@stigmer/server 3.40.1 → 3.41.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (527) hide show
  1. package/dist/authorization/authorizer.d.ts +16 -10
  2. package/dist/authorization/authorizer.d.ts.map +1 -1
  3. package/dist/authorization/authorizer.js +17 -9
  4. package/dist/authorization/authorizer.js.map +1 -1
  5. package/dist/authorization/derived-tuples.d.ts +7 -3
  6. package/dist/authorization/derived-tuples.d.ts.map +1 -1
  7. package/dist/authorization/derived-tuples.js +62 -6
  8. package/dist/authorization/derived-tuples.js.map +1 -1
  9. package/dist/authorization/evaluator.d.ts +11 -7
  10. package/dist/authorization/evaluator.d.ts.map +1 -1
  11. package/dist/authorization/evaluator.js +16 -10
  12. package/dist/authorization/evaluator.js.map +1 -1
  13. package/dist/authorization/list-read-scope.d.ts +4 -0
  14. package/dist/authorization/list-read-scope.d.ts.map +1 -1
  15. package/dist/authorization/list-read-scope.js +1 -0
  16. package/dist/authorization/list-read-scope.js.map +1 -1
  17. package/dist/authorization/model/data/authorization-model.json +830 -67
  18. package/dist/authorization/model/execution-viewer.d.ts.map +1 -1
  19. package/dist/authorization/model/execution-viewer.js +26 -24
  20. package/dist/authorization/model/execution-viewer.js.map +1 -1
  21. package/dist/authorization/model/index.d.ts +4 -1
  22. package/dist/authorization/model/index.d.ts.map +1 -1
  23. package/dist/authorization/model/index.js +4 -1
  24. package/dist/authorization/model/index.js.map +1 -1
  25. package/dist/authorization/model/rewrite.d.ts +5 -3
  26. package/dist/authorization/model/rewrite.d.ts.map +1 -1
  27. package/dist/authorization/organization-directory.d.ts +44 -0
  28. package/dist/authorization/organization-directory.d.ts.map +1 -1
  29. package/dist/authorization/organization-directory.js +1 -0
  30. package/dist/authorization/organization-directory.js.map +1 -1
  31. package/dist/authorization/person.d.ts +14 -1
  32. package/dist/authorization/person.d.ts.map +1 -1
  33. package/dist/authorization/person.js +16 -0
  34. package/dist/authorization/person.js.map +1 -1
  35. package/dist/authorization/policy-check.d.ts +52 -0
  36. package/dist/authorization/policy-check.d.ts.map +1 -0
  37. package/dist/authorization/policy-check.js +35 -0
  38. package/dist/authorization/policy-check.js.map +1 -0
  39. package/dist/authorization/posture.d.ts +30 -4
  40. package/dist/authorization/posture.d.ts.map +1 -1
  41. package/dist/authorization/posture.js +58 -0
  42. package/dist/authorization/posture.js.map +1 -1
  43. package/dist/authorization/resource-creators.d.ts +4 -0
  44. package/dist/authorization/resource-creators.d.ts.map +1 -0
  45. package/dist/authorization/resource-creators.js +44 -0
  46. package/dist/authorization/resource-creators.js.map +1 -0
  47. package/dist/authorization/trusted-local-authorizer.d.ts +9 -0
  48. package/dist/authorization/trusted-local-authorizer.d.ts.map +1 -0
  49. package/dist/authorization/trusted-local-authorizer.js +70 -0
  50. package/dist/authorization/trusted-local-authorizer.js.map +1 -0
  51. package/dist/authorization/tuples.d.ts +12 -0
  52. package/dist/authorization/tuples.d.ts.map +1 -1
  53. package/dist/authorization/tuples.js +3 -0
  54. package/dist/authorization/tuples.js.map +1 -1
  55. package/dist/boot/compose.d.ts.map +1 -1
  56. package/dist/boot/compose.js +132 -43
  57. package/dist/boot/compose.js.map +1 -1
  58. package/dist/boot/config.d.ts +22 -7
  59. package/dist/boot/config.d.ts.map +1 -1
  60. package/dist/boot/config.js +2 -1
  61. package/dist/boot/config.js.map +1 -1
  62. package/dist/boot/inprocess.d.ts.map +1 -1
  63. package/dist/boot/inprocess.js +10 -4
  64. package/dist/boot/inprocess.js.map +1 -1
  65. package/dist/boot/list-indexes.d.ts.map +1 -1
  66. package/dist/boot/list-indexes.js +6 -1
  67. package/dist/boot/list-indexes.js.map +1 -1
  68. package/dist/boot/logger.d.ts +3 -1
  69. package/dist/boot/logger.d.ts.map +1 -1
  70. package/dist/boot/logger.js +3 -1
  71. package/dist/boot/logger.js.map +1 -1
  72. package/dist/boot/oauth-redirect-uri.d.ts +33 -12
  73. package/dist/boot/oauth-redirect-uri.d.ts.map +1 -1
  74. package/dist/boot/oauth-redirect-uri.js +43 -14
  75. package/dist/boot/oauth-redirect-uri.js.map +1 -1
  76. package/dist/boot/skill-transfer-origin.d.ts +46 -14
  77. package/dist/boot/skill-transfer-origin.d.ts.map +1 -1
  78. package/dist/boot/skill-transfer-origin.js +53 -13
  79. package/dist/boot/skill-transfer-origin.js.map +1 -1
  80. package/dist/domain/agentchannel/steps.d.ts +8 -6
  81. package/dist/domain/agentchannel/steps.d.ts.map +1 -1
  82. package/dist/domain/agentchannel/steps.js +9 -7
  83. package/dist/domain/agentchannel/steps.js.map +1 -1
  84. package/dist/domain/agentexecution/controller.d.ts +7 -0
  85. package/dist/domain/agentexecution/controller.d.ts.map +1 -1
  86. package/dist/domain/agentexecution/controller.js +1 -1
  87. package/dist/domain/agentexecution/controller.js.map +1 -1
  88. package/dist/domain/agentexecution/create-steps.d.ts +26 -12
  89. package/dist/domain/agentexecution/create-steps.d.ts.map +1 -1
  90. package/dist/domain/agentexecution/create-steps.js +61 -43
  91. package/dist/domain/agentexecution/create-steps.js.map +1 -1
  92. package/dist/domain/agentexecution/submit-approval.d.ts.map +1 -1
  93. package/dist/domain/agentexecution/submit-approval.js +9 -6
  94. package/dist/domain/agentexecution/submit-approval.js.map +1 -1
  95. package/dist/domain/agentexecution/submit-file-decision.d.ts.map +1 -1
  96. package/dist/domain/agentexecution/submit-file-decision.js +5 -4
  97. package/dist/domain/agentexecution/submit-file-decision.js.map +1 -1
  98. package/dist/domain/agentshare/steps.d.ts +5 -3
  99. package/dist/domain/agentshare/steps.d.ts.map +1 -1
  100. package/dist/domain/agentshare/steps.js +6 -4
  101. package/dist/domain/agentshare/steps.js.map +1 -1
  102. package/dist/domain/apikey/verifier.d.ts +7 -0
  103. package/dist/domain/apikey/verifier.d.ts.map +1 -1
  104. package/dist/domain/apikey/verifier.js +34 -1
  105. package/dist/domain/apikey/verifier.js.map +1 -1
  106. package/dist/domain/channelapp/controller.d.ts +4 -3
  107. package/dist/domain/channelapp/controller.d.ts.map +1 -1
  108. package/dist/domain/channelapp/controller.js.map +1 -1
  109. package/dist/domain/executioncontext/steps.d.ts +2 -1
  110. package/dist/domain/executioncontext/steps.d.ts.map +1 -1
  111. package/dist/domain/executioncontext/steps.js +2 -1
  112. package/dist/domain/executioncontext/steps.js.map +1 -1
  113. package/dist/domain/iampolicy/access-lists.d.ts.map +1 -1
  114. package/dist/domain/iampolicy/access-lists.js +57 -2
  115. package/dist/domain/iampolicy/access-lists.js.map +1 -1
  116. package/dist/domain/iampolicy/change.d.ts +53 -0
  117. package/dist/domain/iampolicy/change.d.ts.map +1 -0
  118. package/dist/domain/iampolicy/change.js +44 -0
  119. package/dist/domain/iampolicy/change.js.map +1 -0
  120. package/dist/domain/iampolicy/constants.d.ts +6 -0
  121. package/dist/domain/iampolicy/constants.d.ts.map +1 -1
  122. package/dist/domain/iampolicy/constants.js +6 -0
  123. package/dist/domain/iampolicy/constants.js.map +1 -1
  124. package/dist/domain/iampolicy/controller.d.ts.map +1 -1
  125. package/dist/domain/iampolicy/controller.js +9 -5
  126. package/dist/domain/iampolicy/controller.js.map +1 -1
  127. package/dist/domain/iampolicy/grant-path.d.ts +31 -13
  128. package/dist/domain/iampolicy/grant-path.d.ts.map +1 -1
  129. package/dist/domain/iampolicy/grant-path.js +216 -19
  130. package/dist/domain/iampolicy/grant-path.js.map +1 -1
  131. package/dist/domain/iampolicy/membership.d.ts +11 -3
  132. package/dist/domain/iampolicy/membership.d.ts.map +1 -1
  133. package/dist/domain/iampolicy/membership.js +18 -13
  134. package/dist/domain/iampolicy/membership.js.map +1 -1
  135. package/dist/domain/iampolicy/resource-store.d.ts.map +1 -1
  136. package/dist/domain/iampolicy/resource-store.js +4 -0
  137. package/dist/domain/iampolicy/resource-store.js.map +1 -1
  138. package/dist/domain/iampolicy/role-lifecycle.d.ts.map +1 -1
  139. package/dist/domain/iampolicy/role-lifecycle.js +2 -2
  140. package/dist/domain/iampolicy/role-lifecycle.js.map +1 -1
  141. package/dist/domain/iampolicy/roles.d.ts.map +1 -1
  142. package/dist/domain/iampolicy/roles.js +7 -0
  143. package/dist/domain/iampolicy/roles.js.map +1 -1
  144. package/dist/domain/iampolicy/steps.d.ts +4 -3
  145. package/dist/domain/iampolicy/steps.d.ts.map +1 -1
  146. package/dist/domain/iampolicy/steps.js +7 -7
  147. package/dist/domain/iampolicy/steps.js.map +1 -1
  148. package/dist/domain/iampolicy/store-contract.d.ts.map +1 -1
  149. package/dist/domain/iampolicy/store-contract.js +22 -1
  150. package/dist/domain/iampolicy/store-contract.js.map +1 -1
  151. package/dist/domain/iampolicy/store.d.ts +18 -5
  152. package/dist/domain/iampolicy/store.d.ts.map +1 -1
  153. package/dist/domain/iampolicy/store.js.map +1 -1
  154. package/dist/domain/identityaccount/constants.d.ts +15 -0
  155. package/dist/domain/identityaccount/constants.d.ts.map +1 -1
  156. package/dist/domain/identityaccount/constants.js +17 -0
  157. package/dist/domain/identityaccount/constants.js.map +1 -1
  158. package/dist/domain/identityaccount/controller.d.ts.map +1 -1
  159. package/dist/domain/identityaccount/controller.js +17 -6
  160. package/dist/domain/identityaccount/controller.js.map +1 -1
  161. package/dist/domain/identityaccount/resolve.d.ts +47 -0
  162. package/dist/domain/identityaccount/resolve.d.ts.map +1 -1
  163. package/dist/domain/identityaccount/resolve.js +38 -1
  164. package/dist/domain/identityaccount/resolve.js.map +1 -1
  165. package/dist/domain/identityaccount/resource-store.d.ts.map +1 -1
  166. package/dist/domain/identityaccount/resource-store.js +11 -1
  167. package/dist/domain/identityaccount/resource-store.js.map +1 -1
  168. package/dist/domain/identityaccount/steps.d.ts +2 -1
  169. package/dist/domain/identityaccount/steps.d.ts.map +1 -1
  170. package/dist/domain/identityaccount/steps.js +4 -3
  171. package/dist/domain/identityaccount/steps.js.map +1 -1
  172. package/dist/domain/identityaccount/store-contract.js +2 -2
  173. package/dist/domain/identityaccount/store-contract.js.map +1 -1
  174. package/dist/domain/identityaccount/store.d.ts +6 -1
  175. package/dist/domain/identityaccount/store.d.ts.map +1 -1
  176. package/dist/domain/mcpserver/connect-sandbox.d.ts +67 -0
  177. package/dist/domain/mcpserver/connect-sandbox.d.ts.map +1 -0
  178. package/dist/domain/mcpserver/connect-sandbox.js +64 -0
  179. package/dist/domain/mcpserver/connect-sandbox.js.map +1 -0
  180. package/dist/domain/mcpserver/connect.d.ts +42 -10
  181. package/dist/domain/mcpserver/connect.d.ts.map +1 -1
  182. package/dist/domain/mcpserver/connect.js +147 -40
  183. package/dist/domain/mcpserver/connect.js.map +1 -1
  184. package/dist/domain/mcpserver/controller.js +4 -2
  185. package/dist/domain/mcpserver/controller.js.map +1 -1
  186. package/dist/domain/mcpserver/engine.d.ts +26 -7
  187. package/dist/domain/mcpserver/engine.d.ts.map +1 -1
  188. package/dist/domain/mcpserver/engine.js.map +1 -1
  189. package/dist/domain/mcpserver/start-connect.d.ts +5 -0
  190. package/dist/domain/mcpserver/start-connect.d.ts.map +1 -1
  191. package/dist/domain/mcpserver/start-connect.js +38 -15
  192. package/dist/domain/mcpserver/start-connect.js.map +1 -1
  193. package/dist/domain/memory/controller.js +2 -1
  194. package/dist/domain/memory/controller.js.map +1 -1
  195. package/dist/domain/memory/list-index.d.ts +2 -0
  196. package/dist/domain/memory/list-index.d.ts.map +1 -0
  197. package/dist/domain/memory/list-index.js +31 -0
  198. package/dist/domain/memory/list-index.js.map +1 -0
  199. package/dist/domain/memory/queries.d.ts +10 -0
  200. package/dist/domain/memory/queries.d.ts.map +1 -0
  201. package/dist/domain/memory/queries.js +54 -0
  202. package/dist/domain/memory/queries.js.map +1 -0
  203. package/dist/domain/memory/steps.d.ts +13 -11
  204. package/dist/domain/memory/steps.d.ts.map +1 -1
  205. package/dist/domain/memory/steps.js +26 -57
  206. package/dist/domain/memory/steps.js.map +1 -1
  207. package/dist/domain/organization/steps.d.ts.map +1 -1
  208. package/dist/domain/organization/steps.js +1 -1
  209. package/dist/domain/organization/steps.js.map +1 -1
  210. package/dist/domain/platformclient/mint.d.ts.map +1 -1
  211. package/dist/domain/platformclient/mint.js +2 -2
  212. package/dist/domain/platformclient/mint.js.map +1 -1
  213. package/dist/domain/platformclient/verifier.d.ts.map +1 -1
  214. package/dist/domain/platformclient/verifier.js +6 -3
  215. package/dist/domain/platformclient/verifier.js.map +1 -1
  216. package/dist/domain/plugin/push.d.ts.map +1 -1
  217. package/dist/domain/plugin/push.js +1 -0
  218. package/dist/domain/plugin/push.js.map +1 -1
  219. package/dist/domain/schedule/steps.d.ts +3 -1
  220. package/dist/domain/schedule/steps.d.ts.map +1 -1
  221. package/dist/domain/schedule/steps.js +3 -1
  222. package/dist/domain/schedule/steps.js.map +1 -1
  223. package/dist/domain/skill/push.d.ts.map +1 -1
  224. package/dist/domain/skill/push.js +1 -0
  225. package/dist/domain/skill/push.js.map +1 -1
  226. package/dist/domain/workflow/registry/data/task-kind-registry.json +27 -1
  227. package/dist/domain/workflowexecution/submit-approval.d.ts +5 -2
  228. package/dist/domain/workflowexecution/submit-approval.d.ts.map +1 -1
  229. package/dist/domain/workflowexecution/submit-approval.js +1 -1
  230. package/dist/domain/workflowexecution/submit-approval.js.map +1 -1
  231. package/dist/domain/workflowexecution/submit-file-decision.d.ts +5 -2
  232. package/dist/domain/workflowexecution/submit-file-decision.d.ts.map +1 -1
  233. package/dist/domain/workflowexecution/submit-file-decision.js +1 -1
  234. package/dist/domain/workflowexecution/submit-file-decision.js.map +1 -1
  235. package/dist/domain/workflowexecution/submit-workflow-task-approval.d.ts.map +1 -1
  236. package/dist/domain/workflowexecution/submit-workflow-task-approval.js +12 -1
  237. package/dist/domain/workflowexecution/submit-workflow-task-approval.js.map +1 -1
  238. package/dist/domain/workflowinstance/controller.d.ts +6 -3
  239. package/dist/domain/workflowinstance/controller.d.ts.map +1 -1
  240. package/dist/domain/workflowinstance/controller.js +12 -7
  241. package/dist/domain/workflowinstance/controller.js.map +1 -1
  242. package/dist/domain/workflowinstance/steps.d.ts +31 -0
  243. package/dist/domain/workflowinstance/steps.d.ts.map +1 -1
  244. package/dist/domain/workflowinstance/steps.js +88 -1
  245. package/dist/domain/workflowinstance/steps.js.map +1 -1
  246. package/dist/extensions/composed-services.d.ts +56 -0
  247. package/dist/extensions/composed-services.d.ts.map +1 -0
  248. package/dist/extensions/composed-services.js +2 -0
  249. package/dist/extensions/composed-services.js.map +1 -0
  250. package/dist/extensions/drivers.d.ts +32 -1
  251. package/dist/extensions/drivers.d.ts.map +1 -1
  252. package/dist/extensions/identity.d.ts +4 -1
  253. package/dist/extensions/identity.d.ts.map +1 -1
  254. package/dist/extensions/identity.js +4 -1
  255. package/dist/extensions/identity.js.map +1 -1
  256. package/dist/extensions/registry.d.ts +37 -0
  257. package/dist/extensions/registry.d.ts.map +1 -1
  258. package/dist/extensions/registry.js +50 -0
  259. package/dist/extensions/registry.js.map +1 -1
  260. package/dist/extensions/resource-authorization.d.ts +78 -0
  261. package/dist/extensions/resource-authorization.d.ts.map +1 -1
  262. package/dist/extensions/resource-row-reader.d.ts +43 -0
  263. package/dist/extensions/resource-row-reader.d.ts.map +1 -0
  264. package/dist/extensions/resource-row-reader.js +2 -0
  265. package/dist/extensions/resource-row-reader.js.map +1 -0
  266. package/dist/extensions/visitor-classifier.d.ts +41 -0
  267. package/dist/extensions/visitor-classifier.d.ts.map +1 -0
  268. package/dist/extensions/visitor-classifier.js +2 -0
  269. package/dist/extensions/visitor-classifier.js.map +1 -0
  270. package/dist/identity/oidc-userinfo.d.ts +6 -1
  271. package/dist/identity/oidc-userinfo.d.ts.map +1 -1
  272. package/dist/identity/oidc-userinfo.js.map +1 -1
  273. package/dist/identity/oidc-verifier.d.ts.map +1 -1
  274. package/dist/identity/oidc-verifier.js +37 -8
  275. package/dist/identity/oidc-verifier.js.map +1 -1
  276. package/dist/index.d.ts +14 -6
  277. package/dist/index.d.ts.map +1 -1
  278. package/dist/index.js +25 -9
  279. package/dist/index.js.map +1 -1
  280. package/dist/pipeline/errors.d.ts +8 -0
  281. package/dist/pipeline/errors.d.ts.map +1 -1
  282. package/dist/pipeline/errors.js +25 -16
  283. package/dist/pipeline/errors.js.map +1 -1
  284. package/dist/pipeline/interceptors/auth.d.ts +17 -9
  285. package/dist/pipeline/interceptors/auth.d.ts.map +1 -1
  286. package/dist/pipeline/interceptors/auth.js +17 -9
  287. package/dist/pipeline/interceptors/auth.js.map +1 -1
  288. package/dist/pipeline/steps/authorization-tuples.d.ts +23 -1
  289. package/dist/pipeline/steps/authorization-tuples.d.ts.map +1 -1
  290. package/dist/pipeline/steps/authorization-tuples.js +42 -0
  291. package/dist/pipeline/steps/authorization-tuples.js.map +1 -1
  292. package/dist/pipeline/steps/authorize.d.ts +6 -5
  293. package/dist/pipeline/steps/authorize.d.ts.map +1 -1
  294. package/dist/pipeline/steps/authorize.js +6 -5
  295. package/dist/pipeline/steps/authorize.js.map +1 -1
  296. package/dist/pipeline/steps/defaults.d.ts +12 -0
  297. package/dist/pipeline/steps/defaults.d.ts.map +1 -1
  298. package/dist/pipeline/steps/defaults.js +42 -7
  299. package/dist/pipeline/steps/defaults.js.map +1 -1
  300. package/dist/pipeline/steps/guard-memory-capture.d.ts +13 -15
  301. package/dist/pipeline/steps/guard-memory-capture.d.ts.map +1 -1
  302. package/dist/pipeline/steps/guard-memory-capture.js +2 -3
  303. package/dist/pipeline/steps/guard-memory-capture.js.map +1 -1
  304. package/dist/runnerauth/built-in-runner-credential-provider.d.ts +0 -2
  305. package/dist/runnerauth/built-in-runner-credential-provider.d.ts.map +1 -1
  306. package/dist/runnerauth/built-in-runner-credential-provider.js +8 -17
  307. package/dist/runnerauth/built-in-runner-credential-provider.js.map +1 -1
  308. package/dist/runnerauth/runner-credential-provider.d.ts +17 -7
  309. package/dist/runnerauth/runner-credential-provider.d.ts.map +1 -1
  310. package/dist/runnerauth/runner-credential-provider.js.map +1 -1
  311. package/dist/sandbox/docker.d.ts.map +1 -1
  312. package/dist/sandbox/docker.js +3 -0
  313. package/dist/sandbox/docker.js.map +1 -1
  314. package/dist/sandbox/kubernetes.d.ts.map +1 -1
  315. package/dist/sandbox/kubernetes.js +3 -0
  316. package/dist/sandbox/kubernetes.js.map +1 -1
  317. package/dist/sandbox/local-process.d.ts.map +1 -1
  318. package/dist/sandbox/local-process.js +4 -0
  319. package/dist/sandbox/local-process.js.map +1 -1
  320. package/dist/sandbox/provisioner.d.ts +18 -6
  321. package/dist/sandbox/provisioner.d.ts.map +1 -1
  322. package/dist/sandbox/provisioner.js.map +1 -1
  323. package/dist/temporal/manager.d.ts +5 -0
  324. package/dist/temporal/manager.d.ts.map +1 -1
  325. package/dist/temporal/manager.js +9 -0
  326. package/dist/temporal/manager.js.map +1 -1
  327. package/dist/temporal/mcpserver/engine-client.d.ts +2 -2
  328. package/dist/temporal/mcpserver/engine-client.d.ts.map +1 -1
  329. package/dist/temporal/mcpserver/engine-client.js +6 -4
  330. package/dist/temporal/mcpserver/engine-client.js.map +1 -1
  331. package/dist/temporal/mcpserver/names.d.ts +13 -2
  332. package/dist/temporal/mcpserver/names.d.ts.map +1 -1
  333. package/dist/temporal/mcpserver/names.js +15 -2
  334. package/dist/temporal/mcpserver/names.js.map +1 -1
  335. package/dist/temporal/sdk-logger.d.ts +74 -0
  336. package/dist/temporal/sdk-logger.d.ts.map +1 -0
  337. package/dist/temporal/sdk-logger.js +143 -0
  338. package/dist/temporal/sdk-logger.js.map +1 -0
  339. package/package.json +6 -6
  340. package/src/authorization/README.md +18 -6
  341. package/src/authorization/__tests__/authorizer.test.ts +5 -1
  342. package/src/authorization/__tests__/derived-tuples.test.ts +26 -0
  343. package/src/authorization/__tests__/evaluator.test.ts +4 -0
  344. package/src/authorization/__tests__/list-read-scope.test.ts +11 -5
  345. package/src/authorization/__tests__/store-tests.test.ts +3 -1
  346. package/src/authorization/__tests__/trusted-local-authorizer.test.ts +155 -0
  347. package/src/authorization/__tests__/unit-owned-kinds.test.ts +420 -0
  348. package/src/authorization/__tests__/wire-permissions.test.ts +31 -2
  349. package/src/authorization/authorizer.ts +21 -10
  350. package/src/authorization/derived-tuples.ts +92 -18
  351. package/src/authorization/evaluator.ts +30 -15
  352. package/src/authorization/list-read-scope.ts +4 -0
  353. package/src/authorization/model/__tests__/registry.test.ts +23 -0
  354. package/src/authorization/model/data/authorization-model.json +830 -67
  355. package/src/authorization/model/execution-viewer.ts +32 -27
  356. package/src/authorization/model/index.ts +4 -1
  357. package/src/authorization/model/rewrite.ts +5 -3
  358. package/src/authorization/organization-directory.ts +4 -0
  359. package/src/authorization/person.ts +32 -1
  360. package/src/authorization/policy-check.ts +105 -0
  361. package/src/authorization/posture.ts +45 -4
  362. package/src/authorization/resource-creators.ts +48 -0
  363. package/src/authorization/trusted-local-authorizer.ts +91 -0
  364. package/src/authorization/tuples.ts +17 -0
  365. package/src/boot/__tests__/compose.test.ts +120 -4
  366. package/src/boot/__tests__/list-indexes.test.ts +4 -0
  367. package/src/boot/__tests__/oauth-redirect-uri.test.ts +121 -10
  368. package/src/boot/__tests__/skill-transfer-origin.test.ts +96 -25
  369. package/src/boot/compose.ts +153 -61
  370. package/src/boot/config.ts +28 -12
  371. package/src/boot/inprocess.ts +18 -4
  372. package/src/boot/list-indexes.ts +6 -1
  373. package/src/boot/logger.ts +3 -1
  374. package/src/boot/oauth-redirect-uri.ts +62 -17
  375. package/src/boot/skill-transfer-origin.ts +71 -16
  376. package/src/domain/agent/__tests__/agent.test.ts +42 -1
  377. package/src/domain/agentchannel/__tests__/agentchannel.test.ts +9 -0
  378. package/src/domain/agentchannel/__tests__/channel-runtime.test.ts +2 -0
  379. package/src/domain/agentchannel/__tests__/create-authorization.test.ts +7 -6
  380. package/src/domain/agentchannel/steps.ts +9 -7
  381. package/src/domain/agentexecution/__tests__/agentexecution.test.ts +148 -56
  382. package/src/domain/agentexecution/__tests__/create-steps.test.ts +175 -12
  383. package/src/domain/agentexecution/__tests__/file-review-seed.ts +91 -0
  384. package/src/domain/agentexecution/controller.ts +8 -0
  385. package/src/domain/agentexecution/create-steps.ts +74 -44
  386. package/src/domain/agentexecution/submit-approval.ts +9 -6
  387. package/src/domain/agentexecution/submit-file-decision.ts +5 -4
  388. package/src/domain/agentinstance/__tests__/agentinstance.test.ts +2 -0
  389. package/src/domain/agentshare/__tests__/agentshare.test.ts +17 -0
  390. package/src/domain/agentshare/__tests__/create-authorization.test.ts +5 -4
  391. package/src/domain/agentshare/steps.ts +6 -4
  392. package/src/domain/apikey/__tests__/verifier.test.ts +73 -1
  393. package/src/domain/apikey/verifier.ts +45 -1
  394. package/src/domain/artifact/__tests__/artifact.test.ts +13 -24
  395. package/src/domain/channelapp/__tests__/channelapp.test.ts +7 -0
  396. package/src/domain/channelapp/controller.ts +4 -3
  397. package/src/domain/environment/__tests__/environment.test.ts +13 -0
  398. package/src/domain/executioncontext/__tests__/executioncontext.test.ts +2 -0
  399. package/src/domain/executioncontext/steps.ts +2 -1
  400. package/src/domain/iampolicy/__tests__/access-lists.test.ts +79 -0
  401. package/src/domain/iampolicy/__tests__/change.test.ts +63 -0
  402. package/src/domain/iampolicy/__tests__/controller.test.ts +39 -3
  403. package/src/domain/iampolicy/__tests__/grant-path.test.ts +595 -27
  404. package/src/domain/iampolicy/__tests__/iampolicy.test.ts +33 -2
  405. package/src/domain/iampolicy/__tests__/membership.test.ts +47 -5
  406. package/src/domain/iampolicy/__tests__/resource-store.test.ts +1 -0
  407. package/src/domain/iampolicy/__tests__/role-lifecycle.test.ts +41 -8
  408. package/src/domain/iampolicy/__tests__/roles.test.ts +3 -2
  409. package/src/domain/iampolicy/__tests__/steps.test.ts +75 -6
  410. package/src/domain/iampolicy/__tests__/support.ts +68 -4
  411. package/src/domain/iampolicy/access-lists.ts +70 -2
  412. package/src/domain/iampolicy/change.ts +109 -0
  413. package/src/domain/iampolicy/constants.ts +8 -0
  414. package/src/domain/iampolicy/controller.ts +17 -3
  415. package/src/domain/iampolicy/grant-path.ts +349 -31
  416. package/src/domain/iampolicy/membership.ts +32 -12
  417. package/src/domain/iampolicy/resource-store.ts +4 -0
  418. package/src/domain/iampolicy/role-lifecycle.ts +2 -0
  419. package/src/domain/iampolicy/roles.ts +8 -0
  420. package/src/domain/iampolicy/steps.ts +15 -5
  421. package/src/domain/iampolicy/store-contract.ts +37 -1
  422. package/src/domain/iampolicy/store.ts +19 -5
  423. package/src/domain/identityaccount/__tests__/resolve.test.ts +246 -2
  424. package/src/domain/identityaccount/__tests__/resource-store.test.ts +1 -1
  425. package/src/domain/identityaccount/constants.ts +20 -0
  426. package/src/domain/identityaccount/controller.ts +20 -5
  427. package/src/domain/identityaccount/resolve.ts +80 -1
  428. package/src/domain/identityaccount/resource-store.ts +14 -1
  429. package/src/domain/identityaccount/steps.ts +4 -3
  430. package/src/domain/identityaccount/store-contract.ts +4 -4
  431. package/src/domain/identityaccount/store.ts +6 -1
  432. package/src/domain/mcpserver/__tests__/connect-authorization.test.ts +1 -0
  433. package/src/domain/mcpserver/__tests__/connect.test.ts +358 -15
  434. package/src/domain/mcpserver/__tests__/mcpserver.test.ts +2 -0
  435. package/src/domain/mcpserver/__tests__/oauth-handshake.test.ts +2 -0
  436. package/src/domain/mcpserver/__tests__/store-faults.test.ts +2 -0
  437. package/src/domain/mcpserver/connect-sandbox.ts +135 -0
  438. package/src/domain/mcpserver/connect.ts +226 -56
  439. package/src/domain/mcpserver/controller.ts +8 -2
  440. package/src/domain/mcpserver/engine.ts +24 -6
  441. package/src/domain/mcpserver/start-connect.ts +49 -10
  442. package/src/domain/memory/__tests__/memory.test.ts +92 -22
  443. package/src/domain/memory/__tests__/queries.test.ts +173 -0
  444. package/src/domain/memory/controller.ts +2 -1
  445. package/src/domain/memory/list-index.ts +32 -0
  446. package/src/domain/memory/queries.ts +72 -0
  447. package/src/domain/memory/steps.ts +26 -63
  448. package/src/domain/oauthapp/__tests__/oauthapp.test.ts +14 -0
  449. package/src/domain/organization/__tests__/support.ts +41 -0
  450. package/src/domain/organization/steps.ts +1 -0
  451. package/src/domain/platformclient/mint.ts +6 -2
  452. package/src/domain/platformclient/verifier.ts +6 -3
  453. package/src/domain/plugin/__tests__/plugin.test.ts +11 -24
  454. package/src/domain/plugin/push.ts +1 -0
  455. package/src/domain/schedule/__tests__/schedule.composed.test.ts +2 -0
  456. package/src/domain/schedule/steps.ts +3 -1
  457. package/src/domain/session/__tests__/session.test.ts +2 -0
  458. package/src/domain/skill/__tests__/skill.test.ts +7 -25
  459. package/src/domain/skill/push.ts +1 -0
  460. package/src/domain/workflow/__tests__/workflow.test.ts +2 -0
  461. package/src/domain/workflow/registry/data/task-kind-registry.json +27 -1
  462. package/src/domain/workflowexecution/__tests__/forward-attribution-composed.test.ts +270 -0
  463. package/src/domain/workflowexecution/__tests__/submit-workflow-task-approval.test.ts +196 -0
  464. package/src/domain/workflowexecution/__tests__/workflowexecution.test.ts +3 -57
  465. package/src/domain/workflowexecution/submit-approval.ts +9 -2
  466. package/src/domain/workflowexecution/submit-file-decision.ts +6 -1
  467. package/src/domain/workflowexecution/submit-workflow-task-approval.ts +23 -5
  468. package/src/domain/workflowinstance/controller.ts +27 -9
  469. package/src/domain/workflowinstance/steps.ts +123 -1
  470. package/src/extensions/__tests__/apikey-before-sign-in-composed.test.ts +172 -0
  471. package/src/extensions/__tests__/built-in-authorization-composed.test.ts +80 -1
  472. package/src/extensions/__tests__/composed-services-composed.test.ts +236 -0
  473. package/src/extensions/__tests__/extension-composition.test.ts +229 -16
  474. package/src/extensions/__tests__/identity-account-composed.test.ts +84 -4
  475. package/src/extensions/__tests__/list-read-scope-composed.test.ts +2 -0
  476. package/src/extensions/__tests__/registry.test.ts +147 -1
  477. package/src/extensions/__tests__/secret-cleanup-composed.test.ts +2 -0
  478. package/src/extensions/__tests__/visitor-classifier-points.test.ts +42 -0
  479. package/src/extensions/composed-services.ts +61 -0
  480. package/src/extensions/drivers.ts +33 -1
  481. package/src/extensions/identity.ts +4 -1
  482. package/src/extensions/registry.ts +105 -0
  483. package/src/extensions/resource-authorization.ts +87 -0
  484. package/src/extensions/resource-row-reader.ts +43 -0
  485. package/src/extensions/visitor-classifier.ts +41 -0
  486. package/src/identity/__tests__/oidc-verifier.test.ts +38 -12
  487. package/src/identity/oidc-userinfo.ts +6 -1
  488. package/src/identity/oidc-verifier.ts +42 -8
  489. package/src/index.ts +61 -6
  490. package/src/pipeline/__tests__/steps.test.ts +31 -4
  491. package/src/pipeline/errors.ts +30 -16
  492. package/src/pipeline/interceptors/auth.ts +17 -9
  493. package/src/pipeline/steps/__tests__/authorization-tuples.test.ts +20 -0
  494. package/src/pipeline/steps/__tests__/guard-memory-capture.test.ts +72 -15
  495. package/src/pipeline/steps/authorization-tuples.ts +54 -0
  496. package/src/pipeline/steps/authorize.ts +6 -5
  497. package/src/pipeline/steps/defaults.ts +52 -7
  498. package/src/pipeline/steps/guard-memory-capture.ts +15 -20
  499. package/src/runnerauth/__tests__/built-in-runner-credential-provider.test.ts +1 -1
  500. package/src/runnerauth/__tests__/runner-subject-composed.test.ts +13 -0
  501. package/src/runnerauth/bound-execution.ts +2 -2
  502. package/src/runnerauth/built-in-runner-credential-provider.ts +8 -21
  503. package/src/runnerauth/runner-credential-provider.ts +17 -7
  504. package/src/sandbox/__tests__/docker.integration.test.ts +4 -0
  505. package/src/sandbox/__tests__/kubernetes.test.ts +18 -1
  506. package/src/sandbox/__tests__/local-process.integration.test.ts +4 -0
  507. package/src/sandbox/__tests__/provisioner.test.ts +1 -0
  508. package/src/sandbox/docker.ts +3 -0
  509. package/src/sandbox/kubernetes.ts +3 -0
  510. package/src/sandbox/local-process.ts +4 -0
  511. package/src/sandbox/provisioner.ts +18 -6
  512. package/src/store/postgres/__tests__/support.ts +11 -2
  513. package/src/temporal/README.md +1 -0
  514. package/src/temporal/__tests__/manager.test.ts +56 -4
  515. package/src/temporal/__tests__/sdk-log-workflows.ts +26 -0
  516. package/src/temporal/__tests__/sdk-logger.e2e.test.ts +150 -0
  517. package/src/temporal/__tests__/sdk-logger.test.ts +238 -0
  518. package/src/temporal/manager.ts +9 -0
  519. package/src/temporal/mcpserver/engine-client.ts +8 -3
  520. package/src/temporal/mcpserver/names.ts +16 -2
  521. package/src/temporal/sdk-logger.ts +173 -0
  522. package/dist/authorization/lane-admission.d.ts +0 -50
  523. package/dist/authorization/lane-admission.d.ts.map +0 -1
  524. package/dist/authorization/lane-admission.js +0 -13
  525. package/dist/authorization/lane-admission.js.map +0 -1
  526. package/src/authorization/__tests__/lane-admission.test.ts +0 -115
  527. package/src/authorization/lane-admission.ts +0 -73
@@ -0,0 +1,150 @@
1
+ /**
2
+ * The Temporal SDK's lines reach the server logger's sink through the real
3
+ * Runtime (#1037), end to end: the process bridge installed over the real
4
+ * `Runtime.install`, a real TemporalManager building its worker through
5
+ * createWorker, and a local Temporal server. It pins:
6
+ *
7
+ * - `Activity failed` arrives at warn with the activity's identity
8
+ * (activityType, workflowId, workflowType, attempt) and the error as
9
+ * its message, and without the activity's taskToken;
10
+ * - a workflow body's `log.warn` arrives with every field it passed,
11
+ * the nested one included, tagged `sdkComponent: workflow`;
12
+ * - the SDK's debug `Creating worker` line arrives without the worker
13
+ * options it carries (the payload codecs and their keys ride there).
14
+ *
15
+ * Its own file, so its own vitest process: the Runtime is a process
16
+ * singleton, and this file installs the real one. The bridge attaches
17
+ * BEFORE TestWorkflowEnvironment.createLocal, which creates the Runtime
18
+ * itself; the manager's own attach then retargets the same bridge. Like
19
+ * the invoke-workflow suites, every test is VISIBLY skipped when the
20
+ * local Temporal server cannot start (no `temporal` CLI), never a vacuous
21
+ * green.
22
+ */
23
+ import { ApplicationFailure } from "@temporalio/common";
24
+ import { afterAll, beforeAll, describe, expect, it } from "vitest";
25
+
26
+ import { createLogger, type LogEntry } from "../../boot/logger.js";
27
+ import { TemporalManager } from "../manager.js";
28
+ import { processSdkLogBridge } from "../sdk-logger.js";
29
+ import {
30
+ SDK_LOG_PROBE_ACTIVITY,
31
+ SDK_LOG_PROBE_WARNING,
32
+ SDK_LOG_PROBE_WORKFLOW,
33
+ } from "./sdk-log-workflows.js";
34
+
35
+ const TASK_QUEUE = "sdk-logger-e2e";
36
+ const WORKFLOWS_PATH = new URL("./sdk-log-workflows.ts", import.meta.url)
37
+ .pathname;
38
+
39
+ type TestWorkflowEnvironment =
40
+ import("@temporalio/testing").TestWorkflowEnvironment;
41
+
42
+ const entries: LogEntry[] = [];
43
+ const logger = createLogger({
44
+ level: "debug",
45
+ pretty: false,
46
+ write: () => {},
47
+ sink: (entry) => entries.push(entry),
48
+ });
49
+
50
+ let env: TestWorkflowEnvironment | null = null;
51
+ let manager: TemporalManager | null = null;
52
+ let envReady = false;
53
+
54
+ function findEntry(
55
+ level: LogEntry["level"],
56
+ message: string,
57
+ ): LogEntry | undefined {
58
+ return entries.find(
59
+ (entry) => entry.level === level && entry.message === message,
60
+ );
61
+ }
62
+
63
+ describe("Temporal SDK lines through the server logger (real Runtime)", () => {
64
+ beforeAll(async () => {
65
+ processSdkLogBridge.attach(logger);
66
+ try {
67
+ const { TestWorkflowEnvironment: TWE } =
68
+ await import("@temporalio/testing");
69
+ env = await TWE.createLocal();
70
+ } catch (error) {
71
+ console.warn(
72
+ `Temporal test server unavailable (tests will be skipped): ${error instanceof Error ? error.message : String(error)}`,
73
+ );
74
+ return;
75
+ }
76
+
77
+ manager = new TemporalManager({
78
+ hostPort: env.address,
79
+ namespace: env.namespace ?? "default",
80
+ connection: {},
81
+ logger,
82
+ payloadCodecs: [],
83
+ workerFactories: [
84
+ (deps) =>
85
+ deps.createWorker({
86
+ taskQueue: TASK_QUEUE,
87
+ activities: {
88
+ [SDK_LOG_PROBE_ACTIVITY]: async () => {
89
+ throw ApplicationFailure.create({
90
+ message: "probe activity exploded",
91
+ type: "SdkLogProbeFailure",
92
+ });
93
+ },
94
+ },
95
+ workflows: { workflowsPath: WORKFLOWS_PATH },
96
+ }),
97
+ ],
98
+ });
99
+ envReady =
100
+ (await manager.initialConnect()) &&
101
+ (await manager.startWorkers().then(() => true));
102
+ }, 120_000);
103
+
104
+ afterAll(async () => {
105
+ await manager?.close();
106
+ if (env) await env.teardown();
107
+ }, 30_000);
108
+
109
+ it("carries Activity failed, a workflow warning and the worker's creation line", async (testCtx) => {
110
+ if (!envReady || env === null) return testCtx.skip();
111
+
112
+ const workflowId = `sdk-logger-e2e-${Date.now()}`;
113
+ await expect(
114
+ env.client.workflow.execute(SDK_LOG_PROBE_WORKFLOW, {
115
+ taskQueue: TASK_QUEUE,
116
+ workflowId,
117
+ }),
118
+ ).rejects.toThrow();
119
+
120
+ const failed = findEntry("warn", "Activity failed");
121
+ expect(failed, "the activity failure must reach the sink").toBeDefined();
122
+ expect(failed?.fields).toMatchObject({
123
+ sdkComponent: "worker",
124
+ activityType: SDK_LOG_PROBE_ACTIVITY,
125
+ workflowId,
126
+ workflowType: SDK_LOG_PROBE_WORKFLOW,
127
+ attempt: 1,
128
+ error: "probe activity exploded",
129
+ });
130
+ expect(failed?.fields).not.toHaveProperty("taskToken");
131
+
132
+ const warning = findEntry("warn", SDK_LOG_PROBE_WARNING);
133
+ expect(warning, "the workflow's warning must reach the sink").toBeDefined();
134
+ expect(warning?.fields).toMatchObject({
135
+ sdkComponent: "workflow",
136
+ workflowId,
137
+ workflowType: SDK_LOG_PROBE_WORKFLOW,
138
+ probeCount: 3,
139
+ outcomes: { reaped: 2, kept: 1 },
140
+ });
141
+
142
+ const creating = findEntry("debug", "Creating worker");
143
+ expect(creating, "the SDK's debug lines must reach the sink").toBeDefined();
144
+ expect(creating?.fields).toMatchObject({
145
+ sdkComponent: "worker",
146
+ taskQueue: TASK_QUEUE,
147
+ });
148
+ expect(creating?.fields).not.toHaveProperty("options");
149
+ }, 60_000);
150
+ });
@@ -0,0 +1,238 @@
1
+ /**
2
+ * Pins the Temporal SDK log adapter and its install bridge (#1037):
3
+ *
4
+ * - the level mapping (TRACE folds into debug) and the verbatim message;
5
+ * - the meta table on both sides of the component split: on every line
6
+ * a `taskToken`, a symbol key, null and undefined are dropped, an
7
+ * Error becomes its message and a bigint its decimal string; a nested
8
+ * value passes on a line our code wrote (`workflow`, `activity`,
9
+ * `nexus`) and is dropped from the SDK's own lines, an unknown
10
+ * component counting as the SDK's, and the drop holds for the written
11
+ * line and the sink entry alike;
12
+ * - the bridge installs once and retargets after, catches exactly the
13
+ * SDK's IllegalStateError (warned once, never retried) and lets any
14
+ * other install failure through.
15
+ *
16
+ * Every bridge here is built over a fake install, so nothing creates the
17
+ * native Runtime; the real path is sdk-logger.e2e.test.ts.
18
+ */
19
+ import { IllegalStateError, SdkComponent } from "@temporalio/common";
20
+ import type { RuntimeOptions } from "@temporalio/worker";
21
+ import { describe, expect, it } from "vitest";
22
+
23
+ import { createLogger, type LogEntry, type Logger } from "../../boot/logger.js";
24
+ import {
25
+ createSdkLogBridge,
26
+ createSdkLoggerAdapter,
27
+ toLogFields,
28
+ } from "../sdk-logger.js";
29
+
30
+ function capturingLogger(level = "debug"): {
31
+ logger: Logger;
32
+ lines: string[];
33
+ entries: LogEntry[];
34
+ } {
35
+ const lines: string[] = [];
36
+ const entries: LogEntry[] = [];
37
+ const logger = createLogger({
38
+ level,
39
+ pretty: false,
40
+ write: (line) => lines.push(line),
41
+ sink: (entry) => entries.push(entry),
42
+ });
43
+ return { logger, lines, entries };
44
+ }
45
+
46
+ describe("createSdkLoggerAdapter", () => {
47
+ it("maps each SDK level onto the server's and keeps the message verbatim", () => {
48
+ const { logger, entries } = capturingLogger();
49
+ const adapter = createSdkLoggerAdapter(() => logger);
50
+
51
+ adapter.trace("t");
52
+ adapter.debug("d");
53
+ adapter.info("i");
54
+ adapter.warn("Activity failed");
55
+ adapter.error("e");
56
+ adapter.log("WARN", "via log");
57
+
58
+ expect(entries.map((entry) => [entry.level, entry.message])).toEqual([
59
+ ["debug", "t"],
60
+ ["debug", "d"],
61
+ ["info", "i"],
62
+ ["warn", "Activity failed"],
63
+ ["error", "e"],
64
+ ["warn", "via log"],
65
+ ]);
66
+ });
67
+
68
+ it("writes through whichever logger the target returns at call time", () => {
69
+ const first = capturingLogger();
70
+ const second = capturingLogger();
71
+ let current = first.logger;
72
+ const adapter = createSdkLoggerAdapter(() => current);
73
+
74
+ adapter.info("one");
75
+ current = second.logger;
76
+ adapter.info("two");
77
+
78
+ expect(first.entries.map((entry) => entry.message)).toEqual(["one"]);
79
+ expect(second.entries.map((entry) => entry.message)).toEqual(["two"]);
80
+ });
81
+
82
+ it("keeps the SDK's own nested values out of the written line and the sink", () => {
83
+ const { logger, lines, entries } = capturingLogger();
84
+ const adapter = createSdkLoggerAdapter(() => logger);
85
+
86
+ adapter.debug("Creating worker", {
87
+ sdkComponent: SdkComponent.worker,
88
+ taskQueue: "q",
89
+ options: { dataConverter: { key: Buffer.from("secret-key-bytes") } },
90
+ });
91
+
92
+ expect(entries[0]?.fields).toEqual({
93
+ sdkComponent: "worker",
94
+ taskQueue: "q",
95
+ });
96
+ expect(lines[0]).not.toContain("options");
97
+ expect(lines[0]).not.toContain("Buffer");
98
+ });
99
+ });
100
+
101
+ describe("toLogFields", () => {
102
+ const shared = {
103
+ [Symbol("LogTimestamp")]: 1n,
104
+ taskToken: "dGFzay10b2tlbg==",
105
+ attempt: 1,
106
+ isLocal: false,
107
+ activityType: "FailingActivity",
108
+ runId: null,
109
+ updateId: undefined,
110
+ error: new Error("activity exploded"),
111
+ durationMs: 12n,
112
+ };
113
+
114
+ it("applies the every-line rules on the SDK's own lines", () => {
115
+ expect(
116
+ toLogFields({ ...shared, sdkComponent: SdkComponent.worker }),
117
+ ).toEqual({
118
+ sdkComponent: "worker",
119
+ attempt: 1,
120
+ isLocal: false,
121
+ activityType: "FailingActivity",
122
+ error: "activity exploded",
123
+ durationMs: "12",
124
+ });
125
+ });
126
+
127
+ it("applies the same every-line rules on our code's lines", () => {
128
+ expect(
129
+ toLogFields({ ...shared, sdkComponent: SdkComponent.workflow }),
130
+ ).toEqual({
131
+ sdkComponent: "workflow",
132
+ attempt: 1,
133
+ isLocal: false,
134
+ activityType: "FailingActivity",
135
+ error: "activity exploded",
136
+ durationMs: "12",
137
+ });
138
+ });
139
+
140
+ it("passes nested values on the components our code writes", () => {
141
+ const outcomes = { reaped: 2, kept: 1 };
142
+ for (const component of [
143
+ SdkComponent.workflow,
144
+ SdkComponent.activity,
145
+ SdkComponent.nexus,
146
+ ]) {
147
+ expect(toLogFields({ sdkComponent: component, outcomes })).toEqual({
148
+ sdkComponent: component,
149
+ outcomes,
150
+ });
151
+ }
152
+ });
153
+
154
+ it("drops nested values from the SDK's components, unknown and absent ones included", () => {
155
+ const nested = {
156
+ options: { taskQueue: "q" },
157
+ list: ["a"],
158
+ codecs: new Map([["k", Buffer.from("x")]]),
159
+ key: Buffer.from("x"),
160
+ };
161
+ for (const component of [
162
+ SdkComponent.worker,
163
+ SdkComponent.core,
164
+ "a-component-the-sdk-adds-later",
165
+ ]) {
166
+ expect(toLogFields({ sdkComponent: component, ...nested })).toEqual({
167
+ sdkComponent: component,
168
+ });
169
+ }
170
+ expect(toLogFields(nested)).toEqual({});
171
+ });
172
+
173
+ it("returns no fields for absent meta", () => {
174
+ expect(toLogFields(undefined)).toEqual({});
175
+ });
176
+ });
177
+
178
+ describe("createSdkLogBridge", () => {
179
+ function recordingInstall(): {
180
+ install: (options: RuntimeOptions) => void;
181
+ calls: RuntimeOptions[];
182
+ } {
183
+ const calls: RuntimeOptions[] = [];
184
+ return { install: (options) => calls.push(options), calls };
185
+ }
186
+
187
+ it("installs the adapter on the first attach and only retargets after", () => {
188
+ const { install, calls } = recordingInstall();
189
+ const bridge = createSdkLogBridge(install);
190
+ const first = capturingLogger();
191
+ const second = capturingLogger();
192
+
193
+ bridge.attach(first.logger);
194
+ calls[0]?.logger?.info("to first");
195
+ bridge.attach(second.logger);
196
+ calls[0]?.logger?.info("to second");
197
+
198
+ expect(calls).toHaveLength(1);
199
+ expect(Object.keys(calls[0] ?? {})).toEqual(["logger"]);
200
+ expect(first.entries.map((entry) => entry.message)).toEqual(["to first"]);
201
+ expect(second.entries.map((entry) => entry.message)).toEqual(["to second"]);
202
+ });
203
+
204
+ it("warns once and keeps the SDK default when the Runtime already exists", () => {
205
+ let installs = 0;
206
+ const bridge = createSdkLogBridge(() => {
207
+ installs++;
208
+ throw new IllegalStateError(
209
+ "Runtime singleton has already been instantiated. Did you start a Worker before calling `install`?",
210
+ );
211
+ });
212
+ const { logger, entries } = capturingLogger();
213
+
214
+ bridge.attach(logger);
215
+ bridge.attach(logger);
216
+
217
+ expect(installs).toBe(1);
218
+ expect(entries).toHaveLength(1);
219
+ expect(entries[0]).toMatchObject({
220
+ level: "warn",
221
+ message:
222
+ "Temporal SDK logger not installed: the Temporal runtime already existed before the worker manager's first connect",
223
+ });
224
+ expect(entries[0]?.fields?.["error"]).toContain(
225
+ "already been instantiated",
226
+ );
227
+ });
228
+
229
+ it("lets any other install failure through", () => {
230
+ const bridge = createSdkLogBridge(() => {
231
+ throw new TypeError("Invalid logging filter");
232
+ });
233
+
234
+ expect(() => bridge.attach(capturingLogger().logger)).toThrow(
235
+ "Invalid logging filter",
236
+ );
237
+ });
238
+ });
@@ -43,6 +43,11 @@
43
43
  * capability (the TS SDK's Worker.create takes its own dataConverter; Go
44
44
  * workers inherit the client's — same coverage, two installation sites,
45
45
  * one source array, one construction path).
46
+ *
47
+ * One choke point for the SDK's own log lines: every native connect is
48
+ * preceded by attaching this manager's logger to the process's SDK log
49
+ * bridge (sdk-logger.ts), so the Runtime logger every worker inherits is
50
+ * the server logger, with its threshold and its sink (#1037).
46
51
  */
47
52
  import { Client, Connection } from "@temporalio/client";
48
53
  import type { PayloadCodec } from "@temporalio/common";
@@ -54,6 +59,7 @@ import {
54
59
  } from "@temporalio/worker";
55
60
 
56
61
  import type { Logger } from "../boot/logger.js";
62
+ import { processSdkLogBridge } from "./sdk-logger.js";
57
63
 
58
64
  /**
59
65
  * Initial connect: 3 attempts with exponential backoff (1s, 2s between
@@ -504,6 +510,9 @@ export class TemporalManager {
504
510
  }
505
511
 
506
512
  private async createAndRunWorkers(): Promise<void> {
513
+ // Before the connect: the first native connect creates the SDK's
514
+ // Runtime, after which its logger can no longer be installed.
515
+ processSdkLogBridge.attach(this.logger);
507
516
  const nativeConnection = await NativeConnection.connect({
508
517
  address: this.hostPort,
509
518
  ...this.connectionSecurity,
@@ -35,6 +35,7 @@ import type {
35
35
  ConnectRun,
36
36
  ConnectRunFailure,
37
37
  ConnectRunOutcome,
38
+ ConnectTaskQueue,
38
39
  ConnectWorkflowInput,
39
40
  ConnectWorkflowOutput,
40
41
  McpServerConnectEngine,
@@ -58,13 +59,17 @@ export class TemporalMcpServerConnectEngine implements McpServerConnectEngine {
58
59
  mcpServerId: string,
59
60
  input: ConnectWorkflowInput,
60
61
  runTimeoutMs: number,
62
+ taskQueue: ConnectTaskQueue,
61
63
  ): Promise<ConnectRun> {
62
64
  const { client, config, logger } = this.deps;
63
65
  const workflowId = connectWorkflowIdFor(mcpServerId);
64
66
  // MCP connect is not session-scoped (it discovers tools at the server
65
- // level), so it always routes to the default runner queue regardless
66
- // of routing mode (connect.go:642-645).
67
- const runnerQueue = config.runnerQueue;
67
+ // level), so it never takes the agent-execution routing mode: it runs
68
+ // on the shared runner queue (connect.go:642-645) or, with a sandbox
69
+ // provisioner composed, on the queue its own connect sandbox serves —
70
+ // the domain decides which (engine.ts ConnectTaskQueue).
71
+ const runnerQueue =
72
+ taskQueue.kind === "runner" ? config.runnerQueue : taskQueue.name;
68
73
 
69
74
  let handle: WorkflowHandle;
70
75
  let attached = false;
@@ -1,7 +1,9 @@
1
1
  /**
2
2
  * McpServer connect workflow wire identifiers — cross-edition constants
3
- * copied character-for-character from Go (connect.go:31-32, 584-586).
4
- * Renaming one is a wire protocol break (guidelines §2).
3
+ * copied character-for-character from Go (connect.go:31-32, 584-586), plus
4
+ * the connect sandbox's task queue (stigmer/stigmer#1474), which a
5
+ * sandboxed runner polls. Renaming one is a wire protocol break
6
+ * (guidelines §2).
5
7
  */
6
8
 
7
9
  /** The runner's connect workflow type (Go connectWorkflowName). */
@@ -21,3 +23,15 @@ export const CONNECT_WORKFLOW_NAME = "stigmer/mcp-server/connect";
21
23
  export function connectWorkflowIdFor(mcpServerId: string): string {
22
24
  return `${CONNECT_WORKFLOW_NAME}/${mcpServerId}`;
23
25
  }
26
+
27
+ /**
28
+ * The task queue one connect sandbox serves: its runner polls exactly this
29
+ * queue (STIGMER_TASK_QUEUE) and the connect workflow is started on it. The
30
+ * colon form of every per-queue name (`session:`, `wfexec:`, `sandbox:`);
31
+ * the id is the connect's synthetic execution id
32
+ * (domain/mcpserver/connect-execution-id.ts), unique per attempt, so two
33
+ * connects of one server never share a sandbox.
34
+ */
35
+ export function connectTaskQueueFor(connectExecutionId: string): string {
36
+ return `mcpconnect:${connectExecutionId}`;
37
+ }
@@ -0,0 +1,173 @@
1
+ /**
2
+ * The Temporal SDK's log lines, routed through the server logger (#1037).
3
+ *
4
+ * The SDK logs through its process-wide Runtime logger: `Activity failed`
5
+ * with the activity's identity and error, worker lifecycle lines, and every
6
+ * `log.*` a workflow body calls (the workflow sink resolves to the same
7
+ * logger). Left at its default, that logger writes its own format to
8
+ * stderr, outside LOG_LEVEL and outside the sink seam, so a deployable that
9
+ * exports the server's lines (boot/logger.ts's `sink`) never sees the
10
+ * warnings an operator most needs. One `Runtime.install({ logger })` before
11
+ * the first native connection routes them all through the server logger,
12
+ * with the same threshold, shape and export as every other line.
13
+ *
14
+ * Meta becomes fields by one table, keyed on who wrote the line. The SDK
15
+ * tags each line with `sdkComponent`; `workflow`, `activity` and `nexus`
16
+ * are the context loggers user code calls, and the SDK "never publishes
17
+ * messages with" them (@temporalio/common's SdkComponent). Those lines are
18
+ * ours and get the server logger's own contract: values pass as the call
19
+ * site wrote them, and redaction is the call site's. Every other line is
20
+ * the SDK's own, and keeps only strings, numbers and booleans, because
21
+ * its nested values are not ours to vouch for: at debug the SDK logs
22
+ * `Creating worker` with the whole worker options, which hold the payload
23
+ * codecs and their decryption keys. An unknown or absent component is
24
+ * treated as the SDK's, since the SDK says its component list may change.
25
+ * On every line: symbol keys are dropped (the workflow sink's call-time
26
+ * stamp rides one), `taskToken` is dropped (it can complete the activity
27
+ * from outside, and has no business in a log store), null and undefined
28
+ * are dropped, an Error becomes its message as every server call site logs
29
+ * one, and a bigint becomes its decimal string because JSON cannot carry
30
+ * it. Keys keep the SDK's names (`activityType`, `workflowId`), which are
31
+ * Temporal's documented vocabulary.
32
+ *
33
+ * Two consequences, accepted. A workflow line is stamped when its
34
+ * activation's sinks flush, milliseconds after the `log.*` call, because
35
+ * the server Logger takes no instant. And the table runs before the
36
+ * threshold drops a line, because the Logger exposes no level check; it
37
+ * walks a handful of keys, and drops the one large SDK object unwalked.
38
+ *
39
+ * Native (Rust core) lines stay on the console, as the SDK defaults:
40
+ * forwarding them makes the SDK buffer every runtime-logger line for
41
+ * 100 ms (RuntimeOptions' telemetryOptions.logging), which would delay and
42
+ * restamp `Activity failed` itself.
43
+ *
44
+ * The Runtime is a process singleton, so the install is a bridge with one
45
+ * process instance: the first attach installs an adapter that reads the
46
+ * bridge's current target, and every later attach (a reconnect, a second
47
+ * composition in one test process) only retargets it. A Runtime created
48
+ * before the first attach (a test environment, or an embedder that touched
49
+ * the SDK first) keeps the SDK default; the attach says so once and never
50
+ * fails the boot over it. TemporalManager attaches before every native
51
+ * connect, so every worker it builds, OSS and extension alike, is covered.
52
+ * A composition that prebuilds a bundle with `bundleWorkflowCode` passes
53
+ * that call its own logger: the bundler never reads the Runtime.
54
+ */
55
+ import {
56
+ IllegalStateError,
57
+ SdkComponent,
58
+ type LogLevel as SdkLogLevel,
59
+ type LogMetadata,
60
+ type Logger as SdkLogger,
61
+ } from "@temporalio/common";
62
+ import { Runtime, type RuntimeOptions } from "@temporalio/worker";
63
+
64
+ import type { LogFields, Logger, LogLevel } from "../boot/logger.js";
65
+
66
+ /** The components whose lines come from our own code (module header). */
67
+ const CALLER_COMPONENTS: ReadonlySet<string> = new Set([
68
+ SdkComponent.workflow,
69
+ SdkComponent.activity,
70
+ SdkComponent.nexus,
71
+ ]);
72
+
73
+ /** Dropped on every line: it completes the activity from outside. */
74
+ const TASK_TOKEN_KEY = "taskToken";
75
+
76
+ const LEVELS: Record<SdkLogLevel, LogLevel> = {
77
+ TRACE: "debug",
78
+ DEBUG: "debug",
79
+ INFO: "info",
80
+ WARN: "warn",
81
+ ERROR: "error",
82
+ };
83
+
84
+ /** The meta table (module header), exported for its own unit arms. */
85
+ export function toLogFields(meta: LogMetadata | undefined): LogFields {
86
+ const fields: LogFields = {};
87
+ if (meta === undefined) {
88
+ return fields;
89
+ }
90
+ const fromCaller = CALLER_COMPONENTS.has(String(meta["sdkComponent"]));
91
+ for (const [key, value] of Object.entries(meta)) {
92
+ if (key === TASK_TOKEN_KEY || value === null || value === undefined) {
93
+ continue;
94
+ }
95
+ if (value instanceof Error) {
96
+ fields[key] = value.message;
97
+ } else if (typeof value === "bigint") {
98
+ fields[key] = value.toString();
99
+ } else if (
100
+ fromCaller ||
101
+ typeof value === "string" ||
102
+ typeof value === "number" ||
103
+ typeof value === "boolean"
104
+ ) {
105
+ fields[key] = value;
106
+ }
107
+ }
108
+ return fields;
109
+ }
110
+
111
+ /** The SDK's Logger over whichever server logger `target` returns now. */
112
+ export function createSdkLoggerAdapter(target: () => Logger): SdkLogger {
113
+ const log = (level: SdkLogLevel, message: string, meta?: LogMetadata) => {
114
+ target()[LEVELS[level]](message, toLogFields(meta));
115
+ };
116
+ return {
117
+ log,
118
+ trace: (message, meta) => log("TRACE", message, meta),
119
+ debug: (message, meta) => log("DEBUG", message, meta),
120
+ info: (message, meta) => log("INFO", message, meta),
121
+ warn: (message, meta) => log("WARN", message, meta),
122
+ error: (message, meta) => log("ERROR", message, meta),
123
+ };
124
+ }
125
+
126
+ /** `Runtime.install`'s shape, the bridge's test seam. */
127
+ export type RuntimeInstall = (options: RuntimeOptions) => unknown;
128
+
129
+ export interface SdkLogBridge {
130
+ /**
131
+ * Routes the SDK's lines to `logger`: installs the Runtime logger on the
132
+ * first call, retargets it on every later one.
133
+ */
134
+ attach(logger: Logger): void;
135
+ }
136
+
137
+ export function createSdkLogBridge(install: RuntimeInstall): SdkLogBridge {
138
+ let state: "pending" | "installed" | "preempted" = "pending";
139
+ let target: Logger | undefined;
140
+ const adapter = createSdkLoggerAdapter(() => {
141
+ if (target === undefined) {
142
+ throw new Error("Temporal SDK log bridge used before attach");
143
+ }
144
+ return target;
145
+ });
146
+
147
+ return {
148
+ attach(logger) {
149
+ target = logger;
150
+ if (state !== "pending") {
151
+ return;
152
+ }
153
+ try {
154
+ install({ logger: adapter });
155
+ state = "installed";
156
+ } catch (error) {
157
+ if (!(error instanceof IllegalStateError)) {
158
+ throw error;
159
+ }
160
+ state = "preempted";
161
+ logger.warn(
162
+ "Temporal SDK logger not installed: the Temporal runtime already existed before the worker manager's first connect",
163
+ { error: error.message },
164
+ );
165
+ }
166
+ },
167
+ };
168
+ }
169
+
170
+ /** The process's one bridge, over the SDK's one Runtime. */
171
+ export const processSdkLogBridge: SdkLogBridge = createSdkLogBridge((options) =>
172
+ Runtime.install(options),
173
+ );