@kybernesis/buzz 0.5.0 → 0.5.1

package/dist/bridge.js

@@ -1,4 +1,5 @@
 import { channelIdentity } from "@kybernesis/enterprise";
+import { speakerCredentials } from "./credentials.js";
 import { Client } from "eve/client";
 import { BuzzRelay } from "./relay.js";
 import { loadKey, npubEncode } from "./keys.js";
@@ -50,14 +51,33 @@ export function buzzBridge(options) {
     const sessions = new Map();
     /** Who has already been sent a link, so a room full of strangers is not a room full of spam. */
     const invited = new Map();
-    const clientFor = (token, bundle) => 
-    // `host`, not `baseUrl`: a wrong key is ignored rather than rejected, and the client then
-    // builds a nonsense URL — an error about a malformed URL rather than about a mistyped option.
-    new Client({
-        host: options.agentUrl,
-        auth: { bearer: token },
-        headers: bundle ? { "x-kybernesis-bundle": bundle } : {},
-    });
+    /**
+     * A client whose credentials are resolved per request, not captured once.
+     *
+     * The identity token a turn starts with lives about five minutes. That was
+     * invisible while turns ended early — and became a failure the moment they
+     * were allowed to run to completion: a turn doing real work for six minutes
+     * reconnected its stream with the token it began with, the agent answered
+     * "Authorization is required for this route", and the reply was lost after
+     * all the work had been done. In a channel that reads as the agent typing
+     * for five minutes and then saying nothing.
+     *
+     * Resolving per request costs nothing in the normal case — the resolver
+     * caches and re-mints only near expiry — and it keeps the property the short
+     * lifetime exists for: a person whose access is revoked mid-turn stops being
+     * able to act on the next request rather than at the end of the turn.
+     */
+    const credentialsFor = speakerCredentials((externalId) => identity.resolve(PROVIDER, externalId, npubEncode(externalId)));
+    const clientFor = (pubkey) => {
+        const credentials = credentialsFor(pubkey);
+        // `host`, not `baseUrl`: a wrong key is ignored rather than rejected, and the client then
+        // builds a nonsense URL — an error about a malformed URL rather than about a mistyped option.
+        return new Client({
+            host: options.agentUrl,
+            auth: { bearer: credentials.bearer },
+            headers: credentials.headers,
+        });
+    };
     /**
      * One turn at a time per channel.
      *
@@ -73,9 +93,10 @@ export function buzzBridge(options) {
         inFlight.set(channel, queued.catch(() => { }));
         return queued;
     }
-    async function ask(channel, text, token, bundle) {
-        // Built per turn, for the person whose turn it is.
-        const client = clientFor(token, bundle);
+    async function ask(channel, text, pubkey) {
+        // Built per turn, for the person whose turn it is — and kept current for as
+        // long as that turn runs.
+        const client = clientFor(pubkey);
         const existing = sessions.get(channel);
         if (existing) {
             try {
@@ -212,7 +233,7 @@ export function buzzBridge(options) {
         void relay.react(event.id, SEEN);
         const stopTyping = relay.typingIn(channel);
         try {
-            const reply = await serialize(channel, () => ask(channel, text, speaker.token, speaker.bundle));
+            const reply = await serialize(channel, () => ask(channel, text, event.pubkey));
             if (!reply) {
                 /**
                  * Silence is the worst answer available.

package/dist/credentials.d.ts

@@ -0,0 +1,25 @@
+import type { SpeakerResolution } from "@kybernesis/enterprise";
+/** What the eve client needs to authenticate one person's turn. */
+export interface SpeakerCredentials {
+    /** Bearer resolver — called by the client before every HTTP request. */
+    bearer: () => Promise<string>;
+    /** Header resolver, for the same reason and on the same schedule. */
+    headers: () => Promise<Readonly<Record<string, string>>>;
+}
+/**
+ * Credentials for a turn, resolved per request rather than captured once.
+ *
+ * @remarks
+ * An identity token lives about five minutes. That was invisible while turns
+ * ended early, and became a failure the moment they ran to completion: a turn
+ * doing six minutes of real work reconnected its stream with the token it began
+ * with, the agent answered "Authorization is required for this route", and the
+ * reply was lost after every tool call had already succeeded. In a channel that
+ * reads as the agent typing for five minutes and then saying nothing at all.
+ *
+ * Resolving per request costs nothing in the normal case, because the resolver
+ * caches and re-mints only near expiry. It also preserves the property the
+ * short lifetime exists for: access withdrawn mid-turn stops the next request
+ * rather than being noticed after the work is done.
+ */
+export declare function speakerCredentials(resolve: (externalId: string) => Promise<SpeakerResolution>): (externalId: string) => SpeakerCredentials;

package/dist/credentials.js

@@ -0,0 +1,36 @@
+/**
+ * Credentials for a turn, resolved per request rather than captured once.
+ *
+ * @remarks
+ * An identity token lives about five minutes. That was invisible while turns
+ * ended early, and became a failure the moment they ran to completion: a turn
+ * doing six minutes of real work reconnected its stream with the token it began
+ * with, the agent answered "Authorization is required for this route", and the
+ * reply was lost after every tool call had already succeeded. In a channel that
+ * reads as the agent typing for five minutes and then saying nothing at all.
+ *
+ * Resolving per request costs nothing in the normal case, because the resolver
+ * caches and re-mints only near expiry. It also preserves the property the
+ * short lifetime exists for: access withdrawn mid-turn stops the next request
+ * rather than being noticed after the work is done.
+ */
+export function speakerCredentials(resolve) {
+    return (externalId) => {
+        const current = async () => {
+            const speaker = await resolve(externalId);
+            if (!speaker.linked) {
+                // Failing here is the point: the alternative is finishing a turn with a
+                // credential the control plane has already withdrawn.
+                throw new Error(`no longer authorized (${speaker.reason})`);
+            }
+            return { token: speaker.token, bundle: speaker.bundle };
+        };
+        return {
+            bearer: async () => (await current()).token,
+            headers: async () => {
+                const { bundle } = await current();
+                return bundle ? { "x-kybernesis-bundle": bundle } : {};
+            },
+        };
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kybernesis/buzz",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Put an eve agent in a Buzz workspace as a member: per-speaker verified identity resolved through the control plane, self-service identity linking, presence, typing and seen signals.",
   "license": "Apache-2.0",
   "type": "module",