@agentage/extension 0.2.0 → 0.2.1

package/dist/agcid/scope.d.ts

@@ -1,4 +1,3 @@
 import { type RequestHandler, type Response } from 'express';
-export { currentAgcid } from './current.js';
 export declare const agcidMiddleware: RequestHandler;
 export declare const agcidOfResponse: (res: Response) => string;

package/dist/agcid/scope.js

@@ -1,7 +1,6 @@
 import {} from 'express';
 import { AGCID_HEADER, agcidOf } from './agcid.js';
 import { requestScope } from './current.js';
-export { currentAgcid } from './current.js';
 // Keeps a valid incoming agcid, else mints one; echoed on every response and tags every log line.
 export const agcidMiddleware = (req, res, next) => {
     const agcid = agcidOf(req.get(AGCID_HEADER));

package/dist/auth/route-access.d.ts

@@ -0,0 +1,2 @@
+import { type Access } from './token-check.js';
+export declare const routeAccess: (doc: Record<string, unknown> | null | undefined, method: string, path: string) => Access;

package/dist/auth/route-access.js

@@ -0,0 +1,21 @@
+import { accessOfSecurity } from './token-check.js';
+const PARAM = /^\{.+\}$/;
+const sameShape = (template, path) => {
+    const want = template.split('/');
+    const got = path.split('/');
+    return want.length === got.length && want.every((seg, i) => PARAM.test(seg) || seg === got[i]);
+};
+const params = (template) => template.split('/').filter((seg) => PARAM.test(seg)).length;
+// As OpenAPI matches: a concrete path before a template, then the template with the fewest params.
+const mostSpecific = (templates, path) => templates
+    .filter((template) => sameShape(template, path))
+    .sort((a, b) => params(a) - params(b))[0];
+// The access the committed OpenAPI declares for a request: its operation's, else the document's.
+export const routeAccess = (doc, method, path) => {
+    const paths = (doc?.['paths'] ?? {});
+    const template = mostSpecific(Object.keys(paths), path);
+    const operation = template ? paths[template]?.[method.toLowerCase()] : undefined;
+    if (!operation)
+        return 'read';
+    return accessOfSecurity(operation.security ?? doc?.['security']);
+};

package/dist/auth/token-check.d.ts

@@ -0,0 +1,10 @@
+export type Access = 'public' | 'read' | 'write' | 'admin';
+export interface Caller {
+    sub: string;
+    scopes: readonly string[];
+}
+export type TokenCheck = (authorization: string | undefined, access: Access) => Promise<Caller | null>;
+export declare const setCaller: (request: object, caller: Caller | null) => void;
+export declare const callerOf: (request: object) => Caller | null;
+export declare const strongest: (needed: readonly Access[]) => Access;
+export declare const accessOfSecurity: (security: unknown) => Access;

package/dist/auth/token-check.js

@@ -0,0 +1,18 @@
+// Kit-private until ctx.auth.caller(request) exists (M3): part code never reads it from the request.
+const callers = new WeakMap();
+export const setCaller = (request, caller) => void callers.set(request, caller);
+export const callerOf = (request) => callers.get(request) ?? null;
+const RANK = { public: 0, read: 1, write: 2, admin: 3 };
+export const strongest = (needed) => needed.reduce((top, access) => (RANK[access] > RANK[top] ? access : top), 'public');
+const VERB = /:(read|write|admin)$/;
+// OpenAPI security: [] is public, a scope names the verb; a route that declares nothing needs read.
+export const accessOfSecurity = (security) => {
+    if (Array.isArray(security) && security.length === 0)
+        return 'public';
+    const scopes = (Array.isArray(security) ? security : [])
+        .flatMap((requirement) => Object.values(requirement ?? {}))
+        .flat()
+        .filter((scope) => typeof scope === 'string');
+    const verbs = scopes.map((scope) => VERB.exec(scope)?.[1] ?? 'read');
+    return verbs.length === 0 ? 'read' : strongest(verbs);
+};

package/dist/command/check-cli.js

@@ -1,6 +1,6 @@
 import { readManifest } from '../manifest/read-manifest.js';
-import { loadHandlers } from './run-command.js';
 import { createOut } from './out.js';
+import { contextFor, loadHandlers } from './run-command.js';
 const quiet = () => undefined;
 // null when the cli entry exports create and its handlers are exactly the declared commands.
 export const checkCli = async (dir) => {
@@ -8,12 +8,7 @@ export const checkCli = async (dir) => {
         const pkg = await readManifest(dir);
         const declared = (pkg.agentage.commands ?? []).map((command) => command.name).sort();
         const out = createOut({ json: false, stdout: quiet, stderr: quiet });
-        const ctx = {
-            extension: { id: pkg.agentage.id, version: pkg.version, part: 'cli' },
-            args: {},
-            out,
-        };
-        const handlers = Object.keys(await loadHandlers(dir, pkg, ctx)).sort();
+        const handlers = Object.keys(await loadHandlers(dir, pkg, contextFor(pkg, {}, out))).sort();
         if (JSON.stringify(handlers) === JSON.stringify(declared))
             return null;
         return `cli handlers [${handlers.join(', ')}] differ from commands [${declared.join(', ')}]`;

package/dist/command/run-command.d.ts

@@ -12,4 +12,5 @@ export declare const EXIT_OK = 0;
 export declare const EXIT_FAILED = 1;
 export declare const EXIT_USAGE = 2;
 export declare const loadHandlers: (dir: string, pkg: ExtensionPackage, ctx: CliContext) => Promise<Record<string, CommandHandler>>;
+export declare const contextFor: (pkg: ExtensionPackage, args: CliContext["args"], out: CliContext["out"]) => CliContext;
 export declare const runCommand: (o: RunCommandOptions) => Promise<number>;

package/dist/command/run-command.js

@@ -1,7 +1,5 @@
-import { join } from 'node:path';
-import { pathToFileURL } from 'node:url';
+import { loadCreate } from '../manifest/entry.js';
 import {} from '../manifest/manifest.schema.js';
-import { entryOf } from '../manifest/parts.js';
 import { readManifest } from '../manifest/read-manifest.js';
 import { parseCommandArgs, usage, UsageError } from './args.js';
 import {} from './command.types.js';
@@ -11,14 +9,8 @@ export const EXIT_FAILED = 1;
 export const EXIT_USAGE = 2;
 const writeOut = (text) => void process.stdout.write(text);
 const writeErr = (text) => void process.stderr.write(text);
-export const loadHandlers = async (dir, pkg, ctx) => {
-    const file = join(dir, entryOf(pkg, 'cli'));
-    const mod = (await import(pathToFileURL(file).href));
-    if (typeof mod.create !== 'function')
-        throw new Error(`${file} does not export create(ctx)`);
-    return mod.create(ctx);
-};
-const contextFor = (pkg, args, out) => ({
+export const loadHandlers = async (dir, pkg, ctx) => (await loadCreate(dir, pkg, 'cli'))(ctx);
+export const contextFor = (pkg, args, out) => ({
     extension: Object.freeze({ id: pkg.agentage.id, version: pkg.version, part: 'cli' }),
     args: Object.freeze(args),
     out,
@@ -28,10 +20,8 @@ const execute = async (o, pkg, stdout, stderr) => {
     if (!spec)
         throw new UsageError(`${pkg.agentage.id} has no command ${o.command}`);
     const parsed = parseCommandArgs(spec, o.argv);
-    if (parsed.help) {
-        stdout(`${usage(spec)}\n`);
-        return EXIT_OK;
-    }
+    if (parsed.help)
+        return (stdout(`${usage(spec)}\n`), EXIT_OK);
     const out = createOut({ json: parsed.json, stdout, stderr });
     const handler = (await loadHandlers(o.dir, pkg, contextFor(pkg, parsed.args, out)))[o.command];
     if (typeof handler !== 'function')

package/dist/context/test-context.js

@@ -24,33 +24,36 @@ const testStore = (option, log) => {
     const dir = option === true ? process.cwd() : option.dir;
     return createTestStore((store) => migrate(store, dir, log));
 };
+const TEST_EXTENSION = {
+    id: 'test',
+    version: '0.0.0',
+    part: 'api',
+    origin: 'http://127.0.0.1',
+    commit: '0'.repeat(40),
+};
+// Jobs run by hand with runJob, tools recorded as the mcp part registers them.
+const recorders = (log) => {
+    const scheduler = createScheduler({ runs: memoryRuns(), log });
+    return { ...createToolRegistry(), schedule: scheduler.schedule, runJob: scheduler.run };
+};
 const serverContext = (options) => {
     const logs = [];
     const log = runLog(recordingLog(logs));
-    const extension = {
-        id: 'test',
-        version: '0.0.0',
-        part: 'api',
-        origin: 'http://127.0.0.1',
-        commit: '0'.repeat(40),
-        ...options.extension,
-    };
     const store = testStore(options.store, recordingLog([]));
-    const scheduler = createScheduler({ runs: memoryRuns(), log });
-    const { tool, tools } = createToolRegistry();
-    const base = { extension, log, settings: { ...options.settings }, logs, tool, tools };
-    const close = async () => store?.close();
     return {
-        ...base,
+        extension: { ...TEST_EXTENSION, ...options.extension },
+        log,
+        logs,
+        settings: { ...options.settings },
         store: store ?? NO_STORE,
-        close,
-        schedule: scheduler.schedule,
-        runJob: scheduler.run,
+        close: async () => store?.close(),
+        ...recorders(log),
     };
 };
+// One recorded line per line written, the trailing newline dropped.
+const lines = (into) => (text) => void into.push(...text.replace(/\n$/, '').split('\n'));
 const commandContext = (options) => {
     const output = { stdout: [], stderr: [] };
-    const lines = (into) => (text) => void into.push(...text.replace(/\n$/, '').split('\n'));
     const out = createOut({
         json: options.json ?? false,
         stdout: lines(output.stdout),

package/dist/discovery/discovery.schema.d.ts

@@ -1,4 +1,9 @@
 import { z } from 'zod';
+export declare const WidgetSchema: z.ZodObject<{
+    name: z.ZodString;
+    element: z.ZodString;
+    module: z.ZodString;
+}, z.core.$strict>;
 export declare const ExtensionRecordSchema: z.ZodObject<{
     id: z.ZodString;
     version: z.ZodString;

package/dist/discovery/discovery.schema.js

@@ -24,7 +24,7 @@ const OriginSchema = z
     .string()
     .max(270)
     .regex(/^(https:\/\/[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+|http:\/\/(127\.0\.0\.1|localhost))(:[0-9]{1,5})?$/);
-const WidgetSchema = z.strictObject({
+export const WidgetSchema = z.strictObject({
     name: z.string().regex(/^[a-z][a-z0-9-]*$/),
     element: z.string().regex(/^[a-z][a-z0-9]*-[a-z0-9-]+$/),
     module: z.string().regex(/^\/ui\/[^/]+\/[^/]+\.m?js$/),

package/dist/manifest/entry.d.ts

@@ -0,0 +1,5 @@
+import { type ExtensionPackage } from './manifest.schema.js';
+import { type ImagePartKind } from './primitives.schema.js';
+export type ImportModule = (file: string) => Promise<unknown>;
+export declare const createOf: (mod: unknown, file: string) => ((ctx: never) => unknown);
+export declare const loadCreate: <C>(dir: string, pkg: ExtensionPackage, part: ImagePartKind | "cli", importModule?: ImportModule) => Promise<(ctx: C) => unknown>;

package/dist/manifest/entry.js

@@ -0,0 +1,29 @@
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import {} from './manifest.schema.js';
+import { entryOf } from './parts.js';
+import {} from './primitives.schema.js';
+const importFile = (file) => import(pathToFileURL(file).href);
+export const createOf = (mod, file) => {
+    const create = mod?.create;
+    if (typeof create !== 'function')
+        throw new Error(`${file} does not export create(ctx)`);
+    return create;
+};
+// The entry itself missing (not a module it imports) means the package was never built.
+const notBuilt = (err, file) => {
+    const missing = err?.code === 'ERR_MODULE_NOT_FOUND';
+    const message = String(err?.message);
+    const named = [file, pathToFileURL(file).href].some((name) => message.includes(`'${name}'`));
+    if (!missing || !named)
+        return err;
+    return new Error(`${file} not found: build the package first (npm run build)`);
+};
+// The one way the kit reaches part code: import the part's entry, take its create(ctx).
+export const loadCreate = async (dir, pkg, part, importModule = importFile) => {
+    const file = join(dir, entryOf(pkg, part));
+    const mod = await importModule(file).catch((err) => {
+        throw notBuilt(err, file);
+    });
+    return createOf(mod, file);
+};

package/dist/manifest/parts.d.ts

@@ -9,3 +9,4 @@ export interface NormalizedParts {
 export declare const normalizeParts: (parts: Parts) => NormalizedParts;
 export declare const imageParts: (pkg: ExtensionPackage) => ImagePartKind[];
 export declare const entryOf: (pkg: ExtensionPackage, part: ImagePartKind | "cli") => string;
+export declare const hasPostgres: (pkg: ExtensionPackage) => boolean;

package/dist/manifest/parts.js

@@ -22,3 +22,4 @@ export const imageParts = (pkg) => {
     return IMAGE_PART_KINDS.filter((kind) => code[kind] !== undefined);
 };
 export const entryOf = (pkg, part) => normalizeParts(pkg.agentage.parts).code[part]?.entry ?? `./dist/${part}/index.js`;
+export const hasPostgres = (pkg) => normalizeParts(pkg.agentage.parts).store === 'postgres';

package/dist/mcp/mcp-app.js

@@ -3,10 +3,11 @@ import { pipeline } from 'node:stream/promises';
 import cors from 'cors';
 import express, {} from 'express';
 import { createMcpHandler } from '@modelcontextprotocol/server';
+import { strongest } from '../auth/token-check.js';
 import { fail } from '../envelope/envelope.js';
 import { BODY_LIMIT, createPartApp, PUBLIC_CORS } from '../server/app.js';
 import { serverFactory } from './server.js';
-import {} from './tools.js';
+import { prefixed } from './tools.js';
 const MCP_HEADERS = ['Mcp-Protocol-Version', 'Mcp-Method', 'Mcp-Name', 'Accept'];
 const MCP_CORS = {
     ...PUBLIC_CORS,
@@ -20,7 +21,28 @@ const parsed = (body) => {
         return undefined;
     }
 };
-const isListing = (body) => (Array.isArray(body) ? body : [body]).some((message) => message?.method === 'tools/list');
+const messagesOf = (body) => (Array.isArray(body) ? body : [body]);
+const isListing = (body) => messagesOf(body).some((message) => message?.method === 'tools/list');
+// Each tools/call needs its tool's declared scope (read when it declares none).
+const callAccess = (options, body) => messagesOf(body)
+    .filter((message) => message?.method === 'tools/call')
+    .map((message) => {
+    const id = options.pkg.agentage.id;
+    const entry = options.tools.find((t) => prefixed(id, t.name) === message?.params?.name);
+    return entry?.spec.scope ?? 'read';
+});
+// Tokens off: calls stay anonymous and a closed listing refuses every tools/list (nothing can verify).
+const guard = async (options, req, body) => {
+    const listing = options.listing === 'token' && isListing(body) ? ['read'] : [];
+    const needed = [...listing, ...callAccess(options, body)];
+    if (!options.tokenCheck) {
+        if (listing.length > 0)
+            throw fail('UNAUTHORIZED', 'tools/list needs a token');
+        return;
+    }
+    if (needed.length > 0)
+        await options.tokenCheck(req.get('authorization'), strongest(needed));
+};
 const webRequest = (req, body) => {
     const headers = new Headers();
     for (const [key, value] of Object.entries(req.headers)) {
@@ -40,12 +62,10 @@ const send = async (response, res) => {
         return void res.end();
     await pipeline(Readable.fromWeb(response.body), res);
 };
-// The kit verifies no token yet, so a closed listing refuses every tools/list.
-const handle = (handler, listing) => async (req, res) => {
+const handle = (handler, options) => async (req, res) => {
     const body = Buffer.isBuffer(req.body) ? req.body : Buffer.alloc(0);
     const message = parsed(body);
-    if (listing === 'token' && isListing(message))
-        throw fail('UNAUTHORIZED', 'tools/list needs a token');
+    await guard(options, req, message);
     await send(await handler.fetch(webRequest(req, body), { parsedBody: message }), res);
 };
 const methodNotAllowed = (_req, res) => {
@@ -67,7 +87,7 @@ export const createMcpApp = (options) => {
         part: 'mcp',
         mount: (app) => {
             app.use('/mcp', cors(MCP_CORS));
-            app.post('/mcp', raw, handle(handler, options.listing));
+            app.post('/mcp', raw, handle(handler, options));
             app.all('/mcp', methodNotAllowed);
         },
     });

package/dist/mcp/server.js

@@ -1,15 +1,17 @@
 import { McpServer } from '@modelcontextprotocol/server';
+import { agcidOf } from '../agcid/agcid.js';
 import { currentAgcid } from '../agcid/current.js';
 import { fail, isFailure } from '../envelope/envelope.js';
 import {} from '../log/log.js';
 import { prefixed } from './tools.js';
 const text = (value) => [{ type: 'text', text: JSON.stringify(value) }];
 // A failed tool is isError with the REST error shape; anything unexpected is a generic INTERNAL.
+// Outside a request (no agcid in scope) the error still carries a valid one, minted here.
 const errorResult = (err, log) => {
     const failure = isFailure(err) ? err : fail('INTERNAL', 'Internal error');
     if (failure.status >= 500)
         log.error(err);
-    const error = { code: failure.code, message: failure.message, agcid: currentAgcid() ?? '' };
+    const error = { code: failure.code, message: failure.message, agcid: agcidOf(currentAgcid()) };
     return { isError: true, content: text({ error }), structuredContent: { error } };
 };
 const callback = (entry, log) => async (args) => {

package/dist/mcp/tools.d.ts

@@ -1,10 +1,12 @@
 import { type z } from 'zod';
+import { type Access } from '../auth/token-check.js';
 import { type PartContext } from '../context/context.js';
 type ObjectSchema = z.ZodObject;
 export interface ToolSpec<I extends ObjectSchema, O extends ObjectSchema> {
     description: string;
     input: I;
     output: O;
+    scope?: Access;
 }
 export type ToolHandler<I extends ObjectSchema, O extends ObjectSchema> = (args: z.output<I>) => z.input<O> | Promise<z.input<O>>;
 export type ToolRegistrar = <I extends ObjectSchema, O extends ObjectSchema>(name: string, spec: ToolSpec<I, O>, handler: ToolHandler<I, O>) => void;

package/dist/mcp/tools.js

@@ -1,6 +1,8 @@
 import {} from 'zod';
+import {} from '../auth/token-check.js';
 import {} from '../context/context.js';
 const TOOL_NAME = /^[a-z][a-z0-9_-]*$/;
+const SCOPES = ['public', 'read', 'write', 'admin'];
 export const createToolRegistry = () => {
     const tools = [];
     const tool = (name, spec, handler) => {
@@ -10,6 +12,8 @@ export const createToolRegistry = () => {
             throw new Error(`tool ${name} is registered twice`);
         if (!spec.description)
             throw new Error(`tool ${name} needs a description: it routes the model`);
+        if (spec.scope !== undefined && !SCOPES.includes(spec.scope))
+            throw new Error(`tool ${name} scope ${String(spec.scope)}: one of ${SCOPES.join(', ')}`);
         tools.push({ name, spec, handler: handler });
     };
     return { tool, tools };

package/dist/runtime/part-runners.d.ts

@@ -1,20 +1,20 @@
 import { type Express } from 'express';
 import { type PartContext } from '../context/context.js';
 import { type ExtensionPackage } from '../manifest/manifest.schema.js';
+import { type ImportModule } from '../manifest/entry.js';
 import { type ImagePartKind } from '../manifest/primitives.schema.js';
 import { type PartAppBase } from '../server/app.js';
+import { type Env } from './build-info.js';
 export interface RunnerInput {
     dir: string;
     pkg: ExtensionPackage;
-    ctx: PartContext;
+    env: Env;
+    ctx: () => PartContext;
     base: PartAppBase;
-    importModule?: (file: string) => Promise<unknown>;
+    importModule?: ImportModule;
 }
 export interface Running {
     app: Express;
     stop?: () => void;
 }
-type PartCreate = (ctx: never) => unknown;
-export declare const createOf: (mod: unknown, file: string) => PartCreate;
 export declare const RUNNERS: Record<ImagePartKind, (input: RunnerInput) => Promise<Running>>;
-export {};

package/dist/runtime/part-runners.js

@@ -1,57 +1,52 @@
 import { join } from 'node:path';
-import { pathToFileURL } from 'node:url';
 import {} from 'express';
 import {} from '../context/context.js';
 import { readOpenapi } from '../discovery/openapi.js';
 import {} from '../manifest/manifest.schema.js';
-import { entryOf, normalizeParts } from '../manifest/parts.js';
+import { loadCreate } from '../manifest/entry.js';
+import { hasPostgres } from '../manifest/parts.js';
 import {} from '../manifest/primitives.schema.js';
 import { createMcpApp } from '../mcp/mcp-app.js';
 import { createToolRegistry } from '../mcp/tools.js';
 import { createPagesApp } from '../pages/pages-app.js';
 import { createApiApp, createPartApp } from '../server/app.js';
 import {} from '../server/part.types.js';
+import {} from './build-info.js';
 import { createUiApp } from '../ui/ui-app.js';
 import { runLog } from '../worker/run-log.js';
 import { memoryRuns, storeRuns } from '../worker/runs.js';
 import { createScheduler } from '../worker/scheduler.js';
-const importFile = (file) => import(pathToFileURL(file).href);
-export const createOf = (mod, file) => {
-    const create = mod?.create;
-    if (typeof create !== 'function')
-        throw new Error(`${file} does not export create(ctx)`);
-    return create;
-};
-// Imports the part's entry and calls its create(ctx); ui has no code to run.
-const callCreate = async (input, part, ctx) => {
-    const file = join(input.dir, entryOf(input.pkg, part));
-    const mod = await (input.importModule ?? importFile)(file);
-    return createOf(mod, file)(ctx);
-};
+// ui has no code to run; every other part is its create(ctx).
+const callCreate = async (input, part, ctx) => (await loadCreate(input.dir, input.pkg, part, input.importModule))(ctx);
 const api = async (input) => {
-    const router = (await callCreate(input, 'api', input.ctx));
+    const router = (await callCreate(input, 'api', input.ctx()));
     const openapi = await readOpenapi(input.dir);
     return { app: createApiApp({ ...input.base, router, openapi }) };
 };
 const mcp = async (input) => {
     const registry = createToolRegistry();
-    await callCreate(input, 'mcp', { ...input.ctx, tool: registry.tool });
-    const listing = input.ctx.settings['mcp.listing'] === 'token' ? 'token' : 'open';
+    const ctx = input.ctx();
+    await callCreate(input, 'mcp', { ...ctx, tool: registry.tool });
+    const listing = ctx.settings['mcp.listing'] === 'token' ? 'token' : 'open';
     return { app: createMcpApp({ ...input.base, tools: registry.tools, listing }) };
 };
 const pages = async (input) => {
-    const site = (await callCreate(input, 'pages', input.ctx));
+    const site = (await callCreate(input, 'pages', input.ctx()));
     return { app: createPagesApp({ ...input.base, site }) };
 };
 const ui = async (input) => ({
-    app: createUiApp({ ...input.base, dir: join(input.dir, 'dist', 'ui') }),
+    app: createUiApp({
+        ...input.base,
+        dir: join(input.dir, 'dist', 'ui'),
+        devIssuer: input.env['AGENTAGE_DEV_ISSUER'],
+    }),
 });
 const worker = async (input) => {
-    const log = runLog(input.ctx.log);
-    const hasStore = normalizeParts(input.pkg.agentage.parts).store === 'postgres';
-    const runs = hasStore ? storeRuns(input.ctx.store) : memoryRuns();
+    const ctx = input.ctx();
+    const log = runLog(ctx.log);
+    const runs = hasPostgres(input.pkg) ? storeRuns(ctx.store) : memoryRuns();
     const scheduler = createScheduler({ runs, log });
-    await callCreate(input, 'worker', { ...input.ctx, log, schedule: scheduler.schedule });
+    await callCreate(input, 'worker', { ...ctx, log, schedule: scheduler.schedule });
     const checks = { ...input.base.checks, ...scheduler.checks() };
     scheduler.start();
     return {

package/dist/runtime/run-part.d.ts

@@ -1,15 +1,17 @@
 import { type Server } from 'node:http';
+import { type TokenCheck } from '../auth/token-check.js';
+import { type ImportModule } from '../manifest/entry.js';
 import { type ExtensionPackage } from '../manifest/manifest.schema.js';
 import { type ImagePartKind } from '../manifest/primitives.schema.js';
 import { type ServeOptions } from '../server/serve.js';
 import { type Env } from './build-info.js';
-export { createOf } from './part-runners.js';
 export interface RunPartOptions {
     dir: string;
     part: string;
     env: Env;
-    importModule?: (file: string) => Promise<unknown>;
+    importModule?: ImportModule;
     serve?: Pick<ServeOptions, 'signals' | 'exit'>;
+    tokenCheck?: TokenCheck;
 }
 export declare const partOf: (pkg: ExtensionPackage, part: string) => ImagePartKind;
 export declare const runPart: (options: RunPartOptions) => Promise<Server>;

package/dist/runtime/run-part.js

@@ -2,17 +2,19 @@ import {} from 'node:http';
 import { createContext } from '../context/context.js';
 import { settingsFromEnv } from '../context/settings.js';
 import { DEFAULT_RECORD_FILE, loadRecord } from '../discovery/discovery.js';
+import {} from '../auth/token-check.js';
 import {} from '../health/health.js';
 import { createLog } from '../log/log.js';
+import {} from '../manifest/entry.js';
 import {} from '../manifest/manifest.schema.js';
-import { imageParts, normalizeParts } from '../manifest/parts.js';
+import { hasPostgres, imageParts } from '../manifest/parts.js';
 import {} from '../manifest/primitives.schema.js';
 import { readManifest } from '../manifest/read-manifest.js';
 import { serve } from '../server/serve.js';
 import { createStore, storeCheck } from '../store/store.js';
+import {} from '../store/store.types.js';
 import { buildInfoFromEnv, portFromEnv } from './build-info.js';
 import { RUNNERS } from './part-runners.js';
-export { createOf } from './part-runners.js';
 const recordFor = async (env, log) => {
     const file = env['AGENTAGE_RECORD_FILE'] || DEFAULT_RECORD_FILE;
     const record = await loadRecord(file);
@@ -27,34 +29,47 @@ export const partOf = (pkg, part) => {
     return part;
 };
 // ui serves files and gets no ctx; every other part gets the store when the manifest has postgres.
-const storeFor = (pkg, part, env, log) => part !== 'ui' && normalizeParts(pkg.agentage.parts).store === 'postgres'
-    ? createStore(env, log)
-    : undefined;
-const inputFor = async (options, pkg, part, log) => {
-    const { env } = options;
-    const origin = env['AGENTAGE_ORIGIN'] || undefined;
-    const build = buildInfoFromEnv(env);
-    const store = storeFor(pkg, part, env, log);
-    const settings = settingsFromEnv(pkg, env, log);
-    const ctxOrigin = origin ?? `http://127.0.0.1:${portFromEnv(env)}`;
-    const ctxPart = (part === 'ui' ? 'pages' : part);
-    const ctx = createContext({
+const storeFor = ({ pkg, part, env, log }) => part !== 'ui' && hasPostgres(pkg) ? createStore(env, log) : undefined;
+const contextFor = (start, part, store) => createContext({
+    pkg: start.pkg,
+    part,
+    origin: start.env['AGENTAGE_ORIGIN'] || `http://127.0.0.1:${portFromEnv(start.env)}`,
+    commit: buildInfoFromEnv(start.env).commit,
+    log: start.log,
+    settings: settingsFromEnv(start.pkg, start.env, start.log),
+    store,
+});
+// Built on first use, so the ui runner, which never asks, has no ctx at all.
+const lazyContext = (start, store) => {
+    let ctx;
+    return () => {
+        if (start.part === 'ui')
+            throw new Error('the ui part gets no ctx');
+        return (ctx ??= contextFor(start, start.part, store));
+    };
+};
+const baseFor = async (options, start, store) => {
+    const { pkg, env, log } = start;
+    const checks = store ? { store: storeCheck(store) } : {};
+    return {
         pkg,
-        part: ctxPart,
-        origin: ctxOrigin,
-        commit: build.commit,
         log,
-        settings,
-        store,
-    });
-    const record = await recordFor(env, log);
-    const checks = store ? { store: storeCheck(store) } : {};
-    const base = { pkg, build, log, record, origin, ownImage: env['AGENTAGE_IMAGE'], checks };
+        checks,
+        build: buildInfoFromEnv(env),
+        record: await recordFor(env, log),
+        origin: env['AGENTAGE_ORIGIN'] || undefined,
+        ownImage: env['AGENTAGE_IMAGE'],
+        tokenCheck: options.tokenCheck,
+    };
+};
+const inputFor = async (options, start) => {
+    const store = storeFor(start);
     return {
         dir: options.dir,
-        pkg,
-        ctx,
-        base,
+        pkg: start.pkg,
+        env: start.env,
+        ctx: lazyContext(start, store),
+        base: await baseFor(options, start, store),
         importModule: options.importModule,
     };
 };
@@ -62,7 +77,8 @@ export const runPart = async (options) => {
     const pkg = await readManifest(options.dir);
     const part = partOf(pkg, options.part);
     const log = createLog({ extension: pkg.agentage.id, part });
-    const { app, stop } = await RUNNERS[part](await inputFor(options, pkg, part, log));
+    const start = { pkg, part, env: options.env, log };
+    const { app, stop } = await RUNNERS[part](await inputFor(options, start));
     if (stop)
         for (const signal of options.serve?.signals ?? ['SIGTERM', 'SIGINT'])
             process.once(signal, stop);

package/dist/server/app.d.ts

@@ -1,6 +1,7 @@
 import { type CorsOptions } from 'cors';
 import { type Express } from 'express';
 import { type HelmetOptions } from 'helmet';
+import { type TokenCheck } from '../auth/token-check.js';
 import { type BuildInfo } from '../discovery/discovery.js';
 import { type ExtensionRecord } from '../discovery/discovery.schema.js';
 import { type HealthCheck } from '../health/health.js';
@@ -16,6 +17,7 @@ export interface PartAppBase {
     ownImage?: string;
     origin?: string;
     checks?: Record<string, HealthCheck>;
+    tokenCheck?: TokenCheck;
 }
 export interface PartAppOptions extends PartAppBase {
     part: ImagePartKind;