@tangle-network/agent-app 0.46.52 → 0.46.54

package/dist/billing/crypto-probe.d.ts

@@ -0,0 +1,3 @@
+import type { KeyCrypto } from './index';
+/** Prove the at-rest crypto seam before a remote key is minted. */
+export declare function assertWorkspaceKeyCryptoUsable(crypto: KeyCrypto): Promise<void>;

package/dist/billing/identity-bound.d.ts

@@ -0,0 +1,183 @@
+import type { KeyCrypto, KeyProvisioner } from './index';
+/** Lifecycle state for a durable delegated key row. */
+export type WorkspaceKeyStatus = 'legacy' | 'provisioning' | 'active' | 'revocation_pending' | 'revoked' | 'orphaned';
+/** Product partition used by the key store and remote provisioner. */
+export type WorkspaceKeyProduct = string;
+/** The identity fields that bind a child key to its paying owner and source. */
+export interface WorkspaceKeyIdentity {
+    workspaceId: string;
+    ownerUserId: string;
+    platformUserId: string;
+    sourceKeyId?: string | null;
+    /** A non-secret digest of the source credential. */
+    sourceKeyFingerprint: string;
+}
+/** A product/workspace/owner lookup scope. */
+export interface DurableWorkspaceKeyScope {
+    workspaceId: string;
+    ownerUserId: string;
+    product: WorkspaceKeyProduct;
+}
+/** A persisted child-key row owned by this manager. */
+export interface DurableWorkspaceKeyRecord {
+    id: string;
+    workspaceId: string;
+    ownerUserId: string;
+    product: WorkspaceKeyProduct;
+    platformUserId: string;
+    sourceKeyId: string | null;
+    sourceKeyFingerprint: string;
+    /** The persisted name used to recover a remote create after a crash. Null only for pre-name rows. */
+    name: string | null;
+    keyId: string;
+    keyEncrypted: string;
+    budgetUsd: number;
+    expiresAt: Date;
+    status: WorkspaceKeyStatus;
+    revocationAttempts: number;
+    nextRevocationAt: Date | null;
+    lastRevocationError: string | null;
+    createdAt: Date;
+}
+/** A row that has been written before its remote child key exists. */
+export interface DurableWorkspaceKeyProvisioningRecord extends DurableWorkspaceKeyRecord {
+    status: 'provisioning';
+}
+type DurableWorkspaceKeyCreateResult = Awaited<ReturnType<KeyProvisioner['createKey']>> & {
+    budgetUsd?: number | null;
+    budgetRemaining?: number;
+    expiresAt?: string | null;
+};
+/** The remote operations required by the durable manager. */
+export interface DurableWorkspaceKeyProvisioner {
+    createKey(input: Parameters<KeyProvisioner['createKey']>[0]): Promise<DurableWorkspaceKeyCreateResult>;
+    getKey(id: string): Promise<{
+        budgetUsd?: number | null;
+        budgetSpent?: number;
+        expiresAt?: string | null;
+    }>;
+    revokeKey: KeyProvisioner['revokeKey'];
+    /** Find remote keys for a specific persisted provisioning attempt. */
+    findCreatedKeys(input: {
+        name: string;
+        product: string;
+        sourceKeyId?: string | null;
+    }): Promise<Array<{
+        id: string;
+    }>>;
+}
+/** Persistence operations for identity-bound key lifecycle state. */
+export interface DurableWorkspaceKeyStore {
+    /** Return the active row for this exact product scope. */
+    getActive(scope: DurableWorkspaceKeyScope): Promise<DurableWorkspaceKeyRecord | null>;
+    /** Return every unfinished provisioning row for this exact product scope. */
+    listProvisioning(scope: DurableWorkspaceKeyScope): Promise<DurableWorkspaceKeyProvisioningRecord[]>;
+    /** Insert before the remote create so a crashed create can be recovered. */
+    insertProvisioning(record: DurableWorkspaceKeyProvisioningRecord): Promise<void>;
+    /** Save the remote id while the row remains in provisioning state. */
+    markProvisioningRemote(input: {
+        id: string;
+        keyId: string;
+    }): Promise<void>;
+    /** Promote a fully encrypted row to active state. */
+    markActive(input: {
+        id: string;
+        keyId: string;
+        keyEncrypted: string;
+        expiresAt: Date;
+        budgetUsd: number;
+    }): Promise<void>;
+    /** Keep a failed cleanup visible and schedule a later retry. */
+    markRevocationPending(input: {
+        id: string;
+        error?: string | null;
+        nextAttemptAt: Date;
+        incrementAttempts: boolean;
+    }): Promise<void>;
+    /** Mark a remote key as revoked. Missing remote keys count as revoked. */
+    markRevoked(id: string, now: Date): Promise<void>;
+    /** Mark a provisioning row terminal when no remote key remains to clean. */
+    markOrphaned(id: string, error: string): Promise<void>;
+    /** Query due cleanup rows. The implementation should filter by the supplied scope. */
+    listPendingRevocations(input: {
+        product: WorkspaceKeyProduct;
+        workspaceId?: string;
+        ownerUserId?: string;
+        now: Date;
+        limit: number;
+        /** Include rows scheduled for a later retry when checking before issuance. */
+        includeFuture?: boolean;
+    }): Promise<DurableWorkspaceKeyRecord[]>;
+    /** Acquire a cross-process lease for one product/workspace/owner scope. */
+    acquireLease(scope: string, operationId: string, now: Date, leaseMs: number): Promise<boolean>;
+    /** Renew an acquired lease before its expiry. */
+    renewLease(scope: string, operationId: string, now: Date, leaseMs: number): Promise<boolean>;
+    /** Release an acquired lease. */
+    releaseLease(scope: string, operationId: string): Promise<void>;
+}
+/** Live budget information for a child key. */
+export interface WorkspaceKeyUsage {
+    keyId: string;
+    budgetUsd: number;
+    budgetSpent: number;
+    budgetRemaining: number;
+    expiresAt: string;
+    exhausted: boolean;
+}
+/** The decrypted key plus the usage snapshot used to issue it. */
+export interface WorkspaceRuntimeKey {
+    key: string;
+    usage: WorkspaceKeyUsage;
+    /** True when this call minted a new remote key. */
+    refreshed: boolean;
+}
+/** Identity-bound durable key manager API. */
+export interface DurableWorkspaceKeyManager {
+    /** Reuse a matching active key or reconcile and mint one under a lease. */
+    ensureKey(identity: WorkspaceKeyIdentity, options?: {
+        budgetUsd?: number;
+    }): Promise<WorkspaceRuntimeKey>;
+    /** Read usage without returning the child secret. */
+    getUsage(identity: WorkspaceKeyIdentity): Promise<WorkspaceKeyUsage | null>;
+    /** Retry due cleanup rows. A supplied owner/workspace limits the retry to its scope. */
+    retryPendingRevocations(scope?: Pick<WorkspaceKeyIdentity, 'ownerUserId' | 'workspaceId'>): Promise<number>;
+}
+/** Configuration for {@link createIdentityBoundWorkspaceKeyManager}. */
+export interface DurableWorkspaceKeyManagerOptions {
+    store: DurableWorkspaceKeyStore;
+    provisioner: DurableWorkspaceKeyProvisioner;
+    crypto: KeyCrypto;
+    /** Product partition. Products must use separate values. */
+    product: WorkspaceKeyProduct;
+    defaultBudgetUsd: number;
+    now?: () => Date;
+    /** Local lifetime used when the remote response omits an expiry. */
+    keyLifetimeMs?: number;
+    /** Lease lifetime for remote operations. */
+    leaseMs?: number;
+    /** Maximum time to wait for another issuer to release the scope lease. */
+    leaseWaitMs?: number;
+    /** Poll delay while waiting for a scope lease. */
+    leasePollMs?: number;
+    /** Renewal interval. It must be shorter than `leaseMs`. */
+    leaseRenewIntervalMs?: number;
+    /** Initial delay for a failed remote revoke. */
+    revocationRetryBaseMs?: number;
+    /** Maximum delay for a failed remote revoke. */
+    revocationRetryMaxMs?: number;
+    /** Stable remote name. The operation id makes the default crash-safe. */
+    nameForIdentity?: (identity: WorkspaceKeyIdentity, operationId: string) => string;
+    /** Resolve names for rows written before `name` became durable. Null blocks issuance safely. */
+    legacyNameForRecord?: (record: DurableWorkspaceKeyRecord) => string | null | undefined;
+    /** Recognize a missing remote key without depending on a provider SDK. */
+    isRemoteMissing?: (error: unknown) => boolean;
+}
+/**
+ * Create a product-neutral manager for child-key issuance and cleanup.
+ *
+ * The provisioner must already be authenticated for the current source
+ * credential. The manager persists only the source id and its non-secret
+ * fingerprint, then refuses to reuse a row from another identity.
+ */
+export declare function createIdentityBoundWorkspaceKeyManager(options: DurableWorkspaceKeyManagerOptions): DurableWorkspaceKeyManager;
+export {};

package/dist/billing/index.d.ts

@@ -239,3 +239,4 @@ export interface PlatformBalanceManager<Plan extends string> {
 export declare function createPlatformBalanceManager<Plan extends string>(opts: PlatformBalanceManagerOptions<Plan>): PlatformBalanceManager<Plan>;
 /** Create a workspace key manager that handles key provisioning and budget tracking */
 export declare function createWorkspaceKeyManager(opts: WorkspaceKeyManagerOptions): WorkspaceKeyManager;
+export { createIdentityBoundWorkspaceKeyManager, type DurableWorkspaceKeyManager, type DurableWorkspaceKeyManagerOptions, type DurableWorkspaceKeyProvisioner, type DurableWorkspaceKeyProvisioningRecord, type DurableWorkspaceKeyRecord, type DurableWorkspaceKeyScope, type DurableWorkspaceKeyStore, type WorkspaceKeyIdentity, type WorkspaceKeyProduct, type WorkspaceKeyStatus, type WorkspaceKeyUsage, type WorkspaceRuntimeKey, } from './identity-bound';

package/dist/billing/index.js

@@ -1,9 +1,11 @@
 import {
+  createIdentityBoundWorkspaceKeyManager,
   createPlatformBalanceManager,
   createTcloudKeyProvisioner,
   createWorkspaceKeyManager
-} from "../chunk-GXE6KHTS.js";
+} from "../chunk-TS2ZIB53.js";
 export {
+  createIdentityBoundWorkspaceKeyManager,
   createPlatformBalanceManager,
   createTcloudKeyProvisioner,
   createWorkspaceKeyManager

package/dist/chat-routes/index.js

@@ -112,7 +112,7 @@ import {
   flattenHistory,
   readSandboxBinaryBytes,
   statSandboxFileSize
-} from "../chunk-FS6YF4ZV.js";
+} from "../chunk-T374KO42.js";
 import "../chunk-MCYJON3F.js";
 import "../chunk-LWSJK546.js";
 import "../chunk-P5PIAQVS.js";

package/dist/{chunk-FS6YF4ZV.js → chunk-T374KO42.js}

@@ -2672,12 +2672,16 @@ async function driveSandboxTurn(shell, box, message, options) {
       sessionId: options.sessionId,
       ...options.turnId ? { turnId: options.turnId } : {},
       ...options.wallCapMs !== void 0 ? { wallCapMs: options.wallCapMs } : {},
-      ...options.executionId ? { executionId: options.executionId } : {},
       ...options.timeoutMs !== void 0 ? { timeoutMs: options.timeoutMs } : {},
       ...options.signal ? { signal: options.signal } : {},
-      // Deliberately NO `interactions` here: detached turns (cron / mission steps) have
-      // no consumer to answer a question. Interactive Q&A is streaming-path only.
-      backend: { type: harness, profile, ...model ? { model } : {} }
+      // A durable caller with a session-gateway consumer can handle these events;
+      // callers without one should omit interactions so the run stays unattended.
+      backend: {
+        type: harness,
+        profile,
+        ...model ? { model } : {},
+        ...options.interactions ? { interactions: options.interactions } : {}
+      }
     });
     emitSandboxActivity(options.spend, box);
     return ok(drive);
@@ -2829,4 +2833,4 @@ export {
   isTerminalPromptEvent,
   detectInteractiveQuestion
 };
-//# sourceMappingURL=chunk-FS6YF4ZV.js.map
+//# sourceMappingURL=chunk-T374KO42.js.map