@stacknet/stacks 0.1.2 → 0.2.0

package/dist/streaming/index.js

@@ -1,13 +1,9 @@
-var m={"Content-Type":"text/event-stream","Cache-Control":"no-cache",Connection:"keep-alive"};async function*S(i){if(!i.body)throw new Error("Response body is null");let t=i.body.getReader(),r=new TextDecoder,n="",e={};try{for(;;){let{done:a,value:o}=await t.read();if(a)break;n+=r.decode(o,{stream:!0});let s=n.split(`
-`);n=s.pop()||"";for(let c of s){if(c===""){e.data!==void 0&&(yield e),e={};continue}if(c.startsWith(":"))continue;let u=c.indexOf(":");if(u===-1)continue;let f=c.slice(0,u),l=c.slice(u+1).trimStart();switch(f){case "event":e.event=l;break;case "data":try{e.data=JSON.parse(l);}catch{e.data=l;}break;case "id":e.id=l;break;case "retry":e.retry=parseInt(l,10);break}}}e.data!==void 0&&(yield e);}finally{t.releaseLock();}}function h(i,t){let r=new TextEncoder,n=new ReadableStream({async start(e){try{for await(let a of i){let o="";a.event&&(o+=`event: ${a.event}
-`),a.id&&(o+=`id: ${a.id}
-`),a.retry&&(o+=`retry: ${a.retry}
-`);let s=typeof a.data=="string"?a.data:JSON.stringify(a.data);o+=`data: ${s}
+var m={"Content-Type":"text/event-stream","Cache-Control":"no-cache",Connection:"keep-alive"};var S=1024*1024;function f(a){return a.replace(/[\r\n\u2028\u2029]/g," ")}async function*y(a){if(!a.body)throw new Error("Response body is null");let t=a.body.getReader(),n=new TextDecoder,r="",e={};try{for(;;){let{done:o,value:i}=await t.read();if(o)break;if(r+=n.decode(i,{stream:!0}),r.length>S)throw new Error(`SSE buffer exceeded ${S} bytes without an event delimiter`);let s=r.split(`
+`);r=s.pop()||"";for(let c of s){if(c===""){e.data!==void 0&&(yield e),e={};continue}if(c.startsWith(":"))continue;let p=c.indexOf(":");if(p===-1)continue;let g=c.slice(0,p),l=c.slice(p+1).trimStart();switch(g){case "event":e.event=l;break;case "data":try{e.data=JSON.parse(l);}catch{e.data=l;}break;case "id":e.id=l;break;case "retry":e.retry=parseInt(l,10);break}}}e.data!==void 0&&(yield e);}finally{t.releaseLock();}}function h(a){let t="";a.event&&(t+=`event: ${f(a.event)}
+`),a.id&&(t+=`id: ${f(a.id)}
+`),a.retry!==void 0&&Number.isFinite(a.retry)&&(t+=`retry: ${Math.floor(a.retry)}
+`);let n=typeof a.data=="string"?a.data:JSON.stringify(a.data);for(let r of n.split(/\r?\n/))t+=`data: ${r}
+`;return t+=`
+`,t}function E(a,t){let n=new TextEncoder,r=new ReadableStream({async start(e){try{for await(let o of a)e.enqueue(n.encode(h(o)));}catch(o){console.error("SSE stream error:",o);}finally{e.close();}}});return new Response(r,{headers:{...m,...t}})}var d=class{encoder=new TextEncoder;controller=null;stream;constructor(){this.stream=new ReadableStream({start:t=>{this.controller=t;}});}getStream(){return this.stream}getResponse(t){return new Response(this.stream,{headers:{...m,...t}})}write(t){this.controller&&this.controller.enqueue(this.encoder.encode(h(t)));}writeData(t){this.write({data:t});}writeComment(t){if(!this.controller)return;let n=f(t);this.controller.enqueue(this.encoder.encode(`: ${n}
 
-`,e.enqueue(r.encode(o));}}catch(a){console.error("SSE stream error:",a);}finally{e.close();}}});return new Response(n,{headers:{...m,...t}})}var d=class{encoder=new TextEncoder;controller=null;stream;constructor(){this.stream=new ReadableStream({start:t=>{this.controller=t;}});}getStream(){return this.stream}getResponse(t){return new Response(this.stream,{headers:{...m,...t}})}write(t){if(!this.controller)return;let r="";t.event&&(r+=`event: ${t.event}
-`),t.id&&(r+=`id: ${t.id}
-`);let n=typeof t.data=="string"?t.data:JSON.stringify(t.data);r+=`data: ${n}
-
-`,this.controller.enqueue(this.encoder.encode(r));}writeData(t){this.write({data:t});}writeComment(t){this.controller&&this.controller.enqueue(this.encoder.encode(`: ${t}
-
-`));}close(){this.controller&&(this.controller.close(),this.controller=null);}error(t){this.controller&&(this.controller.error(t),this.controller=null);}};function g(){return new d}var p=class{constructor(t){this.dataStream=t;}processToolCalls(t){if(!(!t||t.length===0))for(let r of t)try{let n=JSON.parse(r.function.arguments),e=r.function.name;switch(e){case "create_document":this.handleCreateDocument(n,r.id);break;case "update_document":this.handleUpdateDocument(n,r.id);break;default:console.log(`[ComponentStream] Unknown tool: ${e}`);}}catch(n){console.error("[ComponentStream] Error processing tool call:",n);}}processToolResult(t){try{t.type==="artifact"?this.handleArtifactResult(t):t.type==="artifact_update"&&this.handleArtifactUpdate(t);}catch(r){console.error("[ComponentStream] Error processing tool result:",r);}}streamArtifact(t){this.dataStream.write({type:"data-kind",data:t.kind,transient:true}),this.dataStream.write({type:"data-id",data:t.id,transient:true}),this.dataStream.write({type:"data-title",data:t.title,transient:true}),this.dataStream.write({type:"data-clear",data:null,transient:true}),this.streamContent(t.content),this.dataStream.write({type:"data-finish",data:null,transient:true});}streamTextDelta(t){this.dataStream.write({type:"data-textDelta",data:t,transient:true});}streamContent(t,r=50){let n=this.splitIntoChunks(t,r);for(let e of n)this.dataStream.write({type:"data-textDelta",data:e,transient:true});}finish(){this.dataStream.write({type:"data-finish",data:null,transient:true});}handleCreateDocument(t,r){let{title:n,kind:e,content:a}=t,o=`doc_${Date.now()}_${Math.random().toString(36).substr(2,9)}`;console.log(`[ComponentStream] Creating document: ${n} (${e})`),this.streamArtifact({id:o,kind:e,title:n,content:a}),this.dataStream.write({type:"tool-result",data:{toolCallId:r,toolName:"create_document",result:{id:o,title:n,kind:e,message:"Document created successfully"}}});}handleUpdateDocument(t,r){let{id:n,description:e,content:a}=t;console.log(`[ComponentStream] Updating document: ${n}`),this.dataStream.write({type:"data-clear",data:null,transient:true}),this.streamContent(a),this.dataStream.write({type:"data-finish",data:null,transient:true}),this.dataStream.write({type:"tool-result",data:{toolCallId:r,toolName:"update_document",result:{id:n,message:`Document updated: ${e}`}}});}handleArtifactResult(t){let{id:r,title:n,kind:e,content:a}=t;if(!r||!n||!e||!a){console.error("[ComponentStream] Invalid artifact result:",t);return}this.streamArtifact({id:r,kind:e,title:n,content:a});}handleArtifactUpdate(t){let{content:r}=t;if(!r){console.error("[ComponentStream] Invalid artifact update:",t);return}this.dataStream.write({type:"data-clear",data:null,transient:true}),this.streamContent(r),this.dataStream.write({type:"data-finish",data:null,transient:true});}splitIntoChunks(t,r){let n=[],e=t.split(" "),a="";for(let o=0;o<e.length;o++){let s=o===0?e[o]:" "+e[o];a.length+s.length>r&&a.length>0?(n.push(a),a=s.trim()):a+=s;}return a.length>0&&n.push(a),n}};function y(i){return !!(i?.tool_calls&&Array.isArray(i.tool_calls)&&i.tool_calls.length>0)}function E(i){try{let t=JSON.parse(i);if(t.type&&(t.type==="artifact"||t.type==="artifact_update"))return [t]}catch{}return []}function v(i){return new p(i)}export{p as ComponentStreamAdapter,d as SSEWriter,v as createComponentStreamAdapter,h as createSSEResponse,g as createSSEWriter,E as extractToolResults,y as hasToolCalls,S as parseSSEStream};
+`));}close(){this.controller&&(this.controller.close(),this.controller=null);}error(t){this.controller&&(this.controller.error(t),this.controller=null);}};function w(){return new d}var u=class{constructor(t){this.dataStream=t;}processToolCalls(t){if(!(!t||t.length===0))for(let n of t)try{let r=JSON.parse(n.function.arguments),e=n.function.name;switch(e){case "create_document":this.handleCreateDocument(r,n.id);break;case "update_document":this.handleUpdateDocument(r,n.id);break;default:console.log(`[ComponentStream] Unknown tool: ${e}`);}}catch(r){console.error("[ComponentStream] Error processing tool call:",r);}}processToolResult(t){try{t.type==="artifact"?this.handleArtifactResult(t):t.type==="artifact_update"&&this.handleArtifactUpdate(t);}catch(n){console.error("[ComponentStream] Error processing tool result:",n);}}streamArtifact(t){this.dataStream.write({type:"data-kind",data:t.kind,transient:true}),this.dataStream.write({type:"data-id",data:t.id,transient:true}),this.dataStream.write({type:"data-title",data:t.title,transient:true}),this.dataStream.write({type:"data-clear",data:null,transient:true}),this.streamContent(t.content),this.dataStream.write({type:"data-finish",data:null,transient:true});}streamTextDelta(t){this.dataStream.write({type:"data-textDelta",data:t,transient:true});}streamContent(t,n=50){let r=this.splitIntoChunks(t,n);for(let e of r)this.dataStream.write({type:"data-textDelta",data:e,transient:true});}finish(){this.dataStream.write({type:"data-finish",data:null,transient:true});}handleCreateDocument(t,n){let{title:r,kind:e,content:o}=t,i=`doc_${Date.now()}_${Math.random().toString(36).substr(2,9)}`;console.log(`[ComponentStream] Creating document: ${r} (${e})`),this.streamArtifact({id:i,kind:e,title:r,content:o}),this.dataStream.write({type:"tool-result",data:{toolCallId:n,toolName:"create_document",result:{id:i,title:r,kind:e,message:"Document created successfully"}}});}handleUpdateDocument(t,n){let{id:r,description:e,content:o}=t;console.log(`[ComponentStream] Updating document: ${r}`),this.dataStream.write({type:"data-clear",data:null,transient:true}),this.streamContent(o),this.dataStream.write({type:"data-finish",data:null,transient:true}),this.dataStream.write({type:"tool-result",data:{toolCallId:n,toolName:"update_document",result:{id:r,message:`Document updated: ${e}`}}});}handleArtifactResult(t){let{id:n,title:r,kind:e,content:o}=t;if(!n||!r||!e||!o){console.error("[ComponentStream] Invalid artifact result:",t);return}this.streamArtifact({id:n,kind:e,title:r,content:o});}handleArtifactUpdate(t){let{content:n}=t;if(!n){console.error("[ComponentStream] Invalid artifact update:",t);return}this.dataStream.write({type:"data-clear",data:null,transient:true}),this.streamContent(n),this.dataStream.write({type:"data-finish",data:null,transient:true});}splitIntoChunks(t,n){let r=[],e=t.split(" "),o="";for(let i=0;i<e.length;i++){let s=i===0?e[i]:" "+e[i];o.length+s.length>n&&o.length>0?(r.push(o),o=s.trim()):o+=s;}return o.length>0&&r.push(o),r}};function R(a){return !!(a?.tool_calls&&Array.isArray(a.tool_calls)&&a.tool_calls.length>0)}function A(a){try{let t=JSON.parse(a);if(t.type&&(t.type==="artifact"||t.type==="artifact_update"))return [t]}catch{}return []}function v(a){return new u(a)}export{u as ComponentStreamAdapter,d as SSEWriter,v as createComponentStreamAdapter,E as createSSEResponse,w as createSSEWriter,A as extractToolResults,R as hasToolCalls,y as parseSSEStream};

package/dist/types/index.d.cts

@@ -1,4 +1,4 @@
-export { A as ALL_CAPABILITIES_BITMASK, c as ActionProof, d as AddPointsInput, e as Agent, f as AgentCreateInput, g as AgentExecuteRequest, h as AgentExecuteResponse, i as AgentFromPromptInput, j as AgentResponse, k as AgentTrigger, l as AgentUpdateInput, m as AgentWorkflow, n as AgentWorkflowEdge, o as AgentWorkflowNode, p as AgentsClientConfig, q as AgentsListResponse, r as AllowlistConfig, s as AllowlistMode, t as AllowlistUpdateInput, u as AuthMetrics, B as BillingClientConfig, v as BillingPlan, w as BillingPlansResponse, x as BillingPortalResponse, y as BillingState, z as BillingTier, C as CAPABILITY_BITS, D as CapabilityKey, E as ChatCompletionChunk, F as ChatCompletionRequest, G as ChatCompletionResponse, H as CommentResponse, I as CommentsResponse, J as ConfigureOAuthInput, K as ConfigureStripeInput, L as ConfigureWeb3Input, M as ConsensusStateSummary, N as ConsensusStatus, O as ContextDomain, P as ContextResponse, Q as ContextsListResponse, R as CreateCheckoutSessionResponse, S as CreateContextInput, U as CreateDelegationInput, V as CreateDomainInput, W as CreateKeyResponse, X as CreatePostInput, Y as CreatePostResponse, Z as CreateStackRequest, _ as Delegation, $ as DelegationChainLink, a0 as DelegationFilters, a1 as DelegationResponse, a2 as DelegationScope, a3 as DelegationsListResponse, a4 as DomainResponse, a5 as DomainsListResponse, a6 as FeedResponse, a7 as FileUploadResponse, a8 as FilesClientConfig, a9 as HistoryFilters, aa as HistoryResponse, ab as ImaginationCharacter, ac as ImaginationMetadata, ad as ImaginationSource, ae as InitNetworkResponse, af as LeaderStatus, ag as LikeCheckResponse, ah as LikeResponse, ai as MCPContent, aj as MCPMessage, ak as MCPSession, al as MCPSessionConfig, am as MCPToolResult, an as MPCNode, ao as MagmaFile, ap as MediaType, aq as Message, ar as MeteredUsage, as as ModelLayerInfo, at as ModelLayersResponse, au as NetworkClientConfig, av as NetworkStatus, br as Orientation, aw as PaginationMeta, bs as PaymentMethod, ax as PaymentRequiredResponse, ay as PointBalance, az as PointContext, aA as PointRecord, aB as PointRecordResponse, aC as PointSpend, aD as PointSpendResponse, aE as PointsClientConfig, aF as PostResponse, aG as ProfileResponse, aH as RemixesResponse, aI as Skill, aJ as SkillCreateInput, bp as SkillMapPromptResponse, bo as SkillMapResponse, aK as SkillResponse, bq as SkillSummaryResponse, aL as SkillUpdateInput, bn as SkillVerifyResponse, aM as SkillsClientConfig, aN as SkillsListResponse, aO as SocialAuthor, aP as SocialClientConfig, aQ as SocialComment, aR as SocialPost, aS as SocialRemix, bt as SolPrepaidResult, bu as SolSubscriptionResult, aT as SpendDestination, aU as SpendPointsInput, aV as StackCapabilities, aW as StackConfig, aX as StackKeyInfo, aY as StackKeysListResponse, aZ as StackListResponse, a_ as StackManagementClientConfig, a$ as StackMember, b0 as StackMemberStats, b1 as StackModelAlias, b2 as StackOAuthProvider, b3 as StackResponse, b4 as StackStripeProvider, b5 as StackWeb3Provider, b6 as TaskPayload, b7 as TaskResponse, a as TaskState, b as TaskStatus, T as TaskType, bv as TopupResult, b8 as UsageRecord, b9 as UserClientConfig, ba as UserProfile, bb as UserProfileResponse, bc as UserProfileUpdateInput, bd as Widget, be as WidgetCreateInput, bf as WidgetResponse, bg as WidgetSystemPromptResponse, bh as WidgetUpdateInput, bi as WidgetsClientConfig, bj as WidgetsListResponse, bk as WorkflowData, bl as bitmaskToCapabilities, bm as capabilitiesToBitmask } from '../billing-BqscteyZ.cjs';
+export { A as ALL_CAPABILITIES_BITMASK, c as ActionProof, d as AddPointsInput, e as Agent, f as AgentCreateInput, g as AgentExecuteRequest, h as AgentExecuteResponse, i as AgentFromPromptInput, j as AgentResponse, k as AgentTrigger, l as AgentUpdateInput, m as AgentWorkflow, n as AgentWorkflowEdge, o as AgentWorkflowNode, p as AgentsClientConfig, q as AgentsListResponse, r as AllowlistConfig, s as AllowlistMode, t as AllowlistUpdateInput, u as AuthMetrics, B as BillingClientConfig, v as BillingPlan, w as BillingPlansResponse, x as BillingPortalResponse, y as BillingState, z as BillingTier, C as CAPABILITY_BITS, D as CapabilityKey, E as ChatCompletionChunk, F as ChatCompletionRequest, G as ChatCompletionResponse, H as CommentResponse, I as CommentsResponse, J as ConfigureOAuthInput, K as ConfigureStripeInput, L as ConfigureWeb3Input, M as ConsensusStateSummary, N as ConsensusStatus, O as ContextDomain, P as ContextResponse, Q as ContextsListResponse, R as CreateCheckoutSessionResponse, S as CreateContextInput, U as CreateDelegationInput, V as CreateDomainInput, W as CreateKeyResponse, X as CreatePostInput, Y as CreatePostResponse, Z as CreateStackRequest, _ as Delegation, $ as DelegationChainLink, a0 as DelegationFilters, a1 as DelegationResponse, a2 as DelegationScope, a3 as DelegationsListResponse, a4 as DomainResponse, a5 as DomainsListResponse, a6 as FeedResponse, a7 as FileUploadResponse, a8 as FilesClientConfig, a9 as HistoryFilters, aa as HistoryResponse, ab as ImaginationCharacter, ac as ImaginationMetadata, ad as ImaginationSource, ae as InitNetworkResponse, af as LeaderStatus, ag as LikeCheckResponse, ah as LikeResponse, ai as MCPContent, aj as MCPMessage, ak as MCPSession, al as MCPSessionConfig, am as MCPToolResult, an as MPCNode, ao as MagmaFile, ap as MediaType, aq as Message, ar as MeteredUsage, as as ModelLayerInfo, at as ModelLayersResponse, au as NetworkClientConfig, av as NetworkStatus, br as Orientation, aw as PaginationMeta, bs as PaymentMethod, ax as PaymentRequiredResponse, ay as PointBalance, az as PointContext, aA as PointRecord, aB as PointRecordResponse, aC as PointSpend, aD as PointSpendResponse, aE as PointsClientConfig, aF as PostResponse, aG as ProfileResponse, aH as RemixesResponse, aI as Skill, aJ as SkillCreateInput, bp as SkillMapPromptResponse, bo as SkillMapResponse, aK as SkillResponse, bq as SkillSummaryResponse, aL as SkillUpdateInput, bn as SkillVerifyResponse, aM as SkillsClientConfig, aN as SkillsListResponse, aO as SocialAuthor, aP as SocialClientConfig, aQ as SocialComment, aR as SocialPost, aS as SocialRemix, bt as SolPrepaidResult, bu as SolSubscriptionResult, aT as SpendDestination, aU as SpendPointsInput, aV as StackCapabilities, aW as StackConfig, aX as StackKeyInfo, aY as StackKeysListResponse, aZ as StackListResponse, a_ as StackManagementClientConfig, a$ as StackMember, b0 as StackMemberStats, b1 as StackModelAlias, b2 as StackOAuthProvider, b3 as StackResponse, b4 as StackStripeProvider, b5 as StackWeb3Provider, b6 as TaskPayload, b7 as TaskResponse, a as TaskState, b as TaskStatus, T as TaskType, bv as TopupResult, b8 as UsageRecord, b9 as UserClientConfig, ba as UserProfile, bb as UserProfileResponse, bc as UserProfileUpdateInput, bd as Widget, be as WidgetCreateInput, bf as WidgetResponse, bg as WidgetSystemPromptResponse, bh as WidgetUpdateInput, bi as WidgetsClientConfig, bj as WidgetsListResponse, bk as WorkflowData, bl as bitmaskToCapabilities, bm as capabilitiesToBitmask } from '../billing-eQZIWeNW.cjs';
 
 /**
  * Coder type definitions

package/dist/types/index.d.ts

@@ -1,4 +1,4 @@
-export { A as ALL_CAPABILITIES_BITMASK, c as ActionProof, d as AddPointsInput, e as Agent, f as AgentCreateInput, g as AgentExecuteRequest, h as AgentExecuteResponse, i as AgentFromPromptInput, j as AgentResponse, k as AgentTrigger, l as AgentUpdateInput, m as AgentWorkflow, n as AgentWorkflowEdge, o as AgentWorkflowNode, p as AgentsClientConfig, q as AgentsListResponse, r as AllowlistConfig, s as AllowlistMode, t as AllowlistUpdateInput, u as AuthMetrics, B as BillingClientConfig, v as BillingPlan, w as BillingPlansResponse, x as BillingPortalResponse, y as BillingState, z as BillingTier, C as CAPABILITY_BITS, D as CapabilityKey, E as ChatCompletionChunk, F as ChatCompletionRequest, G as ChatCompletionResponse, H as CommentResponse, I as CommentsResponse, J as ConfigureOAuthInput, K as ConfigureStripeInput, L as ConfigureWeb3Input, M as ConsensusStateSummary, N as ConsensusStatus, O as ContextDomain, P as ContextResponse, Q as ContextsListResponse, R as CreateCheckoutSessionResponse, S as CreateContextInput, U as CreateDelegationInput, V as CreateDomainInput, W as CreateKeyResponse, X as CreatePostInput, Y as CreatePostResponse, Z as CreateStackRequest, _ as Delegation, $ as DelegationChainLink, a0 as DelegationFilters, a1 as DelegationResponse, a2 as DelegationScope, a3 as DelegationsListResponse, a4 as DomainResponse, a5 as DomainsListResponse, a6 as FeedResponse, a7 as FileUploadResponse, a8 as FilesClientConfig, a9 as HistoryFilters, aa as HistoryResponse, ab as ImaginationCharacter, ac as ImaginationMetadata, ad as ImaginationSource, ae as InitNetworkResponse, af as LeaderStatus, ag as LikeCheckResponse, ah as LikeResponse, ai as MCPContent, aj as MCPMessage, ak as MCPSession, al as MCPSessionConfig, am as MCPToolResult, an as MPCNode, ao as MagmaFile, ap as MediaType, aq as Message, ar as MeteredUsage, as as ModelLayerInfo, at as ModelLayersResponse, au as NetworkClientConfig, av as NetworkStatus, br as Orientation, aw as PaginationMeta, bs as PaymentMethod, ax as PaymentRequiredResponse, ay as PointBalance, az as PointContext, aA as PointRecord, aB as PointRecordResponse, aC as PointSpend, aD as PointSpendResponse, aE as PointsClientConfig, aF as PostResponse, aG as ProfileResponse, aH as RemixesResponse, aI as Skill, aJ as SkillCreateInput, bp as SkillMapPromptResponse, bo as SkillMapResponse, aK as SkillResponse, bq as SkillSummaryResponse, aL as SkillUpdateInput, bn as SkillVerifyResponse, aM as SkillsClientConfig, aN as SkillsListResponse, aO as SocialAuthor, aP as SocialClientConfig, aQ as SocialComment, aR as SocialPost, aS as SocialRemix, bt as SolPrepaidResult, bu as SolSubscriptionResult, aT as SpendDestination, aU as SpendPointsInput, aV as StackCapabilities, aW as StackConfig, aX as StackKeyInfo, aY as StackKeysListResponse, aZ as StackListResponse, a_ as StackManagementClientConfig, a$ as StackMember, b0 as StackMemberStats, b1 as StackModelAlias, b2 as StackOAuthProvider, b3 as StackResponse, b4 as StackStripeProvider, b5 as StackWeb3Provider, b6 as TaskPayload, b7 as TaskResponse, a as TaskState, b as TaskStatus, T as TaskType, bv as TopupResult, b8 as UsageRecord, b9 as UserClientConfig, ba as UserProfile, bb as UserProfileResponse, bc as UserProfileUpdateInput, bd as Widget, be as WidgetCreateInput, bf as WidgetResponse, bg as WidgetSystemPromptResponse, bh as WidgetUpdateInput, bi as WidgetsClientConfig, bj as WidgetsListResponse, bk as WorkflowData, bl as bitmaskToCapabilities, bm as capabilitiesToBitmask } from '../billing-BqscteyZ.js';
+export { A as ALL_CAPABILITIES_BITMASK, c as ActionProof, d as AddPointsInput, e as Agent, f as AgentCreateInput, g as AgentExecuteRequest, h as AgentExecuteResponse, i as AgentFromPromptInput, j as AgentResponse, k as AgentTrigger, l as AgentUpdateInput, m as AgentWorkflow, n as AgentWorkflowEdge, o as AgentWorkflowNode, p as AgentsClientConfig, q as AgentsListResponse, r as AllowlistConfig, s as AllowlistMode, t as AllowlistUpdateInput, u as AuthMetrics, B as BillingClientConfig, v as BillingPlan, w as BillingPlansResponse, x as BillingPortalResponse, y as BillingState, z as BillingTier, C as CAPABILITY_BITS, D as CapabilityKey, E as ChatCompletionChunk, F as ChatCompletionRequest, G as ChatCompletionResponse, H as CommentResponse, I as CommentsResponse, J as ConfigureOAuthInput, K as ConfigureStripeInput, L as ConfigureWeb3Input, M as ConsensusStateSummary, N as ConsensusStatus, O as ContextDomain, P as ContextResponse, Q as ContextsListResponse, R as CreateCheckoutSessionResponse, S as CreateContextInput, U as CreateDelegationInput, V as CreateDomainInput, W as CreateKeyResponse, X as CreatePostInput, Y as CreatePostResponse, Z as CreateStackRequest, _ as Delegation, $ as DelegationChainLink, a0 as DelegationFilters, a1 as DelegationResponse, a2 as DelegationScope, a3 as DelegationsListResponse, a4 as DomainResponse, a5 as DomainsListResponse, a6 as FeedResponse, a7 as FileUploadResponse, a8 as FilesClientConfig, a9 as HistoryFilters, aa as HistoryResponse, ab as ImaginationCharacter, ac as ImaginationMetadata, ad as ImaginationSource, ae as InitNetworkResponse, af as LeaderStatus, ag as LikeCheckResponse, ah as LikeResponse, ai as MCPContent, aj as MCPMessage, ak as MCPSession, al as MCPSessionConfig, am as MCPToolResult, an as MPCNode, ao as MagmaFile, ap as MediaType, aq as Message, ar as MeteredUsage, as as ModelLayerInfo, at as ModelLayersResponse, au as NetworkClientConfig, av as NetworkStatus, br as Orientation, aw as PaginationMeta, bs as PaymentMethod, ax as PaymentRequiredResponse, ay as PointBalance, az as PointContext, aA as PointRecord, aB as PointRecordResponse, aC as PointSpend, aD as PointSpendResponse, aE as PointsClientConfig, aF as PostResponse, aG as ProfileResponse, aH as RemixesResponse, aI as Skill, aJ as SkillCreateInput, bp as SkillMapPromptResponse, bo as SkillMapResponse, aK as SkillResponse, bq as SkillSummaryResponse, aL as SkillUpdateInput, bn as SkillVerifyResponse, aM as SkillsClientConfig, aN as SkillsListResponse, aO as SocialAuthor, aP as SocialClientConfig, aQ as SocialComment, aR as SocialPost, aS as SocialRemix, bt as SolPrepaidResult, bu as SolSubscriptionResult, aT as SpendDestination, aU as SpendPointsInput, aV as StackCapabilities, aW as StackConfig, aX as StackKeyInfo, aY as StackKeysListResponse, aZ as StackListResponse, a_ as StackManagementClientConfig, a$ as StackMember, b0 as StackMemberStats, b1 as StackModelAlias, b2 as StackOAuthProvider, b3 as StackResponse, b4 as StackStripeProvider, b5 as StackWeb3Provider, b6 as TaskPayload, b7 as TaskResponse, a as TaskState, b as TaskStatus, T as TaskType, bv as TopupResult, b8 as UsageRecord, b9 as UserClientConfig, ba as UserProfile, bb as UserProfileResponse, bc as UserProfileUpdateInput, bd as Widget, be as WidgetCreateInput, bf as WidgetResponse, bg as WidgetSystemPromptResponse, bh as WidgetUpdateInput, bi as WidgetsClientConfig, bj as WidgetsListResponse, bk as WorkflowData, bl as bitmaskToCapabilities, bm as capabilitiesToBitmask } from '../billing-eQZIWeNW.js';
 
 /**
  * Coder type definitions

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stacknet/stacks",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "SDK for connecting to StackNet",
   "type": "module",
   "main": "./dist/index.cjs",

package/src/clients/agents.ts

@@ -22,11 +22,25 @@ export type { AgentsClientConfig } from '../types/agent';
 export class AgentsClient {
   private baseUrl: string;
   private useCpxApi: boolean;
+  private authToken: string | null;
 
   constructor(config: AgentsClientConfig = {}) {
     this.baseUrl = config.baseUrl || DEFAULT_TASK_NETWORK_URL;
     // Use coprocessor API by default (can be disabled for backwards compatibility)
     this.useCpxApi = config.useCpxApi !== false;
+    this.authToken = config.authToken || null;
+  }
+
+  setAuthToken(token: string | null) {
+    this.authToken = token;
+  }
+
+  private get headers(): Record<string, string> {
+    const h: Record<string, string> = { ...JSON_HEADERS };
+    if (this.authToken) {
+      h['Authorization'] = `Bearer ${this.authToken}`;
+    }
+    return h;
   }
 
   private get agentsUrl(): string {
@@ -48,7 +62,7 @@ export class AgentsClient {
     const queryString = params.toString();
     const url = `${this.agentsUrl}${queryString ? `?${queryString}` : ''}`;
 
-    const response = await fetch(url);
+    const response = await fetch(url, { headers: this.headers });
 
     if (!response.ok) {
       throw new StacksSDKError(
@@ -64,7 +78,7 @@ export class AgentsClient {
    * Get an agent by ID
    */
   async get(id: string): Promise<Agent> {
-    const response = await fetch(`${this.agentsUrl}/${id}`);
+    const response = await fetch(`${this.agentsUrl}/${id}`, { headers: this.headers });
 
     if (!response.ok) {
       throw new StacksSDKError(
@@ -82,7 +96,7 @@ export class AgentsClient {
   async create(input: AgentCreateInput): Promise<AgentResponse> {
     const response = await fetch(this.agentsUrl, {
       method: 'POST',
-      headers: JSON_HEADERS,
+      headers: this.headers,
       body: JSON.stringify(input),
     });
 
@@ -103,7 +117,7 @@ export class AgentsClient {
   async update(id: string, input: AgentUpdateInput): Promise<AgentResponse> {
     const response = await fetch(`${this.agentsUrl}/${id}`, {
       method: 'PUT',
-      headers: JSON_HEADERS,
+      headers: this.headers,
       body: JSON.stringify(input),
     });
 
@@ -124,6 +138,7 @@ export class AgentsClient {
   async delete(id: string): Promise<{ success: boolean }> {
     const response = await fetch(`${this.agentsUrl}/${id}`, {
       method: 'DELETE',
+      headers: this.headers,
     });
 
     if (!response.ok) {
@@ -142,6 +157,7 @@ export class AgentsClient {
   async enable(id: string): Promise<AgentResponse> {
     const response = await fetch(`${this.agentsUrl}/${id}/enable`, {
       method: 'POST',
+      headers: this.headers,
     });
 
     if (!response.ok) {
@@ -160,6 +176,7 @@ export class AgentsClient {
   async disable(id: string): Promise<AgentResponse> {
     const response = await fetch(`${this.agentsUrl}/${id}/disable`, {
       method: 'POST',
+      headers: this.headers,
     });
 
     if (!response.ok) {
@@ -178,7 +195,7 @@ export class AgentsClient {
   async execute(id: string, request: AgentExecuteRequest = {}): Promise<AgentExecuteResponse> {
     const response = await fetch(`${this.agentsUrl}/${id}/execute`, {
       method: 'POST',
-      headers: JSON_HEADERS,
+      headers: this.headers,
       body: JSON.stringify(request),
     });
 
@@ -199,7 +216,7 @@ export class AgentsClient {
     // First, generate agent config from prompt
     const generateResponse = await fetch(`${this.agentsUrl}/from-prompt`, {
       method: 'POST',
-      headers: JSON_HEADERS,
+      headers: this.headers,
       body: JSON.stringify(input),
     });
 

package/src/managers/task-manager.ts

@@ -256,12 +256,34 @@ export class TaskManager {
     const channel = `task:progress:${taskId}`;
 
     await redis.subscribe(channel, (message) => {
+      let data: unknown;
       try {
-        const data = JSON.parse(message);
-        callback(data);
+        data = JSON.parse(message);
       } catch {
-        // Ignore parse errors
+        return; // not JSON — ignore
       }
+      // Shape-check: Redis pub/sub is a trust boundary. If anything else
+      // (a compromised publisher, a misconfigured tenant, or an operator
+      // pushing test data) posts to this channel, the message reaches
+      // this callback. Drop anything that doesn't match our own
+      // publisher's shape before handing it to consumer code — otherwise
+      // an attacker with publish access could inject arbitrary objects
+      // (prototype keys, unexpected fields) into the UI layer.
+      if (!data || typeof data !== 'object' || Array.isArray(data)) return;
+      const d = data as Record<string, unknown>;
+      if (typeof d.taskId !== 'string' || d.taskId !== taskId) return;
+      if (typeof d.status !== 'string') return;
+      if (d.progress !== undefined && typeof d.progress !== 'number') return;
+      if (d.message !== undefined && typeof d.message !== 'string') return;
+      if (d.error !== undefined && typeof d.error !== 'string') return;
+      callback({
+        taskId: d.taskId,
+        status: d.status as TaskStatus,
+        progress: d.progress as number | undefined,
+        message: d.message as string | undefined,
+        result: d.result,
+        error: d.error as string | undefined,
+      });
     });
 
     return async () => {

package/src/proxy/forwarder.ts

@@ -7,7 +7,13 @@ import { DEFAULT_TASK_NETWORK_URL } from '../utils/constants';
 export interface ForwarderConfig {
   baseUrl?: string;
   defaultHeaders?: Record<string, string>;
+  /** Request timeout in milliseconds. Applied via AbortSignal to every
+   *  outbound fetch. Default: 30_000 (30s). Previously declared but not
+   *  wired — an upstream hang would leak file descriptors indefinitely. */
   timeout?: number;
+  /** Hard cap on inbound JSON body size (bytes) read by `createProxyHandler`.
+   *  Requests larger than this are rejected with 413. Default: 1 MiB. */
+  maxBodyBytes?: number;
 }
 
 export interface RequestOptions {
@@ -18,6 +24,42 @@ export interface RequestOptions {
   stream?: boolean;
 }
 
+const DEFAULT_TIMEOUT_MS = 30_000;
+const DEFAULT_MAX_BODY_BYTES = 1024 * 1024; // 1 MiB
+
+/** Headers that are safe to forward from an inbound request to the upstream.
+ *  `createProxyHandler` previously copied every inbound header — including
+ *  `cookie`, attacker-set `x-forwarded-for`, and the consumer app's session
+ *  cookies — to an arbitrary upstream. Only the headers that carry request
+ *  semantics (auth + content negotiation + a request id for tracing) are
+ *  preserved now. */
+const FORWARDABLE_REQUEST_HEADERS = new Set([
+  'authorization',
+  'content-type',
+  'accept',
+  'accept-language',
+  'x-request-id',
+  'x-correlation-id',
+  'idempotency-key',
+]);
+
+/** Build the outbound URL by resolving `path` relative to `baseUrl`. Using
+ *  the URL constructor here (instead of string concatenation) prevents a
+ *  path like ".evil.com/x" from producing an unintended host.
+ *  Throws if the resolved URL escapes the baseUrl origin. */
+function resolveUrl(baseUrl: string, path: string): string {
+  // Ensure baseUrl ends with '/' so URL() treats it as a directory root.
+  const baseForResolve = baseUrl.endsWith('/') ? baseUrl : `${baseUrl}/`;
+  // Drop leading '/' on path so it doesn't replace the baseUrl pathname.
+  const rel = path.startsWith('/') ? path.slice(1) : path;
+  const resolved = new URL(rel, baseForResolve);
+  const base = new URL(baseForResolve);
+  if (resolved.origin !== base.origin) {
+    throw new Error(`forwarder: resolved URL ${resolved.origin} escapes baseUrl origin ${base.origin}`);
+  }
+  return resolved.toString();
+}
+
 /**
  * Forward a request to a backend URL
  */
@@ -29,19 +71,14 @@ export async function forwardRequest(
   const baseUrl = config.baseUrl || DEFAULT_TASK_NETWORK_URL;
   const { method = 'GET', headers = {}, body, searchParams, stream } = options;
 
-  // Build URL with search params
-  let url = `${baseUrl}${path}`;
+  // Build URL safely, then attach search params.
+  const urlObj = new URL(resolveUrl(baseUrl, path));
   if (searchParams) {
-    const params = new URLSearchParams();
     Object.entries(searchParams).forEach(([key, value]) => {
       if (value !== undefined) {
-        params.set(key, value);
+        urlObj.searchParams.set(key, value);
       }
     });
-    const paramString = params.toString();
-    if (paramString) {
-      url += `?${paramString}`;
-    }
   }
 
   const fetchOptions: RequestInit = {
@@ -50,6 +87,7 @@ export async function forwardRequest(
       ...config.defaultHeaders,
       ...headers,
     },
+    signal: AbortSignal.timeout(config.timeout ?? DEFAULT_TIMEOUT_MS),
   };
 
   if (body && method !== 'GET') {
@@ -60,7 +98,7 @@ export async function forwardRequest(
     fetchOptions.body = JSON.stringify(body);
   }
 
-  const response = await fetch(url, fetchOptions);
+  const response = await fetch(urlObj.toString(), fetchOptions);
 
   // For streaming responses, return directly
   if (stream && response.body) {
@@ -83,13 +121,59 @@ export async function forwardJSON<T = unknown>(
   return { data, status: response.status };
 }
 
+/** Read a request body with a hard byte cap. Returns `null` if the body
+ *  exceeds the cap, so the caller can return 413 without first buffering
+ *  an attacker-sized payload into memory. */
+async function readBodyCapped(request: Request, maxBytes: number): Promise<unknown | { _tooLarge: true }> {
+  const contentLength = request.headers.get('content-length');
+  if (contentLength) {
+    const n = parseInt(contentLength, 10);
+    if (Number.isFinite(n) && n > maxBytes) return { _tooLarge: true };
+  }
+  if (!request.body) return undefined;
+  const reader = request.body.getReader();
+  let received = 0;
+  const chunks: Uint8Array[] = [];
+  // Streaming read with byte cap — aborts as soon as the cap is exceeded.
+  // eslint-disable-next-line no-constant-condition
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    received += value.byteLength;
+    if (received > maxBytes) {
+      try { await reader.cancel(); } catch { /* ignore */ }
+      return { _tooLarge: true };
+    }
+    chunks.push(value);
+  }
+  if (received === 0) return undefined;
+  const buf = new Uint8Array(received);
+  let offset = 0;
+  for (const c of chunks) { buf.set(c, offset); offset += c.byteLength; }
+  const text = new TextDecoder().decode(buf);
+  if (text.trim() === '') return undefined;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return undefined;
+  }
+}
+
 /**
- * Create a proxy handler that forwards requests
+ * Create a proxy handler that forwards requests.
+ *
+ * SECURITY: only a small whitelist of inbound headers is forwarded (see
+ * FORWARDABLE_REQUEST_HEADERS). Everything else — including `cookie`,
+ * `x-forwarded-for`, `host` — is stripped so a caller cannot poison the
+ * upstream's view of the request or smuggle the consumer app's cookies to
+ * a third-party StackNet endpoint.
  */
 export function createProxyHandler(
   path: string | ((req: Request) => string),
   config: ForwarderConfig = {}
 ) {
+  const maxBodyBytes = config.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+
   return async (request: Request): Promise<Response> => {
     const url = new URL(request.url);
     const targetPath = typeof path === 'function' ? path(request) : path;
@@ -102,17 +186,22 @@ export function createProxyHandler(
 
     let body: unknown = undefined;
     if (request.method !== 'GET' && request.method !== 'HEAD') {
-      try {
-        body = await request.json();
-      } catch {
-        // No body or not JSON
+      const read = await readBodyCapped(request, maxBodyBytes);
+      if (read && typeof read === 'object' && (read as { _tooLarge?: boolean })._tooLarge) {
+        return Response.json(
+          { error: `Request body exceeds ${maxBodyBytes} bytes` },
+          { status: 413 },
+        );
       }
+      body = read;
     }
 
-    // Extract headers
+    // Forward ONLY the whitelisted headers.
     const requestHeaders: Record<string, string> = {};
     request.headers.forEach((value, key) => {
-      requestHeaders[key] = value;
+      if (FORWARDABLE_REQUEST_HEADERS.has(key.toLowerCase())) {
+        requestHeaders[key] = value;
+      }
     });
 
     const response = await forwardRequest(