@themoltnet/agent-daemon 0.64.0 → 0.65.0

package/dist/cli.js

@@ -9580,6 +9580,20 @@ async function validateNativeSocket(path) {
 //#region src/lib/agent-server/operator-oauth.ts
 var InvalidOperatorGrantError = class extends Error {};
 var LOCAL_SCOPE = OPERATOR_OAUTH.localControlScope;
+function readOperatorTeams(value) {
+	if (!Array.isArray(value) || value.length > 256) return [];
+	const teams = value;
+	if (!teams.every(isOperatorTeam)) return [];
+	return teams.map(({ id, name }) => ({
+		id,
+		name
+	}));
+}
+function isOperatorTeam(value) {
+	if (!value || typeof value !== "object") return false;
+	const team = value;
+	return typeof team["id"] === "string" && /^[0-9a-f-]{36}$/i.test(team["id"]) && typeof team["name"] === "string" && team["name"].length > 0 && team["name"].length <= 200;
+}
 /** Trusted native controller owns the verifier, callback and token exchange. */
 var OperatorOAuth = class {
 	instance = randomUUID();
@@ -9611,7 +9625,8 @@ var OperatorOAuth = class {
 			if (!value || typeof value !== "object" || !("issuer" in value) || !("subject" in value) || typeof value.issuer !== "string" || typeof value.subject !== "string") throw new Error("Invalid operator");
 			this.operator = {
 				issuer: value.issuer,
-				subject: value.subject
+				subject: value.subject,
+				teams: "teams" in value ? readOperatorTeams(value.teams) : []
 			};
 		} catch (error) {
 			if (error.code !== "ENOENT") throw error;
@@ -9624,6 +9639,9 @@ var OperatorOAuth = class {
 	operatorConfigured() {
 		return this.operator !== null;
 	}
+	listTeams() {
+		return this.operator?.teams ?? [];
+	}
 	removeOperator() {
 		this.cancel();
 		rmSync(join(this.root, "operator.json"), { force: true });
@@ -9647,7 +9665,8 @@ var OperatorOAuth = class {
 		return {
 			issuer: payload.iss,
 			subject: payload.sub,
-			provisioning: claims["moltnet:provisioning"]
+			provisioning: claims["moltnet:provisioning"],
+			teams: readOperatorTeams(claims["moltnet:operator_teams"])
 		};
 	}
 	async authorize(grant, signal) {
@@ -9736,7 +9755,8 @@ var OperatorOAuth = class {
 				try {
 					writeFileSync(join(this.root, "operator.json"), JSON.stringify({
 						issuer: operator.issuer,
-						subject: operator.subject
+						subject: operator.subject,
+						teams: grant ? [] : operator.teams
 					}), {
 						mode: 384,
 						flag: "wx"
@@ -9748,8 +9768,12 @@ var OperatorOAuth = class {
 				}
 				this.operator = {
 					issuer: operator.issuer,
-					subject: operator.subject
+					subject: operator.subject,
+					teams: grant ? [] : operator.teams
 				};
+			} else if (!grant) {
+				this.operator.teams = operator.teams;
+				writeFileSync(join(this.root, "operator.json"), JSON.stringify(this.operator), { mode: 384 });
 			}
 			return tokens.access_token;
 		} finally {
@@ -12873,6 +12897,31 @@ function buildAgentServer(input) {
 		app.get("/v1/native/operator", { schema: { hide: true } }, async (request) => {
 			return { operatorConfigured: (await requireNativeOrigin(requireAuthorizedOrigin, request, oauth)).operatorConfigured() };
 		});
+		app.get("/v1/operator/teams", { schema: {
+			operationId: "listAgentServerOperatorTeams",
+			tags: ["operator"],
+			security: [{ agentServerToken: [] }],
+			response: { 200: {
+				type: "object",
+				required: ["items"],
+				properties: { items: {
+					type: "array",
+					items: {
+						type: "object",
+						required: ["id", "name"],
+						properties: {
+							id: {
+								type: "string",
+								format: "uuid"
+							},
+							name: { type: "string" }
+						}
+					}
+				} }
+			} }
+		} }, async (request) => {
+			return { items: (await requireNativeOrigin(requireAuthorizedOrigin, request, oauth)).listTeams() };
+		});
 		app.post("/v1/operator/cancel", { schema: {
 			operationId: "cancelAgentServerOperatorApproval",
 			tags: ["operator"],
@@ -14187,7 +14236,7 @@ async function writeCache(cache) {
 }
 //#endregion
 //#region src/version.ts
-var DAEMON_VERSION = "0.64.0";
+var DAEMON_VERSION = "0.65.0";
 //#endregion
 //#region src/cli.ts
 async function runAgentDaemonCli(options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.64.0",
+  "version": "0.65.0",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "Universal MoltNet agent daemon host with a built-in Pi/Gondolin runtime and support for trusted operator-owned runtime modules. CLI: moltnet-agent.",
@@ -84,10 +84,10 @@
     "pino-pretty": "^13.1.3",
     "proper-lockfile": "4.1.2",
     "typebox": "^1.2.8",
-    "@themoltnet/sdk": "0.146.0",
-    "@themoltnet/pi-runtime": "0.18.4",
     "@themoltnet/agent-runtime": "1.4.0",
-    "@themoltnet/os-keyring": "0.4.0"
+    "@themoltnet/os-keyring": "0.4.0",
+    "@themoltnet/pi-runtime": "0.18.4",
+    "@themoltnet/sdk": "0.146.0"
   },
   "devDependencies": {
     "@fastify/swagger": "^9.6.1",
@@ -98,16 +98,16 @@
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
     "@moltnet/agent-eval": "0.1.0",
-    "@moltnet/bootstrap": "0.1.0",
-    "@moltnet/execution-integrations": "0.1.0",
     "@moltnet/api-client": "0.1.0",
-    "@moltnet/models": "0.1.0",
+    "@moltnet/bootstrap": "0.1.0",
+    "@moltnet/crypto-service": "0.1.0",
     "@moltnet/execution-plan": "0.1.0",
-    "@moltnet/observability": "0.1.0",
     "@moltnet/loopback-companion": "0.1.0",
+    "@moltnet/models": "0.1.0",
+    "@moltnet/tasks": "0.1.0",
     "@moltnet/runtime-profiles": "0.1.0",
-    "@moltnet/crypto-service": "0.1.0",
-    "@moltnet/tasks": "0.1.0"
+    "@moltnet/observability": "0.1.0",
+    "@moltnet/execution-integrations": "0.1.0"
   },
   "nx": {
     "projectType": "application",