@stigmer/server 3.15.3-dev.20260916211208 → 3.16.0

package/dist/runnerauth/bound-execution.js

@@ -0,0 +1,137 @@
+import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { ExecutionContextSchema } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/api_pb";
+import { WorkflowExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { isTerminalExecutionPhase } from "../domain/agentexecution/phases.js";
+import { isConnectExecutionId } from "../domain/mcpserver/connect-execution-id.js";
+import { isTerminalWorkflowExecutionPhase } from "../domain/workflowexecution/phases.js";
+import { kindByIdPrefix } from "../pipeline/apiresource-meta.js";
+import { auditOf } from "../pipeline/steps/defaults.js";
+import { ResourceNotFoundError } from "../store/interface.js";
+import { RUN_CREDENTIAL_GRACE_AFTER_TERMINAL_MS } from "./constants.js";
+export function boundExecutionKindOf(executionId) {
+    switch (kindByIdPrefix(executionId)) {
+        case ApiResourceKind.agent_execution:
+            return "agent-execution";
+        case ApiResourceKind.workflow_execution:
+            return "workflow-execution";
+        default:
+            return isConnectExecutionId(executionId) ? "mcp-connect" : undefined;
+    }
+}
+/** Whether a binding of this kind is a RUN — the only thing a no-`exp` credential may name (see the header). */
+export function bindsARun(kind) {
+    switch (kind) {
+        case "agent-execution":
+        case "workflow-execution":
+            return true;
+        case "mcp-connect":
+            return false;
+        default: {
+            const exhaustive = kind;
+            throw new Error(`unknown bound execution kind ${String(exhaustive)}`);
+        }
+    }
+}
+/**
+ * Loads the bound execution's facts; `undefined` when the id names no
+ * binding kind or no row. `now` is injectable for the grace arms and
+ * defaults to the wall clock.
+ */
+export async function loadBoundExecution(store, executionId, now = Date.now()) {
+    const kind = boundExecutionKindOf(executionId);
+    if (kind === undefined) {
+        return undefined;
+    }
+    switch (kind) {
+        case "agent-execution": {
+            const row = await getRow(store, ApiResourceKind.agent_execution, executionId, AgentExecutionSchema);
+            if (row === undefined) {
+                return undefined;
+            }
+            return {
+                kind,
+                executionId,
+                org: row.metadata?.org ?? "",
+                createdBy: creatorStampOf(AgentExecutionSchema, row),
+                sessionId: row.spec?.sessionId ?? "",
+                live: isLive(row.status !== undefined &&
+                    isTerminalExecutionPhase(row.status.phase), row.status?.completedAt ?? "", now),
+            };
+        }
+        case "workflow-execution": {
+            const row = await getRow(store, ApiResourceKind.workflow_execution, executionId, WorkflowExecutionSchema);
+            if (row === undefined) {
+                return undefined;
+            }
+            return {
+                kind,
+                executionId,
+                org: row.metadata?.org ?? "",
+                createdBy: creatorStampOf(WorkflowExecutionSchema, row),
+                sessionId: "",
+                live: isLive(row.status !== undefined &&
+                    isTerminalWorkflowExecutionPhase(row.status.phase), row.status?.completedAt ?? "", now),
+            };
+        }
+        case "mcp-connect": {
+            // The connect's ExecutionContext, by the execution id it was
+            // created for — the same indexed read getByExecutionId makes. The
+            // row is deleted when the connect settles, so its presence is the
+            // liveness; the token's clock is enforced by `verify` before this.
+            const row = await getExecutionContextRow(store, executionId);
+            if (row === undefined) {
+                return undefined;
+            }
+            return {
+                kind,
+                executionId,
+                org: row.metadata?.org ?? "",
+                createdBy: creatorStampOf(ExecutionContextSchema, row),
+                sessionId: "",
+                live: true,
+            };
+        }
+        default: {
+            const exhaustive = kind;
+            throw new Error(`unknown bound execution kind ${String(exhaustive)}`);
+        }
+    }
+}
+/** A row with no status has not started, which is live. */
+function isLive(terminal, completedAt, now) {
+    if (!terminal) {
+        return true;
+    }
+    const finishedAt = Date.parse(completedAt);
+    if (Number.isNaN(finishedAt)) {
+        return false;
+    }
+    return now - finishedAt < RUN_CREDENTIAL_GRACE_AFTER_TERMINAL_MS;
+}
+function creatorStampOf(schema, row) {
+    return auditOf(schema, row)?.specAudit?.createdBy?.id ?? "";
+}
+async function getRow(store, kind, id, schema) {
+    try {
+        return await store.getResource(kind, id, schema);
+    }
+    catch (error) {
+        if (error instanceof ResourceNotFoundError) {
+            return undefined;
+        }
+        throw error;
+    }
+}
+async function getExecutionContextRow(store, executionId) {
+    try {
+        return await store.findByField(ApiResourceKind.execution_context, "spec.executionId", executionId, ExecutionContextSchema);
+    }
+    catch (error) {
+        if (error instanceof ResourceNotFoundError) {
+            return undefined;
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=bound-execution.js.map

package/dist/runnerauth/bound-execution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bound-execution.js","sourceRoot":"","sources":["../../src/runnerauth/bound-execution.ts"],"names":[],"mappings":"AAiEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,uBAAuB,EAAE,MAAM,gEAAgE,CAAC;AACzG,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,sCAAsC,EAAE,MAAM,gBAAgB,CAAC;AAwBxE,MAAM,UAAU,oBAAoB,CAClC,WAAmB;IAEnB,QAAQ,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;QACpC,KAAK,eAAe,CAAC,eAAe;YAClC,OAAO,iBAAiB,CAAC;QAC3B,KAAK,eAAe,CAAC,kBAAkB;YACrC,OAAO,oBAAoB,CAAC;QAC9B;YACE,OAAO,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,CAAC;AACH,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,SAAS,CAAC,IAAwB;IAChD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,iBAAiB,CAAC;QACvB,KAAK,oBAAoB;YACvB,OAAO,IAAI,CAAC;QACd,KAAK,aAAa;YAChB,OAAO,KAAK,CAAC;QACf,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,IAAI,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAA0B,EAC1B,WAAmB,EACnB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,IAAI,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,GAAG,GAAG,MAAM,MAAM,CACtB,KAAK,EACL,eAAe,CAAC,eAAe,EAC/B,WAAW,EACX,oBAAoB,CACrB,CAAC;YACF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO;gBACL,IAAI;gBACJ,WAAW;gBACX,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;gBAC5B,SAAS,EAAE,cAAc,CAAC,oBAAoB,EAAE,GAAG,CAAC;gBACpD,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE;gBACpC,IAAI,EAAE,MAAM,CACV,GAAG,CAAC,MAAM,KAAK,SAAS;oBACtB,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAC5C,GAAG,CAAC,MAAM,EAAE,WAAW,IAAI,EAAE,EAC7B,GAAG,CACJ;aACF,CAAC;QACJ,CAAC;QACD,KAAK,oBAAoB,CAAC,CAAC,CAAC;YAC1B,MAAM,GAAG,GAAG,MAAM,MAAM,CACtB,KAAK,EACL,eAAe,CAAC,kBAAkB,EAClC,WAAW,EACX,uBAAuB,CACxB,CAAC;YACF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO;gBACL,IAAI;gBACJ,WAAW;gBACX,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;gBAC5B,SAAS,EAAE,cAAc,CAAC,uBAAuB,EAAE,GAAG,CAAC;gBACvD,SAAS,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM,CACV,GAAG,CAAC,MAAM,KAAK,SAAS;oBACtB,gCAAgC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EACpD,GAAG,CAAC,MAAM,EAAE,WAAW,IAAI,EAAE,EAC7B,GAAG,CACJ;aACF,CAAC;QACJ,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,6DAA6D;YAC7D,kEAAkE;YAClE,kEAAkE;YAClE,mEAAmE;YACnE,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAC7D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO;gBACL,IAAI;gBACJ,WAAW;gBACX,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;gBAC5B,SAAS,EAAE,cAAc,CAAC,sBAAsB,EAAE,GAAG,CAAC;gBACtD,SAAS,EAAE,EAAE;gBACb,IAAI,EAAE,IAAI;aACX,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,IAAI,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,SAAS,MAAM,CAAC,QAAiB,EAAE,WAAmB,EAAE,GAAW;IACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,GAAG,GAAG,UAAU,GAAG,sCAAsC,CAAC;AACnE,CAAC;AAQD,SAAS,cAAc,CAAC,MAAsB,EAAE,GAAY;IAC1D,OAAO,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,MAAM,CAEnB,KAA0B,EAAE,IAAqB,EAAE,EAAU,EAAE,MAAY;IAC3E,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,KAA0B,EAC1B,WAAmB;IAEnB,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,WAAW,CAC5B,eAAe,CAAC,iBAAiB,EACjC,kBAAkB,EAClB,WAAW,EACX,sBAAsB,CACvB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/runnerauth/built-in-runner-credential-provider.d.ts

@@ -0,0 +1,28 @@
+import type { AccountsByCaller } from "../domain/identityaccount/resolve.js";
+import type { CallerIdentity } from "../extensions/identity.js";
+import type { BoundExecutionKind, BoundExecutionStore } from "./bound-execution.js";
+import type { RunnerCredentialProvider } from "./runner-credential-provider.js";
+import type { RunnerAuthService } from "./runnerauth.js";
+/** What a runner-class caller's credential is bound to. */
+export interface RunnerBinding {
+    readonly kind: BoundExecutionKind;
+    readonly executionId: string;
+}
+export interface BuiltInRunnerCredentialProviderDeps {
+    /** The service that signed every token this provider reads. */
+    readonly service: RunnerAuthService;
+    /** Where the bound executions live — the capture and exchange capabilities' one read each. */
+    readonly store: BoundExecutionStore;
+    /** Resolves a run's creator stamp to its person — the exchange's owner check, the verifier's reading. */
+    readonly accounts: AccountsByCaller;
+}
+/**
+ * The one reading of a runner's binding. `undefined` for anything that
+ * is not a runner-class caller holding a token this service signed whose
+ * binding names an execution kind; never a throw.
+ */
+export declare function runnerBindingOf(service: RunnerAuthService, caller: CallerIdentity): RunnerBinding | undefined;
+/** The lane-admission predicate: a runner acting for a WORKFLOW execution (the cloud's `workflow_sandbox`). */
+export declare function isWorkflowBoundRunner(service: RunnerAuthService, caller: CallerIdentity): boolean;
+export declare function newBuiltInRunnerCredentialProvider(deps: BuiltInRunnerCredentialProviderDeps): RunnerCredentialProvider;
+//# sourceMappingURL=built-in-runner-credential-provider.d.ts.map

package/dist/runnerauth/built-in-runner-credential-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"built-in-runner-credential-provider.d.ts","sourceRoot":"","sources":["../../src/runnerauth/built-in-runner-credential-provider.ts"],"names":[],"mappings":"AAkGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAQhE,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAM9B,OAAO,KAAK,EAEV,wBAAwB,EAGzB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,2DAA2D;AAC3D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,mCAAmC;IAClD,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,yGAAyG;IACzG,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,cAAc,GACrB,aAAa,GAAG,SAAS,CAY3B;AAED,+GAA+G;AAC/G,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,cAAc,GACrB,OAAO,CAET;AAkBD,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,mCAAmC,GACxC,wBAAwB,CA+G1B"}

package/dist/runnerauth/built-in-runner-credential-provider.js

@@ -0,0 +1,217 @@
+/**
+ * The built-in RunnerCredentialProvider — the open-source execution-scoped
+ * default (runner-credential-provider.ts) plus the three capabilities an
+ * ENFORCING self-host needs, composed under the built-in authorization
+ * posture beside the runner-subject verifier (boot/compose.ts). The
+ * cloud's shape, kept on purpose: one provider object carries the
+ * edition's whole credential story, so the composition root binds one
+ * thing and every OSS touchpoint that consults the seam sees the same
+ * policy. Mint, verify, isEnabled and the dispatch's `mintRunCredential`
+ * are the default provider's, byte for byte; under trusted-local the
+ * default alone is composed and none of what follows exists.
+ *
+ * ONE reading of "what is this runner bound to" — `runnerBindingOf` —
+ * feeds everything here and the Authorizer's lane admission
+ * (authorization/lane-admission.ts). It re-verifies the caller's own
+ * `rawToken` (the cloud's `verifiedClaims(caller.rawToken)` pattern: one
+ * HMAC, no store read) and reads the kind off the bound id's prefix
+ * through the contract's table (bound-execution.ts). It checks the
+ * caller CLASS first: the lane admission runs on every run-gate check
+ * for every caller, and only the runner-subject verifier mints `runner`,
+ * so a person costs nothing here. It never throws: a person, a runner
+ * holding no token, a token this server did not sign, or a binding that
+ * names no kind is simply "not a runner binding", and each caller
+ * answers its own default for that. A CONNECT binding (`mcp-connect`, a
+ * runner reading one discovery's secrets as the person who asked) IS a
+ * runner binding, and every capability below answers it by name: it is
+ * admitted on no run gate, vouches no lineage, captures no memory, and
+ * the exchange mints nothing for it.
+ *
+ * The capabilities, and where they follow or narrow the cloud:
+ *
+ *   - `vouchRunnerLineageLabels`: a WORKFLOW-bound runner vouches the two
+ *     lineage keys for its own workflow execution and REFUSES a stamp
+ *     naming another (the cloud's byte-pinned copy, constants.ts). Without
+ *     this, a self-host with sign-in on cannot run any workflow that
+ *     calls an agent: the child create's GuardReservedLabels asks the
+ *     Authorizer for `can_write_reserved_labels` on the platform object,
+ *     which the built-in Authorizer denies for everyone. NARROWER than the
+ *     cloud on purpose: the cloud vouches for every runner-class
+ *     credential and binds only its workflow lane; here an agent-bound
+ *     runner vouches nothing, because the workflow's `agent_call` activity
+ *     is the only producer of the lineage labels and it runs under the
+ *     workflow's credential (runner: activities/call-agent.ts). Nothing
+ *     observable diverges; do not widen this toward the cloud without a
+ *     producer that needs it.
+ *   - `authorizeMemoryCapture`: an AGENT-bound runner is ADMITTED with the
+ *     human the verifier resolved as the memory's subject — the row's one
+ *     principal under the model; without it every memory an enforcing
+ *     self-host writes belongs to nobody — and the run's session as the
+ *     proved provenance. The cloud reads both off its session-scoped
+ *     token; our token names only the execution, so this reads the row
+ *     (one primary-key read per `remember` call) and the seam allows the
+ *     promise. The cloud's org arm is kept: a capture addressed to an org
+ *     that is not the run's is "a forged address, not a routing choice"
+ *     (its byte-pinned copy). A workflow-bound runner is refused (the
+ *     cloud refuses every non-session lane); a person, or a runner whose
+ *     token does not verify, is no-opinion and the gate's own logic
+ *     applies. A run that has vanished between the verifier's read and
+ *     this one is refused: a memory the server cannot attribute to a run
+ *     must not be written as nobody's (fail closed).
+ *   - `exchangeScopedToken`: the platform exchange (getRunnerScopedToken)
+ *     becomes a MINT GATE. Under trusted-local the controller's own arms
+ *     mint a clocked decrypt-lane token for any caller naming an
+ *     execution, and that is harmless — the token unlocks a decrypt lane
+ *     and nothing more. Under this posture the same token IS an identity
+ *     (the verifier admits its bearer as the run's human), so minting
+ *     one for another person's run would be impersonation. The execution
+ *     arms therefore mint only for the run's own person — the account
+ *     the row's creator stamp resolves to, the same reading the verifier
+ *     makes — and mint the RUN credential (no `exp`; `expires_in_seconds`
+ *     0, the proto default), so under the posture there is one credential
+ *     shape and the exchange is the runner's true fallback for a dispatch
+ *     that carried none. The ladder is the platform's own: a row that
+ *     does not exist → NOT_FOUND with the load-first copy (what a `get`
+ *     on that id answers), a caller who is not the run's person, or a run
+ *     whose stamp names nobody → PERMISSION_DENIED with one sentence
+ *     (constants.ts). The id decides which execution kind is read (the
+ *     lane's rule everywhere); the request's arm only chooses the
+ *     not-found copy; an id that resolves to a CONNECT binding is
+ *     NOT_FOUND too, because the exchange mints run credentials and a
+ *     connect is not a run. Liveness is NOT judged at mint — both lanes that
+ *     accept the token judge it, by one rule (bound-execution.ts), and a
+ *     third judge here would be a divergence waiting to happen. The
+ *     pool-claim, renewal and unset arms answer not-minted, the
+ *     controller's arms verbatim; keyless answers not-minted too.
+ *
+ * Deliberately UNDEFINED here: `bootstrapCredentials`,
+ * `mintSandboxCredential`, `authorizeExecutionContextRead`,
+ * `resolvePayloadKey`. Their open-source arms stay where they are (the
+ * sandbox lane's mint, the decrypt lane's binding-equality decision);
+ * this provider adds policy an enforcing server lacks and takes over
+ * nothing that already works.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { accountForStamp } from "../domain/identityaccount/resolve.js";
+import { getKindName } from "../pipeline/apiresource-meta.js";
+import { notFoundError } from "../pipeline/errors.js";
+import { bindsARun, boundExecutionKindOf, loadBoundExecution, } from "./bound-execution.js";
+import { MEMORY_CAPTURE_ORG_MISMATCH_MESSAGE, RUN_CREDENTIAL_NOT_RUNS_PERSON_MESSAGE, WORKFLOW_LINEAGE_BINDING_MISMATCH_MESSAGE, } from "./constants.js";
+import { newExecutionScopedRunnerCredentialProvider } from "./runner-credential-provider.js";
+/**
+ * The one reading of a runner's binding. `undefined` for anything that
+ * is not a runner-class caller holding a token this service signed whose
+ * binding names an execution kind; never a throw.
+ */
+export function runnerBindingOf(service, caller) {
+    if (caller.callerClass !== "runner" || caller.rawToken === "") {
+        return undefined;
+    }
+    let executionId;
+    try {
+        executionId = service.verify(caller.rawToken);
+    }
+    catch {
+        return undefined;
+    }
+    const kind = boundExecutionKindOf(executionId);
+    return kind === undefined ? undefined : { kind, executionId };
+}
+/** The lane-admission predicate: a runner acting for a WORKFLOW execution (the cloud's `workflow_sandbox`). */
+export function isWorkflowBoundRunner(service, caller) {
+    return runnerBindingOf(service, caller)?.kind === "workflow-execution";
+}
+/** The kind name the not-found copy carries, by the request's arm (what a `get` on that kind would say). */
+function requestedKindName(arm) {
+    switch (arm) {
+        case "agent-execution":
+            return getKindName(ApiResourceKind.agent_execution);
+        case "workflow-execution":
+            return getKindName(ApiResourceKind.workflow_execution);
+        default: {
+            const exhaustive = arm;
+            throw new Error(`unhandled exchange arm: ${JSON.stringify(exhaustive)}`);
+        }
+    }
+}
+export function newBuiltInRunnerCredentialProvider(deps) {
+    const { service, store, accounts } = deps;
+    const lane = newExecutionScopedRunnerCredentialProvider(service);
+    const mintRunCredential = lane.mintRunCredential.bind(lane);
+    return {
+        isEnabled: lane.isEnabled,
+        mint: lane.mint,
+        verify: lane.verify,
+        mintRunCredential,
+        async exchangeScopedToken(request, caller) {
+            switch (request.arm) {
+                case "agent-execution":
+                case "workflow-execution": {
+                    if (request.executionId === "" || !service.isEnabled()) {
+                        return { minted: false };
+                    }
+                    const execution = await loadBoundExecution(store, request.executionId);
+                    // A connect binding is not a run: the exchange mints RUN
+                    // credentials, and the requested kind's row does not exist.
+                    if (execution === undefined || !bindsARun(execution.kind)) {
+                        throw notFoundError(requestedKindName(request.arm), request.executionId);
+                    }
+                    const person = await accountForStamp(accounts, execution.createdBy);
+                    if (person === undefined ||
+                        person.metadata?.id !== caller.identityId) {
+                        throw new ConnectError(RUN_CREDENTIAL_NOT_RUNS_PERSON_MESSAGE, Code.PermissionDenied);
+                    }
+                    return {
+                        minted: true,
+                        token: mintRunCredential(execution.executionId),
+                        // No `exp` on a run credential; 0 is the proto default and
+                        // the runner's acquire sites read no expiry from it.
+                        expiresInSeconds: 0,
+                    };
+                }
+                case "pool-claim":
+                case "renewal":
+                case "unset":
+                    return { minted: false };
+                default: {
+                    const exhaustive = request;
+                    throw new Error(`unhandled exchange arm: ${JSON.stringify(exhaustive)}`);
+                }
+            }
+        },
+        vouchRunnerLineageLabels(caller, stampedWorkflowExecutionId) {
+            const binding = runnerBindingOf(service, caller);
+            if (binding?.kind !== "workflow-execution") {
+                return false;
+            }
+            if (stampedWorkflowExecutionId !== "" &&
+                stampedWorkflowExecutionId !== binding.executionId) {
+                throw new ConnectError(WORKFLOW_LINEAGE_BINDING_MISMATCH_MESSAGE, Code.InvalidArgument);
+            }
+            return true;
+        },
+        async authorizeMemoryCapture(caller, captureOrg) {
+            const binding = runnerBindingOf(service, caller);
+            if (binding === undefined) {
+                return { verdict: "no-opinion" };
+            }
+            if (binding.kind !== "agent-execution") {
+                return { verdict: "refuse" };
+            }
+            const execution = await loadBoundExecution(store, binding.executionId);
+            if (execution === undefined) {
+                return { verdict: "refuse" };
+            }
+            if (captureOrg !== "" && captureOrg !== execution.org) {
+                throw new ConnectError(MEMORY_CAPTURE_ORG_MISMATCH_MESSAGE, Code.PermissionDenied);
+            }
+            return {
+                verdict: "admit",
+                subjectIdentityAccountId: caller.identityId,
+                provedSessionId: execution.sessionId,
+            };
+        },
+    };
+}
+//# sourceMappingURL=built-in-runner-credential-provider.js.map

package/dist/runnerauth/built-in-runner-credential-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"built-in-runner-credential-provider.js","sourceRoot":"","sources":["../../src/runnerauth/built-in-runner-credential-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4FG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAGvE,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EACL,SAAS,EACT,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EACL,mCAAmC,EACnC,sCAAsC,EACtC,yCAAyC,GAC1C,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EAAE,0CAA0C,EAAE,MAAM,iCAAiC,CAAC;AAkB7F;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,OAA0B,EAC1B,MAAsB;IAEtB,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAC/C,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAChE,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,qBAAqB,CACnC,OAA0B,EAC1B,MAAsB;IAEtB,OAAO,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,KAAK,oBAAoB,CAAC;AACzE,CAAC;AAED,4GAA4G;AAC5G,SAAS,iBAAiB,CACxB,GAA6C;IAE7C,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,iBAAiB;YACpB,OAAO,WAAW,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QACtD,KAAK,oBAAoB;YACvB,OAAO,WAAW,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC;QACzD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,GAAG,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,IAAyC;IAEzC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,0CAA0C,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,iBAAiB;QAEjB,KAAK,CAAC,mBAAmB,CACvB,OAAiC,EACjC,MAAsB;YAEtB,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;gBACpB,KAAK,iBAAiB,CAAC;gBACvB,KAAK,oBAAoB,CAAC,CAAC,CAAC;oBAC1B,IAAI,OAAO,CAAC,WAAW,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;wBACvD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;oBAC3B,CAAC;oBACD,MAAM,SAAS,GAAG,MAAM,kBAAkB,CACxC,KAAK,EACL,OAAO,CAAC,WAAW,CACpB,CAAC;oBACF,yDAAyD;oBACzD,4DAA4D;oBAC5D,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC1D,MAAM,aAAa,CACjB,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,EAC9B,OAAO,CAAC,WAAW,CACpB,CAAC;oBACJ,CAAC;oBACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;oBACpE,IACE,MAAM,KAAK,SAAS;wBACpB,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,MAAM,CAAC,UAAU,EACzC,CAAC;wBACD,MAAM,IAAI,YAAY,CACpB,sCAAsC,EACtC,IAAI,CAAC,gBAAgB,CACtB,CAAC;oBACJ,CAAC;oBACD,OAAO;wBACL,MAAM,EAAE,IAAI;wBACZ,KAAK,EAAE,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC;wBAC/C,2DAA2D;wBAC3D,qDAAqD;wBACrD,gBAAgB,EAAE,CAAC;qBACpB,CAAC;gBACJ,CAAC;gBACD,KAAK,YAAY,CAAC;gBAClB,KAAK,SAAS,CAAC;gBACf,KAAK,OAAO;oBACV,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;gBAC3B,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,UAAU,GAAU,OAAO,CAAC;oBAClC,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CACxD,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,wBAAwB,CACtB,MAAsB,EACtB,0BAAkC;YAElC,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACjD,IAAI,OAAO,EAAE,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBAC3C,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IACE,0BAA0B,KAAK,EAAE;gBACjC,0BAA0B,KAAK,OAAO,CAAC,WAAW,EAClD,CAAC;gBACD,MAAM,IAAI,YAAY,CACpB,yCAAyC,EACzC,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,sBAAsB,CAC1B,MAAsB,EACtB,UAAkB;YAElB,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACjD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACnC,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBACvC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;YAC/B,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YACvE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;YAC/B,CAAC;YACD,IAAI,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;gBACtD,MAAM,IAAI,YAAY,CACpB,mCAAmC,EACnC,IAAI,CAAC,gBAAgB,CACtB,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,OAAO;gBAChB,wBAAwB,EAAE,MAAM,CAAC,UAAU;gBAC3C,eAAe,EAAE,SAAS,CAAC,SAAS;aACrC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/runnerauth/constants.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The runner-subject lane's pinned names and copy — the one constants
+ * module for the runner-credential domain (the ts-server guideline:
+ * byte-pinned copy lives in one constants module per domain, never
+ * inline at the refusal site).
+ *
+ * Two refusal sentences for a PRESENTED credential, deliberately not
+ * more (the InvalidTokenError doctrine of runnerauth.ts: a finer reason
+ * invites branching on it). The runner is the only caller that ever
+ * presents a run credential, and the person reading these is its
+ * operator, in the runner's log:
+ *
+ *   - the TOKEN sentence: the credential itself is not one this server
+ *     will honor — forged, the wrong shape, bound to an execution or a
+ *     connect this server does not have (a connect's row is gone once
+ *     the connect settles), a clockless token bound to a connect (a shape
+ *     no mint produces), a present `exp` in the past, or minted by a key
+ *     this server does not hold. A missing row is this sentence and not
+ *     NOT_FOUND on purpose: the credential is invalid, and the run is
+ *     not the caller's to learn about.
+ *   - the LIVENESS sentence: the credential is genuine but its run is
+ *     over, or its run or connect was created by nobody this server
+ *     recognizes as a person (the schedule fire caller's
+ *     deterministic-refusal shape: no retry will make that run anyone's).
+ *
+ * And one for a REQUESTED credential — the platform exchange under the
+ * built-in posture (built-in-runner-credential-provider.ts), where the
+ * caller is a signed-in person asking for a run's credential and the
+ * answer is a permission, not a token verdict: only the person whose run
+ * it is may hold its credential. A run whose creator stamp names nobody
+ * gets the same sentence — no one is its person.
+ *
+ * The lineage mismatch copy is the cloud edition's, transcribed byte for
+ * byte (credentials/provider.ts in the composition; the Java
+ * RecordRunnerLineageLabelsStep before it) so the two editions refuse a
+ * mis-stamped lineage label with one sentence.
+ */
+/** The verifier's name in the boot log and in auth failures (the `oidc` / `apikey` precedent). */
+export declare const RUNNER_VERIFIER_NAME = "runner";
+/** The token arms: forged, wrong shape, unknown execution, past `exp`, keyless. */
+export declare const RUNNER_CREDENTIAL_INVALID_MESSAGE = "runner credential is not valid on this server";
+/** The resolution arms: a terminal execution; a run stamped by nobody the server recognizes. */
+export declare const RUNNER_CREDENTIAL_NOT_LIVE_MESSAGE = "runner credential names a run that is over or belongs to nobody this server recognizes";
+/** The exchange's refusal under the built-in posture: the caller is not the run's person (PERMISSION_DENIED). */
+export declare const RUN_CREDENTIAL_NOT_RUNS_PERSON_MESSAGE = "a run credential is minted only for the person whose run it is";
+/** The cloud's byte-pinned lineage refusal (the Java step's copy). */
+export declare const WORKFLOW_LINEAGE_BINDING_MISMATCH_MESSAGE = "workflow lineage label names a workflow execution this runner credential is not bound to";
+/** The cloud's byte-pinned org-mismatch refusal (MemoryPolicy.MEMORY_CAPTURE_ORG_MISMATCH_MESSAGE). */
+export declare const MEMORY_CAPTURE_ORG_MISMATCH_MESSAGE = "memory capture is scoped to the session's organization";
+/**
+ * How long a run credential outlives its run, measured from the row's
+ * `status.completed_at`. A run's credential is valid while the run is
+ * not terminal — runs wait on humans with no timeout, so no clock can
+ * bound them — and for this long after, because two legitimate runner
+ * writes land after the terminal stamp: the session-subject generation
+ * the workflow fires and does not await (issue #665), and a Temporal
+ * activity retried after its completion failed to reach the engine.
+ * Ten minutes covers one model call and one retry backoff; today's
+ * exchange-lane token outlives a run by up to an hour. A terminal row
+ * with no `completed_at` gets no grace: fail closed.
+ */
+export declare const RUN_CREDENTIAL_GRACE_AFTER_TERMINAL_MS: number;
+//# sourceMappingURL=constants.d.ts.map

package/dist/runnerauth/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/runnerauth/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,kGAAkG;AAClG,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C,mFAAmF;AACnF,eAAO,MAAM,iCAAiC,kDACG,CAAC;AAElD,gGAAgG;AAChG,eAAO,MAAM,kCAAkC,2FAC2C,CAAC;AAE3F,iHAAiH;AACjH,eAAO,MAAM,sCAAsC,mEACe,CAAC;AAEnE,sEAAsE;AACtE,eAAO,MAAM,yCAAyC,6FACsC,CAAC;AAE7F,uGAAuG;AACvG,eAAO,MAAM,mCAAmC,2DACU,CAAC;AAE3D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sCAAsC,QAAiB,CAAC"}

package/dist/runnerauth/constants.js

@@ -0,0 +1,63 @@
+/**
+ * The runner-subject lane's pinned names and copy — the one constants
+ * module for the runner-credential domain (the ts-server guideline:
+ * byte-pinned copy lives in one constants module per domain, never
+ * inline at the refusal site).
+ *
+ * Two refusal sentences for a PRESENTED credential, deliberately not
+ * more (the InvalidTokenError doctrine of runnerauth.ts: a finer reason
+ * invites branching on it). The runner is the only caller that ever
+ * presents a run credential, and the person reading these is its
+ * operator, in the runner's log:
+ *
+ *   - the TOKEN sentence: the credential itself is not one this server
+ *     will honor — forged, the wrong shape, bound to an execution or a
+ *     connect this server does not have (a connect's row is gone once
+ *     the connect settles), a clockless token bound to a connect (a shape
+ *     no mint produces), a present `exp` in the past, or minted by a key
+ *     this server does not hold. A missing row is this sentence and not
+ *     NOT_FOUND on purpose: the credential is invalid, and the run is
+ *     not the caller's to learn about.
+ *   - the LIVENESS sentence: the credential is genuine but its run is
+ *     over, or its run or connect was created by nobody this server
+ *     recognizes as a person (the schedule fire caller's
+ *     deterministic-refusal shape: no retry will make that run anyone's).
+ *
+ * And one for a REQUESTED credential — the platform exchange under the
+ * built-in posture (built-in-runner-credential-provider.ts), where the
+ * caller is a signed-in person asking for a run's credential and the
+ * answer is a permission, not a token verdict: only the person whose run
+ * it is may hold its credential. A run whose creator stamp names nobody
+ * gets the same sentence — no one is its person.
+ *
+ * The lineage mismatch copy is the cloud edition's, transcribed byte for
+ * byte (credentials/provider.ts in the composition; the Java
+ * RecordRunnerLineageLabelsStep before it) so the two editions refuse a
+ * mis-stamped lineage label with one sentence.
+ */
+/** The verifier's name in the boot log and in auth failures (the `oidc` / `apikey` precedent). */
+export const RUNNER_VERIFIER_NAME = "runner";
+/** The token arms: forged, wrong shape, unknown execution, past `exp`, keyless. */
+export const RUNNER_CREDENTIAL_INVALID_MESSAGE = "runner credential is not valid on this server";
+/** The resolution arms: a terminal execution; a run stamped by nobody the server recognizes. */
+export const RUNNER_CREDENTIAL_NOT_LIVE_MESSAGE = "runner credential names a run that is over or belongs to nobody this server recognizes";
+/** The exchange's refusal under the built-in posture: the caller is not the run's person (PERMISSION_DENIED). */
+export const RUN_CREDENTIAL_NOT_RUNS_PERSON_MESSAGE = "a run credential is minted only for the person whose run it is";
+/** The cloud's byte-pinned lineage refusal (the Java step's copy). */
+export const WORKFLOW_LINEAGE_BINDING_MISMATCH_MESSAGE = "workflow lineage label names a workflow execution this runner credential is not bound to";
+/** The cloud's byte-pinned org-mismatch refusal (MemoryPolicy.MEMORY_CAPTURE_ORG_MISMATCH_MESSAGE). */
+export const MEMORY_CAPTURE_ORG_MISMATCH_MESSAGE = "memory capture is scoped to the session's organization";
+/**
+ * How long a run credential outlives its run, measured from the row's
+ * `status.completed_at`. A run's credential is valid while the run is
+ * not terminal — runs wait on humans with no timeout, so no clock can
+ * bound them — and for this long after, because two legitimate runner
+ * writes land after the terminal stamp: the session-subject generation
+ * the workflow fires and does not await (issue #665), and a Temporal
+ * activity retried after its completion failed to reach the engine.
+ * Ten minutes covers one model call and one retry backoff; today's
+ * exchange-lane token outlives a run by up to an hour. A terminal row
+ * with no `completed_at` gets no grace: fail closed.
+ */
+export const RUN_CREDENTIAL_GRACE_AFTER_TERMINAL_MS = 10 * 60 * 1000;
+//# sourceMappingURL=constants.js.map

package/dist/runnerauth/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/runnerauth/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,kGAAkG;AAClG,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAE7C,mFAAmF;AACnF,MAAM,CAAC,MAAM,iCAAiC,GAC5C,+CAA+C,CAAC;AAElD,gGAAgG;AAChG,MAAM,CAAC,MAAM,kCAAkC,GAC7C,wFAAwF,CAAC;AAE3F,iHAAiH;AACjH,MAAM,CAAC,MAAM,sCAAsC,GACjD,gEAAgE,CAAC;AAEnE,sEAAsE;AACtE,MAAM,CAAC,MAAM,yCAAyC,GACpD,0FAA0F,CAAC;AAE7F,uGAAuG;AACvG,MAAM,CAAC,MAAM,mCAAmC,GAC9C,wDAAwD,CAAC;AAE3D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC"}

package/dist/runnerauth/dispatch-credential.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The one reader of the provider's `mintRunCredential` capability for the
+ * two dispatch paths (temporal/agentexecution/engine-client.ts and
+ * temporal/workflowexecution/engine-client.ts). Both engines put the
+ * answer on the invoke workflow input as `execution_context_token` — the
+ * connect lane's key for the same token type (domain/mcpserver/engine.ts)
+ * — and omit the key when the answer is "".
+ *
+ * Three answers, one rule each:
+ *
+ *   - the capability is absent: "" — this edition's runner is
+ *     credentialed another way (the cloud bakes a sandbox credential at
+ *     provision; runner-credential-provider.ts). Nothing to log: it is
+ *     the composition's shape, not a condition.
+ *   - the capability answers "": "" — the lane cannot mint (keyless, the
+ *     modeled disabled state). The composition root makes a keyless
+ *     server boot-fatal, so this is a test-only arm in practice.
+ *   - the capability THROWS: one warning naming the execution, then "" —
+ *     a dispatch never fails because a credential could not be minted
+ *     (the connect lane's precedent, ruled 2026-09-16). The runner then
+ *     falls back to the platform exchange and, refused there for a run
+ *     that is not the key-holder's, reads redacted and fails the run
+ *     loudly at its first read — attributable, never silent. The default
+ *     provider throws only for an empty execution id (a programming
+ *     error), so this arm exists to be pinned, not expected.
+ *
+ * The credential is never logged: the warning carries the execution id
+ * and the error's message, and the engines' own "Started …" lines carry
+ * ids and queues (a test pins the field names). A run credential in a log
+ * line would let anyone who reads the log act as the run's human for as
+ * long as the run lives.
+ */
+import type { Logger } from "../boot/logger.js";
+import type { RunnerCredentialProvider } from "./runner-credential-provider.js";
+/** The dispatch's view of the seam: the one capability it reads. */
+export type RunCredentialMint = Pick<RunnerCredentialProvider, "mintRunCredential">;
+export declare function runCredentialForDispatch(credentials: RunCredentialMint, executionId: string, logger: Logger): string;
+//# sourceMappingURL=dispatch-credential.d.ts.map

package/dist/runnerauth/dispatch-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch-credential.d.ts","sourceRoot":"","sources":["../../src/runnerauth/dispatch-credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAEhF,oEAAoE;AACpE,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAClC,wBAAwB,EACxB,mBAAmB,CACpB,CAAC;AAEF,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,iBAAiB,EAC9B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,MAAM,CAiBR"}

package/dist/runnerauth/dispatch-credential.js

@@ -0,0 +1,17 @@
+export function runCredentialForDispatch(credentials, executionId, logger) {
+    const mintRunCredential = credentials.mintRunCredential?.bind(credentials);
+    if (mintRunCredential === undefined) {
+        return "";
+    }
+    try {
+        return mintRunCredential(executionId);
+    }
+    catch (error) {
+        logger.warn("Failed to mint the run credential — dispatching without it; the runner will fall back to the platform exchange", {
+            execution_id: executionId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return "";
+    }
+}
+//# sourceMappingURL=dispatch-credential.js.map

package/dist/runnerauth/dispatch-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch-credential.js","sourceRoot":"","sources":["../../src/runnerauth/dispatch-credential.ts"],"names":[],"mappings":"AAyCA,MAAM,UAAU,wBAAwB,CACtC,WAA8B,EAC9B,WAAmB,EACnB,MAAc;IAEd,MAAM,iBAAiB,GAAG,WAAW,CAAC,iBAAiB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3E,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT,gHAAgH,EAChH;YACE,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CACF,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}