[shuv1337]

Brings in upstream v2 up to 54bfc1a59 (8 "Export" commits, Oct 21–23; 85 files, +10,677 / −3,415). Authorized by Kyle. This is a fork-only PR to shuv1337/executor v2; nothing goes upstream.

What upstream brings

Mostly Cloud: v1 import runs and checks, Cloud onboarding and sign-in, product analytics, and the edge contract. Plus an SDK refactor that moves the deploy-time build into apps.build / buildSource, workerd-client and resource-lifecycle changes, dashboard UI updates, and app-template skill updates.

Conflicts (3 files), resolved keeping both sides

• apps/hosted/cloud/src/infrastructure/mcp-auth.ts: keep the fork's connection-key endpoints (mint, revokeMcpConnectionKeys, listMcpConnectionKeys, revokeMcpConnectionKey; Connection keys: API keys bound to one scoped MCP connection #36/List a connection's keys and revoke one without revoking the connection #53) and the connection argument to bearer checks. Add upstream's getSession and v1-forward authentication. A v1-forwarded request takes upstream's path, and bearer requests keep the connection binding.
• packages/sdk/src/contracts/executor.ts: keep the Caller import and the searchableKept omission (Batch MCP search discovery into a few product operations #51). Take upstream's SourceFiles import and the apps.build omission.
• packages/sdk/src/implementation/apps.ts: take upstream's buildSource refactor and re-add the fork's sharedRuntime requirement (Let an app share one warm runtime across callers with sharedRuntime (opt-in) #44), which upstream's buildSource doesn't carry. Without it, sharedRuntime apps would deploy as per-selection runtimes.

Fork features preserved. I compared marker counts before and after the merge; every one is unchanged:
sharedRuntime, sharesRuntime, callerIdentity, approvedBy, approvalStatus, AppDataVersionSuperseded, searchableKept, listAccountsEach, connection-key list/revoke, ConnectionIdTaken, ScheduleScopeRequired, refreshAtMostEvery, recycleIdleFacets, trace sampling, self-host-native.config.ts, EXECUTOR_NPM_REGISTRY (custom registry), appsResolving.

bun.lock is regenerated: the apps workspace now records 0.0.1-beta.100.shuv.3, which was the stale-lockfile item in the sync plan.

Checks

• bun run check passes: patches, versions, format, lint, typecheck, apps protocols (no protocol change), telemetry, API errors, auth rate limit, v1-import access, and the boundary checks.
• E2E on self-host, 15 spec files: 50 passed, 2 skipped as not applicable to self-host. They cover connection keys (including per-key revoke and ID reuse), scoped connections (upstream changed this spec), shared runtime, caller identity and person approval, app-page approvals, superseded data versions, app data limits and migrations (exercising the buildSource path), MCP search statements, tool-call overhead, the CLI call (device code), schedule scope, live-query batching, trace sampling and PAT MCP.
• Not run locally: upstream's Cloud-only specs (cloud-v1-import*, cloud-onboarding-experiment, cloud-v1-sign-in, product-analytics). Cloud isn't deployed by this fork; they run in the managed local Cloud job.

mcp-connections.spec.ts
connection-keys.spec.ts
connection-api-keys.spec.ts
shared-runtime.spec.ts
caller-identity.spec.ts
app-page-approvals.spec.ts
app-superseded-data-version.spec.ts
app-data-limits.spec.ts
mcp-search-statements.spec.ts
tool-call-overhead.spec.ts
apps-cli-call.spec.ts
app-schedules.spec.ts
app-live-query-batching.spec.ts
trace-sampling.spec.ts
pat-mcp.spec.ts