Readonly[The runtime-driven brand the thread-Durable-Object signal wake requires (see
RUNTIME_DRIVEN_AGENT). A unique symbol field, so it cannot collide
with an inherited property and a plain Agent never carries it.
ProtectedexecuteDrive the durable-agentic-loop through RunnerRuntime instead of the base
createRun + run.start. stream()/generate() have already parked the
non-serializables (model/tools/messageList) on the in-process run registry
keyed by this runId, so the loop the runtime starts resolves them in-isolate
while the runtime mints the per-leg grant context. The runId guard here is
defense in depth — the public boundary (stream/generate) already enforced
the tenant-scoped run-ID rule; this catches any future internal caller.
The same tenant-scoped run-ID guard as FlowsafeDurableAgent.stream —
generate()
re-implements the durable setup and mints its own runId the same way when
one is not supplied.
Optionaloptions: DurableAgentStreamOptions<TOutput>The same tenant-scoped run-ID guard as FlowsafeDurableAgent.stream.
prepare()
is the third inherited minting entry point: it forwards options?.runId into
core's prepareForDurableExecution (agent/durable/index.js:5980), which mints
a tenant-less crypto.randomUUID() when it is absent (index.js:589) AND
REGISTERS a run under that id (index.js:5984) — so a later
resume(runId)/executeWorkflow sees a bare UUID PATH_SAFE_ID_PATTERN
already accepts, past every downstream guard. Enforce the caller-minted ID here, while
"absent" is still visible.
Optionaloptions: AgentExecutionOptions<TOutput>Rehydrate a suspended durable-agent run after isolate eviction, restore its active thread registration, then resume through RunnerRuntime so approval grant derivation and the durable resume ledger remain authoritative. Hosts expose this only from their trusted approval-decision topology.
Enforce a caller-minted tenant-scoped run ID before the inherited durable
stream() runs: without this the
optional options.runId would let core mint a tenant-less
crypto.randomUUID() upstream. The private run-ID guard rejects a missing or
non-path-safe value before delegating to core.
A host mints ${tenantId}_${uuid} and passes it as options.runId.
Optionaloptions: DurableAgentStreamOptions<TOutput>
A DurableAgent whose loop runs through RunnerRuntime rather than the base
createRun + run.start. Construct via createFlowsafeDurableAgent so the loop workflow is registered on the runtime.