrB,sBAAsB;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAChD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,IAAI,CACV,wEAAwE;QACxE,kEAAkE,CACnE,CAAC;IAEF,MAAM,WAAW,GAAG,qBAAqB,EAAE,CAAC;IAC5C,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,qBAAqB;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,aAAa,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,WAAW,QAAQ,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,UAAU,QAAQ,EAAE,CAAC;AAC9B,CAAC"}

package/dist/encryption/config.d.ts

@@ -1,15 +1,28 @@
 /**
- * Payload-encryption configuration (stigmer-cloud#227).
+ * Payload-encryption configuration (stigmer-cloud#227, stigmer#398).
  *
- * Encryption is enabled iff STIGMER_PAYLOAD_ENCRYPTION_KEY is present —
- * the same enabled-iff-configured pattern as the claim-check codec. A
- * malformed key fails the boot rather than silently running plaintext:
- * an operator who set the key intended history to be encrypted.
+ * Two key sources, strict precedence:
+ *
+ *   1. Environment (STIGMER_PAYLOAD_ENCRYPTION_KEY(_ID)) — the operator's
+ *      explicit choice: self-hosted deployments sharing one key with their
+ *      server, and cloud sandboxes injected with the platform key. When the
+ *      env key is set, bootstrap-delivered material is ignored entirely.
+ *   2. Bootstrap-delivered — server-managed per-identity keys handed to
+ *      desktop-class runners by getRunnerBootstrapConfig. Held in memory
+ *      only; persistence lives server-side, which is what makes Temporal
+ *      replay work across runner restarts (every boot re-fetches the SAME
+ *      key).
+ *
+ * Encryption is enabled iff a key is present from either source — the same
+ * enabled-iff-configured pattern as the claim-check codec. A malformed key
+ * fails the boot rather than silently running plaintext: an operator who set
+ * the key (or a server that minted one) intended history to be encrypted.
  *
  * Key rotation: payloads carry the id of the key that encrypted them.
- * During a rotation window the previous key stays readable via
- * STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY(_ID) while new payloads are
- * written under the primary key.
+ * During a rotation window the previous key stays readable via the
+ * secondary pair while new payloads are written under the primary key.
+ * Workers capture keys at construction, so a rotated bootstrap key lands
+ * on the next runner boot — there is no live re-key.
  */
 export interface EncryptionKey {
     readonly keyId: string;
@@ -22,11 +35,30 @@ export interface PayloadEncryptionConfig {
     /** Decrypt-only key accepted during rotation windows. */
     readonly secondary?: EncryptionKey;
 }
+/**
+ * Server-managed key material delivered by getRunnerBootstrapConfig.
+ * Structurally mirrors {@link BootstrapPayloadEncryptionKeys} in
+ * stigmer-client.ts — declared here so this leaf module stays free of
+ * client imports.
+ */
+export interface BootstrapKeyMaterial {
+    readonly key: string;
+    readonly keyId?: string;
+    readonly secondaryKey?: string;
+    readonly secondaryKeyId?: string;
+}
 /**
  * Returns the encryption config, or undefined when encryption is not
  * configured (the codec is then simply not installed).
  *
+ * Source precedence: the env key wins outright; bootstrap-delivered
+ * material applies only when no env key is set (see the module doc).
+ *
  * @throws when a key is present but malformed, or a key id is missing —
  *   key misconfiguration must stop the boot, not degrade to plaintext.
+ *   This applies equally to bootstrap material: a server that hands out
+ *   a bad key or omits its id has broken the protocol contract, and
+ *   running plaintext against a server that manages keys would silently
+ *   defeat the feature.
  */
-export declare function loadPayloadEncryptionConfig(): PayloadEncryptionConfig | undefined;
+export declare function loadPayloadEncryptionConfig(bootstrap?: BootstrapKeyMaterial): PayloadEncryptionConfig | undefined;

package/dist/encryption/config.js

@@ -1,15 +1,28 @@
 /**
- * Payload-encryption configuration (stigmer-cloud#227).
+ * Payload-encryption configuration (stigmer-cloud#227, stigmer#398).
  *
- * Encryption is enabled iff STIGMER_PAYLOAD_ENCRYPTION_KEY is present —
- * the same enabled-iff-configured pattern as the claim-check codec. A
- * malformed key fails the boot rather than silently running plaintext:
- * an operator who set the key intended history to be encrypted.
+ * Two key sources, strict precedence:
+ *
+ *   1. Environment (STIGMER_PAYLOAD_ENCRYPTION_KEY(_ID)) — the operator's
+ *      explicit choice: self-hosted deployments sharing one key with their
+ *      server, and cloud sandboxes injected with the platform key. When the
+ *      env key is set, bootstrap-delivered material is ignored entirely.
+ *   2. Bootstrap-delivered — server-managed per-identity keys handed to
+ *      desktop-class runners by getRunnerBootstrapConfig. Held in memory
+ *      only; persistence lives server-side, which is what makes Temporal
+ *      replay work across runner restarts (every boot re-fetches the SAME
+ *      key).
+ *
+ * Encryption is enabled iff a key is present from either source — the same
+ * enabled-iff-configured pattern as the claim-check codec. A malformed key
+ * fails the boot rather than silently running plaintext: an operator who set
+ * the key (or a server that minted one) intended history to be encrypted.
  *
  * Key rotation: payloads carry the id of the key that encrypted them.
- * During a rotation window the previous key stays readable via
- * STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY(_ID) while new payloads are
- * written under the primary key.
+ * During a rotation window the previous key stays readable via the
+ * secondary pair while new payloads are written under the primary key.
+ * Workers capture keys at construction, so a rotated bootstrap key lands
+ * on the next runner boot — there is no live re-key.
  */
 const KEY_ENV = "STIGMER_PAYLOAD_ENCRYPTION_KEY";
 const KEY_ID_ENV = "STIGMER_PAYLOAD_ENCRYPTION_KEY_ID";
@@ -20,26 +33,46 @@ const AES_256_KEY_BYTES = 32;
  * Returns the encryption config, or undefined when encryption is not
  * configured (the codec is then simply not installed).
  *
+ * Source precedence: the env key wins outright; bootstrap-delivered
+ * material applies only when no env key is set (see the module doc).
+ *
  * @throws when a key is present but malformed, or a key id is missing —
  *   key misconfiguration must stop the boot, not degrade to plaintext.
+ *   This applies equally to bootstrap material: a server that hands out
+ *   a bad key or omits its id has broken the protocol contract, and
+ *   running plaintext against a server that manages keys would silently
+ *   defeat the feature.
  */
-export function loadPayloadEncryptionConfig() {
+export function loadPayloadEncryptionConfig(bootstrap) {
     const rawKey = process.env[KEY_ENV];
-    if (!rawKey) {
-        return undefined;
+    if (rawKey) {
+        const primary = {
+            keyId: requireKeyId(KEY_ID_ENV),
+            key: parseKey(rawKey, KEY_ENV),
+        };
+        const rawSecondary = process.env[SECONDARY_KEY_ENV];
+        const secondary = rawSecondary
+            ? {
+                keyId: requireKeyId(SECONDARY_KEY_ID_ENV),
+                key: parseKey(rawSecondary, SECONDARY_KEY_ENV),
+            }
+            : undefined;
+        return { primary, secondary };
+    }
+    if (bootstrap?.key) {
+        const primary = {
+            keyId: requireBootstrapKeyId(bootstrap.keyId, "payload_encryption_key_id"),
+            key: parseKey(bootstrap.key, "bootstrap payload_encryption_key"),
+        };
+        const secondary = bootstrap.secondaryKey
+            ? {
+                keyId: requireBootstrapKeyId(bootstrap.secondaryKeyId, "payload_encryption_secondary_key_id"),
+                key: parseKey(bootstrap.secondaryKey, "bootstrap payload_encryption_secondary_key"),
+            }
+            : undefined;
+        return { primary, secondary };
     }
-    const primary = {
-        keyId: requireKeyId(KEY_ID_ENV),
-        key: parseKey(rawKey, KEY_ENV),
-    };
-    const rawSecondary = process.env[SECONDARY_KEY_ENV];
-    const secondary = rawSecondary
-        ? {
-            keyId: requireKeyId(SECONDARY_KEY_ID_ENV),
-            key: parseKey(rawSecondary, SECONDARY_KEY_ENV),
-        }
-        : undefined;
-    return { primary, secondary };
+    return undefined;
 }
 function requireKeyId(envName) {
     const keyId = process.env[envName];
@@ -51,6 +84,13 @@ function requireKeyId(envName) {
     }
     return keyId;
 }
+function requireBootstrapKeyId(keyId, fieldName) {
+    if (!keyId) {
+        throw new Error(`Runner bootstrap returned a payload encryption key without its ${fieldName} — ` +
+            `refusing to encrypt under an unidentified key (server contract violation)`);
+    }
+    return keyId;
+}
 function parseKey(rawBase64, envName) {
     let key;
     try {

package/dist/encryption/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/encryption/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAeH,MAAM,OAAO,GAAG,gCAAgC,CAAC;AACjD,MAAM,UAAU,GAAG,mCAAmC,CAAC;AACvD,MAAM,iBAAiB,GAAG,0CAA0C,CAAC;AACrE,MAAM,oBAAoB,GAAG,6CAA6C,CAAC;AAE3E,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAkB;QAC7B,KAAK,EAAE,YAAY,CAAC,UAAU,CAAC;QAC/B,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;KAC/B,CAAC;IAEF,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACpD,MAAM,SAAS,GAA8B,YAAY;QACvD,CAAC,CAAC;YACE,KAAK,EAAE,YAAY,CAAC,oBAAoB,CAAC;YACzC,GAAG,EAAE,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;SAC/C;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,oEAAoE;IACpE,4DAA4D;IAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,wBAAwB;YAClE,0BAA0B,CAC7B,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,SAAiB,EAAE,OAAe;IAClD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,OAAO,sBAAsB,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,kBAAkB;YAC5D,GAAG,iBAAiB,yBAAyB,GAAG,CAAC,MAAM,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/encryption/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AA4BH,MAAM,OAAO,GAAG,gCAAgC,CAAC;AACjD,MAAM,UAAU,GAAG,mCAAmC,CAAC;AACvD,MAAM,iBAAiB,GAAG,0CAA0C,CAAC;AACrE,MAAM,oBAAoB,GAAG,6CAA6C,CAAC;AAE3E,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAgC;IAEhC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAkB;YAC7B,KAAK,EAAE,YAAY,CAAC,UAAU,CAAC;YAC/B,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;SAC/B,CAAC;QAEF,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACpD,MAAM,SAAS,GAA8B,YAAY;YACvD,CAAC,CAAC;gBACE,KAAK,EAAE,YAAY,CAAC,oBAAoB,CAAC;gBACzC,GAAG,EAAE,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;aAC/C;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,SAAS,EAAE,GAAG,EAAE,CAAC;QACnB,MAAM,OAAO,GAAkB;YAC7B,KAAK,EAAE,qBAAqB,CAAC,SAAS,CAAC,KAAK,EAAE,2BAA2B,CAAC;YAC1E,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,kCAAkC,CAAC;SACjE,CAAC;QAEF,MAAM,SAAS,GAA8B,SAAS,CAAC,YAAY;YACjE,CAAC,CAAC;gBACE,KAAK,EAAE,qBAAqB,CAC1B,SAAS,CAAC,cAAc,EACxB,qCAAqC,CACtC;gBACD,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,4CAA4C,CAAC;aACpF;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,oEAAoE;IACpE,4DAA4D;IAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,wBAAwB;YAClE,0BAA0B,CAC7B,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAyB,EAAE,SAAiB;IACzE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,kEAAkE,SAAS,KAAK;YAC9E,2EAA2E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,SAAiB,EAAE,OAAe;IAClD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,OAAO,sBAAsB,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,kBAAkB;YAC5D,GAAG,iBAAiB,yBAAyB,GAAG,CAAC,MAAM,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/middleware/index.d.ts

@@ -4,6 +4,9 @@
  * Assembles the ordered middleware array from a MiddlewareStackConfig.
  * The composition order matches the Python create_deep_agent injection:
  *
+ *   0. Path normalization (conditional: only on permission-rule-bearing
+ *      graphs — FIRST, so every downstream middleware observes canonical
+ *      workspace-absolute paths)
  *   1. Loop detection (always)
  *   2. Execution budget (always)
  *   3. Tool truncation (always)

package/dist/middleware/index.js

@@ -4,6 +4,9 @@
  * Assembles the ordered middleware array from a MiddlewareStackConfig.
  * The composition order matches the Python create_deep_agent injection:
  *
+ *   0. Path normalization (conditional: only on permission-rule-bearing
+ *      graphs — FIRST, so every downstream middleware observes canonical
+ *      workspace-absolute paths)
  *   1. Loop detection (always)
  *   2. Execution budget (always)
  *   3. Tool truncation (always)
@@ -12,6 +15,7 @@
  *   6. Error hints (always)
  *   7. OTel spans (always, no-op when OTel not configured)
  */
+import { createPathNormalizationMiddleware } from "./path-normalization.js";
 import { createLoopDetectionMiddleware } from "./loop-detection.js";
 import { createExecutionBudgetMiddleware } from "./execution-budget.js";
 import { createToolTruncationMiddleware } from "./tool-truncation.js";
@@ -22,6 +26,9 @@ import { createErrorHintsMiddleware } from "./error-hints.js";
 import { createOtelSpansMiddleware } from "./otel-spans.js";
 export function buildMiddlewareStack(config = {}) {
     const stack = [];
+    if (config.pathNormalization) {
+        stack.push(createPathNormalizationMiddleware(config.pathNormalization));
+    }
     stack.push(createLoopDetectionMiddleware(config.loopDetection));
     stack.push(createExecutionBudgetMiddleware(config.executionBudget));
     stack.push(createToolTruncationMiddleware(config.toolTruncation));

package/dist/middleware/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAA0B,MAAM,eAAe,CAAC;AAChF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAY5D,MAAM,UAAU,oBAAoB,CAClC,SAAgC,EAAE;IAElC,MAAM,KAAK,GAAwB,EAAE,CAAC;IAEtC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IAEhE,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IAEpE,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;IAElE,MAAM,YAAY,GAAG,4BAA4B,EAAE,CAAC;IACpD,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEzB,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAE9B,KAAK,CAAC,IAAI,CAAC,0BAA0B,EAAE,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAExD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,0BAA0B,EAAE,CAAC,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAExD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAE,iCAAiC,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAA0B,MAAM,eAAe,CAAC;AAChF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAY5D,MAAM,UAAU,oBAAoB,CAClC,SAAgC,EAAE;IAElC,MAAM,KAAK,GAAwB,EAAE,CAAC;IAEtC,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IAEhE,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IAEpE,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;IAElE,MAAM,YAAY,GAAG,4BAA4B,EAAE,CAAC;IACpD,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEzB,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAE9B,KAAK,CAAC,IAAI,CAAC,0BAA0B,EAAE,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAExD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,0BAA0B,EAAE,CAAC,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAExD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC5D,CAAC"}

package/dist/middleware/path-normalization.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Workspace-relative path normalization for permission-rule-bearing graphs
+ * (issue #429).
+ *
+ * deepagents' permission enforcement canonicalizes tool-call paths BEFORE any
+ * rule or backend runs, and its validation refuses non-absolute paths — on
+ * EVERY filesystem tool call once a graph carries any permission rules, reads
+ * included. Plan mode is the only rule-bearing production configuration
+ * (shared/plan-mode-permissions.ts), so there a workspace-relative path —
+ * the shape the multi-workspace prompt explicitly mandates, and one models
+ * routinely choose in single-workspace sessions — fails with
+ * `path must be absolute` instead of just working, burning tool rounds until
+ * the model adapts by switching to absolute paths.
+ *
+ * This middleware repairs the contract at our own seam: it rewrites
+ * workspace-relative paths on the deepagents built-in filesystem tools to
+ * workspace-absolute before the tool (and therefore enforcement) runs. The
+ * write-deny rule then fires as designed and reads succeed on the first try.
+ * Rule-less (act-mode) graphs never install it — the legacy backend already
+ * resolves relative paths under the workspace root, so act mode keeps a
+ * byte-zero delta.
+ *
+ * Invariant — nothing becomes newly reachable: only paths whose resolution
+ * stays INSIDE the workspace root are rewritten. Escaping relatives (`../x`)
+ * and `~`-carrying paths are left raw so today's validation refusal keeps
+ * speaking (a naive join would resolve `..` away and smuggle an out-of-root
+ * read past validation), and absolute paths pass through byte-untouched.
+ * The middleware converts false errors into correct behavior — never a
+ * refusal into an allowance the rules didn't decide.
+ *
+ * Tool matching is by bare built-in name, the house doctrine (an MCP server
+ * is not expected to shadow a built-in name — see shared/tool-kind.ts); the
+ * rewrite touches only the tool's path-bearing argument, never glob/grep
+ * patterns. Install FIRST in the stack so every downstream middleware
+ * (approval gate, error hints, otel spans) observes canonical paths.
+ */
+import type { StigmerMiddleware } from "./types.js";
+export interface PathNormalizationConfig {
+    /** The workspace root the graph's filesystem backend resolves against. */
+    readonly rootDir: string;
+}
+/**
+ * Rewrite `raw` to its workspace-absolute form, or return undefined when the
+ * value must be left untouched (absolute already, `~`-carrying, or escaping
+ * the workspace root). Exported for direct unit testing of the mapping table.
+ */
+export declare function normalizeWorkspacePathArg(raw: string, rootDir: string): string | undefined;
+/**
+ * Create middleware that normalizes workspace-relative paths on the built-in
+ * filesystem tools before permission enforcement sees them.
+ *
+ * Installed only on graphs that carry filesystem permission rules — derive
+ * the install condition from the same expression that supplies the rules
+ * (setup.ts / compileSubagents) so the rules and their normalization shim
+ * cannot drift apart.
+ */
+export declare function createPathNormalizationMiddleware(config: PathNormalizationConfig): StigmerMiddleware;