@stigmer/server 3.15.3-dev.20260916211208 → 3.16.1-dev.20260917224426

package/dist/domain/workflowexecution/phases.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The workflow execution's "will this run ever run again?" predicate —
+ * the twin of domain/agentexecution/phases.ts `isTerminalExecutionPhase`,
+ * stated once so every consumer names the same set: COMPLETED, FAILED,
+ * CANCELLED and TERMINATED. PAUSED is NOT terminal (lifecycle.ts:
+ * `applyLifecyclePhaseTransition` keeps `completed_at` as-is on a pause
+ * and clears it on the way back to IN_PROGRESS), and neither is PENDING.
+ *
+ * Deliberately distinct from `isWorkflowTerminalPhase` in subscribe.ts,
+ * which OMITS TERMINATED — the disclosed Go quirk the subscribe stream
+ * ports faithfully as its close set. Do not merge the two; that file's
+ * header carries the reason.
+ *
+ * The first consumer is the runner-credential lane (runnerauth/
+ * bound-execution.ts): a run credential is valid while its run may still
+ * run, so a terminated workflow's credential must die exactly as a
+ * completed one's does.
+ */
+import { ExecutionPhase } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/enum_pb";
+export declare function isTerminalWorkflowExecutionPhase(phase: ExecutionPhase): boolean;
+//# sourceMappingURL=phases.d.ts.map

package/dist/domain/workflowexecution/phases.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"phases.d.ts","sourceRoot":"","sources":["../../../src/domain/workflowexecution/phases.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,iEAAiE,CAAC;AAEjG,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,cAAc,GACpB,OAAO,CAUT"}

package/dist/domain/workflowexecution/phases.js

@@ -0,0 +1,31 @@
+/**
+ * The workflow execution's "will this run ever run again?" predicate —
+ * the twin of domain/agentexecution/phases.ts `isTerminalExecutionPhase`,
+ * stated once so every consumer names the same set: COMPLETED, FAILED,
+ * CANCELLED and TERMINATED. PAUSED is NOT terminal (lifecycle.ts:
+ * `applyLifecyclePhaseTransition` keeps `completed_at` as-is on a pause
+ * and clears it on the way back to IN_PROGRESS), and neither is PENDING.
+ *
+ * Deliberately distinct from `isWorkflowTerminalPhase` in subscribe.ts,
+ * which OMITS TERMINATED — the disclosed Go quirk the subscribe stream
+ * ports faithfully as its close set. Do not merge the two; that file's
+ * header carries the reason.
+ *
+ * The first consumer is the runner-credential lane (runnerauth/
+ * bound-execution.ts): a run credential is valid while its run may still
+ * run, so a terminated workflow's credential must die exactly as a
+ * completed one's does.
+ */
+import { ExecutionPhase } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/enum_pb";
+export function isTerminalWorkflowExecutionPhase(phase) {
+    switch (phase) {
+        case ExecutionPhase.EXECUTION_COMPLETED:
+        case ExecutionPhase.EXECUTION_FAILED:
+        case ExecutionPhase.EXECUTION_CANCELLED:
+        case ExecutionPhase.EXECUTION_TERMINATED:
+            return true;
+        default:
+            return false;
+    }
+}
+//# sourceMappingURL=phases.js.map

package/dist/domain/workflowexecution/phases.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"phases.js","sourceRoot":"","sources":["../../../src/domain/workflowexecution/phases.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,iEAAiE,CAAC;AAEjG,MAAM,UAAU,gCAAgC,CAC9C,KAAqB;IAErB,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,cAAc,CAAC,mBAAmB,CAAC;QACxC,KAAK,cAAc,CAAC,gBAAgB,CAAC;QACrC,KAAK,cAAc,CAAC,mBAAmB,CAAC;QACxC,KAAK,cAAc,CAAC,oBAAoB;YACtC,OAAO,IAAI,CAAC;QACd;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/identity/oidc-verifier.js

@@ -127,7 +127,14 @@ function classifyJoseError(error) {
         return new ConnectError(TOKEN_SIGNATURE_MESSAGE, Code.Unauthenticated);
     }
     if (error instanceof joseErrors.JWTInvalid ||
-        error instanceof joseErrors.JWSInvalid) {
+        error instanceof joseErrors.JWSInvalid ||
+        // A JWT whose algorithm the issuer's key set cannot serve (an HS256
+        // token against an RS256 JWKS): a credential this verifier recognizes
+        // but cannot verify, so a credential rejection — never the
+        // infrastructure arm. Until 2026-09-16 it fell through to INTERNAL,
+        // and a self-host with sign-in on failed every agent execution on its
+        // own runner token (stigmer#1137).
+        error instanceof joseErrors.JOSENotSupported) {
         return new ConnectError(INVALID_TOKEN_MESSAGE, Code.Unauthenticated);
     }
     // JWKSTimeout, fetch failures, and anything unclassified: infrastructure —

package/dist/identity/oidc-verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-verifier.js","sourceRoot":"","sources":["../../src/identity/oidc-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,MAAM,CAAC;AAE3E,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAQ5E,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AACzD,MAAM,CAAC,MAAM,sBAAsB,GACjC,qDAAqD,CAAC;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,qCAAqC,CAAC;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAerD,MAAM,UAAU,uBAAuB,CACrC,MAA0B;IAE1B,wEAAwE;IACxE,uEAAuE;IACvE,IAAI,IAA4B,CAAC;IAEjC,KAAK,UAAU,OAAO;QACpB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnE,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;YAC7B,IAAI,OAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;oBAC1C,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;gBAC1D,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,MAAM,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC;gBACpE,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,KAAK;gBACf,GAAG,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE;oBACjE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;oBAC7B,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE;oBAC/D,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;oBAClC,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3C,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,YAAY,UAAU,CAAC,wBAAwB,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,IAAI,YAAY,CAAC,sBAAsB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,IACE,KAAK,YAAY,UAAU,CAAC,8BAA8B;QAC1D,KAAK,YAAY,UAAU,CAAC,iBAAiB;QAC7C,KAAK,YAAY,UAAU,CAAC,wBAAwB;QACpD,KAAK,YAAY,UAAU,CAAC,WAAW,EACvC,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,uBAAuB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACzE,CAAC;IACD,IACE,KAAK,YAAY,UAAU,CAAC,UAAU;QACtC,KAAK,YAAY,UAAU,CAAC,UAAU,EACtC,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,2EAA2E;IAC3E,yDAAyD;IACzD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"oidc-verifier.js","sourceRoot":"","sources":["../../src/identity/oidc-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,MAAM,CAAC;AAE3E,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAQ5E,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AACzD,MAAM,CAAC,MAAM,sBAAsB,GACjC,qDAAqD,CAAC;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,qCAAqC,CAAC;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAerD,MAAM,UAAU,uBAAuB,CACrC,MAA0B;IAE1B,wEAAwE;IACxE,uEAAuE;IACvE,IAAI,IAA4B,CAAC;IAEjC,KAAK,UAAU,OAAO;QACpB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnE,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;YAC7B,IAAI,OAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;oBAC1C,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;gBAC1D,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,MAAM,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC;gBACpE,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,KAAK;gBACf,GAAG,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE;oBACjE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;oBAC7B,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE;oBAC/D,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;oBAClC,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3C,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,YAAY,UAAU,CAAC,wBAAwB,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,IAAI,YAAY,CAAC,sBAAsB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,IACE,KAAK,YAAY,UAAU,CAAC,8BAA8B;QAC1D,KAAK,YAAY,UAAU,CAAC,iBAAiB;QAC7C,KAAK,YAAY,UAAU,CAAC,wBAAwB;QACpD,KAAK,YAAY,UAAU,CAAC,WAAW,EACvC,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,uBAAuB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACzE,CAAC;IACD,IACE,KAAK,YAAY,UAAU,CAAC,UAAU;QACtC,KAAK,YAAY,UAAU,CAAC,UAAU;QACtC,oEAAoE;QACpE,sEAAsE;QACtE,2DAA2D;QAC3D,oEAAoE;QACpE,sEAAsE;QACtE,mCAAmC;QACnC,KAAK,YAAY,UAAU,CAAC,gBAAgB,EAC5C,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,2EAA2E;IAC3E,yDAAyD;IACzD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/pipeline/apiresource-meta.d.ts

@@ -108,4 +108,19 @@ export declare function supportsVisibility(kind: ApiResourceKind, visibility: Ap
  * copy from this exact format.
  */
 export declare function supportedVisibilityLevels(kind: ApiResourceKind): string;
+/**
+ * The kind a minted resource id belongs to, read off its prefix — the
+ * inverse of `getIdPrefix` over the ids `generateId` mints
+ * (`<prefix>_<ulid>`, pipeline/steps/defaults.ts). The one consumer today
+ * is the runner-credential lane, whose token binds an execution by id and
+ * must know whether that id names an agent execution or a workflow
+ * execution without a second claim or a guess. Anything that is not
+ * `<known prefix>_<rest>` — no underscore, an unknown prefix, the empty
+ * string — is `api_resource_kind_unknown`; never a throw, because the id
+ * arrived inside a credential and the caller refuses with its own
+ * sentence. Every `id_prefix` in the contract is unique; the table pin in
+ * __tests__ makes a future duplicate a reviewed change, since this lookup
+ * would otherwise resolve it silently to one of the two.
+ */
+export declare function kindByIdPrefix(id: string): ApiResourceKind;
 //# sourceMappingURL=apiresource-meta.d.ts.map

package/dist/pipeline/apiresource-meta.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiresource-meta.d.ts","sourceRoot":"","sources":["../../src/pipeline/apiresource-meta.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EACL,eAAe,EAEf,YAAY,EAEb,MAAM,qFAAqF,CAAC;AAC7F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qFAAqF,CAAC;AAK/H,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wFAAwF,CAAC;AACnI,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,mBAAmB,CAMtE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,eAAe,GACpB,oBAAoB,GAAG,SAAS,CASlC;AAED,0CAA0C;AAC1C,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAEzD;AAED,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,CAS9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAI7D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAO1D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,GACpB,qBAAqB,CAKvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,GACpB,aAAa,CAAC,OAAO,CAAC,CAMxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,aAAa,GACrB,OAAO,CAKT;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,aAAa,GACrB,OAAO,CAET;AAkCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAYT;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAavE"}
+{"version":3,"file":"apiresource-meta.d.ts","sourceRoot":"","sources":["../../src/pipeline/apiresource-meta.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EACL,eAAe,EAEf,YAAY,EAEb,MAAM,qFAAqF,CAAC;AAC7F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qFAAqF,CAAC;AAK/H,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wFAAwF,CAAC;AACnI,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,mBAAmB,CAMtE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,eAAe,GACpB,oBAAoB,GAAG,SAAS,CASlC;AAED,0CAA0C;AAC1C,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAEzD;AAED,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,CAS9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAI7D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAO1D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,GACpB,qBAAqB,CAKvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,GACpB,aAAa,CAAC,OAAO,CAAC,CAMxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,aAAa,GACrB,OAAO,CAKT;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,aAAa,GACrB,OAAO,CAET;AAkCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAYT;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAavE;AA+CD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,CAS1D"}

package/dist/pipeline/apiresource-meta.js

@@ -293,4 +293,38 @@ function kindsByEnumName() {
     }
     return enumNameCache;
 }
+/**
+ * The kind a minted resource id belongs to, read off its prefix — the
+ * inverse of `getIdPrefix` over the ids `generateId` mints
+ * (`<prefix>_<ulid>`, pipeline/steps/defaults.ts). The one consumer today
+ * is the runner-credential lane, whose token binds an execution by id and
+ * must know whether that id names an agent execution or a workflow
+ * execution without a second claim or a guess. Anything that is not
+ * `<known prefix>_<rest>` — no underscore, an unknown prefix, the empty
+ * string — is `api_resource_kind_unknown`; never a throw, because the id
+ * arrived inside a credential and the caller refuses with its own
+ * sentence. Every `id_prefix` in the contract is unique; the table pin in
+ * __tests__ makes a future duplicate a reviewed change, since this lookup
+ * would otherwise resolve it silently to one of the two.
+ */
+export function kindByIdPrefix(id) {
+    const separator = id.indexOf("_");
+    if (separator <= 0) {
+        return ApiResourceKind.api_resource_kind_unknown;
+    }
+    return (kindsByIdPrefix().get(id.slice(0, separator)) ??
+        ApiResourceKind.api_resource_kind_unknown);
+}
+let idPrefixCache;
+function kindsByIdPrefix() {
+    if (idPrefixCache === undefined) {
+        idPrefixCache = new Map(ApiResourceKindSchema.values
+            .filter((value) => hasOption(value, kind_meta))
+            .map((value) => [
+            getOption(value, kind_meta).idPrefix,
+            value.number,
+        ]));
+    }
+    return idPrefixCache;
+}
 //# sourceMappingURL=apiresource-meta.js.map

package/dist/pipeline/apiresource-meta.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiresource-meta.js","sourceRoot":"","sources":["../../src/pipeline/apiresource-meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,SAAS,GACV,MAAM,qFAAqF,CAAC;AAE7F,OAAO,EACL,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,wFAAwF,CAAC;AAGhG,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,iEAAiE;AACjE,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,8BAA8B,CAC5C,IAAqB;IAErB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;IAC/C,IACE,MAAM,EAAE,SAAS,KAAK,sBAAsB,CAAC,MAAM;QACnD,MAAM,CAAC,SAAS,KAAK,oBAAoB,CAAC,SAAS,EACnD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;AACpC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;IACtE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,CACL,eAAe,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,yBAAyB,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAqB;IAChD,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,KAAK,GACT,mBAAmB,CAAC,IAAI,CAAC;QACzB,mBAAmB,CAAC,eAAe,CAAC,yBAAyB,CAAC,CAAC;IACjE,OAAO,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAqB;IAErB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,OAAO,MAAM,EAAE,uBAAuB,KAAK,IAAI;QAC7C,CAAC,CAAC,qBAAqB,CAAC,cAAc;QACtC,CAAC,CAAC,qBAAqB,CAAC,kBAAkB,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAqB;IAErB,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,aAAa,EAAE,cAAc,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAkB,EAClB,OAAsB;IAEtB,IAAI,OAAO,KAAK,aAAa,CAAC,0BAA0B,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAqB,EACrB,OAAsB;IAEtB,OAAO,mBAAmB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,WAAW,CAAC,OAAsB;IACzC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,aAAa,CAAC,GAAG;YACpB,OAAO,CAAC,CAAC;QACX,KAAK,aAAa,CAAC,UAAU;YAC3B,OAAO,CAAC,CAAC;QACX,KAAK,aAAa,CAAC,KAAK,CAAC;QACzB,KAAK,aAAa,CAAC,0BAA0B;YAC3C,OAAO,CAAC,CAAC;QACX,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAkB;IAClC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,YAAY,CAAC,WAAW,CAAC;QAC9B,KAAK,YAAY,CAAC,yBAAyB;YACzC,OAAO,CAAC,CAAC;QACX,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,CAAC,CAAC;QACX,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,CAAC,CAAC;QACX,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,IAAI,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAqB,EACrB,UAAiC;IAEjC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,qBAAqB,CAAC,iBAAiB;YAC1C,OAAO,MAAM,EAAE,cAAc,KAAK,IAAI,CAAC;QACzC,KAAK,qBAAqB,CAAC,cAAc;YACvC,OAAO,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;QACtC,KAAK,qBAAqB,CAAC,mBAAmB;YAC5C,OAAO,MAAM,EAAE,gBAAgB,KAAK,IAAI,CAAC;QAC3C;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAqB;IAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,IAAI,MAAM,GAAG,oBAAoB,CAAC;IAClC,IAAI,MAAM,EAAE,WAAW,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,kBAAkB,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,EAAE,cAAc,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,qBAAqB,CAAC;IAClC,CAAC;IACD,IAAI,MAAM,EAAE,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,uBAAuB,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAqB;IAChD,OAAO,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,IAAI,kBAA4D,CAAC;AAEjE,SAAS,oBAAoB;IAC3B,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,kBAAkB,GAAG,IAAI,GAAG,CAC1B,qBAAqB,CAAC,MAAM;aACzB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;aAC9C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YACd,iBAAiB,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC;YACnD,KAAK,CAAC,MAAyB;SAChC,CAAC,CACL,CAAC;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,IAAI,aAAuD,CAAC;AAE5D;;;;;GAKG;AACH,SAAS,eAAe;IACtB,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,aAAa,GAAG,IAAI,GAAG,CACrB,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI;YACV,KAAK,CAAC,MAAyB;SAChC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC"}
+{"version":3,"file":"apiresource-meta.js","sourceRoot":"","sources":["../../src/pipeline/apiresource-meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,SAAS,GACV,MAAM,qFAAqF,CAAC;AAE7F,OAAO,EACL,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,wFAAwF,CAAC;AAGhG,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,iEAAiE;AACjE,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,8BAA8B,CAC5C,IAAqB;IAErB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;IAC/C,IACE,MAAM,EAAE,SAAS,KAAK,sBAAsB,CAAC,MAAM;QACnD,MAAM,CAAC,SAAS,KAAK,oBAAoB,CAAC,SAAS,EACnD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;AACpC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;IACtE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,CACL,eAAe,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,yBAAyB,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAqB;IAChD,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,KAAK,GACT,mBAAmB,CAAC,IAAI,CAAC;QACzB,mBAAmB,CAAC,eAAe,CAAC,yBAAyB,CAAC,CAAC;IACjE,OAAO,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAqB;IAErB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,OAAO,MAAM,EAAE,uBAAuB,KAAK,IAAI;QAC7C,CAAC,CAAC,qBAAqB,CAAC,cAAc;QACtC,CAAC,CAAC,qBAAqB,CAAC,kBAAkB,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAqB;IAErB,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,aAAa,EAAE,cAAc,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAkB,EAClB,OAAsB;IAEtB,IAAI,OAAO,KAAK,aAAa,CAAC,0BAA0B,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAqB,EACrB,OAAsB;IAEtB,OAAO,mBAAmB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,WAAW,CAAC,OAAsB;IACzC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,aAAa,CAAC,GAAG;YACpB,OAAO,CAAC,CAAC;QACX,KAAK,aAAa,CAAC,UAAU;YAC3B,OAAO,CAAC,CAAC;QACX,KAAK,aAAa,CAAC,KAAK,CAAC;QACzB,KAAK,aAAa,CAAC,0BAA0B;YAC3C,OAAO,CAAC,CAAC;QACX,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAkB;IAClC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,YAAY,CAAC,WAAW,CAAC;QAC9B,KAAK,YAAY,CAAC,yBAAyB;YACzC,OAAO,CAAC,CAAC;QACX,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,CAAC,CAAC;QACX,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,CAAC,CAAC;QACX,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,IAAI,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAqB,EACrB,UAAiC;IAEjC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,qBAAqB,CAAC,iBAAiB;YAC1C,OAAO,MAAM,EAAE,cAAc,KAAK,IAAI,CAAC;QACzC,KAAK,qBAAqB,CAAC,cAAc;YACvC,OAAO,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;QACtC,KAAK,qBAAqB,CAAC,mBAAmB;YAC5C,OAAO,MAAM,EAAE,gBAAgB,KAAK,IAAI,CAAC;QAC3C;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAqB;IAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,IAAI,MAAM,GAAG,oBAAoB,CAAC;IAClC,IAAI,MAAM,EAAE,WAAW,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,kBAAkB,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,EAAE,cAAc,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,qBAAqB,CAAC;IAClC,CAAC;IACD,IAAI,MAAM,EAAE,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,uBAAuB,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAqB;IAChD,OAAO,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,IAAI,kBAA4D,CAAC;AAEjE,SAAS,oBAAoB;IAC3B,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,kBAAkB,GAAG,IAAI,GAAG,CAC1B,qBAAqB,CAAC,MAAM;aACzB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;aAC9C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YACd,iBAAiB,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC;YACnD,KAAK,CAAC,MAAyB;SAChC,CAAC,CACL,CAAC;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,IAAI,aAAuD,CAAC;AAE5D;;;;;GAKG;AACH,SAAS,eAAe;IACtB,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,aAAa,GAAG,IAAI,GAAG,CACrB,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI;YACV,KAAK,CAAC,MAAyB;SAChC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,eAAe,CAAC,yBAAyB,CAAC;IACnD,CAAC;IACD,OAAO,CACL,eAAe,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC7C,eAAe,CAAC,yBAAyB,CAC1C,CAAC;AACJ,CAAC;AAED,IAAI,aAAuD,CAAC;AAE5D,SAAS,eAAe;IACtB,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,aAAa,GAAG,IAAI,GAAG,CACrB,qBAAqB,CAAC,MAAM;aACzB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;aAC9C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YACd,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,QAAQ;YACpC,KAAK,CAAC,MAAyB;SAChC,CAAC,CACL,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/pipeline/steps/guard-memory-capture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard-memory-capture.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-memory-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAG/F,wEAAwE;AACxE,eAAO,MAAM,6BAA6B,iEACsB,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AAEvE,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,QAAQ,CAAC,EAAE,wBAAwB,GAClC,YAAY,CAAC,IAAI,CAAC,CAoDpB;AAED,4EAA4E;AAC5E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,GACxB,uBAAuB,GAAG,SAAS,CAWrC"}
+{"version":3,"file":"guard-memory-capture.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-memory-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAG/F,wEAAwE;AACxE,eAAO,MAAM,6BAA6B,iEACsB,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AAEvE,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,QAAQ,CAAC,EAAE,wBAAwB,GAClC,YAAY,CAAC,IAAI,CAAC,CAsDpB;AAED,4EAA4E;AAC5E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,SAAS,WAAW,EAChE,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,GACxB,uBAAuB,GAAG,SAAS,CAWrC"}

package/dist/pipeline/steps/guard-memory-capture.js

@@ -12,7 +12,7 @@ export const MEMORY_CAPTURE_CREDENTIAL_KEY = "memoryCaptureCredential";
 export function newGuardMemoryCaptureStep(provider) {
     return {
         name: "GuardMemoryCapture",
-        execute(ctx) {
+        async execute(ctx) {
             const caller = ctx.callerIdentity;
             if (caller.callerClass === "internal" || caller.origin === "in-process") {
                 // Server-composed traversals are not capture requests from a
@@ -25,9 +25,11 @@ export function newGuardMemoryCaptureStep(provider) {
                 // arm checks it against the token's own claim (and throws its
                 // byte-pinned refusal itself). Empty when the request carries
                 // none; Java requires metadata.org before its org-match arm, so
-                // an empty value can only ever narrow.
+                // an empty value can only ever narrow. Awaited because the
+                // built-in provider reads the bound execution's row for the
+                // session and org the cloud's token carries as claims.
                 const org = metadataOf(ctx.newState)?.org ?? "";
-                const decision = decide.call(provider, caller, org);
+                const decision = await decide.call(provider, caller, org);
                 switch (decision.verdict) {
                     case "admit":
                         ctx.set(MEMORY_CAPTURE_CREDENTIAL_KEY, {

package/dist/pipeline/steps/guard-memory-capture.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard-memory-capture.js","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-memory-capture.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKzD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,wEAAwE;AACxE,MAAM,CAAC,MAAM,6BAA6B,GACxC,8DAA8D,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAC;AAEvE,MAAM,UAAU,yBAAyB,CACvC,QAAmC;IAEnC,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,OAAO,CAAC,GAAyB;YAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC;YAClC,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBACxE,6DAA6D;gBAC7D,+DAA+D;gBAC/D,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,EAAE,sBAAsB,CAAC;YAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,gEAAgE;gBAChE,8DAA8D;gBAC9D,8DAA8D;gBAC9D,gEAAgE;gBAChE,uCAAuC;gBACvC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;gBACpD,QAAQ,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACzB,KAAK,OAAO;wBACV,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE;4BACrC,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;4BAC3D,eAAe,EAAE,QAAQ,CAAC,eAAe;yBAC1C,CAAC,CAAC;wBACH,OAAO;oBACT,KAAK,QAAQ;wBACX,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,gBAAgB,CACtB,CAAC;oBACJ,KAAK,YAAY;wBACf,MAAM;oBACR,OAAO,CAAC,CAAC,CAAC;wBACR,MAAM,UAAU,GAAU,QAAQ,CAAC;wBACnC,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAChE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IACE,MAAM,CAAC,WAAW,KAAK,SAAS;gBAChC,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC3C,CAAC;gBACD,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,gBAAgB,CACtB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAyB;IAEzB,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACvD,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,0BAA0B,IAAI,OAAO;QACrC,iBAAiB,IAAI,OAAO,EAC5B,CAAC;QACD,OAAO,OAAkC,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B,CAAC,QAAgB;IAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,CAAC,iDAAiD;IACjE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACnB,CAAC;QACtC,OAAO,CACL,OAAO,OAAO,CAAC,kBAAkB,KAAK,QAAQ;YAC9C,OAAO,CAAC,kBAAkB,KAAK,EAAE,CAClC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"guard-memory-capture.js","sourceRoot":"","sources":["../../../src/pipeline/steps/guard-memory-capture.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKzD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,wEAAwE;AACxE,MAAM,CAAC,MAAM,6BAA6B,GACxC,8DAA8D,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAC;AAEvE,MAAM,UAAU,yBAAyB,CACvC,QAAmC;IAEnC,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,KAAK,CAAC,OAAO,CAAC,GAAyB;YACrC,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC;YAClC,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBACxE,6DAA6D;gBAC7D,+DAA+D;gBAC/D,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,EAAE,sBAAsB,CAAC;YAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,gEAAgE;gBAChE,8DAA8D;gBAC9D,8DAA8D;gBAC9D,gEAAgE;gBAChE,2DAA2D;gBAC3D,4DAA4D;gBAC5D,uDAAuD;gBACvD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;gBAC1D,QAAQ,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACzB,KAAK,OAAO;wBACV,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE;4BACrC,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;4BAC3D,eAAe,EAAE,QAAQ,CAAC,eAAe;yBAC1C,CAAC,CAAC;wBACH,OAAO;oBACT,KAAK,QAAQ;wBACX,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,gBAAgB,CACtB,CAAC;oBACJ,KAAK,YAAY;wBACf,MAAM;oBACR,OAAO,CAAC,CAAC,CAAC;wBACR,MAAM,UAAU,GAAU,QAAQ,CAAC;wBACnC,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAChE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IACE,MAAM,CAAC,WAAW,KAAK,SAAS;gBAChC,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC3C,CAAC;gBACD,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,IAAI,CAAC,gBAAgB,CACtB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAyB;IAEzB,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACvD,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,0BAA0B,IAAI,OAAO;QACrC,iBAAiB,IAAI,OAAO,EAC5B,CAAC;QACD,OAAO,OAAkC,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B,CAAC,QAAgB;IAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,CAAC,iDAAiD;IACjE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACnB,CAAC;QACtC,OAAO,CACL,OAAO,OAAO,CAAC,kBAAkB,KAAK,QAAQ;YAC9C,OAAO,CAAC,kBAAkB,KAAK,EAAE,CAClC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/runnerauth/bound-execution.d.ts

@@ -0,0 +1,27 @@
+import type { Store } from "../store/interface.js";
+/** The three things a runner credential can bind — the lane's own vocabulary, not the enum's. */
+export type BoundExecutionKind = "agent-execution" | "workflow-execution" | "mcp-connect";
+/** The facts the lane reads off a bound execution's row. */
+export interface BoundExecution {
+    readonly kind: BoundExecutionKind;
+    readonly executionId: string;
+    /** `metadata.org` — the capture capability scopes a memory to it. */
+    readonly org: string;
+    /** The creator stamp as written: an account id since 3.15.0, a raw issuer subject before. */
+    readonly createdBy: string;
+    /** The agent execution's session; empty for a workflow execution or a connect, which have none. */
+    readonly sessionId: string;
+    /** Not terminal, or terminal within the grace (see the header); a connect's row exists. */
+    readonly live: boolean;
+}
+export type BoundExecutionStore = Pick<Store, "getResource" | "findByField">;
+export declare function boundExecutionKindOf(executionId: string): BoundExecutionKind | undefined;
+/** Whether a binding of this kind is a RUN — the only thing a no-`exp` credential may name (see the header). */
+export declare function bindsARun(kind: BoundExecutionKind): boolean;
+/**
+ * Loads the bound execution's facts; `undefined` when the id names no
+ * binding kind or no row. `now` is injectable for the grace arms and
+ * defaults to the wall clock.
+ */
+export declare function loadBoundExecution(store: BoundExecutionStore, executionId: string, now?: number): Promise<BoundExecution | undefined>;
+//# sourceMappingURL=bound-execution.d.ts.map

package/dist/runnerauth/bound-execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bound-execution.d.ts","sourceRoot":"","sources":["../../src/runnerauth/bound-execution.ts"],"names":[],"mappings":"AA2EA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAInD,iGAAiG;AACjG,MAAM,MAAM,kBAAkB,GAC1B,iBAAiB,GACjB,oBAAoB,GACpB,aAAa,CAAC;AAElB,4DAA4D;AAC5D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,6FAA6F;IAC7F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,mGAAmG;IACnG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa,CAAC,CAAC;AAE7E,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,GAClB,kBAAkB,GAAG,SAAS,CAShC;AAED,gHAAgH;AAChH,wBAAgB,SAAS,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAY3D;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,mBAAmB,EAC1B,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,MAAmB,GACvB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CA6ErC"}

package/dist/runnerauth/bound-execution.js

@@ -0,0 +1,137 @@
+import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { ExecutionContextSchema } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/api_pb";
+import { WorkflowExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { isTerminalExecutionPhase } from "../domain/agentexecution/phases.js";
+import { isConnectExecutionId } from "../domain/mcpserver/connect-execution-id.js";
+import { isTerminalWorkflowExecutionPhase } from "../domain/workflowexecution/phases.js";
+import { kindByIdPrefix } from "../pipeline/apiresource-meta.js";
+import { auditOf } from "../pipeline/steps/defaults.js";
+import { ResourceNotFoundError } from "../store/interface.js";
+import { RUN_CREDENTIAL_GRACE_AFTER_TERMINAL_MS } from "./constants.js";
+export function boundExecutionKindOf(executionId) {
+    switch (kindByIdPrefix(executionId)) {
+        case ApiResourceKind.agent_execution:
+            return "agent-execution";
+        case ApiResourceKind.workflow_execution:
+            return "workflow-execution";
+        default:
+            return isConnectExecutionId(executionId) ? "mcp-connect" : undefined;
+    }
+}
+/** Whether a binding of this kind is a RUN — the only thing a no-`exp` credential may name (see the header). */
+export function bindsARun(kind) {
+    switch (kind) {
+        case "agent-execution":
+        case "workflow-execution":
+            return true;
+        case "mcp-connect":
+            return false;
+        default: {
+            const exhaustive = kind;
+            throw new Error(`unknown bound execution kind ${String(exhaustive)}`);
+        }
+    }
+}
+/**
+ * Loads the bound execution's facts; `undefined` when the id names no
+ * binding kind or no row. `now` is injectable for the grace arms and
+ * defaults to the wall clock.
+ */
+export async function loadBoundExecution(store, executionId, now = Date.now()) {
+    const kind = boundExecutionKindOf(executionId);
+    if (kind === undefined) {
+        return undefined;
+    }
+    switch (kind) {
+        case "agent-execution": {
+            const row = await getRow(store, ApiResourceKind.agent_execution, executionId, AgentExecutionSchema);
+            if (row === undefined) {
+                return undefined;
+            }
+            return {
+                kind,
+                executionId,
+                org: row.metadata?.org ?? "",
+                createdBy: creatorStampOf(AgentExecutionSchema, row),
+                sessionId: row.spec?.sessionId ?? "",
+                live: isLive(row.status !== undefined &&
+                    isTerminalExecutionPhase(row.status.phase), row.status?.completedAt ?? "", now),
+            };
+        }
+        case "workflow-execution": {
+            const row = await getRow(store, ApiResourceKind.workflow_execution, executionId, WorkflowExecutionSchema);
+            if (row === undefined) {
+                return undefined;
+            }
+            return {
+                kind,
+                executionId,
+                org: row.metadata?.org ?? "",
+                createdBy: creatorStampOf(WorkflowExecutionSchema, row),
+                sessionId: "",
+                live: isLive(row.status !== undefined &&
+                    isTerminalWorkflowExecutionPhase(row.status.phase), row.status?.completedAt ?? "", now),
+            };
+        }
+        case "mcp-connect": {
+            // The connect's ExecutionContext, by the execution id it was
+            // created for — the same indexed read getByExecutionId makes. The
+            // row is deleted when the connect settles, so its presence is the
+            // liveness; the token's clock is enforced by `verify` before this.
+            const row = await getExecutionContextRow(store, executionId);
+            if (row === undefined) {
+                return undefined;
+            }
+            return {
+                kind,
+                executionId,
+                org: row.metadata?.org ?? "",
+                createdBy: creatorStampOf(ExecutionContextSchema, row),
+                sessionId: "",
+                live: true,
+            };
+        }
+        default: {
+            const exhaustive = kind;
+            throw new Error(`unknown bound execution kind ${String(exhaustive)}`);
+        }
+    }
+}
+/** A row with no status has not started, which is live. */
+function isLive(terminal, completedAt, now) {
+    if (!terminal) {
+        return true;
+    }
+    const finishedAt = Date.parse(completedAt);
+    if (Number.isNaN(finishedAt)) {
+        return false;
+    }
+    return now - finishedAt < RUN_CREDENTIAL_GRACE_AFTER_TERMINAL_MS;
+}
+function creatorStampOf(schema, row) {
+    return auditOf(schema, row)?.specAudit?.createdBy?.id ?? "";
+}
+async function getRow(store, kind, id, schema) {
+    try {
+        return await store.getResource(kind, id, schema);
+    }
+    catch (error) {
+        if (error instanceof ResourceNotFoundError) {
+            return undefined;
+        }
+        throw error;
+    }
+}
+async function getExecutionContextRow(store, executionId) {
+    try {
+        return await store.findByField(ApiResourceKind.execution_context, "spec.executionId", executionId, ExecutionContextSchema);
+    }
+    catch (error) {
+        if (error instanceof ResourceNotFoundError) {
+            return undefined;
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=bound-execution.js.map

package/dist/runnerauth/bound-execution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bound-execution.js","sourceRoot":"","sources":["../../src/runnerauth/bound-execution.ts"],"names":[],"mappings":"AAiEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,uBAAuB,EAAE,MAAM,gEAAgE,CAAC;AACzG,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,sCAAsC,EAAE,MAAM,gBAAgB,CAAC;AAwBxE,MAAM,UAAU,oBAAoB,CAClC,WAAmB;IAEnB,QAAQ,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;QACpC,KAAK,eAAe,CAAC,eAAe;YAClC,OAAO,iBAAiB,CAAC;QAC3B,KAAK,eAAe,CAAC,kBAAkB;YACrC,OAAO,oBAAoB,CAAC;QAC9B;YACE,OAAO,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,CAAC;AACH,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,SAAS,CAAC,IAAwB;IAChD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,iBAAiB,CAAC;QACvB,KAAK,oBAAoB;YACvB,OAAO,IAAI,CAAC;QACd,KAAK,aAAa;YAChB,OAAO,KAAK,CAAC;QACf,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,IAAI,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAA0B,EAC1B,WAAmB,EACnB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,IAAI,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,GAAG,GAAG,MAAM,MAAM,CACtB,KAAK,EACL,eAAe,CAAC,eAAe,EAC/B,WAAW,EACX,oBAAoB,CACrB,CAAC;YACF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO;gBACL,IAAI;gBACJ,WAAW;gBACX,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;gBAC5B,SAAS,EAAE,cAAc,CAAC,oBAAoB,EAAE,GAAG,CAAC;gBACpD,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE;gBACpC,IAAI,EAAE,MAAM,CACV,GAAG,CAAC,MAAM,KAAK,SAAS;oBACtB,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAC5C,GAAG,CAAC,MAAM,EAAE,WAAW,IAAI,EAAE,EAC7B,GAAG,CACJ;aACF,CAAC;QACJ,CAAC;QACD,KAAK,oBAAoB,CAAC,CAAC,CAAC;YAC1B,MAAM,GAAG,GAAG,MAAM,MAAM,CACtB,KAAK,EACL,eAAe,CAAC,kBAAkB,EAClC,WAAW,EACX,uBAAuB,CACxB,CAAC;YACF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO;gBACL,IAAI;gBACJ,WAAW;gBACX,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;gBAC5B,SAAS,EAAE,cAAc,CAAC,uBAAuB,EAAE,GAAG,CAAC;gBACvD,SAAS,EAAE,EAAE;gBACb,IAAI,EAAE,MAAM,CACV,GAAG,CAAC,MAAM,KAAK,SAAS;oBACtB,gCAAgC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EACpD,GAAG,CAAC,MAAM,EAAE,WAAW,IAAI,EAAE,EAC7B,GAAG,CACJ;aACF,CAAC;QACJ,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,6DAA6D;YAC7D,kEAAkE;YAClE,kEAAkE;YAClE,mEAAmE;YACnE,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAC7D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO;gBACL,IAAI;gBACJ,WAAW;gBACX,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;gBAC5B,SAAS,EAAE,cAAc,CAAC,sBAAsB,EAAE,GAAG,CAAC;gBACtD,SAAS,EAAE,EAAE;gBACb,IAAI,EAAE,IAAI;aACX,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,IAAI,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,SAAS,MAAM,CAAC,QAAiB,EAAE,WAAmB,EAAE,GAAW;IACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,GAAG,GAAG,UAAU,GAAG,sCAAsC,CAAC;AACnE,CAAC;AAQD,SAAS,cAAc,CAAC,MAAsB,EAAE,GAAY;IAC1D,OAAO,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,MAAM,CAEnB,KAA0B,EAAE,IAAqB,EAAE,EAAU,EAAE,MAAY;IAC3E,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,KAA0B,EAC1B,WAAmB;IAEnB,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,WAAW,CAC5B,eAAe,CAAC,iBAAiB,EACjC,kBAAkB,EAClB,WAAW,EACX,sBAAsB,CACvB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/runnerauth/built-in-runner-credential-provider.d.ts

@@ -0,0 +1,28 @@
+import type { AccountsByCaller } from "../domain/identityaccount/resolve.js";
+import type { CallerIdentity } from "../extensions/identity.js";
+import type { BoundExecutionKind, BoundExecutionStore } from "./bound-execution.js";
+import type { RunnerCredentialProvider } from "./runner-credential-provider.js";
+import type { RunnerAuthService } from "./runnerauth.js";
+/** What a runner-class caller's credential is bound to. */
+export interface RunnerBinding {
+    readonly kind: BoundExecutionKind;
+    readonly executionId: string;
+}
+export interface BuiltInRunnerCredentialProviderDeps {
+    /** The service that signed every token this provider reads. */
+    readonly service: RunnerAuthService;
+    /** Where the bound executions live — the capture and exchange capabilities' one read each. */
+    readonly store: BoundExecutionStore;
+    /** Resolves a run's creator stamp to its person — the exchange's owner check, the verifier's reading. */
+    readonly accounts: AccountsByCaller;
+}
+/**
+ * The one reading of a runner's binding. `undefined` for anything that
+ * is not a runner-class caller holding a token this service signed whose
+ * binding names an execution kind; never a throw.
+ */
+export declare function runnerBindingOf(service: RunnerAuthService, caller: CallerIdentity): RunnerBinding | undefined;
+/** The lane-admission predicate: a runner acting for a WORKFLOW execution (the cloud's `workflow_sandbox`). */
+export declare function isWorkflowBoundRunner(service: RunnerAuthService, caller: CallerIdentity): boolean;
+export declare function newBuiltInRunnerCredentialProvider(deps: BuiltInRunnerCredentialProviderDeps): RunnerCredentialProvider;
+//# sourceMappingURL=built-in-runner-credential-provider.d.ts.map

package/dist/runnerauth/built-in-runner-credential-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"built-in-runner-credential-provider.d.ts","sourceRoot":"","sources":["../../src/runnerauth/built-in-runner-credential-provider.ts"],"names":[],"mappings":"AAkGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAQhE,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAM9B,OAAO,KAAK,EAEV,wBAAwB,EAGzB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,2DAA2D;AAC3D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,mCAAmC;IAClD,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,yGAAyG;IACzG,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,cAAc,GACrB,aAAa,GAAG,SAAS,CAY3B;AAED,+GAA+G;AAC/G,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,cAAc,GACrB,OAAO,CAET;AAkBD,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,mCAAmC,GACxC,wBAAwB,CA+G1B"}