@stigmer/server 3.15.3-dev.20260916211208 → 3.16.0

package/dist/runnerauth/runner-credential-provider.d.ts

@@ -41,12 +41,26 @@
  * the token baked into a provisioned sandbox, and the ExecutionContext
  * decrypt trust decision. Each is an OPTIONAL method here; each OSS call
  * site falls back to today's exact behavior when the method is absent,
- * and the OSS default provider defines none — empty-composition behavior
- * is byte-identical by construction (the local conformance rosters pin
- * it). One provider object carries the edition's whole credential story;
- * the rejected alternative (a second single-instance driver for the
- * exchange) split that story across two objects whose only consumer is
- * the same composition.
+ * and the OSS default provider defines none of these POLICY capabilities
+ * — empty-composition behavior is byte-identical by construction (the
+ * local conformance rosters pin it). One provider object carries the
+ * edition's whole credential story; the rejected alternative (a second
+ * single-instance driver for the exchange) split that story across two
+ * objects whose only consumer is the same composition.
+ *
+ * One capability is open source's OWN and the default provider does
+ * define it: `mintRunCredential`, the run credential the dispatch path
+ * puts on every invoke workflow input (2026-09-16). It is optional on the
+ * seam for the same reason the others are — an edition whose runner
+ * credential rides another channel (the cloud's, minted at sandbox
+ * provision) leaves it undefined and its payloads carry nothing — but
+ * here the OSS default is the one that defines it, because the run
+ * credential is how an open-source runner acts for each run under the
+ * built-in authorization posture (runner-subject-verifier.ts). A unit
+ * that registers its own Authorizer but no provider of its own inherits
+ * this mint and composes no verifier for it; such a unit owns its
+ * credential story and must bring a provider, the rule the composition
+ * root already states for the verifier.
  *
  * Capability implementations REFUSE by throwing (a ConnectError with the
  * implementation's own byte-pinned copy — the gate-step refusal shape)
@@ -201,6 +215,22 @@ export interface RunnerCredentialProvider {
      * propagates to the invoking step's own failure posture.
      */
     mintSandboxCredential?(request: SandboxCredentialRequest): string;
+    /**
+     * The RUN credential the dispatch path hands the runner in the invoke
+     * workflow input (`execution_context_token` on both invoke inputs —
+     * the connect lane's key for the same token type). Bound to one
+     * execution and carrying NO `exp`: its validity is the bound row's
+     * liveness (runnerauth.ts `mintRunCredential`; bound-execution.ts),
+     * read by both lanes that accept it. When present, both engine clients
+     * call it for every dispatch (start, recover, signalWithStart); absent,
+     * the payload carries no credential — the edition's runner is
+     * credentialed another way (the cloud bakes a sandbox credential at
+     * provision). Returns "" to dispatch without a credential (the lane
+     * cannot mint — keyless); a thrown error is a real fault, which the
+     * dispatch reader (dispatch-credential.ts) logs and degrades to the
+     * same "" rather than failing the run's start.
+     */
+    mintRunCredential?(executionId: string): string;
     /**
      * The ExecutionContext decrypt trust decision for getByExecutionId
      * (`executionId` is the EC's spec.execution_id). When present, it IS
@@ -263,17 +293,25 @@ export interface RunnerCredentialProvider {
      * `captureOrg` is the request's metadata.org, checked against the
      * token's own org claim).
      *
+     * May answer synchronously or with a promise: the cloud's credential
+     * carries the subject and the session in its own claims, so its answer
+     * is a decode; open source's run credential names only the execution,
+     * so the built-in provider reads the execution row for its session and
+     * org (built-in-runner-credential-provider.ts). The gate awaits either.
+     *
      * Absent method → the gate's existing logic exactly (today's OSS
      * behavior: the trusted-local single-user posture admits, honestly).
      */
-    authorizeMemoryCapture?(caller: CallerIdentity, captureOrg: string): MemoryCaptureDecision;
+    authorizeMemoryCapture?(caller: CallerIdentity, captureOrg: string): MemoryCaptureDecision | Promise<MemoryCaptureDecision>;
 }
 /**
  * The OSS default: RunnerAuthService behind the provider contract,
- * providing only the execution_scoped lane. A separate adapter rather
- * than the service implementing the interface: the service's concrete
- * lane-free signatures are a stable test surface (and the O2 sub-project
- * edits runnerauth.ts in parallel — this file keeps O5 out of it).
+ * providing only the execution_scoped lane, plus the one capability that
+ * is open source's own — the run credential a dispatch carries (module
+ * header). A separate adapter rather than the service implementing the
+ * interface: the service's concrete lane-free signatures are a stable
+ * test surface (and the O2 sub-project edits runnerauth.ts in parallel —
+ * this file keeps O5 out of it).
  */
 export declare function newExecutionScopedRunnerCredentialProvider(service: RunnerAuthService): RunnerCredentialProvider;
 //# sourceMappingURL=runner-credential-provider.d.ts.map

package/dist/runnerauth/runner-credential-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner-credential-provider.d.ts","sourceRoot":"","sources":["../../src/runnerauth/runner-credential-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAEL,iBAAiB,EAElB,MAAM,iBAAiB,CAAC;AAEzB;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GAM3B;IAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;CAAE,CAAC;AAE9B;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;CAAE,GAC1B;IACE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;KACnC,CAAC;IACF,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;KACtC,CAAC;CACH;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAA;CAAE,GAC9B;IACE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,CAAC;AAEN;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAAC;IACrE;;;;OAIG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAE5C;;;;;;;OAOG;IACH,mBAAmB,CAAC,CAClB,OAAO,EAAE,wBAAwB,EACjC,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEtC;;;;;;;;OAQG;IACH,oBAAoB,CAAC,CACnB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAEvC;;;;;;;OAOG;IACH,qBAAqB,CAAC,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CAAC;IAElE;;;;;;;;;OASG;IACH,6BAA6B,CAAC,CAC5B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAE/D;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,wBAAwB,CAAC,CACvB,MAAM,EAAE,cAAc,EACtB,0BAA0B,EAAE,MAAM,GACjC,OAAO,CAAC;IAEX;;;;;;;;;;;;;;OAcG;IACH,sBAAsB,CAAC,CACrB,MAAM,EAAE,cAAc,EACtB,UAAU,EAAE,MAAM,GACjB,qBAAqB,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CACxD,OAAO,EAAE,iBAAiB,GACzB,wBAAwB,CAoB1B"}
+{"version":3,"file":"runner-credential-provider.d.ts","sourceRoot":"","sources":["../../src/runnerauth/runner-credential-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAEL,iBAAiB,EAElB,MAAM,iBAAiB,CAAC;AAEzB;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GAM3B;IAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;CAAE,CAAC;AAE9B;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;CAAE,GAC1B;IACE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;KACnC,CAAC;IACF,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;KACtC,CAAC;CACH;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAA;CAAE,GAC9B;IACE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,CAAC;AAEN;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAAC;IACrE;;;;OAIG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAE5C;;;;;;;OAOG;IACH,mBAAmB,CAAC,CAClB,OAAO,EAAE,wBAAwB,EACjC,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEtC;;;;;;;;OAQG;IACH,oBAAoB,CAAC,CACnB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAEvC;;;;;;;OAOG;IACH,qBAAqB,CAAC,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CAAC;IAElE;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAEhD;;;;;;;;;OASG;IACH,6BAA6B,CAAC,CAC5B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAE/D;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,wBAAwB,CAAC,CACvB,MAAM,EAAE,cAAc,EACtB,0BAA0B,EAAE,MAAM,GACjC,OAAO,CAAC;IAEX;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,sBAAsB,CAAC,CACrB,MAAM,EAAE,cAAc,EACtB,UAAU,EAAE,MAAM,GACjB,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CAC3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,0CAA0C,CACxD,OAAO,EAAE,iBAAiB,GACzB,wBAAwB,CA8B1B"}

package/dist/runnerauth/runner-credential-provider.js

@@ -1,10 +1,12 @@
 import { InvalidTokenError, TOKEN_TYPE_EXECUTION_SCOPED, } from "./runnerauth.js";
 /**
  * The OSS default: RunnerAuthService behind the provider contract,
- * providing only the execution_scoped lane. A separate adapter rather
- * than the service implementing the interface: the service's concrete
- * lane-free signatures are a stable test surface (and the O2 sub-project
- * edits runnerauth.ts in parallel — this file keeps O5 out of it).
+ * providing only the execution_scoped lane, plus the one capability that
+ * is open source's own — the run credential a dispatch carries (module
+ * header). A separate adapter rather than the service implementing the
+ * interface: the service's concrete lane-free signatures are a stable
+ * test surface (and the O2 sub-project edits runnerauth.ts in parallel —
+ * this file keeps O5 out of it).
  */
 export function newExecutionScopedRunnerCredentialProvider(service) {
     return {
@@ -23,6 +25,16 @@ export function newExecutionScopedRunnerCredentialProvider(service) {
             }
             return service.verify(token);
         },
+        mintRunCredential(executionId) {
+            // Keyless is the modeled disabled state (the exchange's fail-soft
+            // arm, the sandbox lane's tokenless launch): answer "" and let the
+            // dispatch go without. Anything else the service refuses is a
+            // programming error and propagates as itself.
+            if (!service.isEnabled()) {
+                return "";
+            }
+            return service.mintRunCredential(executionId);
+        },
     };
 }
 //# sourceMappingURL=runner-credential-provider.js.map

package/dist/runnerauth/runner-credential-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"runner-credential-provider.js","sourceRoot":"","sources":["../../src/runnerauth/runner-credential-provider.ts"],"names":[],"mappings":"AA0DA,OAAO,EACL,iBAAiB,EAEjB,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AA4OzB;;;;;;GAMG;AACH,MAAM,UAAU,0CAA0C,CACxD,OAA0B;IAE1B,OAAO;QACL,SAAS,CAAC,IAAY;YACpB,OAAO,IAAI,KAAK,2BAA2B,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,UAAkB;YACpD,IAAI,IAAI,KAAK,2BAA2B,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,uDAAuD,2BAA2B,IAAI,CACtH,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,CAAC,IAAY,EAAE,KAAa;YAChC,IAAI,IAAI,KAAK,2BAA2B,EAAE,CAAC;gBACzC,MAAM,IAAI,iBAAiB,EAAE,CAAC;YAChC,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"runner-credential-provider.js","sourceRoot":"","sources":["../../src/runnerauth/runner-credential-provider.ts"],"names":[],"mappings":"AAwEA,OAAO,EACL,iBAAiB,EAEjB,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AAmQzB;;;;;;;;GAQG;AACH,MAAM,UAAU,0CAA0C,CACxD,OAA0B;IAE1B,OAAO;QACL,SAAS,CAAC,IAAY;YACpB,OAAO,IAAI,KAAK,2BAA2B,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,UAAkB;YACpD,IAAI,IAAI,KAAK,2BAA2B,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,uDAAuD,2BAA2B,IAAI,CACtH,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,CAAC,IAAY,EAAE,KAAa;YAChC,IAAI,IAAI,KAAK,2BAA2B,EAAE,CAAC;gBACzC,MAAM,IAAI,iBAAiB,EAAE,CAAC;YAChC,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QACD,iBAAiB,CAAC,WAAmB;YACnC,kEAAkE;YAClE,mEAAmE;YACnE,8DAA8D;YAC9D,8CAA8C;YAC9C,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;gBACzB,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,OAAO,OAAO,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/runnerauth/runner-subject-verifier.d.ts

@@ -0,0 +1,14 @@
+import type { AccountsByCaller } from "../domain/identityaccount/resolve.js";
+import type { IdentityVerifier } from "../extensions/identity.js";
+import type { BoundExecutionStore } from "./bound-execution.js";
+import type { RunnerCredentialProvider } from "./runner-credential-provider.js";
+export interface RunnerSubjectVerifierDeps {
+    /** Where the executions live — one primary-key read per claimed token. */
+    readonly store: BoundExecutionStore;
+    /** The account port the creator stamp resolves through (by id, then by subject). */
+    readonly accounts: AccountsByCaller;
+    /** The provider whose execution_scoped lane signed the token — verification goes through the seam. */
+    readonly credentials: Pick<RunnerCredentialProvider, "verify">;
+}
+export declare function newRunnerSubjectIdentityVerifier(deps: RunnerSubjectVerifierDeps): IdentityVerifier;
+//# sourceMappingURL=runner-subject-verifier.d.ts.map

package/dist/runnerauth/runner-subject-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-subject-verifier.d.ts","sourceRoot":"","sources":["../../src/runnerauth/runner-subject-verifier.ts"],"names":[],"mappings":"AAwEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAMhE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAOhF,MAAM,WAAW,yBAAyB;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,sGAAsG;IACtG,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,wBAAwB,EAAE,QAAQ,CAAC,CAAC;CAChE;AAED,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,yBAAyB,GAC9B,gBAAgB,CAmClB"}

package/dist/runnerauth/runner-subject-verifier.js

@@ -0,0 +1,115 @@
+/**
+ * The runner-subject identity verifier — the third open-source entry on
+ * the chassis's verifier chain, composed under the built-in authorization
+ * posture ONLY (boot/compose.ts; authorization/posture.ts), between
+ * `apikey` and `oidc`. It admits the bearer of an execution-scoped runner
+ * token AS THE HUMAN WHO ASKED: for a run, the person the execution row's
+ * creator stamp names, for as long as that run lives; for an MCP
+ * connect, the person who asked for the connect, whose stamp the
+ * connect's ExecutionContext row carries for as long as that row exists
+ * — in the `runner` caller class either way (runnerauth.ts header: the
+ * lane the token gains under this posture; bound-execution.ts: the three
+ * bindings and what "lives" means for each).
+ *
+ * Why a verifier reads the store: the token is a capability for one
+ * execution, not an identity assertion. Its claims name only the
+ * binding; the server resolves the person from the row the way the
+ * schedule fire caller resolves a schedule's creator (`accountForStamp`:
+ * the account id stamped since 3.15.0, the raw issuer subject the 3.14.x
+ * verifiers stamped) and mints the account acting as itself
+ * (`accountAsRunnerCaller`), so the audit actor on every row the runner
+ * writes carries the person's email and display name that no token
+ * could. The API-key verifier is the precedent for a store-reading
+ * verifier (domain/apikey/verifier.ts: the key row, then the owner's
+ * account); this one pays the same two reads. No cache: a run that ends,
+ * or a connect that settles, stops admitting on the very next request.
+ *
+ * A token with no `exp` is a RUN credential and may bind only a run
+ * (`bindsARun`): no mint produces a clockless connect token, so one that
+ * arrives is refused as the credential it is not — the same predicate
+ * the decrypt lane falls closed on, one rule in one home.
+ *
+ * The execution's creator IS the session's owner on every path open
+ * source has today. `agent_execution.can_edit` derives from the SESSION's
+ * owner, not the execution's stamp, so the person this verifier admits
+ * must be the session's owner for the runner to report at all. They
+ * coincide because a session's `can_create_execution_in` is its viewers,
+ * and in open source a session has no viewer but its owner: the contract
+ * lists `viewer` as grantable on a session, but open source's grant scope
+ * is organization-only (domain/iampolicy/grant-scope.ts) and the session
+ * model derives no organization-wide viewer. A scheduled run is created
+ * as the schedule's creator, who owns the session the fire creates. The
+ * verifier test pins the grant-scope fact by name; an edition that grants
+ * `viewer` on sessions (the cloud does) has the cloud's own credential
+ * story, and a change to open source's scope must revisit this sentence.
+ *
+ * Claim rule: exactly `token_type === "execution_scoped"`, read from the
+ * UNTRUSTED payload (`peekTokenType`). Everything else passes — the
+ * API-key lane's `stk_`, the OIDC verifier's JWTs, garbage. The ORDER on
+ * the chain is the contract, not a detail: the OIDC verifier claims any
+ * JWT-shaped token and throws when it cannot verify one, and the server's
+ * own HS256 token is JWT-shaped, so composed after `oidc` this verifier
+ * would never see its own token; that is precisely what a 3.15.x
+ * self-host with sign-in on did (stigmer#1137: every agent execution
+ * failed INTERNAL). A token that names our type and fails the HMAC is
+ * CLAIMED and refused, never passed to a laxer verifier (the identity.ts
+ * contract); an OIDC-issued JWT never carries the claim, so there is no
+ * downgrade path.
+ *
+ * Refusals are UNAUTHENTICATED with exactly two sentences (constants.ts):
+ * the token sentence for anything wrong with the credential itself — the
+ * HMAC, a present `exp` in the past, a binding that names no kind or no
+ * row (the run is not the caller's to learn about, so never NOT_FOUND),
+ * a clockless token bound to a connect — and the liveness sentence for a
+ * genuine credential whose run is over or was created by nobody this
+ * server recognizes. A store fault propagates as the fault it is: the
+ * chassis maps it INTERNAL (pipeline/interceptors/auth.ts), so an outage
+ * never reads as a bad credential.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { accountAsRunnerCaller } from "../domain/identityaccount/actor.js";
+import { accountForStamp } from "../domain/identityaccount/resolve.js";
+import { bindsARun, loadBoundExecution } from "./bound-execution.js";
+import { RUNNER_CREDENTIAL_INVALID_MESSAGE, RUNNER_CREDENTIAL_NOT_LIVE_MESSAGE, RUNNER_VERIFIER_NAME, } from "./constants.js";
+import { isClockedToken, peekTokenType, TOKEN_TYPE_EXECUTION_SCOPED, } from "./runnerauth.js";
+export function newRunnerSubjectIdentityVerifier(deps) {
+    return {
+        name: RUNNER_VERIFIER_NAME,
+        async verify(token) {
+            if (peekTokenType(token) !== TOKEN_TYPE_EXECUTION_SCOPED) {
+                return null;
+            }
+            let executionId;
+            try {
+                executionId = deps.credentials.verify(TOKEN_TYPE_EXECUTION_SCOPED, token);
+            }
+            catch {
+                // Every verify failure is the one InvalidTokenError by contract;
+                // the sentence on the wire is ours, not the service's.
+                throw invalidCredential();
+            }
+            const execution = await loadBoundExecution(deps.store, executionId);
+            if (execution === undefined) {
+                throw invalidCredential();
+            }
+            if (!isClockedToken(token) && !bindsARun(execution.kind)) {
+                throw invalidCredential();
+            }
+            if (!execution.live) {
+                throw notLive();
+            }
+            const account = await accountForStamp(deps.accounts, execution.createdBy);
+            if (account === undefined) {
+                throw notLive();
+            }
+            return accountAsRunnerCaller(account, token);
+        },
+    };
+}
+function invalidCredential() {
+    return new ConnectError(RUNNER_CREDENTIAL_INVALID_MESSAGE, Code.Unauthenticated);
+}
+function notLive() {
+    return new ConnectError(RUNNER_CREDENTIAL_NOT_LIVE_MESSAGE, Code.Unauthenticated);
+}
+//# sourceMappingURL=runner-subject-verifier.js.map

package/dist/runnerauth/runner-subject-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-subject-verifier.js","sourceRoot":"","sources":["../../src/runnerauth/runner-subject-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAMvE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAErE,OAAO,EACL,iCAAiC,EACjC,kCAAkC,EAClC,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,cAAc,EACd,aAAa,EACb,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AAWzB,MAAM,UAAU,gCAAgC,CAC9C,IAA+B;IAE/B,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,2BAA2B,EAAE,CAAC;gBACzD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,WAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CACnC,2BAA2B,EAC3B,KAAK,CACN,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;gBACjE,uDAAuD;gBACvD,MAAM,iBAAiB,EAAE,CAAC;YAC5B,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YACpE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,iBAAiB,EAAE,CAAC;YAC5B,CAAC;YACD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzD,MAAM,iBAAiB,EAAE,CAAC;YAC5B,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;gBACpB,MAAM,OAAO,EAAE,CAAC;YAClB,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;YAC1E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,OAAO,EAAE,CAAC;YAClB,CAAC;YACD,OAAO,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,YAAY,CACrB,iCAAiC,EACjC,IAAI,CAAC,eAAe,CACrB,CAAC;AACJ,CAAC;AAED,SAAS,OAAO;IACd,OAAO,IAAI,YAAY,CACrB,kCAAkC,EAClC,IAAI,CAAC,eAAe,CACrB,CAAC;AACJ,CAAC"}

package/dist/runnerauth/runnerauth.d.ts

@@ -57,10 +57,10 @@ export declare class RunnerAuthService {
     /**
      * Go NewServiceFromEnv: key via the shared ladder (env var → key file →
      * auto-generate). Errors only on unusable explicit configuration; the
-     * composition root maps that to the BOOT-FATAL posture (the ratified D2
-     * asymmetry: a server that cannot mint runner tokens would hand every
-     * execution redaction markers instead of its secrets — the silent-junk
-     * failure the oss#405 fail-loud doctrine forbids).
+     * composition root maps that to the BOOT-FATAL posture: a server that
+     * cannot mint runner tokens would hand every execution redaction markers
+     * instead of its secrets — the silent-junk failure the encryption work
+     * (stigmer#405) made fail-loud.
      */
     static fromEnv(options?: KeyLoaderOptions): RunnerAuthService;
     /** Go IsEnabled: whether the service holds a signing key. */
@@ -70,6 +70,14 @@ export declare class RunnerAuthService {
      * (DEFAULT_TTL_SECONDS when <= 0).
      */
     mint(executionId: string, ttlSeconds?: number): MintedToken;
+    /**
+     * The run credential: bound to `executionId`, with NO `exp` (see the
+     * header — a run outlives any clock; the row decides). The dispatch
+     * path mints it into the workflow input; only the string travels, since
+     * there is no lifetime to report.
+     */
+    mintRunCredential(executionId: string): string;
+    private signClaims;
     /**
      * Go Verify: checks signature, algorithm, expiry, and token type, and
      * returns the execution id the token is bound to. Any failure throws the
@@ -79,9 +87,30 @@ export declare class RunnerAuthService {
      * Check order mirrors Go: enabled → three parts → exact encoded-header
      * compare → constant-time HMAC → payload decode → claims. The expiry
      * boundary is `now >= exp` (a token in its expiring second is invalid).
+     * A token with no `exp` is a run credential and passes this check; a
+     * present `exp` that is not a number is a malformed clock and refuses.
      */
     verify(token: string): string;
     /** base64url HMAC-SHA256 of the signing input — Go sign(). */
     private sign;
 }
+/**
+ * The `token_type` claim read off an UNVERIFIED token, or undefined for
+ * anything that is not a three-segment token with a JSON payload naming
+ * one. This is the runner-subject verifier's claim rule (the chassis
+ * contract: decide "is this ours?" before trusting anything), so it must
+ * never throw and must trust nothing it reads — `verify` runs afterwards
+ * on a claimed token. It is NOT a shortcut for reading claims a caller
+ * intends to act on.
+ */
+export declare function peekTokenType(token: string): string | undefined;
+/**
+ * Whether a token this module has ALREADY verified carries a clock. The
+ * decrypt lane reads it to know which validity rule applies (a clocked
+ * token's clock was enforced by `verify`; a run credential's validity is
+ * the row's). Reading the payload of a verified token is a read of
+ * trusted state, the GuardMemoryCapture precedent; on anything `verify`
+ * has not accepted the answer is meaningless, so callers verify first.
+ */
+export declare function isClockedToken(verifiedToken: string): boolean;
 //# sourceMappingURL=runnerauth.d.ts.map

package/dist/runnerauth/runnerauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runnerauth.d.ts","sourceRoot":"","sources":["../../src/runnerauth/runnerauth.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,qBAAqB,CAAC;AAE9D,gEAAgE;AAChE,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE,iEAAiE;AACjE,eAAO,MAAM,0BAA0B,qBAAqB,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,OAAO,CAAC;AAExC;;;;;GAKG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;;CAK3C;AAED;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;;CAK9C;AAmBD,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;IAEzC,OAAO;IAIP;;;;OAIG;IACH,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB;IAOzD;;;;;;;OAOG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,gBAAqB,GAAG,iBAAiB;IASjE,6DAA6D;IAC7D,SAAS,IAAI,OAAO;IAIpB;;;OAGG;IACH,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,GAAE,MAAU,GAAG,WAAW;IAwB9D;;;;;;;;;OASG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAgD7B,8DAA8D;IAC9D,OAAO,CAAC,IAAI;CAQb"}
+{"version":3,"file":"runnerauth.d.ts","sourceRoot":"","sources":["../../src/runnerauth/runnerauth.ts"],"names":[],"mappings":"AAqEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,qBAAqB,CAAC;AAE9D,gEAAgE;AAChE,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE,iEAAiE;AACjE,eAAO,MAAM,0BAA0B,qBAAqB,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,OAAO,CAAC;AAExC;;;;;GAKG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;;CAK3C;AAED;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;;CAK9C;AAuBD,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;IAEzC,OAAO;IAIP;;;;OAIG;IACH,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB;IAOzD;;;;;;;OAOG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,gBAAqB,GAAG,iBAAiB;IASjE,6DAA6D;IAC7D,SAAS,IAAI,OAAO;IAIpB;;;OAGG;IACH,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,GAAE,MAAU,GAAG,WAAW;IAY9D;;;;;OAKG;IACH,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IAM9C,OAAO,CAAC,UAAU;IAsBlB;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAqD7B,8DAA8D;IAC9D,OAAO,CAAC,IAAI;CAQb;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAI/D;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAE7D"}

package/dist/runnerauth/runnerauth.js

@@ -1,34 +1,67 @@
 /**
  * Execution-scoped runner tokens — ports pkg/runnerauth/runnerauth.go
- * (oss#535), the lane that gates the ExecutionContext decrypt path.
+ * (oss#535): one HS256 token type, bound to ONE execution, serving two
+ * lanes that the server's posture decides between.
  *
  * WHY: since oss#535 the EC read RPCs redact is_secret values for every
  * caller — the same contract the cloud edition enforces — but the runner
  * still needs the real values to serve executions. Cloud distinguishes the
- * runner by the token_type claim of its platform-minted credential; OSS
- * ships no token VERIFIERS on its identity chassis (O2, 20260827.01 — the
- * verifier chain exists but resolves every request to the trusted-local
- * identity until O3 lands the first verifiers), so this module supplies
- * the minimal equivalent: the platform exchange mints a short-lived token
- * bound to ONE execution, and the EC handler decrypts only for a token
- * whose binding matches the requested ExecutionContext.
+ * runner by the token_type claim of its platform-minted credential; this
+ * module is the open-source equivalent: a token whose binding names the
+ * execution it serves, and the EC handler decrypts only for a token whose
+ * binding matches the requested ExecutionContext.
  *
- * A LANE DISCRIMINATOR, NOT A TRUST BOUNDARY (DD-004): in the trusted-local
- * posture anyone who can reach the server can mint. What the token buys is
- * the redaction-by-default read contract converging with cloud, on top of
- * oss#405's encryption at rest. It is deliberately NOT an IdentityVerifier
- * on the chassis: presenting it must never change the caller's identity
- * (the Q6 fall-through keeps the runner's Bearer-on-every-RPC behavior
- * byte-identical), only unlock this one decrypt lane.
+ * THE TWO LANES, BY POSTURE. Until 2026-09-16 this header stated the
+ * token was "deliberately NOT an IdentityVerifier on the chassis:
+ * presenting it must never change the caller's identity". That sentence
+ * described a server that did not enforce authorization: with the
+ * permissive Authorizer, the runner's operator key could do everything,
+ * so the token only needed to unlock one decrypt lane. Under the built-in
+ * authorization posture (an OIDC self-host; authorization/posture.ts) the
+ * server enforces the cloud's model, and a runner keyed with one
+ * operator's API key could report on nobody's run but the operator's.
+ * So under that posture the SAME token is also an identity
+ * (runner-subject-verifier.ts): it admits its bearer as the human whose
+ * run it is, the person the execution row's creator stamp names, for as
+ * long as that run lives. The runner acts as the run's human, which is
+ * what the cloud's managed sandbox has always done. Under trusted-local
+ * no verifier is composed and the token stays the decrypt-lane
+ * discriminator it was: anyone who can reach that server can mint one,
+ * and there is one person to be.
  *
  * Token shape (field names are wire contract — the runner's
  * token-claims.ts reads token_type by name):
  *   {"token_type":"execution_scoped","execution_id":"<id>","iat":…,"exp":…}
  *
- * Consumers arrive with their own domains: the platform exchange RPC
- * (mint) and the executioncontext resolve step (verify). This module lands
- * with the encryption sub-project because its signing key rides the shared
- * key ladder and its boot posture is a ratified cross-domain invariant
+ * Two mints, one shape:
+ *   - `mint(executionId, ttl)` — the CLOCKED token: the trusted-local
+ *     exchange and the connect and sandbox lanes, whose one unit of work
+ *     has a bounded lifetime. `exp` is present and enforced. The connect
+ *     lane's token binds no execution row but the connect's own
+ *     ExecutionContext (domain/mcpserver/connect-execution-id.ts), and
+ *     under the built-in posture it too is an identity: its bearer acts
+ *     as the person who asked for the connect, whom that row was created
+ *     by (bound-execution.ts, the `mcp-connect` binding).
+ *   - `mintRunCredential(executionId)` — the RUN credential: the two
+ *     execution engines put it on every dispatch's workflow input
+ *     (dispatch-credential.ts), and under the built-in posture the
+ *     exchange mints it too, for the run's own person only
+ *     (built-in-runner-credential-provider.ts). NO `exp`. A run waits on
+ *     humans with no timeout and outlives any clock; its credential's
+ *     validity is the ROW's — the execution is live, or ended within a
+ *     short grace (bound-execution.ts) — read by both lanes that accept
+ *     the token, because a plaintext token in Temporal history must not
+ *     decrypt a finished run's secrets, and the clock that prevented that
+ *     is gone.
+ * `verify` enforces `exp` when present and accepts its absence; it never
+ * decides liveness, which needs the store.
+ *
+ * Consumers arrive with their own domains, through the provider seam
+ * (runner-credential-provider.ts): the platform exchange RPC and the two
+ * engine clients (mint), the executioncontext resolve step and the
+ * runner-subject verifier (verify). This module lands with the
+ * encryption sub-project because its signing key rides the shared key
+ * ladder and its boot posture is a ratified cross-domain invariant
  * (fatal — see compose.ts).
  */
 import { createHmac, timingSafeEqual } from "node:crypto";
@@ -105,10 +138,10 @@ export class RunnerAuthService {
     /**
      * Go NewServiceFromEnv: key via the shared ladder (env var → key file →
      * auto-generate). Errors only on unusable explicit configuration; the
-     * composition root maps that to the BOOT-FATAL posture (the ratified D2
-     * asymmetry: a server that cannot mint runner tokens would hand every
-     * execution redaction markers instead of its secrets — the silent-junk
-     * failure the oss#405 fail-loud doctrine forbids).
+     * composition root maps that to the BOOT-FATAL posture: a server that
+     * cannot mint runner tokens would hand every execution redaction markers
+     * instead of its secrets — the silent-junk failure the encryption work
+     * (stigmer#405) made fail-loud.
      */
     static fromEnv(options = {}) {
         const key = getOrCreateNamedKey(RUNNER_TOKEN_KEY_ENV_VAR, RUNNER_TOKEN_KEY_FILE_NAME, options);
@@ -123,25 +156,43 @@ export class RunnerAuthService {
      * (DEFAULT_TTL_SECONDS when <= 0).
      */
     mint(executionId, ttlSeconds = 0) {
+        const ttl = ttlSeconds > 0 ? ttlSeconds : DEFAULT_TTL_SECONDS;
+        const nowSeconds = Math.floor(Date.now() / 1000);
+        return {
+            token: this.signClaims(executionId, {
+                iat: nowSeconds,
+                exp: nowSeconds + ttl,
+            }),
+            ttlSeconds: ttl,
+        };
+    }
+    /**
+     * The run credential: bound to `executionId`, with NO `exp` (see the
+     * header — a run outlives any clock; the row decides). The dispatch
+     * path mints it into the workflow input; only the string travels, since
+     * there is no lifetime to report.
+     */
+    mintRunCredential(executionId) {
+        return this.signClaims(executionId, {
+            iat: Math.floor(Date.now() / 1000),
+        });
+    }
+    signClaims(executionId, clock) {
         if (this.key === undefined) {
             throw new MintingDisabledError();
         }
         if (executionId === "") {
             throw new Error("execution id is required to mint a runner token");
         }
-        const ttl = ttlSeconds > 0 ? ttlSeconds : DEFAULT_TTL_SECONDS;
-        const nowSeconds = Math.floor(Date.now() / 1000);
         const claims = {
             token_type: TOKEN_TYPE_EXECUTION_SCOPED,
             execution_id: executionId,
-            iat: nowSeconds,
-            exp: nowSeconds + ttl,
-        };
-        const signingInput = JWT_HEADER + "." + Buffer.from(JSON.stringify(claims)).toString("base64url");
-        return {
-            token: signingInput + "." + this.sign(signingInput),
-            ttlSeconds: ttl,
+            ...clock,
         };
+        const signingInput = JWT_HEADER +
+            "." +
+            Buffer.from(JSON.stringify(claims)).toString("base64url");
+        return signingInput + "." + this.sign(signingInput);
     }
     /**
      * Go Verify: checks signature, algorithm, expiry, and token type, and
@@ -152,6 +203,8 @@ export class RunnerAuthService {
      * Check order mirrors Go: enabled → three parts → exact encoded-header
      * compare → constant-time HMAC → payload decode → claims. The expiry
      * boundary is `now >= exp` (a token in its expiring second is invalid).
+     * A token with no `exp` is a run credential and passes this check; a
+     * present `exp` that is not a number is a malformed clock and refuses.
      */
     verify(token) {
         if (this.key === undefined) {
@@ -183,9 +236,12 @@ export class RunnerAuthService {
         }
         if (claims.token_type !== TOKEN_TYPE_EXECUTION_SCOPED ||
             typeof claims.execution_id !== "string" ||
-            claims.execution_id === "" ||
-            typeof claims.exp !== "number" ||
-            Math.floor(Date.now() / 1000) >= claims.exp) {
+            claims.execution_id === "") {
+            throw new InvalidTokenError();
+        }
+        if (claims.exp !== undefined &&
+            (typeof claims.exp !== "number" ||
+                Math.floor(Date.now() / 1000) >= claims.exp)) {
             throw new InvalidTokenError();
         }
         return claims.execution_id;
@@ -200,4 +256,44 @@ export class RunnerAuthService {
             .digest("base64url");
     }
 }
+/**
+ * The `token_type` claim read off an UNVERIFIED token, or undefined for
+ * anything that is not a three-segment token with a JSON payload naming
+ * one. This is the runner-subject verifier's claim rule (the chassis
+ * contract: decide "is this ours?" before trusting anything), so it must
+ * never throw and must trust nothing it reads — `verify` runs afterwards
+ * on a claimed token. It is NOT a shortcut for reading claims a caller
+ * intends to act on.
+ */
+export function peekTokenType(token) {
+    const claims = decodePayload(token);
+    const type = claims?.["token_type"];
+    return typeof type === "string" && type !== "" ? type : undefined;
+}
+/**
+ * Whether a token this module has ALREADY verified carries a clock. The
+ * decrypt lane reads it to know which validity rule applies (a clocked
+ * token's clock was enforced by `verify`; a run credential's validity is
+ * the row's). Reading the payload of a verified token is a read of
+ * trusted state, the GuardMemoryCapture precedent; on anything `verify`
+ * has not accepted the answer is meaningless, so callers verify first.
+ */
+export function isClockedToken(verifiedToken) {
+    return typeof decodePayload(verifiedToken)?.["exp"] === "number";
+}
+function decodePayload(token) {
+    const segments = token.split(".");
+    if (segments.length !== 3) {
+        return undefined;
+    }
+    try {
+        const decoded = JSON.parse(Buffer.from(segments[1] ?? "", "base64url").toString("utf8"));
+        return typeof decoded === "object" && decoded !== null
+            ? decoded
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 //# sourceMappingURL=runnerauth.js.map

package/dist/runnerauth/runnerauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"runnerauth.js","sourceRoot":"","sources":["../../src/runnerauth/runnerauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGnE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,kBAAkB,CAAC;AAE9D,gEAAgE;AAChE,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAEnE,iEAAiE;AACjE,MAAM,CAAC,MAAM,0BAA0B,GAAG,kBAAkB,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAExC;;;;;GAKG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C;QACE,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C;QACE,KAAK,CAAC,8DAA8D,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CACpE,WAAW,CACZ,CAAC;AAgBF;;;GAGG;AACH,MAAM,OAAO,iBAAiB;IACX,GAAG,CAAqB;IAEzC,YAAoB,GAAuB;QACzC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAM,CAAC,GAAuB;QACnC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO,IAAI,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,OAAO,CAAC,UAA4B,EAAE;QAC3C,MAAM,GAAG,GAAG,mBAAmB,CAC7B,wBAAwB,EACxB,0BAA0B,EAC1B,OAAO,CACR,CAAC;QACF,OAAO,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAED,6DAA6D;IAC7D,SAAS;QACP,OAAO,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,IAAI,CAAC,WAAmB,EAAE,aAAqB,CAAC;QAC9C,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,oBAAoB,EAAE,CAAC;QACnC,CAAC;QACD,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,GAAG,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC;QAE9D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,MAAM,GAAgB;YAC1B,UAAU,EAAE,2BAA2B;YACvC,YAAY,EAAE,WAAW;YACzB,GAAG,EAAE,UAAU;YACf,GAAG,EAAE,UAAU,GAAG,GAAG;SACtB,CAAC;QACF,MAAM,YAAY,GAChB,UAAU,GAAG,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC/E,OAAO;YACL,KAAK,EAAE,YAAY,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;YACnD,UAAU,EAAE,GAAG;SAChB,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,KAAa;QAClB,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAChC,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAChC,CAAC;QACD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAChC,CAAC;QAED,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAC;QACjD,2DAA2D;QAC3D,qEAAqE;QACrE,iEAAiE;QACjE,IACE,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YACnC,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACpC,CAAC;YACD,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAChC,CAAC;QAED,IAAI,MAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CACjB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC/C,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAChC,CAAC;QAED,IACE,MAAM,CAAC,UAAU,KAAK,2BAA2B;YACjD,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;YACvC,MAAM,CAAC,YAAY,KAAK,EAAE;YAC1B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,MAAM,CAAC,GAAG,EAC3C,CAAC;YACD,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAChC,CAAC;QAED,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IAED,8DAA8D;IACtD,IAAI,CAAC,YAAoB;QAC/B,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAChC,CAAC;QACD,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC;aAClC,MAAM,CAAC,YAAY,CAAC;aACpB,MAAM,CAAC,WAAW,CAAC,CAAC;IACzB,CAAC;CACF"}
+{"version":3,"file":"runnerauth.js","sourceRoot":"","sources":["../../src/runnerauth/runnerauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGnE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,kBAAkB,CAAC;AAE9D,gEAAgE;AAChE,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAEnE,iEAAiE;AACjE,MAAM,CAAC,MAAM,0BAA0B,GAAG,kBAAkB,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAExC;;;;;GAKG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C;QACE,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C;QACE,KAAK,CAAC,8DAA8D,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CACpE,WAAW,CACZ,CAAC;AAoBF;;;GAGG;AACH,MAAM,OAAO,iBAAiB;IACX,GAAG,CAAqB;IAEzC,YAAoB,GAAuB;QACzC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAM,CAAC,GAAuB;QACnC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO,IAAI,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,OAAO,CAAC,UAA4B,EAAE;QAC3C,MAAM,GAAG,GAAG,mBAAmB,CAC7B,wBAAwB,EACxB,0BAA0B,EAC1B,OAAO,CACR,CAAC;QACF,OAAO,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAED,6DAA6D;IAC7D,SAAS;QACP,OAAO,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,IAAI,CAAC,WAAmB,EAAE,aAAqB,CAAC;QAC9C,MAAM,GAAG,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC;QAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE;gBAClC,GAAG,EAAE,UAAU;gBACf,GAAG,EAAE,UAAU,GAAG,GAAG;aACtB,CAAC;YACF,UAAU,EAAE,GAAG;SAChB,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,WAAmB;QACnC,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE;YAClC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IAEO,UAAU,CAChB,WAAmB,EACnB,KAAuC;QAEvC,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,oBAAoB,EAAE,CAAC;QACnC,CAAC;QACD,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,MAAM,GAAgB;YAC1B,UAAU,EAAE,2BAA2B;YACvC,YAAY,EAAE,WAAW;YACzB,GAAG,KAAK;SACT,CAAC;QACF,MAAM,YAAY,GAChB,UAAU;YACV,GAAG;YACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5D,OAAO,YAAY,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,KAAa;QAClB,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAChC,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAChC,CAAC;QACD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAChC,CAAC;QAED,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAC;QACjD,2DAA2D;QAC3D,qEAAqE;QACrE,iEAAiE;QACjE,IACE,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YACnC,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACpC,CAAC;YACD,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAChC,CAAC;QAED,IAAI,MAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CACjB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC/C,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAChC,CAAC;QAED,IACE,MAAM,CAAC,UAAU,KAAK,2BAA2B;YACjD,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;YACvC,MAAM,CAAC,YAAY,KAAK,EAAE,EAC1B,CAAC;YACD,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAChC,CAAC;QACD,IACE,MAAM,CAAC,GAAG,KAAK,SAAS;YACxB,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;gBAC7B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,EAC9C,CAAC;YACD,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAChC,CAAC;QAED,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IAED,8DAA8D;IACtD,IAAI,CAAC,YAAoB;QAC/B,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAChC,CAAC;QACD,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC;aAClC,MAAM,CAAC,YAAY,CAAC;aACpB,MAAM,CAAC,WAAW,CAAC,CAAC;IACzB,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;IACpC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,aAAqB;IAClD,OAAO,OAAO,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC;AACnE,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CACjC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC7D,CAAC;QACF,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;YACpD,CAAC,CAAE,OAAmC;YACtC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}