@byok-sdk/server 0.6.1 → 0.7.0

package/dist/index.js

@@ -5,7 +5,7 @@ import { mkdir, writeFile, readFile } from 'fs/promises';
 import { mkdtempSync, mkdirSync, existsSync, chmodSync } from 'fs';
 import { tmpdir } from 'os';
 import path, { dirname } from 'path';
-import { CAPABILITY_FLAGS, byokBlobContentPath, canTransition, PROTOCOL_VERSION, encodeEnvelope, DAEMON_TO_SERVER_TYPES, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, AgentRefSchema, AgentEgressPolicySchema, DispatchSelectionSchema, RequiredToolsetsSchema, AgentContentReadPayloadSchema, createEnvelope, TASK_STATES, BYOK_PAIR_PATH, PairRequestSchema, BYOK_CHALLENGE_PATH, ChallengeRequestSchema, BYOK_TOKEN_PATH, TokenRequestSchema, BYOK_BLOBS_PATH, CreateBlobRequestSchema, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BLOB_CONTENT_ROUTE, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendRequestSchema, AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, decodeEnvelope, BYOK_WS_PATH } from '@byok-sdk/protocol';
+import { CAPABILITY_FLAGS, byokBlobContentPath, canTransition, PROTOCOL_VERSION, encodeEnvelope, DAEMON_TO_SERVER_TYPES, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, AgentRefSchema, AgentEgressPolicySchema, DispatchSelectionSchema, RequiredToolsetsSchema, AgentContentReadPayloadSchema, createEnvelope, TASK_STATES, BYOK_PAIR_PATH, PairRequestSchema, PairResponseSchema, BYOK_CHALLENGE_PATH, ChallengeRequestSchema, BYOK_TOKEN_PATH, TokenRequestSchema, BYOK_BLOBS_PATH, CreateBlobRequestSchema, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BLOB_CONTENT_ROUTE, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendRequestSchema, AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, PairResponseTenantIdSchema, decodeEnvelope, BYOK_WS_PATH } from '@byok-sdk/protocol';
 import { Hono } from 'hono';
 import { WebSocketServer } from 'ws';
 import { createRequire } from 'module';
@@ -266,8 +266,6 @@ function generateDeviceId() {
 function generateTaskId() {
   return `task_${randomUUID()}`;
 }
-
-// src/pairing.ts
 var PAIRING_CODE_TTL_MS = 10 * 60 * 1e3;
 var PairingCodeInvalidError = class extends Error {
   constructor(reason) {
@@ -320,13 +318,14 @@ function validatePairingCodeClaims(claims) {
     throw new TypeError("createPairingCode requires { tenantId, productId } claims");
   }
   const { tenantId, productId } = claims;
-  if (typeof tenantId !== "string" || tenantId.length === 0) {
-    throw new TypeError("createPairingCode requires a non-empty tenantId");
+  const tenantResult = PairResponseTenantIdSchema.safeParse(tenantId);
+  if (!tenantResult.success) {
+    throw new TypeError("createPairingCode requires a valid bounded tenantId");
   }
   if (typeof productId !== "string" || productId.length === 0) {
     throw new TypeError("createPairingCode requires a non-empty productId");
   }
-  return { tenantId, productId };
+  return { tenantId: tenantResult.data, productId };
 }
 
 // src/http.ts
@@ -366,12 +365,21 @@ function buildHonoApp(deps) {
       deviceName,
       devicePublicKey
     });
+    const device = deps.devices.get(claims.tenantId, deviceId);
+    if (device === void 0) {
+      throw new Error("paired device row was not persisted");
+    }
     const { accessToken, expiresAt } = await mintAccessToken(deps.tokenSigner, {
-      deviceId,
-      tenantId: claims.tenantId,
-      productId: claims.productId
+      deviceId: device.deviceId,
+      tenantId: device.tenantId,
+      productId: device.productId
+    });
+    const response = PairResponseSchema.parse({
+      deviceId: device.deviceId,
+      accessToken,
+      refreshHint: expiresAt,
+      tenantId: device.tenantId
     });
-    const response = { deviceId, accessToken, refreshHint: expiresAt };
     return c.json(response, 200);
   });
   app.post(BYOK_CHALLENGE_PATH, async (c) => {