@agentage/extension 0.3.0 → 0.3.1

package/dist/auth/part-auth.d.ts

@@ -10,7 +10,7 @@ export declare const partAuth: (env: Env, id: string, log: Log, scopes: string[]
         bearer_methods_supported: string[];
     };
     checks: {
-        auth: import("../health/health.js").HealthCheck;
+        auth: () => Promise<"ok" | "degraded" | "unavailable">;
     };
 }>;
 export declare const declaredScopes: (id: string, openapi: Record<string, unknown> | null, tools?: readonly {

package/dist/auth/part-auth.js

@@ -30,16 +30,19 @@ const settingsOf = (env) => {
     const { origin, hostname } = new URL(parsed.data.AGENTAGE_ORIGIN);
     if (!covers(audience, hostname))
         throw new Error(`the host ${hostname} is not under the audience ${audience}`);
+    if (origin.startsWith('https:') && !issuer.startsWith('https:'))
+        throw new Error(`the issuer ${issuer} is not https under the origin ${origin}`);
     return { issuer, audience, origin };
 };
-// Keys and revoked list read once before the part serves; an issuer down at start is no stop.
+// Read before serving, then every 30 s (keys only while none held); no stop on a dead issuer.
 export const partAuth = async (env, id, log, scopes) => {
     const { issuer, audience, origin } = settingsOf(env);
-    const { keys, read } = remoteKeys(issuer);
+    const { keys, read, held } = remoteKeys(issuer);
     const revoked = createRevokedList(issuer, log);
     const unread = (err) => log.warn('key set not read', { reason: messageOf(err) });
-    await Promise.all([read().catch(unread), revoked.refresh()]);
-    setInterval(() => void revoked.refresh(), REVOKED_POLL_MS).unref();
+    const poll = () => Promise.all([held() || read().catch(unread), revoked.refresh()]);
+    await poll();
+    setInterval(() => void poll(), REVOKED_POLL_MS).unref();
     return {
         tokenCheck: createTokenCheck({ issuer, audience, id, origin, keys, revoked }),
         resource: {
@@ -48,7 +51,7 @@ export const partAuth = async (env, id, log, scopes) => {
             scopes_supported: scopes,
             bearer_methods_supported: ['header'],
         },
-        checks: { auth: revoked.check },
+        checks: { auth: async () => (held() ? revoked.check() : 'degraded') },
     };
 };
 export const declaredScopes = (id, openapi, tools = []) => {

package/dist/auth/verify-token.d.ts

@@ -14,5 +14,6 @@ export interface TokenCheckDeps {
 export declare const remoteKeys: (issuer: string) => {
     keys: JWTVerifyGetKey<Uint8Array<ArrayBufferLike> | import("node:crypto").webcrypto.CryptoKey>;
     read: () => Promise<void>;
+    held: () => boolean;
 };
 export declare const createTokenCheck: (deps: TokenCheckDeps) => TokenCheck;

package/dist/auth/verify-token.js

@@ -33,7 +33,8 @@ export const remoteKeys = (issuer) => {
         timeoutDuration: 3000,
         cacheMaxAge: Infinity,
     });
-    return { keys: keysOrOutage(set), read: () => retryOnce(set.reload) };
+    const held = () => set.jwks() !== undefined;
+    return { keys: keysOrOutage(set), read: () => retryOnce(set.reload), held };
 };
 const claimsOf = async (authorization, deps) => {
     const [scheme = '', credential = '', ...rest] = authorization.split(' ');

package/dist/discovery/discovery.js

@@ -13,7 +13,7 @@ const partsOf = (pkg, images, migrations) => {
         parts['store'] = migrations === undefined ? { kind: store } : { kind: store, migrations };
     return parts;
 };
-// From the manifest, the build, the images by digest and what the code serves; OpenAPI comes later.
+// From the manifest, the build, the images by digest and what the code serves.
 export const recordOf = (pkg, build, images, extras = {}) => {
     const { id, commands } = pkg.agentage;
     const { commit, buildTime } = build;

package/dist/mcp/server.js

@@ -5,8 +5,7 @@ import { fail, isFailure } from '../envelope/envelope.js';
 import {} from '../log/log.js';
 import { prefixed } from './tools.js';
 const text = (value) => [{ type: 'text', text: value }];
-// A failed tool is isError with the REST error shape; anything unexpected is a generic INTERNAL.
-// Outside a request (no agcid in scope) the error still carries a valid one, minted here.
+// A failed tool: isError, the REST error shape, an agcid (minted outside a request); else INTERNAL.
 const errorResult = (err, log) => {
     const failure = isFailure(err) ? err : fail('INTERNAL', 'Internal error');
     if (failure.status >= 500)

package/dist/store/migrate.js

@@ -5,8 +5,7 @@ import { migrate } from './migrations.js';
 import { createStore } from './store.js';
 // A migration may rewrite a table: minutes, not a request's seconds; the job itself has no retry.
 const MIGRATE_TIMEOUTS = { connectMs: 10_000, statementMs: 300_000 };
-// The api image's migrate entry (`node dist/store/migrate.js` in /app), run as a job before a rollout.
-// Until the manifest is read the id is unknown; every line after it carries the extension.
+// The api image's migrate job (`node dist/store/migrate.js`); lines before the manifest read 'unknown'.
 let log = createLog({ extension: 'unknown', part: 'migrate' });
 try {
     const pkg = await readManifest(process.cwd());

package/dist/testing/test-server.js

@@ -12,7 +12,7 @@ const TEST_BUILD = { commit: '0'.repeat(40), buildTime: '2026-01-01T00:00:00Z' }
 const testPackage = (ctx, parts) => ({
     name: `@agentage/extension-${ctx.extension.id}`,
     version: ctx.extension.version,
-    engines: { agentage: '^0.2.0' },
+    engines: { agentage: '^0.3.0' },
     agentage: { id: ctx.extension.id, parts },
 });
 const startOn = async (app) => {

package/dist/tool/up/compose.js

@@ -9,11 +9,11 @@ const ISSUER_ENTRY = 'node_modules/@agentage/extension/dist/tool/up/dev-issuer.j
 // A local-only credential: the store has no published port, only the parts' network reaches it.
 const STORE_PASSWORD = 'agentage-local';
 const storeUrl = (id) => `postgres://${id}:${STORE_PASSWORD}@store:5432/${id}`;
-const TOKENS = { AGENTAGE_ISSUER: UP_ISSUER, AGENTAGE_AUDIENCE: DEV_AUDIENCE };
 // Only the ui under `up` names the dev issuer: its CSP then lets the harness ask it for a token.
 const partEnv = (pkg, part) => ({
     AGENTAGE_ORIGIN: `http://localhost:${GATEWAY_PORT}`,
-    ...TOKENS,
+    AGENTAGE_ISSUER: UP_ISSUER,
+    AGENTAGE_AUDIENCE: DEV_AUDIENCE,
     AGENTAGE_RECORD_FILE: RECORD_TARGET,
     ...(hasPostgres(pkg) && part !== 'ui' ? { AGENTAGE_STORE_URL: storeUrl(pkg.agentage.id) } : {}),
     ...(part === 'ui' ? { AGENTAGE_DEV_ISSUER: DEV_ISSUER } : {}),
@@ -23,10 +23,7 @@ const storeService = (id) => ({
     image: STORE_IMAGE,
     environment: { POSTGRES_USER: id, POSTGRES_PASSWORD: STORE_PASSWORD, POSTGRES_DB: id },
     volumes: ['store:/var/lib/postgresql'],
-    healthcheck: {
-        test: ['CMD-SHELL', `pg_isready -U ${id} -d ${id}`],
-        ...QUICK_CHECK,
-    },
+    healthcheck: { test: ['CMD-SHELL', `pg_isready -U ${id} -d ${id}`], ...QUICK_CHECK },
 });
 const HEALTHY = { condition: 'service_healthy' };
 // api and mcp read the issuer's keys and revoked list before they serve.
@@ -34,30 +31,26 @@ const dependsOn = (pkg, part) => ({
     ...(hasPostgres(pkg) && part !== 'ui' ? { store: HEALTHY } : {}),
     ...(part === 'api' || part === 'mcp' ? { issuer: HEALTHY } : {}),
 });
-const partService = (input, part) => {
-    const depends_on = dependsOn(input.pkg, part);
-    return {
-        image: input.tags[part],
-        environment: partEnv(input.pkg, part),
-        volumes: [`${input.recordFile}:${RECORD_TARGET}:ro`],
-        ...(Object.keys(depends_on).length > 0 ? { depends_on } : {}),
-    };
-};
+const partService = (input, part) => ({
+    image: input.tags[part],
+    environment: partEnv(input.pkg, part),
+    volumes: [`${input.recordFile}:${RECORD_TARGET}:ro`],
+    depends_on: dependsOn(input.pkg, part),
+});
 const fixedServices = (input, anyImage) => ({
     gateway: {
         image: TRAEFIK_IMAGE,
         command: TRAEFIK_COMMAND,
         ports: [`127.0.0.1:${GATEWAY_PORT}:80`],
         volumes: [`${input.gatewayFile}:/etc/traefik/dynamic.yml:ro`],
-        healthcheck: {
-            test: ['CMD', 'wget', '-qO-', 'http://127.0.0.1:8082/ping'],
-            ...QUICK_CHECK,
-        },
+        healthcheck: { test: ['CMD', 'wget', '-qO-', 'http://127.0.0.1:8082/ping'], ...QUICK_CHECK },
     },
     issuer: {
         image: anyImage,
         command: ['node', ISSUER_ENTRY],
         ports: [`127.0.0.1:${ISSUER_PORT}:${PART_PORT}`],
+        healthcheck: { start_period: '15s', start_interval: '1s' }, // the image's test, each second
+        init: true, // node as PID 1 ignores SIGTERM: without it every stop waits 10 s
     },
 });
 const migrateService = (input) => ({

package/dist/tool/up/dev-issuer-app.js

@@ -81,9 +81,8 @@ const revokedList = ({ revoked }) => {
 const ORIGINS = ['localhost', '127.0.0.1'].map((host) => `http://${host}:${GATEWAY_PORT}`);
 const allowed = ({ settings }, req) => {
     const host = (req.headers.host ?? '').replace(/:[0-9]+$/, '');
-    const origin = req.headers.origin;
     const hosts = ['localhost', '127.0.0.1', new URL(settings.issuer).hostname];
-    return hosts.includes(host) && (origin === undefined || ORIGINS.includes(origin));
+    return hosts.includes(host) && [undefined, ...ORIGINS].includes(req.headers.origin);
 };
 const route = (issuer, req, res) => {
     const at = `${req.method ?? ''} ${(req.url ?? '/').split('?')[0] ?? ''}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentage/extension",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "The agentage extension kit: create(ctx) per part (pages, ui, api, mcp, worker, cli), the store, /health, discovery, the envelope, and the build tool with up and token",
   "type": "module",
   "license": "MIT",