@stigmer/runner 3.12.4 → 3.12.6

package/dist/shared/artifact-storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifact-storage.js","sourceRoot":"","sources":["../../src/shared/artifact-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGlC,OAAO,EAAE,cAAc,EAAyB,MAAM,iBAAiB,CAAC;AAgCxE,wEAAwE;AAExE,MAAM,OAAO,oBAAoB;IACtB,eAAe,GAAG,aAAsB,CAAC;IACjC,QAAQ,CAAS;IACjB,YAAY,CAAS;IAEtC,YAAY,QAAgB,EAAE,YAAoB;QAChD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,OAAe,EAAE,YAAqB;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,OAAO,GAAG,IAAI,CAAC,YAAY,IAAI,GAAG,EAAE,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,2EAA2E;QAC3E,4EAA4E;QAC5E,iEAAiE;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,mEAAmE;YACnE,yEAAyE;YACzE,2EAA2E;YAC3E,MAAM,IAAI,KAAK,CACb,+BAA+B,GAAG,gCAAgC,IAAI,CAAC,QAAQ,MAAM,MAAM,IAAI;gBAC/F,6FAA6F;gBAC7F,wCAAwC,CACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,iBAAiB,CAAC,GAAW;QACnC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,gBAAgB,GAAG,8CAA8C,CAClE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAiBD;;;;;;GAMG;AACH,MAAM,aAAa,GAAG;IACpB,WAAW,EAAE,GAAG;IAChB,aAAa,EAAE,CAAC;IAChB,UAAU,EAAE,CAAC;IACb,gBAAgB,EAAE,MAAM;IACxB,iBAAiB,EAAE,OAAO;CAClB,CAAC;AAEX,MAAM,OAAO,oBAAoB;IACtB,eAAe,GAAG,WAAoB,CAAC;IAC/B,OAAO,CAAS;IAChB,eAAe,CAAuB;IACvD,4DAA4D;IAC3C,aAAa,CAAmB;IACjD,sEAAsE;IACrD,cAAc,CAAmB;IAElD,YACE,aAAqB,EACrB,SAA+B,EAC/B,UAAuC,EAAE;QAEzC,IAAI,CAAC,OAAO,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC;QACzE,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QACjC,MAAM,MAAM,GAAG;YACb,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,aAAa,CAAC,WAAW;YAC7D,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,aAAa,CAAC,aAAa;YACnE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,aAAa,CAAC,UAAU;YAC1D,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;QACF,IAAI,CAAC,aAAa,GAAG;YACnB,GAAG,MAAM;YACT,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,aAAa,CAAC,gBAAgB;SAC7E,CAAC;QACF,IAAI,CAAC,cAAc,GAAG;YACpB,GAAG,MAAM;YACT,gBAAgB,EAAE,OAAO,CAAC,iBAAiB,IAAI,aAAa,CAAC,iBAAiB;SAC/E,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,IAAY,SAAS;QACnB,OAAO,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ;YAC7C,CAAC,CAAC,IAAI,CAAC,eAAe;YACtB,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,OAAe,EAAE,WAAoB;QAC7D,MAAM,EAAE,GAAG,WAAW,IAAI,0BAA0B,CAAC;QAErD,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,GAAG,IAAI,CAAC,OAAO,uBAAuB,EAAE;YAC/E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE;gBAC3C,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;SAChD,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,4CAA4C,WAAW,CAAC,MAAM,KAAK;gBACnE,MAAM,WAAW,CAAC,IAAI,EAAE,CACzB,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAuD,CAAC;QAE3F,yEAAyE;QACzE,4EAA4E;QAC5E,6EAA6E;QAC7E,0DAA0D;QAC1D,yEAAyE;QACzE,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QACzC,MAAM,aAAa,GAA2B,EAAE,CAAC;QACjD,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1D,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM;gBAAE,SAAS;YAC5C,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,cAAc;gBAAE,iBAAiB,GAAG,IAAI,CAAC;YACpE,aAAa,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC9B,CAAC;QACD,2EAA2E;QAC3E,4EAA4E;QAC5E,kCAAkC;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,aAAa,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;QACrC,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE;YAC7C,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,aAAa;YACtB,IAAI,EAAE,OAAO;SACd,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,iCAAiC,OAAO,CAAC,MAAM,KAAK;gBACpD,MAAM,OAAO,CAAC,IAAI,EAAE,CACrB,CAAC;QACJ,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,IAAI,CAAC,OAAO,yBAAyB,EAAE;YAC1E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE;gBAC3C,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC;SAC9B,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,8CAA8C,IAAI,CAAC,MAAM,KAAK;gBAC9D,MAAM,IAAI,CAAC,IAAI,EAAE,CAClB,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAqB,CAAC;QAClD,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,kCAAkC,IAAI,CAAC,MAAM,cAAc,GAAG,KAAK;gBACnE,MAAM,IAAI,CAAC,IAAI,EAAE,CAClB,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,8EAA8E;QAC9E,6EAA6E;QAC7E,+EAA+E;QAC/E,yEAAyE;QACzE,uEAAuE;QACvE,4EAA4E;QAC5E,4EAA4E;QAC5E,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,kEAAkE;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAC/B,GAAG,EACH,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EACnC,IAAI,CAAC,aAAa,CACnB,CAAC;QACF,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,0BAA0B;QAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACnF,8EAA8E;QAC9E,uEAAuE;QACvE,MAAM,IAAI,KAAK,CACb,yCAAyC,IAAI,CAAC,MAAM,cAAc,GAAG,GAAG,CACzE,CAAC;IACJ,CAAC;CACF;AAkBD;;;;;;;GAOG;AACH,SAAS,wBAAwB;IAC/B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,OAAO,IAAI;QACT,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC;QAC7C,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACtD,4EAA4E;IAC5E,+EAA+E;IAC/E,wEAAwE;IACxE,0EAA0E;IAC1E,qCAAqC;IACrC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAClD,MAAM,IAAI,GACR,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC/B,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAE3C,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,wBAAwB,EAAE;QACxE,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,uBAAuB;QAC9E,aAAa,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACvE,sEAAsE;QACtE,yDAAyD;QACzD,cAAc,EAAE,IAAI,KAAK,OAAO;YAC9B,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC;YACzD,CAAC,CAAC,IAAI;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAA0B;IAC9D,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ;YACxD,CAAC,CAAC,GAAG,CAAC,cAAc;YACpB,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC;QAChC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,IAAI,oBAAoB,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,cAAe,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,IAAI,oBAAoB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,gBAAgB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC/B,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAA0B,EAC1B,GAA4B;IAE5B,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,0EAA0E;YAC1E,kDAAkD,GAAG,CAAC,WAAW,IAAI;YACrE,QAAQ,GAAG,CAAC,IAAI,WAAW,GAAG,EAAE,CACjC,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,IAAI,CACV,4EAA4E;YAC5E,6EAA6E;YAC7E,wBAAwB,GAAG,CAAC,WAAW,UAAU,GAAG,CAAC,SAAS,IAAI;YAClE,mFAAmF;YACnF,iEAAiE,CAClE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"artifact-storage.js","sourceRoot":"","sources":["../../src/shared/artifact-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGlC,OAAO,EAAE,cAAc,EAAyB,MAAM,iBAAiB,CAAC;AA0CxE,wEAAwE;AAExE,MAAM,OAAO,oBAAoB;IACtB,eAAe,GAAG,aAAsB,CAAC;IACjC,QAAQ,CAAS;IACjB,YAAY,CAAS;IAEtC,YAAY,QAAgB,EAAE,YAAoB;QAChD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,OAAe,EAAE,YAAqB;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,OAAO,GAAG,IAAI,CAAC,YAAY,IAAI,GAAG,EAAE,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,2EAA2E;QAC3E,4EAA4E;QAC5E,iEAAiE;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,mEAAmE;YACnE,yEAAyE;YACzE,2EAA2E;YAC3E,MAAM,IAAI,KAAK,CACb,+BAA+B,GAAG,gCAAgC,IAAI,CAAC,QAAQ,MAAM,MAAM,IAAI;gBAC/F,6FAA6F;gBAC7F,wCAAwC,CACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,iBAAiB,CAAC,GAAW;QACnC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,gBAAgB,GAAG,8CAA8C,CAClE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAiBD;;;;;;GAMG;AACH,MAAM,aAAa,GAAG;IACpB,WAAW,EAAE,GAAG;IAChB,aAAa,EAAE,CAAC;IAChB,UAAU,EAAE,CAAC;IACb,gBAAgB,EAAE,MAAM;IACxB,iBAAiB,EAAE,OAAO;CAClB,CAAC;AAEX,MAAM,OAAO,oBAAoB;IACtB,eAAe,GAAG,WAAoB,CAAC;IAC/B,OAAO,CAAS;IAChB,eAAe,CAAuB;IACvD,4DAA4D;IAC3C,aAAa,CAAmB;IACjD,sEAAsE;IACrD,cAAc,CAAmB;IAElD,YACE,aAAqB,EACrB,SAA+B,EAC/B,UAAuC,EAAE;QAEzC,IAAI,CAAC,OAAO,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC;QACzE,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QACjC,MAAM,MAAM,GAAG;YACb,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,aAAa,CAAC,WAAW;YAC7D,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,aAAa,CAAC,aAAa;YACnE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,aAAa,CAAC,UAAU;YAC1D,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;QACF,IAAI,CAAC,aAAa,GAAG;YACnB,GAAG,MAAM;YACT,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,aAAa,CAAC,gBAAgB;SAC7E,CAAC;QACF,IAAI,CAAC,cAAc,GAAG;YACpB,GAAG,MAAM;YACT,gBAAgB,EAAE,OAAO,CAAC,iBAAiB,IAAI,aAAa,CAAC,iBAAiB;SAC/E,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,IAAY,SAAS;QACnB,OAAO,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ;YAC7C,CAAC,CAAC,IAAI,CAAC,eAAe;YACtB,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,OAAe,EAAE,WAAoB;QAC7D,MAAM,EAAE,GAAG,WAAW,IAAI,0BAA0B,CAAC;QAErD,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,GAAG,IAAI,CAAC,OAAO,uBAAuB,EAAE;YAC/E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE;gBAC3C,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;SAChD,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,4CAA4C,WAAW,CAAC,MAAM,KAAK;gBACnE,MAAM,WAAW,CAAC,IAAI,EAAE,CACzB,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAuD,CAAC;QAE3F,yEAAyE;QACzE,4EAA4E;QAC5E,6EAA6E;QAC7E,0DAA0D;QAC1D,yEAAyE;QACzE,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QACzC,MAAM,aAAa,GAA2B,EAAE,CAAC;QACjD,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1D,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM;gBAAE,SAAS;YAC5C,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,cAAc;gBAAE,iBAAiB,GAAG,IAAI,CAAC;YACpE,aAAa,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC9B,CAAC;QACD,2EAA2E;QAC3E,4EAA4E;QAC5E,kCAAkC;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,aAAa,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;QACrC,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE;YAC7C,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,aAAa;YACtB,IAAI,EAAE,OAAO;SACd,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,iCAAiC,OAAO,CAAC,MAAM,KAAK;gBACpD,MAAM,OAAO,CAAC,IAAI,EAAE,CACrB,CAAC;QACJ,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,IAAI,CAAC,OAAO,yBAAyB,EAAE;YAC1E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE;gBAC3C,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC;SAC9B,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,8CAA8C,IAAI,CAAC,MAAM,KAAK;gBAC9D,MAAM,IAAI,CAAC,IAAI,EAAE,CAClB,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAqB,CAAC;QAClD,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,kCAAkC,IAAI,CAAC,MAAM,cAAc,GAAG,KAAK;gBACnE,MAAM,IAAI,CAAC,IAAI,EAAE,CAClB,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,8EAA8E;QAC9E,6EAA6E;QAC7E,+EAA+E;QAC/E,yEAAyE;QACzE,uEAAuE;QACvE,4EAA4E;QAC5E,4EAA4E;QAC5E,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,kEAAkE;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAC/B,GAAG,EACH,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EACnC,IAAI,CAAC,aAAa,CACnB,CAAC;QACF,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,0BAA0B;QAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACnF,8EAA8E;QAC9E,uEAAuE;QACvE,MAAM,IAAI,KAAK,CACb,yCAAyC,IAAI,CAAC,MAAM,cAAc,GAAG,GAAG,CACzE,CAAC;IACJ,CAAC;CACF;AAkBD;;;;;;;GAOG;AACH,SAAS,wBAAwB;IAC/B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,OAAO,IAAI;QACT,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC;QAC7C,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACtD,4EAA4E;IAC5E,+EAA+E;IAC/E,wEAAwE;IACxE,0EAA0E;IAC1E,qCAAqC;IACrC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAClD,MAAM,IAAI,GACR,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC/B,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC7B,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAE3C,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,wBAAwB,EAAE;QACxE,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,uBAAuB;QAC9E,aAAa,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACvE,sEAAsE;QACtE,yDAAyD;QACzD,cAAc,EAAE,IAAI,KAAK,OAAO;YAC9B,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC;YACzD,CAAC,CAAC,IAAI;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAA0B;IAC9D,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACxB,qEAAqE;QACrE,qEAAqE;QACrE,mEAAmE;QACnE,gEAAgE;QAChE,8BAA8B;QAC9B,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ;YACxD,CAAC,CAAC,GAAG,CAAC,cAAc;YACpB,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC;QAChC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,IAAI,oBAAoB,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,cAAe,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,IAAI,oBAAoB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,gBAAgB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC/B,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAA0B,EAC1B,GAA4B;IAE5B,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,0EAA0E;YAC1E,kDAAkD,GAAG,CAAC,WAAW,IAAI;YACrE,QAAQ,GAAG,CAAC,IAAI,WAAW,GAAG,EAAE,CACjC,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,IAAI,CACV,4EAA4E;YAC5E,6EAA6E;YAC7E,wBAAwB,GAAG,CAAC,WAAW,UAAU,GAAG,CAAC,SAAS,IAAI;YAClE,mFAAmF;YACnF,iEAAiE,CAClE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/shared/caller-identity.d.ts

@@ -50,15 +50,18 @@ export declare const STIGMER_USER_KIND = "stigmer_user";
 export declare const ANONYMOUS_KIND = "anonymous";
 /**
  * Audit-actor id that backends stamp when NO caller identity exists —
- * the OSS server writes it on every create (no local auth), and the
- * cloud's AuditActorBuilder falls back to it for caller-less internal
- * writes. It names "nobody in particular": unrelated sessions from
- * unrelated people all carry it, so presenting it as a caller identity
- * would make the one string a grantable value that silently covers ALL
- * such traffic in an MCP server's binding sheet. A creator matching this
+ * the OSS server writes it on every create unless the deployment
+ * configured an operator identity (STIGMER_OPERATOR_EMAIL,
+ * stigmer/stigmer#400; a configured install stamps a real actor whose
+ * email resolves below like any other), and the cloud's
+ * AuditActorBuilder falls back to it for caller-less internal writes.
+ * It names "nobody in particular": unrelated sessions from unrelated
+ * people all carry it, so presenting it as a caller identity would make
+ * the one string a grantable value that silently covers ALL such
+ * traffic in an MCP server's binding sheet. A creator matching this
  * sentinel (and carrying no email) is therefore unresolvable and falls
  * to anonymous — the deny-by-default the docs guide already promises
- * for self-hosted backends.
+ * for unconfigured self-hosted backends.
  */
 export declare const SYSTEM_CREATOR_SENTINEL = "system";
 /** The resolved caller identity. */

package/dist/shared/caller-identity.js

@@ -51,15 +51,18 @@ export const STIGMER_USER_KIND = "stigmer_user";
 export const ANONYMOUS_KIND = "anonymous";
 /**
  * Audit-actor id that backends stamp when NO caller identity exists —
- * the OSS server writes it on every create (no local auth), and the
- * cloud's AuditActorBuilder falls back to it for caller-less internal
- * writes. It names "nobody in particular": unrelated sessions from
- * unrelated people all carry it, so presenting it as a caller identity
- * would make the one string a grantable value that silently covers ALL
- * such traffic in an MCP server's binding sheet. A creator matching this
+ * the OSS server writes it on every create unless the deployment
+ * configured an operator identity (STIGMER_OPERATOR_EMAIL,
+ * stigmer/stigmer#400; a configured install stamps a real actor whose
+ * email resolves below like any other), and the cloud's
+ * AuditActorBuilder falls back to it for caller-less internal writes.
+ * It names "nobody in particular": unrelated sessions from unrelated
+ * people all carry it, so presenting it as a caller identity would make
+ * the one string a grantable value that silently covers ALL such
+ * traffic in an MCP server's binding sheet. A creator matching this
  * sentinel (and carrying no email) is therefore unresolvable and falls
  * to anonymous — the deny-by-default the docs guide already promises
- * for self-hosted backends.
+ * for unconfigured self-hosted backends.
  */
 export const SYSTEM_CREATOR_SENTINEL = "system";
 /** The identity injected when no session context exists (discovery). */

package/dist/shared/caller-identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"caller-identity.js","sourceRoot":"","sources":["../../src/shared/caller-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,mDAAmD;AACnD,MAAM,CAAC,MAAM,4BAA4B,GAAG,8BAA8B,CAAC;AAE3E,8CAA8C;AAC9C,MAAM,CAAC,MAAM,6BAA6B,GAAG,+BAA+B,CAAC;AAE7E,mEAAmE;AACnE,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC;AAchD,wEAAwE;AACxE,MAAM,UAAU,uBAAuB;IACrC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,eAAmD,EACnD,OAA6B;IAE7B,MAAM,MAAM,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACrC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,EAAE,KAAK,uBAAuB,EAAE,CAAC;QACnC,+DAA+D;QAC/D,uEAAuE;QACvE,OAAO,CAAC,IAAI,CACV,2BAA2B,uBAAuB,sBAAsB;YACxE,oEAAoE;YACpE,gCAAgC,CACjC,CAAC;QACF,OAAO,uBAAuB,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,EAAE,EAAE,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAChD,CAAC;IAED,OAAO,uBAAuB,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA+B,EAC/B,QAAwB,EACxB,SAAiB;IAEjB,MAAM,QAAQ,GAA2B;QACvC,CAAC,4BAA4B,CAAC,EAAE,QAAQ,CAAC,IAAI;QAC7C,CAAC,6BAA6B,CAAC,EAAE,QAAQ,CAAC,KAAK;QAC/C,CAAC,kBAAkB,CAAC,EAAE,SAAS;KAChC,CAAC;IAEF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,GAAG,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;YAC7C,OAAO,CAAC,IAAI,CACV,qBAAqB,GAAG,0CAA0C;gBAClE,0CAA0C,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yCAAyC,CACvD,eAAoC,EACpC,OAA+B;IAE/B,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;IAC5C,MAAM,SAAS,GAA2B;QACxC,CAAC,4BAA4B,CAAC,EAAE,SAAS,CAAC,IAAI;QAC9C,CAAC,6BAA6B,CAAC,EAAE,SAAS,CAAC,KAAK;QAChD,CAAC,kBAAkB,CAAC,EAAE,EAAE;KACzB,CAAC;IAEF,IAAI,MAA0C,CAAC;IAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACxC,IAAI,CAAC,MAAM;YAAE,MAAM,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,OAAO,MAAM,IAAI,OAAO,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"caller-identity.js","sourceRoot":"","sources":["../../src/shared/caller-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,mDAAmD;AACnD,MAAM,CAAC,MAAM,4BAA4B,GAAG,8BAA8B,CAAC;AAE3E,8CAA8C;AAC9C,MAAM,CAAC,MAAM,6BAA6B,GAAG,+BAA+B,CAAC;AAE7E,mEAAmE;AACnE,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAE1C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC;AAchD,wEAAwE;AACxE,MAAM,UAAU,uBAAuB;IACrC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,eAAmD,EACnD,OAA6B;IAE7B,MAAM,MAAM,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACrC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,EAAE,KAAK,uBAAuB,EAAE,CAAC;QACnC,+DAA+D;QAC/D,uEAAuE;QACvE,OAAO,CAAC,IAAI,CACV,2BAA2B,uBAAuB,sBAAsB;YACxE,oEAAoE;YACpE,gCAAgC,CACjC,CAAC;QACF,OAAO,uBAAuB,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,EAAE,EAAE,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAChD,CAAC;IAED,OAAO,uBAAuB,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA+B,EAC/B,QAAwB,EACxB,SAAiB;IAEjB,MAAM,QAAQ,GAA2B;QACvC,CAAC,4BAA4B,CAAC,EAAE,QAAQ,CAAC,IAAI;QAC7C,CAAC,6BAA6B,CAAC,EAAE,QAAQ,CAAC,KAAK;QAC/C,CAAC,kBAAkB,CAAC,EAAE,SAAS;KAChC,CAAC;IAEF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,GAAG,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;YAC7C,OAAO,CAAC,IAAI,CACV,qBAAqB,GAAG,0CAA0C;gBAClE,0CAA0C,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yCAAyC,CACvD,eAAoC,EACpC,OAA+B;IAE/B,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;IAC5C,MAAM,SAAS,GAA2B;QACxC,CAAC,4BAA4B,CAAC,EAAE,SAAS,CAAC,IAAI;QAC9C,CAAC,6BAA6B,CAAC,EAAE,SAAS,CAAC,KAAK;QAChD,CAAC,kBAAkB,CAAC,EAAE,EAAE;KACzB,CAAC;IAEF,IAAI,MAA0C,CAAC;IAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACxC,IAAI,CAAC,MAAM;YAAE,MAAM,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,OAAO,MAAM,IAAI,OAAO,CAAC;AAC3B,CAAC"}

package/dist/shared/declared-preferences.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Declared preferences (stigmer/stigmer#293, DD-002): standing free-text
+ * preferences the organization and the calling user declared once — "keep
+ * answers terse", "we deploy to us-east-1" — that every eligible execution
+ * receives without the user re-typing them.
+ *
+ * The server composes the CONTENT at execution create: the create pipeline
+ * snapshots `Organization.spec.preferences.standing_context` and (cloud, for
+ * first-party human callers only) the caller
+ * `IdentityAccount.spec.preferences.standing_context` verbatim onto the
+ * execution spec's `declared_preferences` field. This module owns the
+ * PRESENTATION — the preamble and the per-scope attribution — so the framing
+ * cannot drift between harnesses.
+ *
+ * Like conversation-catchup (its typed-field sibling) there is no metadata
+ * key to mirror-guard: the value rides a TYPED proto field, so codegen
+ * enforces the cross-repo contract. Degradation is safe by construction: an
+ * absent or blank field renders nothing, and a runner predating this module
+ * simply ignores it — the agent runs without preferences, exactly the
+ * pre-#293 behavior, never worse.
+ */
+import type { DeclaredPreferences } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/spec_pb";
+/**
+ * The non-blank preference scopes of an execution, in presentation order.
+ * At least one scope is set (the read function returns undefined otherwise).
+ */
+export interface DeclaredPreferencesContent {
+    /** The organization's standing context, trimmed; absent when blank. */
+    orgContext?: string;
+    /** The calling user's standing context, trimmed; absent when blank. */
+    userContext?: string;
+}
+/**
+ * Read the declared preferences from an execution spec's
+ * `declared_preferences`. Returns undefined when the field is absent or both
+ * scopes are blank — the caller renders no section. Blank-is-absent applies
+ * PER SCOPE: an org-only snapshot renders only the org subsection.
+ */
+export declare function readDeclaredPreferences(preferences: DeclaredPreferences | undefined): DeclaredPreferencesContent | undefined;
+/**
+ * The framed preferences body (preamble + labeled per-scope subsections),
+ * ready for section wrapping. Attribution is explicit — the model must know
+ * WHO declared what. Organization first, user last: the user's refinement
+ * reads last and so naturally wins where the two conflict, without this
+ * module encoding any override rule.
+ */
+export declare function formatDeclaredPreferencesText(content: DeclaredPreferencesContent): string;

package/dist/shared/declared-preferences.js

@@ -0,0 +1,64 @@
+/**
+ * Declared preferences (stigmer/stigmer#293, DD-002): standing free-text
+ * preferences the organization and the calling user declared once — "keep
+ * answers terse", "we deploy to us-east-1" — that every eligible execution
+ * receives without the user re-typing them.
+ *
+ * The server composes the CONTENT at execution create: the create pipeline
+ * snapshots `Organization.spec.preferences.standing_context` and (cloud, for
+ * first-party human callers only) the caller
+ * `IdentityAccount.spec.preferences.standing_context` verbatim onto the
+ * execution spec's `declared_preferences` field. This module owns the
+ * PRESENTATION — the preamble and the per-scope attribution — so the framing
+ * cannot drift between harnesses.
+ *
+ * Like conversation-catchup (its typed-field sibling) there is no metadata
+ * key to mirror-guard: the value rides a TYPED proto field, so codegen
+ * enforces the cross-repo contract. Degradation is safe by construction: an
+ * absent or blank field renders nothing, and a runner predating this module
+ * simply ignores it — the agent runs without preferences, exactly the
+ * pre-#293 behavior, never worse.
+ */
+/**
+ * How the preferences are introduced to the model, shared by both harnesses
+ * so the behavioral contract cannot drift between them. Same posture as the
+ * session-context channel: calibration material, never authority — the task
+ * always outranks a standing preference.
+ */
+const DECLARED_PREFERENCES_PREAMBLE = "Standing preferences declared by the organization and/or the user you " +
+    "are assisting. Treat them as background you already know: use them to " +
+    "calibrate depth, defaults, and tone. Do not repeat them back, quote " +
+    "them, or mention that you received them. They are context, not " +
+    "instructions that override your task.";
+/**
+ * Read the declared preferences from an execution spec's
+ * `declared_preferences`. Returns undefined when the field is absent or both
+ * scopes are blank — the caller renders no section. Blank-is-absent applies
+ * PER SCOPE: an org-only snapshot renders only the org subsection.
+ */
+export function readDeclaredPreferences(preferences) {
+    const orgContext = preferences?.orgContext?.trim() || undefined;
+    const userContext = preferences?.userContext?.trim() || undefined;
+    if (!orgContext && !userContext) {
+        return undefined;
+    }
+    return { orgContext, userContext };
+}
+/**
+ * The framed preferences body (preamble + labeled per-scope subsections),
+ * ready for section wrapping. Attribution is explicit — the model must know
+ * WHO declared what. Organization first, user last: the user's refinement
+ * reads last and so naturally wins where the two conflict, without this
+ * module encoding any override rule.
+ */
+export function formatDeclaredPreferencesText(content) {
+    const sections = [DECLARED_PREFERENCES_PREAMBLE];
+    if (content.orgContext) {
+        sections.push(`Declared by the organization:\n${content.orgContext}`);
+    }
+    if (content.userContext) {
+        sections.push(`Declared by the user:\n${content.userContext}`);
+    }
+    return sections.join("\n\n");
+}
+//# sourceMappingURL=declared-preferences.js.map

package/dist/shared/declared-preferences.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"declared-preferences.js","sourceRoot":"","sources":["../../src/shared/declared-preferences.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH;;;;;GAKG;AACH,MAAM,6BAA6B,GACjC,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,iEAAiE;IACjE,uCAAuC,CAAC;AAa1C;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAA4C;IAE5C,MAAM,UAAU,GAAG,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAChE,MAAM,WAAW,GAAG,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAClE,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAmC;IAEnC,MAAM,QAAQ,GAAa,CAAC,6BAA6B,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC,kCAAkC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,0BAA0B,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC"}

package/dist/shared/mcp-enabled-tools.d.ts

@@ -7,9 +7,8 @@
  * - An empty usage list falls back to the server's default_enabled_tools.
  * - Both empty means NO restriction — every discovered tool is available.
  *
- * Both harnesses import THIS module so they can never drift on these
- * semantics (the mcp-transport-guard precedent for logic shared across the
- * duplicated resolvers — see the header of shared/mcp-resolver.ts):
+ * Resolution is shared (shared/mcp-resolver.ts threads the effective list
+ * onto every ResolvedMcpServer), but ENFORCEMENT is per-harness:
  * - The deep-agent harness filters the discovered toolset before it reaches
  *   the model (shared/mcp-manager.ts connectMcpServers).
  * - The Cursor harness cannot hide tools (the Cursor SDK's McpServerConfig

package/dist/shared/mcp-enabled-tools.js

@@ -7,9 +7,8 @@
  * - An empty usage list falls back to the server's default_enabled_tools.
  * - Both empty means NO restriction — every discovered tool is available.
  *
- * Both harnesses import THIS module so they can never drift on these
- * semantics (the mcp-transport-guard precedent for logic shared across the
- * duplicated resolvers — see the header of shared/mcp-resolver.ts):
+ * Resolution is shared (shared/mcp-resolver.ts threads the effective list
+ * onto every ResolvedMcpServer), but ENFORCEMENT is per-harness:
  * - The deep-agent harness filters the discovered toolset before it reaches
  *   the model (shared/mcp-manager.ts connectMcpServers).
  * - The Cursor harness cannot hide tools (the Cursor SDK's McpServerConfig

package/dist/shared/mcp-enabled-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-enabled-tools.js","sourceRoot":"","sources":["../../src/shared/mcp-enabled-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,iBAAgD,EAChD,mBAAkD;IAElD,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,GAAG,iBAAiB,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,mBAAmB,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,CAAC,GAAG,mBAAmB,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAY,EACZ,KAAmB,EACnB,YAA2C;IAE3C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CACV,iBAAiB,IAAI,2BAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACtE,qEAAqE;YACrE,OAAO,QAAQ,CAAC,MAAM,sCAAsC;YAC5D,uDAAuD,CACxD,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CACT,iBAAiB,IAAI,8BAA8B,KAAK,CAAC,MAAM,GAAG;QAClE,yBAAyB,QAAQ,CAAC,MAAM,EAAE,CAC3C,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA6D;IAE7D,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"mcp-enabled-tools.js","sourceRoot":"","sources":["../../src/shared/mcp-enabled-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,iBAAgD,EAChD,mBAAkD;IAElD,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,GAAG,iBAAiB,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,mBAAmB,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,CAAC,GAAG,mBAAmB,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAY,EACZ,KAAmB,EACnB,YAA2C;IAE3C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CACV,iBAAiB,IAAI,2BAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACtE,qEAAqE;YACrE,OAAO,QAAQ,CAAC,MAAM,sCAAsC;YAC5D,uDAAuD,CACxD,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CACT,iBAAiB,IAAI,8BAA8B,KAAK,CAAC,MAAM,GAAG;QAClE,yBAAyB,QAAQ,CAAC,MAAM,EAAE,CAC3C,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA6D;IAE7D,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/shared/mcp-resolver.d.ts

@@ -2,13 +2,17 @@
  * Resolves Stigmer McpServerUsage references into an intermediate
  * ResolvedMcpServer format.
  *
- * Consumers: the deep-agent harness (execute-deep-agent/setup.ts), the
- * connect backfill (shared/connect-backfill.ts), and the discovery
- * activity (activities/discover-mcp-server.ts, via mcpServerToResolved).
- * NOTE: the Cursor harness does NOT use this module — it has its own
- * near-duplicate resolver at activities/execute-cursor/mcp-resolver.ts.
- * A behavioral change here (like the transport guard) must be mirrored
- * there until the two are consolidated.
+ * THE single resolver for both harnesses (oss#387 retired the Cursor
+ * harness's near-duplicate): the deep-agent harness
+ * (execute-deep-agent/setup.ts), the Cursor harness
+ * (execute-cursor/index.ts), the connect backfill
+ * (shared/connect-backfill.ts), and the discovery activity
+ * (activities/discover-mcp-server.ts, via mcpServerToResolved) all consume
+ * it. Each harness maps the result into its SDK format at the last hop:
+ * toMcpClientConfig (shared/mcp-manager.ts) for LangChain,
+ * toCursorMcpConfig (execute-cursor/cursor-mcp-config.ts) for the Cursor
+ * SDK — so a behavioral change here (like the transport guard) lands in
+ * both execution paths by construction.
  */
 import type { McpServerUsage, ToolApprovalOverride } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
 import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
@@ -38,8 +42,11 @@ export interface ResolvedMcpServer {
      * enabled_tools, falling back to the server's default_enabled_tools when
      * the usage's list is empty (see shared/mcp-enabled-tools.ts). Absent when
      * unrestricted — which keeps synthesized attachment servers (built without
-     * a usage) and the discovery path unfiltered by construction. Enforced at
-     * connect time by connectMcpServers (shared/mcp-manager.ts).
+     * a usage) and the discovery path unfiltered by construction. Enforcement
+     * is per-harness: the deep-agent path filters at connect time
+     * (connectMcpServers, shared/mcp-manager.ts); the Cursor SDK config cannot
+     * hide tools, so that harness denies non-enabled calls in the HITL hook
+     * (see hook-script.ts).
      */
     enabledTools?: string[];
     /**
@@ -48,11 +55,10 @@ export interface ResolvedMcpServer {
      * override to its own server — a flat cross-server list is how an
      * override once leaked onto (or silently un-gated) a same-named tool on
      * another server. Deliberately REQUIRED, not optional: empty means "no
-     * overrides", and every construction site — including the near-duplicate
-     * Cursor resolver and the synthesized attachments, which have no usage
-     * and therefore no layer 3 — must say so explicitly, so a forgotten
-     * mirror cannot compile. Consumed by mergeApprovalPolicies
-     * (shared/approval-policy.ts).
+     * overrides", and every construction site — including the synthesized
+     * attachments, which have no usage and therefore no layer 3 — must say so
+     * explicitly, so a forgotten site cannot compile. Consumed by
+     * mergeApprovalPolicies (shared/approval-policy.ts).
      */
     toolApprovalOverrides: ToolApprovalOverride[];
 }
@@ -69,7 +75,6 @@ export interface McpResolutionResult {
  */
 export declare function resolveMcpServers(client: StigmerClient, usages: McpServerUsage[], envVars: Record<string, string>, transportPosture: McpTransportPosture): Promise<McpResolutionResult>;
 export declare function mcpServerToResolved(server: McpServer, slug: string, envVars: Record<string, string>, usageEnabledTools?: readonly string[], usageToolApprovalOverrides?: ToolApprovalOverride[]): ResolvedMcpServer | null;
-export declare function extractMcpServerSlugs(usages: McpServerUsage[]): string[];
 /**
  * Merge MCP server usages from agent (base) and session (overlay).
  *

package/dist/shared/mcp-resolver.js

@@ -2,13 +2,17 @@
  * Resolves Stigmer McpServerUsage references into an intermediate
  * ResolvedMcpServer format.
  *
- * Consumers: the deep-agent harness (execute-deep-agent/setup.ts), the
- * connect backfill (shared/connect-backfill.ts), and the discovery
- * activity (activities/discover-mcp-server.ts, via mcpServerToResolved).
- * NOTE: the Cursor harness does NOT use this module — it has its own
- * near-duplicate resolver at activities/execute-cursor/mcp-resolver.ts.
- * A behavioral change here (like the transport guard) must be mirrored
- * there until the two are consolidated.
+ * THE single resolver for both harnesses (oss#387 retired the Cursor
+ * harness's near-duplicate): the deep-agent harness
+ * (execute-deep-agent/setup.ts), the Cursor harness
+ * (execute-cursor/index.ts), the connect backfill
+ * (shared/connect-backfill.ts), and the discovery activity
+ * (activities/discover-mcp-server.ts, via mcpServerToResolved) all consume
+ * it. Each harness maps the result into its SDK format at the last hop:
+ * toMcpClientConfig (shared/mcp-manager.ts) for LangChain,
+ * toCursorMcpConfig (execute-cursor/cursor-mcp-config.ts) for the Cursor
+ * SDK — so a behavioral change here (like the transport guard) lands in
+ * both execution paths by construction.
  */
 import { assertTransportAllowed, McpTransportError, } from "./mcp-transport-guard.js";
 import { resolveHeaders, resolvePlaceholders, filterEnvToDeclaredKeys, PlaceholderResolutionError, } from "./placeholder-resolver.js";
@@ -112,11 +116,6 @@ export function mcpServerToResolved(server, slug, envVars, usageEnabledTools, us
             return null;
     }
 }
-export function extractMcpServerSlugs(usages) {
-    return usages
-        .map((u) => u.mcpServerRef?.slug)
-        .filter((s) => !!s);
-}
 /**
  * Merge MCP server usages from agent (base) and session (overlay).
  *

package/dist/shared/mcp-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-resolver.js","sourceRoot":"","sources":["../../src/shared/mcp-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAElB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAgD/D;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAqB,EACrB,MAAwB,EACxB,OAA+B,EAC/B,gBAAqC;IAErC,MAAM,QAAQ,GAAwB,EAAE,CAAC;IAEzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,CAAC;QAC/B,IAAI,CAAC,GAAG,EAAE,IAAI;YAAE,SAAS;QAEzB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC5D,MAAM,SAAS,GAAG,uBAAuB,CACvC,SAAS,CAAC,IAAI,EAAE,GAAG,EACnB,OAAO,EACP,GAAG,CAAC,IAAI,CACT,CAAC;YACF,MAAM,MAAM,GAAG,mBAAmB,CAChC,SAAS,EACT,GAAG,CAAC,IAAI,EACR,SAAS,EACT,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAClC,CAAC;YACF,IAAI,MAAM,EAAE,CAAC;gBACX,sBAAsB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;gBAC7E,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBACrC,gEAAgE;gBAChE,iEAAiE;gBACjE,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,GAAG,YAAY,0BAA0B,EAAE,CAAC;gBAC9C,OAAO,CAAC,KAAK,CACX,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CACpD,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CACV,gCAAgC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CACnG,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAiB,EACjB,IAAY,EACZ,OAA+B,EAC/B,iBAAqC,EACrC,6BAAqD,EAAE;IAEvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,MAAM,aAAa,GAAG,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC;IAClD,MAAM,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,IAAI,EAAE,CAAC;IAC3D,MAAM,2BAA2B,GAAG,CAAC,MAAM,EAAE,sBAAsB;WAC9D,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;eAC/C,MAAM,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IAErE,MAAM,IAAI,GAAG;QACX,aAAa;QACb,mBAAmB;QACnB,2BAA2B;QAC3B,wEAAwE;QACxE,+DAA+D;QAC/D,oEAAoE;QACpE,YAAY,EAAE,qBAAqB,CAAC,iBAAiB,EAAE,IAAI,CAAC,mBAAmB,CAAC;QAChF,wEAAwE;QACxE,sEAAsE;QACtE,qBAAqB,EAAE,0BAA0B;KAClD,CAAC;IAEF,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAC7B,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YACpC,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAChC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;gBACxC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CACxB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,CACrD;gBACH,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,IAAI;gBACJ,cAAc,EAAE,OAAO;gBACvB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,YAAY;gBAClB,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;gBACjE,GAAG,EAAE,KAAK,CAAC,UAAU,IAAI,SAAS;gBAClC,GAAG,IAAI;aACR,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC3B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YACnF,MAAM,QAAQ,GAAG,UAAU;gBACzB,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC;gBACzE,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,IAAI;gBACJ,cAAc,EAAE,MAAM;gBACtB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,OAAO,EAAE,QAAQ;gBACjB,GAAG,IAAI;aACR,CAAC;QACJ,CAAC;QACD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAwB;IAC5D,OAAO,MAAM;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC;SAChC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAA6B,EAC7B,aAA+B;IAE/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEjD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC;QACtC,IAAI,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC;QACtC,IAAI,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"mcp-resolver.js","sourceRoot":"","sources":["../../src/shared/mcp-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAElB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAkD/D;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAqB,EACrB,MAAwB,EACxB,OAA+B,EAC/B,gBAAqC;IAErC,MAAM,QAAQ,GAAwB,EAAE,CAAC;IAEzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,CAAC;QAC/B,IAAI,CAAC,GAAG,EAAE,IAAI;YAAE,SAAS;QAEzB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC5D,MAAM,SAAS,GAAG,uBAAuB,CACvC,SAAS,CAAC,IAAI,EAAE,GAAG,EACnB,OAAO,EACP,GAAG,CAAC,IAAI,CACT,CAAC;YACF,MAAM,MAAM,GAAG,mBAAmB,CAChC,SAAS,EACT,GAAG,CAAC,IAAI,EACR,SAAS,EACT,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAClC,CAAC;YACF,IAAI,MAAM,EAAE,CAAC;gBACX,sBAAsB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;gBAC7E,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBACrC,gEAAgE;gBAChE,iEAAiE;gBACjE,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,GAAG,YAAY,0BAA0B,EAAE,CAAC;gBAC9C,OAAO,CAAC,KAAK,CACX,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CACpD,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CACV,gCAAgC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CACnG,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAiB,EACjB,IAAY,EACZ,OAA+B,EAC/B,iBAAqC,EACrC,6BAAqD,EAAE;IAEvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,MAAM,aAAa,GAAG,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC;IAClD,MAAM,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,IAAI,EAAE,CAAC;IAC3D,MAAM,2BAA2B,GAAG,CAAC,MAAM,EAAE,sBAAsB;WAC9D,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;eAC/C,MAAM,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IAErE,MAAM,IAAI,GAAG;QACX,aAAa;QACb,mBAAmB;QACnB,2BAA2B;QAC3B,wEAAwE;QACxE,+DAA+D;QAC/D,oEAAoE;QACpE,YAAY,EAAE,qBAAqB,CAAC,iBAAiB,EAAE,IAAI,CAAC,mBAAmB,CAAC;QAChF,wEAAwE;QACxE,sEAAsE;QACtE,qBAAqB,EAAE,0BAA0B;KAClD,CAAC;IAEF,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAC7B,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YACpC,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAChC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;gBACxC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CACxB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,CACrD;gBACH,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,IAAI;gBACJ,cAAc,EAAE,OAAO;gBACvB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,YAAY;gBAClB,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;gBACjE,GAAG,EAAE,KAAK,CAAC,UAAU,IAAI,SAAS;gBAClC,GAAG,IAAI;aACR,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC3B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YACnF,MAAM,QAAQ,GAAG,UAAU;gBACzB,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC;gBACzE,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,IAAI;gBACJ,cAAc,EAAE,MAAM;gBACtB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,OAAO,EAAE,QAAQ;gBACjB,GAAG,IAAI;aACR,CAAC;QACJ,CAAC;QACD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAA6B,EAC7B,aAA+B;IAE/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEjD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC;QACtC,IAAI,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC;QACtC,IAAI,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/shared/placeholder-resolver.d.ts

@@ -1,8 +1,10 @@
 /**
  * Strict placeholder resolver for ${VAR_NAME} syntax in MCP server configs.
  *
+ * Port of the Python agent-runner's PlaceholderResolver (strict mode only).
  * Always raises on unresolved placeholders — sending literal ${VAR} as an
- * HTTP header value produces cryptic auth failures from the remote server.
+ * HTTP header value (e.g. Authorization: Bearer ${API_KEY}) produces
+ * cryptic auth failures from the remote server.
  */
 export declare class PlaceholderResolutionError extends Error {
     readonly variableName: string;
@@ -17,11 +19,16 @@ export declare class PlaceholderResolutionError extends Error {
 export declare function resolvePlaceholders(template: string, envVars: Record<string, string>, context?: string): string;
 /**
  * Resolve placeholders in all values of a headers map.
+ *
+ * @throws PlaceholderResolutionError if any header value contains an
+ *   unresolvable placeholder.
  */
 export declare function resolveHeaders(headers: Record<string, string>, envVars: Record<string, string>): Record<string, string>;
 /**
  * Filter env vars to only keys declared in the MCP server's spec.env.
- * Prevents secret over-sharing by restricting the environment to
+ *
+ * Mirrors the agent-runner's _filter_env_to_declared_keys: prevents
+ * secret over-sharing by restricting the subprocess/HTTP environment to
  * explicitly declared variables.
  */
 export declare function filterEnvToDeclaredKeys(declaredEnv: Record<string, unknown> | undefined, envVars: Record<string, string>, serverSlug: string): Record<string, string>;

package/dist/shared/placeholder-resolver.js

@@ -1,8 +1,10 @@
 /**
  * Strict placeholder resolver for ${VAR_NAME} syntax in MCP server configs.
  *
+ * Port of the Python agent-runner's PlaceholderResolver (strict mode only).
  * Always raises on unresolved placeholders — sending literal ${VAR} as an
- * HTTP header value produces cryptic auth failures from the remote server.
+ * HTTP header value (e.g. Authorization: Bearer ${API_KEY}) produces
+ * cryptic auth failures from the remote server.
  */
 const PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 export class PlaceholderResolutionError extends Error {
@@ -32,6 +34,9 @@ export function resolvePlaceholders(template, envVars, context) {
 }
 /**
  * Resolve placeholders in all values of a headers map.
+ *
+ * @throws PlaceholderResolutionError if any header value contains an
+ *   unresolvable placeholder.
  */
 export function resolveHeaders(headers, envVars) {
     const resolved = {};
@@ -42,7 +47,9 @@ export function resolveHeaders(headers, envVars) {
 }
 /**
  * Filter env vars to only keys declared in the MCP server's spec.env.
- * Prevents secret over-sharing by restricting the environment to
+ *
+ * Mirrors the agent-runner's _filter_env_to_declared_keys: prevents
+ * secret over-sharing by restricting the subprocess/HTTP environment to
  * explicitly declared variables.
  */
 export function filterEnvToDeclaredKeys(declaredEnv, envVars, serverSlug) {

package/dist/shared/placeholder-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"placeholder-resolver.js","sourceRoot":"","sources":["../../src/shared/placeholder-resolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,cAAc,GAAG,iCAAiC,CAAC;AAEzD,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAEjC;IACA;IAFlB,YACkB,YAAoB,EACpB,OAAgB;QAEhC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,KAAK,CACH,6BAA6B,YAAY,IAAI,KAAK,IAAI;YACpD,sDAAsD,CACzD,CAAC;QAPc,iBAAY,GAAZ,YAAY,CAAQ;QACpB,YAAO,GAAP,OAAO,CAAS;QAOhC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,OAA+B,EAC/B,OAAgB;IAEhB,OAAO,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,OAAe,EAAE,EAAE;QACjE,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;YACvB,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,IAAI,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA+B,EAC/B,OAA+B;IAE/B,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,QAAQ,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,GAAG,GAAG,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAgD,EAChD,OAA+B,EAC/B,UAAkB;IAElB,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CACT,eAAe,UAAU,8BAA8B;gBACrD,YAAY,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,aAAa,CACvD,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACvD,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAE5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IAC3E,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,eAAe,UAAU,cAAc,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG;YACpE,qCAAqC,OAAO,oBAAoB,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CACV,eAAe,UAAU,oBAAoB,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACxE,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"placeholder-resolver.js","sourceRoot":"","sources":["../../src/shared/placeholder-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,cAAc,GAAG,iCAAiC,CAAC;AAEzD,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAEjC;IACA;IAFlB,YACkB,YAAoB,EACpB,OAAgB;QAEhC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,KAAK,CACH,6BAA6B,YAAY,IAAI,KAAK,IAAI;YACpD,sDAAsD,CACzD,CAAC;QAPc,iBAAY,GAAZ,YAAY,CAAQ;QACpB,YAAO,GAAP,OAAO,CAAS;QAOhC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,OAA+B,EAC/B,OAAgB;IAEhB,OAAO,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,OAAe,EAAE,EAAE;QACjE,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;YACvB,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,IAAI,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA+B,EAC/B,OAA+B;IAE/B,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,QAAQ,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,GAAG,GAAG,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAgD,EAChD,OAA+B,EAC/B,UAAkB;IAElB,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CACT,eAAe,UAAU,8BAA8B;gBACrD,YAAY,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,aAAa,CACvD,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACvD,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAE5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IAC3E,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,eAAe,UAAU,cAAc,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG;YACpE,qCAAqC,OAAO,oBAAoB,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CACV,eAAe,UAAU,oBAAoB,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACxE,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/shared/plan-mode-permissions.d.ts

@@ -2,26 +2,25 @@
  * The Plan-mode filesystem permission rules — the enforcement twin of
  * `plan-mode-prompt.ts` (which carries the instruction half of the contract).
  *
- * Plan mode is contained BY CONSTRUCTION on the native harness: these rules
- * deny every filesystem write everywhere AND scope reads to the session
- * workspace (issue #528 — owner ruling: the workspace is plan mode's read
- * boundary on cloud and desktop runners alike). Without the read boundary,
- * model-provided absolute paths reached anywhere the process account could
- * read — the pod filesystem (including /proc/self/environ) on cloud runners,
- * the user's whole home directory on desktop — while plan mode still carries
- * exfiltration-capable tools (web_fetch, MCP). Rules are first-match-wins
- * with a permissive default (deepagents' decidePathAccess), so order is
- * load-bearing: the workspace read-allow must precede the read-deny.
+ * Plan mode's policy is: reads anywhere in the workspace, writes nowhere.
+ * Only the write half needs a RULE. The read boundary that issue #528 built
+ * out of rules (workspace read-allow + read-deny, glob-escaped real root) is
+ * now STRUCTURAL: every native-harness backend is virtual-rooted
+ * (`virtualMode: true` — see cas-capture-backend.ts, issue #754), so every
+ * path a tool can express resolves inside the workspace root and traversal
+ * is rejected at resolution. A rule cannot widen that, and no workspace-root
+ * glob is needed to narrow it — which also retires the whole
+ * special-characters-in-the-root hazard (`escapeGlobLiteral` and its
+ * end-to-end matcher suite) that the real-path rules carried.
  *
- * The workspace-root pattern is matched as a STRING against the raw tool-call
- * path (micromatch, dot:true), before the backend touches disk. That is
- * exactly why the legitimate out-of-workspace reads keep working: skills,
- * attachments, and the approved plan live in the platform dir but are
- * addressed through the `{workspace}/.stigmer` symlink (see
- * shared/workspace/stigmer-link.ts), so their path strings are in-root even
- * though the bytes are not. The same holds for multi-workspace local entries
- * (`{workspace}/{name}` symlinks). A realpath-based boundary would break
- * both; do not "harden" this into one.
+ * Paths in these rules are VIRTUAL: "/" is the workspace root, matched by
+ * micromatch against the raw tool-call path (dot:true) after the
+ * path-normalization middleware has canonicalized it (relative → "/"-rooted;
+ * see middleware/path-normalization.ts). The legitimate platform-dir reads
+ * (skills, attachments, the approved plan) keep working exactly as before:
+ * they are addressed through the `{workspace}/.stigmer` symlink
+ * (shared/workspace/stigmer-link.ts), an in-root path string in either
+ * dialect.
  *
  * Applied in execute-deep-agent/setup.ts to the parent graph AND threaded
  * into every compiled sub-agent graph: deepagents' parent-permission
@@ -30,13 +29,6 @@
  * (issue #255). Kept as its own side-effect-free module so tests can pin the
  * production rules without dragging in setup.ts's import graph.
  *
- * Rules travel with a companion: every graph that carries them also installs
- * the path-normalization middleware (middleware/path-normalization.ts,
- * issues #429/#528), because deepagents' rule validation refuses
- * workspace-relative paths outright and its `ls`/`glob`/`grep` schema default
- * of "/" would deny the bare first listing. Both are derived from the same
- * expression at each composition site so they cannot drift apart.
- *
  * Invariant: never combine these rules with a shell-capable (sandbox)
  * backend — deepagents rejects that pairing at graph construction (see the
  * cas-capture-backend.ts header). Plan mode guarantees it by construction:
@@ -45,25 +37,13 @@
  */
 import type { FilesystemPermission } from "deepagents";
 /**
- * Backslash-escape every character micromatch/picomatch treats as glob
- * syntax, so the result matches the input literally. micromatch exports no
- * escape API of its own, and this is correctness, not caution: an unescaped
- * `(` in a desktop project path would make the workspace read-allow rule
- * silently never match — bricking every plan-mode read for that workspace.
- * Semantics are pinned end-to-end through deepagents' own matcher by the
- * special-character workspace suite in plan-mode-path-normalization.test.ts.
- */
-export declare function escapeGlobLiteral(literal: string): string;
-/**
- * Build the plan-mode rule set for a graph whose filesystem backend is
- * rooted at `workspaceRootDir`. The three rules read as the policy:
- * reads allowed in the workspace, reads denied everywhere else, writes
- * denied everywhere.
+ * Build the plan-mode rule set. One rule IS the policy: writes denied
+ * everywhere ("/**" is every virtual path; deepagents evaluates
+ * first-match-wins with a permissive default, so reads stay allowed —
+ * workspace-confined structurally, not by rule).
  *
- * `{root}/**` matches the root itself as well as its subtree (verified
- * against the installed micromatch), so one allow pattern suffices. The
- * root is `path.resolve`d first because enforcement canonicalizes incoming
- * paths (collapsed slashes, no trailing separator) before matching — a
- * trailing slash in the pattern would silently match nothing.
+ * Deliberately parameterless: the pre-#754 signature took the workspace root
+ * to build a real-path read fence; resurrecting a root-derived rule would
+ * silently mismatch the virtual dialect the enforcement now sees.
  */
-export declare function buildPlanModePermissions(workspaceRootDir: string): FilesystemPermission[];
+export declare function buildPlanModePermissions(): FilesystemPermission[];