@kybernesis/dispatch 0.4.0 → 0.6.0

package/README.md

@@ -55,6 +55,23 @@ Your own project's deployments and `eve dev` keep working (current-project
 OIDC bypass + `localDev()`); production browser traffic stays rejected unless
 you pass your app's real auth via `extraAuth`.
 
+## Asserted asker on governed calls
+
+A dynamic `governedPeers()` call carries the authenticated identity of the
+calling agent, plus that agent's optional claim about the human who prompted
+it. The human's authenticated authority does not travel with this call. On the
+receiver, `assertedAsker(session)` from `@kybernesis/enterprise` reads the
+caller's asserted asker.
+
+The value is asserted rather than authenticated: the control plane signs the
+token containing the claim, but does not verify the named human. Use it only for
+non-escalating purposes such as greeting or addressing someone, attribution or
+logging, tailoring a non-sensitive response, or refusing work. Never use it to
+authorize access, widen permissions, impersonate a user, select user-scoped
+credentials, or permit access to personal data. A tool that reaches personal
+data must use the authenticated session principal, which on this agent-to-agent
+call is the calling agent.
+
 ## Bidirectional edges
 
 Answering is built into one edge — the caller parks until the peer's terminal

package/dist/governed-peers.js

@@ -33,15 +33,40 @@ async function discover(options) {
         return hit?.peers ?? [];
     }
 }
+/**
+ * Who is asking, from the verified session principal.
+ *
+ * The agent's own door authenticated this; the model did not choose it and
+ * cannot set it, which is the only reason it is worth sending at all. Undefined
+ * for an unattended turn — a schedule, a webhook — where there is no person.
+ *
+ * This travels to the peer as an ASSERTION, not as authentication. The peer
+ * learns who prompted the call and can address them by name or decline work
+ * that is not theirs to do, but the call still carries this agent's authority,
+ * not the person's. A peer must never widen what it will do because of this
+ * value: the caller could claim anything, and the control plane only records
+ * the claim. Reaching a peer AS the person is a different mechanism.
+ */
+function askedBy(ctx) {
+    const current = ctx?.session?.auth?.current;
+    const id = current?.principalId;
+    if (!id)
+        return undefined;
+    const attributes = current?.attributes ?? {};
+    const label = ["email", "user_name", "name"]
+        .map((key) => attributes[key])
+        .find((value) => typeof value === "string" && value.length > 0);
+    return label ? { id, label } : { id };
+}
 /** Mint a short-lived token for one callee, then hold the conversation. */
-async function ask(options, peer, message) {
+async function ask(options, peer, message, asker) {
     const { issuer, credential } = config(options);
     if (!credential)
         throw new Error("This agent has no control-plane credential, so it cannot call another agent.");
     const minted = await fetch(`${issuer}/api/agent/session`, {
         method: "POST",
         headers: { "content-type": "application/json", authorization: `Bearer ${credential}` },
-        body: JSON.stringify({ callee: peer.name }),
+        body: JSON.stringify({ callee: peer.name, ...(asker ? { onBehalfOf: asker } : {}) }),
         signal: AbortSignal.timeout(20_000),
     });
     if (!minted.ok) {
@@ -176,7 +201,7 @@ export function governedPeers(options = {}) {
                                 .string()
                                 .describe("What to ask it. Write it as you would to a colleague — it has no view of this conversation."),
                         }),
-                        execute: (input) => ask(options, peer, input.message),
+                        execute: (input, ctx) => ask(options, peer, input.message, askedBy(ctx)),
                     });
                 }
                 return tools;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kybernesis/dispatch",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Agent-to-agent dispatch for eve agents: declared remote-peer edges with principal forwarding on by default, and a receiver channel that makes trusting the wrong caller hard to express.",
   "license": "Apache-2.0",
   "type": "module",
@@ -26,17 +26,18 @@
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
-    "prepare": "tsc -p tsconfig.build.json",
+    "prepack": "tsc -p tsconfig.build.json",
     "typecheck": "tsc --noEmit",
     "prepublishOnly": "node ../../scripts/prepublish.mjs"
   },
   "devDependencies": {
+    "@kybernesis/enterprise": "^0.8.0",
     "@types/node": "24.x",
-    "eve": "0.38.3",
+    "eve": "0.49.0",
     "typescript": "7.0.2"
   },
   "peerDependencies": {
-    "eve": ">=0.38.0 <0.39.0",
+    "eve": ">=0.49.0 <0.50.0",
     "@kybernesis/enterprise": ">=0.2.0"
   },
   "engines": {