From 4e526e67f0dafdc80cdfcc325ddd1adf102dd54f Mon Sep 17 00:00:00 2001
From: nicholascole <nicholas.colesd@gmail.com>
Date: Thu, 9 Jul 2026 21:08:13 -0700
Subject: [PATCH] feat(client): add Task.runtimeMetadata to OpenAPI spec +
 regenerated types
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The server can resolve a worker's declared TaskDef.runtimeMetadata secret names
at poll time and deliver the values on the wire-only Task.runtimeMetadata
(conductor-oss PR #1255) — never persisted to task input. Declare the field on
the Task schema so the generated client type carries it (string->string map,
optional). The runtime client already keeps unknown JSON keys; this makes the
field first-class and type-checked.

- spec.json: Task.runtimeMetadata (object, additionalProperties string).
- types.gen.ts: regenerated via `npm run generate-openapi-layer`.
- __tests__/TaskRuntimeMetadata.test.ts: compile-time type guard (tsc) + JSON
  round-trip + omit-when-empty.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../__tests__/TaskRuntimeMetadata.test.ts     | 31 +++++++++++++++++++
 src/open-api/generated/types.gen.ts           |  6 ++++
 src/open-api/spec/spec.json                   |  7 +++++
 3 files changed, 44 insertions(+)
 create mode 100644 src/open-api/__tests__/TaskRuntimeMetadata.test.ts

diff --git a/src/open-api/__tests__/TaskRuntimeMetadata.test.ts b/src/open-api/__tests__/TaskRuntimeMetadata.test.ts
new file mode 100644
index 00000000..b01faaff
--- /dev/null
+++ b/src/open-api/__tests__/TaskRuntimeMetadata.test.ts
@@ -0,0 +1,31 @@
+import { Task } from "../generated/types.gen";
+
+// Compile-time guarantee: the generated Task type carries runtimeMetadata as an optional
+// string->string map. If the OpenAPI spec (and thus the regenerated type) drops the field, this
+// assignment fails `tsc` — the type is the real deliverable for the dynamic TS client.
+const _runtimeMetadataTypeGuard: Record<string, string> | undefined = ({} as Task).runtimeMetadata;
+void _runtimeMetadataTypeGuard;
+
+/**
+ * The server delivers host-resolved secret values on Task.runtimeMetadata (wire-only, never
+ * persisted) when a worker's TaskDef.runtimeMetadata declares secret names (conductor-oss PR #1255).
+ * Verify the generated client type carries the field as a string->string map and round-trips it.
+ */
+describe("Task.runtimeMetadata", () => {
+  it("round-trips host-resolved secret values", () => {
+    const task: Task = {
+      taskId: "t1",
+      runtimeMetadata: { GITHUB_TOKEN: "ghp_secret", GH_APP_ID: "42" },
+    };
+
+    const back = JSON.parse(JSON.stringify(task)) as Task;
+
+    expect(back.runtimeMetadata).toEqual({ GITHUB_TOKEN: "ghp_secret", GH_APP_ID: "42" });
+    expect(back.runtimeMetadata?.["GITHUB_TOKEN"]).toBe("ghp_secret");
+  });
+
+  it("is optional and omitted from the wire when absent", () => {
+    const task: Task = { taskId: "t1" };
+    expect(JSON.stringify(task)).not.toContain("runtimeMetadata");
+  });
+});
diff --git a/src/open-api/generated/types.gen.ts b/src/open-api/generated/types.gen.ts
index 44005b9c..99f65da6 100644
--- a/src/open-api/generated/types.gen.ts
+++ b/src/open-api/generated/types.gen.ts
@@ -2188,6 +2188,12 @@ export type Task = {
     outputData?: {
         [key: string]: unknown;
     };
+    /**
+     * Secret values the server resolved for this task at poll time and delivered on the wire only (never persisted). Populated when the task's TaskDef.runtimeMetadata declares secret names the host resolves from its secret store (conductor-oss PR #1255).
+     */
+    runtimeMetadata?: {
+        [key: string]: string;
+    };
     parentTaskId?: string;
     pollCount?: number;
     queueWaitTime?: number;
diff --git a/src/open-api/spec/spec.json b/src/open-api/spec/spec.json
index bb429f80..9373efae 100644
--- a/src/open-api/spec/spec.json
+++ b/src/open-api/spec/spec.json
@@ -16847,6 +16847,13 @@
               "type": "object",
               "additionalProperties": {}
             },
+            "runtimeMetadata": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Secret values the server resolved for this task at poll time and delivered on the wire only (never persisted). Populated when the task's TaskDef.runtimeMetadata declares secret names the host resolves from its secret store (conductor-oss PR #1255)."
+            },
             "parentTaskId": {
               "type": "string"
             },