@slashfi/agents-sdk 0.34.1 → 0.36.0

package/dist/cjs/server.js

@@ -33,9 +33,14 @@ exports.createAgentServer = createAgentServer;
 const secrets_js_1 = require("./agent-definitions/secrets.js");
 const bm25_js_1 = require("./bm25.js");
 const jwt_js_1 = require("./jwt.js");
-const jwt_js_2 = require("./jwt.js");
 const oidc_signin_js_1 = require("./oidc-signin.js");
 const call_agent_schema_js_1 = require("./call-agent-schema.js");
+const types_js_1 = require("./types.js");
+function parseProxyCallerType(raw) {
+    if (raw === "agent" || raw === "user" || raw === "system")
+        return raw;
+    return "agent";
+}
 // Auth governance — single source of truth for visibility/access control
 var auth_governance_js_1 = require("./auth-governance.js");
 Object.defineProperty(exports, "hasAdminScope", { enumerable: true, get: function () { return auth_governance_js_1.hasAdminScope; } });
@@ -115,7 +120,7 @@ async function resolveAuth(req, authConfig, jwksOptions) {
     if (parts.length === 3 && jwksOptions?.signingKeys?.length) {
         for (const key of jwksOptions.signingKeys) {
             try {
-                const verified = await (0, jwt_js_2.verifyJwtLocal)(credential, key.publicKey);
+                const verified = await (0, jwt_js_1.verifyJwtLocal)(credential, key.publicKey);
                 if (verified) {
                     return {
                         callerId: verified.sub ?? verified.name ?? "unknown",
@@ -138,7 +143,7 @@ async function resolveAuth(req, authConfig, jwksOptions) {
             if (unverified.iss) {
                 const issuerConfig = jwksOptions.trustedIssuers.find((i) => i.issuer === unverified.iss);
                 if (issuerConfig) {
-                    const verified = await (0, jwt_js_2.verifyJwtFromIssuer)(credential, issuerConfig.issuer);
+                    const verified = await (0, jwt_js_1.verifyJwtFromIssuer)(credential, issuerConfig.issuer);
                     if (verified) {
                         const scopes = issuerConfig.scopes;
                         const isSystem = scopes.includes("*") || scopes.includes("agents:admin");
@@ -260,8 +265,12 @@ function createAgentServer(registry, options = {}) {
                         ...(options.registry && {
                             registry: {
                                 version: options.registry.version ?? "1.0",
-                                ...(options.registry.features && { features: options.registry.features }),
-                                ...(options.registry.oauthCallbackUrl && { oauthCallbackUrl: options.registry.oauthCallbackUrl }),
+                                ...(options.registry.features && {
+                                    features: options.registry.features,
+                                }),
+                                ...(options.registry.oauthCallbackUrl && {
+                                    oauthCallbackUrl: options.registry.oauthCallbackUrl,
+                                }),
                             },
                         }),
                     },
@@ -297,7 +306,7 @@ function createAgentServer(registry, options = {}) {
                 // Validate + strip nulls (OpenAI convention: null = absent)
                 const parsed = callAgentValidate.safeParse(args);
                 const req = (parsed.success
-                    ? parsed.data.request ?? parsed.data
+                    ? (parsed.data.request ?? parsed.data)
                     : (args.request ?? args));
                 // Inject auth context
                 if (auth) {
@@ -313,94 +322,97 @@ function createAgentServer(registry, options = {}) {
                     req.callerType = "system";
                 }
                 // Process secret params: resolve refs, store raw secrets
-                if (req.params && secretStore) {
+                if (req.action === "execute_tool" && req.params && secretStore) {
+                    const execReq = req;
                     const ownerId = auth?.callerId ?? "anonymous";
-                    const agent = registry.get(req.path);
-                    const tool = agent?.tools.find((t) => t.name === req.tool);
+                    const agent = registry.get(execReq.path);
+                    const tool = agent?.tools.find((t) => t.name === execReq.tool);
                     const schema = tool?.inputSchema;
-                    const { resolved } = await (0, secrets_js_1.processSecretParams)(req.params, schema, secretStore, ownerId);
-                    req.params = resolved;
+                    const { resolved } = await (0, secrets_js_1.processSecretParams)(execReq.params, schema, secretStore, ownerId);
+                    execReq.params = resolved;
                 }
                 const result = await registry.call(req);
                 return mcpResult(result);
             }
             case "list_agents": {
-                const { query: listQuery, limit: listLimit, cursor: listCursor } = listAgentsValidate.parse(args);
-                const agents = registry.list();
-                let visible = agents.filter((agent) => (0, auth_governance_js_2.canSeeAgent)(agent, auth));
-                // Decode cursor if provided
-                const after = listCursor
-                    ? JSON.parse(Buffer.from(listCursor, "base64url").toString())
-                    : undefined;
-                const pageSize = listLimit ?? 20;
-                let page;
-                let nextCursor;
-                if (listQuery) {
-                    // BM25 search — ranked by score desc, path asc for tie-breaking
-                    const docs = visible.map((agent, i) => ({
-                        id: String(i),
-                        text: [
-                            agent.path,
-                            agent.config?.name ?? "",
-                            agent.config?.description ?? "",
-                            ...agent.tools
-                                .filter((t) => (0, auth_governance_js_2.canSeeTool)(t, auth))
-                                .map((t) => `${t.name} ${t.description}`),
-                        ].join(" "),
-                    }));
-                    const index = (0, bm25_js_1.createBM25Index)(docs);
-                    const ranked = index.search(listQuery);
-                    let scored = ranked.map((r) => ({
-                        ...visible[Number(r.id)],
-                        _score: r.score,
-                    }));
-                    // Apply cursor: skip past the after position
-                    if (after?.score !== undefined) {
-                        scored = scored.filter((a) => a._score < after.score ||
-                            (a._score === after.score && a.path > after.path));
-                    }
-                    page = scored.slice(0, pageSize);
-                    if (scored.length > pageSize) {
-                        const last = scored[pageSize - 1];
-                        nextCursor = Buffer.from(JSON.stringify({ path: last.path, score: last._score })).toString("base64url");
-                    }
-                }
-                else {
-                    // Alphabetical listing — sorted by path
-                    visible.sort((a, b) => a.path.localeCompare(b.path));
-                    // Apply cursor: skip past afterPath
-                    if (after) {
-                        visible = visible.filter((a) => a.path > after.path);
+                const { query: listQuery, limit: listLimit, cursor: listCursor, } = listAgentsValidate.parse(args);
+                const result = await registry.listAgents({ query: listQuery, limit: listLimit, cursor: listCursor }, async (allAgents) => {
+                    let visible = allAgents.filter((agent) => (0, auth_governance_js_2.canSeeAgent)(agent, auth));
+                    // Decode cursor if provided
+                    const after = listCursor
+                        ? JSON.parse(Buffer.from(listCursor, "base64url").toString())
+                        : undefined;
+                    const pageSize = listLimit ?? 20;
+                    let page;
+                    let nextCursor;
+                    if (listQuery) {
+                        // BM25 search — ranked by score desc, path asc for tie-breaking
+                        const docs = visible.map((agent, i) => ({
+                            id: String(i),
+                            text: [
+                                agent.path,
+                                agent.config?.name ?? "",
+                                agent.config?.description ?? "",
+                                ...agent.tools
+                                    .filter((t) => (0, auth_governance_js_2.canSeeTool)(t, auth))
+                                    .map((t) => `${t.name} ${t.description}`),
+                            ].join(" "),
+                        }));
+                        const index = (0, bm25_js_1.createBM25Index)(docs);
+                        const ranked = index.search(listQuery);
+                        let scored = ranked.map((r) => ({
+                            ...visible[Number(r.id)],
+                            _score: r.score,
+                        }));
+                        // Apply cursor: skip past the after position
+                        if (after?.score !== undefined) {
+                            scored = scored.filter((a) => a._score < after.score ||
+                                (a._score === after.score && a.path > after.path));
+                        }
+                        page = scored.slice(0, pageSize);
+                        if (scored.length > pageSize) {
+                            const last = scored[pageSize - 1];
+                            nextCursor = Buffer.from(JSON.stringify({ path: last.path, score: last._score })).toString("base64url");
+                        }
                     }
-                    page = visible.slice(0, pageSize);
-                    if (visible.length > pageSize) {
-                        const last = page[page.length - 1];
-                        nextCursor = Buffer.from(JSON.stringify({ path: last.path })).toString("base64url");
+                    else {
+                        // Alphabetical listing — sorted by path
+                        visible.sort((a, b) => a.path.localeCompare(b.path));
+                        // Apply cursor: skip past afterPath
+                        if (after) {
+                            visible = visible.filter((a) => a.path > after.path);
+                        }
+                        page = visible.slice(0, pageSize);
+                        if (visible.length > pageSize) {
+                            const last = page[page.length - 1];
+                            nextCursor = Buffer.from(JSON.stringify({ path: last.path })).toString("base64url");
+                        }
                     }
-                }
-                return mcpResult({
-                    success: true,
-                    total: agents.filter((a) => (0, auth_governance_js_2.canSeeAgent)(a, auth)).length,
-                    nextCursor,
-                    agents: page.map((agent) => ({
-                        path: agent.path,
-                        name: agent.config?.name,
-                        description: agent.config?.description,
-                        supportedActions: agent.config?.supportedActions,
-                        integration: agent.config?.integration || null,
-                        security: agent.config?.security
-                            ? { type: agent.config.security.type }
-                            : undefined,
-                        resources: agent.config?.resources?.map((r) => ({
-                            uri: r.uri,
-                            name: r.name,
-                            mimeType: r.mimeType,
+                    return {
+                        success: true,
+                        total: allAgents.filter((a) => (0, auth_governance_js_2.canSeeAgent)(a, auth)).length,
+                        nextCursor,
+                        agents: page.map((agent) => ({
+                            path: agent.path,
+                            name: agent.config?.name,
+                            description: agent.config?.description,
+                            supportedActions: agent.config?.supportedActions,
+                            integration: agent.config?.integration || null,
+                            security: agent.config?.security
+                                ? { type: agent.config.security.type }
+                                : undefined,
+                            resources: agent.config?.resources?.map((r) => ({
+                                uri: r.uri,
+                                name: r.name,
+                                mimeType: r.mimeType,
+                            })),
+                            tools: agent.tools
+                                .filter((t) => (0, auth_governance_js_2.canSeeTool)(t, auth))
+                                .map((t) => t.name),
                         })),
-                        tools: agent.tools
-                            .filter((t) => (0, auth_governance_js_2.canSeeTool)(t, auth))
-                            .map((t) => t.name),
-                    })),
+                    };
                 });
+                return mcpResult(result);
             }
             default:
                 throw new Error(`Unknown tool: ${toolName}`);
@@ -459,15 +471,20 @@ function createAgentServer(registry, options = {}) {
                     params: { token: assertion },
                     callerType: "system",
                 });
-                const exchangeResult = result?.result;
-                // If the tool call failed, forward the error
-                if (result?.success === false) {
+                if ((0, types_js_1.isCallAgentErrorResponse)(result)) {
                     return jsonResponse({
                         error: "server_error",
-                        error_description: result?.error ?? "Exchange tool failed",
+                        error_description: result.error ?? "Exchange tool failed",
                         raw: JSON.stringify(result)?.slice(0, 300),
                     }, 500);
                 }
+                if (!("result" in result)) {
+                    return jsonResponse({
+                        error: "server_error",
+                        error_description: `Unexpected exchange response: ${JSON.stringify(result)?.slice(0, 300)}`,
+                    }, 500);
+                }
+                const exchangeResult = result.result;
                 // ── Reverse registration: if caller is an agent-registry, auto-store connection ──
                 try {
                     const assertionParts = assertion.split(".");
@@ -508,7 +525,7 @@ function createAgentServer(registry, options = {}) {
                     }, 500);
                 }
                 // User not linked yet — needs OAuth identity linking
-                if (exchangeResult.needsAuth) {
+                if ((0, types_js_1.isExchangeTokenNeedsIdentity)(exchangeResult)) {
                     const baseUrl = resolveBaseUrl(req);
                     const authorizeUrl = new URL(`${baseUrl}${basePath}/oauth/authorize`);
                     authorizeUrl.searchParams.set("token", assertion);
@@ -526,9 +543,10 @@ function createAgentServer(registry, options = {}) {
                     }, 403);
                 }
                 // User found — sign a local access token
-                if (exchangeResult.userId && serverSigningKeys.length > 0) {
+                if ((0, types_js_1.isExchangeTokenLinkedSuccess)(exchangeResult) &&
+                    serverSigningKeys.length > 0) {
                     const sigKey = serverSigningKeys[0];
-                    const token = await (0, jwt_js_2.signJwtES256)({
+                    const token = await (0, jwt_js_1.signJwtES256)({
                         sub: exchangeResult.userId,
                         name: exchangeResult.userId,
                         scopes: ["*"],
@@ -570,8 +588,20 @@ function createAgentServer(registry, options = {}) {
                     params: { clientId, clientSecret },
                     callerType: "system",
                 });
-                const tokenResult = result?.result;
-                if (!tokenResult?.accessToken) {
+                if ((0, types_js_1.isCallAgentErrorResponse)(result)) {
+                    return jsonResponse({
+                        error: "invalid_client",
+                        error_description: result.error ?? "Authentication failed",
+                    }, 401);
+                }
+                if (!("result" in result)) {
+                    return jsonResponse({
+                        error: "invalid_client",
+                        error_description: "Authentication failed",
+                    }, 401);
+                }
+                const tokenResult = result.result;
+                if (tokenResult.accessToken == null) {
                     return jsonResponse({
                         error: "invalid_client",
                         error_description: "Authentication failed",
@@ -622,7 +652,7 @@ function createAgentServer(registry, options = {}) {
                     if (actorId) {
                         return {
                             callerId: actorId,
-                            callerType: actorType ?? "agent",
+                            callerType: parseProxyCallerType(actorType),
                             scopes: ["*"],
                             claims: {},
                         };
@@ -685,7 +715,7 @@ function createAgentServer(registry, options = {}) {
                 console.log("[oauth/authorize] storeIssuers:", storeIssuers.length, "configIssuers:", configIssuerUrls.length, "total:", allIssuerUrls.length, "urls:", allIssuerUrls);
                 for (const issuerUrl of allIssuerUrls) {
                     try {
-                        const result = await (0, jwt_js_2.verifyJwtFromIssuer)(token, issuerUrl);
+                        const result = await (0, jwt_js_1.verifyJwtFromIssuer)(token, issuerUrl);
                         console.log("[oauth/authorize] verify", issuerUrl, "->", result ? "OK" : "null");
                         if (result) {
                             claims = result;
@@ -693,7 +723,7 @@ function createAgentServer(registry, options = {}) {
                         }
                     }
                     catch (e) {
-                        console.log("[oauth/authorize] verify", issuerUrl, "-> ERROR:", e.message);
+                        console.log("[oauth/authorize] verify", issuerUrl, "-> ERROR:", e instanceof Error ? e.message : String(e));
                     }
                 }
                 if (!claims) {
@@ -740,28 +770,11 @@ function createAgentServer(registry, options = {}) {
             // ── GET /.well-known/jwks.json → JWKS public keys ──
             if (path === "/.well-known/jwks.json" && req.method === "GET") {
                 const jwks = serverSigningKeys.length > 0
-                    ? await (0, jwt_js_2.buildJwks)(serverSigningKeys)
+                    ? await (0, jwt_js_1.buildJwks)(serverSigningKeys)
                     : { keys: [] };
                 const res = jsonResponse(jwks);
                 return cors ? addCors(res) : res;
             }
-            // ── GET /.well-known/configuration → Server discovery (deprecated, use MCP initialize capabilities) ──
-            if (path === "/.well-known/configuration" && req.method === "GET") {
-                const baseUrl = resolveBaseUrl(req);
-                const res = jsonResponse({
-                    issuer: baseUrl,
-                    jwks_uri: `${baseUrl}/.well-known/jwks.json`,
-                    token_endpoint: `${baseUrl}/oauth/token`,
-                    agents_endpoint: `${baseUrl}/list`,
-                    call_endpoint: baseUrl,
-                    supported_grant_types: ["client_credentials", "jwt_exchange"],
-                    authorization_endpoint: `${baseUrl}/oauth/authorize`,
-                    ...(oidcSignIn
-                        ? { signin_endpoint: `${baseUrl}/signin/authorize` }
-                        : {}),
-                });
-                return cors ? addCors(res) : res;
-            }
             // ── GET /.well-known/oauth-authorization-server → OAuth Server Metadata (RFC 8414) ──
             // Only exposed when the server requires auth (private registries).
             // Public registries (e.g. registry.slash.com) skip this entirely.
@@ -778,7 +791,11 @@ function createAgentServer(registry, options = {}) {
                     token_endpoint: `${baseUrl}/oauth/token`,
                     jwks_uri: `${baseUrl}/.well-known/jwks.json`,
                     response_types_supported: ["code"],
-                    grant_types_supported: ["authorization_code", "client_credentials", "jwt_exchange"],
+                    grant_types_supported: [
+                        "authorization_code",
+                        "client_credentials",
+                        "jwt_exchange",
+                    ],
                     code_challenge_methods_supported: ["S256"],
                     token_endpoint_auth_methods_supported: ["client_secret_post", "none"],
                     ...(options.registry?.oauthCallbackUrl && {
@@ -787,78 +804,6 @@ function createAgentServer(registry, options = {}) {
                 });
                 return cors ? addCors(res) : res;
             }
-            // ── GET /list → List agents (──
-            if (path === "/list" && req.method === "GET") {
-                const agents = registry.list();
-                let visible = agents.filter((agent) => (0, auth_governance_js_2.canSeeAgent)(agent, effectiveAuth));
-                const searchQuery = url.searchParams.get("q");
-                const searchLimit = url.searchParams.get("limit");
-                const searchCursor = url.searchParams.get("cursor");
-                // Decode cursor
-                const httpAfter = searchCursor
-                    ? JSON.parse(Buffer.from(searchCursor, "base64url").toString())
-                    : undefined;
-                const httpPageSize = searchLimit ? Number(searchLimit) : 20;
-                let httpPage;
-                let httpNextCursor;
-                if (searchQuery) {
-                    const docs = visible.map((agent, i) => ({
-                        id: String(i),
-                        text: [
-                            agent.path,
-                            agent.config?.name ?? "",
-                            agent.config?.description ?? "",
-                            ...agent.tools
-                                .filter((t) => (0, auth_governance_js_2.canSeeTool)(t, effectiveAuth))
-                                .map((t) => `${t.name} ${t.description}`),
-                        ].join(" "),
-                    }));
-                    const index = (0, bm25_js_1.createBM25Index)(docs);
-                    const ranked = index.search(searchQuery);
-                    let scored = ranked.map((r) => ({
-                        ...visible[Number(r.id)],
-                        _score: r.score,
-                    }));
-                    if (httpAfter?.score !== undefined) {
-                        scored = scored.filter((a) => a._score < httpAfter.score ||
-                            (a._score === httpAfter.score && a.path > httpAfter.path));
-                    }
-                    httpPage = scored.slice(0, httpPageSize);
-                    if (scored.length > httpPageSize) {
-                        const last = scored[httpPageSize - 1];
-                        httpNextCursor = Buffer.from(JSON.stringify({ path: last.path, score: last._score })).toString("base64url");
-                    }
-                }
-                else {
-                    visible.sort((a, b) => a.path.localeCompare(b.path));
-                    if (httpAfter) {
-                        visible = visible.filter((a) => a.path > httpAfter.path);
-                    }
-                    httpPage = visible.slice(0, httpPageSize);
-                    if (visible.length > httpPageSize) {
-                        const last = httpPage[httpPage.length - 1];
-                        httpNextCursor = Buffer.from(JSON.stringify({ path: last.path })).toString("base64url");
-                    }
-                }
-                const res = jsonResponse({
-                    total: agents.filter((a) => (0, auth_governance_js_2.canSeeAgent)(a, effectiveAuth)).length,
-                    nextCursor: httpNextCursor,
-                    agents: httpPage.map((agent) => ({
-                        path: agent.path,
-                        name: agent.config?.name,
-                        description: agent.config?.description,
-                        supportedActions: agent.config?.supportedActions,
-                        integration: agent.config?.integration || null,
-                        tools: agent.tools
-                            .filter((t) => (0, auth_governance_js_2.canSeeTool)(t, effectiveAuth))
-                            .map((t) => ({
-                            name: t.name,
-                            description: t.description,
-                        })),
-                    })),
-                });
-                return cors ? addCors(res) : res;
-            }
             // ── GET /agents → List public agents (discovery endpoint) ──
             if (path === "/agents" && req.method === "GET") {
                 const agents = registry.list();
@@ -872,7 +817,7 @@ function createAgentServer(registry, options = {}) {
                     path: agent.path,
                     name: agent.config?.name,
                     description: agent.config?.description ?? agent.entrypoint?.slice(0, 200),
-                    mode: agent.mode ?? 'direct',
+                    mode: agent.mode ?? "direct",
                     ...(agent.upstream && { upstream: agent.upstream }),
                     tools: (0, auth_governance_js_2.getVisibleTools)(agent, effectiveAuth).map((t) => ({
                         name: t.name,
@@ -893,7 +838,7 @@ function createAgentServer(registry, options = {}) {
                     path: agent.path,
                     name: agent.config?.name,
                     description: agent.config?.description ?? agent.entrypoint?.slice(0, 200),
-                    mode: agent.mode ?? 'direct',
+                    mode: agent.mode ?? "direct",
                     ...(agent.upstream && { upstream: agent.upstream }),
                     tools: (0, auth_governance_js_2.getVisibleTools)(agent, effectiveAuth).map((t) => ({
                         name: t.name,
@@ -1045,14 +990,14 @@ function createAgentServer(registry, options = {}) {
             else if (authConfig?.store && serverSigningKeys.length === 0) {
                 const stored = (await authConfig.store.getSigningKeys()) ?? [];
                 for (const exported of stored) {
-                    serverSigningKeys.push(await (0, jwt_js_2.importSigningKey)(exported));
+                    serverSigningKeys.push(await (0, jwt_js_1.importSigningKey)(exported));
                 }
             }
             if (serverSigningKeys.length === 0) {
-                const key = await (0, jwt_js_2.generateSigningKey)();
+                const key = await (0, jwt_js_1.generateSigningKey)();
                 serverSigningKeys.push(key);
                 if (authConfig?.store) {
-                    await authConfig.store.storeSigningKey(await (0, jwt_js_2.exportSigningKey)(key));
+                    await authConfig.store.storeSigningKey(await (0, jwt_js_1.exportSigningKey)(key));
                 }
             }
         },
@@ -1079,7 +1024,13 @@ function createAgentServer(registry, options = {}) {
                 throw new Error("No signing keys available. Call start() or initKeys() first.");
             }
             const key = serverSigningKeys[0];
-            return (0, jwt_js_2.signJwtES256)({ sub: "system", name: "atlas-os", scopes: ["*"], ...claims }, key.privateKey, key.kid, options.serverName ?? "agents-sdk", claims.exp != null ? undefined : "1h");
+            const payload = {
+                sub: "system",
+                name: "atlas-os",
+                scopes: ["*"],
+                ...claims,
+            };
+            return (0, jwt_js_1.signJwtES256)(payload, key.privateKey, key.kid, options.serverName ?? "agents-sdk", claims.exp != null ? undefined : "1h");
         },
         async resolveAuth(req) {
             const customAuth = options.resolveAuth