@themoltnet/node-red-contrib-core 0.12.7 → 0.12.8

package/dist/nodes/src.js

@@ -1675,6 +1675,21 @@ var verifyDiaryEntryById = (options) => (options.client ?? client).get({
 	...options
 });
 /**
+* Register an agent-signed executor manifest for fingerprint-only task claims.
+*/
+var registerExecutorManifest = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/executor-manifests/register",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
+});
+/**
 * Shallow liveness probe.
 */
 var getHealth = (options) => (options?.client ?? client).get({
@@ -10355,6 +10370,875 @@ function deepFreeze(value) {
 deepFreeze(RUNTIME_PROFILE_CONTEXT_CATALOGUE);
 Object.freeze(Object.keys(RUNTIME_PROFILE_CONTEXT_CATALOGUE.recipes));
 //#endregion
+//#region ../models/src/preview-sign.ts
+function schemaRef$1(schema, id) {
+	return Unsafe(Ref$2(id));
+}
+var PreviewSignBase64UrlSchema = String$1({
+	$id: "PreviewSignBase64Url",
+	minLength: 1,
+	maxLength: 5462,
+	pattern: "^[A-Za-z0-9_-]+$"
+});
+var PreviewSignSha256Base64UrlSchema = String$1({
+	$id: "PreviewSignSha256Base64Url",
+	minLength: 43,
+	maxLength: 43,
+	pattern: "^[A-Za-z0-9_-]+$"
+});
+var PreviewSignP256DerSignatureBase64UrlSchema = String$1({
+	$id: "PreviewSignP256DerSignatureBase64Url",
+	minLength: 11,
+	maxLength: 96,
+	pattern: "^[A-Za-z0-9_-]+$"
+});
+var PreviewSignEs256PublicKeySchema = _Object_({
+	kty: Literal(2),
+	algorithm: Literal(-7),
+	curve: Literal(1),
+	x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
+	y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
+}, {
+	$id: "PreviewSignEs256PublicKey",
+	additionalProperties: false
+});
+var PreviewSignEcdhEsHkdf256PublicKeySchema = _Object_({
+	kty: Literal(2),
+	algorithm: Literal(-25),
+	curve: Literal(1),
+	x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
+	y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
+}, {
+	$id: "PreviewSignEcdhEsHkdf256PublicKey",
+	additionalProperties: false
+});
+var PreviewSignEsp256PublicKeySchema = _Object_({
+	kty: Literal(2),
+	algorithm: Literal(-9),
+	curve: Literal(1),
+	x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
+	y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
+}, {
+	$id: "PreviewSignEsp256PublicKey",
+	additionalProperties: false
+});
+var PreviewSignArkgSeedPublicKeySchema = _Object_({
+	kty: Literal(-65537),
+	algorithm: Literal(-65700),
+	derivedAlgorithm: Literal(-9),
+	blindingKey: schemaRef$1(PreviewSignEs256PublicKeySchema, "PreviewSignEs256PublicKey"),
+	kemKey: schemaRef$1(PreviewSignEcdhEsHkdf256PublicKeySchema, "PreviewSignEcdhEsHkdf256PublicKey")
+}, {
+	$id: "PreviewSignArkgSeedPublicKey",
+	additionalProperties: false
+});
+var PreviewSignPublicMaterialSchema = _Object_({
+	version: Literal(1),
+	outerCredentialId: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
+	outerPublicKey: schemaRef$1(PreviewSignEs256PublicKeySchema, "PreviewSignEs256PublicKey"),
+	previewKeyHandle: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
+	seedPublicKey: schemaRef$1(PreviewSignArkgSeedPublicKeySchema, "PreviewSignArkgSeedPublicKey")
+}, {
+	$id: "PreviewSignPublicMaterial",
+	additionalProperties: false
+});
+var PreviewSignChallengeSchema = _Object_({
+	verificationMethod: Literal("human-hardware-previewsign"),
+	version: Literal(1),
+	envelope: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
+	digest: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
+	additionalArguments: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
+	outerCredentialId: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
+	outerPublicKey: schemaRef$1(PreviewSignEs256PublicKeySchema, "PreviewSignEs256PublicKey"),
+	previewKeyHandle: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url")
+}, {
+	$id: "PreviewSignChallenge",
+	additionalProperties: false
+});
+var PreviewSignChallengeValueSchema = _Object_({
+	verificationMethod: Literal("human-hardware-previewsign"),
+	value: schemaRef$1(PreviewSignChallengeSchema, "PreviewSignChallenge")
+}, {
+	$id: "PreviewSignChallengeValue",
+	additionalProperties: false
+});
+var PreviewSignChallengeOperationSchema = Union([Literal("credential-registration"), Literal("signing-request")], { $id: "PreviewSignChallengeOperation" });
+var PreviewSignReceiptSchema = _Object_({
+	version: Literal(1),
+	signature: schemaRef$1(PreviewSignP256DerSignatureBase64UrlSchema, "PreviewSignP256DerSignatureBase64Url")
+}, {
+	$id: "PreviewSignReceipt",
+	additionalProperties: false
+});
+var PreviewSignReceiptValueSchema = _Object_({
+	verificationMethod: Literal("human-hardware-previewsign"),
+	value: schemaRef$1(PreviewSignReceiptSchema, "PreviewSignReceipt")
+}, {
+	$id: "PreviewSignReceiptValue",
+	additionalProperties: false
+});
+var previewSignSchemaContext = {
+	PreviewSignBase64Url: PreviewSignBase64UrlSchema,
+	PreviewSignSha256Base64Url: PreviewSignSha256Base64UrlSchema,
+	PreviewSignP256DerSignatureBase64Url: PreviewSignP256DerSignatureBase64UrlSchema,
+	PreviewSignEs256PublicKey: PreviewSignEs256PublicKeySchema,
+	PreviewSignEcdhEsHkdf256PublicKey: PreviewSignEcdhEsHkdf256PublicKeySchema,
+	PreviewSignEsp256PublicKey: PreviewSignEsp256PublicKeySchema,
+	PreviewSignArkgSeedPublicKey: PreviewSignArkgSeedPublicKeySchema,
+	PreviewSignPublicMaterial: PreviewSignPublicMaterialSchema,
+	PreviewSignChallenge: PreviewSignChallengeSchema,
+	PreviewSignChallengeValue: PreviewSignChallengeValueSchema,
+	PreviewSignChallengeOperation: PreviewSignChallengeOperationSchema,
+	PreviewSignReceipt: PreviewSignReceiptSchema,
+	PreviewSignReceiptValue: PreviewSignReceiptValueSchema
+};
+//#endregion
+//#region ../models/src/verification-method.ts
+/**
+* Persisted and wire-level signing verification method identifiers.
+*
+* This vocabulary is append-only. Never rename, remove, or change an existing
+* value: PostgreSQL rows, workflow inputs, and API clients persist these exact
+* strings. Future signing methods must add a new property and value.
+*/
+var VERIFICATION_METHOD = {
+	AgentEd25519: "agent-ed25519",
+	HumanHardwarePreviewSign: "human-hardware-previewsign"
+};
+VERIFICATION_METHOD.AgentEd25519, VERIFICATION_METHOD.HumanHardwarePreviewSign;
+//#endregion
+//#region ../models/src/schemas.ts
+var UuidSchema = String$1({
+	format: "uuid",
+	description: "UUID v4 identifier"
+});
+var TimestampSchema = String$1({
+	format: "date-time",
+	description: "ISO 8601 timestamp"
+});
+Union([Literal(VERIFICATION_METHOD.AgentEd25519), Literal(VERIFICATION_METHOD.HumanHardwarePreviewSign)], { description: "Stable signing verification method identifier" });
+Union([
+	Literal("private"),
+	Literal("moltnet"),
+	Literal("public")
+], { description: "Entry visibility level" });
+var ENTRY_TYPE_VALUES = [
+	"episodic",
+	"semantic",
+	"procedural",
+	"reflection"
+];
+var EntryTypeSchema = Union([
+	Literal("episodic"),
+	Literal("semantic"),
+	Literal("procedural"),
+	Literal("reflection")
+], { description: "Entry memory type" });
+/** Regex fragment matching a single entry type value. */
+var ENTRY_TYPE_PATTERN = `(${ENTRY_TYPE_VALUES.join("|")})`;
+`${ENTRY_TYPE_PATTERN}${ENTRY_TYPE_PATTERN}`, ENTRY_TYPE_VALUES.length - 1;
+var PublicKeySchema = String$1({
+	pattern: "^ed25519:[A-Za-z0-9+/=]+$",
+	description: "Ed25519 public key with prefix"
+});
+var FingerprintSchema = String$1({
+	pattern: "^[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}$",
+	description: "Key fingerprint (A1B2-C3D4-E5F6-G7H8)"
+});
+_Object_({
+	title: Optional(String$1({ maxLength: 255 })),
+	content: String$1({
+		minLength: 1,
+		maxLength: 1e5
+	}),
+	tags: Optional(_Array_(String$1({ maxLength: 128 }), { maxItems: 20 }))
+});
+_Object_({
+	title: Optional(String$1({ maxLength: 255 })),
+	content: Optional(String$1({
+		minLength: 1,
+		maxLength: 1e5
+	})),
+	tags: Optional(_Array_(String$1({ maxLength: 128 }), { maxItems: 20 }))
+});
+_Object_({
+	query: Optional(String$1({
+		minLength: 1,
+		maxLength: 500
+	})),
+	tags: Optional(_Array_(String$1({ maxLength: 128 }), {
+		minItems: 1,
+		maxItems: 20,
+		description: "Filter: entry must have ALL specified tags"
+	})),
+	limit: Optional(Number$1({
+		minimum: 1,
+		maximum: 100,
+		default: 20
+	})),
+	offset: Optional(Number$1({
+		minimum: 0,
+		default: 0
+	}))
+});
+_Object_({
+	identityId: UuidSchema,
+	publicKey: PublicKeySchema,
+	fingerprint: FingerprintSchema,
+	createdAt: TimestampSchema
+});
+_Object_({
+	publicKey: PublicKeySchema,
+	fingerprint: FingerprintSchema
+});
+_Object_({ message: String$1({
+	minLength: 1,
+	maxLength: 1e4
+}) });
+_Object_({
+	message: String$1(),
+	signature: String$1({ description: "Base64 encoded Ed25519 signature" }),
+	publicKey: PublicKeySchema
+});
+_Object_({
+	message: String$1({
+		minLength: 1,
+		maxLength: 1e4
+	}),
+	signature: String$1({ description: "Base64 encoded signature" }),
+	publicKey: PublicKeySchema
+});
+_Object_({
+	valid: Boolean$1(),
+	signer: Optional(_Object_({ fingerprint: FingerprintSchema }))
+});
+var BaseAuthContextSchema = _Object_({
+	identityId: UuidSchema,
+	scopes: _Array_(String$1()),
+	subjectType: Union([Literal("agent"), Literal("human")]),
+	currentTeamId: Union([UuidSchema, Null()])
+});
+Union([Intersect([BaseAuthContextSchema, _Object_({
+	subjectType: Literal("agent"),
+	publicKey: PublicKeySchema,
+	fingerprint: FingerprintSchema,
+	clientId: String$1()
+})]), Intersect([BaseAuthContextSchema, _Object_({
+	subjectType: Literal("human"),
+	clientId: Union([String$1(), Null()])
+})])]);
+_Object_({
+	success: Boolean$1(),
+	message: Optional(String$1())
+});
+_Object_({ diaryId: UuidSchema });
+_Object_({
+	diaryId: UuidSchema,
+	entryId: UuidSchema
+});
+_Object_({ entryId: UuidSchema });
+_Object_({ id: UuidSchema });
+_Object_({
+	publicKey: PublicKeySchema,
+	fingerprint: FingerprintSchema,
+	agentName: String$1({
+		minLength: 1,
+		maxLength: 34
+	}),
+	org: Optional(String$1({
+		minLength: 1,
+		maxLength: 39,
+		pattern: "^[a-zA-Z0-9-]+$",
+		description: "GitHub organization name. When provided, the GitHub App will be created under this org instead of the personal account."
+	}))
+});
+_Object_({
+	workflowId: String$1(),
+	manifestFormUrl: String$1()
+});
+_Object_({
+	status: Union([
+		Literal("awaiting_github"),
+		Literal("github_code_ready"),
+		Literal("awaiting_installation"),
+		Literal("completed"),
+		Literal("failed")
+	]),
+	githubCode: Optional(String$1()),
+	identityId: Optional(String$1()),
+	clientId: Optional(String$1()),
+	clientSecret: Optional(String$1()),
+	installationId: Optional(String$1())
+});
+_Object_({
+	wf: String$1({
+		minLength: 1,
+		description: "Workflow ID baked into setup_url"
+	}),
+	installation_id: String$1({ minLength: 1 }),
+	setup_action: Optional(String$1())
+});
+_Object_({ id: UuidSchema });
+_Object_({
+	id: UuidSchema,
+	subjectId: UuidSchema
+});
+_Object_({
+	id: UuidSchema,
+	inviteId: UuidSchema
+});
+_Object_({ name: String$1({
+	minLength: 1,
+	maxLength: 255
+}) });
+_Object_({
+	role: Optional(Union([Literal("manager"), Literal("member")])),
+	maxUses: Optional(Integer({
+		minimum: 1,
+		default: 1
+	})),
+	expiresInHours: Optional(Integer({
+		minimum: 1,
+		maximum: 720,
+		default: 168
+	}))
+});
+_Object_({ code: String$1({ minLength: 1 }) });
+_Object_({ role: Union([Literal("manager"), Literal("member")]) });
+var TeamRoleSchema = Union([
+	Literal("owner"),
+	Literal("manager"),
+	Literal("member")
+]);
+_Object_({
+	id: UuidSchema,
+	name: String$1()
+});
+var DateTimeUnsafe = Unsafe(String$1({ format: "date-time" }));
+_Object_({
+	id: UuidSchema,
+	code: String$1(),
+	role: Union([Literal("manager"), Literal("member")]),
+	maxUses: Integer(),
+	useCount: Integer(),
+	expiresAt: DateTimeUnsafe,
+	createdAt: DateTimeUnsafe
+});
+var TeamMemberSchema = _Object_({
+	subjectId: UuidSchema,
+	subjectType: Union([Literal("agent"), Literal("human")]),
+	role: TeamRoleSchema,
+	displayName: String$1(),
+	fingerprint: Optional(String$1()),
+	email: Optional(String$1())
+});
+_Object_({
+	id: UuidSchema,
+	name: String$1(),
+	personal: Boolean$1(),
+	status: String$1(),
+	role: TeamRoleSchema
+});
+_Object_({
+	id: UuidSchema,
+	name: String$1(),
+	status: String$1(),
+	personal: Boolean$1(),
+	createdAt: DateTimeUnsafe,
+	updatedAt: DateTimeUnsafe,
+	members: _Array_(TeamMemberSchema)
+});
+_Object_({
+	teamId: UuidSchema,
+	role: Union([Literal("manager"), Literal("member")])
+});
+_Object_({
+	updated: Boolean$1(),
+	role: Union([Literal("manager"), Literal("member")])
+});
+_Object_({ deleted: Boolean$1() });
+_Object_({ removed: Boolean$1() });
+var FoundingMemberSchema = _Object_({
+	subjectId: UuidSchema,
+	subjectNs: Union([Literal("Agent"), Literal("Human")]),
+	role: Union([
+		Literal("owner"),
+		Literal("manager"),
+		Literal("member")
+	])
+});
+_Object_({
+	name: String$1({
+		minLength: 1,
+		maxLength: 255
+	}),
+	foundingMembers: Optional(_Array_(FoundingMemberSchema, { minItems: 1 }))
+});
+_Object_({
+	id: UuidSchema,
+	name: String$1(),
+	status: String$1(),
+	workflowId: Optional(String$1())
+});
+_Object_({});
+_Object_({
+	accepted: Boolean$1(),
+	teamStatus: String$1()
+});
+_Object_({ destinationTeamId: UuidSchema });
+_Object_({ transferId: UuidSchema });
+_Object_({ items: _Array_(_Object_({
+	id: UuidSchema,
+	diaryId: UuidSchema,
+	sourceTeamId: UuidSchema,
+	destinationTeamId: UuidSchema,
+	status: String$1(),
+	initiatedBy: UuidSchema,
+	expiresAt: Unsafe(String$1({ format: "date-time" })),
+	createdAt: Unsafe(String$1({ format: "date-time" }))
+})) });
+_Object_({ groupId: UuidSchema });
+_Object_({
+	groupId: UuidSchema,
+	subjectId: UuidSchema
+});
+_Object_({ name: String$1({
+	minLength: 1,
+	maxLength: 255
+}) });
+_Object_({
+	subjectId: UuidSchema,
+	subjectNs: Optional(Union([Literal("Agent"), Literal("Human")]))
+});
+_Object_({
+	id: UuidSchema,
+	name: String$1(),
+	teamId: UuidSchema
+});
+var GroupMemberResponseSchema = _Object_({
+	subjectId: UuidSchema,
+	subjectNs: String$1()
+});
+_Object_({
+	id: UuidSchema,
+	name: String$1(),
+	teamId: UuidSchema,
+	createdAt: DateTimeUnsafe,
+	members: _Array_(GroupMemberResponseSchema)
+});
+var DiaryGrantRoleSchema = Union([Literal("writer"), Literal("manager")]);
+var GrantSubjectNsSchema = Union([
+	Literal("Agent"),
+	Literal("Human"),
+	Literal("Group")
+]);
+_Object_({
+	subjectId: UuidSchema,
+	subjectNs: GrantSubjectNsSchema,
+	role: DiaryGrantRoleSchema
+});
+_Object_({
+	subjectId: UuidSchema,
+	subjectNs: GrantSubjectNsSchema,
+	role: DiaryGrantRoleSchema
+});
+_Object_({ grants: _Array_(_Object_({
+	subjectId: UuidSchema,
+	subjectNs: GrantSubjectNsSchema,
+	role: DiaryGrantRoleSchema
+})) });
+_Object_({ revoked: Boolean$1() });
+_Object_({ "x-moltnet-team-id": String$1({
+	format: "uuid",
+	description: "Team ID (UUID) that will own the resource. Required."
+}) });
+_Object_({ "x-moltnet-team-id": Optional(String$1({
+	format: "uuid",
+	description: "Team ID (UUID) for scoping the request. Optional."
+})) });
+_Object_({
+	kind: Literal("agent"),
+	identityId: UuidSchema,
+	fingerprint: FingerprintSchema,
+	publicKey: PublicKeySchema
+}, {
+	$id: "AgentPrincipal",
+	additionalProperties: false
+});
+_Object_({
+	kind: Literal("human"),
+	humanId: UuidSchema,
+	identityId: Union([UuidSchema, Null()])
+}, {
+	$id: "HumanPrincipal",
+	additionalProperties: false
+});
+var principalUnionVariants = [_Object_({
+	kind: Literal("agent"),
+	identityId: UuidSchema,
+	fingerprint: FingerprintSchema,
+	publicKey: PublicKeySchema
+}, { additionalProperties: false }), _Object_({
+	kind: Literal("human"),
+	humanId: UuidSchema,
+	identityId: Union([UuidSchema, Null()])
+}, { additionalProperties: false })];
+Union(principalUnionVariants, {
+	$id: "PrincipalIdentity",
+	discriminator: { propertyName: "kind" }
+});
+/**
+* `$id`-less twin of `PrincipalIdentitySchema`. Required anywhere the
+* schema is **embedded** inline into another schema (MCP `outputSchema`
+* — every tool that returns a creator-bearing object embeds its own
+* copy; provenance-graph node `meta.creator`, etc.). Ajv 8 throws
+* `reference "PrincipalIdentity" resolves to more than one schema` if
+* the same `$id` appears twice in the same compilation pass, which is
+* exactly what happens when the MCP server lists tools and Ajv
+* traverses every advertised `outputSchema`.
+*
+* Structurally identical to `PrincipalIdentitySchema` (they share the
+* variants array); change one, change both.
+*/
+var PrincipalIdentitySchemaInline = Union(principalUnionVariants, { discriminator: { propertyName: "kind" } });
+//#endregion
+//#region ../models/src/problem-details.ts
+var ProblemCodeSchema = Union([
+	Literal("UNAUTHORIZED"),
+	Literal("FORBIDDEN"),
+	Literal("NOT_FOUND"),
+	Literal("CONFLICT"),
+	Literal("UNSUPPORTED_MEDIA_TYPE"),
+	Literal("VALIDATION_FAILED"),
+	Literal("INVALID_CHALLENGE"),
+	Literal("INVALID_SIGNATURE"),
+	Literal("VOUCHER_LIMIT"),
+	Literal("RATE_LIMIT_EXCEEDED"),
+	Literal("SERIALIZATION_EXHAUSTED"),
+	Literal("SIGNING_REQUEST_EXPIRED"),
+	Literal("SIGNING_REQUEST_ALREADY_COMPLETED"),
+	Literal("SIGNING_REQUEST_LIMIT_REACHED"),
+	Literal("REGISTRATION_FAILED"),
+	Literal("UPSTREAM_ERROR"),
+	Literal("SERVICE_UNAVAILABLE"),
+	Literal("INTERNAL_SERVER_ERROR"),
+	Literal("TEAM_PERSONAL_IMMUTABLE"),
+	Literal("TEAM_NOT_ACTIVE"),
+	Literal("INVITE_EXPIRED"),
+	Literal("INVITE_EXHAUSTED"),
+	Literal("TEAM_LAST_OWNER"),
+	Literal("TEAM_ALREADY_ACTIVE"),
+	Literal("TEAM_NOT_FOUNDING"),
+	Literal("FOUNDING_ALREADY_ACCEPTED"),
+	Literal("DIARY_TRANSFER_PENDING"),
+	Literal("DIARY_TRANSFER_NOT_FOUND"),
+	Literal("DIARY_TRANSFER_ALREADY_RESOLVED")
+]);
+var ProblemDetailsSchema = _Object_({
+	type: String$1({ format: "uri" }),
+	title: String$1(),
+	status: Integer({
+		minimum: 100,
+		maximum: 599
+	}),
+	code: ProblemCodeSchema,
+	detail: Optional(String$1()),
+	instance: Optional(String$1())
+}, {
+	$id: "ProblemDetails",
+	additionalProperties: true
+});
+_Object_({
+	field: String$1(),
+	message: String$1(),
+	code: Optional(String$1())
+}, {
+	$id: "ValidationError",
+	additionalProperties: false
+});
+_Object_({
+	resource: String$1(),
+	id: Optional(String$1({ format: "uuid" })),
+	keys: Optional(Record(String$1(), String$1()))
+}, {
+	$id: "ConflictTarget",
+	additionalProperties: false
+});
+_Object_({
+	constraint: Optional(String$1()),
+	target: Optional(Ref$2("ConflictTarget"))
+}, {
+	$id: "ConflictError",
+	additionalProperties: false
+});
+var ConflictProblemDetailsSchema = Intersect([ProblemDetailsSchema, _Object_({ conflict: Ref$2("ConflictError") })], { $id: "ConflictProblemDetails" });
+_Object_({
+	type: String$1(),
+	severity: Number$1(),
+	match: String$1()
+}, {
+	$id: "InjectionThreat",
+	additionalProperties: false
+});
+Intersect([ConflictProblemDetailsSchema, _Object_({ flagged: Optional(_Array_(_Object_({
+	id: String$1({ format: "uuid" }),
+	threats: _Array_(Ref$2("InjectionThreat"))
+}, { additionalProperties: false }))) })], { $id: "InjectionConflictProblemDetails" });
+Intersect([ProblemDetailsSchema, _Object_({ errors: _Array_(Ref$2("ValidationError")) })], { $id: "ValidationProblemDetails" });
+Union([
+	Literal("pack"),
+	Literal("entry"),
+	Literal("rendered_pack")
+]);
+var ProvenanceGraphEdgeKindSchema = Union([
+	Literal("includes"),
+	Literal("supersedes"),
+	Literal("rendered_from")
+]);
+var ProvenanceGraphPackMetaSchema = _Object_({
+	packId: UuidSchema,
+	diaryId: UuidSchema,
+	packCid: String$1(),
+	packType: String$1(),
+	packCodec: String$1(),
+	pinned: Boolean$1(),
+	createdAt: TimestampSchema,
+	expiresAt: Union([TimestampSchema, Null()]),
+	supersedesPackId: Union([UuidSchema, Null()])
+});
+/**
+* Discriminated creator embedded inside provenance-node response
+* payloads. Re-uses the shared `PrincipalIdentitySchemaInline` (the
+* `$id`-less twin) — embedding the named `PrincipalIdentitySchema`
+* here would clash with the top-level registration via @fastify/swagger
+* (`reference "PrincipalIdentity" resolves to more than one schema`).
+*/
+var ProvenanceGraphCreatorSchema = PrincipalIdentitySchemaInline;
+var ProvenanceGraphEntryMetaSchema = _Object_({
+	entryId: UuidSchema,
+	diaryId: UuidSchema,
+	entryType: EntryTypeSchema,
+	contentHash: Union([String$1(), Null()]),
+	createdAt: TimestampSchema,
+	updatedAt: TimestampSchema,
+	signed: Boolean$1(),
+	title: Union([String$1(), Null()]),
+	tags: _Array_(String$1()),
+	creator: Optional(ProvenanceGraphCreatorSchema)
+});
+var ProvenanceGraphPackNodeSchema = _Object_({
+	id: String$1(),
+	kind: Literal("pack"),
+	label: String$1(),
+	cid: Union([String$1(), Null()]),
+	meta: Intersect([ProvenanceGraphPackMetaSchema, _Object_({ creator: Optional(ProvenanceGraphCreatorSchema) })])
+});
+var ProvenanceGraphEntryNodeSchema = _Object_({
+	id: String$1(),
+	kind: Literal("entry"),
+	label: String$1(),
+	cid: Union([String$1(), Null()]),
+	meta: ProvenanceGraphEntryMetaSchema
+});
+var ProvenanceGraphRenderedPackMetaSchema = _Object_({
+	renderedPackId: UuidSchema,
+	sourcePackId: UuidSchema,
+	diaryId: UuidSchema,
+	packCid: String$1(),
+	renderMethod: String$1(),
+	totalTokens: Number$1(),
+	pinned: Boolean$1(),
+	createdAt: TimestampSchema,
+	expiresAt: Union([TimestampSchema, Null()]),
+	creator: Optional(ProvenanceGraphCreatorSchema)
+});
+var ProvenanceGraphNodeSchema = Union([
+	ProvenanceGraphPackNodeSchema,
+	ProvenanceGraphEntryNodeSchema,
+	_Object_({
+		id: String$1(),
+		kind: Literal("rendered_pack"),
+		label: String$1(),
+		cid: Union([String$1(), Null()]),
+		meta: ProvenanceGraphRenderedPackMetaSchema
+	})
+]);
+var ProvenanceGraphEdgeSchema = _Object_({
+	id: String$1(),
+	from: String$1(),
+	to: String$1(),
+	kind: ProvenanceGraphEdgeKindSchema,
+	label: Optional(String$1()),
+	meta: Optional(Record(String$1(), Union([
+		String$1(),
+		Number$1(),
+		Boolean$1(),
+		Null()
+	])))
+});
+_Object_({
+	metadata: _Object_({
+		format: Literal("moltnet.provenance-graph/v1"),
+		generatedAt: TimestampSchema,
+		rootNodeId: String$1(),
+		rootPackId: UuidSchema,
+		depth: Number$1({ minimum: 0 })
+	}),
+	nodes: _Array_(ProvenanceGraphNodeSchema),
+	edges: _Array_(ProvenanceGraphEdgeSchema)
+}, { $id: "ProvenanceGraph" });
+//#endregion
+//#region ../models/src/signer-constraint.ts
+var SIGNER_CONSTRAINT_TYPE = {
+	Human: "human",
+	TeamRole: "team-role",
+	Group: "group"
+};
+Union([
+	_Object_({
+		type: Literal(SIGNER_CONSTRAINT_TYPE.Human),
+		id: String$1({ format: "uuid" })
+	}),
+	_Object_({
+		type: Literal(SIGNER_CONSTRAINT_TYPE.TeamRole),
+		id: TeamRoleSchema
+	}),
+	_Object_({
+		type: Literal(SIGNER_CONSTRAINT_TYPE.Group),
+		id: String$1({ format: "uuid" })
+	})
+]);
+//#endregion
+//#region ../models/src/signer-protocol.ts
+function schemaRef(schema) {
+	return Ref$2(schemaId(schema));
+}
+function schemaId(schema) {
+	const id = schema.$id;
+	if (typeof id !== "string" || id.length === 0) throw new Error("Signer protocol schemas must have an identifier");
+	return id;
+}
+var SignerBase64UrlSchema = PreviewSignBase64UrlSchema;
+var SignerUuidSchema = String$1({
+	$id: "SignerUuid",
+	pattern: "^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
+});
+var SignerOperationSchema = Union([
+	Literal("credential-enrollment"),
+	Literal("credential-registration"),
+	Literal("signing-request")
+], { $id: "SignerOperation" });
+var SignerChallengeOperationSchema = PreviewSignChallengeOperationSchema;
+var SignerPreviewSignPublicMaterialSchema = PreviewSignPublicMaterialSchema;
+var SignerPreviewSignChallengeValueSchema = PreviewSignChallengeValueSchema;
+var SignerProblemSchema = _Object_({
+	code: String$1({ minLength: 1 }),
+	message: String$1({ minLength: 1 })
+}, {
+	$id: "SignerProblem",
+	additionalProperties: false
+});
+var SignerCeremonyParamsSchema = _Object_({ ceremonyId: Unsafe(schemaRef(SignerBase64UrlSchema)) }, {
+	$id: "SignerCeremonyParams",
+	additionalProperties: false
+});
+var SignerSessionSchema = _Object_({
+	version: Literal(1),
+	token: Unsafe(schemaRef(SignerBase64UrlSchema)),
+	expiresAt: String$1()
+}, {
+	$id: "SignerSession",
+	additionalProperties: false
+});
+var SignerEnrollmentCeremonyRequestSchema = _Object_({
+	version: Literal(1),
+	operation: Literal("credential-enrollment"),
+	label: String$1({
+		minLength: 1,
+		maxLength: 255
+	}),
+	teamId: Unsafe(schemaRef(SignerUuidSchema))
+}, {
+	$id: "SignerEnrollmentCeremonyRequest",
+	additionalProperties: false
+});
+var SignerChallengeCeremonyRequestSchema = _Object_({
+	version: Literal(1),
+	operation: Unsafe(schemaRef(SignerChallengeOperationSchema)),
+	resourceId: Unsafe(schemaRef(SignerUuidSchema)),
+	challenge: Unsafe(schemaRef(SignerPreviewSignChallengeValueSchema))
+}, {
+	$id: "SignerChallengeCeremonyRequest",
+	additionalProperties: false
+});
+var SignerCeremonyRequestSchema = Union([Unsafe(schemaRef(SignerEnrollmentCeremonyRequestSchema)), Unsafe(schemaRef(SignerChallengeCeremonyRequestSchema))], { $id: "SignerCeremonyRequest" });
+var SignerCeremonySchema = _Object_({
+	version: Literal(1),
+	id: Unsafe(schemaRef(SignerBase64UrlSchema)),
+	operation: Unsafe(schemaRef(SignerOperationSchema)),
+	approvalUrl: String$1(),
+	expiresAt: String$1()
+}, {
+	$id: "SignerCeremony",
+	additionalProperties: false
+});
+var SignerPendingResultSchema = _Object_({
+	version: Literal(1),
+	status: Literal("pending"),
+	operation: Unsafe(schemaRef(SignerOperationSchema))
+}, {
+	$id: "SignerPendingResult",
+	additionalProperties: false
+});
+var SignerEnrollmentResultSchema = _Object_({
+	version: Literal(1),
+	status: Literal("completed"),
+	operation: Literal("credential-enrollment"),
+	publicMaterial: Unsafe(schemaRef(SignerPreviewSignPublicMaterialSchema))
+}, {
+	$id: "SignerEnrollmentResult",
+	additionalProperties: false
+});
+var SignerReceiptSchema = PreviewSignReceiptValueSchema;
+var SignerSignatureResultSchema = _Object_({
+	version: Literal(1),
+	status: Literal("completed"),
+	operation: Unsafe(schemaRef(SignerChallengeOperationSchema)),
+	receipt: Unsafe(schemaRef(SignerReceiptSchema))
+}, {
+	$id: "SignerSignatureResult",
+	additionalProperties: false
+});
+var SignerFailedResultSchema = _Object_({
+	version: Literal(1),
+	status: Literal("failed"),
+	operation: Unsafe(schemaRef(SignerOperationSchema)),
+	code: String$1(),
+	message: String$1()
+}, {
+	$id: "SignerFailedResult",
+	additionalProperties: false
+});
+var SignerCeremonyResultSchema = Union([
+	Unsafe(schemaRef(SignerPendingResultSchema)),
+	Unsafe(schemaRef(SignerEnrollmentResultSchema)),
+	Unsafe(schemaRef(SignerSignatureResultSchema)),
+	Unsafe(schemaRef(SignerFailedResultSchema))
+], { $id: "SignerCeremonyResult" });
+({ ...previewSignSchemaContext }), schemaId(SignerUuidSchema), schemaId(SignerOperationSchema), schemaId(SignerProblemSchema), schemaId(SignerCeremonyParamsSchema), schemaId(SignerSessionSchema), schemaId(SignerEnrollmentCeremonyRequestSchema), schemaId(SignerChallengeCeremonyRequestSchema), schemaId(SignerCeremonyRequestSchema), schemaId(SignerCeremonySchema), schemaId(SignerPendingResultSchema), schemaId(SignerEnrollmentResultSchema), schemaId(SignerSignatureResultSchema), schemaId(SignerFailedResultSchema), schemaId(SignerCeremonyResultSchema);
+//#endregion
+//#region ../models/src/tool-enforcement.ts
+var TOOL_ENFORCEMENT_VALUES = [
+	"off",
+	"watch",
+	"enforce"
+];
+var ToolEnforcementSchema = Union([
+	Literal(TOOL_ENFORCEMENT_VALUES[0]),
+	Literal(TOOL_ENFORCEMENT_VALUES[1]),
+	Literal(TOOL_ENFORCEMENT_VALUES[2])
+], { description: "Runtime tool-policy enforcement mode: off (inert), watch (audit only), enforce (block disallowed tools, fail-closed)." });
+//#endregion
 //#region ../tasks/src/runtime-profiles.ts
 var RuntimeProfileName = String$1({
 	minLength: 1,
@@ -10371,6 +11255,13 @@ var RuntimeProfileToolName = String$1({
 	maxLength: 128,
 	pattern: "^[a-zA-Z0-9._/-]+$"
 });
+var RUNTIME_PROFILE_RUNTIME_KIND_PATTERN = "^[a-z][a-z0-9._-]{0,99}$";
+new RegExp(RUNTIME_PROFILE_RUNTIME_KIND_PATTERN);
+var RuntimeProfileRuntimeKind = String$1({
+	minLength: 1,
+	maxLength: 100,
+	pattern: RUNTIME_PROFILE_RUNTIME_KIND_PATTERN
+});
 var RuntimeProfileWorkspaceMode = Union([
 	Literal("none"),
 	Literal("shared_mount"),
@@ -10381,11 +11272,7 @@ var RuntimeProfileWorkspaceMode = Union([
 * `off` (inert), `watch` (audit only), `enforce` (block disallowed tools,
 * fail-closed). Read by the daemon via `GET /runtime-profiles/:id/allowed-tools`.
 */
-var RuntimeProfileToolEnforcement = Union([
-	Literal("off"),
-	Literal("watch"),
-	Literal("enforce")
-]);
+var RuntimeProfileToolEnforcement = ToolEnforcementSchema;
 var RuntimeProfileAllowedWorkspaceModes = _Array_(RuntimeProfileWorkspaceMode, {
 	minItems: 1,
 	maxItems: 3,
@@ -10417,58 +11304,16 @@ var RuntimeProfileNullableMaxOutputTokens = Union([Integer({
 	minimum: 1,
 	maximum: 1e6
 }), Null()]);
-var SandboxResumeCommandWhenSchema = _Object_({ workspaceMode: Optional(_Array_(Union([
-	Literal("shared_mount"),
-	Literal("dedicated_worktree"),
-	Literal("scratch_mount")
-]), {
-	minItems: 1,
-	maxItems: 3
-})) }, { additionalProperties: false });
-var RuntimeProfileSandboxResumeCommand = Union([String$1({
-	minLength: 1,
-	maxLength: 4096
-}), _Object_({
-	run: String$1({
-		minLength: 1,
-		maxLength: 4096
-	}),
-	when: Optional(SandboxResumeCommandWhenSchema),
-	retries: Optional(Integer({
-		minimum: 0,
-		maximum: 5
-	})),
-	retryBackoffMs: Optional(Integer({
-		minimum: 0,
-		maximum: 6e4
-	}))
-}, { additionalProperties: false })]);
 var RuntimeProfileAllowedHost = String$1({
 	minLength: 1,
 	maxLength: 255,
 	pattern: "^(?:\\*\\.)?(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)(?:\\.(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?))*$"
 });
 var RuntimeProfileSandbox = _Object_({
-	snapshot: Optional(_Object_({
-		setupCommands: Optional(_Array_(String$1({
-			minLength: 1,
-			maxLength: 4096
-		}), { maxItems: 20 })),
-		allowedHosts: Optional(_Array_(String$1({
-			minLength: 1,
-			maxLength: 255
-		}), { maxItems: 50 })),
-		overlaySize: Optional(String$1({
-			minLength: 2,
-			maxLength: 16,
-			pattern: "^[0-9]+[KMGTP]?$"
-		}))
-	}, { additionalProperties: false })),
 	network: Optional(_Object_({
 		allowedHosts: Optional(_Array_(RuntimeProfileAllowedHost, { maxItems: 50 })),
 		allowedInternalHosts: Optional(_Array_(RuntimeProfileAllowedHost, { maxItems: 50 }))
 	}, { additionalProperties: false })),
-	resumeCommands: Optional(_Array_(RuntimeProfileSandboxResumeCommand, { maxItems: 30 })),
 	vfs: Optional(_Object_({
 		shadow: Optional(_Array_(String$1({
 			minLength: 1,
@@ -10555,7 +11400,7 @@ _Object_({
 	topP: RuntimeProfileNullableTopP,
 	topK: RuntimeProfileNullableTopK,
 	maxOutputTokens: RuntimeProfileNullableMaxOutputTokens,
-	runtimeKind: Literal("gondolin_pi"),
+	runtimeKind: RuntimeProfileRuntimeKind,
 	sandbox: RuntimeProfileSandbox,
 	sessionStorageMode: Literal("local"),
 	workspaceStorageMode: Literal("local"),
@@ -10577,6 +11422,7 @@ _Object_({
 	toolEnforcement: RuntimeProfileToolEnforcement,
 	requiredEnv: _Array_(RuntimeProfileEnvName, { maxItems: 100 }),
 	requiredTools: _Array_(RuntimeProfileToolName, { maxItems: 100 }),
+	requiredExecutables: _Array_(RuntimeProfileToolName, { maxItems: 100 }),
 	context: _Array_(RuntimeProfileContext, { maxItems: 5 }),
 	revision: Integer({ minimum: 1 }),
 	definitionCid: String$1({
@@ -11978,7 +12824,7 @@ var BUILT_IN_TASK_TYPES = {
 		outputKind: "artifact",
 		resumable: true,
 		workspaceMode: "shared_mount",
-		workspaceScope: "session",
+		workspaceScope: "attempt",
 		sessionScope: "correlation",
 		acceptsInputWorkspaceOverride: true,
 		requiresReferences: false,
@@ -15872,6 +16718,13 @@ function createTasksNamespace(context) {
 				auth
 			}));
 		},
+		async registerExecutorManifest(body) {
+			return unwrapResult(await registerExecutorManifest({
+				client,
+				auth,
+				body
+			}));
+		},
 		artifacts: {
 			async stage(body, query, options) {
 				return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/node-red-contrib-core",
-  "version": "0.12.7",
+  "version": "0.12.8",
   "type": "module",
   "description": "Node-RED nodes for the MoltNet API",
   "keywords": [
@@ -46,7 +46,7 @@
   },
   "main": "dist/nodes/agent.js",
   "dependencies": {
-    "@themoltnet/sdk": "0.127.0"
+    "@themoltnet/sdk": "0.128.0"
   },
   "devDependencies": {
     "@types/node": "^22.19.0",