@agentage/extension 0.2.0 → 0.3.0

package/dist/tool/build.d.ts

@@ -33,6 +33,4 @@ export interface BuildResult {
 }
 export declare const imageTag: (registry: string, pkg: ExtensionPackage, part: ImagePartKind) => string;
 export declare const recordFor: (dir: string, pkg: ExtensionPackage, info: BuildInfo, images: BuiltImage[]) => Promise<ExtensionRecord>;
-declare const writeRecord: (dir: string, record: ExtensionRecord, file?: string) => Promise<string>;
 export declare const build: (options?: BuildOptions, deps?: BuildDeps) => Promise<BuildResult>;
-export { writeRecord };

package/dist/tool/build.js

@@ -8,17 +8,19 @@ import {} from '../manifest/primitives.schema.js';
 import { readManifest } from '../manifest/read-manifest.js';
 import {} from '../runtime/build-info.js';
 import { resolveBuildInfo } from './build-info.js';
+import { assertConforms } from './check.js';
 import { createDocker } from './docker.js';
 import { mustRun, runCommand } from './exec.js';
 import { labelsOf } from './labels.js';
 import { recordExtras } from './record-extras.js';
 import { RECORD_FILE, stageContext } from './stage.js';
+import { TIMEOUTS } from './timeouts.js';
 export const DEFAULT_REGISTRY = 'ghcr.io/agentage';
 export const imageTag = (registry, pkg, part) => `${registry}/${pkg.agentage.id}-${part}:${pkg.version}`;
 const compile = async (dir, pkg, run) => {
     const scripts = pkg.scripts;
     if (typeof scripts?.['build'] === 'string')
-        await mustRun(run, 'npm', ['run', 'build'], { cwd: dir });
+        await mustRun(run, 'npm', ['run', 'build'], { cwd: dir, timeoutMs: TIMEOUTS.compile });
 };
 const buildImage = async (job, docker, tmpRoot) => {
     const context = await stageContext(job.dir, job.pkg, job.part, tmpRoot);
@@ -60,16 +62,16 @@ const buildParts = async (base, options, deps) => {
     }
     return images;
 };
-// Validate, compile, one image per part from the kit recipe; --push pushes and writes the record.
+// Validate, compile, check, one image per part from the kit recipe; --push pushes, writes the record.
 export const build = async (options = {}, deps = { run: runCommand }) => {
     const dir = resolve(options.dir ?? '.');
     const pkg = await readManifest(dir);
     const info = await resolveBuildInfo(dir, options.env ?? process.env, deps.run);
     await compile(dir, pkg, deps.run);
+    await assertConforms({ dir, pkg });
     const images = await buildParts({ dir, pkg, info }, options, deps);
     const result = { id: pkg.agentage.id, version: pkg.version, ...info, images };
     if (!options.push)
         return result;
     return { ...result, recordFile: await writeRecord(dir, await recordFor(dir, pkg, info, images)) };
 };
-export { writeRecord };

package/dist/tool/check.d.ts

@@ -0,0 +1,16 @@
+import { type ExtensionPackage } from '../manifest/manifest.schema.js';
+export interface CheckInput {
+    dir: string;
+    pkg: ExtensionPackage;
+}
+export interface CheckRule {
+    name: string;
+    run(input: CheckInput): Promise<string[]>;
+}
+export interface CheckProblem {
+    rule: string;
+    problem: string;
+}
+export declare const RULES: readonly CheckRule[];
+export declare const check: (input: CheckInput, rules?: readonly CheckRule[]) => Promise<CheckProblem[]>;
+export declare const assertConforms: (input: CheckInput, rules?: readonly CheckRule[]) => Promise<void>;

package/dist/tool/check.js

@@ -0,0 +1,30 @@
+import { checkCli } from '../command/check-cli.js';
+import {} from '../manifest/manifest.schema.js';
+import { imageParts, normalizeParts } from '../manifest/parts.js';
+import { assertBuilt } from './stage.js';
+const problemsOf = (work) => work.then(() => [], (err) => [err.message]);
+// Every image part built where its image looks for it; the cli handlers are exactly the commands.
+const entries = {
+    name: 'entries',
+    run: async ({ dir, pkg }) => {
+        const built = imageParts(pkg).map((part) => problemsOf(assertBuilt(dir, pkg, part)));
+        const cli = normalizeParts(pkg.agentage.parts).code.cli ? await checkCli(dir) : null;
+        return [...(await Promise.all(built)).flat(), ...(cli ? [`cli part: ${cli}`] : [])];
+    },
+};
+// Kit 0.2 has the entries rule; M4 adds manifest, surface, stack, store and sealing beside it.
+export const RULES = [entries];
+export const check = async (input, rules = RULES) => {
+    const found = [];
+    for (const rule of rules)
+        for (const problem of await rule.run(input))
+            found.push({ rule: rule.name, problem });
+    return found;
+};
+// What build runs after the compile and before any image: one failure stops everything.
+export const assertConforms = async (input, rules = RULES) => {
+    const problems = await check(input, rules);
+    if (problems.length === 0)
+        return;
+    throw new Error(`check failed: ${problems.map((p) => `${p.rule}: ${p.problem}`).join('; ')}`);
+};

package/dist/tool/docker.js

@@ -1,4 +1,5 @@
 import { mustRun } from './exec.js';
+import { TIMEOUTS } from './timeouts.js';
 const PLATFORM = 'linux/amd64';
 const flags = (flag, values) => Object.entries(values).flatMap(([key, value]) => [flag, `${key}=${value}`]);
 // No provenance attestation: the pushed digest is then the image itself, as the record expects.
@@ -21,7 +22,7 @@ export const digestOf = (pushOutput) => {
 };
 export const createDocker = (run) => ({
     build: async (options) => {
-        await mustRun(run, 'docker', buildArgsOf(options));
+        await mustRun(run, 'docker', buildArgsOf(options), { timeoutMs: TIMEOUTS.build });
     },
-    push: async (tag) => digestOf(await mustRun(run, 'docker', ['push', tag], { echo: true })),
+    push: async (tag) => digestOf(await mustRun(run, 'docker', ['push', tag], { echo: true, timeoutMs: TIMEOUTS.push })),
 });

package/dist/tool/exec.d.ts

@@ -3,6 +3,7 @@ export interface RunOptions {
     echo?: boolean;
     quiet?: boolean;
     env?: Record<string, string | undefined>;
+    timeoutMs?: number;
 }
 export interface RunResult {
     code: number;

package/dist/tool/exec.js

@@ -1,24 +1,51 @@
 import { spawn } from 'node:child_process';
 import {} from 'node:stream';
-// stdout is captured (and echoed to stderr with `echo`); stderr streams through as progress.
-export const runCommand = (command, args, options = {}) => new Promise((resolve, reject) => {
-    const stdio = ['ignore', 'pipe', options.quiet ? 'pipe' : 'inherit'];
-    const env = options.env ? { ...process.env, ...options.env } : process.env;
-    const child = spawn(command, args, {
-        cwd: options.cwd,
-        stdio: [...stdio],
-        env,
-    });
-    let stdout = '';
-    let stderr = '';
+import { KILL_GRACE_MS, TIMEOUTS } from './timeouts.js';
+const spawnFor = (command, args, options) => spawn(command, args, {
+    cwd: options.cwd,
+    stdio: ['ignore', 'pipe', options.quiet ? 'pipe' : 'inherit'],
+    env: options.env ? { ...process.env, ...options.env } : process.env,
+});
+// Resolves true once the command is past its time and has been told to stop.
+const expiry = (child, ms) => {
+    let timer;
+    const expired = { value: false };
+    timer = setTimeout(() => {
+        expired.value = true;
+        child.kill('SIGTERM');
+        timer = setTimeout(() => child.kill('SIGKILL'), KILL_GRACE_MS).unref();
+    }, ms).unref();
+    return { expired, clear: () => clearTimeout(timer) };
+};
+const timedOut = (command, args, ms) => new Error(`${command} ${args[0] ?? ''} did not finish in ${Math.round(ms / 1000)} s`);
+// stdout is captured (and echoed to stderr with `echo`); a piped stderr is captured too.
+const collect = (child, echo) => {
+    const out = { stdout: '', stderr: '' };
     child.stdout.on('data', (chunk) => {
-        stdout += chunk.toString();
-        if (options.echo)
+        out.stdout += chunk.toString();
+        if (echo)
             process.stderr.write(chunk);
     });
-    child.stderr?.on('data', (chunk) => void (stderr += chunk.toString()));
-    child.on('error', (err) => reject(err.code === 'ENOENT' ? new Error(`${command} is not installed or not on PATH`) : err));
-    child.on('close', (code) => resolve({ code: code ?? 1, stdout, ...(options.quiet ? { stderr } : {}) }));
+    child.stderr?.on('data', (chunk) => void (out.stderr += chunk.toString()));
+    return out;
+};
+// stderr streams through as progress unless `quiet`; past its timeout the command is killed.
+export const runCommand = (command, args, options = {}) => new Promise((resolve, reject) => {
+    const child = spawnFor(command, args, options);
+    const ms = options.timeoutMs ?? TIMEOUTS.command;
+    const timer = expiry(child, ms);
+    const out = collect(child, options.echo);
+    child.on('error', (err) => {
+        timer.clear();
+        reject(err.code === 'ENOENT' ? new Error(`${command} is not installed or not on PATH`) : err);
+    });
+    child.on('close', (code) => {
+        timer.clear();
+        if (timer.expired.value)
+            return reject(timedOut(command, args, ms));
+        const stderr = options.quiet ? { stderr: out.stderr } : {};
+        resolve({ code: code ?? 1, stdout: out.stdout, ...stderr });
+    });
 });
 const tail = (text) => text ? `\n${text.trim().split('\n').slice(-15).join('\n')}` : '';
 export const mustRun = async (run, command, args, options) => {

package/dist/tool/main.js

@@ -1,4 +1,6 @@
 import { parseArgs } from 'node:util';
+import { UsageError } from '../command/args.js';
+import { EXIT_FAILED, EXIT_OK, EXIT_USAGE } from '../command/run-command.js';
 import { build } from './build.js';
 import { buildLines } from './format.js';
 import { down } from './up/down.js';
@@ -14,10 +16,10 @@ const USAGE = `usage: agentage-extension <build|up|down|token> [options]
   token      a dev token: --scope <id>:<verb> [--issuer <url>]
   --dir      the extension package folder (default: the current folder)`;
 const defaultDeps = {
-    build: (options) => build(options),
-    up: (options) => up(options),
-    down: (options) => down(options),
-    token: (options) => token(options),
+    build,
+    up,
+    down,
+    token,
     out: (line) => void process.stdout.write(`${line}\n`),
     err: (line) => void process.stderr.write(`${line}\n`),
 };
@@ -31,8 +33,6 @@ const OPTIONS = {
     help: { type: 'boolean', short: 'h' },
 };
 const parse = (argv) => parseArgs({ args: argv, allowPositionals: true, options: OPTIONS });
-class UsageError extends Error {
-}
 const COMMANDS = {
     build: async (v, deps) => {
         for (const line of buildLines(await deps.build({ push: v.push, dir: v.dir, registry: v.registry })))
@@ -49,34 +49,33 @@ const COMMANDS = {
 const runOne = async (name, values, deps) => {
     try {
         await COMMANDS[name]?.(values, deps);
-        return 0;
+        return EXIT_OK;
     }
     catch (err) {
-        deps.err(err instanceof UsageError
-            ? `${err.message}\n${USAGE}`
-            : `${name} failed: ${err.message}`);
-        return err instanceof UsageError ? 2 : 1;
+        const usage = err instanceof UsageError;
+        deps.err(usage ? `${err.message}\n${USAGE}` : `${name} failed: ${err.message}`);
+        return usage ? EXIT_USAGE : EXIT_FAILED;
     }
 };
-// Exit codes: 0 ok, 1 the step failed, 2 usage.
-export const main = async (argv, deps = defaultDeps) => {
-    let parsed;
+const parsedOrUsage = (argv, deps) => {
     try {
-        parsed = parse(argv);
+        return parse(argv);
     }
     catch (err) {
         deps.err(`${err.message}\n${USAGE}`);
-        return 2;
+        return null;
     }
+};
+// Exit codes: 0 ok, 1 the step failed, 2 usage.
+export const main = async (argv, deps = defaultDeps) => {
+    const parsed = parsedOrUsage(argv, deps);
+    if (!parsed)
+        return EXIT_USAGE;
     const { positionals, values } = parsed;
-    if (values.help) {
-        deps.out(USAGE);
-        return 0;
-    }
+    if (values.help)
+        return (deps.out(USAGE), EXIT_OK);
     const name = positionals[0] ?? '';
-    if (!(name in COMMANDS) || positionals.length !== 1) {
-        deps.err(USAGE);
-        return 2;
-    }
+    if (!(name in COMMANDS) || positionals.length !== 1)
+        return (deps.err(USAGE), EXIT_USAGE);
     return runOne(name, values, deps);
 };

package/dist/tool/record-extras.d.ts

@@ -1,4 +1,7 @@
 import { type RecordExtras } from '../discovery/discovery.js';
 import { type ExtensionPackage } from '../manifest/manifest.schema.js';
-export declare const toolNames: (dir: string, pkg: ExtensionPackage) => Promise<string[]>;
+export declare const toolsOf: (dir: string, pkg: ExtensionPackage) => Promise<{
+    name: string;
+    scope: string;
+}[]>;
 export declare const recordExtras: (dir: string, pkg: ExtensionPackage) => Promise<RecordExtras>;

package/dist/tool/record-extras.js

@@ -1,27 +1,27 @@
 import { join } from 'node:path';
-import { pathToFileURL } from 'node:url';
 import { z } from 'zod';
+import { scopeOf } from '../auth/token-check.js';
 import { createContext } from '../context/context.js';
 import {} from '../discovery/discovery.js';
+import { WidgetSchema } from '../discovery/discovery.schema.js';
 import { OPENAPI_PATH, readOpenapi } from '../discovery/openapi.js';
 import { createLog } from '../log/log.js';
+import { loadCreate } from '../manifest/entry.js';
 import { readJsonIfExists } from '../manifest/read-manifest.js';
 import {} from '../manifest/manifest.schema.js';
-import { entryOf, normalizeParts } from '../manifest/parts.js';
+import { hasPostgres, normalizeParts } from '../manifest/parts.js';
 import { createToolRegistry, prefixed } from '../mcp/tools.js';
 import { sqlFiles } from '../store/migrations.js';
 import {} from '../store/store.types.js';
-const WidgetsSchema = z
-    .array(z.strictObject({ name: z.string(), element: z.string(), module: z.string() }))
-    .min(1);
+const WidgetsSchema = z.array(WidgetSchema).min(1);
 const noStore = {
     query: async () => {
         throw new Error('the store is not open while the build lists tools');
     },
 };
 const silent = createLog({ extension: 'build', part: 'mcp' }, () => undefined);
-// The tool names the mcp part registers, read by running its create(ctx) with a recording ctx.
-export const toolNames = async (dir, pkg) => {
+// The tools the mcp part registers and their scopes, read by running its create(ctx) on a recorder.
+export const toolsOf = async (dir, pkg) => {
     const registry = createToolRegistry();
     const base = createContext({
         pkg,
@@ -31,11 +31,12 @@ export const toolNames = async (dir, pkg) => {
         log: silent,
         store: noStore,
     });
-    const mod = (await import(pathToFileURL(join(dir, entryOf(pkg, 'mcp'))).href));
-    if (typeof mod.create !== 'function')
-        throw new Error('the mcp entry does not export create(ctx)');
-    await mod.create({ ...base, tool: registry.tool });
-    return registry.tools.map((tool) => prefixed(pkg.agentage.id, tool.name));
+    await (await loadCreate(dir, pkg, 'mcp'))({ ...base, tool: registry.tool });
+    const { id } = pkg.agentage;
+    return registry.tools.map((tool) => ({
+        name: prefixed(id, tool.name),
+        scope: scopeOf(id, tool.spec.scope),
+    }));
 };
 const widgetsOf = async (dir) => {
     const value = await readJsonIfExists(join(dir, 'dist', 'ui', 'widgets.json'));
@@ -43,10 +44,10 @@ const widgetsOf = async (dir) => {
 };
 // What the code serves, for the record: tools, widgets and the migration count.
 export const recordExtras = async (dir, pkg) => {
-    const { code, store } = normalizeParts(pkg.agentage.parts);
+    const { code } = normalizeParts(pkg.agentage.parts);
     const extras = {};
     if (code.mcp) {
-        const tools = await toolNames(dir, pkg);
+        const tools = await toolsOf(dir, pkg);
         if (tools.length > 0)
             extras.tools = tools;
     }
@@ -54,7 +55,7 @@ export const recordExtras = async (dir, pkg) => {
         extras.widgets = await widgetsOf(dir);
     if (code.api && (await readOpenapi(dir)))
         extras.openapi = OPENAPI_PATH;
-    if (store === 'postgres')
+    if (hasPostgres(pkg))
         extras.migrations = (await sqlFiles(join(dir, 'migrations'))).length;
     return extras;
 };

package/dist/tool/stage.d.ts

@@ -3,6 +3,7 @@ import { type ImagePartKind } from '../manifest/primitives.schema.js';
 export declare const RECORD_FILE = "agentage-extension.json";
 export declare const MIGRATE_SHIM = "// Generated by @agentage/extension build.\nimport '@agentage/extension/migrate';\n";
 export declare const localTarballs: (pkg: ExtensionPackage) => string[];
+export declare const exists: (path: string) => Promise<boolean>;
 export declare const appPaths: (dir: string, pkg: ExtensionPackage, part: ImagePartKind) => Promise<string[]>;
 export declare const assertBuilt: (dir: string, pkg: ExtensionPackage, part: ImagePartKind) => Promise<void>;
 export declare const stageContext: (dir: string, pkg: ExtensionPackage, part: ImagePartKind, tmpRoot?: string) => Promise<string>;

package/dist/tool/stage.js

@@ -2,7 +2,7 @@ import { access, cp, mkdir, mkdtemp, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { dirname, isAbsolute, join, normalize, sep } from 'node:path';
 import {} from '../manifest/manifest.schema.js';
-import { entryOf, normalizeParts } from '../manifest/parts.js';
+import { entryOf, hasPostgres } from '../manifest/parts.js';
 import {} from '../manifest/primitives.schema.js';
 import { OPENAPI_FILE } from '../discovery/openapi.js';
 import { serverPartRecipe } from './recipe.js';
@@ -25,7 +25,7 @@ export const localTarballs = (pkg) => dependencySpecs(pkg)
     }
     return path;
 });
-const exists = (path) => access(path).then(() => true, () => false);
+export const exists = (path) => access(path).then(() => true, () => false);
 const copyInto = async (from, to) => {
     await mkdir(dirname(to), { recursive: true });
     await cp(from, to, { recursive: true });
@@ -39,25 +39,23 @@ const copyDeps = async (dir, root, pkg) => {
     for (const path of localTarballs(pkg))
         await copyInto(join(dir, path), join(root, 'deps', path));
 };
-// What a part image carries: its own dist/{part}, the shared dist/lib, and for api the store files.
+// The api image runs the migrate job, so it alone carries the migrations; seeds never ship.
+const migrates = (pkg, part) => part === 'api' && hasPostgres(pkg);
+// What a part image carries: its own dist/{part}, the shared dist/lib, and for api the migrations.
 export const appPaths = async (dir, pkg, part) => {
     const paths = ['package.json', join('dist', part)];
     if (part === 'api' && (await exists(join(dir, OPENAPI_FILE))))
         paths.push(OPENAPI_FILE);
     if (await exists(join(dir, 'dist', 'lib')))
         paths.push(join('dist', 'lib'));
-    const postgres = normalizeParts(pkg.agentage.parts).store === 'postgres';
-    if (part === 'api' && postgres) {
-        for (const folder of ['migrations', 'seeds'])
-            if (await exists(join(dir, folder)))
-                paths.push(folder);
-    }
+    if (migrates(pkg, part) && (await exists(join(dir, 'migrations'))))
+        paths.push('migrations');
     return paths;
 };
 const copyApp = async (dir, root, pkg, part) => {
     for (const path of await appPaths(dir, pkg, part))
         await copyInto(join(dir, path), join(root, 'app', path));
-    if (part === 'api' && normalizeParts(pkg.agentage.parts).store === 'postgres') {
+    if (migrates(pkg, part)) {
         await mkdir(join(root, 'app', 'dist', 'store'), { recursive: true });
         await writeFile(join(root, 'app', 'dist', 'store', 'migrate.js'), MIGRATE_SHIM);
     }

package/dist/tool/timeouts.d.ts

@@ -0,0 +1,10 @@
+export declare const TIMEOUTS: {
+    readonly command: 120000;
+    readonly compile: 600000;
+    readonly build: 1200000;
+    readonly push: 600000;
+    readonly start: 600000;
+    readonly migrate: 300000;
+    readonly issuer: 5000;
+};
+export declare const KILL_GRACE_MS = 5000;

package/dist/tool/timeouts.js

@@ -0,0 +1,19 @@
+// Every outbound call the tool makes and its bound; none retries, since a re-run is safe.
+export const TIMEOUTS = {
+    // git rev-parse, docker image inspect, compose ps, logs and down, the port check
+    command: 120_000,
+    // the package's own npm run build
+    compile: 600_000,
+    // docker build: a cold cache pulls the node base image and runs npm ci
+    build: 1_200_000,
+    // docker push to the registry
+    push: 600_000,
+    // compose up: the store and gateway images are pulled on first use
+    start: 600_000,
+    // compose run migrate: the store's migrations and seeds
+    migrate: 300_000,
+    // POST /token to the dev issuer
+    issuer: 5_000,
+};
+// SIGTERM first; a command that ignores it is killed this long after.
+export const KILL_GRACE_MS = 5_000;

package/dist/tool/up/compose-run.d.ts

@@ -9,6 +9,7 @@ export interface ServiceState {
     health: string;
     exitCode: number;
 }
-export declare const compose: (run: Run, target: ComposeTarget, args: string[]) => Promise<string>;
+export declare const composeArgs: (target: ComposeTarget, args: string[]) => string[];
+export declare const compose: (run: Run, target: ComposeTarget, args: string[], timeoutMs?: number) => Promise<string>;
 export declare const parsePs: (stdout: string) => ServiceState[];
 export declare const states: (run: Run, target: ComposeTarget) => Promise<ServiceState[]>;

package/dist/tool/up/compose-run.js

@@ -1,11 +1,12 @@
 import { mustRun } from '../exec.js';
-export const compose = (run, target, args) => mustRun(run, 'docker', [
+export const composeArgs = (target, args) => [
     'compose',
     ...(target.file ? ['-f', target.file] : []),
     '-p',
     target.project,
     ...args,
-]);
+];
+export const compose = (run, target, args, timeoutMs) => mustRun(run, 'docker', composeArgs(target, args), { timeoutMs });
 // `compose ps --format json` prints one object per line (older releases: one array).
 export const parsePs = (stdout) => {
     const text = stdout.trim();

package/dist/tool/up/compose.d.ts

@@ -2,11 +2,12 @@ import { type ExtensionPackage } from '../../manifest/manifest.schema.js';
 export declare const STORE_IMAGE = "postgres:18-alpine";
 export interface ComposeInput {
     pkg: ExtensionPackage;
+    project: string;
     tags: Record<string, string>;
     recordFile: string;
     gatewayFile: string;
+    seedsDir?: string;
 }
-export declare const projectName: (pkg: ExtensionPackage) => string;
 export declare const composeFile: (input: ComposeInput) => {
     name: string;
     services: Record<string, unknown>;

package/dist/tool/up/compose.js

@@ -1,38 +1,48 @@
 import {} from '../../manifest/manifest.schema.js';
-import { imageParts, normalizeParts } from '../../manifest/parts.js';
+import { hasPostgres, imageParts } from '../../manifest/parts.js';
 import {} from '../../manifest/primitives.schema.js';
+import { DEV_AUDIENCE, DEV_ISSUER, UP_ISSUER } from './dev-issuer-app.js';
 import { GATEWAY_PORT, ISSUER_PORT, PART_PORT, TRAEFIK_COMMAND, TRAEFIK_IMAGE } from './gateway.js';
 export const STORE_IMAGE = 'postgres:18-alpine';
 const RECORD_TARGET = '/run/agentage/agentage-extension.json';
 const ISSUER_ENTRY = 'node_modules/@agentage/extension/dist/tool/up/dev-issuer.js';
-export const projectName = (pkg) => `agentage-${pkg.agentage.id}`;
 // A local-only credential: the store has no published port, only the parts' network reaches it.
-const storeUrl = (id) => `postgres://${id}:agentage-local@store:5432/${id}`;
-const hasStore = (pkg) => normalizeParts(pkg.agentage.parts).store === 'postgres';
+const STORE_PASSWORD = 'agentage-local';
+const storeUrl = (id) => `postgres://${id}:${STORE_PASSWORD}@store:5432/${id}`;
+const TOKENS = { AGENTAGE_ISSUER: UP_ISSUER, AGENTAGE_AUDIENCE: DEV_AUDIENCE };
+// Only the ui under `up` names the dev issuer: its CSP then lets the harness ask it for a token.
 const partEnv = (pkg, part) => ({
     AGENTAGE_ORIGIN: `http://localhost:${GATEWAY_PORT}`,
+    ...TOKENS,
     AGENTAGE_RECORD_FILE: RECORD_TARGET,
-    ...(hasStore(pkg) && part !== 'ui' ? { AGENTAGE_STORE_URL: storeUrl(pkg.agentage.id) } : {}),
+    ...(hasPostgres(pkg) && part !== 'ui' ? { AGENTAGE_STORE_URL: storeUrl(pkg.agentage.id) } : {}),
+    ...(part === 'ui' ? { AGENTAGE_DEV_ISSUER: DEV_ISSUER } : {}),
 });
+const QUICK_CHECK = { interval: '2s', timeout: '3s', retries: 30 };
 const storeService = (id) => ({
     image: STORE_IMAGE,
-    environment: { POSTGRES_USER: id, POSTGRES_PASSWORD: 'agentage-local', POSTGRES_DB: id },
+    environment: { POSTGRES_USER: id, POSTGRES_PASSWORD: STORE_PASSWORD, POSTGRES_DB: id },
     volumes: ['store:/var/lib/postgresql'],
     healthcheck: {
         test: ['CMD-SHELL', `pg_isready -U ${id} -d ${id}`],
-        interval: '2s',
-        timeout: '3s',
-        retries: 30,
+        ...QUICK_CHECK,
     },
 });
-const partService = (input, part) => ({
-    image: input.tags[part],
-    environment: partEnv(input.pkg, part),
-    volumes: [`${input.recordFile}:${RECORD_TARGET}:ro`],
-    ...(hasStore(input.pkg) && part !== 'ui'
-        ? { depends_on: { store: { condition: 'service_healthy' } } }
-        : {}),
+const HEALTHY = { condition: 'service_healthy' };
+// api and mcp read the issuer's keys and revoked list before they serve.
+const dependsOn = (pkg, part) => ({
+    ...(hasPostgres(pkg) && part !== 'ui' ? { store: HEALTHY } : {}),
+    ...(part === 'api' || part === 'mcp' ? { issuer: HEALTHY } : {}),
 });
+const partService = (input, part) => {
+    const depends_on = dependsOn(input.pkg, part);
+    return {
+        image: input.tags[part],
+        environment: partEnv(input.pkg, part),
+        volumes: [`${input.recordFile}:${RECORD_TARGET}:ro`],
+        ...(Object.keys(depends_on).length > 0 ? { depends_on } : {}),
+    };
+};
 const fixedServices = (input, anyImage) => ({
     gateway: {
         image: TRAEFIK_IMAGE,
@@ -41,9 +51,7 @@ const fixedServices = (input, anyImage) => ({
         volumes: [`${input.gatewayFile}:/etc/traefik/dynamic.yml:ro`],
         healthcheck: {
             test: ['CMD', 'wget', '-qO-', 'http://127.0.0.1:8082/ping'],
-            interval: '2s',
-            timeout: '3s',
-            retries: 30,
+            ...QUICK_CHECK,
         },
     },
     issuer: {
@@ -56,7 +64,8 @@ const migrateService = (input) => ({
     image: input.tags['api'],
     command: ['node', 'dist/store/migrate.js'],
     environment: partEnv(input.pkg, 'migrate'),
-    depends_on: { store: { condition: 'service_healthy' } },
+    ...(input.seedsDir ? { volumes: [`${input.seedsDir}:/app/seeds:ro`] } : {}),
+    depends_on: { store: HEALTHY },
     profiles: ['jobs'],
     restart: 'no',
 });
@@ -67,11 +76,11 @@ export const composeFile = (input) => {
     for (const part of parts)
         services[part] = partService(input, part);
     Object.assign(services, fixedServices(input, input.tags[parts[0] ?? 'api'] ?? ''));
-    if (hasStore(input.pkg)) {
+    if (hasPostgres(input.pkg)) {
         services['store'] = storeService(input.pkg.agentage.id);
         if (input.tags['api'])
             services['migrate'] = migrateService(input);
     }
-    const volumes = hasStore(input.pkg) ? { store: {} } : {};
-    return { name: projectName(input.pkg), services, volumes };
+    const volumes = hasPostgres(input.pkg) ? { store: {} } : {};
+    return { name: input.project, services, volumes };
 };

package/dist/tool/up/dev-issuer-app.d.ts

@@ -2,11 +2,17 @@ import { type KeyObject } from 'node:crypto';
 import { type Server } from 'node:http';
 import { z } from 'zod';
 export declare const DEV_ISSUER = "http://localhost:4281";
-export declare const DEV_AUDIENCE = "*.agentage.io";
+export declare const UP_ISSUER = "http://issuer:3000";
+export declare const DEV_AUDIENCE = "localhost";
+export type IssuerSettings = {
+    issuer: string;
+    audience: string;
+};
 declare const TokenRequestSchema: z.ZodObject<{
     scope: z.ZodString;
     sub: z.ZodOptional<z.ZodString>;
     ttlSeconds: z.ZodOptional<z.ZodInt>;
+    aud: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 interface Keys {
     kid: string;
@@ -14,9 +20,9 @@ interface Keys {
     jwk: Record<string, unknown>;
 }
 export declare const newKeys: () => Keys;
-export declare const mint: (keys: Keys, request: z.infer<typeof TokenRequestSchema>, now?: number) => {
+export declare const mint: (keys: Keys, request: z.infer<typeof TokenRequestSchema>, settings: IssuerSettings, now?: number) => {
     token: string;
     expiresAt: string;
 };
-export declare const createIssuer: (keys?: Keys) => Server;
+export declare const createIssuer: (settings?: IssuerSettings, keys?: Keys) => Server;
 export {};