@stigmer/server 3.14.0-dev.20260910084630

package/dist/query/search/query-store.js

@@ -0,0 +1,186 @@
+/**
+ * Search query store — ports
+ * pkg/query/search/store/sqlite_search_query_store.go: the CQRS read path
+ * over the search index. The SQL, engine query syntax, and score
+ * normalization all live in the storage driver (Store.querySearchIndex /
+ * clearSearchIndex — OD-3: no DB() escape hatch; DD-009: engine
+ * specifics inside each driver); this module owns query SHAPING — the
+ * engine-neutral tokenization of the user's query — plus per-hit
+ * load-and-convert through the extractor registry, and RebuildIndex.
+ *
+ * Per-hit loading is Go's shape ported faithfully: each page row loads
+ * its resource individually and converts through the kind's extractor;
+ * a row that fails to parse, load, or convert logs a warning and is
+ * SKIPPED — the request never fails over one bad row. (The N+1 read is
+ * disclosed in the PR — parity over optimization, laptop-scale by
+ * design.)
+ *
+ * Proven by __tests__/query-store.test.ts (Go's store test tables +
+ * the scope-filter matrix) and search.conformance.test.ts on local.
+ */
+import { fromBinary } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { goFields } from "../../gocompat/trim.js";
+import { apiResourceKindName } from "../../store/proto-fields.js";
+import { emptyResult, newSearchPagedResult } from "./paged-result.js";
+export class SqliteSearchQueryStore {
+    store;
+    registry;
+    logger;
+    constructor(store, registry, logger) {
+        this.store = store;
+        this.registry = registry;
+        this.logger = logger;
+    }
+    async search(criteria, authorizedIdsByKind) {
+        const effectiveKinds = criteria.effectiveKinds();
+        // A request naming only non-searchable kinds answers emptiness —
+        // never a discover fallback (stigmer/stigmer#440).
+        if (effectiveKinds.length === 0) {
+            return emptyResult();
+        }
+        const { countsByKind, totalCount, hits } = await this.store.querySearchIndex({
+            kinds: effectiveKinds.map((kind) => apiResourceKindName(kind)),
+            authorizedIdsByKind,
+            // Engine-neutral tokenization: whitespace terms via the gocompat
+            // twin of Go's strings.Fields (JS \s+ disagrees with Go on
+            // U+FEFF/U+0085 — the #8 BOM divergence class; criteria.query()
+            // is already goTrimSpace'd). Engine syntax is the driver's job.
+            terms: criteria.hasQuery() ? goFields(criteria.query()) : undefined,
+            orgFilter: criteria.orgFilter(),
+            crossOrgPublic: criteria.crossOrgPublic(),
+            excludePublic: criteria.excludePublic(),
+            limit: criteria.pageSize(),
+            offset: criteria.offset(),
+        });
+        if (totalCount === 0) {
+            return emptyResult();
+        }
+        const results = [];
+        for (const hit of hits) {
+            const kind = parseKind(hit.kind);
+            if (kind === undefined) {
+                this.logger.warn("Unknown resource kind in search index", {
+                    kind: hit.kind,
+                });
+                continue;
+            }
+            const result = await this.loadAndConvertResource(kind, hit.resourceId, hit.score);
+            if (result !== undefined) {
+                results.push(result);
+            }
+        }
+        return newSearchPagedResult(results, countsByKind, totalCount, criteria.pageSize());
+    }
+    /** Go loadAndConvertResource: load the hit, convert via its extractor. */
+    async loadAndConvertResource(kind, resourceId, score) {
+        const extractor = this.registry.getExtractor(kind);
+        if (extractor === undefined) {
+            this.logger.warn("Failed to load resource", {
+                kind: ApiResourceKind[kind],
+                id: resourceId,
+                error: "no SearchableExtractor registered",
+            });
+            return undefined;
+        }
+        try {
+            const resource = await this.store.getResource(kind, resourceId, extractor.schema);
+            return extractor.toSearchResult(resource, score);
+        }
+        catch (error) {
+            // A stale index row (resource deleted between the page query and
+            // this load) or a corrupt row: warn and skip, exactly Go.
+            this.logger.warn("Failed to load resource", {
+                kind: ApiResourceKind[kind],
+                id: resourceId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return undefined;
+        }
+    }
+    async rebuildIndex() {
+        this.logger.info("Rebuilding search index...");
+        await this.store.clearSearchIndex();
+        let totalIndexed = 0;
+        const indexErrors = [];
+        for (const kind of this.registry.supportedKinds()) {
+            try {
+                const count = await this.indexKind(kind);
+                totalIndexed += count;
+                this.logger.info("Indexed resources", {
+                    kind: ApiResourceKind[kind],
+                    count,
+                });
+            }
+            catch (error) {
+                this.logger.warn("Failed to index kind (continuing with remaining kinds)", {
+                    kind: ApiResourceKind[kind],
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                indexErrors.push(`${ApiResourceKind[kind]}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        if (indexErrors.length > 0) {
+            this.logger.warn("Search index rebuild completed with errors", {
+                total: totalIndexed,
+                failed_kinds: indexErrors.length,
+            });
+            throw new Error(`failed to index ${indexErrors.length} kind(s): ${indexErrors.join("; ")}`);
+        }
+        this.logger.info("Search index rebuild complete", { total: totalIndexed });
+        return totalIndexed;
+    }
+    /** Go indexKind: every row of the kind through its extractor. */
+    async indexKind(kind) {
+        const extractor = this.registry.getExtractor(kind);
+        if (extractor === undefined) {
+            // supportedKinds() only yields registered kinds; this arm guards
+            // the same impossible state Go's GetExtractor error return does.
+            throw new Error("no SearchableExtractor registered");
+        }
+        const rows = await this.store.listResources(kind);
+        let count = 0;
+        for (const data of rows) {
+            let resource;
+            try {
+                resource = fromBinary(extractor.schema, data);
+            }
+            catch (error) {
+                this.logger.warn("Failed to unmarshal resource", {
+                    kind: ApiResourceKind[kind],
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                continue;
+            }
+            const entry = extractor.getSearchIndexEntry(resource);
+            if (entry === undefined) {
+                continue;
+            }
+            // The resource ID rides the SearchResult projection (it has the
+            // metadata access) — Go's exact two-step.
+            const result = extractor.toSearchResult(resource, 1.0);
+            if (result === undefined) {
+                continue;
+            }
+            try {
+                await this.store.upsertSearchIndex(kind, result.id, entry);
+            }
+            catch (error) {
+                this.logger.warn("Failed to index resource", {
+                    kind: ApiResourceKind[kind],
+                    id: result.id,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                continue;
+            }
+            count += 1;
+        }
+        return count;
+    }
+}
+/** Go parseKind: the enum-name string back to the enum value. */
+export function parseKind(kindName) {
+    const value = ApiResourceKind[kindName];
+    return typeof value === "number" ? value : undefined;
+}
+//# sourceMappingURL=query-store.js.map

package/dist/query/search/query-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-store.js","sourceRoot":"","sources":["../../../src/query/search/query-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAItH,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAGlE,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAyBtE,MAAM,OAAO,sBAAsB;IAEd;IACA;IACA;IAHnB,YACmB,KAAY,EACZ,QAAoC,EACpC,MAAc;QAFd,UAAK,GAAL,KAAK,CAAO;QACZ,aAAQ,GAAR,QAAQ,CAA4B;QACpC,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,mBAA8D;QAE9D,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC;QACjD,iEAAiE;QACjE,mDAAmD;QACnD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,WAAW,EAAE,CAAC;QACvB,CAAC;QAED,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,GACtC,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;YAChC,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAC9D,mBAAmB;YACnB,iEAAiE;YACjE,2DAA2D;YAC3D,gEAAgE;YAChE,gEAAgE;YAChE,KAAK,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;YACnE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE;YAC/B,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE;YACzC,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE;YACvC,KAAK,EAAE,QAAQ,CAAC,QAAQ,EAAE;YAC1B,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;SAC1B,CAAC,CAAC;QAEL,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,WAAW,EAAE,CAAC;QACvB,CAAC;QAED,MAAM,OAAO,GAAmB,EAAE,CAAC;QACnC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;oBACxD,IAAI,EAAE,GAAG,CAAC,IAAI;iBACf,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAC9C,IAAI,EACJ,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,KAAK,CACV,CAAC;YACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,OAAO,oBAAoB,CACzB,OAAO,EACP,YAAY,EACZ,UAAU,EACV,QAAQ,CAAC,QAAQ,EAAE,CACpB,CAAC;IACJ,CAAC;IAED,0EAA0E;IAClE,KAAK,CAAC,sBAAsB,CAClC,IAAqB,EACrB,UAAkB,EAClB,KAAa;QAEb,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;gBAC1C,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;gBAC3B,EAAE,EAAE,UAAU;gBACd,KAAK,EAAE,mCAAmC;aAC3C,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAC3C,IAAI,EACJ,UAAU,EACV,SAAS,CAAC,MAAM,CACjB,CAAC;YACF,OAAO,SAAS,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,iEAAiE;YACjE,0DAA0D;YAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;gBAC1C,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;gBAC3B,EAAE,EAAE,UAAU;gBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC/C,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAEpC,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,MAAM,WAAW,GAAa,EAAE,CAAC;QAEjC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACzC,YAAY,IAAI,KAAK,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE;oBACpC,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;oBAC3B,KAAK;iBACN,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wDAAwD,EACxD;oBACE,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;oBAC3B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CACF,CAAC;gBACF,WAAW,CAAC,IAAI,CACd,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACtF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE;gBAC7D,KAAK,EAAE,YAAY;gBACnB,YAAY,EAAE,WAAW,CAAC,MAAM;aACjC,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CACb,mBAAmB,WAAW,CAAC,MAAM,aAAa,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3E,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3E,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,iEAAiE;IACzD,KAAK,CAAC,SAAS,CAAC,IAAqB;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,iEAAiE;YACjE,iEAAiE;YACjE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,IAAI,QAAQ,CAAC;YACb,IAAI,CAAC;gBACH,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;oBAC/C,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;oBAC3B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAG,SAAS,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,gEAAgE;YAChE,0CAA0C;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACvD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;oBAC3C,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;oBAC3B,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,iEAAiE;AACjE,MAAM,UAAU,SAAS,CAAC,QAAgB;IACxC,MAAM,KAAK,GAAI,eAAsD,CACnE,QAAQ,CACT,CAAC;IACF,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAyB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC"}

package/dist/query/search/registry.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Searchable-resource registry — ports
+ * pkg/query/search/extractor/registry.go with the composition-root idiom
+ * in place of Go's init() self-registration (house rule: no import side
+ * effects). The ENTIRE searchable surface is this one explicit list; a
+ * kind is searchable exactly when its extractor appears here AND kind_meta
+ * declares it search-indexed — the registry unit test pins the two sets
+ * equal (Go's #439 invariant, TS home).
+ *
+ * Duplicate registration throws at construction (Go panics at init).
+ * validateExpectedKinds is WARN-only at boot, exactly Go's posture
+ * (registry.go ValidateExpectedKinds; server.go:509): a missing extractor
+ * degrades that kind to unsearchable, never refuses boot.
+ *
+ * The project extractor is registered here by THIS sub-project (#14)
+ * although the project DOMAIN ports with #16 — boot RebuildIndex re-indexes
+ * every registered kind from the resources table, and an adopted Go
+ * database may already hold projects; without the extractor those rows
+ * would silently vanish from search (D4 #14 DD-D, owner-ratified).
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { Logger } from "../../boot/logger.js";
+import type { SearchableExtractor } from "./extractor.js";
+/** Go SearchableResourceRegistry — kind → extractor, read-only after build. */
+export declare class SearchableResourceRegistry {
+    private readonly extractors;
+    constructor(extractors: readonly SearchableExtractor[]);
+    /** Go GetExtractorOrNil — undefined when the kind is not registered. */
+    getExtractor(kind: ApiResourceKind): SearchableExtractor | undefined;
+    /**
+     * Go SupportedKinds: registered kinds sorted by their NAME strings —
+     * RebuildIndex's deterministic order. Code-unit `<`, not localeCompare:
+     * Go's sort is byte-wise on kind.String(), and locale collation could
+     * reorder names around `_` (not wire-visible, but log/error order is
+     * part of the operator-facing contract).
+     */
+    supportedKinds(): readonly ApiResourceKind[];
+    /**
+     * Go ValidateExpectedKinds (server.go:509): warn about searchable kinds
+     * with no extractor — those kinds are silently unsearchable — or log
+     * the healthy roster. Never throws: boot proceeds either way.
+     */
+    validateExpectedKinds(logger: Logger): void;
+}
+/**
+ * The production registry — every searchable kind's extractor, in one
+ * place. Growing the searchable surface = one entry here + the domain's
+ * extractor file (the registry test fails until both exist).
+ */
+export declare function newSearchableResourceRegistry(): SearchableResourceRegistry;
+//# sourceMappingURL=registry.d.ts.map

package/dist/query/search/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/query/search/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAetH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,+EAA+E;AAC/E,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoD;gBAEnE,UAAU,EAAE,SAAS,mBAAmB,EAAE;IAatD,wEAAwE;IACxE,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,mBAAmB,GAAG,SAAS;IAIpE;;;;;;OAMG;IACH,cAAc,IAAI,SAAS,eAAe,EAAE;IAQ5C;;;;OAIG;IACH,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;CAgB5C;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,IAAI,0BAA0B,CAgB1E"}

package/dist/query/search/registry.js

@@ -0,0 +1,108 @@
+/**
+ * Searchable-resource registry — ports
+ * pkg/query/search/extractor/registry.go with the composition-root idiom
+ * in place of Go's init() self-registration (house rule: no import side
+ * effects). The ENTIRE searchable surface is this one explicit list; a
+ * kind is searchable exactly when its extractor appears here AND kind_meta
+ * declares it search-indexed — the registry unit test pins the two sets
+ * equal (Go's #439 invariant, TS home).
+ *
+ * Duplicate registration throws at construction (Go panics at init).
+ * validateExpectedKinds is WARN-only at boot, exactly Go's posture
+ * (registry.go ValidateExpectedKinds; server.go:509): a missing extractor
+ * degrades that kind to unsearchable, never refuses boot.
+ *
+ * The project extractor is registered here by THIS sub-project (#14)
+ * although the project DOMAIN ports with #16 — boot RebuildIndex re-indexes
+ * every registered kind from the resources table, and an adopted Go
+ * database may already hold projects; without the extractor those rows
+ * would silently vanish from search (D4 #14 DD-D, owner-ratified).
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { agentSearchExtractor } from "../../domain/agent/search-extractor.js";
+import { agentExecutionSearchExtractor } from "../../domain/agentexecution/search-extractor.js";
+import { agentInstanceSearchExtractor } from "../../domain/agentinstance/search-extractor.js";
+import { environmentSearchExtractor } from "../../domain/environment/search-extractor.js";
+import { executionContextSearchExtractor } from "../../domain/executioncontext/search-extractor.js";
+import { mcpServerSearchExtractor } from "../../domain/mcpserver/search-extractor.js";
+import { organizationSearchExtractor } from "../../domain/organization/search-extractor.js";
+import { projectSearchExtractor } from "../../domain/project/search-extractor.js";
+import { sessionSearchExtractor } from "../../domain/session/search-extractor.js";
+import { skillSearchExtractor } from "../../domain/skill/search-extractor.js";
+import { workflowSearchExtractor } from "../../domain/workflow/search-extractor.js";
+import { workflowExecutionSearchExtractor } from "../../domain/workflowexecution/search-extractor.js";
+import { workflowInstanceSearchExtractor } from "../../domain/workflowinstance/search-extractor.js";
+import { searchIndexedKinds } from "./criteria.js";
+/** Go SearchableResourceRegistry — kind → extractor, read-only after build. */
+export class SearchableResourceRegistry {
+    extractors;
+    constructor(extractors) {
+        const map = new Map();
+        for (const extractor of extractors) {
+            if (map.has(extractor.kind)) {
+                throw new Error(`duplicate SearchableExtractor for kind ${ApiResourceKind[extractor.kind]}`);
+            }
+            map.set(extractor.kind, extractor);
+        }
+        this.extractors = map;
+    }
+    /** Go GetExtractorOrNil — undefined when the kind is not registered. */
+    getExtractor(kind) {
+        return this.extractors.get(kind);
+    }
+    /**
+     * Go SupportedKinds: registered kinds sorted by their NAME strings —
+     * RebuildIndex's deterministic order. Code-unit `<`, not localeCompare:
+     * Go's sort is byte-wise on kind.String(), and locale collation could
+     * reorder names around `_` (not wire-visible, but log/error order is
+     * part of the operator-facing contract).
+     */
+    supportedKinds() {
+        return [...this.extractors.keys()].sort((a, b) => {
+            const nameA = ApiResourceKind[a] ?? "";
+            const nameB = ApiResourceKind[b] ?? "";
+            return nameA < nameB ? -1 : nameA > nameB ? 1 : 0;
+        });
+    }
+    /**
+     * Go ValidateExpectedKinds (server.go:509): warn about searchable kinds
+     * with no extractor — those kinds are silently unsearchable — or log
+     * the healthy roster. Never throws: boot proceeds either way.
+     */
+    validateExpectedKinds(logger) {
+        const missing = searchIndexedKinds()
+            .filter((kind) => !this.extractors.has(kind))
+            .map((kind) => ApiResourceKind[kind] ?? String(kind));
+        if (missing.length > 0) {
+            logger.warn("SearchableResourceRegistry is missing extractors. These kinds will not be searchable.", { missing_kinds: missing });
+            return;
+        }
+        logger.info("SearchableResourceRegistry initialized successfully", {
+            count: this.extractors.size,
+            kinds: this.supportedKinds().map((kind) => ApiResourceKind[kind]),
+        });
+    }
+}
+/**
+ * The production registry — every searchable kind's extractor, in one
+ * place. Growing the searchable surface = one entry here + the domain's
+ * extractor file (the registry test fails until both exist).
+ */
+export function newSearchableResourceRegistry() {
+    return new SearchableResourceRegistry([
+        agentSearchExtractor,
+        agentExecutionSearchExtractor,
+        agentInstanceSearchExtractor,
+        environmentSearchExtractor,
+        executionContextSearchExtractor,
+        mcpServerSearchExtractor,
+        organizationSearchExtractor,
+        projectSearchExtractor,
+        sessionSearchExtractor,
+        skillSearchExtractor,
+        workflowSearchExtractor,
+        workflowExecutionSearchExtractor,
+        workflowInstanceSearchExtractor,
+    ]);
+}
+//# sourceMappingURL=registry.js.map

package/dist/query/search/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/query/search/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iDAAiD,CAAC;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,gDAAgD,CAAC;AAC9F,OAAO,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC1F,OAAO,EAAE,+BAA+B,EAAE,MAAM,mDAAmD,CAAC;AACpG,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAC5F,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EAAE,+BAA+B,EAAE,MAAM,mDAAmD,CAAC;AAEpG,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGnD,+EAA+E;AAC/E,MAAM,OAAO,0BAA0B;IACpB,UAAU,CAAoD;IAE/E,YAAY,UAA0C;QACpD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAwC,CAAC;QAC5D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CACb,0CAA0C,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAC5E,CAAC;YACJ,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;IACxB,CAAC;IAED,wEAAwE;IACxE,YAAY,CAAC,IAAqB;QAChC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;OAMG;IACH,cAAc;QACZ,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC/C,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvC,OAAO,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,qBAAqB,CAAC,MAAc;QAClC,MAAM,OAAO,GAAG,kBAAkB,EAAE;aACjC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;aAC5C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CACT,uFAAuF,EACvF,EAAE,aAAa,EAAE,OAAO,EAAE,CAC3B,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE;YACjE,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAC3B,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B;IAC3C,OAAO,IAAI,0BAA0B,CAAC;QACpC,oBAAoB;QACpB,6BAA6B;QAC7B,4BAA4B;QAC5B,0BAA0B;QAC1B,+BAA+B;QAC/B,wBAAwB;QACxB,2BAA2B;QAC3B,sBAAsB;QACtB,sBAAsB;QACtB,oBAAoB;QACpB,uBAAuB;QACvB,gCAAgC;QAChC,+BAA+B;KAChC,CAAC,CAAC;AACL,CAAC"}

package/dist/runnerauth/runner-credential-provider.d.ts

@@ -0,0 +1,279 @@
+/**
+ * The runner-credential provider seam — convergence program 20260826.02,
+ * blueprint/03 §6c, extracted with O5 (20260827.02). Lives in
+ * src/runnerauth beside the OSS implementation it fronts.
+ *
+ * Mint and verify PER CREDENTIAL LANE, where a lane is an implementation's
+ * own token_type vocabulary: OSS defines exactly one
+ * (TOKEN_TYPE_EXECUTION_SCOPED, runnerauth.ts); the cloud edition's
+ * session/workflow/connect/pool lanes stay entirely on its side of the
+ * seam (C4). The lane parameter is an open string DELIBERATELY — this
+ * contract must neither import cloud vocabulary into OSS nor pretend OSS
+ * has lanes it does not (the Q4 gate ruling).
+ *
+ * Per-arm fail posture, pinned precisely because the approved docs
+ * abbreviate it two different ways ("fail-closed" / "fail-soft") and the
+ * real contract is BOTH, per arm:
+ *
+ *   - verify fails CLOSED: any failure — forged, expired, wrong lane, a
+ *     lane the implementation does not provide — throws InvalidTokenError,
+ *     and the caller's only correct reaction is to fall back to redaction
+ *     (the executioncontext decrypt lane's posture, oss#535).
+ *   - mint on a PROVIDED lane without a signing key throws
+ *     MintingDisabledError, which the platform exchange RPC maps to the
+ *     presence-based "not minted" response the runner handles — degraded,
+ *     not fatal. Minting on a lane the implementation does NOT provide is
+ *     a composition bug, not a runtime condition: it throws a plain Error
+ *     naming the lane (the loud-fail doctrine).
+ *
+ * The OSS default (newExecutionScopedRunnerCredentialProvider) adapts
+ * RunnerAuthService unchanged — same key ladder, same HS256 tokens, same
+ * boot-fatal key posture owned by the composition root. Extensions
+ * substitute an implementation through the drivers registry point
+ * (extensions/drivers.ts); with none composed, behavior is byte-identical
+ * to the direct-service wiring this seam replaced.
+ *
+ * # The optional capability methods (C4, 20260827.09 — gate ruling Q1)
+ *
+ * Beyond the mint/verify primitives, an edition's runner credentials
+ * surface at four OSS-owned touchpoints whose POLICY is edition-specific:
+ * the platform scoped-token exchange, the bootstrap credential response,
+ * the token baked into a provisioned sandbox, and the ExecutionContext
+ * decrypt trust decision. Each is an OPTIONAL method here; each OSS call
+ * site falls back to today's exact behavior when the method is absent,
+ * and the OSS default provider defines none — empty-composition behavior
+ * is byte-identical by construction (the local conformance rosters pin
+ * it). One provider object carries the edition's whole credential story;
+ * the rejected alternative (a second single-instance driver for the
+ * exchange) split that story across two objects whose only consumer is
+ * the same composition.
+ *
+ * Capability implementations REFUSE by throwing (a ConnectError with the
+ * implementation's own byte-pinned copy — the gate-step refusal shape)
+ * and DEGRADE by returning their not-minted/empty results. The
+ * distinction is contract: a refusal fails the RPC, a degrade rides the
+ * presence-based response the runner already handles.
+ */
+import type { CallerIdentity } from "../extensions/identity.js";
+import type { MintedToken } from "./runnerauth.js";
+import { RunnerAuthService } from "./runnerauth.js";
+/**
+ * The domain shape of a getRunnerScopedToken request — one arm per proto
+ * scope (server_info.proto), transcribed so implementations never import
+ * wire types. The renewal arm is deliberately empty: every renewal
+ * parameter comes from the CALLER's verified credential, never the
+ * request (the Java exchange's ruled posture).
+ */
+export type RunnerScopedTokenRequest = {
+    readonly arm: "agent-execution";
+    readonly executionId: string;
+} | {
+    readonly arm: "workflow-execution";
+    readonly executionId: string;
+} | {
+    readonly arm: "pool-claim";
+    readonly sessionId: string;
+} | {
+    readonly arm: "renewal";
+} | {
+    readonly arm: "unset";
+};
+/**
+ * An exchange outcome: minted, or the presence-based "not minted" shape
+ * (empty output on the wire — the runner's degrade contract). Refusals
+ * are NOT an arm of this type: implementations throw them.
+ */
+export type RunnerScopedTokenExchange = {
+    readonly minted: false;
+} | {
+    readonly minted: true;
+    readonly token: string;
+    readonly expiresInSeconds: number;
+};
+/**
+ * The credential portion of a getRunnerBootstrapConfig response. Both
+ * arms are independently optional — the Java contract's presence-based
+ * coupling (token fields all-or-nothing, key fields all-or-nothing) is
+ * expressed structurally.
+ */
+export interface RunnerBootstrapCredentials {
+    readonly accessToken?: {
+        readonly token: string;
+        readonly expiresInSeconds: number;
+    };
+    readonly payloadKeys?: {
+        readonly keyId: string;
+        readonly keyBase64: string;
+        readonly secondaryKeyId?: string;
+        readonly secondaryKeyBase64?: string;
+    };
+}
+/**
+ * What the sandbox ensure steps know when they mint the credential baked
+ * into a provisioned sandbox (steps.ts). `sessionId` is empty on the
+ * workflow scope; `callerIdentityId` is empty when the invocation site
+ * has no caller (the Java ensure step's null-identity arm, which mints
+ * nothing rather than minting unattributed).
+ */
+export interface SandboxCredentialRequest {
+    readonly scope: "session" | "workflow";
+    readonly sessionId: string;
+    readonly executionId: string;
+    readonly org: string;
+    readonly callerIdentityId: string;
+}
+/**
+ * The memory-capture eligibility answer for one caller (the sixth
+ * capability, parity entry 20260830.05 — the Java
+ * MemoryCreateHandler.ResolveMemoryDefaults runner arm):
+ *
+ *   - `no-opinion`: the caller's credential is not one this
+ *     implementation classifies — the gate's own eligibility logic
+ *     applies unchanged.
+ *   - `refuse`: a runner-class credential outside the capture lane —
+ *     the gate answers its byte-pinned PERMISSION_DENIED copy.
+ *   - `admit`: the session-scoped capture lane. The implementation
+ *     hands over the token's own proved claims: the subject the record
+ *     belongs to (Java: "the sub IS the human subject the session
+ *     belongs to") and the session id provenance is overridden with
+ *     (server-proved beats runner-reported). Both are the
+ *     implementation's claim vocabulary — OSS never decodes them.
+ */
+export type MemoryCaptureDecision = {
+    readonly verdict: "no-opinion";
+} | {
+    readonly verdict: "refuse";
+} | {
+    readonly verdict: "admit";
+    readonly subjectIdentityAccountId: string;
+    readonly provedSessionId: string;
+};
+/**
+ * Mints and verifies runner credentials per lane. Implementations must be
+ * stateless-safe for concurrent use (they gate every ExecutionContext
+ * decrypt and every execution dispatch).
+ */
+export interface RunnerCredentialProvider {
+    /**
+     * Whether the implementation can currently mint for the lane — false
+     * for lanes it does not provide AND for provided lanes with no signing
+     * key. Callers that degrade on "cannot mint" (mcpserver connect) probe
+     * this instead of catching MintingDisabledError.
+     */
+    isEnabled(lane: string): boolean;
+    /**
+     * A credential on the given lane bound to `binding` (what the binding
+     * identifies is lane vocabulary — OSS's execution_scoped lane binds an
+     * execution id). ttlSeconds <= 0 selects the implementation default.
+     */
+    mint(lane: string, binding: string, ttlSeconds: number): MintedToken;
+    /**
+     * Verifies a credential against the ONE lane the caller accepts — the
+     * caller states its trust decision, the provider enforces it — and
+     * returns the binding. ANY failure throws InvalidTokenError.
+     */
+    verify(lane: string, token: string): string;
+    /**
+     * The whole getRunnerScopedToken policy: per-arm caller-class gating,
+     * authorization, and mint (the cloud edition's four-arm exchange).
+     * When present, the platform controller delegates EVERY arm here;
+     * absent, the controller keeps the OSS behavior (execution arms mint
+     * on the execution_scoped lane; pool-claim/renewal answer not-minted).
+     * Refusals throw; keyless degrade returns `{ minted: false }`.
+     */
+    exchangeScopedToken?(request: RunnerScopedTokenRequest, caller: CallerIdentity): Promise<RunnerScopedTokenExchange>;
+    /**
+     * The credential portion of getRunnerBootstrapConfig (the runner access
+     * token and per-identity payload-encryption keys). When present, the
+     * platform controller merges the result into the response; absent, the
+     * fields stay empty (the OSS posture — minting a proxy credential is a
+     * cloud capability). Both arms are best-effort by contract: a failure
+     * inside an arm degrades that arm to absent, never fails the bootstrap
+     * the Temporal coordinates ride on.
+     */
+    bootstrapCredentials?(caller: CallerIdentity): Promise<RunnerBootstrapCredentials>;
+    /**
+     * The credential baked into a provisioned sandbox (SandboxEnvironment.
+     * stigmerToken). When present, the ensure steps delegate here with the
+     * full provisioning context; absent, they mint on the execution_scoped
+     * lane exactly as before. Returns "" to launch tokenless (the
+     * redaction-fallback contract lane.ts documents); a thrown error
+     * propagates to the invoking step's own failure posture.
+     */
+    mintSandboxCredential?(request: SandboxCredentialRequest): string;
+    /**
+     * The ExecutionContext decrypt trust decision for getByExecutionId
+     * (`executionId` is the EC's spec.execution_id). When present, it IS
+     * the entire decision — the implementation owns its lane set and scope
+     * bindings (the cloud's session/workflow/connect scope rules, including
+     * any resource loads through its own clients); absent, the decrypt gate
+     * keeps the OSS decision (execution_scoped verify + binding equality).
+     * True decrypts; false redacts; never throws for an unrecognized or
+     * invalid token — redaction-as-success is the pinned contract.
+     */
+    authorizeExecutionContextRead?(rawToken: string, executionId: string): Promise<boolean>;
+    /**
+     * Decrypt-key material for a Temporal payload-encryption key id the
+     * server's env-configured codec does not hold (C4 Stage 2: the
+     * server-managed per-identity `rpk_` keys bootstrapCredentials hands
+     * out — resolution belongs on the same object that distributes them).
+     * Threaded into the server's decode-only payload codec at compose;
+     * consulted only when that codec is installed at all (env-keyed — the
+     * cloud composition always configures the platform key). Undefined
+     * means unknown: the codec keeps its pinned fail-closed throw. Absent
+     * method → today's exact behavior (static env keys only).
+     */
+    resolvePayloadKey?(keyId: string): Promise<Buffer | undefined>;
+    /**
+     * The workflow-lineage vouching decision for an agent-execution create
+     * that carries the runner-stamped lineage labels (parity entry
+     * 20260830.05; the Java RecordRunnerLineageLabelsStep, cloud#386,
+     * consumed by the agentexecution chain's RecordRunnerLineageLabels
+     * step). The implementation owns
+     * BOTH halves of the decision: whether the caller's credential is a
+     * runner credential at all (its own token-type vocabulary — no caller
+     * class expresses this, and OSS must not learn another edition's
+     * lane names), and whether a workflow-bound credential may stamp the
+     * given workflow execution id ("a workflow sandbox cannot stamp
+     * another workflow's lineage" — Java verifies the label against the
+     * token's own binding).
+     *
+     * Returns true to vouch the lineage keys (the guard then exempts
+     * exactly them), false for a non-runner credential (nothing vouched —
+     * the caller stays fully subject to the guard). REFUSES by throwing a
+     * ConnectError with the implementation's byte-pinned copy when the
+     * binding check fails. `stampedWorkflowExecutionId` is empty when the
+     * request stamped only the task label — no binding to check.
+     *
+     * Absent method → nothing is vouched (today's exact OSS behavior: the
+     * permissive default Authorizer is what admits the local runner's
+     * lineage write, and a strict composition without the capability keeps
+     * refusing).
+     */
+    vouchRunnerLineageLabels?(caller: CallerIdentity, stampedWorkflowExecutionId: string): boolean;
+    /**
+     * The memory capture-eligibility decision for one caller (parity entry
+     * 20260830.05, stigmer-cloud#564; the Java MemoryCreateHandler runner
+     * arm: admit `isSessionSandbox()`, refuse every other runner
+     * credential). Consulted by GuardMemoryCapture
+     * BEFORE its own eligibility logic; `no-opinion` falls through to
+     * that logic unchanged. REFUSES the org-mismatch arm by throwing a
+     * ConnectError with the implementation's byte-pinned copy (Java:
+     * "a mismatch is a forged address, not a routing choice" —
+     * `captureOrg` is the request's metadata.org, checked against the
+     * token's own org claim).
+     *
+     * Absent method → the gate's existing logic exactly (today's OSS
+     * behavior: the trusted-local single-user posture admits, honestly).
+     */
+    authorizeMemoryCapture?(caller: CallerIdentity, captureOrg: string): MemoryCaptureDecision;
+}
+/**
+ * The OSS default: RunnerAuthService behind the provider contract,
+ * providing only the execution_scoped lane. A separate adapter rather
+ * than the service implementing the interface: the service's concrete
+ * lane-free signatures are a stable test surface (and the O2 sub-project
+ * edits runnerauth.ts in parallel — this file keeps O5 out of it).
+ */
+export declare function newExecutionScopedRunnerCredentialProvider(service: RunnerAuthService): RunnerCredentialProvider;
+//# sourceMappingURL=runner-credential-provider.d.ts.map

package/dist/runnerauth/runner-credential-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-credential-provider.d.ts","sourceRoot":"","sources":["../../src/runnerauth/runner-credential-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAEL,iBAAiB,EAElB,MAAM,iBAAiB,CAAC;AAEzB;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GAM3B;IAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;CAAE,CAAC;AAE9B;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;CAAE,GAC1B;IACE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;KACnC,CAAC;IACF,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;KACtC,CAAC;CACH;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAA;CAAE,GAC9B;IACE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,CAAC;AAEN;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAAC;IACrE;;;;OAIG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAE5C;;;;;;;OAOG;IACH,mBAAmB,CAAC,CAClB,OAAO,EAAE,wBAAwB,EACjC,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEtC;;;;;;;;OAQG;IACH,oBAAoB,CAAC,CACnB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAEvC;;;;;;;OAOG;IACH,qBAAqB,CAAC,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CAAC;IAElE;;;;;;;;;OASG;IACH,6BAA6B,CAAC,CAC5B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAE/D;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,wBAAwB,CAAC,CACvB,MAAM,EAAE,cAAc,EACtB,0BAA0B,EAAE,MAAM,GACjC,OAAO,CAAC;IAEX;;;;;;;;;;;;;;OAcG;IACH,sBAAsB,CAAC,CACrB,MAAM,EAAE,cAAc,EACtB,UAAU,EAAE,MAAM,GACjB,qBAAqB,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CACxD,OAAO,EAAE,iBAAiB,GACzB,wBAAwB,CAoB1B"}