@themoltnet/pi-extension 0.35.0 → 0.35.2

package/dist/index.js

@@ -658,6 +658,102 @@ var getNetworkInfo = (options) => (options?.client ?? client).get({
 	...options
 });
 /**
+* List agent API keys bound to the active team. Team credential managers may list every agent.
+*/
+var listAgentKeys = (options) => (options.client ?? client).get({
+	security: [
+		{
+			scheme: "bearer",
+			type: "http"
+		},
+		{
+			name: "X-Moltnet-Session-Token",
+			type: "apiKey"
+		},
+		{
+			in: "cookie",
+			name: "ory_kratos_session",
+			type: "apiKey"
+		}
+	],
+	url: "/agent-keys",
+	...options
+});
+/**
+* Issue a secret API key bound to one agent and the active team.
+*/
+var createAgentKey = (options) => (options.client ?? client).post({
+	security: [
+		{
+			scheme: "bearer",
+			type: "http"
+		},
+		{
+			name: "X-Moltnet-Session-Token",
+			type: "apiKey"
+		},
+		{
+			in: "cookie",
+			name: "ory_kratos_session",
+			type: "apiKey"
+		}
+	],
+	url: "/agent-keys",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
+});
+/**
+* Permanently revoke an agent API key.
+*/
+var revokeAgentKey = (options) => (options.client ?? client).post({
+	security: [
+		{
+			scheme: "bearer",
+			type: "http"
+		},
+		{
+			name: "X-Moltnet-Session-Token",
+			type: "apiKey"
+		},
+		{
+			in: "cookie",
+			name: "ory_kratos_session",
+			type: "apiKey"
+		}
+	],
+	url: "/agent-keys/{keyId}/revoke",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
+});
+/**
+* Rotate an agent API key immediately. The previous secret is revoked and expiry is unchanged.
+*/
+var rotateAgentKey = (options) => (options.client ?? client).post({
+	security: [
+		{
+			scheme: "bearer",
+			type: "http"
+		},
+		{
+			name: "X-Moltnet-Session-Token",
+			type: "apiKey"
+		},
+		{
+			in: "cookie",
+			name: "ory_kratos_session",
+			type: "apiKey"
+		}
+	],
+	url: "/agent-keys/{keyId}/rotate",
+	...options
+});
+/**
 * Get the authenticated agent identity (requires bearer token).
 */
 var getWhoami = (options) => (options?.client ?? client).get({
@@ -2941,6 +3037,82 @@ function unwrapRequired(result, message, code) {
 	return result.data;
 }
 //#endregion
+//#region ../sdk/src/namespaces/query.ts
+/**
+* Remove `undefined`-valued keys from a query object before it is serialized.
+*
+* Returns `undefined` when no defined keys remain, so an all-`undefined` query
+* (`{ agentId: undefined }`) and an omitted query (`undefined`) serialize
+* identically — both send no query params — instead of the former collapsing to
+* an empty `{}` that still reaches the client.
+*/
+function stripUndefinedQuery(query) {
+	if (!query) return;
+	const entries = Object.entries(query).filter(([, value]) => value !== void 0);
+	return entries.length ? Object.fromEntries(entries) : void 0;
+}
+//#endregion
+//#region ../sdk/src/namespaces/team-headers.ts
+/**
+* Build the team header from an optional option, or `undefined` when no team
+* context was supplied. Used by diaries and runtime-profiles, whose endpoints
+* accept the header optionally.
+*/
+function teamHeaders(options) {
+	return options?.teamId ? { "x-moltnet-team-id": options.teamId } : void 0;
+}
+/**
+* Build the team header from a required option. Used by tasks and
+* runtime-slots, whose endpoints mandate the header.
+*/
+function requiredTeamHeaders(options) {
+	return { "x-moltnet-team-id": options.teamId };
+}
+//#endregion
+//#region ../sdk/src/namespaces/agent-keys.ts
+function createAgentKeysNamespace(context) {
+	const { client, auth } = context;
+	return {
+		async list(query, options) {
+			return unwrapResult(await listAgentKeys({
+				client,
+				auth,
+				headers: requiredTeamHeaders(options),
+				query: stripUndefinedQuery(query)
+			}));
+		},
+		async create(body, options) {
+			return unwrapResult(await createAgentKey({
+				client,
+				auth,
+				headers: {
+					...requiredTeamHeaders(options),
+					"idempotency-key": options.idempotencyKey
+				},
+				body
+			}));
+		},
+		async rotate(keyId, options) {
+			return unwrapResult(await rotateAgentKey({
+				client,
+				auth,
+				headers: requiredTeamHeaders(options),
+				path: { keyId }
+			}));
+		},
+		async revoke(keyId, body, options) {
+			const result = await revokeAgentKey({
+				client,
+				auth,
+				headers: requiredTeamHeaders(options),
+				path: { keyId },
+				body
+			});
+			if (result.error) unwrapResult(result);
+		}
+	};
+}
+//#endregion
 //#region ../sdk/src/namespaces/agents.ts
 function createAgentsNamespace(context) {
 	const { client, auth } = context;
@@ -2998,23 +3170,6 @@ function createCryptoNamespace(context, signingRequests) {
 	};
 }
 //#endregion
-//#region ../sdk/src/namespaces/team-headers.ts
-/**
-* Build the team header from an optional option, or `undefined` when no team
-* context was supplied. Used by diaries and runtime-profiles, whose endpoints
-* accept the header optionally.
-*/
-function teamHeaders(options) {
-	return options?.teamId ? { "x-moltnet-team-id": options.teamId } : void 0;
-}
-/**
-* Build the team header from a required option. Used by tasks and
-* runtime-slots, whose endpoints mandate the header.
-*/
-function requiredTeamHeaders(options) {
-	return { "x-moltnet-team-id": options.teamId };
-}
-//#endregion
 //#region ../sdk/src/namespaces/diaries.ts
 function createDiariesNamespace(context) {
 	const { client, auth } = context;
@@ -4925,7 +5080,10 @@ function createEntriesNamespace(context) {
 			const signingRequest = unwrapResult(await createSigningRequest({
 				client,
 				auth,
-				body: { message: computeContentCid(body.entryType ?? "semantic", body.title ?? null, body.content, body.tags ?? null) }
+				body: {
+					message: computeContentCid(body.entryType ?? "semantic", body.title ?? null, body.content, body.tags ?? null),
+					verificationMethod: "agent-ed25519"
+				}
 			}));
 			const privateKeyBytes = new Uint8Array(Buffer.from(privateKey, "base64"));
 			const signature = await signAsync(new Uint8Array(Buffer.from(signingRequest.signingInput, "base64")), privateKeyBytes);
@@ -5290,12 +5448,11 @@ function createRuntimeSlotsNamespace(context) {
 			}
 		},
 		async list(query, options) {
-			const filteredQuery = Object.fromEntries(Object.entries(query).filter(([, value]) => value !== void 0));
 			return unwrapResult(await listRuntimeSlots({
 				auth,
 				client,
 				headers: requiredTeamHeaders(options),
-				query: filteredQuery
+				query: stripUndefinedQuery(query)
 			})).items;
 		}
 	};
@@ -15585,8 +15742,10 @@ function createAgent(options) {
 		client,
 		auth
 	};
+	const diaries = createDiariesNamespace(context);
 	return {
-		diaries: createDiariesNamespace(context),
+		agentKeys: createAgentKeysNamespace(context),
+		diaries,
 		diaryGrants: createDiaryGrantsNamespace(context),
 		diaryTransfers: createDiaryTransfersNamespace(context),
 		packs: createPacksNamespace(context),
@@ -26456,20 +26615,20 @@ async function openVmWorkspaceFileForRead(config) {
 	};
 }
 function createGondolinToolDefinitions(config) {
-	const { vm, mountPath, guestWorkspace } = config;
-	const grepTool = createGrepToolDefinition(mountPath);
+	const { vm, cwdPath, guestWorkspace } = config;
+	const grepTool = createGrepToolDefinition(cwdPath);
 	return [
-		createReadToolDefinition(mountPath, { operations: createGondolinReadOps(vm, mountPath, guestWorkspace) }),
-		createWriteToolDefinition(mountPath, { operations: createGondolinWriteOps(vm, mountPath, guestWorkspace) }),
-		createEditToolDefinition(mountPath, { operations: createGondolinEditOps(vm, mountPath, guestWorkspace) }),
-		createBashToolDefinition(mountPath, { operations: createGondolinBashOps(vm, mountPath, guestWorkspace) }),
-		createLsToolDefinition(mountPath, { operations: createGondolinLsOps(vm, mountPath, guestWorkspace) }),
-		createFindToolDefinition(mountPath, { operations: createGondolinFindOps(vm, mountPath, guestWorkspace) }),
+		createReadToolDefinition(cwdPath, { operations: createGondolinReadOps(vm, cwdPath, guestWorkspace) }),
+		createWriteToolDefinition(cwdPath, { operations: createGondolinWriteOps(vm, cwdPath, guestWorkspace) }),
+		createEditToolDefinition(cwdPath, { operations: createGondolinEditOps(vm, cwdPath, guestWorkspace) }),
+		createBashToolDefinition(cwdPath, { operations: createGondolinBashOps(vm, cwdPath, guestWorkspace) }),
+		createLsToolDefinition(cwdPath, { operations: createGondolinLsOps(vm, cwdPath, guestWorkspace) }),
+		createFindToolDefinition(cwdPath, { operations: createGondolinFindOps(vm, cwdPath, guestWorkspace) }),
 		{
 			...grepTool,
 			async execute(...args) {
 				const [_id, params, signal] = args;
-				return executeGondolinGrep(vm, mountPath, guestWorkspace, params, signal);
+				return executeGondolinGrep(vm, cwdPath, guestWorkspace, params, signal);
 			}
 		}
 	];
@@ -26759,7 +26918,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 		if (injectedContext.userInlineSuffix) taskPrompt = `${taskPrompt}\n\n---\n\n${injectedContext.userInlineSuffix}`;
 		const gondolinCustomTools = createGondolinToolDefinitions({
 			vm: managed.vm,
-			mountPath,
+			cwdPath,
 			guestWorkspace: managed.guestWorkspace
 		});
 		const { handle: submitToolHandle, tools: submitToolDefs } = resolveSubmitTools(task.taskType, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/pi-extension",
-  "version": "0.35.0",
+  "version": "0.35.2",
   "type": "module",
   "description": "MoltNet pi extension — sandboxed tool execution in Gondolin VMs with MoltNet identity and persistent memory",
   "keywords": [
@@ -36,8 +36,8 @@
     "@earendil-works/gondolin": "^0.9.1",
     "@opentelemetry/api": "^1.9.0",
     "typebox": "^1.2.8",
-    "@themoltnet/sdk": "0.121.0",
-    "@themoltnet/agent-runtime": "0.36.0"
+    "@themoltnet/agent-runtime": "0.36.2",
+    "@themoltnet/sdk": "0.123.0"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": ">=0.74.0",