@economic/agents 0.0.1 → 1.0.0

package/bin/cli.mjs

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import "../dist/cli.mjs";

package/dist/cli.d.mts

@@ -0,0 +1 @@
+export { };

package/dist/cli.mjs

@@ -0,0 +1,561 @@
+#!/usr/bin/env node
+import path from "node:path";
+import * as p from "@clack/prompts";
+import fs from "node:fs";
+//#region src/cli/utils.ts
+function toKebabCase(str) {
+	return str.replace(/([a-z])([A-Z])/g, "$1-$2").replace(/[\s_]+/g, "-").toLowerCase();
+}
+function toCamelCase(str) {
+	return str.replace(/[-_\s]+(.)?/g, (_, c) => c ? c.toUpperCase() : "").replace(/^./, (c) => c.toLowerCase());
+}
+function toSnakeCase(str) {
+	return str.replace(/([a-z])([A-Z])/g, "$1_$2").replace(/[-\s]+/g, "_").toLowerCase();
+}
+function ensureDir(dir) {
+	if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+}
+function writeFile(filePath, content) {
+	ensureDir(path.dirname(filePath));
+	fs.writeFileSync(filePath, content, "utf-8");
+}
+function fileExists(filePath) {
+	return fs.existsSync(filePath);
+}
+function findSkills(cwd) {
+	const skillsDir = path.join(cwd, "src", "skills");
+	if (!fs.existsSync(skillsDir)) return [];
+	return fs.readdirSync(skillsDir, { withFileTypes: true }).filter((dirent) => dirent.isDirectory()).map((dirent) => dirent.name);
+}
+function getSrcDir(cwd) {
+	return path.join(cwd, "src");
+}
+function readFile(filePath) {
+	return fs.readFileSync(filePath, "utf-8");
+}
+function globSync(dir, pattern, results = []) {
+	if (!fs.existsSync(dir)) return results;
+	const entries = fs.readdirSync(dir, { withFileTypes: true });
+	for (const entry of entries) {
+		const fullPath = path.join(dir, entry.name);
+		if (entry.isDirectory()) {
+			if (entry.name !== "node_modules") globSync(fullPath, pattern, results);
+		} else if (pattern.test(entry.name)) results.push(fullPath);
+	}
+	return results;
+}
+const IMPORT_PATTERN = /import\s+\{[^}]*\b(ChatAgentHarness|ChatAgent|Agent)\b[^}]*\}\s+from\s+["']@economic\/agents["']/;
+const CLASS_PATTERN = /class\s+(\w+)\s+extends\s+(ChatAgentHarness|ChatAgent|Agent)(?:<|[\s{])/;
+function parseAgentFromContent(content, filePath) {
+	const importMatch = content.match(IMPORT_PATTERN);
+	if (!importMatch) return null;
+	const importedClasses = importMatch[0];
+	const classMatch = content.match(CLASS_PATTERN);
+	if (!classMatch) return null;
+	const [, className, baseClass] = classMatch;
+	if (!importedClasses.includes(baseClass)) return null;
+	return {
+		path: filePath,
+		className,
+		baseClass
+	};
+}
+function findAgentFiles(cwd) {
+	const tsFiles = globSync(getSrcDir(cwd), /\.tsx?$/);
+	const agents = [];
+	for (const filePath of tsFiles) {
+		const agent = parseAgentFromContent(readFile(filePath), filePath);
+		if (agent) agents.push(agent);
+	}
+	return agents;
+}
+//#endregion
+//#region src/cli/templates/skill.ts
+function generateSkillTemplate(options) {
+	const { name, camelName, description, toolImports, toolNames } = options;
+	return `import type { Skill } from "@economic/agents";
+${toolImports.length > 0 ? toolImports.map((t) => `import { ${t} } from "./tools/${t}";`).join("\n") + "\n" : ""}
+export const ${camelName}Skill = {
+  name: "${name}",
+  description: "${description}",
+  guidance:
+    "TODO: Add guidance for the LLM on how to use this skill's tools. " +
+    "Describe the workflow, when to call each tool, and how to present results.",
+  tools: {
+${toolNames.length > 0 ? toolNames.map((t) => `    ${t},`).join("\n") : "    // Add your tools here"}
+  },
+} satisfies Skill;
+`;
+}
+//#endregion
+//#region src/cli/templates/tool.ts
+function generateToolTemplate(options) {
+	const { snakeName, description, useContext } = options;
+	if (useContext) return `import { tool } from "ai";
+import { z } from "zod";
+import type { AgentToolContext } from "@economic/agents";
+
+export const ${snakeName} = tool({
+  description: "${description}",
+  inputSchema: z.object({
+    // Add your input parameters here
+    // example: z.string().describe("Description of the parameter"),
+  }),
+  execute: async (input, { experimental_context }) => {
+    const ctx = experimental_context as AgentToolContext;
+
+    // Implement your tool logic here
+    return {
+      result: "TODO: implement ${snakeName}",
+    };
+  },
+});
+`;
+	return `import { tool } from "ai";
+import { z } from "zod";
+
+export const ${snakeName} = tool({
+  description: "${description}",
+  inputSchema: z.object({
+    // Add your input parameters here
+    // example: z.string().describe("Description of the parameter"),
+  }),
+  execute: async (input) => {
+    // Implement your tool logic here
+    return {
+      result: "TODO: implement ${snakeName}",
+    };
+  },
+});
+`;
+}
+//#endregion
+//#region src/cli/codegen.ts
+function addImport(content, importName, importPath) {
+	const importStatement = `import { ${importName} } from "${importPath}";`;
+	const lines = content.split("\n");
+	let lastRelativeImportIndex = -1;
+	for (let i = 0; i < lines.length; i++) {
+		const line = lines[i];
+		if (/^import\s+.*from\s+["']\.\//m.test(line)) lastRelativeImportIndex = i;
+	}
+	if (lastRelativeImportIndex === -1) {
+		for (let i = 0; i < lines.length; i++) if (/^import\s+/m.test(lines[i])) lastRelativeImportIndex = i;
+	}
+	if (lastRelativeImportIndex === -1) return importStatement + "\n" + content;
+	lines.splice(lastRelativeImportIndex + 1, 0, importStatement);
+	return lines.join("\n");
+}
+function hasComplexPattern(code) {
+	return /\.\.\./.test(code) || /\w+\s*\(/.test(code);
+}
+function addToArrayReturn(methodContent, itemName) {
+	const returnMatch = methodContent.match(/return\s*\[([^\]]*)\]/s);
+	if (!returnMatch) return null;
+	const [fullMatch, arrayContent] = returnMatch;
+	if (hasComplexPattern(arrayContent)) return null;
+	const trimmed = arrayContent.trim();
+	const newReturn = `return [${trimmed ? `${trimmed}, ${itemName}` : itemName}]`;
+	return methodContent.replace(fullMatch, newReturn);
+}
+function addToObjectReturn(methodContent, itemName) {
+	const returnMatch = methodContent.match(/return\s*\{([^}]*)\}/s);
+	if (!returnMatch) return null;
+	const [fullMatch, objectContent] = returnMatch;
+	if (hasComplexPattern(objectContent)) return null;
+	const trimmed = objectContent.trim();
+	const newReturn = `return {${trimmed ? `${trimmed}, ${itemName}` : ` ${itemName} `}}`;
+	return methodContent.replace(fullMatch, newReturn);
+}
+function findMethodBounds(content, methodName) {
+	const match = new RegExp(`(${methodName})\\s*\\([^)]*\\)\\s*(?::\\s*[^{]+)?\\s*\\{`, "g").exec(content);
+	if (!match) return null;
+	const start = match.index;
+	let braceCount = 0;
+	let inMethod = false;
+	let end = start;
+	for (let i = start; i < content.length; i++) if (content[i] === "{") {
+		braceCount++;
+		inMethod = true;
+	} else if (content[i] === "}") {
+		braceCount--;
+		if (inMethod && braceCount === 0) {
+			end = i + 1;
+			break;
+		}
+	}
+	return {
+		start,
+		end
+	};
+}
+function updateHarnessMethod(content, methodName, itemName) {
+	const bounds = findMethodBounds(content, methodName);
+	if (!bounds) return null;
+	const methodContent = content.slice(bounds.start, bounds.end);
+	let newMethodContent;
+	if (methodName === "getSkills") newMethodContent = addToArrayReturn(methodContent, itemName);
+	else newMethodContent = addToObjectReturn(methodContent, itemName);
+	if (!newMethodContent) return null;
+	return content.slice(0, bounds.start) + newMethodContent + content.slice(bounds.end);
+}
+function findClassEnd(content, className) {
+	const match = new RegExp(`class\\s+${className}\\s+extends`).exec(content);
+	if (!match) return null;
+	let braceCount = 0;
+	let inClass = false;
+	for (let i = match.index; i < content.length; i++) if (content[i] === "{") {
+		braceCount++;
+		inClass = true;
+	} else if (content[i] === "}") {
+		braceCount--;
+		if (inClass && braceCount === 0) return i;
+	}
+	return null;
+}
+function addMethodToClass(content, className, methodName, itemName) {
+	const classEnd = findClassEnd(content, className);
+	if (classEnd === null) return null;
+	let methodCode;
+	if (methodName === "getSkills") methodCode = `\n  ${methodName}() {\n    return [${itemName}];\n  }\n`;
+	else methodCode = `\n  ${methodName}() {\n    return { ${itemName} };\n  }\n`;
+	return content.slice(0, classEnd) + methodCode + content.slice(classEnd);
+}
+function updateBuildLLMParams(content, propertyName, itemName) {
+	const paramsMatch = content.match(/buildLLMParams\s*\(\s*\{/);
+	if (!paramsMatch) return null;
+	const paramsStart = paramsMatch.index;
+	let braceCount = 0;
+	let paramsEnd = paramsStart;
+	let inParams = false;
+	for (let i = paramsStart; i < content.length; i++) if (content[i] === "{") {
+		braceCount++;
+		inParams = true;
+	} else if (content[i] === "}") {
+		braceCount--;
+		if (inParams && braceCount === 0) {
+			paramsEnd = i + 1;
+			break;
+		}
+	}
+	const paramsContent = content.slice(paramsStart, paramsEnd);
+	if (new RegExp(`${propertyName}\\s*:`).test(paramsContent)) {
+		const propertyLiteralPattern = new RegExp(`${propertyName}\\s*:\\s*(\\[[^\\]]*\\]|\\{[^}]*\\})`);
+		const propertyMatch = paramsContent.match(propertyLiteralPattern);
+		if (!propertyMatch) return null;
+		const [fullPropertyMatch, propertyValue] = propertyMatch;
+		if (hasComplexPattern(propertyValue)) return null;
+		let newPropertyValue;
+		if (propertyName === "skills") {
+			const inner = propertyValue.slice(1, -1).trim();
+			newPropertyValue = inner ? `[${inner}, ${itemName}]` : `[${itemName}]`;
+		} else {
+			const inner = propertyValue.slice(1, -1).trim();
+			newPropertyValue = inner ? `{ ${inner}, ${itemName} }` : `{ ${itemName} }`;
+		}
+		const newPropertyDecl = `${propertyName}: ${newPropertyValue}`;
+		const newParamsContent = paramsContent.replace(fullPropertyMatch, newPropertyDecl);
+		return content.slice(0, paramsStart) + newParamsContent + content.slice(paramsEnd);
+	}
+	const insertPoint = paramsStart + paramsMatch[0].length;
+	let newProperty;
+	if (propertyName === "skills") newProperty = `\n      ${propertyName}: [${itemName}],`;
+	else newProperty = `\n      ${propertyName}: { ${itemName} },`;
+	return content.slice(0, insertPoint) + newProperty + content.slice(insertPoint);
+}
+function registerSkill(agent, skillName, skillImportName, skillImportPath, agentFilePath) {
+	let content = readFile(agentFilePath);
+	const relativePath = path.relative(path.dirname(agentFilePath), skillImportPath).replace(/\.ts$/, "").replace(/^(?!\.)/, "./");
+	content = addImport(content, skillImportName, relativePath);
+	let updated = null;
+	if (agent.baseClass === "ChatAgentHarness") {
+		updated = updateHarnessMethod(content, "getSkills", skillImportName);
+		if (!updated) updated = addMethodToClass(content, agent.className, "getSkills", skillImportName);
+	} else updated = updateBuildLLMParams(content, "skills", skillImportName);
+	if (!updated) return {
+		success: false,
+		message: `Could not auto-register skill. Add manually:\n  1. Import: import { ${skillImportName} } from "${relativePath}";\n  2. Add ${skillImportName} to your skills array`
+	};
+	writeFile(agentFilePath, updated);
+	return {
+		success: true,
+		message: `Registered ${skillImportName} in ${path.basename(agentFilePath)}`
+	};
+}
+function registerTool(agent, toolName, toolImportName, toolImportPath, agentFilePath) {
+	let content = readFile(agentFilePath);
+	const relativePath = path.relative(path.dirname(agentFilePath), toolImportPath).replace(/\.ts$/, "").replace(/^(?!\.)/, "./");
+	content = addImport(content, toolImportName, relativePath);
+	let updated = null;
+	if (agent.baseClass === "ChatAgentHarness") {
+		updated = updateHarnessMethod(content, "getTools", toolImportName);
+		if (!updated) updated = addMethodToClass(content, agent.className, "getTools", toolImportName);
+	} else updated = updateBuildLLMParams(content, "tools", toolImportName);
+	if (!updated) return {
+		success: false,
+		message: `Could not auto-register tool. Add manually:\n  1. Import: import { ${toolImportName} } from "${relativePath}";\n  2. Add ${toolImportName} to your tools object`
+	};
+	writeFile(agentFilePath, updated);
+	return {
+		success: true,
+		message: `Registered ${toolImportName} in ${path.basename(agentFilePath)}`
+	};
+}
+//#endregion
+//#region src/cli/commands/generate-skill.ts
+async function generateSkill(name) {
+	const cwd = process.cwd();
+	const kebabName = toKebabCase(name);
+	const camelName = toCamelCase(name);
+	const skillDir = path.join(getSrcDir(cwd), "skills", kebabName);
+	const skillFile = path.join(skillDir, `${kebabName}.ts`);
+	p.intro(`Creating skill: ${kebabName}`);
+	if (fileExists(skillFile)) {
+		p.cancel(`Skill already exists at ${skillFile}`);
+		process.exit(1);
+	}
+	const answers = await p.group({
+		description: () => p.text({
+			message: "Skill description",
+			placeholder: "What does this skill do?",
+			validate: (value) => {
+				if (!value) return "Description is required";
+			}
+		}),
+		tools: () => p.text({
+			message: "Initial tools (comma-separated, leave empty to skip)",
+			placeholder: "e.g., calculate_tax, generate_invoice"
+		})
+	}, { onCancel: () => {
+		p.cancel("Operation cancelled");
+		process.exit(0);
+	} });
+	const toolNames = answers.tools ? answers.tools.split(",").map((t) => t.trim()).filter(Boolean).map(toSnakeCase) : [];
+	const toolDescriptions = {};
+	const toolUseContext = {};
+	if (toolNames.length > 0) {
+		p.note(`Configuring ${toolNames.length} tool(s)...`);
+		for (const toolName of toolNames) {
+			const desc = await p.text({
+				message: `Description for ${toolName}`,
+				placeholder: "What does this tool do?",
+				validate: (value) => {
+					if (!value) return "Description is required";
+				}
+			});
+			if (p.isCancel(desc)) {
+				p.cancel("Operation cancelled");
+				process.exit(0);
+			}
+			toolDescriptions[toolName] = desc;
+			const useContext = await p.confirm({
+				message: `Does ${toolName} need access to AgentToolContext?`,
+				initialValue: false
+			});
+			if (p.isCancel(useContext)) {
+				p.cancel("Operation cancelled");
+				process.exit(0);
+			}
+			toolUseContext[toolName] = useContext;
+		}
+	}
+	const spinner = p.spinner();
+	spinner.start("Creating files...");
+	writeFile(skillFile, generateSkillTemplate({
+		name: kebabName,
+		camelName,
+		description: answers.description,
+		toolImports: toolNames,
+		toolNames
+	}));
+	const createdFiles = [skillFile];
+	for (const toolName of toolNames) {
+		const toolFile = path.join(skillDir, "tools", `${toolName}.ts`);
+		writeFile(toolFile, generateToolTemplate({
+			snakeName: toolName,
+			description: toolDescriptions[toolName],
+			useContext: toolUseContext[toolName]
+		}));
+		createdFiles.push(toolFile);
+	}
+	spinner.stop("Files created");
+	p.note(createdFiles.map((f) => `  ${path.relative(cwd, f)}`).join("\n"), "Created files");
+	const skillImportName = `${camelName}Skill`;
+	const agents = findAgentFiles(cwd);
+	let selectedAgent = null;
+	if (agents.length === 1) selectedAgent = agents[0];
+	else if (agents.length > 1) {
+		const choice = await p.select({
+			message: "Which agent should this skill be registered with?",
+			options: agents.map((a) => ({
+				value: a.path,
+				label: `${a.className} (${path.relative(cwd, a.path)})`
+			}))
+		});
+		if (p.isCancel(choice)) {
+			p.outro(`Skill created. Add ${skillImportName} to your agent manually.`);
+			return;
+		}
+		selectedAgent = agents.find((a) => a.path === choice) ?? null;
+	}
+	if (selectedAgent) {
+		const result = registerSkill(selectedAgent, kebabName, skillImportName, skillFile, selectedAgent.path);
+		if (result.success) p.note(result.message, "Registered skill");
+		else p.note(result.message, "Manual registration required");
+	} else p.note(`Add ${skillImportName} to your agent's getSkills() method`, "No agent found");
+	p.outro(`Next steps:
+  1. Implement tool logic in tools/*.ts
+  2. Update the skill guidance in ${kebabName}.ts`);
+}
+//#endregion
+//#region src/cli/commands/generate-tool.ts
+async function generateTool(name) {
+	const cwd = process.cwd();
+	const snakeName = toSnakeCase(name);
+	const srcDir = getSrcDir(cwd);
+	p.intro(`Creating tool: ${snakeName}`);
+	const locationOptions = [{
+		value: "global",
+		label: "Global tool (src/tools/)"
+	}, ...findSkills(cwd).map((skill) => ({
+		value: `skill:${skill}`,
+		label: `In skill: ${skill}`
+	}))];
+	const answers = await p.group({
+		description: () => p.text({
+			message: "Tool description",
+			placeholder: "What does this tool do?",
+			validate: (value) => {
+				if (!value) return "Description is required";
+			}
+		}),
+		location: () => p.select({
+			message: "Where should this tool be created?",
+			options: locationOptions
+		}),
+		useContext: () => p.confirm({
+			message: "Does this tool need access to AgentToolContext?",
+			initialValue: false
+		})
+	}, { onCancel: () => {
+		p.cancel("Operation cancelled");
+		process.exit(0);
+	} });
+	let toolFile;
+	if (answers.location === "global") toolFile = path.join(srcDir, "tools", `${snakeName}.ts`);
+	else {
+		const skillName = answers.location.replace("skill:", "");
+		toolFile = path.join(srcDir, "skills", skillName, "tools", `${snakeName}.ts`);
+	}
+	if (fileExists(toolFile)) {
+		p.cancel(`Tool already exists at ${toolFile}`);
+		process.exit(1);
+	}
+	const spinner = p.spinner();
+	spinner.start("Creating file...");
+	const toolContent = generateToolTemplate({
+		snakeName,
+		description: answers.description,
+		useContext: answers.useContext
+	});
+	writeFile(toolFile, toolContent);
+	spinner.stop("File created");
+	const relativePath = path.relative(cwd, toolFile);
+	p.note(`  ${relativePath}`, "Created file");
+	if (answers.location === "global") {
+		const agents = findAgentFiles(cwd);
+		let selectedAgent = null;
+		if (agents.length === 1) selectedAgent = agents[0];
+		else if (agents.length > 1) {
+			const choice = await p.select({
+				message: "Which agent should this tool be registered with?",
+				options: agents.map((a) => ({
+					value: a.path,
+					label: `${a.className} (${path.relative(cwd, a.path)})`
+				}))
+			});
+			if (p.isCancel(choice)) {
+				p.outro(`Tool created. Add ${snakeName} to your agent manually.`);
+				return;
+			}
+			selectedAgent = agents.find((a) => a.path === choice) ?? null;
+		}
+		if (selectedAgent) {
+			const result = registerTool(selectedAgent, snakeName, snakeName, toolFile, selectedAgent.path);
+			if (result.success) p.note(result.message, "Registered tool");
+			else p.note(result.message, "Manual registration required");
+		} else p.note(`Add ${snakeName} to your agent's getTools() method`, "No agent found");
+		p.outro(`Next step: Implement tool logic in ${relativePath}`);
+	} else {
+		const skillName = answers.location.replace("skill:", "");
+		const skillFile = path.join(srcDir, "skills", skillName, `${skillName}.ts`);
+		if (fileExists(skillFile)) {
+			let skillContent = readFile(skillFile);
+			const toolRelativePath = `./tools/${snakeName}`;
+			skillContent = addImport(skillContent, snakeName, toolRelativePath);
+			const toolsMatch = skillContent.match(/tools:\s*\{([^}]*)\}/s);
+			if (toolsMatch) {
+				const [fullMatch, toolsContent] = toolsMatch;
+				const trimmed = toolsContent.trim();
+				const newTools = `tools: {${trimmed ? `${trimmed},\n    ${snakeName},` : `\n    ${snakeName},\n  `}}`;
+				skillContent = skillContent.replace(fullMatch, newTools);
+				writeFile(skillFile, skillContent);
+				p.note(`Added ${snakeName} to ${skillName}.ts`, "Registered tool");
+			} else p.note(`Add ${snakeName} to the tools object in src/skills/${skillName}/${skillName}.ts`, "Manual registration required");
+		}
+		p.outro(`Next step: Implement tool logic in ${relativePath}`);
+	}
+}
+//#endregion
+//#region src/cli/index.ts
+const args = process.argv.slice(2);
+const [command, type, name] = args;
+function printHelp() {
+	console.log(`
+Usage: economic-agents <command> <type> <name>
+
+Commands:
+  generate skill <name>  Create a new skill with tools
+  generate tool <name>   Create a new tool
+
+Options:
+  --help, -h     Show this help message
+  --version, -v  Show version
+`);
+}
+function printVersion() {
+	console.log("0.0.1");
+}
+async function main() {
+	if (args.includes("--help") || args.includes("-h")) {
+		printHelp();
+		process.exit(0);
+	}
+	if (args.includes("--version") || args.includes("-v")) {
+		printVersion();
+		process.exit(0);
+	}
+	if (command !== "generate") {
+		printHelp();
+		process.exit(1);
+	}
+	if (type === "skill") {
+		if (!name) {
+			console.error("Error: skill name is required");
+			process.exit(1);
+		}
+		await generateSkill(name);
+	} else if (type === "tool") {
+		if (!name) {
+			console.error("Error: tool name is required");
+			process.exit(1);
+		}
+		await generateTool(name);
+	} else {
+		console.error(`Error: unknown type "${type}". Use "skill" or "tool".`);
+		process.exit(1);
+	}
+}
+main();
+//#endregion
+export {};

package/dist/hono.d.mts

@@ -0,0 +1,21 @@
+import { MiddlewareHandler } from "hono";
+
+//#region src/hono/jwt-auth.d.ts
+interface JwtAuthConfig {
+  /** Issuers whose tokens are accepted (exact string or RegExp). */
+  allowedIssuers: readonly (string | RegExp)[];
+  /** Expected `aud` claim. */
+  audience: string;
+  /** Required OAuth scopes; token `scope` must include all (empty = no scope check). */
+  requiredScopes?: readonly string[];
+}
+/**
+ * Hono middleware: verify JWT via JWKS derived from the token `iss` claim,
+ * after `iss` passes `allowedIssuers`.
+ *
+ * Reads the token from `Authorization: Bearer` only. Browser WebSocket clients
+ * cannot set that header; use `routeAgentRequest` `onBeforeConnect` for those.
+ */
+declare function jwtAuth(config: JwtAuthConfig): MiddlewareHandler;
+//#endregion
+export { type JwtAuthConfig, jwtAuth };

package/dist/hono.mjs

@@ -0,0 +1,71 @@
+import { createRemoteJWKSet, decodeJwt, errors, jwtVerify } from "jose";
+//#region src/hono/jwt-auth.ts
+const jwksByIssuer = /* @__PURE__ */ new Map();
+function getJwksForIssuer(issuer) {
+	const normalized = issuer.replace(/\/$/, "");
+	let jwks = jwksByIssuer.get(normalized);
+	if (!jwks) {
+		jwks = createRemoteJWKSet(new URL(`${normalized}/.well-known/openid-configuration/jwks`));
+		jwksByIssuer.set(normalized, jwks);
+	}
+	return jwks;
+}
+function isIssuerAllowed(iss, allowed) {
+	return allowed.some((rule) => typeof rule === "string" ? rule === iss : rule.test(iss));
+}
+function bearerTokenFromAuthorizationHeader(authorization) {
+	if (!authorization) return null;
+	return authorization.match(/^Bearer\s+(.+)$/i)?.[1]?.trim() ?? null;
+}
+function hasRequiredScopes(tokenScope, required) {
+	if (required.length === 0) return true;
+	if (tokenScope === void 0) return false;
+	const tokens = Array.isArray(tokenScope) ? tokenScope : tokenScope.split(" ").map((s) => s.trim()).filter(Boolean);
+	const granted = new Set(tokens);
+	return required.every((scope) => granted.has(scope));
+}
+function authErrorResponse(status, message) {
+	return new Response(message, { status });
+}
+/**
+* Hono middleware: verify JWT via JWKS derived from the token `iss` claim,
+* after `iss` passes `allowedIssuers`.
+*
+* Reads the token from `Authorization: Bearer` only. Browser WebSocket clients
+* cannot set that header; use `routeAgentRequest` `onBeforeConnect` for those.
+*/
+function jwtAuth(config) {
+	const requiredScopes = config.requiredScopes ?? [];
+	return async (c, next) => {
+		const token = bearerTokenFromAuthorizationHeader(c.req.header("Authorization"));
+		if (!token) return authErrorResponse(401, "Unauthorized: Missing authentication token");
+		let unverifiedPayload;
+		try {
+			unverifiedPayload = decodeJwt(token);
+		} catch {
+			return authErrorResponse(401, "Unauthorized: Invalid token");
+		}
+		const iss = typeof unverifiedPayload.iss === "string" ? unverifiedPayload.iss : void 0;
+		if (!iss) return authErrorResponse(401, "Unauthorized: Missing issuer claim");
+		if (!isIssuerAllowed(iss, config.allowedIssuers)) return authErrorResponse(401, "Unauthorized: Untrusted issuer");
+		const jwks = getJwksForIssuer(iss);
+		let payload;
+		try {
+			payload = (await jwtVerify(token, jwks, {
+				issuer: iss,
+				audience: config.audience
+			})).payload;
+		} catch (error) {
+			console.error("Authentication failed", error);
+			if (error instanceof errors.JWTExpired) return authErrorResponse(401, "Unauthorized: Token expired");
+			if (error instanceof errors.JWTClaimValidationFailed) return authErrorResponse(401, "Unauthorized: Token claim validation failed");
+			if (error instanceof errors.JWSSignatureVerificationFailed || error instanceof errors.JWKSNoMatchingKey) return authErrorResponse(401, "Unauthorized: Invalid token signature");
+			return authErrorResponse(401, "Authentication failed");
+		}
+		const scopeClaim = payload.scope;
+		if (!hasRequiredScopes(scopeClaim, requiredScopes)) return authErrorResponse(403, "Forbidden: Insufficient scope");
+		await next();
+	};
+}
+//#endregion
+export { jwtAuth };