@stigmer/server 3.15.3-dev.20260914121148 → 3.16.0

package/dist/runnerauth/dispatch-credential.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The one reader of the provider's `mintRunCredential` capability for the
+ * two dispatch paths (temporal/agentexecution/engine-client.ts and
+ * temporal/workflowexecution/engine-client.ts). Both engines put the
+ * answer on the invoke workflow input as `execution_context_token` — the
+ * connect lane's key for the same token type (domain/mcpserver/engine.ts)
+ * — and omit the key when the answer is "".
+ *
+ * Three answers, one rule each:
+ *
+ *   - the capability is absent: "" — this edition's runner is
+ *     credentialed another way (the cloud bakes a sandbox credential at
+ *     provision; runner-credential-provider.ts). Nothing to log: it is
+ *     the composition's shape, not a condition.
+ *   - the capability answers "": "" — the lane cannot mint (keyless, the
+ *     modeled disabled state). The composition root makes a keyless
+ *     server boot-fatal, so this is a test-only arm in practice.
+ *   - the capability THROWS: one warning naming the execution, then "" —
+ *     a dispatch never fails because a credential could not be minted
+ *     (the connect lane's precedent, ruled 2026-09-16). The runner then
+ *     falls back to the platform exchange and, refused there for a run
+ *     that is not the key-holder's, reads redacted and fails the run
+ *     loudly at its first read — attributable, never silent. The default
+ *     provider throws only for an empty execution id (a programming
+ *     error), so this arm exists to be pinned, not expected.
+ *
+ * The credential is never logged: the warning carries the execution id
+ * and the error's message, and the engines' own "Started …" lines carry
+ * ids and queues (a test pins the field names). A run credential in a log
+ * line would let anyone who reads the log act as the run's human for as
+ * long as the run lives.
+ */
+import type { Logger } from "../boot/logger.js";
+import type { RunnerCredentialProvider } from "./runner-credential-provider.js";
+/** The dispatch's view of the seam: the one capability it reads. */
+export type RunCredentialMint = Pick<RunnerCredentialProvider, "mintRunCredential">;
+export declare function runCredentialForDispatch(credentials: RunCredentialMint, executionId: string, logger: Logger): string;
+//# sourceMappingURL=dispatch-credential.d.ts.map

package/dist/runnerauth/dispatch-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch-credential.d.ts","sourceRoot":"","sources":["../../src/runnerauth/dispatch-credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAEhF,oEAAoE;AACpE,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAClC,wBAAwB,EACxB,mBAAmB,CACpB,CAAC;AAEF,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,iBAAiB,EAC9B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,MAAM,CAiBR"}

package/dist/runnerauth/dispatch-credential.js

@@ -0,0 +1,17 @@
+export function runCredentialForDispatch(credentials, executionId, logger) {
+    const mintRunCredential = credentials.mintRunCredential?.bind(credentials);
+    if (mintRunCredential === undefined) {
+        return "";
+    }
+    try {
+        return mintRunCredential(executionId);
+    }
+    catch (error) {
+        logger.warn("Failed to mint the run credential — dispatching without it; the runner will fall back to the platform exchange", {
+            execution_id: executionId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return "";
+    }
+}
+//# sourceMappingURL=dispatch-credential.js.map

package/dist/runnerauth/dispatch-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch-credential.js","sourceRoot":"","sources":["../../src/runnerauth/dispatch-credential.ts"],"names":[],"mappings":"AAyCA,MAAM,UAAU,wBAAwB,CACtC,WAA8B,EAC9B,WAAmB,EACnB,MAAc;IAEd,MAAM,iBAAiB,GAAG,WAAW,CAAC,iBAAiB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3E,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT,gHAAgH,EAChH;YACE,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CACF,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/runnerauth/runner-credential-provider.d.ts

@@ -41,12 +41,26 @@
  * the token baked into a provisioned sandbox, and the ExecutionContext
  * decrypt trust decision. Each is an OPTIONAL method here; each OSS call
  * site falls back to today's exact behavior when the method is absent,
- * and the OSS default provider defines none — empty-composition behavior
- * is byte-identical by construction (the local conformance rosters pin
- * it). One provider object carries the edition's whole credential story;
- * the rejected alternative (a second single-instance driver for the
- * exchange) split that story across two objects whose only consumer is
- * the same composition.
+ * and the OSS default provider defines none of these POLICY capabilities
+ * — empty-composition behavior is byte-identical by construction (the
+ * local conformance rosters pin it). One provider object carries the
+ * edition's whole credential story; the rejected alternative (a second
+ * single-instance driver for the exchange) split that story across two
+ * objects whose only consumer is the same composition.
+ *
+ * One capability is open source's OWN and the default provider does
+ * define it: `mintRunCredential`, the run credential the dispatch path
+ * puts on every invoke workflow input (2026-09-16). It is optional on the
+ * seam for the same reason the others are — an edition whose runner
+ * credential rides another channel (the cloud's, minted at sandbox
+ * provision) leaves it undefined and its payloads carry nothing — but
+ * here the OSS default is the one that defines it, because the run
+ * credential is how an open-source runner acts for each run under the
+ * built-in authorization posture (runner-subject-verifier.ts). A unit
+ * that registers its own Authorizer but no provider of its own inherits
+ * this mint and composes no verifier for it; such a unit owns its
+ * credential story and must bring a provider, the rule the composition
+ * root already states for the verifier.
  *
  * Capability implementations REFUSE by throwing (a ConnectError with the
  * implementation's own byte-pinned copy — the gate-step refusal shape)
@@ -201,6 +215,22 @@ export interface RunnerCredentialProvider {
      * propagates to the invoking step's own failure posture.
      */
     mintSandboxCredential?(request: SandboxCredentialRequest): string;
+    /**
+     * The RUN credential the dispatch path hands the runner in the invoke
+     * workflow input (`execution_context_token` on both invoke inputs —
+     * the connect lane's key for the same token type). Bound to one
+     * execution and carrying NO `exp`: its validity is the bound row's
+     * liveness (runnerauth.ts `mintRunCredential`; bound-execution.ts),
+     * read by both lanes that accept it. When present, both engine clients
+     * call it for every dispatch (start, recover, signalWithStart); absent,
+     * the payload carries no credential — the edition's runner is
+     * credentialed another way (the cloud bakes a sandbox credential at
+     * provision). Returns "" to dispatch without a credential (the lane
+     * cannot mint — keyless); a thrown error is a real fault, which the
+     * dispatch reader (dispatch-credential.ts) logs and degrades to the
+     * same "" rather than failing the run's start.
+     */
+    mintRunCredential?(executionId: string): string;
     /**
      * The ExecutionContext decrypt trust decision for getByExecutionId
      * (`executionId` is the EC's spec.execution_id). When present, it IS
@@ -263,17 +293,25 @@ export interface RunnerCredentialProvider {
      * `captureOrg` is the request's metadata.org, checked against the
      * token's own org claim).
      *
+     * May answer synchronously or with a promise: the cloud's credential
+     * carries the subject and the session in its own claims, so its answer
+     * is a decode; open source's run credential names only the execution,
+     * so the built-in provider reads the execution row for its session and
+     * org (built-in-runner-credential-provider.ts). The gate awaits either.
+     *
      * Absent method → the gate's existing logic exactly (today's OSS
      * behavior: the trusted-local single-user posture admits, honestly).
      */
-    authorizeMemoryCapture?(caller: CallerIdentity, captureOrg: string): MemoryCaptureDecision;
+    authorizeMemoryCapture?(caller: CallerIdentity, captureOrg: string): MemoryCaptureDecision | Promise<MemoryCaptureDecision>;
 }
 /**
  * The OSS default: RunnerAuthService behind the provider contract,
- * providing only the execution_scoped lane. A separate adapter rather
- * than the service implementing the interface: the service's concrete
- * lane-free signatures are a stable test surface (and the O2 sub-project
- * edits runnerauth.ts in parallel — this file keeps O5 out of it).
+ * providing only the execution_scoped lane, plus the one capability that
+ * is open source's own — the run credential a dispatch carries (module
+ * header). A separate adapter rather than the service implementing the
+ * interface: the service's concrete lane-free signatures are a stable
+ * test surface (and the O2 sub-project edits runnerauth.ts in parallel —
+ * this file keeps O5 out of it).
  */
 export declare function newExecutionScopedRunnerCredentialProvider(service: RunnerAuthService): RunnerCredentialProvider;
 //# sourceMappingURL=runner-credential-provider.d.ts.map

package/dist/runnerauth/runner-credential-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner-credential-provider.d.ts","sourceRoot":"","sources":["../../src/runnerauth/runner-credential-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAEL,iBAAiB,EAElB,MAAM,iBAAiB,CAAC;AAEzB;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GAM3B;IAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;CAAE,CAAC;AAE9B;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;CAAE,GAC1B;IACE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;KACnC,CAAC;IACF,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;KACtC,CAAC;CACH;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAA;CAAE,GAC9B;IACE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,CAAC;AAEN;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAAC;IACrE;;;;OAIG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAE5C;;;;;;;OAOG;IACH,mBAAmB,CAAC,CAClB,OAAO,EAAE,wBAAwB,EACjC,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEtC;;;;;;;;OAQG;IACH,oBAAoB,CAAC,CACnB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAEvC;;;;;;;OAOG;IACH,qBAAqB,CAAC,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CAAC;IAElE;;;;;;;;;OASG;IACH,6BAA6B,CAAC,CAC5B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAE/D;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,wBAAwB,CAAC,CACvB,MAAM,EAAE,cAAc,EACtB,0BAA0B,EAAE,MAAM,GACjC,OAAO,CAAC;IAEX;;;;;;;;;;;;;;OAcG;IACH,sBAAsB,CAAC,CACrB,MAAM,EAAE,cAAc,EACtB,UAAU,EAAE,MAAM,GACjB,qBAAqB,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CACxD,OAAO,EAAE,iBAAiB,GACzB,wBAAwB,CAoB1B"}
+{"version":3,"file":"runner-credential-provider.d.ts","sourceRoot":"","sources":["../../src/runnerauth/runner-credential-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAEL,iBAAiB,EAElB,MAAM,iBAAiB,CAAC;AAEzB;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GAM3B;IAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;CAAE,CAAC;AAE9B;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;CAAE,GAC1B;IACE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;KACnC,CAAC;IACF,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;KACtC,CAAC;CACH;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAA;CAAE,GAC9B;IACE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,CAAC;AAEN;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAAC;IACrE;;;;OAIG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAE5C;;;;;;;OAOG;IACH,mBAAmB,CAAC,CAClB,OAAO,EAAE,wBAAwB,EACjC,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEtC;;;;;;;;OAQG;IACH,oBAAoB,CAAC,CACnB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAEvC;;;;;;;OAOG;IACH,qBAAqB,CAAC,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CAAC;IAElE;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAEhD;;;;;;;;;OASG;IACH,6BAA6B,CAAC,CAC5B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAE/D;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,wBAAwB,CAAC,CACvB,MAAM,EAAE,cAAc,EACtB,0BAA0B,EAAE,MAAM,GACjC,OAAO,CAAC;IAEX;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,sBAAsB,CAAC,CACrB,MAAM,EAAE,cAAc,EACtB,UAAU,EAAE,MAAM,GACjB,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CAC3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,0CAA0C,CACxD,OAAO,EAAE,iBAAiB,GACzB,wBAAwB,CA8B1B"}

package/dist/runnerauth/runner-credential-provider.js

@@ -1,10 +1,12 @@
 import { InvalidTokenError, TOKEN_TYPE_EXECUTION_SCOPED, } from "./runnerauth.js";
 /**
  * The OSS default: RunnerAuthService behind the provider contract,
- * providing only the execution_scoped lane. A separate adapter rather
- * than the service implementing the interface: the service's concrete
- * lane-free signatures are a stable test surface (and the O2 sub-project
- * edits runnerauth.ts in parallel — this file keeps O5 out of it).
+ * providing only the execution_scoped lane, plus the one capability that
+ * is open source's own — the run credential a dispatch carries (module
+ * header). A separate adapter rather than the service implementing the
+ * interface: the service's concrete lane-free signatures are a stable
+ * test surface (and the O2 sub-project edits runnerauth.ts in parallel —
+ * this file keeps O5 out of it).
  */
 export function newExecutionScopedRunnerCredentialProvider(service) {
     return {
@@ -23,6 +25,16 @@ export function newExecutionScopedRunnerCredentialProvider(service) {
             }
             return service.verify(token);
         },
+        mintRunCredential(executionId) {
+            // Keyless is the modeled disabled state (the exchange's fail-soft
+            // arm, the sandbox lane's tokenless launch): answer "" and let the
+            // dispatch go without. Anything else the service refuses is a
+            // programming error and propagates as itself.
+            if (!service.isEnabled()) {
+                return "";
+            }
+            return service.mintRunCredential(executionId);
+        },
     };
 }
 //# sourceMappingURL=runner-credential-provider.js.map

package/dist/runnerauth/runner-credential-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"runner-credential-provider.js","sourceRoot":"","sources":["../../src/runnerauth/runner-credential-provider.ts"],"names":[],"mappings":"AA0DA,OAAO,EACL,iBAAiB,EAEjB,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AA4OzB;;;;;;GAMG;AACH,MAAM,UAAU,0CAA0C,CACxD,OAA0B;IAE1B,OAAO;QACL,SAAS,CAAC,IAAY;YACpB,OAAO,IAAI,KAAK,2BAA2B,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,UAAkB;YACpD,IAAI,IAAI,KAAK,2BAA2B,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,uDAAuD,2BAA2B,IAAI,CACtH,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,CAAC,IAAY,EAAE,KAAa;YAChC,IAAI,IAAI,KAAK,2BAA2B,EAAE,CAAC;gBACzC,MAAM,IAAI,iBAAiB,EAAE,CAAC;YAChC,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"runner-credential-provider.js","sourceRoot":"","sources":["../../src/runnerauth/runner-credential-provider.ts"],"names":[],"mappings":"AAwEA,OAAO,EACL,iBAAiB,EAEjB,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AAmQzB;;;;;;;;GAQG;AACH,MAAM,UAAU,0CAA0C,CACxD,OAA0B;IAE1B,OAAO;QACL,SAAS,CAAC,IAAY;YACpB,OAAO,IAAI,KAAK,2BAA2B,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,UAAkB;YACpD,IAAI,IAAI,KAAK,2BAA2B,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,uDAAuD,2BAA2B,IAAI,CACtH,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,CAAC,IAAY,EAAE,KAAa;YAChC,IAAI,IAAI,KAAK,2BAA2B,EAAE,CAAC;gBACzC,MAAM,IAAI,iBAAiB,EAAE,CAAC;YAChC,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QACD,iBAAiB,CAAC,WAAmB;YACnC,kEAAkE;YAClE,mEAAmE;YACnE,8DAA8D;YAC9D,8CAA8C;YAC9C,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;gBACzB,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,OAAO,OAAO,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/runnerauth/runner-subject-verifier.d.ts

@@ -0,0 +1,14 @@
+import type { AccountsByCaller } from "../domain/identityaccount/resolve.js";
+import type { IdentityVerifier } from "../extensions/identity.js";
+import type { BoundExecutionStore } from "./bound-execution.js";
+import type { RunnerCredentialProvider } from "./runner-credential-provider.js";
+export interface RunnerSubjectVerifierDeps {
+    /** Where the executions live — one primary-key read per claimed token. */
+    readonly store: BoundExecutionStore;
+    /** The account port the creator stamp resolves through (by id, then by subject). */
+    readonly accounts: AccountsByCaller;
+    /** The provider whose execution_scoped lane signed the token — verification goes through the seam. */
+    readonly credentials: Pick<RunnerCredentialProvider, "verify">;
+}
+export declare function newRunnerSubjectIdentityVerifier(deps: RunnerSubjectVerifierDeps): IdentityVerifier;
+//# sourceMappingURL=runner-subject-verifier.d.ts.map

package/dist/runnerauth/runner-subject-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-subject-verifier.d.ts","sourceRoot":"","sources":["../../src/runnerauth/runner-subject-verifier.ts"],"names":[],"mappings":"AAwEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAMhE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAOhF,MAAM,WAAW,yBAAyB;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,sGAAsG;IACtG,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,wBAAwB,EAAE,QAAQ,CAAC,CAAC;CAChE;AAED,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,yBAAyB,GAC9B,gBAAgB,CAmClB"}

package/dist/runnerauth/runner-subject-verifier.js

@@ -0,0 +1,115 @@
+/**
+ * The runner-subject identity verifier — the third open-source entry on
+ * the chassis's verifier chain, composed under the built-in authorization
+ * posture ONLY (boot/compose.ts; authorization/posture.ts), between
+ * `apikey` and `oidc`. It admits the bearer of an execution-scoped runner
+ * token AS THE HUMAN WHO ASKED: for a run, the person the execution row's
+ * creator stamp names, for as long as that run lives; for an MCP
+ * connect, the person who asked for the connect, whose stamp the
+ * connect's ExecutionContext row carries for as long as that row exists
+ * — in the `runner` caller class either way (runnerauth.ts header: the
+ * lane the token gains under this posture; bound-execution.ts: the three
+ * bindings and what "lives" means for each).
+ *
+ * Why a verifier reads the store: the token is a capability for one
+ * execution, not an identity assertion. Its claims name only the
+ * binding; the server resolves the person from the row the way the
+ * schedule fire caller resolves a schedule's creator (`accountForStamp`:
+ * the account id stamped since 3.15.0, the raw issuer subject the 3.14.x
+ * verifiers stamped) and mints the account acting as itself
+ * (`accountAsRunnerCaller`), so the audit actor on every row the runner
+ * writes carries the person's email and display name that no token
+ * could. The API-key verifier is the precedent for a store-reading
+ * verifier (domain/apikey/verifier.ts: the key row, then the owner's
+ * account); this one pays the same two reads. No cache: a run that ends,
+ * or a connect that settles, stops admitting on the very next request.
+ *
+ * A token with no `exp` is a RUN credential and may bind only a run
+ * (`bindsARun`): no mint produces a clockless connect token, so one that
+ * arrives is refused as the credential it is not — the same predicate
+ * the decrypt lane falls closed on, one rule in one home.
+ *
+ * The execution's creator IS the session's owner on every path open
+ * source has today. `agent_execution.can_edit` derives from the SESSION's
+ * owner, not the execution's stamp, so the person this verifier admits
+ * must be the session's owner for the runner to report at all. They
+ * coincide because a session's `can_create_execution_in` is its viewers,
+ * and in open source a session has no viewer but its owner: the contract
+ * lists `viewer` as grantable on a session, but open source's grant scope
+ * is organization-only (domain/iampolicy/grant-scope.ts) and the session
+ * model derives no organization-wide viewer. A scheduled run is created
+ * as the schedule's creator, who owns the session the fire creates. The
+ * verifier test pins the grant-scope fact by name; an edition that grants
+ * `viewer` on sessions (the cloud does) has the cloud's own credential
+ * story, and a change to open source's scope must revisit this sentence.
+ *
+ * Claim rule: exactly `token_type === "execution_scoped"`, read from the
+ * UNTRUSTED payload (`peekTokenType`). Everything else passes — the
+ * API-key lane's `stk_`, the OIDC verifier's JWTs, garbage. The ORDER on
+ * the chain is the contract, not a detail: the OIDC verifier claims any
+ * JWT-shaped token and throws when it cannot verify one, and the server's
+ * own HS256 token is JWT-shaped, so composed after `oidc` this verifier
+ * would never see its own token; that is precisely what a 3.15.x
+ * self-host with sign-in on did (stigmer#1137: every agent execution
+ * failed INTERNAL). A token that names our type and fails the HMAC is
+ * CLAIMED and refused, never passed to a laxer verifier (the identity.ts
+ * contract); an OIDC-issued JWT never carries the claim, so there is no
+ * downgrade path.
+ *
+ * Refusals are UNAUTHENTICATED with exactly two sentences (constants.ts):
+ * the token sentence for anything wrong with the credential itself — the
+ * HMAC, a present `exp` in the past, a binding that names no kind or no
+ * row (the run is not the caller's to learn about, so never NOT_FOUND),
+ * a clockless token bound to a connect — and the liveness sentence for a
+ * genuine credential whose run is over or was created by nobody this
+ * server recognizes. A store fault propagates as the fault it is: the
+ * chassis maps it INTERNAL (pipeline/interceptors/auth.ts), so an outage
+ * never reads as a bad credential.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { accountAsRunnerCaller } from "../domain/identityaccount/actor.js";
+import { accountForStamp } from "../domain/identityaccount/resolve.js";
+import { bindsARun, loadBoundExecution } from "./bound-execution.js";
+import { RUNNER_CREDENTIAL_INVALID_MESSAGE, RUNNER_CREDENTIAL_NOT_LIVE_MESSAGE, RUNNER_VERIFIER_NAME, } from "./constants.js";
+import { isClockedToken, peekTokenType, TOKEN_TYPE_EXECUTION_SCOPED, } from "./runnerauth.js";
+export function newRunnerSubjectIdentityVerifier(deps) {
+    return {
+        name: RUNNER_VERIFIER_NAME,
+        async verify(token) {
+            if (peekTokenType(token) !== TOKEN_TYPE_EXECUTION_SCOPED) {
+                return null;
+            }
+            let executionId;
+            try {
+                executionId = deps.credentials.verify(TOKEN_TYPE_EXECUTION_SCOPED, token);
+            }
+            catch {
+                // Every verify failure is the one InvalidTokenError by contract;
+                // the sentence on the wire is ours, not the service's.
+                throw invalidCredential();
+            }
+            const execution = await loadBoundExecution(deps.store, executionId);
+            if (execution === undefined) {
+                throw invalidCredential();
+            }
+            if (!isClockedToken(token) && !bindsARun(execution.kind)) {
+                throw invalidCredential();
+            }
+            if (!execution.live) {
+                throw notLive();
+            }
+            const account = await accountForStamp(deps.accounts, execution.createdBy);
+            if (account === undefined) {
+                throw notLive();
+            }
+            return accountAsRunnerCaller(account, token);
+        },
+    };
+}
+function invalidCredential() {
+    return new ConnectError(RUNNER_CREDENTIAL_INVALID_MESSAGE, Code.Unauthenticated);
+}
+function notLive() {
+    return new ConnectError(RUNNER_CREDENTIAL_NOT_LIVE_MESSAGE, Code.Unauthenticated);
+}
+//# sourceMappingURL=runner-subject-verifier.js.map

package/dist/runnerauth/runner-subject-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-subject-verifier.js","sourceRoot":"","sources":["../../src/runnerauth/runner-subject-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAMvE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAErE,OAAO,EACL,iCAAiC,EACjC,kCAAkC,EAClC,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,cAAc,EACd,aAAa,EACb,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AAWzB,MAAM,UAAU,gCAAgC,CAC9C,IAA+B;IAE/B,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,2BAA2B,EAAE,CAAC;gBACzD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,WAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CACnC,2BAA2B,EAC3B,KAAK,CACN,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;gBACjE,uDAAuD;gBACvD,MAAM,iBAAiB,EAAE,CAAC;YAC5B,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YACpE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,iBAAiB,EAAE,CAAC;YAC5B,CAAC;YACD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzD,MAAM,iBAAiB,EAAE,CAAC;YAC5B,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;gBACpB,MAAM,OAAO,EAAE,CAAC;YAClB,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;YAC1E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,OAAO,EAAE,CAAC;YAClB,CAAC;YACD,OAAO,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,YAAY,CACrB,iCAAiC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;AACJ,CAAC;AAED,SAAS,OAAO;IACd,OAAO,IAAI,YAAY,CACrB,kCAAkC,EAClC,IAAI,CAAC,eAAe,CACrB,CAAC;AACJ,CAAC"}

package/dist/runnerauth/runnerauth.d.ts

@@ -57,10 +57,10 @@ export declare class RunnerAuthService {
     /**
      * Go NewServiceFromEnv: key via the shared ladder (env var → key file →
      * auto-generate). Errors only on unusable explicit configuration; the
-     * composition root maps that to the BOOT-FATAL posture (the ratified D2
-     * asymmetry: a server that cannot mint runner tokens would hand every
-     * execution redaction markers instead of its secrets — the silent-junk
-     * failure the oss#405 fail-loud doctrine forbids).
+     * composition root maps that to the BOOT-FATAL posture: a server that
+     * cannot mint runner tokens would hand every execution redaction markers
+     * instead of its secrets — the silent-junk failure the encryption work
+     * (stigmer#405) made fail-loud.
      */
     static fromEnv(options?: KeyLoaderOptions): RunnerAuthService;
     /** Go IsEnabled: whether the service holds a signing key. */
@@ -70,6 +70,14 @@ export declare class RunnerAuthService {
      * (DEFAULT_TTL_SECONDS when <= 0).
      */
     mint(executionId: string, ttlSeconds?: number): MintedToken;
+    /**
+     * The run credential: bound to `executionId`, with NO `exp` (see the
+     * header — a run outlives any clock; the row decides). The dispatch
+     * path mints it into the workflow input; only the string travels, since
+     * there is no lifetime to report.
+     */
+    mintRunCredential(executionId: string): string;
+    private signClaims;
     /**
      * Go Verify: checks signature, algorithm, expiry, and token type, and
      * returns the execution id the token is bound to. Any failure throws the
@@ -79,9 +87,30 @@ export declare class RunnerAuthService {
      * Check order mirrors Go: enabled → three parts → exact encoded-header
      * compare → constant-time HMAC → payload decode → claims. The expiry
      * boundary is `now >= exp` (a token in its expiring second is invalid).
+     * A token with no `exp` is a run credential and passes this check; a
+     * present `exp` that is not a number is a malformed clock and refuses.
      */
     verify(token: string): string;
     /** base64url HMAC-SHA256 of the signing input — Go sign(). */
     private sign;
 }
+/**
+ * The `token_type` claim read off an UNVERIFIED token, or undefined for
+ * anything that is not a three-segment token with a JSON payload naming
+ * one. This is the runner-subject verifier's claim rule (the chassis
+ * contract: decide "is this ours?" before trusting anything), so it must
+ * never throw and must trust nothing it reads — `verify` runs afterwards
+ * on a claimed token. It is NOT a shortcut for reading claims a caller
+ * intends to act on.
+ */
+export declare function peekTokenType(token: string): string | undefined;
+/**
+ * Whether a token this module has ALREADY verified carries a clock. The
+ * decrypt lane reads it to know which validity rule applies (a clocked
+ * token's clock was enforced by `verify`; a run credential's validity is
+ * the row's). Reading the payload of a verified token is a read of
+ * trusted state, the GuardMemoryCapture precedent; on anything `verify`
+ * has not accepted the answer is meaningless, so callers verify first.
+ */
+export declare function isClockedToken(verifiedToken: string): boolean;
 //# sourceMappingURL=runnerauth.d.ts.map

package/dist/runnerauth/runnerauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runnerauth.d.ts","sourceRoot":"","sources":["../../src/runnerauth/runnerauth.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,qBAAqB,CAAC;AAE9D,gEAAgE;AAChE,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE,iEAAiE;AACjE,eAAO,MAAM,0BAA0B,qBAAqB,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,OAAO,CAAC;AAExC;;;;;GAKG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;;CAK3C;AAED;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;;CAK9C;AAmBD,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;IAEzC,OAAO;IAIP;;;;OAIG;IACH,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB;IAOzD;;;;;;;OAOG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,gBAAqB,GAAG,iBAAiB;IASjE,6DAA6D;IAC7D,SAAS,IAAI,OAAO;IAIpB;;;OAGG;IACH,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,GAAE,MAAU,GAAG,WAAW;IAwB9D;;;;;;;;;OASG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAgD7B,8DAA8D;IAC9D,OAAO,CAAC,IAAI;CAQb"}
+{"version":3,"file":"runnerauth.d.ts","sourceRoot":"","sources":["../../src/runnerauth/runnerauth.ts"],"names":[],"mappings":"AAqEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,qBAAqB,CAAC;AAE9D,gEAAgE;AAChE,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE,iEAAiE;AACjE,eAAO,MAAM,0BAA0B,qBAAqB,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,OAAO,CAAC;AAExC;;;;;GAKG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;;CAK3C;AAED;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;;CAK9C;AAuBD,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;IAEzC,OAAO;IAIP;;;;OAIG;IACH,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB;IAOzD;;;;;;;OAOG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,gBAAqB,GAAG,iBAAiB;IASjE,6DAA6D;IAC7D,SAAS,IAAI,OAAO;IAIpB;;;OAGG;IACH,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,GAAE,MAAU,GAAG,WAAW;IAY9D;;;;;OAKG;IACH,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IAM9C,OAAO,CAAC,UAAU;IAsBlB;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAqD7B,8DAA8D;IAC9D,OAAO,CAAC,IAAI;CAQb;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAI/D;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAE7D"}