@economic/agents 2.6.0 → 2.6.1

package/dist/index.d.mts

@@ -225,10 +225,7 @@ declare abstract class Agent<RequestContext extends Record<string, unknown> = Re
   private _getExchangedToken;
   /**
    * Swaps the client-sent token for the exchanged one in a copy of the turn
-   * body. No-op when token exchange is not configured. When the exchanged
-   * token is missing or expired the turn cannot run: only a reconnect can
-   * deliver a fresh subject token, so the current connection (if any) is
-   * closed to force one, and the turn fails.
+   * body. No-op when token exchange is not configured.
    */
   private _applyTokenExchange;
   /**

package/dist/index.mjs

@@ -4,6 +4,37 @@ import { Think, skills } from "@cloudflare/think";
 import { Output, convertToModelMessages, generateText, jsonSchema, pruneMessages, tool as tool$1 } from "ai";
 import { nanoid } from "nanoid";
 import { createCompactFunction } from "agents/experimental/memory/utils";
+//#region src/server/util/agent.ts
+function sendConnectionStatus(connection, status) {
+	connection.send(JSON.stringify({
+		type: "connection_status",
+		status
+	}));
+}
+function sendAgentType(connection, agentType) {
+	connection.send(JSON.stringify({
+		type: "agent_type",
+		agentType
+	}));
+}
+function sendSubAgentName(connection, subAgentName) {
+	connection.send(JSON.stringify({
+		type: "sub_agent_name",
+		subAgentName
+	}));
+}
+/**
+* Close code for a getUserContext failure. Subclasses signal an intentional
+* auth-style rejection by throwing an Error carrying a numeric `closeCode`
+* in the WebSocket application range (4000-4999); anything else is treated
+* as an internal error (1011).
+*/
+function getConnectCloseCode(error) {
+	const closeCode = error?.closeCode;
+	if (typeof closeCode === "number" && closeCode >= 4e3 && closeCode <= 4999) return closeCode;
+	return 1011;
+}
+//#endregion
 //#region src/server/features/auth/tokenExchange.ts
 /**
 * OAuth 2.0 Token Exchange (RFC 8693) against an identity server.
@@ -94,6 +125,56 @@ function withExchangedToken(body, tokenHeader, accessToken) {
 		}
 	};
 }
+/**
+* Connect-time exchange. On failure, signals the client and closes the
+* connection — `unauthorized`/4001 when the session token itself was rejected
+* (only a re-login fixes that), `error`/1011 for identity-server or
+* configuration faults — and returns undefined so the caller abandons the
+* connect.
+*/
+async function exchangeConnectToken(subjectToken, config, connection) {
+	let result;
+	try {
+		result = await exchangeToken(subjectToken, config);
+	} catch (error) {
+		sendConnectionStatus(connection, "error");
+		console.error(`[Agent] Token exchange error - ${error}`);
+		connection.close(1011, "Token exchange failed");
+		return;
+	}
+	if (!result.success) {
+		console.error(`[Agent] Token exchange failed - ${result.message}`);
+		if (result.subjectTokenRejected) {
+			sendConnectionStatus(connection, "unauthorized");
+			connection.close(4001, "Unauthorized");
+		} else {
+			sendConnectionStatus(connection, "error");
+			connection.close(1011, "Token exchange failed");
+		}
+		return;
+	}
+	return {
+		accessToken: result.accessToken,
+		expiresAt: result.expiresAt
+	};
+}
+/**
+* Turn-time injection: returns a body copy with the held token under
+* `tokens[config.tokenHeader]`. When the held token is missing or expired the
+* turn cannot run — only a re-authenticating reconnect delivers a fresh
+* subject token — so the current connection (if any) is closed to force one,
+* and this throws to fail the turn.
+*/
+function injectExchangedToken(body, config, token, connection) {
+	if (!token || token.expiresAt <= Date.now()) {
+		if (connection) {
+			sendConnectionStatus(connection, "unauthorized");
+			connection.close(4001, "Unauthorized");
+		}
+		throw new Error("Exchanged token missing or expired - the client must reconnect");
+	}
+	return withExchangedToken(body, config.tokenHeader ?? "X-EconomicToken", token.accessToken);
+}
 //#endregion
 //#region src/server/util/tools.ts
 function tool(tool) {
@@ -183,26 +264,6 @@ async function touchAgentInstance(db, input) {
        WHERE agent_name = ? AND durable_object_name = ?`).bind(input.updatedAt, input.agentName, input.durableObjectName).run();
 }
 //#endregion
-//#region src/server/util/agent.ts
-function sendConnectionStatus(connection, status) {
-	connection.send(JSON.stringify({
-		type: "connection_status",
-		status
-	}));
-}
-function sendAgentType(connection, agentType) {
-	connection.send(JSON.stringify({
-		type: "agent_type",
-		agentType
-	}));
-}
-function sendSubAgentName(connection, subAgentName) {
-	connection.send(JSON.stringify({
-		type: "sub_agent_name",
-		subAgentName
-	}));
-}
-//#endregion
 //#region src/server/util/llm.ts
 /**
 * Convention: tools can include a `sources` array in their return value to surface
@@ -240,17 +301,6 @@ function buildSourcesTransform(additional) {
 //#endregion
 //#region src/server/agents/Agent.ts
 const EXCHANGED_TOKEN_STORAGE_KEY = "economic:exchangedToken";
-/**
-* Close code for a getUserContext failure. Subclasses signal an intentional
-* auth-style rejection by throwing an Error carrying a numeric `closeCode`
-* in the WebSocket application range (4000-4999); anything else is treated
-* as an internal error (1011).
-*/
-function getConnectCloseCode(error) {
-	const closeCode = error?.closeCode;
-	if (typeof closeCode === "number" && closeCode >= 4e3 && closeCode <= 4999) return closeCode;
-	return 1011;
-}
 var Agent = class extends Think {
 	agentType = "agent";
 	clientIp;
@@ -314,31 +364,10 @@ var Agent = class extends Think {
 				const getTokenExchangeConfig = this.constructor.getTokenExchangeConfig;
 				const exchangeConfig = getTokenExchangeConfig?.(this.env);
 				if (token && exchangeConfig) {
-					let result;
-					try {
-						result = await exchangeToken(token, exchangeConfig);
-					} catch (error) {
-						sendConnectionStatus(connection, "error");
-						console.error(`[Agent] Token exchange error - ${error}`);
-						connection.close(1011, "Token exchange failed");
-						return;
-					}
-					if (!result.success) {
-						console.error(`[Agent] Token exchange failed - ${result.message}`);
-						if (result.subjectTokenRejected) {
-							sendConnectionStatus(connection, "unauthorized");
-							connection.close(4001, "Unauthorized");
-						} else {
-							sendConnectionStatus(connection, "error");
-							connection.close(1011, "Token exchange failed");
-						}
-						return;
-					}
-					await this._storeExchangedToken({
-						accessToken: result.accessToken,
-						expiresAt: result.expiresAt
-					});
-					effectiveToken = result.accessToken;
+					const exchanged = await exchangeConnectToken(token, exchangeConfig, connection);
+					if (!exchanged) return;
+					await this._storeExchangedToken(exchanged);
+					effectiveToken = exchanged.accessToken;
 				}
 				if (effectiveToken && this.getUserContext) try {
 					connection.setState({ userContext: await this.getUserContext(effectiveToken) });
@@ -587,25 +616,13 @@ var Agent = class extends Think {
 	}
 	/**
 	* Swaps the client-sent token for the exchanged one in a copy of the turn
-	* body. No-op when token exchange is not configured. When the exchanged
-	* token is missing or expired the turn cannot run: only a reconnect can
-	* deliver a fresh subject token, so the current connection (if any) is
-	* closed to force one, and the turn fails.
+	* body. No-op when token exchange is not configured.
 	*/
 	async _applyTokenExchange(body) {
 		const getTokenExchangeConfig = this.constructor.getTokenExchangeConfig;
 		const exchangeConfig = getTokenExchangeConfig?.(this.env);
 		if (!exchangeConfig) return body;
-		const token = await this._getExchangedToken();
-		if (!token) {
-			const { connection } = getCurrentAgent();
-			if (connection) {
-				sendConnectionStatus(connection, "unauthorized");
-				connection.close(4001, "Unauthorized");
-			}
-			throw new Error("Exchanged token missing or expired - the client must reconnect");
-		}
-		return withExchangedToken(body, exchangeConfig.tokenHeader ?? "X-EconomicToken", token.accessToken);
+		return injectExchangedToken(body, exchangeConfig, await this._getExchangedToken(), getCurrentAgent().connection);
 	}
 	/**
 	* The user context for the session.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@economic/agents",
-  "version": "2.6.0",
+  "version": "2.6.1",
   "description": "A starter for creating a TypeScript package.",
   "license": "MIT",
   "files": [