@stigmer/runner 3.12.3 → 3.12.4

package/dist/shared/llm-backend.js

@@ -13,6 +13,7 @@
  * `_projects/2026-08/20260809.01.multi-cloud-llm-provider-endpoints/`
  * `design-decisions/001-provider-backends.md`.
  */
+import { runnerSecretsEnvView } from "./runner-credential-store.js";
 // ─── Backend selection ───────────────────────────────────────────────────────
 /** Env var selecting where Anthropic models are served. */
 export const ANTHROPIC_BACKEND_ENV = "STIGMER_ANTHROPIC_BACKEND";
@@ -244,7 +245,13 @@ export function checkFoundryPrerequisites(env = process.env) {
  * no proxy is configured — a proxied deployment authenticates with
  * STIGMER_TOKEN and holds no provider credentials at all.
  */
-export function checkDirectCredentials(provider, env = process.env) {
+export function checkDirectCredentials(provider, 
+// Credential keys live in the runner credential store after the boot
+// capture (#508), so the default is the store view, not bare process.env.
+// The other checks in this module keep the process.env default: they read
+// deployment CONFIG (backend selection, regions), which is deliberately
+// not captured.
+env = runnerSecretsEnvView()) {
     if (provider === "openai") {
         if (env.OPENAI_API_KEY?.trim())
             return null;

package/dist/shared/llm-backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"llm-backend.js","sourceRoot":"","sources":["../../src/shared/llm-backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,gFAAgF;AAEhF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AACjE,wDAAwD;AACxD,MAAM,CAAC,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AAE3D,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,uDAAuD,CAAC;AA0BvF,sEAAsE;AACtE,MAAM,iBAAiB,GAAa,EAAE,CAAC;AACvC,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,CAAC;AAEjC,SAAS,YAAY,CACnB,MAAc,EACd,GAAuB,EACvB,SAAuB,EACvB,OAA0B;IAE1B,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,mEAAmE;QACnE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAa,EAAE,CAAC;IAC9C,CAAC;IACD,IAAK,SAA+B,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAU,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EACL,GAAG,MAAM,KAAK,KAAK,0CAA0C;gBAC7D,oBAAoB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,eAAe,GAAG;SACtE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EACL,GAAG,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,gCAAgC;YACzD,cAAc,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,eAAe,GAAG;KAChE,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,qBAAqB,CACnC,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,YAAY,CACjB,qBAAqB,EACrB,GAAG,CAAC,qBAAqB,CAAC,EAC1B,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,EAC1C,iBAAiB,CAClB,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,kBAAkB,CAChC,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,YAAY,CACjB,kBAAkB,EAClB,GAAG,CAAC,kBAAkB,CAAC,EACvB,CAAC,QAAQ,CAAC;IACV,yEAAyE;IACzE,qEAAqE;IACrE,cAAc,CACf,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,CACL,sEAAsE;QACtE,0CAA0C,eAAe,GAAG,CAC7D,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AACjE,gFAAgF;AAChF,MAAM,CAAC,MAAM,4BAA4B,GAAG,kCAAkC,CAAC;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5B,OAAO,CACL,qEAAqE;YACrE,kEAAkE;YAClE,mEAAmE;YACnE,wCAAwC,eAAe,GAAG,CAC3D,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAMD;;;;;;GAMG;AACH,SAAS,aAAa,CACpB,MAAc,EACd,GAAuB,EACvB,IAAY,EACZ,OAAe;IAEf,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAEvC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,SAAS,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EACL,GAAG,MAAM,WAAW,IAAI,wBAAwB,IAAI,GAAG;oBACvD,UAAU,OAAO,mCAAmC;oBACpD,OAAO,eAAe,GAAG;aAC5B,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,aAAa,CAClB,qBAAqB,EACrB,GAAG,CAAC,qBAAqB,CAAC,EAC1B,qBAAqB,EACrB,uDAAuD,CACxD,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;AAC3E,wEAAwE;AACxE,MAAM,CAAC,MAAM,oBAAoB,GAAG,4BAA4B,CAAC;AACjE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,4BAA4B,CAAC;AAEjE;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,aAAa,CAClB,0BAA0B,EAC1B,GAAG,CAAC,0BAA0B,CAAC,EAC/B,0BAA0B,EAC1B,wCAAwC,CACzC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,GAAG,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,CACL,gCAAgC,oBAAoB,mBAAmB;YACvE,wDAAwD;YACxD,GAAG,oBAAoB,4BAA4B;YACnD,mEAAmE;YACnE,OAAO,eAAe,GAAG,CAC1B,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;QACxB,OAAO,CACL,GAAG,oBAAoB,QAAQ,oBAAoB,gBAAgB;YACnE,kEAAkE;YAClE,oBAAoB,eAAe,GAAG,CACvC,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAqB,EACrB,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QAC5C,OAAO,CACL,oEAAoE;YACpE,oEAAoE;YACpE,OAAO,eAAe,GAAG,CAC1B,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,CACL,uEAAuE;QACvE,kEAAkE;QAClE,GAAG,qBAAqB,+CAA+C;QACvE,mCAAmC,eAAe,GAAG,CACtD,CAAC;AACJ,CAAC;AASD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC;IAEtD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,MAAM,IAAI,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,EAAE,CAAC;YACjE,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;YAChC,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC1C,QAAQ,CAAC,IAAI,CACX,kCAAkC,MAAM,IAAI,GAAG,gBAAgB;oBAC/D,kCAAkC,CACnC,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;SAAM,IAAI,SAAS,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;SAAM,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;SAAM,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE5C,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC/E,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,sBAAsB,GAAG,WAAW,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,OAAO,UAAU,CAAC,OAAO,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAkB,EAClB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAExC,kEAAkE;IAClE,MAAM,MAAM,GAAG,GAAG,CAAC,4BAA4B,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,aAAa,UAAU,OAAO,CAAC;IAC/C,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAkB,EAClB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAExC,OAAO,UAAU,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"llm-backend.js","sourceRoot":"","sources":["../../src/shared/llm-backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE,gFAAgF;AAEhF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AACjE,wDAAwD;AACxD,MAAM,CAAC,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AAE3D,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,uDAAuD,CAAC;AA0BvF,sEAAsE;AACtE,MAAM,iBAAiB,GAAa,EAAE,CAAC;AACvC,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,CAAC;AAEjC,SAAS,YAAY,CACnB,MAAc,EACd,GAAuB,EACvB,SAAuB,EACvB,OAA0B;IAE1B,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,mEAAmE;QACnE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAa,EAAE,CAAC;IAC9C,CAAC;IACD,IAAK,SAA+B,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAU,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EACL,GAAG,MAAM,KAAK,KAAK,0CAA0C;gBAC7D,oBAAoB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,eAAe,GAAG;SACtE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EACL,GAAG,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,gCAAgC;YACzD,cAAc,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,eAAe,GAAG;KAChE,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,qBAAqB,CACnC,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,YAAY,CACjB,qBAAqB,EACrB,GAAG,CAAC,qBAAqB,CAAC,EAC1B,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,EAC1C,iBAAiB,CAClB,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,kBAAkB,CAChC,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,YAAY,CACjB,kBAAkB,EAClB,GAAG,CAAC,kBAAkB,CAAC,EACvB,CAAC,QAAQ,CAAC;IACV,yEAAyE;IACzE,qEAAqE;IACrE,cAAc,CACf,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,CACL,sEAAsE;QACtE,0CAA0C,eAAe,GAAG,CAC7D,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AACjE,gFAAgF;AAChF,MAAM,CAAC,MAAM,4BAA4B,GAAG,kCAAkC,CAAC;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5B,OAAO,CACL,qEAAqE;YACrE,kEAAkE;YAClE,mEAAmE;YACnE,wCAAwC,eAAe,GAAG,CAC3D,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAMD;;;;;;GAMG;AACH,SAAS,aAAa,CACpB,MAAc,EACd,GAAuB,EACvB,IAAY,EACZ,OAAe;IAEf,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAEvC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,SAAS,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EACL,GAAG,MAAM,WAAW,IAAI,wBAAwB,IAAI,GAAG;oBACvD,UAAU,OAAO,mCAAmC;oBACpD,OAAO,eAAe,GAAG;aAC5B,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,aAAa,CAClB,qBAAqB,EACrB,GAAG,CAAC,qBAAqB,CAAC,EAC1B,qBAAqB,EACrB,uDAAuD,CACxD,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;AAC3E,wEAAwE;AACxE,MAAM,CAAC,MAAM,oBAAoB,GAAG,4BAA4B,CAAC;AACjE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,4BAA4B,CAAC;AAEjE;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,aAAa,CAClB,0BAA0B,EAC1B,GAAG,CAAC,0BAA0B,CAAC,EAC/B,0BAA0B,EAC1B,wCAAwC,CACzC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,GAAG,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,CACL,gCAAgC,oBAAoB,mBAAmB;YACvE,wDAAwD;YACxD,GAAG,oBAAoB,4BAA4B;YACnD,mEAAmE;YACnE,OAAO,eAAe,GAAG,CAC1B,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;QACxB,OAAO,CACL,GAAG,oBAAoB,QAAQ,oBAAoB,gBAAgB;YACnE,kEAAkE;YAClE,oBAAoB,eAAe,GAAG,CACvC,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAqB;AACrB,qEAAqE;AACrE,0EAA0E;AAC1E,0EAA0E;AAC1E,wEAAwE;AACxE,gBAAgB;AAChB,MAAyB,oBAAoB,EAAE;IAE/C,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QAC5C,OAAO,CACL,oEAAoE;YACpE,oEAAoE;YACpE,OAAO,eAAe,GAAG,CAC1B,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,CACL,uEAAuE;QACvE,kEAAkE;QAClE,GAAG,qBAAqB,+CAA+C;QACvE,mCAAmC,eAAe,GAAG,CACtD,CAAC;AACJ,CAAC;AASD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC;IAEtD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,MAAM,IAAI,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,EAAE,CAAC;YACjE,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;YAChC,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC1C,QAAQ,CAAC,IAAI,CACX,kCAAkC,MAAM,IAAI,GAAG,gBAAgB;oBAC/D,kCAAkC,CACnC,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;SAAM,IAAI,SAAS,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;SAAM,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;SAAM,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE5C,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC/E,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,sBAAsB,GAAG,WAAW,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,OAAO,UAAU,CAAC,OAAO,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAkB,EAClB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAExC,kEAAkE;IAClE,MAAM,MAAM,GAAG,GAAG,CAAC,4BAA4B,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,aAAa,UAAU,OAAO,CAAC;IAC/C,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAkB,EAClB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAExC,OAAO,UAAU,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC"}

package/dist/shared/model-client.d.ts

@@ -14,6 +14,7 @@
  */
 import type { BaseChatModel } from "@langchain/core/language_models/chat_models";
 import { type LlmProvider } from "./llm-proxy.js";
+import { type EffectiveServiceTier } from "./service-tier.js";
 export interface BuildChatModelOptions {
     /** Registry id ("claude-haiku-4.5"), "provider:model", or a provider API id. */
     readonly modelName: string;
@@ -42,6 +43,20 @@ export interface BuildChatModelOptions {
      */
     readonly timeoutMs?: number;
     readonly maxRetries?: number;
+    /**
+     * The execution's EFFECTIVE service tier (stigmer/stigmer#361) — already
+     * resolved by the caller (resolveEffectiveServiceTier), never
+     * UNSPECIFIED. When set, every provider request pins its tier explicitly
+     * (OpenAI `service_tier`; Anthropic `service_tier` via invocationKwargs)
+     * so the provider ACCOUNT's default can never pick the price — the #357
+     * contract, held on the native harness. Deliberately optional:
+     * platform-internal utility calls (tool-approval classification, session
+     * subjects, structured extraction, workflow llm_call) are not the
+     * execution's own turns and send no tier — the provider treats an absent
+     * parameter as its standard behavior, and those calls' models are
+     * platform-chosen economy models.
+     */
+    readonly serviceTier?: EffectiveServiceTier;
 }
 export interface BuiltChatModel {
     readonly model: BaseChatModel;

package/dist/shared/model-client.js

@@ -17,6 +17,8 @@ import { ChatOpenAI } from "@langchain/openai";
 import { inferProvider, stripProviderPrefix, resolveProxyBaseUrl, buildProxyHeaders, } from "./llm-proxy.js";
 import { resolveAnthropicBackend, checkVertexPrerequisites, checkBedrockPrerequisites, checkFoundryPrerequisites, toVertexModelId, toBedrockModelId, toFoundryDeploymentName, } from "./llm-backend.js";
 import { resolveToApiModelId } from "./model-registry.js";
+import { toAnthropicServiceTier, toOpenAiServiceTier, } from "./service-tier.js";
+import { getRunnerSecret } from "./runner-credential-store.js";
 /**
  * The operator's request-timeout bound. Only a positive integer means
  * "bound the request" — unset, non-numeric, zero, and negative all
@@ -63,11 +65,11 @@ export async function buildChatModel(opts) {
     // tests. Prerequisites are re-checked here (not only in
     // the factories' preflight) so paths that construct models without a
     // runner factory still fail at dispatch with the catalog message instead
-    // of mid-request. Credentials are read natively by each SDK from its
-    // standard conventions (GCP: CLOUD_ML_REGION + ADC; AWS: AWS_REGION +
-    // the credential chain / AWS_BEARER_TOKEN_BEDROCK; Foundry:
-    // ANTHROPIC_FOUNDRY_API_KEY, or the Azure credential chain when no key
-    // is set).
+    // of mid-request. Ambient credentials are read natively by each SDK from
+    // its standard conventions (GCP: CLOUD_ML_REGION + ADC; AWS: AWS_REGION +
+    // the credential chain); runner-held keys (AWS_BEARER_TOKEN_BEDROCK,
+    // ANTHROPIC_FOUNDRY_API_KEY) are passed explicitly from the credential
+    // store because the boot capture empties their env slots (#508).
     let backendCreateClient;
     let wireModelId = apiModelId;
     let maxTokens = opts.maxTokens;
@@ -84,7 +86,16 @@ export async function buildChatModel(opts) {
         if (prereq !== null)
             throw new Error(prereq);
         const { AnthropicBedrock } = await import("@anthropic-ai/bedrock-sdk");
-        backendCreateClient = (options) => new AnthropicBedrock({ maxRetries: options.maxRetries, timeout: options.timeout });
+        // The SDK's own default for `apiKey` is process.env.AWS_BEARER_TOKEN_BEDROCK,
+        // which the boot capture has emptied (#508) — hand it the stored value
+        // explicitly. `undefined` when absent preserves the SDK's fallthrough to
+        // the ambient AWS credential chain (env keys, IRSA, config files).
+        const bedrockBearerToken = getRunnerSecret("AWS_BEARER_TOKEN_BEDROCK");
+        backendCreateClient = (options) => new AnthropicBedrock({
+            apiKey: bedrockBearerToken,
+            maxRetries: options.maxRetries,
+            timeout: options.timeout,
+        });
         wireModelId = toBedrockModelId(apiModelId);
         if (maxTokens === undefined) {
             // LangChain's per-model maxTokens table prefix-matches the model
@@ -115,15 +126,20 @@ export async function buildChatModel(opts) {
         // so refreshed tokens flow without reconstruction (pinned by
         // foundry-seam.test.ts). Endpoint (resource or base URL) and the key
         // are read natively by the SDK from its own env vars.
+        // The SDK's own default for `apiKey` is process.env.ANTHROPIC_FOUNDRY_API_KEY,
+        // which the boot capture has emptied (#508) — resolve it from the store
+        // and hand it over explicitly. The either/or stays intact: exactly one of
+        // apiKey / azureADTokenProvider reaches the constructor.
+        const foundryApiKey = getRunnerSecret("ANTHROPIC_FOUNDRY_API_KEY")?.trim() || undefined;
         let azureADTokenProvider;
-        if (!process.env.ANTHROPIC_FOUNDRY_API_KEY?.trim()) {
+        if (!foundryApiKey) {
             const { DefaultAzureCredential, getBearerTokenProvider } = await import("@azure/identity");
             azureADTokenProvider = getBearerTokenProvider(new DefaultAzureCredential(), "https://ai.azure.com/.default");
         }
         backendCreateClient = (options) => new AnthropicFoundry({
             maxRetries: options.maxRetries,
             timeout: options.timeout,
-            ...(azureADTokenProvider ? { azureADTokenProvider } : {}),
+            ...(foundryApiKey ? { apiKey: foundryApiKey } : { azureADTokenProvider }),
         });
         // Unlike the vertex/bedrock ids, the deployment name needs no maxTokens
         // handling: stripping the snapshot date preserves LangChain's per-model
@@ -137,18 +153,26 @@ export async function buildChatModel(opts) {
     const headers = opts.proxyEndpoint && opts.stigmerToken
         ? buildProxyHeaders(opts.stigmerToken, opts.headerScope ?? {})
         : undefined;
-    // Proxy mode authenticates with the Stigmer token; direct mode falls back to
-    // the provider's own env-var key.
+    // Proxy mode authenticates with the Stigmer token; direct mode falls back
+    // to the provider's own key, resolved from the credential store (the boot
+    // capture moved it out of process.env, #508).
     const apiKey = opts.proxyEndpoint
         ? (opts.stigmerToken ?? "proxy-managed")
         : provider === "openai"
-            ? (process.env.OPENAI_API_KEY ?? "")
-            : (process.env.ANTHROPIC_API_KEY ?? "");
+            ? (getRunnerSecret("OPENAI_API_KEY") ?? "")
+            : (getRunnerSecret("ANTHROPIC_API_KEY") ?? "");
+    // maxRetries applies when a timeout is bound (a retry loop under a bound
+    // multiplies the wall-clock budget) or when the caller pinned it
+    // explicitly (call-llm hands retry ownership to Temporal, #686). Callers
+    // that set neither keep LangChain's default retry behavior unchanged.
+    const maxRetries = timeoutMs !== undefined || opts.maxRetries !== undefined
+        ? { maxRetries: opts.maxRetries ?? 0 }
+        : {};
     const common = {
         temperature: opts.temperature ?? 0,
         apiKey,
         ...(maxTokens ? { maxTokens } : {}),
-        ...(timeoutMs ? { maxRetries: opts.maxRetries ?? 0 } : {}),
+        ...maxRetries,
     };
     // The request timeout lives in a different slot per wrapper: ChatOpenAI
     // reads `timeout` as a constructor field, but ChatAnthropic ignores it
@@ -168,6 +192,17 @@ export async function buildChatModel(opts) {
     const anthropicClientOptionsField = Object.keys(anthropicClientOptions).length > 0
         ? { clientOptions: anthropicClientOptions }
         : {};
+    // The tier rides the request body per provider dialect (#361): OpenAI
+    // takes `service_tier` as a first-class constructor field; ChatAnthropic
+    // has no such field, so it rides `invocationKwargs`, which the wrapper
+    // spreads into every request body. Both spellings resolve through the
+    // shared mapping so no construction site can invent a third one.
+    const openAiServiceTierField = opts.serviceTier !== undefined
+        ? { service_tier: toOpenAiServiceTier(opts.serviceTier) }
+        : {};
+    const anthropicServiceTierField = opts.serviceTier !== undefined
+        ? { invocationKwargs: { service_tier: toAnthropicServiceTier(opts.serviceTier) } }
+        : {};
     // The two SDKs name the transport-override block differently (OpenAI:
     // `configuration`, Anthropic: `clientOptions`) — encapsulating that here is
     // the whole point, since the shape mismatch is where bugs used to hide.
@@ -175,6 +210,7 @@ export async function buildChatModel(opts) {
         ? new ChatOpenAI({
             model: apiModelId,
             ...common,
+            ...openAiServiceTierField,
             ...(timeoutMs ? { timeout: timeoutMs } : {}),
             ...(baseUrl || headers
                 ? {
@@ -192,6 +228,13 @@ export async function buildChatModel(opts) {
                 // provided) is what lets this construct with no ANTHROPIC_API_KEY.
                 // (Backend mode never has a proxy — see the precedence rule above —
                 // so the clientOptions here carry at most the timeout.)
+                //
+                // service_tier deliberately does NOT ride backend requests:
+                // standard/priority tiers are an Anthropic-FIRST-PARTY billing
+                // concept, and Vertex/Bedrock/Foundry bill through the cloud
+                // provider with no tier dimension — an unknown body param there is
+                // a request refusal waiting to happen. The account-default price
+                // hole this parameter closes does not exist on those backends.
                 new ChatAnthropic({
                     model: wireModelId,
                     ...common,
@@ -201,6 +244,7 @@ export async function buildChatModel(opts) {
             : new ChatAnthropic({
                 model: apiModelId,
                 ...common,
+                ...anthropicServiceTierField,
                 ...anthropicClientOptionsField,
             });
     return { model, provider, apiModelId };

package/dist/shared/model-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"model-client.js","sourceRoot":"","sources":["../../src/shared/model-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAG/C,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,GAElB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAgC1D;;;;;GAKG;AACH,SAAS,uBAAuB;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACrF,OAAO,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACzC,CAAC;AAeD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAA2B;IAC9D,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,uBAAuB,EAAE,CAAC;IAE9D,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,gBAAgB,GACpB,QAAQ,KAAK,WAAW,IAAI,CAAC,IAAI,CAAC,aAAa;QAC7C,CAAC,CAAC,uBAAuB,EAAE;QAC3B,CAAC,CAAC,QAAQ,CAAC;IAEf,0EAA0E;IAC1E,kEAAkE;IAClE,sEAAsE;IACtE,yDAAyD;IACzD,6DAA6D;IAC7D,yEAAyE;IACzE,sCAAsC;IACtC,EAAE;IACF,kEAAkE;IAClE,0EAA0E;IAC1E,qEAAqE;IACrE,0EAA0E;IAC1E,uEAAuE;IACvE,yDAAyD;IACzD,qEAAqE;IACrE,wDAAwD;IACxD,qEAAqE;IACrE,yEAAyE;IACzE,qEAAqE;IACrE,sEAAsE;IACtE,4DAA4D;IAC5D,uEAAuE;IACvE,WAAW;IACX,IAAI,mBAES,CAAC;IACd,IAAI,WAAW,GAAG,UAAU,CAAC;IAC7B,IAAI,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAC/B,IAAI,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;QAC1C,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACrE,mBAAmB,GAAG,CAAC,OAAO,EAAE,EAAE,CAChC,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,WAAW,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;SAAM,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,yBAAyB,EAAE,CAAC;QAC3C,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;QACvE,mBAAmB,GAAG,CAAC,OAAO,EAAE,EAAE,CAChC,IAAI,gBAAgB,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACrF,WAAW,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,iEAAiE;YACjE,oEAAoE;YACpE,mEAAmE;YACnE,+DAA+D;YAC/D,oEAAoE;YACpE,qEAAqE;YACrE,iEAAiE;YACjE,8DAA8D;YAC9D,kEAAkE;YAClE,SAAS,GAAG,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7F,CAAC;IACH,CAAC;SAAM,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,yBAAyB,EAAE,CAAC;QAC3C,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,sEAAsE;QACtE,oEAAoE;QACpE,wEAAwE;QACxE,6DAA6D;QAC7D,qEAAqE;QACrE,sDAAsD;QACtD,IAAI,oBAAyD,CAAC;QAC9D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,EAAE,CAAC;YACnD,MAAM,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC3F,oBAAoB,GAAG,sBAAsB,CAC3C,IAAI,sBAAsB,EAAE,EAC5B,+BAA+B,CAChC,CAAC;QACJ,CAAC;QACD,mBAAmB,GAAG,CAAC,OAAO,EAAE,EAAE,CAChC,IAAI,gBAAgB,CAAC;YACnB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC,CAAC;QACL,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,2CAA2C;QAC3C,WAAW,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa;QAChC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC;QACnD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,YAAY;QACrD,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC;IAEd,6EAA6E;IAC7E,kCAAkC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa;QAC/B,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,eAAe,CAAC;QACxC,CAAC,CAAC,QAAQ,KAAK,QAAQ;YACrB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;YACpC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG;QACb,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC;QAClC,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC;IAEF,wEAAwE;IACxE,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,kEAAkE;IAClE,oCAAoC;IACpC,MAAM,sBAAsB,GAAG;QAC7B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;IACF,MAAM,2BAA2B,GAC/B,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,MAAM,GAAG,CAAC;QAC5C,CAAC,CAAC,EAAE,aAAa,EAAE,sBAAsB,EAAE;QAC3C,CAAC,CAAC,EAAE,CAAC;IAET,sEAAsE;IACtE,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,KAAK,GAAkB,QAAQ,KAAK,QAAQ;QAChD,CAAC,CAAC,IAAI,UAAU,CAAC;YACb,KAAK,EAAE,UAAU;YACjB,GAAG,MAAM;YACT,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,OAAO,IAAI,OAAO;gBACpB,CAAC,CAAC;oBACE,aAAa,EAAE;wBACb,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACxC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAChD;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACJ,CAAC,CAAC,mBAAmB;YACnB,CAAC,CAAC,gEAAgE;gBAChE,mEAAmE;gBACnE,oEAAoE;gBACpE,mEAAmE;gBACnE,oEAAoE;gBACpE,wDAAwD;gBACxD,IAAI,aAAa,CAAC;oBAChB,KAAK,EAAE,WAAW;oBAClB,GAAG,MAAM;oBACT,GAAG,2BAA2B;oBAC9B,YAAY,EAAE,mBAAmB;iBAClC,CAAC;YACJ,CAAC,CAAC,IAAI,aAAa,CAAC;gBAChB,KAAK,EAAE,UAAU;gBACjB,GAAG,MAAM;gBACT,GAAG,2BAA2B;aAC/B,CAAC,CAAC;IAET,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC"}
+{"version":3,"file":"model-client.js","sourceRoot":"","sources":["../../src/shared/model-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAG/C,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,GAElB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AA8C/D;;;;;GAKG;AACH,SAAS,uBAAuB;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACrF,OAAO,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACzC,CAAC;AAeD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAA2B;IAC9D,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,uBAAuB,EAAE,CAAC;IAE9D,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,gBAAgB,GACpB,QAAQ,KAAK,WAAW,IAAI,CAAC,IAAI,CAAC,aAAa;QAC7C,CAAC,CAAC,uBAAuB,EAAE;QAC3B,CAAC,CAAC,QAAQ,CAAC;IAEf,0EAA0E;IAC1E,kEAAkE;IAClE,sEAAsE;IACtE,yDAAyD;IACzD,6DAA6D;IAC7D,yEAAyE;IACzE,sCAAsC;IACtC,EAAE;IACF,kEAAkE;IAClE,0EAA0E;IAC1E,qEAAqE;IACrE,0EAA0E;IAC1E,uEAAuE;IACvE,yDAAyD;IACzD,qEAAqE;IACrE,wDAAwD;IACxD,qEAAqE;IACrE,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,qEAAqE;IACrE,uEAAuE;IACvE,iEAAiE;IACjE,IAAI,mBAES,CAAC;IACd,IAAI,WAAW,GAAG,UAAU,CAAC;IAC7B,IAAI,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAC/B,IAAI,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;QAC1C,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACrE,mBAAmB,GAAG,CAAC,OAAO,EAAE,EAAE,CAChC,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,WAAW,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;SAAM,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,yBAAyB,EAAE,CAAC;QAC3C,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;QACvE,8EAA8E;QAC9E,uEAAuE;QACvE,yEAAyE;QACzE,mEAAmE;QACnE,MAAM,kBAAkB,GAAG,eAAe,CAAC,0BAA0B,CAAC,CAAC;QACvE,mBAAmB,GAAG,CAAC,OAAO,EAAE,EAAE,CAChC,IAAI,gBAAgB,CAAC;YACnB,MAAM,EAAE,kBAAkB;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QACL,WAAW,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,iEAAiE;YACjE,oEAAoE;YACpE,mEAAmE;YACnE,+DAA+D;YAC/D,oEAAoE;YACpE,qEAAqE;YACrE,iEAAiE;YACjE,8DAA8D;YAC9D,kEAAkE;YAClE,SAAS,GAAG,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7F,CAAC;IACH,CAAC;SAAM,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,yBAAyB,EAAE,CAAC;QAC3C,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,sEAAsE;QACtE,oEAAoE;QACpE,wEAAwE;QACxE,6DAA6D;QAC7D,qEAAqE;QACrE,sDAAsD;QACtD,+EAA+E;QAC/E,wEAAwE;QACxE,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,aAAa,GAAG,eAAe,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QACxF,IAAI,oBAAyD,CAAC;QAC9D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC3F,oBAAoB,GAAG,sBAAsB,CAC3C,IAAI,sBAAsB,EAAE,EAC5B,+BAA+B,CAChC,CAAC;QACJ,CAAC;QACD,mBAAmB,GAAG,CAAC,OAAO,EAAE,EAAE,CAChC,IAAI,gBAAgB,CAAC;YACnB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC;SAC1E,CAAC,CAAC;QACL,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,2CAA2C;QAC3C,WAAW,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa;QAChC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC;QACnD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,YAAY;QACrD,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC;IAEd,0EAA0E;IAC1E,0EAA0E;IAC1E,8CAA8C;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa;QAC/B,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,eAAe,CAAC;QACxC,CAAC,CAAC,QAAQ,KAAK,QAAQ;YACrB,CAAC,CAAC,CAAC,eAAe,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;YAC3C,CAAC,CAAC,CAAC,eAAe,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;IAEnD,yEAAyE;IACzE,iEAAiE;IACjE,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,UAAU,GAAG,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;QACzE,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE;QACtC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,MAAM,GAAG;QACb,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC;QAClC,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,UAAU;KACd,CAAC;IAEF,wEAAwE;IACxE,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,kEAAkE;IAClE,oCAAoC;IACpC,MAAM,sBAAsB,GAAG;QAC7B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;IACF,MAAM,2BAA2B,GAC/B,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,MAAM,GAAG,CAAC;QAC5C,CAAC,CAAC,EAAE,aAAa,EAAE,sBAAsB,EAAE;QAC3C,CAAC,CAAC,EAAE,CAAC;IAET,sEAAsE;IACtE,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,iEAAiE;IACjE,MAAM,sBAAsB,GAAG,IAAI,CAAC,WAAW,KAAK,SAAS;QAC3D,CAAC,CAAC,EAAE,YAAY,EAAE,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE;QACzD,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,yBAAyB,GAAG,IAAI,CAAC,WAAW,KAAK,SAAS;QAC9D,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,YAAY,EAAE,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;QAClF,CAAC,CAAC,EAAE,CAAC;IAEP,sEAAsE;IACtE,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,KAAK,GAAkB,QAAQ,KAAK,QAAQ;QAChD,CAAC,CAAC,IAAI,UAAU,CAAC;YACb,KAAK,EAAE,UAAU;YACjB,GAAG,MAAM;YACT,GAAG,sBAAsB;YACzB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,OAAO,IAAI,OAAO;gBACpB,CAAC,CAAC;oBACE,aAAa,EAAE;wBACb,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACxC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAChD;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACJ,CAAC,CAAC,mBAAmB;YACnB,CAAC,CAAC,gEAAgE;gBAChE,mEAAmE;gBACnE,oEAAoE;gBACpE,mEAAmE;gBACnE,oEAAoE;gBACpE,wDAAwD;gBACxD,EAAE;gBACF,4DAA4D;gBAC5D,+DAA+D;gBAC/D,6DAA6D;gBAC7D,mEAAmE;gBACnE,iEAAiE;gBACjE,+DAA+D;gBAC/D,IAAI,aAAa,CAAC;oBAChB,KAAK,EAAE,WAAW;oBAClB,GAAG,MAAM;oBACT,GAAG,2BAA2B;oBAC9B,YAAY,EAAE,mBAAmB;iBAClC,CAAC;YACJ,CAAC,CAAC,IAAI,aAAa,CAAC;gBAChB,KAAK,EAAE,UAAU;gBACjB,GAAG,MAAM;gBACT,GAAG,yBAAyB;gBAC5B,GAAG,2BAA2B;aAC/B,CAAC,CAAC;IAET,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC"}

package/dist/shared/registry-endpoint.d.ts

@@ -46,6 +46,11 @@ export declare function resolveRegistryBaseUrl(env?: NodeJS.ProcessEnv): string;
 /**
  * Build request headers for registry fetches: bearer auth when a token is
  * present (cloud requires it; the local server ignores it).
+ *
+ * The default env is the credential-store view, not bare `process.env`:
+ * both token names are captured out of the environment at boot (#508), and
+ * the store also carries rotated tokens (manager updateToken / static
+ * renewal) that never touch env at all.
  */
 export declare function buildRegistryHeaders(env?: NodeJS.ProcessEnv): Record<string, string>;
 /** Full URL of the model registry endpoint for the resolved control plane. */

package/dist/shared/registry-endpoint.js

@@ -19,6 +19,7 @@
  * API would only mask misconfiguration (and breaks offline/local use).
  */
 import { normalizeEndpoint } from "../config.js";
+import { runnerSecretsEnvView } from "./runner-credential-store.js";
 /** Default local stigmer-server origin — mirrors config.ts's local-mode default. */
 const DEFAULT_LOCAL_BACKEND = "http://localhost:7234";
 /**
@@ -62,8 +63,13 @@ export function resolveRegistryBaseUrl(env = process.env) {
 /**
  * Build request headers for registry fetches: bearer auth when a token is
  * present (cloud requires it; the local server ignores it).
+ *
+ * The default env is the credential-store view, not bare `process.env`:
+ * both token names are captured out of the environment at boot (#508), and
+ * the store also carries rotated tokens (manager updateToken / static
+ * renewal) that never touch env at all.
  */
-export function buildRegistryHeaders(env = process.env) {
+export function buildRegistryHeaders(env = runnerSecretsEnvView()) {
     const token = env.STIGMER_TOKEN ?? env.STIGMER_AUTH_TOKEN;
     return token ? { Authorization: `Bearer ${token}` } : {};
 }

package/dist/shared/registry-endpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry-endpoint.js","sourceRoot":"","sources":["../../src/shared/registry-endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGjD,oFAAoF;AACpF,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAEtD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAqB;IACrD,KAAK,EAAE,mBAAmB;IAC1B,WAAW,EAAE,GAAG;IAChB,aAAa,EAAE,CAAC;IAChB,UAAU,EAAE,CAAC;IACb,gBAAgB,EAAE,MAAM;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzE,MAAM,QAAQ,GAAG,GAAG,CAAC,qBAAqB,CAAC;IAC3C,IAAI,QAAQ;QAAE,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAEjD,MAAM,aAAa,GAAG,GAAG,CAAC,sBAAsB,CAAC;IACjD,IAAI,aAAa;QAAE,OAAO,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAE3D,OAAO,iBAAiB,CAAC,GAAG,CAAC,wBAAwB,IAAI,qBAAqB,CAAC,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACvE,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,kBAAkB,CAAC;IAC1D,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,0BAA0B,CAAC;AAClE,CAAC"}
+{"version":3,"file":"registry-endpoint.js","sourceRoot":"","sources":["../../src/shared/registry-endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE,oFAAoF;AACpF,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAEtD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAqB;IACrD,KAAK,EAAE,mBAAmB;IAC1B,WAAW,EAAE,GAAG;IAChB,aAAa,EAAE,CAAC;IAChB,UAAU,EAAE,CAAC;IACb,gBAAgB,EAAE,MAAM;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzE,MAAM,QAAQ,GAAG,GAAG,CAAC,qBAAqB,CAAC;IAC3C,IAAI,QAAQ;QAAE,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAEjD,MAAM,aAAa,GAAG,GAAG,CAAC,sBAAsB,CAAC;IACjD,IAAI,aAAa;QAAE,OAAO,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAE3D,OAAO,iBAAiB,CAAC,GAAG,CAAC,wBAAwB,IAAI,qBAAqB,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAyB,oBAAoB,EAAE;IAE/C,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,kBAAkB,CAAC;IAC1D,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,0BAA0B,CAAC;AAClE,CAAC"}

package/dist/shared/runner-credential-keys.d.ts

@@ -10,7 +10,13 @@
  * their sanctioned delivery channel, and denying them here would break it.
  *
  * Consumers:
- * - shell-env.ts: SHELL_ENV_DENYLIST for the native harness `execute` tool.
+ * - runner-credential-store.ts: captures every name listed in this module
+ *   out of `process.env` at boot (issue #508 — the Cursor SDK's local agent
+ *   runtime runs in-process and its shell tool spawns from the runner's own
+ *   env, so credentials must not LIVE there; see that module for custody
+ *   rules).
+ * - shell-env.ts: SHELL_ENV_DENYLIST for the native harness `execute` tool
+ *   (defense-in-depth behind the boot scrub).
  * - mcp-manager.test.ts: leak-tripwire canaries for MCP stdio subprocesses
  *   (that path passes NO runner env by construction; the test plants these
  *   names to prove none leak through).
@@ -22,3 +28,22 @@
  * credential files off disk regardless (owner ruling on #385).
  */
 export declare const RUNNER_CREDENTIAL_ENV_KEYS: readonly string[];
+/**
+ * Env var names of the runner's non-credential secrets — material that is
+ * not an outbound-call credential (so it does not belong in
+ * {@link RUNNER_CREDENTIAL_ENV_KEYS}, whose inclusion rule is pinned above)
+ * but is every bit as sensitive in an agent-readable environment
+ * (owner ruling on #508: same boot scrub, separate constant so the #385
+ * rule keeps its meaning).
+ *
+ * The `*_KEY_ID` companions are deliberately absent: key identifiers are
+ * rotation bookkeeping, not secrets.
+ */
+export declare const RUNNER_ENCRYPTION_ENV_KEYS: readonly string[];
+/**
+ * Every env name whose VALUE the credential store takes custody of at boot:
+ * the #385 credential set plus the #508 encryption-key set. This is the
+ * scrub list — after `captureRunnerSecrets()`, none of these names remain
+ * in `process.env`.
+ */
+export declare const RUNNER_SECRET_ENV_KEYS: readonly string[];

package/dist/shared/runner-credential-keys.js

@@ -10,7 +10,13 @@
  * their sanctioned delivery channel, and denying them here would break it.
  *
  * Consumers:
- * - shell-env.ts: SHELL_ENV_DENYLIST for the native harness `execute` tool.
+ * - runner-credential-store.ts: captures every name listed in this module
+ *   out of `process.env` at boot (issue #508 — the Cursor SDK's local agent
+ *   runtime runs in-process and its shell tool spawns from the runner's own
+ *   env, so credentials must not LIVE there; see that module for custody
+ *   rules).
+ * - shell-env.ts: SHELL_ENV_DENYLIST for the native harness `execute` tool
+ *   (defense-in-depth behind the boot scrub).
  * - mcp-manager.test.ts: leak-tripwire canaries for MCP stdio subprocesses
  *   (that path passes NO runner env by construction; the test plants these
  *   names to prove none leak through).
@@ -44,4 +50,31 @@ export const RUNNER_CREDENTIAL_ENV_KEYS = [
     // (llm-backend.ts documents it as a supported auth path).
     "AWS_BEARER_TOKEN_BEDROCK",
 ];
+/**
+ * Env var names of the runner's non-credential secrets — material that is
+ * not an outbound-call credential (so it does not belong in
+ * {@link RUNNER_CREDENTIAL_ENV_KEYS}, whose inclusion rule is pinned above)
+ * but is every bit as sensitive in an agent-readable environment
+ * (owner ruling on #508: same boot scrub, separate constant so the #385
+ * rule keeps its meaning).
+ *
+ * The `*_KEY_ID` companions are deliberately absent: key identifiers are
+ * rotation bookkeeping, not secrets.
+ */
+export const RUNNER_ENCRYPTION_ENV_KEYS = [
+    // Temporal payload-encryption keys (encryption/config.ts). An agent that
+    // reads these could decrypt the runner's Temporal history payloads.
+    "STIGMER_PAYLOAD_ENCRYPTION_KEY",
+    "STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY",
+];
+/**
+ * Every env name whose VALUE the credential store takes custody of at boot:
+ * the #385 credential set plus the #508 encryption-key set. This is the
+ * scrub list — after `captureRunnerSecrets()`, none of these names remain
+ * in `process.env`.
+ */
+export const RUNNER_SECRET_ENV_KEYS = [
+    ...RUNNER_CREDENTIAL_ENV_KEYS,
+    ...RUNNER_ENCRYPTION_ENV_KEYS,
+];
 //# sourceMappingURL=runner-credential-keys.js.map

package/dist/shared/runner-credential-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"runner-credential-keys.js","sourceRoot":"","sources":["../../src/shared/runner-credential-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,wEAAwE;IACxE,iDAAiD;IACjD,4BAA4B;IAC5B,+DAA+D;IAC/D,sEAAsE;IACtE,eAAe;IACf,gEAAgE;IAChE,iDAAiD;IACjD,oBAAoB;IACpB,wEAAwE;IACxE,iCAAiC;IACjC,gBAAgB;IAChB,sEAAsE;IACtE,mBAAmB;IACnB,mEAAmE;IACnE,gBAAgB;IAChB,kDAAkD;IAClD,2BAA2B;IAC3B,iEAAiE;IACjE,0DAA0D;IAC1D,0BAA0B;CAC3B,CAAC"}
+{"version":3,"file":"runner-credential-keys.js","sourceRoot":"","sources":["../../src/shared/runner-credential-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,wEAAwE;IACxE,iDAAiD;IACjD,4BAA4B;IAC5B,+DAA+D;IAC/D,sEAAsE;IACtE,eAAe;IACf,gEAAgE;IAChE,iDAAiD;IACjD,oBAAoB;IACpB,wEAAwE;IACxE,iCAAiC;IACjC,gBAAgB;IAChB,sEAAsE;IACtE,mBAAmB;IACnB,mEAAmE;IACnE,gBAAgB;IAChB,kDAAkD;IAClD,2BAA2B;IAC3B,iEAAiE;IACjE,0DAA0D;IAC1D,0BAA0B;CAC3B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,yEAAyE;IACzE,oEAAoE;IACpE,gCAAgC;IAChC,0CAA0C;CAC3C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,GAAG,0BAA0B;IAC7B,GAAG,0BAA0B;CAC9B,CAAC"}

package/dist/shared/runner-credential-store.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Custody point for the runner's own secrets — the VALUES companion to
+ * runner-credential-keys.ts's names (issue #508).
+ *
+ * Why this exists: the Cursor SDK's local agent runtime ships inside
+ * `@cursor/sdk` and runs IN-PROCESS in the runner. Its shell tool spawns
+ * bash with `{...process.env, ...}` and its git layer does the same, so
+ * anything living in the runner's `process.env` is readable by every shell
+ * command the agent runs — and the SDK exposes no env option for local
+ * agents to scrub at the spawn boundary. Denylists on runner-owned spawn
+ * sites (shell-env.ts) cannot reach those vendor spawns. The only fix that
+ * covers every spawn surface, present and future, is for secrets not to
+ * LIVE in `process.env` at all: this module captures them at boot and is
+ * the sole holder afterwards.
+ *
+ * Custody rules:
+ *
+ *  1. `captureRunnerSecrets()` runs at every boot door (both public runner
+ *     factories, plus main() for symmetry) — it MOVES every
+ *     {@link RUNNER_SECRET_ENV_KEYS} value out of `process.env` into a
+ *     module-private map. Idempotent; first call wins.
+ *  2. Reads go through {@link getRunnerSecret}: captured value first, live
+ *     `process.env` as fallback. The fallback keeps the store honest rather
+ *     than frozen — production sets these vars only at process start (the
+ *     capture window), so the fallback is a dead path there, but tests and
+ *     unusual embedders that plant a value later see it behave exactly like
+ *     the env read it replaced.
+ *  3. Rotation writes go through {@link setRunnerSecret} (the
+ *     runner-manager/static-renewal token channel that previously wrote
+ *     `process.env.STIGMER_TOKEN` in lockstep with its tokenRef).
+ *  4. {@link runnerSecretsEnvView} adapts the store to the codebase's
+ *     `env: NodeJS.ProcessEnv` injection seams (llm-backend,
+ *     registry-endpoint). The view re-merges secrets over `process.env` —
+ *     it exists for in-process CONFIG READS ONLY and must never be handed
+ *     to a child process env or any spawn options.
+ *
+ * Embedder note: `@stigmer/runner` is a public library, and capture runs
+ * inside the factories, so embedding the runner scrubs the HOST process's
+ * env of runner secrets at boot. That is the point — agent shells run in
+ * the embedder's process — and host code that still needs a value reads it
+ * through this module.
+ */
+/**
+ * Move every {@link RUNNER_SECRET_ENV_KEYS} value out of `process.env` into
+ * the store. Idempotent — only the first call captures, so a late caller
+ * cannot re-freeze values that rotation has since replaced.
+ */
+export declare function captureRunnerSecrets(): void;
+/**
+ * Read a runner secret: captured value first, live `process.env` fallback
+ * (see custody rule 2). Returns `undefined` when the secret is absent —
+ * callers own their missing-secret reaction, exactly as with the env reads
+ * this replaces.
+ */
+export declare function getRunnerSecret(name: string): string | undefined;
+/**
+ * Write (or with `null`, clear) a runner secret — the rotation channel.
+ * Ensures capture has run first so a rotated value can never sit in
+ * `process.env` because a writer beat the boot capture.
+ */
+export declare function setRunnerSecret(name: string, value: string | null): void;
+/**
+ * `process.env` with the captured secrets merged back over it — an adapter
+ * for the `env: NodeJS.ProcessEnv` injection seams so their defaults stay
+ * secret-aware after the boot scrub.
+ *
+ * IN-PROCESS CONFIG READS ONLY: never pass this to a spawn/exec env, a
+ * worker thread, or anything else that leaves the process — doing so would
+ * reopen exactly the leak the store closes.
+ */
+export declare function runnerSecretsEnvView(): NodeJS.ProcessEnv;
+/**
+ * Test-only: forget everything captured and re-arm capture. Unit tests that
+ * plant secret env vars and boot pieces of the runner need each test to see
+ * its own values.
+ */
+export declare function resetRunnerSecretsForTests(): void;

package/dist/shared/runner-credential-store.js

@@ -0,0 +1,111 @@
+/**
+ * Custody point for the runner's own secrets — the VALUES companion to
+ * runner-credential-keys.ts's names (issue #508).
+ *
+ * Why this exists: the Cursor SDK's local agent runtime ships inside
+ * `@cursor/sdk` and runs IN-PROCESS in the runner. Its shell tool spawns
+ * bash with `{...process.env, ...}` and its git layer does the same, so
+ * anything living in the runner's `process.env` is readable by every shell
+ * command the agent runs — and the SDK exposes no env option for local
+ * agents to scrub at the spawn boundary. Denylists on runner-owned spawn
+ * sites (shell-env.ts) cannot reach those vendor spawns. The only fix that
+ * covers every spawn surface, present and future, is for secrets not to
+ * LIVE in `process.env` at all: this module captures them at boot and is
+ * the sole holder afterwards.
+ *
+ * Custody rules:
+ *
+ *  1. `captureRunnerSecrets()` runs at every boot door (both public runner
+ *     factories, plus main() for symmetry) — it MOVES every
+ *     {@link RUNNER_SECRET_ENV_KEYS} value out of `process.env` into a
+ *     module-private map. Idempotent; first call wins.
+ *  2. Reads go through {@link getRunnerSecret}: captured value first, live
+ *     `process.env` as fallback. The fallback keeps the store honest rather
+ *     than frozen — production sets these vars only at process start (the
+ *     capture window), so the fallback is a dead path there, but tests and
+ *     unusual embedders that plant a value later see it behave exactly like
+ *     the env read it replaced.
+ *  3. Rotation writes go through {@link setRunnerSecret} (the
+ *     runner-manager/static-renewal token channel that previously wrote
+ *     `process.env.STIGMER_TOKEN` in lockstep with its tokenRef).
+ *  4. {@link runnerSecretsEnvView} adapts the store to the codebase's
+ *     `env: NodeJS.ProcessEnv` injection seams (llm-backend,
+ *     registry-endpoint). The view re-merges secrets over `process.env` —
+ *     it exists for in-process CONFIG READS ONLY and must never be handed
+ *     to a child process env or any spawn options.
+ *
+ * Embedder note: `@stigmer/runner` is a public library, and capture runs
+ * inside the factories, so embedding the runner scrubs the HOST process's
+ * env of runner secrets at boot. That is the point — agent shells run in
+ * the embedder's process — and host code that still needs a value reads it
+ * through this module.
+ */
+import { RUNNER_SECRET_ENV_KEYS } from "./runner-credential-keys.js";
+const captured = new Map();
+let captureRan = false;
+/**
+ * Move every {@link RUNNER_SECRET_ENV_KEYS} value out of `process.env` into
+ * the store. Idempotent — only the first call captures, so a late caller
+ * cannot re-freeze values that rotation has since replaced.
+ */
+export function captureRunnerSecrets() {
+    if (captureRan)
+        return;
+    captureRan = true;
+    for (const name of RUNNER_SECRET_ENV_KEYS) {
+        const value = process.env[name];
+        if (value !== undefined) {
+            captured.set(name, value);
+            delete process.env[name];
+        }
+    }
+}
+/**
+ * Read a runner secret: captured value first, live `process.env` fallback
+ * (see custody rule 2). Returns `undefined` when the secret is absent —
+ * callers own their missing-secret reaction, exactly as with the env reads
+ * this replaces.
+ */
+export function getRunnerSecret(name) {
+    return captured.get(name) ?? process.env[name];
+}
+/**
+ * Write (or with `null`, clear) a runner secret — the rotation channel.
+ * Ensures capture has run first so a rotated value can never sit in
+ * `process.env` because a writer beat the boot capture.
+ */
+export function setRunnerSecret(name, value) {
+    captureRunnerSecrets();
+    if (value === null) {
+        captured.delete(name);
+    }
+    else {
+        captured.set(name, value);
+    }
+}
+/**
+ * `process.env` with the captured secrets merged back over it — an adapter
+ * for the `env: NodeJS.ProcessEnv` injection seams so their defaults stay
+ * secret-aware after the boot scrub.
+ *
+ * IN-PROCESS CONFIG READS ONLY: never pass this to a spawn/exec env, a
+ * worker thread, or anything else that leaves the process — doing so would
+ * reopen exactly the leak the store closes.
+ */
+export function runnerSecretsEnvView() {
+    const view = { ...process.env };
+    for (const [name, value] of captured) {
+        view[name] = value;
+    }
+    return view;
+}
+/**
+ * Test-only: forget everything captured and re-arm capture. Unit tests that
+ * plant secret env vars and boot pieces of the runner need each test to see
+ * its own values.
+ */
+export function resetRunnerSecretsForTests() {
+    captured.clear();
+    captureRan = false;
+}
+//# sourceMappingURL=runner-credential-store.js.map

package/dist/shared/runner-credential-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-credential-store.js","sourceRoot":"","sources":["../../src/shared/runner-credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;AAC3C,IAAI,UAAU,GAAG,KAAK,CAAC;AAEvB;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,IAAI,UAAU;QAAE,OAAO;IACvB,UAAU,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,sBAAsB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAoB;IAChE,oBAAoB,EAAE,CAAC;IACvB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,IAAI,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B;IACxC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACjB,UAAU,GAAG,KAAK,CAAC;AACrB,CAAC"}