@sjawhar/pi-legion-envoy 5.5.11 → 5.6.0

package/dist/envoy.js

@@ -34379,6 +34379,39 @@ function subscriptionRemovedTopics(raw, sessionID) {
   return parsedPayload.data.topics ?? [];
 }
 
+// ../envoy-client/src/nats-auth.ts
+var import_nats = __toESM(require_mod4(), 1);
+var seedKeys = import_nats.nkeys;
+function natsAuthOptions(env) {
+  const { NATS_NKEY_SEED_FILE: file2, NATS_NKEY_SEED: plain } = env;
+  let seed;
+  let source;
+  if (file2 !== undefined) {
+    if (file2 === "")
+      throw new Error("NATS_NKEY_SEED_FILE is set but empty");
+    seed = readSecretFile("NATS_NKEY_SEED_FILE", file2);
+    source = `NATS_NKEY_SEED_FILE (${file2})`;
+  } else if (plain !== undefined) {
+    seed = plain.trim();
+    if (seed.length === 0)
+      throw new Error("NATS_NKEY_SEED is set but empty");
+    source = "NATS_NKEY_SEED";
+  } else {
+    return {};
+  }
+  const bytes = new TextEncoder().encode(seed);
+  let publicKey;
+  try {
+    publicKey = seedKeys.fromSeed(bytes).getPublicKey();
+  } catch (error48) {
+    throw new Error(`${source} does not hold a valid nkey seed: ${messageFor(error48)}`);
+  }
+  if (!publicKey.startsWith("U")) {
+    throw new Error(`${source} holds an nkey seed that is not a user's (public key ${publicKey})`);
+  }
+  return { authenticator: import_nats.nkeyAuthenticator(bytes) };
+}
+
 // ../envoy-client/src/tool-contract.ts
 var DELIVERY_CONTRACT = "Delivery is at-least-once, possibly out of order across topics; use id for dedupe and at for freshness.";
 var TOPIC_GUIDE = "Topic guide (all are under notifications.): agent.<session_id> (subscribe: own inbox); role.<role> " + "(publish-to; holders claim via envoy_role_set). > matches one or more trailing tokens and does not " + "match the base subject. Envoy registers the concrete base when you subscribe to <subject>.>, so " + "the recommended default remains github.<owner>.<repo>.pr.<n>.>. <owner> and <repo> are one token " + "each, with every dot in the name written _ (sjawhar/.github is github.sjawhar._github; " + "acme/site.io is github.acme.site_io), and a topic spelled with the dot receives nothing. " + "Default PR subscription: " + "github.<owner>.<repo>.pr.<n>.> (it receives the quiet PR family): pr.<n> (lifecycle: " + "opened/synchronize/closed; closed carries merged, merge_commit_sha, merged_by, head_sha), " + "pr.<n>.comment, pr.<n>.review, pr.<n>.mention, pr.<n>.checks (one head-checks settlement event: " + 'passed/failed/cancelled/skipped with failing names and URLs; re-fires with superseded_settlement: "true" ' + "when new runs appear for the same head). Other GitHub: issue.<n>, issue.<n>.comment, " + "issue.<n>.mention, mention, push.branch.<name>, push.tag.<name>, workflow.<file>.<action> (only " + "runs without an associated PR); slack.<team>.<channel>.message|mention and " + "slack.<team>.<channel>.thread.<ts>.message|mention; ghostwispr.<session>.<kind>; " + "whatsapp.<phone>.<jid>.<kind>; envoy.exceptions.<original-topic>.";
@@ -34764,7 +34797,7 @@ function sourceSession(sessionID) {
 
 // extensions/envoy.ts
 import { logger } from "@oh-my-pi/pi-utils";
-var import_nats = __toESM(require_mod4(), 1);
+var import_nats2 = __toESM(require_mod4(), 1);
 
 // src/envoy-session.ts
 import path2 from "path";
@@ -34996,7 +35029,7 @@ async function copySessionID(copyToClipboard2, sessionID) {
 }
 
 // extensions/envoy.ts
-var codec2 = import_nats.StringCodec();
+var codec2 = import_nats2.StringCodec();
 var NATS_RETRY_INTERVAL_MS = 15000;
 var CAPABILITIES_WITHOUT_BTW = DELIVERY_CAPABILITIES.filter((capability) => capability !== "btw");
 var ROLE_CLAIM_ENTRY = "envoy-role-claim";
@@ -35201,9 +35234,10 @@ function envoyExtension(pi) {
   const ensureConnection = async () => {
     if (connection?.isClosed() === false)
       return connection;
-    connection = await import_nats.connect({
+    connection = await import_nats2.connect({
       servers: [...defaults.natsUrls],
       name: `omp-${sessionID || "unknown"}`,
+      ...natsAuthOptions(process.env),
       reconnect: true,
       maxReconnectAttempts: -1,
       reconnectTimeWait: 2000

package/dist/legion.js

@@ -16136,13 +16136,63 @@ function messageFor(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
-// extensions/legion.ts
+// ../envoy-client/src/nats-auth.ts
 var import_nats = __toESM(require_mod4(), 1);
+
+// ../envoy-client/src/secret-file.ts
+import { readFileSync } from "fs";
+function readSecretFile(variable, filePath) {
+  let contents;
+  try {
+    contents = readFileSync(filePath, "utf8");
+  } catch (error) {
+    throw new Error(`${variable} names ${filePath}, which could not be read: ${messageFor(error)}`);
+  }
+  const value = contents.trim();
+  if (value.length === 0)
+    throw new Error(`${variable} names ${filePath}, which is empty`);
+  return value;
+}
+
+// ../envoy-client/src/nats-auth.ts
+var seedKeys = import_nats.nkeys;
+function natsAuthOptions(env) {
+  const { NATS_NKEY_SEED_FILE: file, NATS_NKEY_SEED: plain } = env;
+  let seed;
+  let source;
+  if (file !== undefined) {
+    if (file === "")
+      throw new Error("NATS_NKEY_SEED_FILE is set but empty");
+    seed = readSecretFile("NATS_NKEY_SEED_FILE", file);
+    source = `NATS_NKEY_SEED_FILE (${file})`;
+  } else if (plain !== undefined) {
+    seed = plain.trim();
+    if (seed.length === 0)
+      throw new Error("NATS_NKEY_SEED is set but empty");
+    source = "NATS_NKEY_SEED";
+  } else {
+    return {};
+  }
+  const bytes = new TextEncoder().encode(seed);
+  let publicKey;
+  try {
+    publicKey = seedKeys.fromSeed(bytes).getPublicKey();
+  } catch (error) {
+    throw new Error(`${source} does not hold a valid nkey seed: ${messageFor(error)}`);
+  }
+  if (!publicKey.startsWith("U")) {
+    throw new Error(`${source} holds an nkey seed that is not a user's (public key ${publicKey})`);
+  }
+  return { authenticator: import_nats.nkeyAuthenticator(bytes) };
+}
+
+// extensions/legion.ts
+var import_nats2 = __toESM(require_mod4(), 1);
 import { logger } from "@oh-my-pi/pi-utils";
 // package.json
 var package_default = {
   name: "@sjawhar/pi-legion-envoy",
-  version: "5.5.11",
+  version: "5.6.0",
   type: "module",
   omp: {
     extensions: [
@@ -30957,21 +31007,6 @@ function zodSchemaApi(zod) {
     }
   };
 }
-// ../envoy-client/src/secret-file.ts
-import { readFileSync } from "fs";
-function readSecretFile(variable, filePath) {
-  let contents;
-  try {
-    contents = readFileSync(filePath, "utf8");
-  } catch (error48) {
-    throw new Error(`${variable} names ${filePath}, which could not be read: ${messageFor(error48)}`);
-  }
-  const value = contents.trim();
-  if (value.length === 0)
-    throw new Error(`${variable} names ${filePath}, which is empty`);
-  return value;
-}
-
 // src/legion/classify.ts
 function classifySession(env) {
   if (env.LEGION_CONTROLLER !== undefined && env.LEGION_TREE !== undefined) {
@@ -32701,7 +32736,7 @@ function legionExtension(pi) {
   const defaults = envoyDefaultsFromEnvironment(process.env);
   let controlConnection;
   let controlSubscription;
-  const controlCodec = import_nats.StringCodec();
+  const controlCodec = import_nats2.StringCodec();
   let capability;
   let bootstrap;
   const checkSubagentSession = subagentSessionCheck();
@@ -32770,9 +32805,10 @@ function legionExtension(pi) {
     if (defaults.natsUrls.length === 0) {
       throw new Error("ENVOY_NATS_URL is required for Legion control directives");
     }
-    const connection = await import_nats.connect({
+    const connection = await import_nats2.connect({
       servers: [...defaults.natsUrls],
       name: `legion-control-${sessionID}`,
+      ...natsAuthOptions(process.env),
       reconnect: true,
       maxReconnectAttempts: -1,
       reconnectTimeWait: 2000

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjawhar/pi-legion-envoy",
-  "version": "5.5.11",
+  "version": "5.6.0",
   "type": "module",
   "omp": {
     "extensions": [