@tokenfactory/acc-runner 0.40.8 → 0.40.10

package/dist/chat-transport.d.ts

@@ -62,6 +62,14 @@ export interface SupabaseChatTransportOptions {
  */
 export declare function createSupabaseChatTransport(client: RunnerSupabaseClient, opts?: SupabaseChatTransportOptions): ChatLaneTransport & {
     close: () => Promise<void>;
+    /**
+     * AUTH-REFRESH: hot-swap the Supabase client (and,
+     * optionally, the durable-ingest bearer) after a token refresh. Old
+     * per-conversation channels are torn down so the next stream frame re-subscribes
+     * on the fresh socket — turn-serving keeps working across a rotation instead of
+     * riding the old, soon-to-expire JWT until the process restarts.
+     */
+    refreshClient: (nextClient: RunnerSupabaseClient, nextIngestToken?: string) => Promise<void>;
 };
 export {};
 //# sourceMappingURL=chat-transport.d.ts.map

package/dist/chat-transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chat-transport.d.ts","sourceRoot":"","sources":["../src/chat-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAEL,KAAK,iBAAiB,EAItB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAgBxB,0EAA0E;AAC1E,UAAU,WAAW;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,eAAe,CAahE;AAED,MAAM,WAAW,4BAA4B;IAC3C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,wDAAwD;IACxD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,oBAAoB,EAC5B,IAAI,GAAE,4BAAiC,GACtC,iBAAiB,GAAG;IAAE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAmIpD"}
+{"version":3,"file":"chat-transport.d.ts","sourceRoot":"","sources":["../src/chat-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAEL,KAAK,iBAAiB,EAItB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAgBxB,0EAA0E;AAC1E,UAAU,WAAW;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,eAAe,CAahE;AAED,MAAM,WAAW,4BAA4B;IAC3C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,wDAAwD;IACxD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,oBAAoB,EAC5B,IAAI,GAAE,4BAAiC,GACtC,iBAAiB,GAAG;IACrB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,UAAU,EAAE,oBAAoB,EAAE,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9F,CAsJA"}

package/dist/chat-transport.js

@@ -22,6 +22,10 @@ export function mapClaimedTurn(row) {
 export function createSupabaseChatTransport(client, opts = {}) {
     const now = opts.now ?? Date.now;
     const doFetch = opts.fetchImpl ?? globalThis.fetch;
+    // AUTH-REFRESH: the client + ingest bearer are mutable so a token refresh can
+    // swap them in place (see refreshClient). Closures below read the live values.
+    let liveClient = client;
+    let ingestToken = opts.ingest?.token;
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const channels = new Map(); // any-allowed: supabase RealtimeChannel type is not re-exported by the schema-scoped client
     async function channelFor(conversationId) {
@@ -29,7 +33,7 @@ export function createSupabaseChatTransport(client, opts = {}) {
         const existing = channels.get(conversationId);
         if (existing)
             return existing;
-        const ch = client.channel(topic);
+        const ch = liveClient.channel(topic);
         channels.set(conversationId, ch);
         await new Promise((resolve) => {
             ch.subscribe((status) => {
@@ -77,7 +81,7 @@ export function createSupabaseChatTransport(client, opts = {}) {
                 method: "POST",
                 headers: {
                     "Content-Type": "application/json",
-                    Authorization: `Bearer ${opts.ingest.token}`,
+                    Authorization: `Bearer ${ingestToken ?? opts.ingest.token}`,
                 },
                 body: JSON.stringify({
                     event,
@@ -97,7 +101,7 @@ export function createSupabaseChatTransport(client, opts = {}) {
     }
     return {
         async claim(args) {
-            const { data, error } = await client.rpc("claim_chat_turn", {
+            const { data, error } = await liveClient.rpc("claim_chat_turn", {
                 p_conversation_id: args.conversationId,
                 p_runner_id: args.runnerId,
                 p_engine_id: args.engineId,
@@ -124,7 +128,7 @@ export function createSupabaseChatTransport(client, opts = {}) {
         async close() {
             for (const ch of channels.values()) {
                 try {
-                    await client.removeChannel(ch);
+                    await liveClient.removeChannel(ch);
                 }
                 catch {
                     /* best-effort teardown */
@@ -132,6 +136,22 @@ export function createSupabaseChatTransport(client, opts = {}) {
             }
             channels.clear();
         },
+        async refreshClient(nextClient, nextIngestToken) {
+            // Tear the old channels down on the OLD client (they carry the stale JWT),
+            // then swap. The next stream/complete re-subscribes on the fresh socket.
+            for (const ch of channels.values()) {
+                try {
+                    await liveClient.removeChannel(ch);
+                }
+                catch {
+                    /* best-effort teardown */
+                }
+            }
+            channels.clear();
+            liveClient = nextClient;
+            if (nextIngestToken !== undefined)
+                ingestToken = nextIngestToken;
+        },
     };
 }
 //# sourceMappingURL=chat-transport.js.map

package/dist/chat-transport.js.map

@@ -1 +1 @@
-{"version":3,"file":"chat-transport.js","sourceRoot":"","sources":["../src/chat-transport.ts"],"names":[],"mappings":"AAqBA,OAAO,EACL,0BAA0B,GAM3B,MAAM,gBAAgB,CAAC;AA8BxB,sFAAsF;AACtF,MAAM,UAAU,cAAc,CAAC,GAAgB;IAC7C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;QACxB,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAyB;QAClD,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE;QAC9B,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE;QAC9B,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,CAAC;QACrC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;KACvC,CAAC;AACJ,CAAC;AAoBD;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAA4B,EAC5B,OAAqC,EAAE;IAEvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAK,UAAU,CAAC,KAAkC,CAAC;IACjF,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAe,CAAC,CAAC,4FAA4F;IAErI,KAAK,UAAU,UAAU,CAAC,cAAsB;QAC9C,MAAM,KAAK,GAAG,QAAQ,cAAc,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC9C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjC,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACjC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,EAAE,CAAC,SAAS,CAAC,CAAC,MAAc,EAAE,EAAE;gBAC9B,IAAI,MAAM,KAAK,YAAY;oBAAE,OAAO,EAAE,CAAC;YACzC,CAAC,CAAC,CAAC;YACH,yEAAyE;YACzE,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QACvC,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,SAAS,MAAM,CACb,IAAoC,EACpC,cAAsB,EACtB,MAAc,EACd,QAAgB;QAEhB,OAAO;YACL,gBAAgB,EAAE,0BAA0B;YAC5C,IAAI;YACJ,eAAe,EAAE,cAAc;YAC/B,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,QAAQ;YACnB,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;SAClC,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,SAAS,CACtB,IAAqB,EACrB,KAAqB,EACrB,IAAoC,EACpC,OAAgB;QAEhB,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAClD,MAAM,EAAE,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,WAAW;gBACjB,KAAK;gBACL,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE;aACrF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,EAAE,CAAC,+BAA+B,KAAK,KAAK,IAAI,CAAC,EAAE,aAAc,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,4EAA4E;QAC5E,2EAA2E;QAC3E,8EAA8E;QAC9E,6DAA6D;QAC7D,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,UAAU,UAAU,CACvB,IAAqB,EACrB,KAAqB,EACrB,OAAgB;QAEhB,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;YAAE,OAAO;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,EAAE;gBACvF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;iBAC7C;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,KAAK;oBACL,eAAe,EAAE,IAAI,CAAC,eAAe;oBACrC,OAAO,EAAE,IAAI,CAAC,EAAE;oBAChB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,OAAO;iBACR,CAAC;aACH,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,IAAI,CAAC,KAAK,EAAE,CAAC,4BAA4B,KAAK,KAAK,IAAI,CAAC,EAAE,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,EAAE,CAAC,4BAA4B,KAAK,KAAK,IAAI,CAAC,EAAE,aAAc,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,IAAI;YACd,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE;gBAC1D,iBAAiB,EAAE,IAAI,CAAC,cAAc;gBACtC,WAAW,EAAE,IAAI,CAAC,QAAQ;gBAC1B,WAAW,EAAE,IAAI,CAAC,QAAQ;gBAC1B,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,UAAU,EAAE,IAAI,CAAC,OAAO;aACzB,CAAC,CAAC;YACH,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,KAAK,EAAE,CAAC,gCAAgC,IAAI,CAAC,cAAc,aAAa,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC9F,OAAO,IAAI,CAAC;YACd,CAAC;YACD,yEAAyE;YACzE,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAmC,CAAC;YACrF,OAAO,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,IAAqB,EAAE,OAA8B;YAChE,MAAM,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;QACpE,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,IAAqB,EAAE,OAAgC;YACpE,MAAM,SAAS,CAAC,IAAI,EAAE,eAAe,EAAE,oBAAoB,EAAE,OAAO,CAAC,CAAC;QACxE,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,IAAqB,EAAE,OAA+B;YAClE,MAAM,SAAS,CAAC,IAAI,EAAE,eAAe,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;QACvE,CAAC;QAED,KAAK,CAAC,KAAK;YACT,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;gBACjC,CAAC;gBAAC,MAAM,CAAC;oBACP,0BAA0B;gBAC5B,CAAC;YACH,CAAC;YACD,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"chat-transport.js","sourceRoot":"","sources":["../src/chat-transport.ts"],"names":[],"mappings":"AAqBA,OAAO,EACL,0BAA0B,GAM3B,MAAM,gBAAgB,CAAC;AA8BxB,sFAAsF;AACtF,MAAM,UAAU,cAAc,CAAC,GAAgB;IAC7C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;QACxB,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAyB;QAClD,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE;QAC9B,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE;QAC9B,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,CAAC;QACrC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;KACvC,CAAC;AACJ,CAAC;AAoBD;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAA4B,EAC5B,OAAqC,EAAE;IAYvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAK,UAAU,CAAC,KAAkC,CAAC;IACjF,8EAA8E;IAC9E,+EAA+E;IAC/E,IAAI,UAAU,GAAG,MAAM,CAAC;IACxB,IAAI,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;IACrC,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAe,CAAC,CAAC,4FAA4F;IAErI,KAAK,UAAU,UAAU,CAAC,cAAsB;QAC9C,MAAM,KAAK,GAAG,QAAQ,cAAc,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC9C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACjC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,EAAE,CAAC,SAAS,CAAC,CAAC,MAAc,EAAE,EAAE;gBAC9B,IAAI,MAAM,KAAK,YAAY;oBAAE,OAAO,EAAE,CAAC;YACzC,CAAC,CAAC,CAAC;YACH,yEAAyE;YACzE,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QACvC,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,SAAS,MAAM,CACb,IAAoC,EACpC,cAAsB,EACtB,MAAc,EACd,QAAgB;QAEhB,OAAO;YACL,gBAAgB,EAAE,0BAA0B;YAC5C,IAAI;YACJ,eAAe,EAAE,cAAc;YAC/B,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,QAAQ;YACnB,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;SAClC,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,SAAS,CACtB,IAAqB,EACrB,KAAqB,EACrB,IAAoC,EACpC,OAAgB;QAEhB,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAClD,MAAM,EAAE,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,WAAW;gBACjB,KAAK;gBACL,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE;aACrF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,EAAE,CAAC,+BAA+B,KAAK,KAAK,IAAI,CAAC,EAAE,aAAc,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,4EAA4E;QAC5E,2EAA2E;QAC3E,8EAA8E;QAC9E,6DAA6D;QAC7D,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,UAAU,UAAU,CACvB,IAAqB,EACrB,KAAqB,EACrB,OAAgB;QAEhB,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;YAAE,OAAO;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,EAAE;gBACvF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;iBAC5D;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,KAAK;oBACL,eAAe,EAAE,IAAI,CAAC,eAAe;oBACrC,OAAO,EAAE,IAAI,CAAC,EAAE;oBAChB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,OAAO;iBACR,CAAC;aACH,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,IAAI,CAAC,KAAK,EAAE,CAAC,4BAA4B,KAAK,KAAK,IAAI,CAAC,EAAE,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,EAAE,CAAC,4BAA4B,KAAK,KAAK,IAAI,CAAC,EAAE,aAAc,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,IAAI;YACd,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,iBAAiB,EAAE;gBAC9D,iBAAiB,EAAE,IAAI,CAAC,cAAc;gBACtC,WAAW,EAAE,IAAI,CAAC,QAAQ;gBAC1B,WAAW,EAAE,IAAI,CAAC,QAAQ;gBAC1B,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,UAAU,EAAE,IAAI,CAAC,OAAO;aACzB,CAAC,CAAC;YACH,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,KAAK,EAAE,CAAC,gCAAgC,IAAI,CAAC,cAAc,aAAa,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC9F,OAAO,IAAI,CAAC;YACd,CAAC;YACD,yEAAyE;YACzE,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAmC,CAAC;YACrF,OAAO,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,IAAqB,EAAE,OAA8B;YAChE,MAAM,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;QACpE,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,IAAqB,EAAE,OAAgC;YACpE,MAAM,SAAS,CAAC,IAAI,EAAE,eAAe,EAAE,oBAAoB,EAAE,OAAO,CAAC,CAAC;QACxE,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,IAAqB,EAAE,OAA+B;YAClE,MAAM,SAAS,CAAC,IAAI,EAAE,eAAe,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;QACvE,CAAC;QAED,KAAK,CAAC,KAAK;YACT,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,MAAM,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACP,0BAA0B;gBAC5B,CAAC;YACH,CAAC;YACD,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,UAAU,EAAE,eAAe;YAC7C,2EAA2E;YAC3E,yEAAyE;YACzE,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,MAAM,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACP,0BAA0B;gBAC5B,CAAC;YACH,CAAC;YACD,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,UAAU,GAAG,UAAU,CAAC;YACxB,IAAI,eAAe,KAAK,SAAS;gBAAE,WAAW,GAAG,eAAe,CAAC;QACnE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/companion-identity.d.ts

@@ -0,0 +1,144 @@
+/**
+ * COMPANION-IDENTITY-DISCOVERY: self-discovery + honest binding of the
+ * companion's enrollment identity.
+ *
+ * The bug this fixes: plain `acc-runner companion` (what the post-ENROLL-FIX
+ * enrollment guidance tells the operator to run) only ever bound an identity —
+ * and therefore only ever wrote `runner_ids` / `probe_tier` — when the operator
+ * had hand-set `ACC_RUNNER_COMPANION_IDENTITY`. Nothing anywhere mentioned that
+ * env var, so the flagless command came online GREEN-AND-SILENT while never
+ * serving provider status. Third seam defect in this flow.
+ *
+ * The fix has three pure pieces, all here so they are exercised without a
+ * network, a `claude` binary, or the live-wiring in companion-run.ts:
+ *
+ *   1. `discoverCompanionIdentities` — the authenticated GET /api/identities/
+ *      discover call. It is ALSO the pre-online SESSION PING: a dead/expired
+ *      session yields 401/403 and `sessionOk:false`, which is what lets the CLI
+ *      refuse to print "online" on a zombie session.
+ *   2. `resolveBinding` — turn the discovery outcome (+ optional env override)
+ *      into a binding decision: exactly one match ⇒ bound; multiple ⇒ unbound +
+ *      list; zero ⇒ unbound + "no enrollment"; unreachable ⇒ unbound + degraded.
+ *   3. `companionBanner` — the HONESTY invariant: a bound companion gets a green
+ *      headline naming the bound identity; anything else gets a yellow headline
+ *      that literally contains "UNBOUND". `tone === "ok"` iff `binding.kind ===
+ *      "bound"`, so green-and-silent-while-unbound is structurally impossible.
+ *
+ * The env var stays as a documented override (a machine with more than one
+ * enrolled subscription of the same engine picks one explicitly).
+ */
+/** One owner-bound companion identity the runner may serve. */
+export interface DiscoveredIdentity {
+    id: string;
+    provider: string;
+    engine: string;
+    status: string;
+    /** null ⇒ pending (never probed); set ⇒ already adopted/probed. */
+    lastProbeAt: string | null;
+}
+/** The outcome of the discovery call — matches plus session/reachability facts. */
+export interface DiscoveryOutcome {
+    /** False ONLY when the registry rejected the token (401/403). Refuse to come online. */
+    sessionOk: boolean;
+    /** False when the registry could not be reached / returned a non-auth error. */
+    reachable: boolean;
+    /** Owner-bound companion identities matching (owner, provider?, engine?). */
+    matches: DiscoveredIdentity[];
+    /** Best-effort human note (never key material). */
+    detail?: string;
+}
+/** The runner's binding decision. */
+export type IdentityBinding = {
+    kind: "bound";
+    identityId: string;
+    /** The discovered row when known (null for a blind env override). */
+    identity: DiscoveredIdentity | null;
+    source: "discovery" | "override";
+} | {
+    kind: "unbound";
+    reason: "no_enrollment" | "multiple" | "unreachable";
+    /** Candidate rows to show the operator (populated for `multiple`). */
+    matches: DiscoveredIdentity[];
+};
+/**
+ * Best-effort engine → LLM provider map, used only to NARROW discovery to the
+ * caller's rows for that provider. Unknown engines omit the provider filter (the
+ * server then matches on owner + engine alone), so this is advisory, never a gate.
+ */
+export declare function providerForEngine(engineId: string): string | undefined;
+/** Injected deps for the discovery call (fetch is a seam for tests). */
+export interface DiscoverDeps {
+    publicUrl: string;
+    accessToken: string;
+    engineId: string;
+    provider?: string;
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Call GET /api/identities/discover under the runner's session. This doubles as
+ * the pre-online session ping: a 401/403 is a dead session (`sessionOk:false`),
+ * a network error or non-auth HTTP error is "unreachable" (`reachable:false`,
+ * but `sessionOk:true` — we cannot disprove the session), and a 200 returns the
+ * matching owner-bound companion identities.
+ */
+export declare function discoverCompanionIdentities(deps: DiscoverDeps): Promise<DiscoveryOutcome>;
+/**
+ * Decide the binding from the discovery outcome and the optional env override.
+ * The override ALWAYS wins (escape hatch) once the session is known-good; it
+ * binds even to an id not in `matches` (a blind bind), because an operator who
+ * hand-sets the id has authoritatively chosen it. Callers must first check
+ * `outcome.sessionOk` — this function assumes the session ping already passed.
+ */
+export declare function resolveBinding(outcome: DiscoveryOutcome, override: string | undefined | null): IdentityBinding;
+/**
+ * The registration payload the companion reports once bound: which runner is
+ * serving which identity, at what probed tier + capacity. `tier`/`capacity` are
+ * kept as plain strings so this module stays free of the engine capability
+ * enums (companion-run.ts passes the narrower union values through).
+ */
+export interface ProbeReportPayload {
+    identityId: string;
+    runnerId: string;
+    tier: string | null;
+    capacity: string;
+}
+/** Injected deps for the probe POST (fetch is a transport seam only). */
+export interface ReportProbeDeps {
+    publicUrl: string;
+    accessToken: string;
+    fetchImpl?: typeof fetch;
+}
+/**
+ * POST the companion registration to /api/identities/probe. This is the WRITE
+ * side of the bind: the server folds `tier` into `probe_tier`/`last_probe_at`
+ * (via acc.set_ai_identity_probe) and unions `runnerId` into the identity's
+ * `runner_ids` roster — the two columns that, left NULL/empty, made the flagless
+ * companion come online green-and-silent while provider-status could never
+ * confirm it. Shared by companion-run.ts (production) and the write-path test so
+ * the exact same request is exercised in both. Throws on a non-2xx response so
+ * CompanionRunner's registration-persist catch can log it (best-effort).
+ */
+export declare function reportIdentityProbe(deps: ReportProbeDeps, payload: ProbeReportPayload): Promise<void>;
+/** The env var whose presence overrides self-discovery with an explicit id. */
+export declare const COMPANION_IDENTITY_OVERRIDE_HINT = "ACC_RUNNER_COMPANION_IDENTITY";
+export type BannerTone = "ok" | "warn";
+/** A rendered (but colour-free) startup banner — the caller applies chalk. */
+export interface CompanionBanner {
+    tone: BannerTone;
+    /** The single headline line. `tone==="ok"` iff the companion is bound. */
+    headline: string;
+    /** Follow-up guidance lines (empty for a clean bound start). */
+    lines: string[];
+}
+/**
+ * Build the startup banner. HONESTY invariant (asserted by the tests):
+ *   - a BOUND companion → tone "ok", headline names the bound identity id;
+ *   - ANY unbound state → tone "warn", headline CONTAINS "UNBOUND" and the
+ *     words "not serving provider status".
+ * There is no path to a green headline that does not name a bound identity, so a
+ * green-and-silent-while-unbound banner cannot be produced.
+ */
+export declare function companionBanner(binding: IdentityBinding, ctx: {
+    email: string;
+}): CompanionBanner;
+//# sourceMappingURL=companion-identity.d.ts.map

package/dist/companion-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"companion-identity.d.ts","sourceRoot":"","sources":["../src/companion-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,mFAAmF;AACnF,MAAM,WAAW,gBAAgB;IAC/B,wFAAwF;IACxF,SAAS,EAAE,OAAO,CAAC;IACnB,gFAAgF;IAChF,SAAS,EAAE,OAAO,CAAC;IACnB,6EAA6E;IAC7E,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qCAAqC;AACrC,MAAM,MAAM,eAAe,GACvB;IACE,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACpC,MAAM,EAAE,WAAW,GAAG,UAAU,CAAC;CAClC,GACD;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,eAAe,GAAG,UAAU,GAAG,aAAa,CAAC;IACrD,sEAAsE;IACtE,OAAO,EAAE,kBAAkB,EAAE,CAAC;CAC/B,CAAC;AAEN;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAWtE;AAED,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAUD;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAyC/F;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,gBAAgB,EACzB,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAClC,eAAe,CAiBjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAoBf;AAED,+EAA+E;AAC/E,eAAO,MAAM,gCAAgC,kCAAkC,CAAC;AAEhF,MAAM,MAAM,UAAU,GAAG,IAAI,GAAG,MAAM,CAAC;AAEvC,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,UAAU,CAAC;IACjB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAQD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GACrB,eAAe,CAqCjB"}

package/dist/companion-identity.js

@@ -0,0 +1,189 @@
+/**
+ * COMPANION-IDENTITY-DISCOVERY: self-discovery + honest binding of the
+ * companion's enrollment identity.
+ *
+ * The bug this fixes: plain `acc-runner companion` (what the post-ENROLL-FIX
+ * enrollment guidance tells the operator to run) only ever bound an identity —
+ * and therefore only ever wrote `runner_ids` / `probe_tier` — when the operator
+ * had hand-set `ACC_RUNNER_COMPANION_IDENTITY`. Nothing anywhere mentioned that
+ * env var, so the flagless command came online GREEN-AND-SILENT while never
+ * serving provider status. Third seam defect in this flow.
+ *
+ * The fix has three pure pieces, all here so they are exercised without a
+ * network, a `claude` binary, or the live-wiring in companion-run.ts:
+ *
+ *   1. `discoverCompanionIdentities` — the authenticated GET /api/identities/
+ *      discover call. It is ALSO the pre-online SESSION PING: a dead/expired
+ *      session yields 401/403 and `sessionOk:false`, which is what lets the CLI
+ *      refuse to print "online" on a zombie session.
+ *   2. `resolveBinding` — turn the discovery outcome (+ optional env override)
+ *      into a binding decision: exactly one match ⇒ bound; multiple ⇒ unbound +
+ *      list; zero ⇒ unbound + "no enrollment"; unreachable ⇒ unbound + degraded.
+ *   3. `companionBanner` — the HONESTY invariant: a bound companion gets a green
+ *      headline naming the bound identity; anything else gets a yellow headline
+ *      that literally contains "UNBOUND". `tone === "ok"` iff `binding.kind ===
+ *      "bound"`, so green-and-silent-while-unbound is structurally impossible.
+ *
+ * The env var stays as a documented override (a machine with more than one
+ * enrolled subscription of the same engine picks one explicitly).
+ */
+/**
+ * Best-effort engine → LLM provider map, used only to NARROW discovery to the
+ * caller's rows for that provider. Unknown engines omit the provider filter (the
+ * server then matches on owner + engine alone), so this is advisory, never a gate.
+ */
+export function providerForEngine(engineId) {
+    switch ((engineId ?? "").trim()) {
+        case "claude-code":
+            return "anthropic";
+        case "codex":
+            return "openai";
+        case "gemini":
+            return "google";
+        default:
+            return undefined;
+    }
+}
+/**
+ * Call GET /api/identities/discover under the runner's session. This doubles as
+ * the pre-online session ping: a 401/403 is a dead session (`sessionOk:false`),
+ * a network error or non-auth HTTP error is "unreachable" (`reachable:false`,
+ * but `sessionOk:true` — we cannot disprove the session), and a 200 returns the
+ * matching owner-bound companion identities.
+ */
+export async function discoverCompanionIdentities(deps) {
+    const base = (deps.publicUrl ?? "").replace(/\/+$/, "");
+    const params = new URLSearchParams();
+    if (deps.engineId)
+        params.set("engine", deps.engineId);
+    if (deps.provider)
+        params.set("provider", deps.provider);
+    const url = `${base}/api/identities/discover${params.toString() ? `?${params.toString()}` : ""}`;
+    const f = deps.fetchImpl ?? fetch;
+    let res;
+    try {
+        res = await f(url, { headers: { Authorization: `Bearer ${deps.accessToken}` } });
+    }
+    catch (err) {
+        return { sessionOk: true, reachable: false, matches: [], detail: err.message };
+    }
+    if (res.status === 401 || res.status === 403) {
+        return { sessionOk: false, reachable: true, matches: [], detail: `discover HTTP ${res.status}` };
+    }
+    if (!res.ok) {
+        return { sessionOk: true, reachable: false, matches: [], detail: `discover HTTP ${res.status}` };
+    }
+    const json = (await res.json().catch(() => null));
+    if (!json || json.ok !== true || !Array.isArray(json.matches)) {
+        return { sessionOk: true, reachable: false, matches: [], detail: "malformed discover response" };
+    }
+    const matches = json.matches
+        .filter((m) => !!m && typeof m === "object")
+        .map((m) => ({
+        id: String(m.id ?? ""),
+        provider: String(m.provider ?? ""),
+        engine: String(m.engine ?? ""),
+        status: String(m.status ?? ""),
+        lastProbeAt: typeof m.last_probe_at === "string" ? m.last_probe_at : null,
+    }))
+        .filter((m) => m.id);
+    return { sessionOk: true, reachable: true, matches };
+}
+/**
+ * Decide the binding from the discovery outcome and the optional env override.
+ * The override ALWAYS wins (escape hatch) once the session is known-good; it
+ * binds even to an id not in `matches` (a blind bind), because an operator who
+ * hand-sets the id has authoritatively chosen it. Callers must first check
+ * `outcome.sessionOk` — this function assumes the session ping already passed.
+ */
+export function resolveBinding(outcome, override) {
+    const ov = (override ?? "").trim();
+    if (ov) {
+        const identity = outcome.matches.find((m) => m.id === ov) ?? null;
+        return { kind: "bound", identityId: ov, identity, source: "override" };
+    }
+    if (!outcome.reachable) {
+        return { kind: "unbound", reason: "unreachable", matches: [] };
+    }
+    if (outcome.matches.length === 1) {
+        const only = outcome.matches[0];
+        return { kind: "bound", identityId: only.id, identity: only, source: "discovery" };
+    }
+    if (outcome.matches.length === 0) {
+        return { kind: "unbound", reason: "no_enrollment", matches: [] };
+    }
+    return { kind: "unbound", reason: "multiple", matches: outcome.matches };
+}
+/**
+ * POST the companion registration to /api/identities/probe. This is the WRITE
+ * side of the bind: the server folds `tier` into `probe_tier`/`last_probe_at`
+ * (via acc.set_ai_identity_probe) and unions `runnerId` into the identity's
+ * `runner_ids` roster — the two columns that, left NULL/empty, made the flagless
+ * companion come online green-and-silent while provider-status could never
+ * confirm it. Shared by companion-run.ts (production) and the write-path test so
+ * the exact same request is exercised in both. Throws on a non-2xx response so
+ * CompanionRunner's registration-persist catch can log it (best-effort).
+ */
+export async function reportIdentityProbe(deps, payload) {
+    const url = `${(deps.publicUrl ?? "").replace(/\/+$/, "")}/api/identities/probe`;
+    const f = deps.fetchImpl ?? fetch;
+    const res = await f(url, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${deps.accessToken}`,
+        },
+        body: JSON.stringify({
+            identity_id: payload.identityId,
+            runner_id: payload.runnerId,
+            tier: payload.tier ?? undefined,
+            capacity: payload.capacity,
+            status: "active",
+        }),
+    });
+    if (!res.ok) {
+        throw new Error(`probe report HTTP ${res.status}`);
+    }
+}
+/** The env var whose presence overrides self-discovery with an explicit id. */
+export const COMPANION_IDENTITY_OVERRIDE_HINT = "ACC_RUNNER_COMPANION_IDENTITY";
+function identityLabel(identity) {
+    if (!identity)
+        return "identity";
+    const pe = [identity.provider, identity.engine].filter(Boolean).join("·");
+    return pe || "identity";
+}
+/**
+ * Build the startup banner. HONESTY invariant (asserted by the tests):
+ *   - a BOUND companion → tone "ok", headline names the bound identity id;
+ *   - ANY unbound state → tone "warn", headline CONTAINS "UNBOUND" and the
+ *     words "not serving provider status".
+ * There is no path to a green headline that does not name a bound identity, so a
+ * green-and-silent-while-unbound banner cannot be produced.
+ */
+export function companionBanner(binding, ctx) {
+    const who = ctx.email || "this runner";
+    if (binding.kind === "bound") {
+        const via = binding.source === "override" ? " (via env override)" : "";
+        return {
+            tone: "ok",
+            headline: `✓ Companion online for ${who} — bound to ${identityLabel(binding.identity)}, identity ${binding.identityId}${via}`,
+            lines: [],
+        };
+    }
+    const headline = `⚠ Companion online for ${who} — UNBOUND, not serving provider status (serving drafts only)`;
+    const lines = [];
+    switch (binding.reason) {
+        case "no_enrollment":
+            lines.push("  No enrollment found for this owner + engine. Enroll in Admin ▸ AI providers,", "  then restart the companion so it can bind and report a chat-auth probe.");
+            break;
+        case "multiple":
+            lines.push("  More than one enrollment matches — the companion will not guess. Set", `  ${COMPANION_IDENTITY_OVERRIDE_HINT}=<id> to pick one, then restart:`, ...binding.matches.map((m) => `    • ${m.id} (${identityLabel(m)}${m.lastProbeAt ? ", probed" : ", pending"})`));
+            break;
+        case "unreachable":
+            lines.push("  Could not reach the identity registry to self-discover (network / deploy).", `  Serving drafts only; set ${COMPANION_IDENTITY_OVERRIDE_HINT}=<id> to bind explicitly.`);
+            break;
+    }
+    return { tone: "warn", headline, lines };
+}
+//# sourceMappingURL=companion-identity.js.map

package/dist/companion-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"companion-identity.js","sourceRoot":"","sources":["../src/companion-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAwCH;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,KAAK,aAAa;YAChB,OAAO,WAAW,CAAC;QACrB,KAAK,OAAO;YACV,OAAO,QAAQ,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAmBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,IAAkB;IAClE,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,IAAI,IAAI,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,GAAG,IAAI,2BAA2B,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACjG,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAElC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;IAC5F,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,iBAAiB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;IACnG,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,iBAAiB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;IACnG,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAExC,CAAC;IACT,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IACnG,CAAC;IAED,MAAM,OAAO,GAAyB,IAAI,CAAC,OAAO;SAC/C,MAAM,CAAC,CAAC,CAAC,EAA4B,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;SACrE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;QAClC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QAC9B,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QAC9B,WAAW,EAAE,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;KAC1E,CAAC,CAAC;SACF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEvB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAyB,EACzB,QAAmC;IAEnC,MAAM,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;QAClE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;AAC3E,CAAC;AAsBD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAqB,EACrB,OAA2B;IAE3B,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC;IACjF,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE;QACvB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;SAC5C;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,WAAW,EAAE,OAAO,CAAC,UAAU;YAC/B,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,SAAS;YAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,QAAQ;SACjB,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gCAAgC,GAAG,+BAA+B,CAAC;AAahF,SAAS,aAAa,CAAC,QAAmC;IACxD,IAAI,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC;IACjC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1E,OAAO,EAAE,IAAI,UAAU,CAAC;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAwB,EACxB,GAAsB;IAEtB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,IAAI,aAAa,CAAC;IACvC,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO;YACL,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,0BAA0B,GAAG,eAAe,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,OAAO,CAAC,UAAU,GAAG,GAAG,EAAE;YAC7H,KAAK,EAAE,EAAE;SACV,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,0BAA0B,GAAG,+DAA+D,CAAC;IAC9G,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,eAAe;YAClB,KAAK,CAAC,IAAI,CACR,gFAAgF,EAChF,2EAA2E,CAC5E,CAAC;YACF,MAAM;QACR,KAAK,UAAU;YACb,KAAK,CAAC,IAAI,CACR,wEAAwE,EACxE,KAAK,gCAAgC,kCAAkC,EACvE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CACpB,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,GAAG,CACxF,CACF,CAAC;YACF,MAAM;QACR,KAAK,aAAa;YAChB,KAAK,CAAC,IAAI,CACR,8EAA8E,EAC9E,8BAA8B,gCAAgC,2BAA2B,CAC1F,CAAC;YACF,MAAM;IACV,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC"}

package/dist/companion-run.d.ts

@@ -4,7 +4,12 @@ export interface CompanionHandle {
 }
 /** Env var seeding the owner's conversations the companion should serve at boot. */
 export declare const COMPANION_CONVERSATIONS_ENV = "ACC_RUNNER_COMPANION_CONVERSATIONS";
-/** Env var naming the acc.ai_identities row this companion serves (enrollment id). */
+/**
+ * Optional OVERRIDE naming the acc.ai_identities row this companion serves. The
+ * default is self-discovery (see companion-identity.ts) — this env var only
+ * short-circuits it, for a host that has more than one enrolled subscription of
+ * the same engine and must pick one explicitly.
+ */
 export declare const COMPANION_IDENTITY_ENV = "ACC_RUNNER_COMPANION_IDENTITY";
 /**
  * Start companion mode. Registers the owner-bound identity, serves the owner's

package/dist/companion-run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"companion-run.d.ts","sourceRoot":"","sources":["../src/companion-run.ts"],"names":[],"mappings":"AAgCA,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,oFAAoF;AACpF,eAAO,MAAM,2BAA2B,uCAAuC,CAAC;AAChF,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,kCAAkC,CAAC;AAEtE;;;;GAIG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,eAAe,CAAC,CAwHjE;AAED,+DAA+D;AAC/D,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAmB5D;AAED,8DAA8D;AAC9D,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC,CAK7D;AAED,wCAAwC;AACxC,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAK/D"}
+{"version":3,"file":"companion-run.d.ts","sourceRoot":"","sources":["../src/companion-run.ts"],"names":[],"mappings":"AA6CA,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,oFAAoF;AACpF,eAAO,MAAM,2BAA2B,uCAAuC,CAAC;AAChF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,kCAAkC,CAAC;AAEtE;;;;GAIG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,eAAe,CAAC,CAgMjE;AAED,+DAA+D;AAC/D,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAmB5D;AAED,8DAA8D;AAC9D,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC,CAK7D;AAED,wCAAwC;AACxC,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAK/D"}