@rebyteai/agent-server 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Rebyte, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,26 @@
+# @rebyteai/agent-server
+
+Install the versioned package (no repository clone required):
+
+```sh
+pnpm add @rebyteai/agent-server@0.2.0
+```
+
+
+A shared Hono application proxy for the Node and Cloudflare App Kit examples.
+
+```ts
+import { createAgentApp } from '@rebyteai/agent-server'
+const app = createAgentApp({ apiKey: process.env.REBYTE_API_KEY!,
+  agentId: process.env.REBYTE_AGENT_ID! })
+```
+
+`/api/sessions` creates hosted Sessions for the configured saved Agent. Routes
+proxy retrieval, deletion, live events, input submission, Items, Turns, Artifact
+list/download and inline file upload. The upload limit is 5 MiB. Event submission
+requires `Idempotency-Key`. API errors retain their HTTP status.
+
+This is an example boundary, not an authentication framework. Mount behind login
+and authorize every Session against the current user in your application. The
+included Agent-ID check only prevents use of a different Agent. Keys stay on the
+server. [Architecture](../../docs/architecture.md).

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+import * as hono_types from 'hono/types';
+import { Hono } from 'hono';
+
+interface AgentAppOptions {
+    apiKey: string;
+    agentId: string;
+    baseURL?: string | undefined;
+}
+/** Same-origin example proxy. Mount behind your application's user authentication. */
+declare function createAgentApp(options: AgentAppOptions): Hono<hono_types.BlankEnv, hono_types.BlankSchema, "/">;
+
+export { type AgentAppOptions, createAgentApp };

package/dist/index.js

@@ -0,0 +1,122 @@
+// src/index.ts
+import { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import Rebyte, { rebyteSandbox } from "@rebyteai/agent-sdk";
+var maxFileSize = 5 * 1024 * 1024;
+var invalid = (message) => new HTTPException(400, { message });
+function createAgentApp(options) {
+  if (!options.apiKey || !options.agentId) throw new Error("API key and Agent ID are required");
+  const client = new Rebyte({ apiKey: options.apiKey, baseURL: options.baseURL, maxRetries: 0 });
+  const sessions = client.beta.agents.sessions;
+  const app = new Hono();
+  async function owned(id) {
+    const session = await sessions.retrieve(id);
+    if (session.agent.id !== options.agentId) throw new HTTPException(404, { message: "Session not found" });
+    return session;
+  }
+  app.get("/api/health", (c) => c.json({ ok: true, api: "agents", agentId: options.agentId }));
+  app.post("/api/sessions", async (c) => {
+    const session = await sessions.create({ agent_id: options.agentId, environment: rebyteSandbox() });
+    return c.json(session, 201);
+  });
+  app.get("/api/sessions/:id", async (c) => c.json(await owned(c.req.param("id"))));
+  app.delete("/api/sessions/:id", async (c) => {
+    await owned(c.req.param("id"));
+    return c.json(await sessions.delete(c.req.param("id")));
+  });
+  app.get("/api/sessions/:id/events", async (c) => {
+    await owned(c.req.param("id"));
+    const response = await sessions.events.stream(c.req.param("id"), { signal: c.req.raw.signal }).asResponse();
+    return new Response(response.body, { headers: {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache, no-transform",
+      "X-Accel-Buffering": "no"
+    } });
+  });
+  app.post("/api/sessions/:id/events", async (c) => {
+    await owned(c.req.param("id"));
+    const body = await c.req.json();
+    if (!body || typeof body !== "object" || !("events" in body) || !Array.isArray(body.events)) throw invalid("events must be an array");
+    const key = c.req.header("Idempotency-Key");
+    if (!key) throw invalid("Idempotency-Key is required");
+    await sessions.events.create(c.req.param("id"), { events: body.events, "Idempotency-Key": key });
+    return c.body(null, 204);
+  });
+  app.get("/api/sessions/:id/items", async (c) => {
+    await owned(c.req.param("id"));
+    const items = [];
+    for await (const item of sessions.items.list(c.req.param("id"), { order: "asc", limit: 100 })) items.push(item);
+    return c.json({ data: items });
+  });
+  app.get("/api/sessions/:id/turns", async (c) => {
+    await owned(c.req.param("id"));
+    const turns = [];
+    for await (const turn of sessions.turns.list(c.req.param("id"), { order: "asc", limit: 100 })) turns.push(turn);
+    return c.json({ data: turns });
+  });
+  app.get("/api/sessions/:id/artifacts", async (c) => {
+    await owned(c.req.param("id"));
+    const artifacts = [];
+    for await (const artifact of sessions.artifacts.list(c.req.param("id"), { order: "asc", limit: 100 })) artifacts.push(artifact);
+    return c.json({ data: artifacts });
+  });
+  app.get("/api/sessions/:id/artifacts/:artifactId/content", async (c) => {
+    await owned(c.req.param("id"));
+    const params = { session_id: c.req.param("id") };
+    const artifact = await sessions.artifacts.retrieve(c.req.param("artifactId"), params);
+    const response = await sessions.artifacts.content(artifact.id, params);
+    return new Response(response.body, { headers: {
+      "Content-Type": "application/octet-stream",
+      "Content-Disposition": `attachment; filename*=UTF-8''${encodeURIComponent(artifact.path.split("/").at(-1))}`,
+      "Cache-Control": "private, no-store"
+    } });
+  });
+  app.post("/api/sessions/:id/files", async (c) => {
+    const session = await owned(c.req.param("id"));
+    if (session.environment.type !== "openai_hosted") throw invalid("Session has no managed environment");
+    const filename = c.req.query("filename");
+    if (!filename || !filename.trim() || /[\\/\x00-\x1f]/.test(filename) || filename.length > 200) throw invalid("Invalid filename");
+    const length = c.req.header("Content-Length");
+    if (length !== void 0 && (!/^\d+$/.test(length) || Number(length) > maxFileSize)) throw new HTTPException(413, { message: "File exceeds the 5 MiB upload limit" });
+    if (!c.req.raw.body) throw invalid("File body is required");
+    const reader = c.req.raw.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        size += value.length;
+        if (size > maxFileSize) {
+          await reader.cancel();
+          throw new HTTPException(413, { message: "File exceeds the 5 MiB upload limit" });
+        }
+        chunks.push(value);
+      }
+    } finally {
+      reader.releaseLock();
+    }
+    const path = `/workspace/uploads/${crypto.randomUUID()}/${filename}`;
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.length;
+    }
+    let binary = "";
+    for (let i = 0; i < bytes.length; i += 8192) binary += String.fromCharCode(...bytes.subarray(i, i + 8192));
+    const file = await client.beta.agents.environments.files.create(session.environment.id, { type: "inline", path, data: btoa(binary) });
+    return c.json({ ...file, session_id: session.id, filename, content_type: c.req.header("Content-Type") ?? "application/octet-stream", max_file_size: maxFileSize }, 201);
+  });
+  app.onError((error, c) => {
+    if (error instanceof HTTPException) return c.json({ error: { message: error.message } }, error.status);
+    if (error instanceof SyntaxError) return c.json({ error: { message: "Invalid JSON" } }, 400);
+    if (error instanceof Rebyte.APIError) return c.json({ error: { message: error.message, code: error.code } }, error.status >= 400 && error.status < 600 ? error.status : 502);
+    console.error("Agents app request failed", error);
+    return c.json({ error: { message: "The example server failed" } }, 500);
+  });
+  return app;
+}
+export {
+  createAgentApp
+};

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@rebyteai/agent-server",
+  "version": "0.2.0",
+  "type": "module",
+  "license": "MIT",
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "hono": "^4.9.9",
+    "@rebyteai/agent-sdk": "0.2.0"
+  },
+  "devDependencies": {
+    "tsup": "^8.5.0",
+    "typescript": "^5.9.3"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ReByteAI/rebyte-agent-toolkit.git",
+    "directory": "packages/server"
+  },
+  "scripts": {
+    "build": "tsup src/index.ts --format esm --dts --clean",
+    "typecheck": "tsc --noEmit"
+  }
+}