@hypequery/agent 0.0.0-canary-20261114145248

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are advised to review the applicable
+      documentation for the specific language governing permissions and
+      limitations under each license.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2024 hypequery
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License. 

package/README.md

@@ -0,0 +1,59 @@
+# @hypequery/agent
+
+Put a hypequery Cloud project's tenant-safe analytics in your own agent.
+
+`mintAgentToken()` signs an end-user token in your backend with a project's
+managed signing key. It makes no network call, so you can mint one per
+session or per request. The tenant comes from the signed token, never from the
+model, so a prompt can't reach another customer's data.
+
+```bash
+npm install @hypequery/agent
+```
+
+```ts
+import { mintAgentToken } from '@hypequery/agent';
+
+// In your backend, when a session starts.
+const { token, mcpUrl, expiresAt } = await mintAgentToken({
+  signingKey: process.env.HYPEQUERY_AGENT_KEY!,
+  tenant: session.orgId,
+  subject: session.userId,
+  permissionSet: 'customers',
+});
+
+// Any MCP client: send the token as a bearer token to mcpUrl.
+```
+
+## Options
+
+| Option | |
+| --- | --- |
+| `signingKey` | The private key JSON Cloud showed when you created the key (Settings → Customer access → Signing keys for in-app agents). Keep it in `HYPEQUERY_AGENT_KEY`. |
+| `tenant` | The end user's customer. Every query is scoped to it. |
+| `subject` | The end user, as your app identifies them. |
+| `permissionSet` | The permission set the end user acts with, by name. Required. |
+| `constraints` | Optional filters every query carries: `{ filter, operator: 'eq', value }` or `{ filter, operator: 'in', value: [...] }`, at most 8. |
+| `expiresInSeconds` | Lifetime, 1 to 900. Defaults to 900 (15 minutes, Cloud's ceiling). |
+| `project` | Optional. The project's protocol name (for example `acme:logistics`). Defaults to the key's `hq_project`. |
+| `endpoint` | Optional. The project's customer endpoint, `https://<endpoint>.hypequery.app`, or its `/mcp` URL. Defaults to the key's `hq_endpoint`. https only, except on localhost. |
+
+An explicit `project` or `endpoint` wins over the key's own. If neither gives
+one, `mintAgentToken()` throws `AgentTokenError` naming it.
+
+It returns `{ token, mcpUrl, expiresAt }`. Mint a new token before
+`expiresAt`. An option Cloud would refuse throws `AgentTokenError`, whose
+`field` names it.
+
+The token is an EdDSA JWT whose `kid` names your key, with audience
+`hypequery-agent:<project>`. Python's `hypequery.agent.mint_agent_token()`
+mints the same token for the same input.
+
+Runs on Node.js 20 or later and on runtimes with Web Crypto Ed25519 (Deno,
+Bun, Cloudflare Workers, Vercel Edge).
+
+Docs: https://hypequery.com/docs/cloud/in-app-agents
+
+## License
+
+Apache-2.0

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export * from './mint/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC"}

package/dist/index.js

@@ -0,0 +1 @@
+export * from './mint/index.js';

package/dist/mint/base64url.d.ts

@@ -0,0 +1,3 @@
+/** Unpadded base64url (RFC 7515 §2), without Buffer so it runs on edge runtimes. */
+export declare function base64UrlEncode(bytes: Uint8Array): string;
+//# sourceMappingURL=base64url.d.ts.map

package/dist/mint/base64url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.d.ts","sourceRoot":"","sources":["../../src/mint/base64url.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIzD"}

package/dist/mint/base64url.js

@@ -0,0 +1,7 @@
+/** Unpadded base64url (RFC 7515 §2), without Buffer so it runs on edge runtimes. */
+export function base64UrlEncode(bytes) {
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}

package/dist/mint/claims.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The claim rules Cloud applies to a managed-key token (AG-18a, the same as
+ * for a customer JWT). A mint that breaks one throws instead of producing a
+ * token the tenant endpoint refuses. `python/hypequery/src/hypequery/agent`
+ * applies the same rules, pinned by `specs/agent-token/fixtures/mint-v1`.
+ */
+/** The longest lifetime (`exp` − `iat`) Cloud accepts: 15 minutes. */
+export declare const AGENT_TOKEN_MAX_LIFETIME_SECONDS: number;
+export declare const MAX_AGENT_CONSTRAINTS = 8;
+export declare const MAX_AGENT_CONSTRAINT_VALUES = 100;
+export type AgentConstraintScalar = string | number | boolean;
+/**
+ * A filter every query the end user makes carries. It names one of the
+ * dataset's declared filters; a dataset without it refuses the query rather
+ * than skip the constraint.
+ */
+export type AgentConstraint = {
+    readonly filter: string;
+    readonly operator: 'eq';
+    readonly value: AgentConstraintScalar;
+} | {
+    readonly filter: string;
+    readonly operator: 'in';
+    readonly value: readonly AgentConstraintScalar[];
+};
+export declare function checkProject(value: unknown): string;
+export declare function checkSubject(value: unknown): string;
+export declare function checkTenant(value: unknown): string;
+export declare function checkPermissionSet(value: unknown): string;
+export declare function checkLifetime(value: unknown): number;
+/**
+ * Copies the constraints into the claim's exact shape (`filter`, `operator`,
+ * `value`, in that order), refusing anything Cloud would refuse: a token
+ * whose constraints don't parse is refused outright.
+ */
+export declare function checkConstraints(value: unknown): AgentConstraint[];
+//# sourceMappingURL=claims.d.ts.map

package/dist/mint/claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../src/mint/claims.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,sEAAsE;AACtE,eAAO,MAAM,gCAAgC,QAAU,CAAC;AACxD,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAU/C,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE9D;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAA;CAAE,GAC3F;IACE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAClD,CAAC;AAEN,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQnD;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQnD;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQlD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQzD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAapD;AA4BD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,EAAE,CAuDlE"}

package/dist/mint/claims.js

@@ -0,0 +1,124 @@
+import { AgentTokenError } from './errors.js';
+/**
+ * The claim rules Cloud applies to a managed-key token (AG-18a, the same as
+ * for a customer JWT). A mint that breaks one throws instead of producing a
+ * token the tenant endpoint refuses. `python/hypequery/src/hypequery/agent`
+ * applies the same rules, pinned by `specs/agent-token/fixtures/mint-v1`.
+ */
+/** The longest lifetime (`exp` − `iat`) Cloud accepts: 15 minutes. */
+export const AGENT_TOKEN_MAX_LIFETIME_SECONDS = 15 * 60;
+export const MAX_AGENT_CONSTRAINTS = 8;
+export const MAX_AGENT_CONSTRAINT_VALUES = 100;
+/** A protocol target token: the project's protocol name, at most 128 bytes. */
+const PROJECT_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+const SUBJECT_PATTERN = /^[\x21-\x7e]{1,128}$/;
+const TENANT_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
+const PERMISSION_SET_PATTERN = /^[a-z][a-z0-9-]{0,63}$/;
+const FILTER_PATTERN = /^[A-Za-z_][A-Za-z0-9_]{0,63}$/;
+const LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+export function checkProject(value) {
+    if (typeof value !== 'string' || !PROJECT_PATTERN.test(value)) {
+        throw new AgentTokenError('project', 'project must be the project\'s protocol name as Cloud shows it (for example "acme:logistics").');
+    }
+    return value;
+}
+export function checkSubject(value) {
+    if (typeof value !== 'string' || !SUBJECT_PATTERN.test(value)) {
+        throw new AgentTokenError('subject', 'subject must be 1 to 128 printable ASCII characters, without spaces.');
+    }
+    return value;
+}
+export function checkTenant(value) {
+    if (typeof value !== 'string' || !TENANT_PATTERN.test(value)) {
+        throw new AgentTokenError('tenant', 'tenant must be 1 to 128 characters of letters, digits, ".", "_", ":" or "-".');
+    }
+    return value;
+}
+export function checkPermissionSet(value) {
+    if (typeof value !== 'string' || !PERMISSION_SET_PATTERN.test(value)) {
+        throw new AgentTokenError('permissionSet', 'permissionSet must name one of the project\'s permission sets (lowercase letters, digits and "-").');
+    }
+    return value;
+}
+export function checkLifetime(value) {
+    if (typeof value !== 'number' ||
+        !Number.isInteger(value) ||
+        value < 1 ||
+        value > AGENT_TOKEN_MAX_LIFETIME_SECONDS) {
+        throw new AgentTokenError('expiresInSeconds', `expiresInSeconds must be a whole number of seconds from 1 to ${AGENT_TOKEN_MAX_LIFETIME_SECONDS}.`);
+    }
+    return value;
+}
+function isPlainObject(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+function scalar(value, where) {
+    if (typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number') {
+        if (Number.isSafeInteger(value))
+            return value;
+        throw new AgentTokenError('constraints', `${where} must be a safe integer, a string or a boolean.`);
+    }
+    if (typeof value === 'string' &&
+        value.length >= 1 &&
+        value.length <= 256 &&
+        !LONE_SURROGATE.test(value)) {
+        return value;
+    }
+    throw new AgentTokenError('constraints', `${where} must be a string of 1 to 256 characters, a safe integer or a boolean.`);
+}
+/**
+ * Copies the constraints into the claim's exact shape (`filter`, `operator`,
+ * `value`, in that order), refusing anything Cloud would refuse: a token
+ * whose constraints don't parse is refused outright.
+ */
+export function checkConstraints(value) {
+    if (!Array.isArray(value)) {
+        throw new AgentTokenError('constraints', 'constraints must be an array.');
+    }
+    if (value.length > MAX_AGENT_CONSTRAINTS) {
+        throw new AgentTokenError('constraints', `A token can carry at most ${MAX_AGENT_CONSTRAINTS} constraints.`);
+    }
+    const filters = new Set();
+    // Array.from visits holes too, so a sparse array is refused, not serialized as null.
+    return Array.from(value, (entry, index) => {
+        const where = `constraints[${index}]`;
+        if (!isPlainObject(entry)) {
+            throw new AgentTokenError('constraints', `${where} must be an object.`);
+        }
+        for (const key of Object.keys(entry)) {
+            if (key !== 'filter' && key !== 'operator' && key !== 'value') {
+                throw new AgentTokenError('constraints', `${where} has an unknown member "${key}".`);
+            }
+        }
+        const { filter, operator } = entry;
+        if (typeof filter !== 'string' || !FILTER_PATTERN.test(filter)) {
+            throw new AgentTokenError('constraints', `${where}.filter must name a dataset filter.`);
+        }
+        if (filters.has(filter)) {
+            throw new AgentTokenError('constraints', `Each filter may be constrained once ("${filter}").`);
+        }
+        filters.add(filter);
+        if (operator === 'eq') {
+            return { filter, operator, value: scalar(entry.value, `${where}.value`) };
+        }
+        if (operator === 'in') {
+            const values = entry.value;
+            if (!Array.isArray(values) ||
+                values.length < 1 ||
+                values.length > MAX_AGENT_CONSTRAINT_VALUES) {
+                throw new AgentTokenError('constraints', `${where}.value must be a list of 1 to ${MAX_AGENT_CONSTRAINT_VALUES} values.`);
+            }
+            return {
+                filter,
+                operator,
+                value: Array.from(values, (item, position) => scalar(item, `${where}.value[${position}]`)),
+            };
+        }
+        throw new AgentTokenError('constraints', `${where}.operator must be "eq" or "in".`);
+    });
+}

package/dist/mint/endpoint.d.ts

@@ -0,0 +1,2 @@
+export declare function resolveMcpUrl(endpoint: unknown): string;
+//# sourceMappingURL=endpoint.d.ts.map

package/dist/mint/endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint.d.ts","sourceRoot":"","sources":["../../src/mint/endpoint.ts"],"names":[],"mappings":"AA8BA,wBAAgB,aAAa,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CA4BvD"}

package/dist/mint/endpoint.js

@@ -0,0 +1,52 @@
+import { AgentTokenError } from './errors.js';
+/**
+ * The project's tenant MCP URL, from its customer endpoint: the origin
+ * (`https://<endpoint>.hypequery.app`) or the MCP URL itself, given as an
+ * option or read from the key's `hq_endpoint`. It is never looked up:
+ * minting makes no network call.
+ *
+ * Parsed by pattern rather than `URL`, so Python's `mint_agent_token()`
+ * resolves every input to the same URL or refuses the same inputs.
+ */
+const ENDPOINT_PATTERN = /^(https?):\/\/([A-Za-z0-9.-]+|\[::1\])(?::([0-9]{1,5}))?(\/|\/mcp)?$/;
+const LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const DEFAULT_PORTS = { https: '443', http: '80' };
+function refuse(message) {
+    throw new AgentTokenError('endpoint', message);
+}
+/** Plain HTTP only reaches a gateway on this machine. */
+function isLoopback(host) {
+    return (host === 'localhost' ||
+        host.endsWith('.localhost') ||
+        host === '127.0.0.1' ||
+        host === '[::1]');
+}
+export function resolveMcpUrl(endpoint) {
+    if (typeof endpoint !== 'string') {
+        refuse('endpoint must be the project\'s customer endpoint URL from Cloud.');
+    }
+    const match = ENDPOINT_PATTERN.exec(endpoint);
+    if (!match) {
+        refuse('endpoint must be the project\'s customer endpoint, for example ' +
+            '"https://acme-logistics-1f2e3d.hypequery.app", or its "/mcp" URL.');
+    }
+    const scheme = match[1];
+    const host = match[2].toLowerCase();
+    const port = match[3];
+    const validHost = host === '[::1]' ||
+        (host.length <= 253 && host.split('.').every((label) => LABEL_PATTERN.test(label)));
+    if (!validHost)
+        refuse('endpoint has an invalid host name.');
+    if (scheme === 'http' && !isLoopback(host)) {
+        refuse('endpoint must use https (plain http is allowed for localhost only).');
+    }
+    let authority = host;
+    if (port !== undefined) {
+        const number = Number(port);
+        if (number < 1 || number > 65_535)
+            refuse('endpoint has an invalid port.');
+        if (String(number) !== DEFAULT_PORTS[scheme])
+            authority = `${host}:${number}`;
+    }
+    return `${scheme}://${authority}/mcp`;
+}

package/dist/mint/errors.d.ts

@@ -0,0 +1,12 @@
+/** The option a refused mint names. */
+export type AgentTokenField = 'signingKey' | 'project' | 'tenant' | 'subject' | 'permissionSet' | 'constraints' | 'expiresInSeconds' | 'endpoint' | 'now';
+/**
+ * Thrown when `mintAgentToken()` is given an option the tenant endpoint would
+ * refuse. Nothing is minted: a token Cloud refuses fails later and less
+ * clearly. The message never contains key material.
+ */
+export declare class AgentTokenError extends Error {
+    readonly field: AgentTokenField;
+    constructor(field: AgentTokenField, message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/mint/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/mint/errors.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,MAAM,MAAM,eAAe,GACvB,YAAY,GACZ,SAAS,GACT,QAAQ,GACR,SAAS,GACT,eAAe,GACf,aAAa,GACb,kBAAkB,GAClB,UAAU,GACV,KAAK,CAAC;AAEV;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;gBAEpB,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM;CAKpD"}

package/dist/mint/errors.js

@@ -0,0 +1,13 @@
+/**
+ * Thrown when `mintAgentToken()` is given an option the tenant endpoint would
+ * refuse. Nothing is minted: a token Cloud refuses fails later and less
+ * clearly. The message never contains key material.
+ */
+export class AgentTokenError extends Error {
+    field;
+    constructor(field, message) {
+        super(message);
+        this.name = 'AgentTokenError';
+        this.field = field;
+    }
+}

package/dist/mint/index.d.ts

@@ -0,0 +1,6 @@
+export { mintAgentToken, agentTokenAudience } from './mint.js';
+export type { MintAgentTokenOptions, AgentToken } from './mint.js';
+export { AGENT_TOKEN_MAX_LIFETIME_SECONDS, type AgentConstraint, type AgentConstraintScalar, } from './claims.js';
+export { AgentTokenError, type AgentTokenField } from './errors.js';
+export type { AgentSigningJwk } from './key.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/mint/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mint/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/D,YAAY,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,EACL,gCAAgC,EAChC,KAAK,eAAe,EACpB,KAAK,qBAAqB,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACpE,YAAY,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC"}

package/dist/mint/index.js

@@ -0,0 +1,3 @@
+export { mintAgentToken, agentTokenAudience } from './mint.js';
+export { AGENT_TOKEN_MAX_LIFETIME_SECONDS, } from './claims.js';
+export { AgentTokenError } from './errors.js';

package/dist/mint/key.d.ts

@@ -0,0 +1,36 @@
+/**
+ * A managed signing key's private half, as Cloud shows it once (AG-18a):
+ * an Ed25519 JWK with its key id.
+ */
+export interface AgentSigningJwk {
+    readonly kty: 'OKP';
+    readonly crv: 'Ed25519';
+    readonly x: string;
+    readonly d: string;
+    readonly kid: string;
+    readonly alg?: 'EdDSA';
+    readonly use?: 'sig';
+    /** The project's protocol name, which Cloud adds so minting needs no `project`. */
+    readonly hq_project?: string;
+    /** The project's customer endpoint, which Cloud adds so minting needs no `endpoint`. */
+    readonly hq_endpoint?: string;
+}
+export interface ParsedSigningKey {
+    readonly kid: string;
+    readonly jwk: {
+        kty: 'OKP';
+        crv: 'Ed25519';
+        x: string;
+        d: string;
+    };
+    /** `hq_project` and `hq_endpoint` as found, checked only when used. */
+    readonly project: unknown;
+    readonly endpoint: unknown;
+}
+/**
+ * Reads the signing key from the JSON Cloud shows (or the object it parses
+ * to). Members it doesn't use are ignored. Only the shape is checked here;
+ * `mint.ts` checks that `x` is `d`'s public key, since Cloud verifies with `x`.
+ */
+export declare function parseSigningKey(input: unknown): ParsedSigningKey;
+//# sourceMappingURL=key.d.ts.map

package/dist/mint/key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.d.ts","sourceRoot":"","sources":["../../src/mint/key.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;IACrB,mFAAmF;IACnF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,wFAAwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE;QAAE,GAAG,EAAE,KAAK,CAAC;QAAC,GAAG,EAAE,SAAS,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAeD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAkChE"}

package/dist/mint/key.js

@@ -0,0 +1,55 @@
+import { AgentTokenError } from './errors.js';
+/** Cloud's key ids: `hqsk_` and 16 random bytes, base64url. */
+const KID_PATTERN = /^hqsk_[A-Za-z0-9_-]{22}$/;
+/**
+ * An Ed25519 key, public or private, is 32 bytes: 43 base64url characters,
+ * the last carrying four bits. Only the canonical encoding is taken, so both
+ * languages read the same bytes whatever their decoders do with the spare bits.
+ */
+const KEY_BYTES_PATTERN = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+function refuse(message) {
+    throw new AgentTokenError('signingKey', message);
+}
+/**
+ * Reads the signing key from the JSON Cloud shows (or the object it parses
+ * to). Members it doesn't use are ignored. Only the shape is checked here;
+ * `mint.ts` checks that `x` is `d`'s public key, since Cloud verifies with `x`.
+ */
+export function parseSigningKey(input) {
+    let value = input;
+    if (typeof input === 'string') {
+        try {
+            // No trimming beyond JSON's own whitespace: Python's would differ.
+            value = JSON.parse(input);
+        }
+        catch {
+            refuse('The signing key is not valid JSON. Use the private key exactly as Cloud showed it.');
+        }
+    }
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        refuse('The signing key must be the private key JSON Cloud showed when it was created.');
+    }
+    const jwk = value;
+    if (jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519') {
+        refuse('The signing key must be an Ed25519 key (kty "OKP", crv "Ed25519").');
+    }
+    if (jwk.alg !== undefined && jwk.alg !== 'EdDSA')
+        refuse('The signing key\'s alg must be "EdDSA".');
+    if (jwk.use !== undefined && jwk.use !== 'sig')
+        refuse('The signing key\'s use must be "sig".');
+    if (typeof jwk.kid !== 'string' || !KID_PATTERN.test(jwk.kid)) {
+        refuse('The signing key has no hypequery key id (kid "hqsk_…").');
+    }
+    if (typeof jwk.d !== 'string' || !KEY_BYTES_PATTERN.test(jwk.d)) {
+        refuse('The signing key has no private key (d). Use the private key, not the public one.');
+    }
+    if (typeof jwk.x !== 'string' || !KEY_BYTES_PATTERN.test(jwk.x)) {
+        refuse('The signing key has no public key (x).');
+    }
+    return {
+        kid: jwk.kid,
+        jwk: { kty: 'OKP', crv: 'Ed25519', x: jwk.x, d: jwk.d },
+        project: jwk.hq_project,
+        endpoint: jwk.hq_endpoint,
+    };
+}

package/dist/mint/mint.d.ts

@@ -0,0 +1,58 @@
+import { type AgentConstraint } from './claims.js';
+import { type AgentSigningJwk } from './key.js';
+export interface MintAgentTokenOptions {
+    /**
+     * The managed signing key's private key, as the JSON Cloud showed once
+     * (keep it in `HYPEQUERY_AGENT_KEY`), or that JSON parsed.
+     */
+    readonly signingKey: string | AgentSigningJwk;
+    /**
+     * The project's protocol name (for example "acme:logistics"). Defaults to
+     * the key's `hq_project`; when both are given, this wins.
+     */
+    readonly project?: string;
+    /**
+     * The project's customer endpoint: its origin
+     * (`https://<endpoint>.hypequery.app`) or its `/mcp` URL. `mcpUrl` is
+     * `<origin>/mcp`. Defaults to the key's `hq_endpoint`; when both are
+     * given, this wins.
+     */
+    readonly endpoint?: string;
+    /** The end user's customer: every query is scoped to this tenant. */
+    readonly tenant: string;
+    /** The end user, as your app identifies them. */
+    readonly subject: string;
+    /** The permission set the end user acts with, by name. */
+    readonly permissionSet: string;
+    /** Filters every query carries, on top of the permission set. */
+    readonly constraints?: readonly AgentConstraint[];
+    /** Lifetime in seconds, at most 900 (15 minutes, Cloud's ceiling). Defaults to 900. */
+    readonly expiresInSeconds?: number;
+    /** The issue time; defaults to now. */
+    readonly now?: Date;
+}
+export interface AgentToken {
+    /** A compact JWS: send it as `Authorization: Bearer <token>`. */
+    readonly token: string;
+    /** The project's tenant MCP endpoint. */
+    readonly mcpUrl: string;
+    /** When the token stops working; mint a new one before then. */
+    readonly expiresAt: Date;
+}
+/** Cloud's audience for a project's managed-key tokens (AG-18a). */
+export declare function agentTokenAudience(project: string): string;
+/**
+ * Mints an end-user token for a project's tenant MCP endpoint, signed locally
+ * with a managed signing key (AG-18a, decision 0019 §15). No network call:
+ * call it per session or per request.
+ *
+ * The token is an EdDSA JWT whose `kid` names the key, with audience
+ * `hypequery-agent:<project>`, claims `sub`, `tenant`, `permission_set`,
+ * optional `constraints`, `iat` and `exp`, and a lifetime of at most 15
+ * minutes. For the same options and time, it is byte-for-byte the token
+ * Python's `mint_agent_token()` mints.
+ *
+ * @throws AgentTokenError when an option is one Cloud would refuse.
+ */
+export declare function mintAgentToken(options: MintAgentTokenOptions): Promise<AgentToken>;
+//# sourceMappingURL=mint.d.ts.map

package/dist/mint/mint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mint.d.ts","sourceRoot":"","sources":["../../src/mint/mint.ts"],"names":[],"mappings":"AACA,OAAO,EAQL,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,UAAU,CAAC;AAEjE,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAAC;IAC9C;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0DAA0D;IAC1D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAClD,uFAAuF;IACvF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,uCAAuC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE1D;AAgBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,CA0ExF"}

package/dist/mint/mint.js

@@ -0,0 +1,91 @@
+import { base64UrlEncode } from './base64url.js';
+import { AGENT_TOKEN_MAX_LIFETIME_SECONDS, checkConstraints, checkLifetime, checkPermissionSet, checkProject, checkSubject, checkTenant, } from './claims.js';
+import { resolveMcpUrl } from './endpoint.js';
+import { AgentTokenError } from './errors.js';
+import { parseSigningKey } from './key.js';
+/** Cloud's audience for a project's managed-key tokens (AG-18a). */
+export function agentTokenAudience(project) {
+    return `hypequery-agent:${checkProject(project)}`;
+}
+const encoder = new TextEncoder();
+function encodeJson(value) {
+    return base64UrlEncode(encoder.encode(JSON.stringify(value)));
+}
+function subtleCrypto() {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle) {
+        throw new Error('mintAgentToken needs Web Crypto (globalThis.crypto.subtle): Node 20 or later.');
+    }
+    return subtle;
+}
+/**
+ * Mints an end-user token for a project's tenant MCP endpoint, signed locally
+ * with a managed signing key (AG-18a, decision 0019 §15). No network call:
+ * call it per session or per request.
+ *
+ * The token is an EdDSA JWT whose `kid` names the key, with audience
+ * `hypequery-agent:<project>`, claims `sub`, `tenant`, `permission_set`,
+ * optional `constraints`, `iat` and `exp`, and a lifetime of at most 15
+ * minutes. For the same options and time, it is byte-for-byte the token
+ * Python's `mint_agent_token()` mints.
+ *
+ * @throws AgentTokenError when an option is one Cloud would refuse.
+ */
+export async function mintAgentToken(options) {
+    const key = parseSigningKey(options.signingKey);
+    // An explicit option wins over the key's own member.
+    const project = options.project ?? key.project;
+    if (project === undefined) {
+        throw new AgentTokenError('project', 'No project: pass project, or use a signing key whose JSON has hq_project.');
+    }
+    const endpoint = options.endpoint ?? key.endpoint;
+    if (endpoint === undefined) {
+        throw new AgentTokenError('endpoint', 'No endpoint: pass endpoint, or use a signing key whose JSON has hq_endpoint.');
+    }
+    const audience = `hypequery-agent:${checkProject(project)}`;
+    const mcpUrl = resolveMcpUrl(endpoint);
+    const subject = checkSubject(options.subject);
+    const tenant = checkTenant(options.tenant);
+    const permissionSet = checkPermissionSet(options.permissionSet);
+    const constraints = options.constraints === undefined ? [] : checkConstraints(options.constraints);
+    const lifetime = checkLifetime(options.expiresInSeconds ?? AGENT_TOKEN_MAX_LIFETIME_SECONDS);
+    const now = options.now ?? new Date();
+    if (!(now instanceof Date) || Number.isNaN(now.getTime())) {
+        throw new AgentTokenError('now', 'now must be a valid Date.');
+    }
+    const issuedAt = Math.floor(now.getTime() / 1_000);
+    const expiresAt = issuedAt + lifetime;
+    // Fixed member order, so both languages serialize the same bytes.
+    const header = { alg: 'EdDSA', kid: key.kid, typ: 'JWT' };
+    const payload = {
+        aud: audience,
+        sub: subject,
+        tenant,
+        permission_set: permissionSet,
+        ...(constraints.length > 0 ? { constraints } : {}),
+        iat: issuedAt,
+        exp: expiresAt,
+    };
+    const signingInput = `${encodeJson(header)}.${encodeJson(payload)}`;
+    const subtle = subtleCrypto();
+    let privateKey;
+    let publicKey;
+    try {
+        privateKey = await subtle.importKey('jwk', key.jwk, { name: 'Ed25519' }, false, ['sign']);
+        publicKey = await subtle.importKey('jwk', { kty: 'OKP', crv: 'Ed25519', x: key.jwk.x }, { name: 'Ed25519' }, false, ['verify']);
+    }
+    catch {
+        throw new AgentTokenError('signingKey', 'The signing key is not a valid Ed25519 key.');
+    }
+    const data = encoder.encode(signingInput);
+    const signature = new Uint8Array(await subtle.sign({ name: 'Ed25519' }, privateKey, data));
+    // Cloud verifies with `x`: a key whose `x` isn't `d`'s would mint tokens it refuses.
+    if (!(await subtle.verify({ name: 'Ed25519' }, publicKey, signature, data))) {
+        throw new AgentTokenError('signingKey', 'The signing key\'s public key (x) does not match its private key (d).');
+    }
+    return {
+        token: `${signingInput}.${base64UrlEncode(signature)}`,
+        mcpUrl,
+        expiresAt: new Date(expiresAt * 1_000),
+    };
+}

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@hypequery/agent",
+  "version": "0.0.0-canary-20261114145248",
+  "description": "Put a hypequery Cloud project's tenant-safe analytics in your own agent: mint end-user tokens locally",
+  "keywords": [
+    "hypequery",
+    "agent",
+    "mcp",
+    "jwt",
+    "multi-tenant",
+    "analytics"
+  ],
+  "license": "Apache-2.0",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.6",
+    "jose": "^6.2.15",
+    "typescript": "^6.0.3",
+    "vitest": "^5.1.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hypequery/hypequery.git",
+    "directory": "packages/agent"
+  },
+  "homepage": "https://hypequery.com",
+  "bugs": {
+    "url": "https://github.com/hypequery/hypequery/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc --project tsconfig.json",
+    "dev": "tsc --project tsconfig.json --watch",
+    "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\" \"type-tests/**/*.ts\"",
+    "test": "npm run test:types && npm run test:unit",
+    "test:unit": "vitest run",
+    "test:types": "tsc --project tsconfig.type-tests.json",
+    "types": "tsc --project tsconfig.json --noEmit"
+  }
+}