@slashfi/agents-sdk 0.11.1 → 0.12.0

package/dist/agent-definitions/remote-registry.js

@@ -1,133 +1,51 @@
 /**
- * Remote Registry Agent
+ * Remote Registry Agent (JWKS Auth)
  *
  * Integration agent for connecting to remote agent registries.
- * Uses the IntegrationMethods pattern so @integrations can discover
- * and interact with it uniformly via setup/connect/list/get/update.
+ * Uses JWKS trust exchange + jwt_exchange for authentication.
+ * No client credentials stored — uses signJwt for outbound calls.
  *
- * Each remote registry connection stores:
- * - url: the registry's base URL
- * - tenantId: the tenant created on the remote registry
- * - clientId + clientSecret: credentials for authentication
+ * Flow:
+ *   setup: discover JWKS → add trusted issuer → call @auth/create_tenant → store connection
+ *   connect: POST /oauth/token jwt_exchange → identity_required → /oauth/authorize → linked
+ *   proxy: sign JWT → POST to remote MCP endpoint
  *
  * @example
  * ```typescript
- * import { createRemoteRegistryAgent, createAgentRegistry } from '@slashfi/agents-sdk';
+ * import { createRemoteRegistryAgent, createAgentServer } from '@slashfi/agents-sdk';
  *
- * const registry = createAgentRegistry();
- * registry.register(createRemoteRegistryAgent({ secretStore }));
+ * const server = createAgentServer(registry, { ... });
+ * await server.start();
  *
- * // Then via @integrations:
- * // setup_integration({ provider: 'remote-registry', params: { url: 'https://registry.slash.com', name: 'slash' } })
- * // connect_integration({ provider: 'remote-registry', params: { registryId: 'slash', userId: 'user_123' } })
+ * registry.register(createRemoteRegistryAgent({
+ *   secretStore,
+ *   signJwt: (claims) => server.signJwt(claims),
+ * }));
  * ```
  */
 import { defineAgent, defineTool } from "../define.js";
-// ============================================
-// Helpers
-// ============================================
-/**
- * Make an MCP JSON-RPC call to a remote registry.
- */
-async function mcpCall(url, token, request) {
-    const res = await globalThis.fetch(url, {
-        method: "POST",
-        headers: {
-            "Content-Type": "application/json",
-            Authorization: `Bearer ${token}`,
-        },
-        body: JSON.stringify({
-            jsonrpc: "2.0",
-            id: Date.now(),
-            method: "tools/call",
-            params: {
-                name: "call_agent",
-                arguments: {
-                    request: {
-                        action: request.action,
-                        path: request.path,
-                        tool: request.tool,
-                        params: request.params ?? {},
-                    },
-                },
-            },
-        }),
-    });
-    if (!res.ok) {
-        throw new Error(`Registry call failed: ${res.status} ${res.statusText}`);
-    }
-    const json = (await res.json());
-    if (json.error) {
-        throw new Error(`Registry RPC error: ${json.error.message ?? JSON.stringify(json.error)}`);
-    }
-    // Parse the tool result from MCP response
-    const text = json?.result?.content?.[0]?.text;
-    if (!text)
-        return json?.result;
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return { raw: text };
-    }
-}
-/**
- * Get an access token from a remote registry via /oauth/token.
- */
-async function getRegistryToken(url, clientId, clientSecret) {
-    const tokenUrl = url.replace(/\/$/, "") + "/oauth/token";
-    const res = await globalThis.fetch(tokenUrl, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-            grant_type: "client_credentials",
-            client_id: clientId,
-            client_secret: clientSecret,
-        }),
-    });
-    if (!res.ok) {
-        const body = await res.text();
-        throw new Error(`Token exchange failed: ${res.status} ${body}`);
-    }
-    const json = (await res.json());
-    return json.access_token;
-}
-// ============================================
-// Create Remote Registry Agent
-// ============================================
+const ENTITY_TYPE = "remote-registry-connections";
 export function createRemoteRegistryAgent(options) {
-    const { secretStore } = options;
-    // We store all registry connections as a single JSON blob per owner.
-    // The secret ID is stored via associate/resolveByEntity for lookup.
-    const ENTITY_TYPE = "remote-registry-connections";
-    /**
-     * Store a registry connection (metadata + credentials).
-     */
-    async function storeConnection(ownerId, conn, clientSecret) {
-        // Load existing connections, update, and store back
+    const { secretStore, signJwt, addTrustedIssuer } = options;
+    // --- Connection storage (KV via SecretStore) ---
+    async function storeConnection(ownerId, conn) {
+        console.error("[remote-registry] storeConnection for owner:", ownerId, "conn:", conn.id);
         const all = await loadAllConnections(ownerId);
-        all[conn.id] = { ...conn, clientSecret };
+        all[conn.id] = conn;
         const value = JSON.stringify(all);
-        // Store the blob
         const scope = { tenantId: ownerId };
         const secretId = await secretStore.store(value, ownerId);
-        // Link it so we can find it later
         if (secretStore.associate) {
             await secretStore.associate(secretId, ENTITY_TYPE, ownerId, scope);
         }
     }
-    /**
-     * Load all connections from the stored blob.
-     */
     async function loadAllConnections(ownerId) {
-        // Try resolveByEntity first (v0.7.0+)
+        console.error("[remote-registry] loadAllConnections for owner:", ownerId);
         if (secretStore.resolveByEntity) {
             const scope = { tenantId: ownerId };
             const secretIds = await secretStore.resolveByEntity(ENTITY_TYPE, ownerId, scope);
-            if (secretIds && secretIds.length > 0) {
-                // Resolve the latest stored blob
-                const latestId = secretIds[secretIds.length - 1];
-                const raw = await secretStore.resolve(latestId, ownerId);
+            if (secretIds?.length) {
+                const raw = await secretStore.resolve(secretIds[secretIds.length - 1], ownerId);
                 if (raw) {
                     try {
                         return JSON.parse(raw);
@@ -140,321 +58,229 @@ export function createRemoteRegistryAgent(options) {
         }
         return {};
     }
-    /**
-     * Load a registry connection.
-     */
     async function loadConnection(ownerId, registryId) {
         const all = await loadAllConnections(ownerId);
-        const entry = all[registryId];
-        if (!entry)
-            return null;
-        const { clientSecret, ...conn } = entry;
-        return { conn, clientSecret };
+        return all[registryId] ?? null;
     }
-    /**
-     * List all registry connections for an owner.
-     */
-    async function listConnectionsList(ownerId) {
-        const all = await loadAllConnections(ownerId);
-        return Object.values(all).map(({ clientSecret: _, ...conn }) => conn);
+    // --- MCP call helper ---
+    async function mcpCall(url, jwt, request) {
+        const res = await globalThis.fetch(url, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${jwt}`,
+            },
+            body: JSON.stringify({
+                jsonrpc: "2.0",
+                id: Date.now(),
+                method: "tools/call",
+                params: { name: "call_agent", arguments: { request } },
+            }),
+        });
+        const rpc = await res.json();
+        const text = rpc.result?.content?.[0]?.text;
+        return text ? JSON.parse(text) : rpc.result;
     }
-    /**
-     * Get an authenticated token for a registry connection.
-     */
-    async function getAuthenticatedToken(ownerId, registryId) {
-        const data = await loadConnection(ownerId, registryId);
-        if (!data) {
-            throw new Error(`No registry connection '${registryId}'. Use setup_integration first.`);
+    // --- Proxy: sign JWT and call remote ---
+    async function proxyCall(ownerId, registryId, request) {
+        const conn = await loadConnection(ownerId, registryId);
+        if (!conn) {
+            return { success: false, error: `No connection '${registryId}'. Use setup_integration first.` };
         }
-        const token = await getRegistryToken(data.conn.url, data.conn.clientId, data.clientSecret);
-        return { token, conn: data.conn };
+        const jwt = await signJwt({ tenantId: conn.remoteTenantId, action: "proxy", type: "agent-registry" });
+        const result = await mcpCall(conn.url, jwt, request);
+        return { success: true, result };
     }
-    // ---- Tools ----
-    const callRemoteTool = defineTool({
-        name: "call_remote",
-        description: "Make an authenticated MCP call to a remote agent registry. " +
-            "Proxies the request with the stored tenant credentials.",
+    // --- Tools ---
+    const proxyTool = defineTool({
+        name: "proxy_call",
+        description: "Proxy an MCP call to a connected remote registry.",
         visibility: "public",
         inputSchema: {
             type: "object",
             properties: {
-                registryId: {
-                    type: "string",
-                    description: "Registry connection ID",
-                },
-                agentPath: {
-                    type: "string",
-                    description: "Agent path on the remote registry (e.g. '@integrations')",
-                },
-                action: {
-                    type: "string",
-                    description: "Action to perform (e.g. 'execute_tool')",
-                },
-                tool: {
-                    type: "string",
-                    description: "Tool name to call",
-                },
-                params: {
-                    type: "object",
-                    description: "Tool parameters",
-                },
+                registryId: { type: "string", description: "Registry connection ID" },
+                action: { type: "string" },
+                path: { type: "string" },
+                tool: { type: "string" },
+                params: { type: "object" },
             },
-            required: ["registryId", "agentPath", "action", "tool"],
+            required: ["registryId", "action", "path", "tool"],
         },
-        execute: async (input, ctx) => {
-            const { token, conn } = await getAuthenticatedToken(ctx.callerId, input.registryId);
-            return mcpCall(conn.url, token, {
+        execute: async (input, _ctx) => {
+            return proxyCall("system", input.registryId, {
                 action: input.action,
-                path: input.agentPath,
+                path: input.path,
                 tool: input.tool,
                 params: input.params,
             });
         },
     });
-    const listRemoteAgentsTool = defineTool({
-        name: "list_remote_agents",
-        description: "List agents available on a remote registry.",
+    const listTool = defineTool({
+        name: "list_connections",
+        description: "List all connected remote registries.",
         visibility: "public",
-        inputSchema: {
-            type: "object",
-            properties: {
-                registryId: {
-                    type: "string",
-                    description: "Registry connection ID",
-                },
-            },
-            required: ["registryId"],
+        inputSchema: { type: "object", properties: {} },
+        execute: async (_input, _ctx) => {
+            const all = await loadAllConnections("system");
+            return {
+                connections: Object.values(all).map(c => ({
+                    id: c.id,
+                    name: c.name,
+                    url: c.url,
+                    remoteTenantId: c.remoteTenantId,
+                })),
+            };
         },
-        execute: async (input, ctx) => {
-            const { token, conn } = await getAuthenticatedToken(ctx.callerId, input.registryId);
-            const listUrl = conn.url.replace(/\/$/, "") + "/list";
-            const res = await globalThis.fetch(listUrl, {
-                headers: { Authorization: `Bearer ${token}` },
+    });
+    // Extract setup/connect as standalone functions to avoid circular reference
+    const setupFn = async (params, _ctx) => {
+        const url = params.url;
+        const name = params.name ?? "registry";
+        const oidcUserId = params.oidcUserId;
+        if (!url)
+            return { success: false, error: "url is required" };
+        try {
+            const baseUrl = url.replace(/\/$/, "");
+            // Phase 2: Complete setup after OIDC — store connection with resolved tenant
+            if (oidcUserId) {
+                const jwt = await signJwt({ sub: oidcUserId, action: "setup", type: "agent-registry" });
+                const tokenRes = await globalThis.fetch(baseUrl + "/oauth/token", {
+                    method: "POST", headers: { "Content-Type": "application/json" },
+                    body: JSON.stringify({ grant_type: "jwt_exchange", assertion: jwt, scope: "setup" }),
+                });
+                const tokenData = await tokenRes.json();
+                if (!tokenData.access_token && !tokenData.tenant_id) {
+                    return { success: false, error: tokenData.error_description ?? tokenData.error ?? "Setup completion failed" };
+                }
+                const remoteTenantId = tokenData.tenant_id ?? name;
+                const ownerId = "system";
+                await storeConnection(ownerId, { id: name, name, url: baseUrl, remoteTenantId, createdAt: Date.now() });
+                return { success: true, data: { registryId: name, url, remoteTenantId } };
+            }
+            // Phase 1: Discover JWKS, establish trust, then request OIDC
+            const configUrl = baseUrl + "/.well-known/configuration";
+            const configRes = await globalThis.fetch(configUrl);
+            if (!configRes.ok)
+                return { success: false, error: "Failed to discover registry at " + configUrl };
+            const remoteConfig = await configRes.json();
+            if (remoteConfig.jwks_uri) {
+                const jwksRes = await globalThis.fetch(remoteConfig.jwks_uri);
+                if (!jwksRes.ok)
+                    return { success: false, error: "JWKS not reachable" };
+            }
+            if (addTrustedIssuer)
+                await addTrustedIssuer(baseUrl);
+            // Request identity — atlas will return authorize URL for Slack OIDC
+            const jwt = await signJwt({ action: "setup", type: "agent-registry", targetUrl: url });
+            const tokenRes = await globalThis.fetch(baseUrl + "/oauth/token", {
+                method: "POST", headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ grant_type: "jwt_exchange", assertion: jwt, scope: "setup" }),
             });
-            if (!res.ok) {
-                throw new Error(`Failed to list agents: ${res.status}`);
+            const tokenData = await tokenRes.json();
+            // If already set up (user linked), store connection directly
+            if (tokenData.access_token) {
+                const remoteTenantId = tokenData.tenant_id ?? name;
+                const ownerId = "system";
+                await storeConnection(ownerId, { id: name, name, url: baseUrl, remoteTenantId, createdAt: Date.now() });
+                return { success: true, data: { registryId: name, url, remoteTenantId } };
             }
-            return res.json();
-        },
-    });
-    // ---- Agent Definition ----
+            // Need OIDC — return authorize URL to caller
+            if (tokenData.error === "identity_required") {
+                return { success: false, error: "identity_required", data: { authorizeUrl: tokenData.authorize_url, registryId: name, url } };
+            }
+            return { success: false, error: tokenData.error_description ?? tokenData.error ?? "Unexpected response from token endpoint" };
+        }
+        catch (err) {
+            return { success: false, error: err instanceof Error ? err.message : String(err) };
+        }
+    };
+    const connectFn = async (params, ctx) => {
+        const registryId = params.registryId;
+        const redirectUri = params.redirectUri ?? "";
+        const oidcUserId = params.oidcUserId;
+        if (!registryId)
+            return { success: false, error: "registryId is required" };
+        try {
+            const ownerId = "system"; // tenant-scoped
+            const conn = await loadConnection(ownerId, registryId);
+            if (!conn)
+                return { success: false, error: "No connection '" + registryId + "'" };
+            // Use OIDC-issued identity if available, never send "anonymous" as sub
+            const sub = oidcUserId ?? (ctx.callerId !== "anonymous" ? ctx.callerId : undefined);
+            const jwt = await signJwt({ ...(sub ? { sub } : {}), tenantId: conn.remoteTenantId, action: "connect", type: "agent-registry" });
+            const tokenRes = await globalThis.fetch(conn.url + "/oauth/token", {
+                method: "POST", headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ grant_type: "jwt_exchange", assertion: jwt, redirect_uri: redirectUri }),
+            });
+            const tokenData = await tokenRes.json();
+            if (tokenData.access_token)
+                return { success: true, data: { registryId, accessToken: tokenData.access_token, userId: tokenData.user_id, tenantId: tokenData.tenant_id } };
+            if (tokenData.error === "identity_required")
+                return { success: false, error: "identity_required", data: { authorizeUrl: tokenData.authorize_url, tenantId: tokenData.tenant_id } };
+            return { success: false, error: tokenData.error_description ?? tokenData.error ?? "Token exchange failed" };
+        }
+        catch (err) {
+            return { success: false, error: err instanceof Error ? err.message : String(err) };
+        }
+    };
     return defineAgent({
         path: "@remote-registry",
         entrypoint: "You manage connections to remote agent registries. " +
-            "Use setup to connect a new registry, connect to register users, " +
-            "and call_remote to proxy authenticated MCP calls.",
+            "Use setup to connect a new registry, connect to link user identities, " +
+            "and proxy_call to make authenticated calls.",
         config: {
             name: "Remote Registry",
-            description: "Connect to remote agent registries (MCP over HTTP) for federated integrations",
+            description: "Connect to remote agent registries via JWKS trust + jwt_exchange",
             supportedActions: ["execute_tool", "describe_tools", "load"],
-            integration: {
-                provider: "remote-registry",
-                displayName: "Agent Registry",
-                icon: "server",
-                category: "infrastructure",
-                description: "Connect to a remote agent registry to access its integrations, databases, and agents.",
-            },
         },
         visibility: "public",
-        integrationMethods: {
-            async setup(params, ctx) {
-                const url = params.url;
-                const name = params.name ?? "registry";
-                if (!url) {
-                    return { success: false, error: "url is required" };
-                }
+        integration: {
+            provider: "remote-registry",
+            displayName: "Agent Registry",
+            icon: "server",
+            category: "infrastructure",
+            description: "Connect to a remote agent registry via JWKS trust exchange.",
+            setup: (params, ctx) => setupFn(params, ctx),
+            connect: (params, ctx) => connectFn(params, ctx),
+            async discover(params) {
+                const url = params.url ?? "";
                 try {
-                    // 1. Create tenant on remote registry
-                    const setupUrl = url.replace(/\/$/, "") + "/setup";
-                    const setupRes = await globalThis.fetch(setupUrl, {
-                        method: "POST",
-                        headers: { "Content-Type": "application/json" },
-                        body: JSON.stringify({ tenant: name }),
-                    });
-                    if (!setupRes.ok) {
-                        const body = await setupRes.text();
-                        return {
-                            success: false,
-                            error: `Failed to create tenant on registry: ${setupRes.status} ${body}`,
-                        };
-                    }
-                    const setupResult = (await setupRes.json());
-                    if (!setupResult.success || !setupResult.result?.tenantId) {
-                        return {
-                            success: false,
-                            error: "Registry /setup did not return a tenantId",
-                        };
-                    }
-                    const remoteTenantId = setupResult.result.tenantId;
-                    // 2. Register a client for this tenant
-                    // Use the setup token (or root key) to create client credentials
-                    const token = setupResult.result.token;
-                    if (!token) {
-                        return {
-                            success: false,
-                            error: "Registry /setup did not return a token for client creation",
-                        };
-                    }
-                    const registerResult = await mcpCall(url, token, {
-                        action: "execute_tool",
-                        path: "@auth",
-                        tool: "register",
-                        params: {
-                            name: `${name}-client`,
-                            scopes: ["integrations", "secrets", "users"],
-                        },
-                    });
-                    const clientId = registerResult?.clientId ?? registerResult?.result?.clientId;
-                    const clientSecret = registerResult?.clientSecret?.value ??
-                        registerResult?.result?.clientSecret?.value ??
-                        registerResult?.clientSecret;
-                    if (!clientId || !clientSecret) {
-                        return {
-                            success: false,
-                            error: `Failed to register client: ${JSON.stringify(registerResult)}`,
-                        };
-                    }
-                    // 3. Store connection
-                    const conn = {
-                        id: name,
-                        name,
-                        url: url.replace(/\/$/, ""),
-                        remoteTenantId,
-                        clientId,
-                        createdAt: Date.now(),
-                    };
-                    await storeConnection(ctx.callerId, conn, clientSecret);
-                    return {
-                        success: true,
-                        data: {
-                            registryId: name,
-                            url: conn.url,
-                            remoteTenantId,
-                            clientId,
-                        },
-                    };
+                    const res = await globalThis.fetch(url.replace(/\/$/, "") + "/.well-known/configuration");
+                    if (!res.ok)
+                        return { success: false, error: "No configuration endpoint at " + url };
+                    const config = await res.json();
+                    return { success: true, data: { url, issuer: config.issuer, grantTypes: config.supported_grant_types, jwksUri: config.jwks_uri } };
                 }
                 catch (err) {
-                    return {
-                        success: false,
-                        error: err instanceof Error ? err.message : String(err),
-                    };
+                    return { success: false, error: err instanceof Error ? err.message : String(err) };
                 }
             },
-            async connect(params, ctx) {
-                const registryId = params.registryId;
-                const userId = params.userId ?? ctx.callerId;
-                if (!registryId) {
-                    return { success: false, error: "registryId is required" };
-                }
-                try {
-                    const { token, conn } = await getAuthenticatedToken(ctx.callerId, registryId);
-                    // Register user on the remote registry
-                    const result = await mcpCall(conn.url, token, {
-                        action: "execute_tool",
-                        path: "@users",
-                        tool: "create_user",
-                        params: { name: userId, tenantId: conn.remoteTenantId },
-                    });
-                    return {
-                        success: true,
-                        data: {
-                            registryId,
-                            userId,
-                            remoteUser: result,
-                        },
-                    };
-                }
-                catch (err) {
-                    return {
-                        success: false,
-                        error: err instanceof Error ? err.message : String(err),
-                    };
-                }
-            },
-            async list(_params, ctx) {
-                try {
-                    const conns = await listConnectionsList(ctx.callerId);
-                    return {
-                        success: true,
-                        data: conns.map((c) => ({
-                            id: c.id,
-                            name: c.name,
-                            url: c.url,
-                            remoteTenantId: c.remoteTenantId,
-                            createdAt: c.createdAt,
-                        })),
-                    };
-                }
-                catch (err) {
-                    return {
-                        success: false,
-                        error: err instanceof Error ? err.message : String(err),
-                    };
-                }
+            async list() {
+                const all = await loadAllConnections("system");
+                return { success: true, data: { connections: Object.values(all).map(c => ({ id: c.id, name: c.name, url: c.url, remoteTenantId: c.remoteTenantId })) } };
             },
-            async get(params, ctx) {
-                const registryId = params.registryId;
-                if (!registryId) {
-                    return { success: false, error: "registryId is required" };
-                }
-                try {
-                    const data = await loadConnection(ctx.callerId, registryId);
-                    if (!data) {
-                        return {
-                            success: false,
-                            error: `No registry connection '${registryId}'`,
-                        };
-                    }
-                    return {
-                        success: true,
-                        data: {
-                            id: data.conn.id,
-                            name: data.conn.name,
-                            url: data.conn.url,
-                            remoteTenantId: data.conn.remoteTenantId,
-                            clientId: data.conn.clientId,
-                            createdAt: data.conn.createdAt,
-                        },
-                    };
-                }
-                catch (err) {
-                    return {
-                        success: false,
-                        error: err instanceof Error ? err.message : String(err),
-                    };
-                }
+            async get(params) {
+                const id = params.registryId ?? "";
+                const conn = await loadConnection("system", id);
+                if (!conn)
+                    return { success: false, error: "No connection '" + id + "'" };
+                return { success: true, data: conn };
             },
-            async update(params, ctx) {
-                const registryId = params.registryId;
-                if (!registryId) {
-                    return { success: false, error: "registryId is required" };
-                }
-                try {
-                    const data = await loadConnection(ctx.callerId, registryId);
-                    if (!data) {
-                        return {
-                            success: false,
-                            error: `No registry connection '${registryId}'`,
-                        };
-                    }
-                    // Update mutable fields
-                    if (params.name)
-                        data.conn.name = params.name;
-                    if (params.url)
-                        data.conn.url = params.url.replace(/\/$/, "");
-                    await storeConnection(ctx.callerId, data.conn, data.clientSecret);
-                    return { success: true, data: { id: data.conn.id, updated: true } };
-                }
-                catch (err) {
-                    return {
-                        success: false,
-                        error: err instanceof Error ? err.message : String(err),
-                    };
-                }
+            async update(params) {
+                const id = params.registryId ?? "";
+                const conn = await loadConnection("system", id);
+                if (!conn)
+                    return { success: false, error: "No connection '" + id + "'" };
+                if (params.name)
+                    conn.name = params.name;
+                if (params.url)
+                    conn.url = params.url;
+                await storeConnection("system", conn);
+                return { success: true, data: conn };
             },
         },
-        tools: [callRemoteTool, listRemoteAgentsTool],
+        tools: [proxyTool, listTool],
     });
 }
 //# sourceMappingURL=remote-registry.js.map