@tangle-network/agent-app 0.47.21 → 0.47.22

package/dist/public-consultation/index.js

@@ -1,7 +1,7 @@
 import {
   createChatTurnRoutes,
   streamChatRouteAsSandboxEvents
-} from "../chunk-3GVFJYLO.js";
+} from "../chunk-42NBWR4U.js";
 import "../chunk-ZSSCVT6H.js";
 import "../chunk-3YUI7WNW.js";
 import "../chunk-4PZE7XAM.js";
@@ -12,7 +12,7 @@ import "../chunk-JEZJ6HTF.js";
 import "../chunk-ZMMIQOFI.js";
 import "../chunk-M3K2HVQD.js";
 import "../chunk-YJMCRXQQ.js";
-import "../chunk-ES3I3UGP.js";
+import "../chunk-N4RR4WAI.js";
 
 // src/public-consultation/index.ts
 import { searchKnowledge } from "@tangle-network/agent-knowledge";

package/dist/sandbox/index.js

@@ -99,7 +99,7 @@ import {
   workspaceSandboxRecoveryMessage,
   workspaceSandboxRecoveryRecommendedActions,
   writeProfileFilesToBox
-} from "../chunk-XR5ZXMYL.js";
+} from "../chunk-PMAQSFJS.js";
 import "../chunk-MCYJON3F.js";
 import "../chunk-LWSJK546.js";
 import "../chunk-P5PIAQVS.js";

package/dist/stream/index.js

@@ -42,7 +42,7 @@ import {
   pumpBufferedTurn,
   replayTurnEvents,
   stampReplaySeq
-} from "../chunk-ES3I3UGP.js";
+} from "../chunk-N4RR4WAI.js";
 export {
   DEFAULT_RUNNING_TURN_LEASE_MS,
   DEFAULT_RUNNING_TURN_RENEW_INTERVAL_MS,

package/dist/stream/turn-buffer.d.ts

@@ -200,7 +200,6 @@ export declare const TURN_STATUS_SCOPE_MIGRATION_SQL = "ALTER TABLE turn_status
 /** For deployments that already have the turn tables, add the index used by
  *  terminal-turn retention without rerunning the table migration. */
 export declare const TURN_STATUS_RETENTION_MIGRATION_SQL = "CREATE INDEX IF NOT EXISTS idx_turn_status_retention ON turn_status (status, updatedAt);";
-/** Resolve a TurnEventStore that appends and reads turn events using a D1-like database interface */
 export declare function createD1TurnEventStore(db: D1LikeForTurns, options?: TurnEventStoreOptions): TurnEventStore;
 /** In-memory store for tests and keyless local dev. */
 export declare function createMemoryTurnEventStore(options?: TurnEventStoreOptions): TurnEventStore;

package/dist/tangle/index.d.ts

@@ -16,10 +16,10 @@
  *      (their Tangle session authorizes the app for a connection + scopes).
  *   2. On the callback, the consumer's client `exchangeAuthCode`s the `agc_`
  *      code into the first broker token + a durable grant.
- *   3. {@link createBrokerTokenProvider} — the runtime path: a cached provider
- *      that re-mints a fresh single-use broker token per `/v1/hub/exec` from the
- *      durable grant using only the app credentials (no user session). Caches
- *      until just before expiry so a burst of hub calls shares one mint.
+ *   3. {@link createBrokerTokenProvider} — the runtime path: each request mints
+ *      a fresh single-use broker token from the durable grant using only app
+ *      credentials (no user session). Neither tokens nor in-flight mint
+ *      promises may be shared between execution attempts.
  */
 /** A single-use hub bearer minted from a durable grant — mirrors
  *  `@tangle-network/agent-integrations`'s `BrokerToken`. */
@@ -71,24 +71,24 @@ export interface BrokerTokenProviderOptions {
     grantId: string;
     /** Requested token TTL (seconds). */
     ttlSeconds?: number;
-    /** Re-mint this many ms BEFORE expiry so an in-flight call never uses a
-     *  just-expired token. Default 30s. */
+    /** @deprecated Retained for source compatibility. Single-use tokens are
+     *  never cached, so refresh skew is ignored. */
     refreshSkewMs?: number;
-    /** Injectable clock (ms). Default `Date.now`. */
+    /** @deprecated Retained for source compatibility; no local expiry cache. */
     now?: () => number;
 }
-/** Provide and refresh broker bearer tokens, allowing forced token invalidation */
+/** Mint a separate single-use bearer for each execution attempt. */
 export interface BrokerTokenProvider {
-    /** A valid `sk-tan-broker-` bearer, minting/refreshing as needed. */
+    /** Mint a fresh bearer for exactly one Hub execution; never cache or share it. */
     getToken(): Promise<string>;
-    /** Force the next `getToken` to re-mint (e.g. after a 401 from the hub). */
+    /** Compatibility no-op: no bearer is cached. Does not revoke Hub grants or
+     *  already-issued tokens; revocation belongs to the authoritative Hub. */
     invalidate(): void;
 }
 /**
- * Cache + auto-refresh a broker token for one grant. A burst of hub calls
- * shares a single mint; the token is re-minted once it's within `refreshSkewMs`
- * of expiry, or on demand via {@link BrokerTokenProvider.invalidate}.
- * Concurrent `getToken` calls during a mint share the same in-flight promise
- * (no thundering herd).
+ * Mint a fresh broker token for every call, including concurrent calls.
+ * A broker bearer is consumed by one Hub execution even when its TTL has not
+ * expired. Cache the durable grant, never the bearer or an in-flight mint.
+ * Mint failures propagate; this helper never retries an external action.
  */
 export declare function createBrokerTokenProvider(opts: BrokerTokenProviderOptions): BrokerTokenProvider;

package/dist/tangle/index.js

@@ -12,31 +12,17 @@ function buildConsentUrl(input) {
   return `${base}/cross-site/app-consent?${params.toString()}`;
 }
 function createBrokerTokenProvider(opts) {
-  const now = opts.now ?? (() => Date.now());
-  const skew = opts.refreshSkewMs ?? 3e4;
-  let cached = null;
-  let inflight = null;
-  async function mint() {
-    const t = await opts.client.mintBrokerToken({
-      clientId: opts.clientId,
-      clientSecret: opts.clientSecret,
-      grantId: opts.grantId,
-      ttlSeconds: opts.ttlSeconds
-    });
-    cached = { token: t.accessToken, expiresAt: now() + t.expiresIn * 1e3 };
-    return t.accessToken;
-  }
   return {
     async getToken() {
-      if (cached && now() < cached.expiresAt - skew) return cached.token;
-      if (inflight) return inflight;
-      inflight = mint().finally(() => {
-        inflight = null;
+      const token = await opts.client.mintBrokerToken({
+        clientId: opts.clientId,
+        clientSecret: opts.clientSecret,
+        grantId: opts.grantId,
+        ttlSeconds: opts.ttlSeconds
       });
-      return inflight;
+      return token.accessToken;
     },
     invalidate() {
-      cached = null;
     }
   };
 }

package/dist/tangle/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/tangle/index.ts"],"sourcesContent":["/**\n * Tangle login + the developer self-service app-registration → broker-token\n * flow, for apps built on agent-app.\n *\n * The platform (agent-dev-container integration hub) lets a developer register\n * their client app and obtain a `sk-tan-broker-` bearer to call `/v1/hub/exec`\n * on a user's connected integrations — WITHOUT being a hard-coded \"trusted app\".\n * The wire client (`TangleAppsClient` — registerApp / exchangeAuthCode /\n * mintBrokerToken) lives in `@tangle-network/agent-integrations`; this module is\n * the app-shell layer on top, and is intentionally **structural**: it depends on\n * the minter CONTRACT, not the concrete client, so it installs without the\n * agent-integrations publish and is trivially testable. A consumer constructs\n * the real client and passes it in.\n *\n *   1. {@link buildConsentUrl} — send the user through the ONE-TIME consent\n *      (their Tangle session authorizes the app for a connection + scopes).\n *   2. On the callback, the consumer's client `exchangeAuthCode`s the `agc_`\n *      code into the first broker token + a durable grant.\n *   3. {@link createBrokerTokenProvider} — the runtime path: a cached provider\n *      that re-mints a fresh single-use broker token per `/v1/hub/exec` from the\n *      durable grant using only the app credentials (no user session). Caches\n *      until just before expiry so a burst of hub calls shares one mint.\n */\n\n/** A single-use hub bearer minted from a durable grant — mirrors\n *  `@tangle-network/agent-integrations`'s `BrokerToken`. */\nexport interface BrokerToken {\n  /** The `sk-tan-broker-…` bearer for a single `/v1/hub/exec` call. */\n  accessToken: string\n  /** Seconds until expiry. */\n  expiresIn: number\n  scope: string\n  connectionId?: string\n}\n\n/** The one method the provider needs — `TangleAppsClient` satisfies it\n *  structurally, so `createBrokerTokenProvider({ client: tangleAppsClient, … })`\n *  type-checks without importing the concrete class. */\nexport interface BrokerTokenMinter {\n  mintBrokerToken(input: { clientId: string; clientSecret: string; grantId: string; ttlSeconds?: number }): Promise<BrokerToken>\n}\n\n/** Define input parameters required to generate a consent URL for OAuth authorization */\nexport interface ConsentUrlInput {\n  /** Platform base URL (e.g. https://id.tangle.tools). */\n  endpoint: string\n  clientId: string\n  /** Must match one of the app's registered redirect URIs. */\n  redirectUri: string\n  /** Scopes the app is requesting for this connection (e.g. ['gmail.read']). */\n  scopes: string[]\n  /** Opaque CSRF/state value the callback echoes back — verify it on return. */\n  state: string\n  /** Optionally pre-select a specific connection to authorize. */\n  connectionId?: string\n}\n\n/**\n * Build the URL to send the user to for the one-time app-consent. The user's\n * Tangle session (not the app's credentials) authorizes it; on approval the\n * platform redirects to `redirectUri?code=agc_…&state=…`.\n */\nexport function buildConsentUrl(input: ConsentUrlInput): string {\n  const base = input.endpoint.replace(/\\/+$/, '')\n  const params = new URLSearchParams({\n    client_id: input.clientId,\n    redirect_uri: input.redirectUri,\n    scope: input.scopes.join(' '),\n    state: input.state,\n    response_type: 'code',\n  })\n  if (input.connectionId) params.set('connection_id', input.connectionId)\n  return `${base}/cross-site/app-consent?${params.toString()}`\n}\n\n/** Define options for configuring a broker token provider including client credentials and token management settings */\nexport interface BrokerTokenProviderOptions {\n  client: BrokerTokenMinter\n  clientId: string\n  clientSecret: string\n  /** The durable grant id from the consent exchange. */\n  grantId: string\n  /** Requested token TTL (seconds). */\n  ttlSeconds?: number\n  /** Re-mint this many ms BEFORE expiry so an in-flight call never uses a\n   *  just-expired token. Default 30s. */\n  refreshSkewMs?: number\n  /** Injectable clock (ms). Default `Date.now`. */\n  now?: () => number\n}\n\n/** Provide and refresh broker bearer tokens, allowing forced token invalidation */\nexport interface BrokerTokenProvider {\n  /** A valid `sk-tan-broker-` bearer, minting/refreshing as needed. */\n  getToken(): Promise<string>\n  /** Force the next `getToken` to re-mint (e.g. after a 401 from the hub). */\n  invalidate(): void\n}\n\n/**\n * Cache + auto-refresh a broker token for one grant. A burst of hub calls\n * shares a single mint; the token is re-minted once it's within `refreshSkewMs`\n * of expiry, or on demand via {@link BrokerTokenProvider.invalidate}.\n * Concurrent `getToken` calls during a mint share the same in-flight promise\n * (no thundering herd).\n */\nexport function createBrokerTokenProvider(opts: BrokerTokenProviderOptions): BrokerTokenProvider {\n  const now = opts.now ?? (() => Date.now())\n  const skew = opts.refreshSkewMs ?? 30_000\n  let cached: { token: string; expiresAt: number } | null = null\n  let inflight: Promise<string> | null = null\n\n  async function mint(): Promise<string> {\n    const t = await opts.client.mintBrokerToken({\n      clientId: opts.clientId,\n      clientSecret: opts.clientSecret,\n      grantId: opts.grantId,\n      ttlSeconds: opts.ttlSeconds,\n    })\n    cached = { token: t.accessToken, expiresAt: now() + t.expiresIn * 1000 }\n    return t.accessToken\n  }\n\n  return {\n    async getToken() {\n      if (cached && now() < cached.expiresAt - skew) return cached.token\n      if (inflight) return inflight\n      inflight = mint().finally(() => {\n        inflight = null\n      })\n      return inflight\n    },\n    invalidate() {\n      cached = null\n    },\n  }\n}\n"],"mappings":";AA8DO,SAAS,gBAAgB,OAAgC;AAC9D,QAAM,OAAO,MAAM,SAAS,QAAQ,QAAQ,EAAE;AAC9C,QAAM,SAAS,IAAI,gBAAgB;AAAA,IACjC,WAAW,MAAM;AAAA,IACjB,cAAc,MAAM;AAAA,IACpB,OAAO,MAAM,OAAO,KAAK,GAAG;AAAA,IAC5B,OAAO,MAAM;AAAA,IACb,eAAe;AAAA,EACjB,CAAC;AACD,MAAI,MAAM,aAAc,QAAO,IAAI,iBAAiB,MAAM,YAAY;AACtE,SAAO,GAAG,IAAI,2BAA2B,OAAO,SAAS,CAAC;AAC5D;AAiCO,SAAS,0BAA0B,MAAuD;AAC/F,QAAM,MAAM,KAAK,QAAQ,MAAM,KAAK,IAAI;AACxC,QAAM,OAAO,KAAK,iBAAiB;AACnC,MAAI,SAAsD;AAC1D,MAAI,WAAmC;AAEvC,iBAAe,OAAwB;AACrC,UAAM,IAAI,MAAM,KAAK,OAAO,gBAAgB;AAAA,MAC1C,UAAU,KAAK;AAAA,MACf,cAAc,KAAK;AAAA,MACnB,SAAS,KAAK;AAAA,MACd,YAAY,KAAK;AAAA,IACnB,CAAC;AACD,aAAS,EAAE,OAAO,EAAE,aAAa,WAAW,IAAI,IAAI,EAAE,YAAY,IAAK;AACvE,WAAO,EAAE;AAAA,EACX;AAEA,SAAO;AAAA,IACL,MAAM,WAAW;AACf,UAAI,UAAU,IAAI,IAAI,OAAO,YAAY,KAAM,QAAO,OAAO;AAC7D,UAAI,SAAU,QAAO;AACrB,iBAAW,KAAK,EAAE,QAAQ,MAAM;AAC9B,mBAAW;AAAA,MACb,CAAC;AACD,aAAO;AAAA,IACT;AAAA,IACA,aAAa;AACX,eAAS;AAAA,IACX;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/tangle/index.ts"],"sourcesContent":["/**\n * Tangle login + the developer self-service app-registration → broker-token\n * flow, for apps built on agent-app.\n *\n * The platform (agent-dev-container integration hub) lets a developer register\n * their client app and obtain a `sk-tan-broker-` bearer to call `/v1/hub/exec`\n * on a user's connected integrations — WITHOUT being a hard-coded \"trusted app\".\n * The wire client (`TangleAppsClient` — registerApp / exchangeAuthCode /\n * mintBrokerToken) lives in `@tangle-network/agent-integrations`; this module is\n * the app-shell layer on top, and is intentionally **structural**: it depends on\n * the minter CONTRACT, not the concrete client, so it installs without the\n * agent-integrations publish and is trivially testable. A consumer constructs\n * the real client and passes it in.\n *\n *   1. {@link buildConsentUrl} — send the user through the ONE-TIME consent\n *      (their Tangle session authorizes the app for a connection + scopes).\n *   2. On the callback, the consumer's client `exchangeAuthCode`s the `agc_`\n *      code into the first broker token + a durable grant.\n *   3. {@link createBrokerTokenProvider} — the runtime path: each request mints\n *      a fresh single-use broker token from the durable grant using only app\n *      credentials (no user session). Neither tokens nor in-flight mint\n *      promises may be shared between execution attempts.\n */\n\n/** A single-use hub bearer minted from a durable grant — mirrors\n *  `@tangle-network/agent-integrations`'s `BrokerToken`. */\nexport interface BrokerToken {\n  /** The `sk-tan-broker-…` bearer for a single `/v1/hub/exec` call. */\n  accessToken: string\n  /** Seconds until expiry. */\n  expiresIn: number\n  scope: string\n  connectionId?: string\n}\n\n/** The one method the provider needs — `TangleAppsClient` satisfies it\n *  structurally, so `createBrokerTokenProvider({ client: tangleAppsClient, … })`\n *  type-checks without importing the concrete class. */\nexport interface BrokerTokenMinter {\n  mintBrokerToken(input: { clientId: string; clientSecret: string; grantId: string; ttlSeconds?: number }): Promise<BrokerToken>\n}\n\n/** Define input parameters required to generate a consent URL for OAuth authorization */\nexport interface ConsentUrlInput {\n  /** Platform base URL (e.g. https://id.tangle.tools). */\n  endpoint: string\n  clientId: string\n  /** Must match one of the app's registered redirect URIs. */\n  redirectUri: string\n  /** Scopes the app is requesting for this connection (e.g. ['gmail.read']). */\n  scopes: string[]\n  /** Opaque CSRF/state value the callback echoes back — verify it on return. */\n  state: string\n  /** Optionally pre-select a specific connection to authorize. */\n  connectionId?: string\n}\n\n/**\n * Build the URL to send the user to for the one-time app-consent. The user's\n * Tangle session (not the app's credentials) authorizes it; on approval the\n * platform redirects to `redirectUri?code=agc_…&state=…`.\n */\nexport function buildConsentUrl(input: ConsentUrlInput): string {\n  const base = input.endpoint.replace(/\\/+$/, '')\n  const params = new URLSearchParams({\n    client_id: input.clientId,\n    redirect_uri: input.redirectUri,\n    scope: input.scopes.join(' '),\n    state: input.state,\n    response_type: 'code',\n  })\n  if (input.connectionId) params.set('connection_id', input.connectionId)\n  return `${base}/cross-site/app-consent?${params.toString()}`\n}\n\n/** Define options for configuring a broker token provider including client credentials and token management settings */\nexport interface BrokerTokenProviderOptions {\n  client: BrokerTokenMinter\n  clientId: string\n  clientSecret: string\n  /** The durable grant id from the consent exchange. */\n  grantId: string\n  /** Requested token TTL (seconds). */\n  ttlSeconds?: number\n  /** @deprecated Retained for source compatibility. Single-use tokens are\n   *  never cached, so refresh skew is ignored. */\n  refreshSkewMs?: number\n  /** @deprecated Retained for source compatibility; no local expiry cache. */\n  now?: () => number\n}\n\n/** Mint a separate single-use bearer for each execution attempt. */\nexport interface BrokerTokenProvider {\n  /** Mint a fresh bearer for exactly one Hub execution; never cache or share it. */\n  getToken(): Promise<string>\n  /** Compatibility no-op: no bearer is cached. Does not revoke Hub grants or\n   *  already-issued tokens; revocation belongs to the authoritative Hub. */\n  invalidate(): void\n}\n\n/**\n * Mint a fresh broker token for every call, including concurrent calls.\n * A broker bearer is consumed by one Hub execution even when its TTL has not\n * expired. Cache the durable grant, never the bearer or an in-flight mint.\n * Mint failures propagate; this helper never retries an external action.\n */\nexport function createBrokerTokenProvider(opts: BrokerTokenProviderOptions): BrokerTokenProvider {\n  return {\n    async getToken() {\n      const token = await opts.client.mintBrokerToken({\n        clientId: opts.clientId,\n        clientSecret: opts.clientSecret,\n        grantId: opts.grantId,\n        ttlSeconds: opts.ttlSeconds,\n      })\n      return token.accessToken\n    },\n    invalidate() {\n      // No cached bearer to clear. Keep this method for existing callers.\n    },\n  }\n}\n"],"mappings":";AA8DO,SAAS,gBAAgB,OAAgC;AAC9D,QAAM,OAAO,MAAM,SAAS,QAAQ,QAAQ,EAAE;AAC9C,QAAM,SAAS,IAAI,gBAAgB;AAAA,IACjC,WAAW,MAAM;AAAA,IACjB,cAAc,MAAM;AAAA,IACpB,OAAO,MAAM,OAAO,KAAK,GAAG;AAAA,IAC5B,OAAO,MAAM;AAAA,IACb,eAAe;AAAA,EACjB,CAAC;AACD,MAAI,MAAM,aAAc,QAAO,IAAI,iBAAiB,MAAM,YAAY;AACtE,SAAO,GAAG,IAAI,2BAA2B,OAAO,SAAS,CAAC;AAC5D;AAiCO,SAAS,0BAA0B,MAAuD;AAC/F,SAAO;AAAA,IACL,MAAM,WAAW;AACf,YAAM,QAAQ,MAAM,KAAK,OAAO,gBAAgB;AAAA,QAC9C,UAAU,KAAK;AAAA,QACf,cAAc,KAAK;AAAA,QACnB,SAAS,KAAK;AAAA,QACd,YAAY,KAAK;AAAA,MACnB,CAAC;AACD,aAAO,MAAM;AAAA,IACf;AAAA,IACA,aAAa;AAAA,IAEb;AAAA,EACF;AACF;","names":[]}

package/dist/turn-stream/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-CCVWR33L.js";
 import {
   DEFAULT_RUNNING_TURN_LEASE_MS
-} from "../chunk-ES3I3UGP.js";
+} from "../chunk-N4RR4WAI.js";
 
 // src/turn-stream/core.ts
 function isTerminalRunEvent(type) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-app",
-  "version": "0.47.21",
+  "version": "0.47.22",
   "packageManager": "pnpm@11.24.0",
   "description": "Build agent applications with typed chat, tools, sandboxes, integrations, billing, and evaluation.",
   "keywords": [