@stigmer/runner 3.15.3-dev.20260916211208 → 3.16.1-dev.20260917224426

package/dist/shared/synthesized-attachment.d.ts

@@ -26,9 +26,14 @@ export interface SynthesizedAttachmentOptions {
      */
     bridgeEndpoint: string | null;
     /**
-     * The execution's session-scoped credential (the sandbox token a
-     * cloud runner holds, or the desktop runner's exchanged scoped
-     * token). Null attaches no Authorization header (OSS/local).
+     * The credential of the RUN this attachment serves — the run's own
+     * credential the server minted at dispatch (the OSS shape), or the
+     * session-scoped sandbox token a cloud runner holds. Both connection
+     * shapes present it: as the Bearer on the bridge's per-request path,
+     * and as the stdio child's startup credential (`stdioCredentialEnv`),
+     * so what the child writes on the person's behalf is stamped as that
+     * person and not refused as nobody's on a server that signs people in.
+     * Null presents nothing (a run whose dispatch carried no credential).
      */
     credential: string | null;
     /**
@@ -37,6 +42,28 @@ export interface SynthesizedAttachmentOptions {
      */
     backendEndpoint: string;
 }
+/**
+ * The mcp-server's startup-credential variable — the ONE name the stdio
+ * child reads its bearer from (mcp-server/src/config.ts `STIGMER_API_KEY`;
+ * the value is any bearer the server honours, an `stk_` key for an IDE
+ * client, the run's credential here). Cross-repo string, pinned on both
+ * sides (the TOOL_CALL_LIMIT precedent).
+ */
+export declare const STDIO_CREDENTIAL_ENV = "STIGMER_API_KEY";
+/**
+ * The stdio child's startup-credential entry: `{ STIGMER_API_KEY }` when the
+ * attachment holds a credential, nothing when it holds none — so a
+ * credential-less run's child environment is byte-for-byte today's, and
+ * the two stdio shapes cannot disagree on the carrier.
+ *
+ * The exposure, stated once: the credential sits in a first-party child's
+ * process environment on the runner host, readable by the same OS user.
+ * That is the runner's own trust boundary (the runner process holds the
+ * same credential), and the child is `stigmer mcp-server`, never a
+ * third-party server — those receive only their declared env (oss#256,
+ * mcp-manager.ts). The alternative was the operator's API key.
+ */
+export declare function stdioCredentialEnv(credential: string | null): Record<string, string>;
 /**
  * Inject a synthesized attachment into a resolved server list — AFTER
  * resolve + backfill (see the module header). A user server shadowing

package/dist/shared/synthesized-attachment.js

@@ -13,6 +13,32 @@
  * tightener structurally unable to touch it. Callers must still inject
  * AFTER resolve + backfill; every harness call site does.
  */
+/**
+ * The mcp-server's startup-credential variable — the ONE name the stdio
+ * child reads its bearer from (mcp-server/src/config.ts `STIGMER_API_KEY`;
+ * the value is any bearer the server honours, an `stk_` key for an IDE
+ * client, the run's credential here). Cross-repo string, pinned on both
+ * sides (the TOOL_CALL_LIMIT precedent).
+ */
+export const STDIO_CREDENTIAL_ENV = "STIGMER_API_KEY";
+/**
+ * The stdio child's startup-credential entry: `{ STIGMER_API_KEY }` when the
+ * attachment holds a credential, nothing when it holds none — so a
+ * credential-less run's child environment is byte-for-byte today's, and
+ * the two stdio shapes cannot disagree on the carrier.
+ *
+ * The exposure, stated once: the credential sits in a first-party child's
+ * process environment on the runner host, readable by the same OS user.
+ * That is the runner's own trust boundary (the runner process holds the
+ * same credential), and the child is `stigmer mcp-server`, never a
+ * third-party server — those receive only their declared env (oss#256,
+ * mcp-manager.ts). The alternative was the operator's API key.
+ */
+export function stdioCredentialEnv(credential) {
+    return credential !== null && credential !== ""
+        ? { [STDIO_CREDENTIAL_ENV]: credential }
+        : {};
+}
 /**
  * Inject a synthesized attachment into a resolved server list — AFTER
  * resolve + backfill (see the module header). A user server shadowing

package/dist/shared/synthesized-attachment.js.map

@@ -1 +1 @@
-{"version":3,"file":"synthesized-attachment.js","sourceRoot":"","sources":["../../src/shared/synthesized-attachment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA4BH;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,eAAoC,EACpC,UAA6B,EAC7B,KAAa;IAEb,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC,CAAC;IACzE,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,oBAAoB,UAAU,CAAC,IAAI,yBAAyB,KAAK,GAAG;YACpE,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC;QAC5D,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC"}
+{"version":3,"file":"synthesized-attachment.js","sourceRoot":"","sources":["../../src/shared/synthesized-attachment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAiCH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AAEtD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAAyB;IAEzB,OAAO,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,EAAE;QAC7C,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,EAAE,UAAU,EAAE;QACxC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,eAAoC,EACpC,UAA6B,EAC7B,KAAa;IAEb,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC,CAAC;IACzE,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,oBAAoB,UAAU,CAAC,IAAI,yBAAyB,KAAK,GAAG;YACpE,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC;QAC5D,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/worker.js

@@ -15,7 +15,8 @@
  */
 import { createRequire } from "node:module";
 import { NativeConnection, Worker } from "@temporalio/worker";
-import { resolveWorkflowSource, OTEL_WORKFLOW_INTERCEPTOR_MODULE } from "./workflow-source.js";
+import { resolveWorkflowSource, runCredentialWorkflowInterceptorModule, OTEL_WORKFLOW_INTERCEPTOR_MODULE, } from "./workflow-source.js";
+import { runCredentialActivityInterceptor } from "./interceptors/run-credential-activity.js";
 export async function startWorker(opts) {
     const { config, activities, payloadCodecs } = opts;
     const connection = await NativeConnection.connect({
@@ -23,9 +24,15 @@ export async function startWorker(opts) {
     });
     const { createWorkflowMetricsSinks } = await import("./interceptors/workflow-metrics-sink.js");
     const workflowSource = resolveWorkflowSource();
-    const activityInterceptors = [];
+    // The run credential's two ends (shared/run-credential.ts): the workflow
+    // side lifts a run's credential onto every activity it schedules, the
+    // activity side enters it for the client to present. Always on; inert
+    // without a credential. Workflow-side modules must live INSIDE the
+    // workflow bundle — a pre-built bundle has it baked in
+    // (scripts/bundle-slim.mjs); only the runtime path registers it here.
+    const activityInterceptors = [runCredentialActivityInterceptor];
     let sinks = { ...createWorkflowMetricsSinks() };
-    const workflowInterceptorModules = [];
+    const workflowInterceptorModules = workflowSource.kind === "runtime" ? [runCredentialWorkflowInterceptorModule()] : [];
     if (process.env.OTEL_EXPORTER_OTLP_ENDPOINT) {
         const { OpenTelemetryActivityInboundInterceptor, makeWorkflowExporter, } = await import("@temporalio/interceptors-opentelemetry");
         const { OTLPTraceExporter } = await import("@opentelemetry/exporter-trace-otlp-grpc");

package/dist/worker.js.map

@@ -1 +1 @@
-{"version":3,"file":"worker.js","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAwD,MAAM,oBAAoB,CAAC;AAGpH,OAAO,EAAE,qBAAqB,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AAa/F,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAEnD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC;QAChD,OAAO,EAAE,MAAM,CAAC,eAAe;KAChC,CAAC,CAAC;IAEH,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;IAE/F,MAAM,cAAc,GAAG,qBAAqB,EAAE,CAAC;IAE/C,MAAM,oBAAoB,GAAkC,EAAE,CAAC;IAC/D,IAAI,KAAK,GAAuB,EAAE,GAAG,0BAA0B,EAAE,EAAE,CAAC;IACpE,MAAM,0BAA0B,GAAa,EAAE,CAAC;IAEhD,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC;QAC5C,MAAM,EACJ,uCAAuC,EACvC,oBAAoB,GACrB,GAAG,MAAM,MAAM,CAAC,wCAAwC,CAAC,CAAC;QAC3D,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;QACtF,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QAE5E,oBAAoB,CAAC,IAAI,CACvB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,uCAAuC,CAAC,GAAG,CAAC,EAAE,CAAC,CACzE,CAAC;QAEF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC;YACrC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B;SAC7C,CAAC,CAAC;QACH,iEAAiE;QACjE,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,SAAS,GAAG,oBAAoB,CAAC,QAAe,EAAE,QAAe,CAAkC,CAAC;QAC1G,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,SAAS,EAAE,CAAC;QAEnC,0EAA0E;QAC1E,sEAAsE;QACtE,6CAA6C;QAC7C,IAAI,cAAc,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClD,0BAA0B,CAAC,IAAI,CAC7B,UAAU,CAAC,OAAO,CAAC,gCAAgC,CAAC,CACrD,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;QACjC,UAAU;QACV,SAAS,EAAE,MAAM,CAAC,iBAAiB;QACnC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU;QACV,GAAG,CAAC,cAAc,CAAC,IAAI,KAAK,UAAU;YACpC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,EAAE;YAC3D,CAAC,CAAC,EAAE,aAAa,EAAE,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,mCAAmC,EAAE,MAAM,CAAC,uBAAuB;QACnE,aAAa,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS;QACpE,KAAK;QACL,YAAY,EAAE;YACZ,GAAG,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,0BAA0B,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClG;KACF,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAwD,MAAM,oBAAoB,CAAC;AAGpH,OAAO,EACL,qBAAqB,EACrB,sCAAsC,EACtC,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAa7F,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAEnD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC;QAChD,OAAO,EAAE,MAAM,CAAC,eAAe;KAChC,CAAC,CAAC;IAEH,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;IAE/F,MAAM,cAAc,GAAG,qBAAqB,EAAE,CAAC;IAE/C,yEAAyE;IACzE,sEAAsE;IACtE,sEAAsE;IACtE,mEAAmE;IACnE,uDAAuD;IACvD,sEAAsE;IACtE,MAAM,oBAAoB,GAAkC,CAAC,gCAAgC,CAAC,CAAC;IAC/F,IAAI,KAAK,GAAuB,EAAE,GAAG,0BAA0B,EAAE,EAAE,CAAC;IACpE,MAAM,0BAA0B,GAC9B,cAAc,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEtF,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC;QAC5C,MAAM,EACJ,uCAAuC,EACvC,oBAAoB,GACrB,GAAG,MAAM,MAAM,CAAC,wCAAwC,CAAC,CAAC;QAC3D,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;QACtF,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QAE5E,oBAAoB,CAAC,IAAI,CACvB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,uCAAuC,CAAC,GAAG,CAAC,EAAE,CAAC,CACzE,CAAC;QAEF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC;YACrC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B;SAC7C,CAAC,CAAC;QACH,iEAAiE;QACjE,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,SAAS,GAAG,oBAAoB,CAAC,QAAe,EAAE,QAAe,CAAkC,CAAC;QAC1G,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,SAAS,EAAE,CAAC;QAEnC,0EAA0E;QAC1E,sEAAsE;QACtE,6CAA6C;QAC7C,IAAI,cAAc,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClD,0BAA0B,CAAC,IAAI,CAC7B,UAAU,CAAC,OAAO,CAAC,gCAAgC,CAAC,CACrD,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;QACjC,UAAU;QACV,SAAS,EAAE,MAAM,CAAC,iBAAiB;QACnC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU;QACV,GAAG,CAAC,cAAc,CAAC,IAAI,KAAK,UAAU;YACpC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,EAAE;YAC3D,CAAC,CAAC,EAAE,aAAa,EAAE,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,mCAAmC,EAAE,MAAM,CAAC,uBAAuB;QACnE,aAAa,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS;QACpE,KAAK;QACL,YAAY,EAAE;YACZ,GAAG,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,0BAA0B,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClG;KACF,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/workflow-source.d.ts

@@ -35,4 +35,14 @@ export type WorkflowSource = {
  * with the workflow bundle.
  */
 export declare const OTEL_WORKFLOW_INTERCEPTOR_MODULE = "@temporalio/interceptors-opentelemetry/lib/workflow-interceptors";
+/**
+ * Path of the runner's own workflow interceptor — the one that carries a
+ * run's credential from the workflow input to every activity it schedules
+ * (`workflows/interceptors/run-credential.ts`). Always registered, unlike
+ * the OTel module: it is inert without a credential and load-bearing with
+ * one. Resolved beside this module so the tsc dist and the slim artifact
+ * both find their own compiled copy; the build script names the source
+ * file itself.
+ */
+export declare function runCredentialWorkflowInterceptorModule(): string;
 export declare function resolveWorkflowSource(): WorkflowSource;

package/dist/workflow-source.js

@@ -28,6 +28,18 @@ import { fileURLToPath } from "node:url";
  * with the workflow bundle.
  */
 export const OTEL_WORKFLOW_INTERCEPTOR_MODULE = "@temporalio/interceptors-opentelemetry/lib/workflow-interceptors";
+/**
+ * Path of the runner's own workflow interceptor — the one that carries a
+ * run's credential from the workflow input to every activity it schedules
+ * (`workflows/interceptors/run-credential.ts`). Always registered, unlike
+ * the OTel module: it is inert without a credential and load-bearing with
+ * one. Resolved beside this module so the tsc dist and the slim artifact
+ * both find their own compiled copy; the build script names the source
+ * file itself.
+ */
+export function runCredentialWorkflowInterceptorModule() {
+    return fileURLToPath(new URL("./workflows/interceptors/run-credential.js", import.meta.url));
+}
 export function resolveWorkflowSource() {
     const explicit = process.env.STIGMER_WORKFLOW_BUNDLE;
     if (explicit) {

package/dist/workflow-source.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-source.js","sourceRoot":"","sources":["../src/workflow-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAczC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAC3C,kEAAkE,CAAC;AAErE,MAAM,UAAU,qBAAqB;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACrD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,0DAA0D,QAAQ,EAAE,CACrE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAClD,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,OAAO;QACL,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;KAC/E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"workflow-source.js","sourceRoot":"","sources":["../src/workflow-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAczC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAC3C,kEAAkE,CAAC;AAErE;;;;;;;;GAQG;AACH,MAAM,UAAU,sCAAsC;IACpD,OAAO,aAAa,CAClB,IAAI,GAAG,CAAC,4CAA4C,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACrD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,0DAA0D,QAAQ,EAAE,CACrE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAClD,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,OAAO;QACL,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;KAC/E,CAAC;AACJ,CAAC"}

package/dist/workflows/execute-from-execution.d.ts

@@ -20,6 +20,14 @@
  * SANDBOX RULES: This file runs inside the Temporal deterministic V8
  * isolate. No Node.js built-ins, no non-deterministic operations.
  */
+/**
+ * The Temporal workflow type this function is exported as in `index.ts` — the
+ * server's `CHILD_WORKFLOW_TYPE`, byte-pinned on both sides. Named here so
+ * the run-credential interceptor can gate on it without a second literal; a
+ * test pins it to the barrel's export alias (an ES2022 export alias must be a
+ * literal, so the barrel cannot import this).
+ */
+export declare const EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE = "stigmer/workflow/execute-from-execution";
 export interface ExecuteFromExecutionInput {
     execution_id: string;
     workflow_instance_id: string;
@@ -28,5 +36,12 @@ export interface ExecuteFromExecutionInput {
     callback_token?: Uint8Array | null;
     invoker_identity_account_id?: string;
     recovery_mode?: boolean;
+    /**
+     * The run credential the server minted for this execution at dispatch —
+     * absent from an older server's dispatch. This workflow never reads it: the
+     * interceptor in `interceptors/run-credential.ts` lifts it onto every
+     * activity this workflow schedules, as a header (`shared/run-credential.ts`).
+     */
+    execution_context_token?: string;
 }
 export declare function executeFromExecution(input: ExecuteFromExecutionInput): Promise<void>;

package/dist/workflows/execute-from-execution.js

@@ -33,6 +33,17 @@ const hydrateProxy = proxyActivities({
     },
 });
 // ─────────────────────────────────────────────────────────────────────────────
+// Workflow Input Type (Temporal wire contract with Java/Go orchestrators)
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * The Temporal workflow type this function is exported as in `index.ts` — the
+ * server's `CHILD_WORKFLOW_TYPE`, byte-pinned on both sides. Named here so
+ * the run-credential interceptor can gate on it without a second literal; a
+ * test pins it to the barrel's export alias (an ES2022 export alias must be a
+ * literal, so the barrel cannot import this).
+ */
+export const EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE = "stigmer/workflow/execute-from-execution";
+// ─────────────────────────────────────────────────────────────────────────────
 // Workflow Function
 // ─────────────────────────────────────────────────────────────────────────────
 export async function executeFromExecution(input) {

package/dist/workflows/execute-from-execution.js.map

@@ -1 +1 @@
-{"version":3,"file":"execute-from-execution.js","sourceRoot":"","sources":["../../src/workflows/execute-from-execution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAUjE,MAAM,YAAY,GAAG,eAAe,CAAoB;IACtD,mBAAmB,EAAE,IAAI;IACzB,KAAK,EAAE;QACL,eAAe,EAAE,CAAC;QAClB,eAAe,EAAE,IAAI;QACrB,kBAAkB,EAAE,CAAC;QACrB,eAAe,EAAE,KAAK;KACvB;CACF,CAAC,CAAC;AAgBH,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAgC;IAEhC,MAAM,EAAE,UAAU,EAAE,GAAG,wBAAwB,EAAE,CAAC;IAElD,GAAG,CAAC,IAAI,CAAC,4CAA4C,EAAE;QACrD,WAAW,EAAE,KAAK,CAAC,YAAY;QAC/B,UAAU,EAAE,KAAK,CAAC,WAAW;QAC7B,kBAAkB,EAAE,KAAK,CAAC,oBAAoB;QAC9C,KAAK,EAAE,KAAK,CAAC,MAAM;KACpB,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,wBAAwB,CAAC;QAC/D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE;QAC9C,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI;QAC9C,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM;KAC/C,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,sEAAsE;QACtE,qEAAqE;QACrE,mEAAmE;QACnE,sEAAsE;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,iEAAiE;QACjE,oEAAoE;QACpE,iEAAiE;QACjE,MAAM,iBAAiB,CAAC,YAAY,EAAE;YACpC,UAAU;YACV,YAAY,EAAE,KAAK,CAAC,aAAa,IAAI,KAAK;SAC3C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,8CAA8C,EAAE;gBACvD,WAAW,EAAE,KAAK,CAAC,YAAY;aAChC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"execute-from-execution.js","sourceRoot":"","sources":["../../src/workflows/execute-from-execution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAUjE,MAAM,YAAY,GAAG,eAAe,CAAoB;IACtD,mBAAmB,EAAE,IAAI;IACzB,KAAK,EAAE;QACL,eAAe,EAAE,CAAC;QAClB,eAAe,EAAE,IAAI;QACrB,kBAAkB,EAAE,CAAC;QACrB,eAAe,EAAE,KAAK;KACvB;CACF,CAAC,CAAC;AAEH,gFAAgF;AAChF,0EAA0E;AAC1E,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAC/C,yCAAyC,CAAC;AAmB5C,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAgC;IAEhC,MAAM,EAAE,UAAU,EAAE,GAAG,wBAAwB,EAAE,CAAC;IAElD,GAAG,CAAC,IAAI,CAAC,4CAA4C,EAAE;QACrD,WAAW,EAAE,KAAK,CAAC,YAAY;QAC/B,UAAU,EAAE,KAAK,CAAC,WAAW;QAC7B,kBAAkB,EAAE,KAAK,CAAC,oBAAoB;QAC9C,KAAK,EAAE,KAAK,CAAC,MAAM;KACpB,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,wBAAwB,CAAC;QAC/D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE;QAC9C,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI;QAC9C,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM;KAC/C,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,sEAAsE;QACtE,qEAAqE;QACrE,mEAAmE;QACnE,sEAAsE;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,iEAAiE;QACjE,oEAAoE;QACpE,iEAAiE;QACjE,MAAM,iBAAiB,CAAC,YAAY,EAAE;YACpC,UAAU;YACV,YAAY,EAAE,KAAK,CAAC,aAAa,IAAI,KAAK;SAC3C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,8CAA8C,EAAE;gBACvD,WAAW,EAAE,KAAK,CAAC,YAAY;aAChC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/workflows/index.d.ts

@@ -13,9 +13,11 @@
  * us map TypeScript function names to the slash-delimited Temporal
  * workflow type names that the backend expects.
  *
- * OTel workflow interceptors are registered at bundle time — not
- * imported here. Pre-built bundles (scripts/bundle-slim.mjs) bake them
- * in; the runtime-bundling fallback passes them to the bundler (see
+ * Workflow interceptors are registered at bundle time — not imported
+ * here: the runner's own run-credential interceptor
+ * (./interceptors/run-credential.ts, always) and OTel's (when the host
+ * configures the sink). Pre-built bundles (scripts/bundle-slim.mjs) bake
+ * them in; the runtime-bundling fallback passes them to the bundler (see
  * src/workflow-source.ts).
  */
 export { connectMcpServer as "stigmer/mcp-server/connect", discoverMcpServerLegacy as "stigmer/mcp-server/discover", } from "./connect-mcp-server.js";

package/dist/workflows/index.js

@@ -13,9 +13,11 @@
  * us map TypeScript function names to the slash-delimited Temporal
  * workflow type names that the backend expects.
  *
- * OTel workflow interceptors are registered at bundle time — not
- * imported here. Pre-built bundles (scripts/bundle-slim.mjs) bake them
- * in; the runtime-bundling fallback passes them to the bundler (see
+ * Workflow interceptors are registered at bundle time — not imported
+ * here: the runner's own run-credential interceptor
+ * (./interceptors/run-credential.ts, always) and OTel's (when the host
+ * configures the sink). Pre-built bundles (scripts/bundle-slim.mjs) bake
+ * them in; the runtime-bundling fallback passes them to the bundler (see
  * src/workflow-source.ts).
  */
 export { connectMcpServer as "stigmer/mcp-server/connect", discoverMcpServerLegacy as "stigmer/mcp-server/discover", } from "./connect-mcp-server.js";

package/dist/workflows/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/workflows/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EACL,gBAAgB,IAAI,4BAA4B,EAChD,uBAAuB,IAAI,6BAA6B,GACzD,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,yBAAyB,IAAI,0BAA0B,GACxD,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,oBAAoB,IAAI,yCAAyC,GAClE,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/workflows/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,gBAAgB,IAAI,4BAA4B,EAChD,uBAAuB,IAAI,6BAA6B,GACzD,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,yBAAyB,IAAI,0BAA0B,GACxD,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,oBAAoB,IAAI,yCAAyC,GAClE,MAAM,6BAA6B,CAAC"}

package/dist/workflows/interceptors/run-credential.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Workflow-side interceptors that carry a run's credential from the workflow
+ * input to every activity the workflow schedules — as a Temporal activity
+ * header, the SDK's channel for context that crosses the isolate boundary
+ * without being anybody's argument (`shared/run-credential.ts` has the
+ * whole story; `interceptors/run-credential-activity.ts` is the other end).
+ *
+ * Gated by WORKFLOW TYPE, not by input shape. The connect workflow's input
+ * carries the same key for a different token — a clocked decrypt-lane token
+ * bound to a synthetic id that no verifier admits as a run — and stamping it
+ * onto that lane's activities would present it where it does not belong.
+ * The gate is the positive list below: the workflow types whose input
+ * carries a RUN credential. One entry today; a test pins each entry to an
+ * export of `workflows/index.ts`, so the list cannot name a type that does
+ * not exist.
+ *
+ * Per-run state lives on this factory's closure: the SDK instantiates the
+ * factory once per workflow run, which is the documented contract. The
+ * header is a pure function of the input, so replay recomputes exactly what
+ * was recorded, and a credential-less input stamps nothing — an in-flight
+ * run from before the credential existed replays byte for byte.
+ *
+ * TEMPORAL SANDBOX: this file is bundled into the workflow isolate. No Node
+ * built-ins. It is baked into the pre-built bundle by
+ * `scripts/bundle-slim.mjs` and passed to the runtime bundler by both worker
+ * roots (`src/workflow-source.ts` names it beside the OTel module).
+ */
+import type { WorkflowInterceptorsFactory } from "@temporalio/workflow";
+/**
+ * The workflow types whose input carries a run credential. Byte-pinned wire
+ * names; each must be an export alias of `workflows/index.ts`.
+ */
+export declare const RUN_WORKFLOW_TYPES: readonly string[];
+export declare const interceptors: WorkflowInterceptorsFactory;

package/dist/workflows/interceptors/run-credential.js

@@ -0,0 +1,71 @@
+/**
+ * Workflow-side interceptors that carry a run's credential from the workflow
+ * input to every activity the workflow schedules — as a Temporal activity
+ * header, the SDK's channel for context that crosses the isolate boundary
+ * without being anybody's argument (`shared/run-credential.ts` has the
+ * whole story; `interceptors/run-credential-activity.ts` is the other end).
+ *
+ * Gated by WORKFLOW TYPE, not by input shape. The connect workflow's input
+ * carries the same key for a different token — a clocked decrypt-lane token
+ * bound to a synthetic id that no verifier admits as a run — and stamping it
+ * onto that lane's activities would present it where it does not belong.
+ * The gate is the positive list below: the workflow types whose input
+ * carries a RUN credential. One entry today; a test pins each entry to an
+ * export of `workflows/index.ts`, so the list cannot name a type that does
+ * not exist.
+ *
+ * Per-run state lives on this factory's closure: the SDK instantiates the
+ * factory once per workflow run, which is the documented contract. The
+ * header is a pure function of the input, so replay recomputes exactly what
+ * was recorded, and a credential-less input stamps nothing — an in-flight
+ * run from before the credential existed replays byte for byte.
+ *
+ * TEMPORAL SANDBOX: this file is bundled into the workflow isolate. No Node
+ * built-ins. It is baked into the pre-built bundle by
+ * `scripts/bundle-slim.mjs` and passed to the runtime bundler by both worker
+ * roots (`src/workflow-source.ts` names it beside the OTel module).
+ */
+import { workflowInfo } from "@temporalio/workflow";
+import { defaultPayloadConverter } from "@temporalio/common";
+import { RUN_CREDENTIAL_HEADER, readRunCredentialFromInput, } from "../../shared/run-credential.js";
+import { EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE } from "../execute-from-execution.js";
+/**
+ * The workflow types whose input carries a run credential. Byte-pinned wire
+ * names; each must be an export alias of `workflows/index.ts`.
+ */
+export const RUN_WORKFLOW_TYPES = [
+    EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE,
+];
+export const interceptors = () => {
+    let credential;
+    const inbound = {
+        async execute(input, next) {
+            if (RUN_WORKFLOW_TYPES.includes(workflowInfo().workflowType)) {
+                credential = readRunCredentialFromInput(input.args[0]);
+            }
+            return next(input);
+        },
+    };
+    const outbound = {
+        async scheduleActivity(input, next) {
+            return next(stamped(input));
+        },
+        async scheduleLocalActivity(input, next) {
+            return next(stamped(input));
+        },
+    };
+    function stamped(input) {
+        if (credential === undefined) {
+            return input;
+        }
+        return {
+            ...input,
+            headers: {
+                ...input.headers,
+                [RUN_CREDENTIAL_HEADER]: defaultPayloadConverter.toPayload(credential),
+            },
+        };
+    }
+    return { inbound: [inbound], outbound: [outbound] };
+};
+//# sourceMappingURL=run-credential.js.map

package/dist/workflows/interceptors/run-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-credential.js","sourceRoot":"","sources":["../../../src/workflows/interceptors/run-credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAUpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,oCAAoC,EAAE,MAAM,8BAA8B,CAAC;AAEpF;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,oCAAoC;CACrC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAgC,GAAG,EAAE;IAC5D,IAAI,UAA8B,CAAC;IAEnC,MAAM,OAAO,GAAoC;QAC/C,KAAK,CAAC,OAAO,CACX,KAA2B,EAC3B,IAAsD;YAEtD,IAAI,kBAAkB,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7D,UAAU,GAAG,0BAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;KACF,CAAC;IAEF,MAAM,QAAQ,GAAqC;QACjD,KAAK,CAAC,gBAAgB,CACpB,KAAoB,EACpB,IAAgE;YAEhE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,qBAAqB,CACzB,KAAyB,EACzB,IAAqE;YAErE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;IAEF,SAAS,OAAO,CACd,KAAQ;QAER,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO;YACL,GAAG,KAAK;YACR,OAAO,EAAE;gBACP,GAAG,KAAK,CAAC,OAAO;gBAChB,CAAC,qBAAqB,CAAC,EAAE,uBAAuB,CAAC,SAAS,CAAC,UAAU,CAAC;aACvE;SACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;AACtD,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/runner",
-  "version": "3.15.3-dev.20260916211208",
+  "version": "3.16.1-dev.20260917224426",
   "description": "Embeddable Temporal worker for the Stigmer AI agent platform — handles agent execution, workflow orchestration, and MCP server management",
   "license": "Apache-2.0",
   "type": "module",
@@ -104,9 +104,9 @@
     "@opentelemetry/sdk-metrics": "^2.0.0",
     "@opentelemetry/sdk-trace-base": "^2.0.0",
     "@opentelemetry/sdk-trace-node": "^2.0.0",
-    "@stigmer/protos": "3.15.3-dev.20260916211208",
-    "@stigmer/temporal-codecs": "3.15.3-dev.20260916211208",
-    "@stigmer/zip-structure": "3.15.3-dev.20260916211208",
+    "@stigmer/protos": "3.16.1-dev.20260917224426",
+    "@stigmer/temporal-codecs": "3.16.1-dev.20260917224426",
+    "@stigmer/zip-structure": "3.16.1-dev.20260917224426",
     "@temporalio/activity": "1.16.2",
     "@temporalio/common": "1.16.2",
     "@temporalio/interceptors-opentelemetry": "1.16.2",

package/src/__tests__/run-credential-e2e.test.ts

@@ -0,0 +1,233 @@
+/**
+ * The run credential end to end through a real Temporal
+ * (`TestWorkflowEnvironment`, the golden E2E's harness): a credential on the
+ * `execute-from-execution` workflow input reaches EVERY activity the run
+ * schedules — the remote hydrate and the engine's local activities alike —
+ * as the activity's current run credential, and a credential-less input
+ * reaches none of them. This is the property the whole carrier exists for
+ * (`shared/run-credential.ts`): no activity of a member's run ever runs as
+ * the operator, and no activity of a credential-less run changes.
+ *
+ * Both ends are registered exactly as the worker roots register them: the
+ * activity interceptor on the worker, the workflow interceptor module in the
+ * bundle. Skipped, like the golden E2E, when a local Temporal cannot boot.
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from "vitest";
+import { readFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { loadWorkflowFromYaml } from "../workflow-engine/loader.js";
+import { evaluateExpressionBatch } from "../workflow-engine/expression.js";
+import type { ExecuteFromExecutionInput } from "../workflows/execute-from-execution.js";
+import { EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE } from "../workflows/execute-from-execution.js";
+import { runCredentialActivityInterceptor } from "../interceptors/run-credential-activity.js";
+import { currentRunCredential } from "../shared/run-credential-store.js";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const WORKFLOWS_PATH = join(__dirname, "../workflows/index.ts");
+const RUN_CREDENTIAL_WORKFLOW_INTERCEPTOR = join(
+  __dirname,
+  "../workflows/interceptors/run-credential.ts",
+);
+const GOLDEN_MODEL = readFileSync(
+  join(__dirname, "../../test/golden/01-operation-basic.yaml"),
+  "utf-8",
+);
+const TASK_QUEUE = "run-credential-e2e-test";
+
+type TestWorkflowEnvironment =
+  import("@temporalio/testing").TestWorkflowEnvironment;
+type Worker = import("@temporalio/worker").Worker;
+
+let env: TestWorkflowEnvironment | null = null;
+let worker: Worker | null = null;
+let workerRunPromise: Promise<void> | null = null;
+let envReady = false;
+
+/**
+ * What each activity saw as its run credential, in the order they ran, with
+ * the execution it was working on (the hydrate's input object; the engine's
+ * positional first argument).
+ */
+const observed: Array<{
+  activity: string;
+  executionId: string;
+  credential: string | undefined;
+}> = [];
+
+function observing<T extends (...args: never[]) => unknown>(
+  activity: string,
+  body: T,
+): T {
+  return ((...args: never[]) => {
+    const first: unknown = args[0];
+    const executionId =
+      typeof first === "string"
+        ? first
+        : typeof first === "object" && first !== null && "execution_id" in first
+          ? String((first as { execution_id: unknown }).execution_id)
+          : "";
+    observed.push({
+      activity,
+      executionId,
+      credential: currentRunCredential(),
+    });
+    return body(...args);
+  }) as T;
+}
+
+function createObservingActivities() {
+  return {
+    HydrateWorkflowExecution: observing(
+      "HydrateWorkflowExecution",
+      async (input: ExecuteFromExecutionInput) => ({
+        model: loadWorkflowFromYaml(GOLDEN_MODEL),
+        workflow_input: null,
+        env: {},
+        metadata: { execution_id: input.execution_id },
+      }),
+    ),
+    ResetEventSequence: observing(
+      "ResetEventSequence",
+      async (): Promise<number> => 0,
+    ),
+    LoadRecoveryContext: observing(
+      "LoadRecoveryContext",
+      async (): Promise<unknown[]> => [],
+    ),
+    EmitWorkflowEvents: observing(
+      "EmitWorkflowEvents",
+      async (): Promise<void> => {},
+    ),
+    PromoteTaskOutput: observing(
+      "PromoteTaskOutput",
+      async (): Promise<void> => {},
+    ),
+    EvaluateExpressions: observing(
+      "EvaluateExpressions",
+      async (
+        expressions: Record<string, string>,
+        input: unknown,
+        stateVars: Record<string, unknown>,
+      ) => evaluateExpressionBatch(expressions, input, stateVars),
+    ),
+  };
+}
+
+async function runOnce(credential: string | undefined): Promise<string> {
+  if (!env) throw new Error("TestWorkflowEnvironment not initialized");
+  const executionId = `wex_e2e_${Math.random().toString(36).slice(2)}`;
+  const input: ExecuteFromExecutionInput = {
+    execution_id: executionId,
+    workflow_instance_id: "wfi_1",
+    workflow_id: "wf_1",
+    org_id: "org_1",
+    ...(credential !== undefined
+      ? { execution_context_token: credential }
+      : {}),
+  };
+  await env.client.workflow.execute(EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE, {
+    taskQueue: TASK_QUEUE,
+    workflowId: `run-credential-e2e-${executionId}`,
+    args: [input],
+    workflowExecutionTimeout: "30s",
+  });
+  return executionId;
+}
+
+describe("run credential E2E — Temporal TestWorkflowEnvironment", () => {
+  beforeAll(async () => {
+    try {
+      const { TestWorkflowEnvironment: TWE } =
+        await import("@temporalio/testing");
+      const { Worker: W } = await import("@temporalio/worker");
+
+      env = await TWE.createLocal();
+      worker = await W.create({
+        connection: env.nativeConnection,
+        taskQueue: TASK_QUEUE,
+        workflowsPath: WORKFLOWS_PATH,
+        activities: createObservingActivities(),
+        interceptors: {
+          activity: [runCredentialActivityInterceptor],
+          workflowModules: [RUN_CREDENTIAL_WORKFLOW_INTERCEPTOR],
+        },
+      });
+      workerRunPromise = worker.run();
+      await runOnce(undefined);
+      observed.length = 0;
+      envReady = true;
+    } catch (err: unknown) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.warn(
+        `Temporal E2E smoke test failed (tests will be skipped): ${msg}`,
+      );
+      envReady = false;
+    }
+  }, 90_000);
+
+  afterAll(async () => {
+    if (worker) {
+      worker.shutdown();
+      await workerRunPromise;
+    }
+    await env?.teardown();
+  });
+
+  it("every activity of a run whose input carries a credential runs with that credential current", async (testCtx) => {
+    if (!envReady) return testCtx.skip();
+    observed.length = 0;
+
+    await runOnce("run-cred-e2e");
+
+    const activities = new Set(observed.map((o) => o.activity));
+    expect(activities).toContain("HydrateWorkflowExecution");
+    expect(activities).toContain("ResetEventSequence");
+    expect(activities).toContain("EmitWorkflowEvents");
+    expect(observed.length).toBeGreaterThan(3);
+    expect(
+      observed.every((o) => o.credential === "run-cred-e2e"),
+      JSON.stringify(observed),
+    ).toBe(true);
+  }, 60_000);
+
+  it("no activity of a credential-less run sees a credential — an older server's dispatch is unchanged", async (testCtx) => {
+    if (!envReady) return testCtx.skip();
+    observed.length = 0;
+
+    await runOnce(undefined);
+
+    expect(observed.length).toBeGreaterThan(3);
+    expect(
+      observed.every((o) => o.credential === undefined),
+      JSON.stringify(observed),
+    ).toBe(true);
+  }, 60_000);
+
+  it("two runs in flight at once each see their own credential", async (testCtx) => {
+    if (!envReady) return testCtx.skip();
+    observed.length = 0;
+
+    const [one, two] = await Promise.all([
+      runOnce("run-cred-one"),
+      runOnce("run-cred-two"),
+    ]);
+    const expected = new Map([
+      [one, "run-cred-one"],
+      [two, "run-cred-two"],
+    ]);
+
+    const identified = observed.filter((o) => o.executionId !== "");
+    expect(identified.length).toBeGreaterThan(6);
+    expect(new Set(identified.map((o) => o.executionId))).toEqual(
+      new Set([one, two]),
+    );
+    for (const o of identified) {
+      expect(o.credential, `${o.activity} on ${o.executionId}`).toBe(
+        expected.get(o.executionId),
+      );
+    }
+  }, 60_000);
+});