@kmlckj/licos-platform-sdk 0.6.4 → 0.6.5

package/README.md

@@ -5,14 +5,15 @@ LICOS platform SDK for server-side project runtime code.
 ## Runtime Configuration
 
 Server-side helpers call platform Studio runtime APIs. Project code does not
-pass API base URLs, project IDs, tokens, or environment scopes. The SDK loads
-them from runtime environment variables injected by LICOS:
-
-- `LICOS_PLATFORM_API_BASE_URL`
-- `LICOS_RUNTIME_TOKEN` or `LICOS_USER_TOKEN`
-- `LICOS_PROJECT_ID` or `AGENT_PROJECT_ID`
-- `LICOS_WORKSPACE_ID` or `AGENT_WORKSPACE_ID`
-- `LICOS_PROJECT_ENV`, mapped internally to `dev` or `prod`
+pass API base URLs, project IDs, tokens, or environment scopes. The SDK loads
+identity from runtime environment variables injected by LICOS. Authentication
+is resolved automatically by the runtime:
+
+- `LICOS_PLATFORM_API_BASE_URL`
+- `LICOS_PROJECT_ID` or `AGENT_PROJECT_ID`
+- `LICOS_WORKSPACE_ID` or `AGENT_WORKSPACE_ID`
+- `LICOS_USER_ID` or `AGENT_USER_ID`
+- `LICOS_PROJECT_ENV`, mapped internally to `dev` or `prod`
 
 ## Database
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kmlckj/licos-platform-sdk",
-  "version": "0.6.4",
+  "version": "0.6.5",
   "description": "LICOS platform SDK package shell for browser and Node runtimes",
   "author": "kmlckj",
   "type": "module",

package/src/database.js

@@ -1,9 +1,9 @@
 import { ApiError } from './shared.js';
 import { authHeaders, runtimeConfig } from './runtime.js';
 
-function databaseConfig() {
-  return runtimeConfig();
-}
+async function databaseConfig() {
+  return runtimeConfig();
+}
 
 function databaseUrl(config, route) {
   return `${config.baseUrl}/api/v1/studio/runtime/database/projects/${encodeURIComponent(config.projectId)}${route}`;
@@ -45,8 +45,8 @@ async function decodeResponse(response) {
   return payload.data;
 }
 
-async function requestJson(route, body) {
-  const config = databaseConfig();
+async function requestJson(route, body) {
+  const config = await databaseConfig();
   const payload = { environment: config.environment, ...compactObject(body) };
   const response = await fetch(databaseUrl(config, route), {
     method: 'POST',
@@ -56,8 +56,8 @@ async function requestJson(route, body) {
   return decodeResponse(response);
 }
 
-async function requestControlJson(route, query = {}) {
-  const config = databaseConfig();
+async function requestControlJson(route, query = {}) {
+  const config = await databaseConfig();
   const url = new URL(controlDatabaseUrl(config, route));
   for (const [key, value] of Object.entries({ environment: config.environment, ...query })) {
     if (value !== undefined && value !== null) url.searchParams.set(key, String(value));
@@ -145,8 +145,8 @@ export async function upsert(table, options = {}) {
   });
 }
 
-export async function transaction(operations) {
-  const config = databaseConfig();
+export async function transaction(operations) {
+  const config = await databaseConfig();
   const normalized = operations.map((operation) => ({
     type: operation.type,
     request: {

package/src/runtime.js

@@ -1,5 +1,8 @@
 import { ConfigurationError } from './shared.js';
 
+const AI_USER_TOKEN_PATH = '/api/v1/internal/auth/ai-user-token';
+const tokenCache = new Map();
+
 export function env(name) {
   const value = process.env[name];
   if (typeof value !== 'string') return undefined;
@@ -40,22 +43,93 @@ export function projectEnvironment(overrideEnvName) {
   return ['prod', 'production', 'release'].includes(projectEnv) ? 'prod' : 'dev';
 }
 
-export function runtimeConfig({ environmentOverrideEnv } = {}) {
+function decodeAiTokenPayload(payload) {
+  if (!payload || typeof payload !== 'object') {
+    throw new ConfigurationError('AI user token exchange response is not an object');
+  }
+  if ((payload.code !== undefined && payload.code !== 0) || payload.success === false) {
+    const error = new ConfigurationError(payload.message || 'AI user token exchange failed');
+    error.code = typeof payload.code === 'number' ? payload.code : undefined;
+    error.details = payload;
+    throw error;
+  }
+  const data = payload.data;
+  const token =
+    typeof data === 'string'
+      ? data.trim()
+      : String(data?.accessToken || data?.access_token || data?.token || '').trim();
+  if (!token) {
+    const error = new ConfigurationError('AI user token exchange response missing accessToken');
+    error.details = payload;
+    throw error;
+  }
+  return token;
+}
+
+async function resolveUserToken(baseUrl, userId) {
+  const ownerUserId = String(userId || '').trim();
+  if (!ownerUserId) {
+    throw new ConfigurationError('project owner user ID is not configured');
+  }
+  const aiAgentToken = env('LICOS_AI_AGENT_TOKEN');
+  if (!aiAgentToken) {
+    throw new ConfigurationError('platform runtime identity is unavailable');
+  }
+
+  const cacheKey = `${baseUrl}\n${ownerUserId}\n${aiAgentToken}`;
+  if (tokenCache.has(cacheKey)) return tokenCache.get(cacheKey);
+
+  const promise = fetch(`${baseUrl}${AI_USER_TOKEN_PATH}`, {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${aiAgentToken}`,
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify({ userId: ownerUserId }),
+  }).then(async (response) => {
+    const text = await response.text();
+    let payload = null;
+    try {
+      payload = text ? JSON.parse(text) : null;
+    } catch (error) {
+      const wrapped = new ConfigurationError('parse AI user token exchange response failed');
+      wrapped.status = response.status;
+      wrapped.details = text;
+      throw wrapped;
+    }
+    if (!response.ok) {
+      const message = payload?.message || text || `AI user token exchange returned ${response.status}`;
+      const wrapped = new ConfigurationError(message);
+      wrapped.status = response.status;
+      wrapped.details = payload;
+      throw wrapped;
+    }
+    return decodeAiTokenPayload(payload);
+  });
+  tokenCache.set(cacheKey, promise);
+  try {
+    return await promise;
+  } catch (error) {
+    tokenCache.delete(cacheKey);
+    throw error;
+  }
+}
+
+export async function runtimeConfig({ environmentOverrideEnv } = {}) {
   const projectId = env('LICOS_PROJECT_ID') || env('AGENT_PROJECT_ID');
   if (!projectId) {
     throw new ConfigurationError('LICOS_PROJECT_ID or AGENT_PROJECT_ID is not configured');
   }
-  const token = env('LICOS_RUNTIME_TOKEN') || env('LICOS_USER_TOKEN');
-  if (!token) {
-    throw new ConfigurationError('LICOS_RUNTIME_TOKEN or LICOS_USER_TOKEN is not configured');
-  }
+  const baseUrl = platformBaseUrl();
+  const userId = env('LICOS_USER_ID') || env('AGENT_USER_ID');
+  const token = await resolveUserToken(baseUrl, userId);
   return {
-    baseUrl: platformBaseUrl(),
+    baseUrl,
     projectId,
     environment: projectEnvironment(environmentOverrideEnv),
     token,
     workspaceId: env('LICOS_WORKSPACE_ID') || env('AGENT_WORKSPACE_ID'),
-    userId: env('LICOS_USER_ID') || env('AGENT_USER_ID'),
+    userId,
   };
 }
 

package/src/storage.js

@@ -6,7 +6,7 @@ import { authHeaders, runtimeConfig } from './runtime.js';
 
 export const MAX_UPLOAD_FILE_BYTES = 20 * 1024 * 1024;
 
-function storageConfig() {
+async function storageConfig() {
   return runtimeConfig({ environmentOverrideEnv: 'LICOS_STORAGE_SCOPE' });
 }
 
@@ -45,7 +45,7 @@ async function decodeResponse(response) {
 }
 
 async function requestJson(method, route, { params, body } = {}) {
-  const config = storageConfig();
+  const config = await storageConfig();
   const response = await fetch(storageUrl(config, route, params), {
     method,
     headers: authHeaders(config),
@@ -113,8 +113,8 @@ export async function deleteFolder(folderId) {
 }
 
 export async function uploadFile(input, options = {}) {
-  const config = storageConfig();
   const { blob, fileName } = await filePart(input, options);
+  const config = await storageConfig();
   const form = new FormData();
   form.set('projectId', config.projectId);
   form.set('scope', config.environment);