feat(webhooks): add gated automation token issuance

[pandemicsyn]

Summary

Enable scoped credentials for Webhook Agent Ingest and scheduled automation. Modern control tokens target Cloud Agent Next, carry exact runtime-admission authority, and preserve existing null peppers. Legacy issuance retains its existing format. Format-specific cache keys prevent reusing credentials from the other issuance mode; callbacks retain separate HMAC authentication.

Extracted from #5976, which originated in the token-issuance implementation in #5857. This PR targets main independently of mobile and Gastown.

Verification

No manual deployed automation smoke tests were run. This extraction was verified with automated suites and source comparison; the deployed prepare/initiate/runtime/callback flow has not been smoke-tested and must be checked during rollout.

Visual Changes

N/A

Reviewer Notes

Feature toggle	Default	Where to configure
SHARED_RESOURCE_TOKENS_ENABLED	On: explicitly "true" in production and development	Cloudflare — Webhook Agent Ingest Worker, configured in services/webhook-agent-ingest/wrangler.jsonc; update the relevant environment and redeploy the Worker

Scoped issuance turns on when this PR deploys; no additional toggle is needed. This Worker variable is independent of the same-named Vercel variable. To stop fresh scoped issuance, set it to "false" in the relevant Worker environment and redeploy. An absent or invalid value also leaves issuance off.

• Blocked-account checks apply with issuance off too. Disabling future issuance does not revoke existing modern sessions; retain compatible receivers/runtime support.
• Web SHARED_RESOURCE_TOKENS_ENABLED=true with CLOUD_AGENT_RESOURCE_TOKENS_ENABLED=false is supported: Web issuance and Worker issuance are independent. Cloud Agent must retain RUNTIME_ISOLATION_ENABLED=true to admit scoped webhook workloads; its checked-in configuration already does. Webhook jobs still exercise the scoped runtime path even when Web issuance is disabled.
• Receiver/runtime contracts already exist on main. Includes the worker-types development dependency and lockfile change; the large generated-types deletion replaces embedded runtime declarations with that dependency.
• Automated validation: all 140 service tests, typecheck, and lint passed on the extracted branch.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The only change since the prior review at e860b232b397b8f88de51b0209873d13f0d8d1be flips SHARED_RESOURCE_TOKENS_ENABLED from "false" to "true" for the production and dev Worker environments in services/webhook-agent-ingest/wrangler.jsonc, with the matching generated binding type; the gated modern-issuance code path is unchanged and the flip is consistent with its format-scoped KV cache key and true/'true' checks at head 8bd510540645a593a2afc4592fd073497b3452fe.

Files Reviewed (2 files)

• services/webhook-agent-ingest/wrangler.jsonc
• services/webhook-agent-ingest/worker-configuration.d.ts (generated)

Previous Review Summaries (2 snapshots, latest commit e860b23)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit e860b23)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The only change since the prior review at 02213512bffd6b6c898125ac90749c4bab24ad50 is the removal of docs/webhook-token-issuance.md; deletion-only documentation changes introduce no code risk at head e860b232b397b8f88de51b0209873d13f0d8d1be.

Files Reviewed (1 file)

• docs/webhook-token-issuance.md (deleted)

Prior Review Context (unchanged files)

Carried forward from the previous review, no new findings: pnpm-lock.yaml, services/webhook-agent-ingest/package.json, services/webhook-agent-ingest/src/db/queries.ts, services/webhook-agent-ingest/src/queue-consumer.ts, services/webhook-agent-ingest/src/queue-consumer.test.ts, services/webhook-agent-ingest/src/routes/callbacks.ts, services/webhook-agent-ingest/src/services/token-minting-service.ts, services/webhook-agent-ingest/src/services/token-minting-service.test.ts, services/webhook-agent-ingest/src/util/auth.ts, services/webhook-agent-ingest/src/util/secret.ts, services/webhook-agent-ingest/tsconfig.json, services/webhook-agent-ingest/worker-configuration.d.ts (generated), services/webhook-agent-ingest/wrangler.jsonc.

Previous review (commit 0221351)

Status: No Issues Found | Recommendation: Merge

Reviewed the gated webhook automation token issuance changes against the current head 02213512bffd6b6c898125ac90749c4bab24ad50. The modern token claims (audience cloud-agent-next, tokenPurpose: internal-service, credentialExchange: false, runtimeAdmission.source: automation) satisfy the kilo-token-policy schema/superRefine and the createRuntimeAuthorization admission contract for both personal (including explicit null pepper) and org-bot principals; the bot-org membership is guaranteed by ensureBotUserForOrg, the user/org namespace split guarantees organizationId is only present for org triggers, and the format-scoped KV cache key matches the minting flag. Blocked-account checks, secret-binding union handling, and the generated-types/@cloudflare/workers-types switch all look consistent. No high-confidence issues found.

Files Reviewed (14 files)

• docs/webhook-token-issuance.md
• pnpm-lock.yaml (generated)
• services/webhook-agent-ingest/package.json
• services/webhook-agent-ingest/src/db/queries.ts
• services/webhook-agent-ingest/src/queue-consumer.ts
• services/webhook-agent-ingest/src/queue-consumer.test.ts
• services/webhook-agent-ingest/src/routes/callbacks.ts
• services/webhook-agent-ingest/src/services/token-minting-service.ts
• services/webhook-agent-ingest/src/services/token-minting-service.test.ts
• services/webhook-agent-ingest/src/util/auth.ts
• services/webhook-agent-ingest/src/util/secret.ts
• services/webhook-agent-ingest/tsconfig.json
• services/webhook-agent-ingest/worker-configuration.d.ts (generated)
• services/webhook-agent-ingest/wrangler.jsonc

---

_{Reviewed by deepseek-v4.1-flash · Input: 39.6K · Output: 5.7K · Cached: 306.8K}

_{Review guidance: REVIEW.md from base branch main}