@themoltnet/node-red-contrib-core 0.12.0 → 0.12.2

package/dist/nodes/src.js

@@ -620,6 +620,102 @@ var getNetworkInfo = (options) => (options?.client ?? client).get({
 	...options
 });
 /**
+* List agent API keys bound to the active team. Team credential managers may list every agent.
+*/
+var listAgentKeys = (options) => (options.client ?? client).get({
+	security: [
+		{
+			scheme: "bearer",
+			type: "http"
+		},
+		{
+			name: "X-Moltnet-Session-Token",
+			type: "apiKey"
+		},
+		{
+			in: "cookie",
+			name: "ory_kratos_session",
+			type: "apiKey"
+		}
+	],
+	url: "/agent-keys",
+	...options
+});
+/**
+* Issue a secret API key bound to one agent and the active team.
+*/
+var createAgentKey = (options) => (options.client ?? client).post({
+	security: [
+		{
+			scheme: "bearer",
+			type: "http"
+		},
+		{
+			name: "X-Moltnet-Session-Token",
+			type: "apiKey"
+		},
+		{
+			in: "cookie",
+			name: "ory_kratos_session",
+			type: "apiKey"
+		}
+	],
+	url: "/agent-keys",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
+});
+/**
+* Permanently revoke an agent API key.
+*/
+var revokeAgentKey = (options) => (options.client ?? client).post({
+	security: [
+		{
+			scheme: "bearer",
+			type: "http"
+		},
+		{
+			name: "X-Moltnet-Session-Token",
+			type: "apiKey"
+		},
+		{
+			in: "cookie",
+			name: "ory_kratos_session",
+			type: "apiKey"
+		}
+	],
+	url: "/agent-keys/{keyId}/revoke",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
+});
+/**
+* Rotate an agent API key immediately. The previous secret is revoked and expiry is unchanged.
+*/
+var rotateAgentKey = (options) => (options.client ?? client).post({
+	security: [
+		{
+			scheme: "bearer",
+			type: "http"
+		},
+		{
+			name: "X-Moltnet-Session-Token",
+			type: "apiKey"
+		},
+		{
+			in: "cookie",
+			name: "ory_kratos_session",
+			type: "apiKey"
+		}
+	],
+	url: "/agent-keys/{keyId}/rotate",
+	...options
+});
+/**
 * Get the authenticated agent identity (requires bearer token).
 */
 var getWhoami = (options) => (options?.client ?? client).get({
@@ -2903,6 +2999,67 @@ function unwrapRequired(result, message, code) {
 	return result.data;
 }
 //#endregion
+//#region ../sdk/src/namespaces/team-headers.ts
+/**
+* Build the team header from an optional option, or `undefined` when no team
+* context was supplied. Used by diaries and runtime-profiles, whose endpoints
+* accept the header optionally.
+*/
+function teamHeaders(options) {
+	return options?.teamId ? { "x-moltnet-team-id": options.teamId } : void 0;
+}
+/**
+* Build the team header from a required option. Used by tasks and
+* runtime-slots, whose endpoints mandate the header.
+*/
+function requiredTeamHeaders(options) {
+	return { "x-moltnet-team-id": options.teamId };
+}
+//#endregion
+//#region ../sdk/src/namespaces/agent-keys.ts
+function createAgentKeysNamespace(context) {
+	const { client, auth } = context;
+	return {
+		async list(query, options) {
+			return unwrapResult(await listAgentKeys({
+				client,
+				auth,
+				headers: requiredTeamHeaders(options),
+				query
+			}));
+		},
+		async create(body, options) {
+			return unwrapResult(await createAgentKey({
+				client,
+				auth,
+				headers: {
+					...requiredTeamHeaders(options),
+					"idempotency-key": options.idempotencyKey
+				},
+				body
+			}));
+		},
+		async rotate(keyId, options) {
+			return unwrapResult(await rotateAgentKey({
+				client,
+				auth,
+				headers: requiredTeamHeaders(options),
+				path: { keyId }
+			}));
+		},
+		async revoke(keyId, body, options) {
+			const result = await revokeAgentKey({
+				client,
+				auth,
+				headers: requiredTeamHeaders(options),
+				path: { keyId },
+				body
+			});
+			if (result.error) unwrapResult(result);
+		}
+	};
+}
+//#endregion
 //#region ../sdk/src/namespaces/agents.ts
 function createAgentsNamespace(context) {
 	const { client, auth } = context;
@@ -2960,23 +3117,6 @@ function createCryptoNamespace(context, signingRequests) {
 	};
 }
 //#endregion
-//#region ../sdk/src/namespaces/team-headers.ts
-/**
-* Build the team header from an optional option, or `undefined` when no team
-* context was supplied. Used by diaries and runtime-profiles, whose endpoints
-* accept the header optionally.
-*/
-function teamHeaders(options) {
-	return options?.teamId ? { "x-moltnet-team-id": options.teamId } : void 0;
-}
-/**
-* Build the team header from a required option. Used by tasks and
-* runtime-slots, whose endpoints mandate the header.
-*/
-function requiredTeamHeaders(options) {
-	return { "x-moltnet-team-id": options.teamId };
-}
-//#endregion
 //#region ../sdk/src/namespaces/diaries.ts
 function createDiariesNamespace(context) {
 	const { client, auth } = context;
@@ -4887,7 +5027,10 @@ function createEntriesNamespace(context) {
 			const signingRequest = unwrapResult(await createSigningRequest({
 				client,
 				auth,
-				body: { message: computeContentCid(body.entryType ?? "semantic", body.title ?? null, body.content, body.tags ?? null) }
+				body: {
+					message: computeContentCid(body.entryType ?? "semantic", body.title ?? null, body.content, body.tags ?? null),
+					verificationMethod: "agent-ed25519"
+				}
 			}));
 			const privateKeyBytes = new Uint8Array(Buffer.from(privateKey, "base64"));
 			const signature = await signAsync(new Uint8Array(Buffer.from(signingRequest.signingInput, "base64")), privateKeyBytes);
@@ -9406,12 +9549,15 @@ function Evaluate(type, options = {}) {
 * V1 bindings only; Tier-2 (reference_file, mcp_resource, imported_file,
 * tool_response_seed, additional_context_hook) ship in a later slice.
 */
-var ContextBinding = Union([
-	Literal("skill"),
-	Literal("context_inline"),
-	Literal("prompt_prefix"),
-	Literal("user_inline")
-], { $id: "ContextBinding" });
+var CONTEXT_BINDINGS = [
+	"skill",
+	"context_inline",
+	"prompt_prefix",
+	"user_inline"
+];
+/** Maximum UTF-16 code units accepted in one ContextRef content field. */
+var CONTEXT_REF_MAX_CONTENT_LENGTH = 65536;
+var ContextBinding = Unsafe(Union(CONTEXT_BINDINGS.map((binding) => Literal(binding)), { $id: "ContextBinding" }));
 /** Reusable input fragment for any task type. Soft cap at 5 items. */
 var TaskContext = _Array_(_Object_({
 	slug: String$1({
@@ -9422,7 +9568,7 @@ var TaskContext = _Array_(_Object_({
 	binding: ContextBinding,
 	content: String$1({
 		minLength: 1,
-		maxLength: 65536
+		maxLength: CONTEXT_REF_MAX_CONTENT_LENGTH
 	})
 }, {
 	$id: "ContextRef",
@@ -10775,6 +10921,27 @@ var JudgeEvalAttemptInput = _Object_({
 	$id: "JudgeEvalAttemptInput",
 	additionalProperties: false
 });
+/** Agent-authored part of a judge attempt's output. */
+var JudgeEvalAttemptSubmission = _Object_({
+	targetTaskId: String$1({ format: "uuid" }),
+	targetAttemptN: Integer({ minimum: 1 }),
+	variantLabel: String$1({
+		minLength: 1,
+		maxLength: 64,
+		pattern: "^(?!.* - ).*$"
+	}),
+	scores: _Array_(JudgePackScore, { minItems: 1 }),
+	composite: Number$1({
+		minimum: 0,
+		maximum: 1
+	}),
+	verdict: String$1({ minLength: 1 }),
+	judgeModel: Optional(String$1({ minLength: 1 }))
+}, {
+	$id: "JudgeEvalAttemptSubmission",
+	additionalProperties: false
+});
+/** Durable output after the executor stamps the claim trace context. */
 var JudgeEvalAttemptOutput = _Object_({
 	targetTaskId: String$1({ format: "uuid" }),
 	targetAttemptN: Integer({ minimum: 1 }),
@@ -10790,7 +10957,7 @@ var JudgeEvalAttemptOutput = _Object_({
 	}),
 	verdict: String$1({ minLength: 1 }),
 	judgeModel: Optional(String$1({ minLength: 1 })),
-	traceparent: String$1({ minLength: 1 })
+	traceparent: Optional(String$1({ minLength: 1 }))
 }, {
 	$id: "JudgeEvalAttemptOutput",
 	additionalProperties: false
@@ -11082,15 +11249,33 @@ var RunEvalInput = _Object_({
 	$id: "RunEvalInput",
 	additionalProperties: false
 });
+var RunEvalArtifact = _Object_({
+	path: String$1({ minLength: 1 }),
+	cid: String$1({ minLength: 1 })
+}, { additionalProperties: false });
+/**
+* Fields the eval agent authors through its submit-output tool. Runtime
+* telemetry deliberately does not live here: an agent cannot truthfully
+* measure provider token usage, wall-clock duration, or the claim trace.
+*/
+var RunEvalSubmission = _Object_({
+	response: String$1({ minLength: 1 }),
+	artifacts: Optional(_Array_(RunEvalArtifact)),
+	verification: Optional(VerificationRecord)
+}, {
+	$id: "RunEvalSubmission",
+	additionalProperties: false
+});
+/**
+* Durable eval output. The daemon materializes this from RunEvalSubmission
+* and observed execution metadata before the task service accepts it.
+*/
 var RunEvalOutput = _Object_({
 	response: String$1({ minLength: 1 }),
-	artifacts: Optional(_Array_(_Object_({
-		path: String$1({ minLength: 1 }),
-		cid: String$1({ minLength: 1 })
-	}, { additionalProperties: false }))),
+	artifacts: Optional(_Array_(RunEvalArtifact)),
 	totalTokens: Integer({ minimum: 0 }),
 	durationMs: Integer({ minimum: 0 }),
-	traceparent: String$1({ minLength: 1 }),
+	traceparent: Optional(String$1({ minLength: 1 })),
 	verification: Optional(VerificationRecord)
 }, {
 	$id: "RunEvalOutput",
@@ -11235,6 +11420,7 @@ var BUILT_IN_TASK_TYPES = {
 		name: RUN_EVAL_TYPE,
 		inputSchema: RunEvalInput,
 		outputSchema: RunEvalOutput,
+		submissionSchema: RunEvalSubmission,
 		outputKind: "artifact",
 		resumable: true,
 		workspaceScope: "session",
@@ -11247,6 +11433,7 @@ var BUILT_IN_TASK_TYPES = {
 		name: JUDGE_EVAL_ATTEMPT_TYPE,
 		inputSchema: JudgeEvalAttemptInput,
 		outputSchema: JudgeEvalAttemptOutput,
+		submissionSchema: JudgeEvalAttemptSubmission,
 		outputKind: "judgment",
 		workspaceScope: "attempt",
 		sessionScope: "none",
@@ -13823,22 +14010,33 @@ function validateTaskInput(taskType, input) {
 	}
 	return [];
 }
-function validateTaskOutput(taskType, output, input) {
+function checkVerificationInputCid(value, runtime) {
+	const verification = value !== null && typeof value === "object" ? value.verification : void 0;
+	if (runtime?.inputCid && verification !== void 0 && verification.inputCid !== runtime.inputCid) return [{
+		field: "output/verification/inputCid",
+		message: "must match the task input CID"
+	}];
+	return [];
+}
+function validateTaskResult(taskType, value, input, runtime, submission = false) {
 	const entry = getTaskTypeEntry(taskType);
 	if (!entry) return [{
 		field: "taskType",
 		message: `Unknown task type: ${taskType}`
 	}];
-	const errors = schemaErrors("output", entry.outputSchema, output);
+	const errors = schemaErrors("output", submission ? entry.submissionSchema ?? entry.outputSchema : entry.outputSchema, value);
 	if (errors.length > 0) return errors;
 	if (entry.validateOutput) {
-		const validationError = entry.validateOutput(output, input);
+		const validationError = entry.validateOutput(value, input);
 		if (validationError) return [{
 			field: "output",
 			message: validationError
 		}];
 	}
-	return [];
+	return checkVerificationInputCid(value, runtime);
+}
+function validateTaskOutput(taskType, output, input, runtime) {
+	return validateTaskResult(taskType, output, input, runtime);
 }
 /**
 * Resolve the TypeBox output schema registered for `taskType`. Returns
@@ -15443,8 +15641,10 @@ function createAgent(options) {
 		client,
 		auth
 	};
+	const diaries = createDiariesNamespace(context);
 	return {
-		diaries: createDiariesNamespace(context),
+		agentKeys: createAgentKeysNamespace(context),
+		diaries,
 		diaryGrants: createDiaryGrantsNamespace(context),
 		diaryTransfers: createDiaryTransfersNamespace(context),
 		packs: createPacksNamespace(context),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/node-red-contrib-core",
-  "version": "0.12.0",
+  "version": "0.12.2",
   "type": "module",
   "description": "Node-RED nodes for the MoltNet API",
   "keywords": [
@@ -46,7 +46,7 @@
   },
   "main": "dist/nodes/agent.js",
   "dependencies": {
-    "@themoltnet/sdk": "0.120.0"
+    "@themoltnet/sdk": "0.122.0"
   },
   "devDependencies": {
     "@types/node": "^22.19.0",