@nylorun/agents 0.13.0-beta → 0.16.0-beta

package/dist/execute-action.js

@@ -1,288 +0,0 @@
-import { delegateOf, implementationsFor, isBuiltWorkflow, isToolError, normalizeToolDefinition, normalizedSchemasFor, runHookPoint, } from "@nylorun/core/define";
-class Suspend {
-    outcome;
-    constructor(outcome) {
-        this.outcome = outcome;
-    }
-}
-const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
-    ? value
-    : {};
-/** Executes code only after a host-issued claim. No engine dependency. */
-export async function executeAction(action, root, signal, options = {}) {
-    const sandbox = options.sandbox;
-    if (action.kind === "fn" || action.kind === "verify") {
-        if (!isBuiltWorkflow(root))
-            throw new Error(`Action ${action.kind} requires a workflow definition`);
-        return executeWorkflowFn(action, root.getBinding(), signal, sandbox);
-    }
-    if (isBuiltWorkflow(root)) {
-        if (action.kind === "tool" && "key" in action && typeof action.key === "string")
-            return executeWorkflowTool(action, root.getBinding(), signal, sandbox);
-        throw new Error(`Unsupported action kind ${action.kind} on workflow`);
-    }
-    // Work for an agent used as a tool runs that agent's code, served from the root's binding.
-    const agent = action.agent ? delegatedAgent(root, action.agent.id) : root;
-    const ref = action.agent ?? { id: root.id, path: root.id };
-    if (action.kind === "hook")
-        // All capabilities at this hook point run concurrently in one action. Never throws.
-        return {
-            value: {
-                results: await runHookPoint(implementationsFor(agent), action.hook, action.input),
-            },
-        };
-    if (action.kind !== "tool" || !("capabilityId" in action))
-        throw new Error(`Unsupported action kind ${action.kind}`);
-    const impl = implementationsFor(agent)[action.capabilityId];
-    if (!impl)
-        throw new Error(`No capability ${action.capabilityId}`);
-    const raw = impl.tools?.[action.toolName];
-    if (!raw)
-        throw new Error("Missing tool implementation");
-    const tool = normalizeToolDefinition(raw);
-    return runTool(action, tool, ref, signal, sandbox);
-}
-/**
- * True when `action` runs a tool marked `background` (`ToolDefinition.background`): an Action
- * endpoint answers its delivery at once and posts the outcome later. False for anything it
- * cannot find; `executeAction` reports those.
- */
-export function runsInBackground(action, root) {
-    if (action.kind !== "tool")
-        return false;
-    try {
-        if (isBuiltWorkflow(root)) {
-            const key = action.key;
-            const impl = typeof key === "string" ? root.getBinding().nodes[key] : undefined;
-            return impl?.kind === "tool" && impl.tool.background === true;
-        }
-        if (!("capabilityId" in action))
-            return false;
-        const agent = action.agent ? delegatedAgent(root, action.agent.id) : root;
-        const raw = implementationsFor(agent)[action.capabilityId]?.tools?.[action.toolName];
-        return raw !== undefined && normalizeToolDefinition(raw).background === true;
-    }
-    catch {
-        return false;
-    }
-}
-async function executeWorkflowTool(action, binding, signal, sandbox) {
-    const impl = binding.nodes[action.key];
-    if (!impl || impl.kind !== "tool")
-        throw new Error(`No tool implementation for key ${action.key}`);
-    const path = "path" in action && typeof action.path === "string" ? action.path : action.key;
-    return runTool(action, impl.tool, { id: action.agentId, path }, signal, sandbox);
-}
-async function runTool(action, raw, ref, signal, sandbox) {
-    const tool = "execute" in raw && typeof raw.execute === "function" && "inputSchema" in raw
-        ? raw
-        : normalizeToolDefinition(raw);
-    const schemas = "inputSchema" in tool && tool.inputSchema && "validate" in tool.inputSchema
-        ? {
-            inputSchema: tool.inputSchema,
-            outputSchema: "outputSchema" in tool ? tool.outputSchema : undefined,
-        }
-        : normalizedSchemasFor(tool);
-    const input = schemas.inputSchema.validate(action.input);
-    if (!input.ok)
-        return {
-            value: {
-                kind: "failed",
-                code: "tool.invalid-input",
-                message: JSON.stringify(input.issues),
-            },
-        };
-    const ctx = action.context;
-    const state = { ...object(ctx.state) };
-    const statePatch = {};
-    const resume = object(ctx.resume);
-    const token = object(resume.token);
-    const memo = object(token._nylorun);
-    const steps = { ...object(memo.steps) };
-    const answers = { ...object(memo.answers) };
-    let waitIndex = 0;
-    let gateApproved = Boolean(memo.gateApproved) ||
-        Boolean(memo.approvalGate && resume.kind === "approval" && resume.approved);
-    const durableToken = (extra = {}) => ({
-        _nylorun: { steps, answers, waitIndex, gateApproved, ...extra },
-    });
-    const wait = async (kind, prompt, metadata) => {
-        const index = String(waitIndex++);
-        if (index in answers)
-            return answers[index];
-        if (!memo.approvalGate &&
-            resume.kind === kind &&
-            Number(memo.waitIndex ?? 0) === Number(index)) {
-            const answer = kind === "approval" ? Boolean(resume.approved) : resume.value;
-            answers[index] = answer;
-            return answer;
-        }
-        throw new Suspend({
-            kind: "interaction-required",
-            interaction: { kind, prompt, ...(metadata ? { metadata } : {}) },
-            token: {
-                _nylorun: { steps, answers, waitIndex: Number(index), gateApproved },
-            },
-        });
-    };
-    const context = {
-        executionId: String(ctx.executionId ?? action.sessionId),
-        turnId: String(ctx.turnId ?? action.turnId),
-        stepId: String(ctx.stepId ?? ""),
-        callId: String(ctx.callId ?? action.actionId),
-        invocationId: String(ctx.invocationId ?? action.actionId),
-        idempotencyKey: String(ctx.idempotencyKey ?? action.actionId),
-        signal,
-        info: ctx.info,
-        session: { id: action.sessionId },
-        agent: ref,
-        ...(ctx.resume ? { resume: ctx.resume } : {}),
-        ...(sandbox ? { sandbox } : {}),
-        state: {
-            get: (key) => state[key],
-            set: (key, value) => {
-                state[key] = value;
-                statePatch[key] = value;
-            },
-            entries: () => ({ ...state }),
-        },
-        progress() {
-            /* Canonical events are host-owned; progress transport is deferred. */
-        },
-        ask: (prompt, options) => wait("response", prompt, options),
-        approve: (prompt) => wait("approval", prompt),
-        sleep: async (duration) => {
-            throw new Suspend({
-                kind: "deferred",
-                token: durableToken({ wait: { kind: "sleep", duration } }),
-            });
-        },
-        waitFor: async (event, options) => {
-            throw new Suspend({
-                kind: "deferred",
-                token: durableToken({ wait: { kind: "waitFor", event, ...options } }),
-            });
-        },
-        step: async (name, fn) => {
-            if (Object.prototype.hasOwnProperty.call(steps, name))
-                return steps[name];
-            signal.throwIfAborted();
-            const value = await fn();
-            // Memoized values are durable only with a persisted action outcome. Interrupted actions stay uncertain.
-            steps[name] = JSON.parse(JSON.stringify(value ?? null));
-            return value;
-        },
-    };
-    try {
-        signal.throwIfAborted();
-        const approval = "approval" in tool ? tool.approval : undefined;
-        if (approval && !gateApproved) {
-            const result = await approval(input.value);
-            if (result)
-                throw new Suspend({
-                    kind: "interaction-required",
-                    interaction: {
-                        kind: "approval",
-                        prompt: typeof result === "string"
-                            ? result
-                            : `Approve ${"name" in tool ? tool.name : "tool"}?`,
-                    },
-                    token: durableToken({ approvalGate: true }),
-                });
-            gateApproved = true;
-        }
-        if (resume.kind === "approval" && resume.approved === false)
-            return { value: { kind: "denied", reason: "Approval denied" } };
-        const execute = "execute" in tool && typeof tool.execute === "function"
-            ? tool.execute
-            : undefined;
-        if (!execute)
-            throw new Error("Missing tool implementation");
-        const value = await execute(input.value, context);
-        const tagged = object(value);
-        let outcome;
-        if ([
-            "completed",
-            "failed",
-            "denied",
-            "interaction-required",
-            "deferred",
-        ].includes(tagged.kind))
-            outcome = value;
-        else
-            outcome = { kind: "completed", output: value ?? null };
-        if (outcome.kind === "completed" && schemas.outputSchema) {
-            const parsed = schemas.outputSchema.validate(outcome.output);
-            outcome = parsed.ok
-                ? { ...outcome, output: parsed.value }
-                : {
-                    kind: "failed",
-                    code: "tool.invalid-output",
-                    message: JSON.stringify(parsed.issues),
-                };
-        }
-        return { value: outcome, statePatch };
-    }
-    catch (error) {
-        if (signal.aborted)
-            throw signal.reason;
-        return {
-            value: error instanceof Suspend
-                ? error.outcome
-                : {
-                    kind: "failed",
-                    code: isToolError(error) ? error.code : "tool.execution-failed",
-                    message: message(error),
-                },
-            statePatch,
-        };
-    }
-}
-async function executeWorkflowFn(action, binding, signal, sandbox) {
-    const impl = binding.nodes[action.key];
-    if (!impl || impl.kind !== action.kind)
-        throw new Error(`No ${action.kind} implementation for key ${action.key}`);
-    signal.throwIfAborted();
-    try {
-        // Verify may receive a tool-like context later (L3/L4); tracer passes input only.
-        const value = action.kind === "verify"
-            ? await impl.fn(action.input, {
-                signal,
-                info: action.context.info,
-                session: { id: action.sessionId },
-                ...(sandbox ? { sandbox } : {}),
-                step: async (_name, fn) => fn(),
-                approve: async () => {
-                    throw new Error("Approvals in verify are not available in the tracer");
-                },
-                ask: async () => {
-                    throw new Error("ask in verify is not available in the tracer");
-                },
-                progress() { },
-            })
-            : await impl.fn(action.input);
-        return { value };
-    }
-    catch (error) {
-        if (signal.aborted)
-            throw signal.reason;
-        return {
-            value: {
-                kind: "failed",
-                code: action.kind === "verify" ? "loop.verify-failed" : "fn.failed",
-                message: message(error),
-            },
-        };
-    }
-}
-function delegatedAgent(root, id) {
-    for (const capability of Object.values(implementationsFor(root))) {
-        const child = delegateOf(capability.tools?.[id])?.agent;
-        if (child)
-            return child;
-    }
-    throw new Error(`Agent '${root.id}' does not use '${id}' as a tool`);
-}
-function message(error) {
-    return error instanceof Error ? error.message : String(error);
-}

package/dist/plugins/launch.d.ts

@@ -1,17 +0,0 @@
-import type { McpServerManifest } from "@nylorun/core/define";
-/** Single-pass replacement. Text inserted for a token is not scanned again. */
-export declare function expandPluginPlaceholders(value: string, pluginRoot: string, pluginData: string): string;
-export interface StdioLaunch {
-    readonly command: string;
-    readonly args: readonly string[];
-    readonly cwd: string;
-    readonly env: Readonly<Record<string, string>>;
-}
-export declare function prepareStdioLaunch(server: Extract<McpServerManifest, {
-    type: "stdio";
-}>, options: {
-    readonly pluginRoot: string;
-    readonly pluginData: string;
-    readonly baseEnv?: Readonly<Record<string, string | undefined>>;
-}): StdioLaunch;
-export declare function resolveContainedCwd(cwd: string, pluginRoot: string, pluginData: string): string;

package/dist/plugins/launch.js

@@ -1,71 +0,0 @@
-import { mkdirSync } from "node:fs";
-import { isAbsolute, relative, resolve, sep } from "node:path";
-const ROOT_TOKEN = "${PLUGIN_ROOT}";
-const DATA_TOKEN = "${PLUGIN_DATA}";
-/** Single-pass replacement. Text inserted for a token is not scanned again. */
-export function expandPluginPlaceholders(value, pluginRoot, pluginData) {
-    let out = "";
-    for (let index = 0; index < value.length;) {
-        if (value.startsWith(ROOT_TOKEN, index)) {
-            out += pluginRoot;
-            index += ROOT_TOKEN.length;
-            continue;
-        }
-        if (value.startsWith(DATA_TOKEN, index)) {
-            out += pluginData;
-            index += DATA_TOKEN.length;
-            continue;
-        }
-        out += value[index];
-        index += 1;
-    }
-    return out;
-}
-export function prepareStdioLaunch(server, options) {
-    const pluginRoot = options.pluginRoot;
-    const pluginData = options.pluginData;
-    mkdirSync(pluginData, { recursive: true });
-    const command = resolveCommand(server.command, pluginRoot);
-    const args = (server.args ?? []).map((arg) => expandPluginPlaceholders(arg, pluginRoot, pluginData));
-    const cwd = server.cwd
-        ? resolveContainedCwd(server.cwd, pluginRoot, pluginData)
-        : pluginRoot;
-    const env = {};
-    for (const [key, value] of Object.entries(options.baseEnv ?? {})) {
-        if (typeof value === "string")
-            setEnv(env, key, value);
-    }
-    for (const [key, value] of Object.entries(server.env ?? {}))
-        setEnv(env, key, expandPluginPlaceholders(value, pluginRoot, pluginData));
-    setEnv(env, "PLUGIN_ROOT", pluginRoot);
-    setEnv(env, "PLUGIN_DATA", pluginData);
-    return { command, args, cwd, env };
-}
-function resolveCommand(command, pluginRoot) {
-    if (command.startsWith("./"))
-        return resolve(pluginRoot, command);
-    return command;
-}
-export function resolveContainedCwd(cwd, pluginRoot, pluginData) {
-    const expanded = expandPluginPlaceholders(cwd, pluginRoot, pluginData);
-    const absolute = isAbsolute(expanded) ? expanded : resolve(pluginRoot, expanded);
-    const root = cwdTargetsData(cwd) ? pluginData : pluginRoot;
-    if (!isInside(root, absolute))
-        throw new Error(`Working directory escapes ${root}`);
-    return absolute;
-}
-function cwdTargetsData(cwd) {
-    return cwd === DATA_TOKEN || cwd.startsWith(`${DATA_TOKEN}/`);
-}
-function isInside(root, target) {
-    const rel = relative(root, target);
-    return rel === "" || (!rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel));
-}
-function setEnv(env, key, value) {
-    if (process.platform === "win32") {
-        const existing = Object.keys(env).find((name) => name.toLowerCase() === key.toLowerCase());
-        if (existing && existing !== key)
-            delete env[existing];
-    }
-    env[key] = value;
-}

package/dist/sandbox/client.d.ts

@@ -1,63 +0,0 @@
-/**
- * Action-scoped sandbox client (`ctx.sandbox`). Calls `POST /v1/actions/:id/sandbox/:tool`
- * over a transport whose credential is the Action's delivery token.
- */
-import { type SandboxToolName } from "@nylorun/core/define";
-import { type Transport } from "../http.js";
-export type ActionSandboxToolResult = {
-    readonly kind: "completed";
-    readonly output: unknown;
-} | {
-    readonly kind: "failed";
-    readonly code: string;
-    readonly message: string;
-};
-export type ActionSandbox = {
-    readonly bash: (input: {
-        command: string;
-        timeout?: number;
-    }) => Promise<ActionSandboxToolResult>;
-    readonly read: (input: {
-        path: string;
-        offset?: number;
-        limit?: number;
-    }) => Promise<ActionSandboxToolResult>;
-    readonly write: (input: {
-        path: string;
-        content: string;
-    }) => Promise<ActionSandboxToolResult>;
-    readonly edit: (input: {
-        path: string;
-        old_string: string;
-        new_string: string;
-        replace_all?: boolean;
-    }) => Promise<ActionSandboxToolResult>;
-    readonly grep: (input: {
-        pattern: string;
-        path?: string;
-        glob?: string;
-        ignore_case?: boolean;
-        max_results?: number;
-    }) => Promise<ActionSandboxToolResult>;
-    readonly glob: (input: {
-        pattern: string;
-        path?: string;
-    }) => Promise<ActionSandboxToolResult>;
-};
-export type CreateActionSandboxOptions = {
-    /** The transport's key is the delivery token, which names the Action and its generation. */
-    readonly transport: Transport;
-    readonly actionId: string;
-    readonly signal?: AbortSignal;
-};
-/** Build `ctx.sandbox` for one delivered action. Callers skip it when the session has none. */
-export declare function createActionSandbox(options: CreateActionSandboxOptions): ActionSandbox;
-export declare function isActionSandboxTool(name: string): name is SandboxToolName;
-/** True when the executable declares a sandbox the Runtime can share. */
-export declare function definitionDeclaresSandbox(manifest: {
-    kind?: string;
-    sandbox?: unknown;
-    capabilities?: readonly {
-        sandbox?: unknown;
-    }[];
-}): boolean;

package/dist/sandbox/client.js

@@ -1,29 +0,0 @@
-/**
- * Action-scoped sandbox client (`ctx.sandbox`). Calls `POST /v1/actions/:id/sandbox/:tool`
- * over a transport whose credential is the Action's delivery token.
- */
-import { SANDBOX_TOOL_NAMES, } from "@nylorun/core/define";
-import { segment } from "../http.js";
-/** Build `ctx.sandbox` for one delivered action. Callers skip it when the session has none. */
-export function createActionSandbox(options) {
-    const call = (tool, input) => options.transport.json(`/v1/actions/${segment(options.actionId)}/sandbox/${tool}`, "POST", input, options.signal);
-    const sandbox = {
-        bash: (input) => call("bash", input),
-        read: (input) => call("read", input),
-        write: (input) => call("write", input),
-        edit: (input) => call("edit", input),
-        grep: (input) => call("grep", input),
-        glob: (input) => call("glob", input),
-    };
-    // Freeze so tools cannot replace built-ins.
-    return Object.freeze(sandbox);
-}
-export function isActionSandboxTool(name) {
-    return SANDBOX_TOOL_NAMES.includes(name);
-}
-/** True when the executable declares a sandbox the Runtime can share. */
-export function definitionDeclaresSandbox(manifest) {
-    if (manifest.kind === "workflow")
-        return manifest.sandbox !== undefined;
-    return (manifest.capabilities ?? []).some((item) => item.sandbox !== undefined);
-}

package/dist/sandbox/index.d.ts

@@ -1,2 +0,0 @@
-export { createActionSandbox, definitionDeclaresSandbox, isActionSandboxTool, } from "./client.js";
-export type { ActionSandbox, ActionSandboxToolResult, CreateActionSandboxOptions, } from "./client.js";

package/dist/sandbox/index.js

@@ -1 +0,0 @@
-export { createActionSandbox, definitionDeclaresSandbox, isActionSandboxTool, } from "./client.js";

package/dist/served-definitions.d.ts

@@ -1,20 +0,0 @@
-import { type BuiltWorkflow } from "@nylorun/core/define";
-import { type AgentSource } from "./client.js";
-import type { ExecutableDefinition } from "./execute-action.js";
-/** The implementation version to register: the option, `NYLORUN_IMPLEMENTATION_VERSION`, or `dev`. */
-export declare function implementationVersionOf(options: {
-    implementationVersion?: string;
-}): string;
-/** The ids among `agents` that are saved only as part of another definition. */
-export declare function embeddedIn(agents: Map<string, ExecutableDefinition>): ReadonlySet<string>;
-/**
- * Every definition `sources` serves, by id: the agents and workflows passed in, the agents
- * a v2 workflow embeds, and flow agents used as tools. `owner` names the caller in errors.
- */
-export declare function buildAgents(sources: readonly (AgentSource | BuiltWorkflow)[], owner: string): Map<string, ExecutableDefinition>;
-/**
- * The manifest hash served for a workflow's flow actions. A run is pinned to one workflow
- * manifest, and its stage keys may shift between deploys, so flow actions for another hash
- * are left for whoever serves it.
- */
-export declare function flowManifestHash(agent: ExecutableDefinition): string | undefined;

package/dist/served-definitions.js

@@ -1,100 +0,0 @@
-/** The definitions an application serves Actions for (`createActionHandler`). */
-import { AgentManifestSchema } from "@nylorun/core/contracts";
-import { agentFrom, delegateOf, hashManifest, isFlowDelegate, isBuiltWorkflow, } from "@nylorun/core/define";
-import { assertNoMiddlewareClosures } from "./client.js";
-import { env } from "./http.js";
-/** The implementation version to register: the option, `NYLORUN_IMPLEMENTATION_VERSION`, or `dev`. */
-export function implementationVersionOf(options) {
-    return (options.implementationVersion ??
-        env("NYLORUN_IMPLEMENTATION_VERSION") ??
-        "dev");
-}
-/** Agents embedded in a v2 workflow: served here, but saved only as part of the workflow. */
-const embeddedAgents = new WeakMap();
-/** The ids among `agents` that are saved only as part of another definition. */
-export function embeddedIn(agents) {
-    return embeddedAgents.get(agents) ?? new Set();
-}
-/**
- * Every definition `sources` serves, by id: the agents and workflows passed in, the agents
- * a v2 workflow embeds, and flow agents used as tools. `owner` names the caller in errors.
- */
-export function buildAgents(sources, owner) {
-    const agents = new Map();
-    const embedded = new Set();
-    /**
-     * Agents embedded in another definition (a v2 flow's agents, a flow agent used as a
-     * tool) may be reached from more than one place; the same definition is served once.
-     */
-    const sameAsServed = (id, manifest) => {
-        const served = agents.get(id);
-        if (!served)
-            return false;
-        if (hashManifest(served.manifest) === hashManifest(manifest))
-            return true;
-        throw new Error(`Duplicate connected agent ${id}`);
-    };
-    const addAgent = (built, shared = false) => {
-        assertNoMiddlewareClosures(built);
-        AgentManifestSchema.parse(built.manifest);
-        if (shared ? sameAsServed(built.id, built.manifest) : agents.has(built.id)) {
-            if (!shared)
-                throw new Error(`Duplicate connected agent ${built.id}`);
-            return;
-        }
-        agents.set(built.id, built);
-        for (const tool of built.getBinding().tools) {
-            const delegate = delegateOf(tool);
-            if (!delegate || !isFlowDelegate(delegate))
-                continue;
-            // A flow agent used as a tool runs in its own linked session: serve its code too.
-            if (!delegate.workflow)
-                throw new Error(`Flow agent '${delegate.manifest.id}' is used as a tool by '${built.id}' but has no local implementation`);
-            addWorkflow(delegate.workflow, true);
-            embedded.add(delegate.workflow.id);
-        }
-    };
-    const addWorkflow = (workflow, shared = false) => {
-        if (shared ? sameAsServed(workflow.id, workflow.manifest) : agents.has(workflow.id)) {
-            if (!shared)
-                throw new Error(`Duplicate connected agent ${workflow.id}`);
-            return;
-        }
-        agents.set(workflow.id, workflow);
-        const v2 = workflow.manifest.workflowSchemaVersion === 2;
-        for (const binding of Object.values(workflow.getBinding().agents)) {
-            addAgent(agentFrom(binding.manifest, binding.implementations), v2);
-            if (v2)
-                embedded.add(binding.manifest.id);
-        }
-    };
-    for (const source of sources) {
-        if (isBuiltWorkflow(source)) {
-            addWorkflow(source);
-            continue;
-        }
-        const built = source.build?.() ?? source;
-        if (isBuiltWorkflow(built)) {
-            addWorkflow(built);
-            continue;
-        }
-        addAgent(built);
-    }
-    if (!agents.size)
-        throw new Error(`${owner} requires at least one agent`);
-    // A definition passed in directly is saved on its own, even if another one embeds it.
-    for (const source of sources)
-        embedded.delete(source.id);
-    embeddedAgents.set(agents, embedded);
-    return agents;
-}
-/**
- * The manifest hash served for a workflow's flow actions. A run is pinned to one workflow
- * manifest, and its stage keys may shift between deploys, so flow actions for another hash
- * are left for whoever serves it.
- */
-export function flowManifestHash(agent) {
-    return isBuiltWorkflow(agent) && agent.manifest.workflowSchemaVersion === 2
-        ? hashManifest(agent.manifest)
-        : undefined;
-}

package/dist/token-endpoint.d.ts

@@ -1,23 +0,0 @@
-/**
- * A route for app servers that mints a subject token for the signed-in person (Host feature
- * `subject-tokens`). The browser client calls it whenever it needs a token. Mount it on your
- * app's own origin behind your sign-in: `POST` only, no CORS, never cached.
- *
- *   export const POST = createTokenEndpoint({
- *     client, role: "user", subject: (request) => userFromCookie(request)?.id,
- *   });
- */
-import type { TokenScope } from "@nylorun/core/contracts";
-import type { AgentsClient } from "./session-client.js";
-export interface TokenEndpointOptions {
-    /** The application client (the Tenant key stays on the server). */
-    client: AgentsClient | Promise<AgentsClient>;
-    /** The signed-in person the token is for; `undefined` answers 401. */
-    subject(request: Request): string | undefined | Promise<string | undefined>;
-    /** The access policy role to mint for, or a function of the request and subject. */
-    role: string | ((request: Request, subject: string) => string | Promise<string>);
-    scopes?: readonly TokenScope[];
-    agents?: readonly string[];
-    ttlSeconds?: number;
-}
-export declare function createTokenEndpoint(options: TokenEndpointOptions): (request: Request) => Promise<Response>;

package/dist/token-endpoint.js

@@ -1,30 +0,0 @@
-import { RuntimeError } from "./http.js";
-const NO_STORE = { "cache-control": "no-store" };
-export function createTokenEndpoint(options) {
-    return async (request) => {
-        if (request.method !== "POST")
-            return new Response(null, { status: 405, headers: { allow: "POST", ...NO_STORE } });
-        const subject = await options.subject(request);
-        if (!subject)
-            return Response.json({ error: "Sign in required" }, { status: 401, headers: NO_STORE });
-        const role = typeof options.role === "string"
-            ? options.role
-            : await options.role(request, subject);
-        try {
-            const client = await options.client;
-            const minted = await client.tokens.create({
-                subject,
-                role,
-                ...(options.scopes ? { scopes: options.scopes } : {}),
-                ...(options.agents ? { agents: options.agents } : {}),
-                ...(options.ttlSeconds === undefined ? {} : { ttlSeconds: options.ttlSeconds }),
-            });
-            return Response.json({ token: minted.token, expiresAt: minted.expiresAt }, { headers: NO_STORE });
-        }
-        catch (error) {
-            // The person sees that a token could not be issued, never the Runtime's details.
-            const status = error instanceof RuntimeError && error.status === 400 ? 403 : 502;
-            return Response.json({ error: "Could not issue a token" }, { status, headers: NO_STORE });
-        }
-    };
-}