@themoltnet/pi-extension 0.35.2 → 0.35.3

package/dist/index.js

@@ -42,6 +42,59 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 //#endregion
+//#region ../sdk/src/errors.ts
+var MoltNetError = class extends Error {
+	code;
+	statusCode;
+	detail;
+	/**
+	* Populated when the server returned a `VALIDATION_FAILED` problem
+	* (status 400) with field-level errors. Empty / undefined for every
+	* other problem kind. Proposer scripts surface these to operators so
+	* they don't have to re-run with curl to see what was rejected.
+	*/
+	validationErrors;
+	constructor(message, options) {
+		super(message);
+		this.name = "MoltNetError";
+		this.code = options.code;
+		this.statusCode = options.statusCode;
+		this.detail = options.detail;
+		this.validationErrors = options.validationErrors;
+	}
+};
+var NetworkError = class extends MoltNetError {
+	constructor(message, options) {
+		super(message, {
+			code: "NETWORK_ERROR",
+			detail: options?.detail
+		});
+		this.name = "NetworkError";
+	}
+};
+var AuthenticationError = class extends MoltNetError {
+	constructor(message, options) {
+		super(message, {
+			code: "AUTH_FAILED",
+			statusCode: options?.statusCode,
+			detail: options?.detail
+		});
+		this.name = "AuthenticationError";
+	}
+};
+function problemToError(problem, statusCode) {
+	const title = problem.title ?? "Request failed";
+	const message = problem.detail ? `${title}: ${problem.detail}` : title;
+	const rawErrors = problem.errors;
+	const validationErrors = Array.isArray(rawErrors) ? rawErrors.filter((e) => typeof e === "object" && e !== null && typeof e.field === "string" && typeof e.message === "string") : void 0;
+	return new MoltNetError(message, {
+		code: problem.type ?? problem.code ?? "UNKNOWN",
+		statusCode,
+		detail: problem.detail,
+		validationErrors
+	});
+}
+//#endregion
 //#region ../api-client/src/generated/core/bodySerializer.gen.ts
 var jsonBodySerializer = { bodySerializer: (body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value) };
 Object.entries({
@@ -754,7 +807,7 @@ var rotateAgentKey = (options) => (options.client ?? client).post({
 	...options
 });
 /**
-* Get the authenticated agent identity (requires bearer token).
+* Get the authenticated caller identity and context. Works for both agents (identity plus, under agent-key auth, the credential binding) and humans, via bearer, session, or cookie auth.
 */
 var getWhoami = (options) => (options?.client ?? client).get({
 	security: [
@@ -2934,63 +2987,11 @@ function createRateLimitFetch(options) {
 	});
 }
 //#endregion
-//#region ../sdk/src/errors.ts
-var MoltNetError = class extends Error {
-	code;
-	statusCode;
-	detail;
-	/**
-	* Populated when the server returned a `VALIDATION_FAILED` problem
-	* (status 400) with field-level errors. Empty / undefined for every
-	* other problem kind. Proposer scripts surface these to operators so
-	* they don't have to re-run with curl to see what was rejected.
-	*/
-	validationErrors;
-	constructor(message, options) {
-		super(message);
-		this.name = "MoltNetError";
-		this.code = options.code;
-		this.statusCode = options.statusCode;
-		this.detail = options.detail;
-		this.validationErrors = options.validationErrors;
-	}
-};
-var NetworkError = class extends MoltNetError {
-	constructor(message, options) {
-		super(message, {
-			code: "NETWORK_ERROR",
-			detail: options?.detail
-		});
-		this.name = "NetworkError";
-	}
-};
-var AuthenticationError = class extends MoltNetError {
-	constructor(message, options) {
-		super(message, {
-			code: "AUTH_FAILED",
-			statusCode: options?.statusCode,
-			detail: options?.detail
-		});
-		this.name = "AuthenticationError";
-	}
-};
-function problemToError(problem, statusCode) {
-	const title = problem.title ?? "Request failed";
-	const message = problem.detail ? `${title}: ${problem.detail}` : title;
-	const rawErrors = problem.errors;
-	const validationErrors = Array.isArray(rawErrors) ? rawErrors.filter((e) => typeof e === "object" && e !== null && typeof e.field === "string" && typeof e.message === "string") : void 0;
-	return new MoltNetError(message, {
-		code: problem.type ?? problem.code ?? "UNKNOWN",
-		statusCode,
-		detail: problem.detail,
-		validationErrors
-	});
-}
-//#endregion
 //#region ../sdk/src/agent-context.ts
 function unwrapResult(result) {
 	if (result.error !== void 0 && result.error !== null) {
 		const error = result.error;
+		if (error instanceof MoltNetError) throw error;
 		if (isProblemDetails(error)) throw problemToError(error, error.status);
 		if (error instanceof Error && result.response === void 0) {
 			const networkError = new NetworkError(error.message, { detail: error.cause ? stringifyUnknown(error.cause) : void 0 });
@@ -3113,16 +3114,25 @@ function createAgentKeysNamespace(context) {
 	};
 }
 //#endregion
+//#region ../sdk/src/namespaces/whoami.ts
+/**
+* Build a `whoami()` accessor bound to an authenticated context. Returns the
+* caller's identity and context: `subjectType`, `currentTeamId`, and, for an
+* agent authenticated via an agent key, its `credentialBinding`.
+*/
+function createWhoami(context) {
+	const { client, auth } = context;
+	return async () => unwrapResult(await getWhoami({
+		client,
+		auth
+	}));
+}
+//#endregion
 //#region ../sdk/src/namespaces/agents.ts
 function createAgentsNamespace(context) {
-	const { client, auth } = context;
+	const { client } = context;
 	return {
-		async whoami() {
-			return unwrapResult(await getWhoami({
-				client,
-				auth
-			}));
-		},
+		whoami: createWhoami(context),
 		async lookup(fingerprint) {
 			return unwrapResult(await getAgentProfile({
 				client,
@@ -15764,22 +15774,37 @@ function createAgent(options) {
 		runtimeSlots: createRuntimeSlotsNamespace(context),
 		runtimeSessions: createRuntimeSessionsNamespace(context),
 		client,
-		getToken: () => tokenManager.getToken()
+		getToken: () => {
+			if (tokenManager) return tokenManager.getToken();
+			if (auth) return auth();
+			return Promise.reject(new MoltNetError("No token source configured", { code: "NO_TOKEN_SOURCE" }));
+		}
 	};
 }
 //#endregion
 //#region ../sdk/src/config.ts
 /**
 * Read MoltNet credentials from environment variables.
-* Reads MOLTNET_CLIENT_ID, MOLTNET_CLIENT_SECRET, and MOLTNET_API_URL.
+* Reads MOLTNET_CLIENT_ID, MOLTNET_CLIENT_SECRET, MOLTNET_API_URL, and
+* MOLTNET_AGENT_KEY.
 */
 function readEnvCredentials() {
 	return {
 		clientId: process.env.MOLTNET_CLIENT_ID,
 		clientSecret: process.env.MOLTNET_CLIENT_SECRET,
-		apiUrl: process.env.MOLTNET_API_URL
+		apiUrl: process.env.MOLTNET_API_URL,
+		agentKey: process.env.MOLTNET_AGENT_KEY
 	};
 }
+/**
+* Resolve the API base URL from an ordered list of candidates, falling back to
+* the hosted default, with any trailing slash stripped. Candidates are tried in
+* order — pass them highest-precedence first (typically explicit option, then
+* env, then config file) so every caller shares one precedence rule.
+*/
+function normalizeApiUrl(...candidates) {
+	return (candidates.find((c) => c) ?? "https://api.themolt.net").replace(/\/$/, "");
+}
 //#endregion
 //#region ../sdk/src/credentials.ts
 function getConfigDir() {
@@ -15843,6 +15868,32 @@ function createRetryFetch(tokenManager, options) {
 		return doFetch(init);
 	};
 }
+/**
+* Create a fetch wrapper for agent-key (static-bearer) authentication.
+*
+* A static key cannot be refreshed, so there is no token-invalidation/replay
+* (that half of {@link createRetryFetch} is intentionally omitted). What remains
+* is orthogonal to token refresh and still matters for a long-running client:
+*
+* - **429**: delegates to `createRateLimitFetch` (Retry-After / backoff), unless
+*   `retry` is `false`.
+* - **401**: the key was rejected (revoked, expired, or not authorized for the
+*   requested team). Rather than silently returning a bare 401 on every call,
+*   throw an actionable {@link AuthenticationError}. The key value is never
+*   included in the message.
+*/
+function createAgentKeyFetch(retry) {
+	const rateLimitFetch = retry === false ? fetch : createRateLimitFetch({
+		maxRetries: retry?.maxRateLimitRetries,
+		baseDelayMs: retry?.baseDelayMs,
+		maxDelayMs: retry?.maxDelayMs
+	});
+	return async (input, init) => {
+		const response = await rateLimitFetch(input, init);
+		if (response.status === 401) throw new AuthenticationError("agent key rejected (401): the key is revoked, expired, or not authorized for the requested team — re-provision the key.", { statusCode: 401 });
+		return response;
+	};
+}
 //#endregion
 //#region ../sdk/src/token.ts
 var TokenManager = class {
@@ -15902,37 +15953,76 @@ var TokenManager = class {
 };
 //#endregion
 //#region ../sdk/src/connect.ts
-var DEFAULT_API_URL = "https://api.themolt.net";
-async function resolveCredentials(options) {
+async function resolveConnection(options) {
+	const env = readEnvCredentials();
+	const explicitAgentKey = options.agentKey?.trim();
+	if (explicitAgentKey) {
+		const config = await readConfig(options.configDir);
+		return {
+			mode: "agentKey",
+			agentKey: explicitAgentKey,
+			apiUrl: normalizeApiUrl(options.apiUrl, env.apiUrl, config?.endpoints?.api)
+		};
+	}
 	if (options.clientId && options.clientSecret) return {
+		mode: "oauth2",
 		clientId: options.clientId,
 		clientSecret: options.clientSecret,
-		apiUrl: (options.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, "")
+		apiUrl: normalizeApiUrl(options.apiUrl, env.apiUrl)
 	};
-	const env = readEnvCredentials();
+	const envAgentKey = env.agentKey?.trim();
+	if (envAgentKey) {
+		const config = await readConfig(options.configDir);
+		return {
+			mode: "agentKey",
+			agentKey: envAgentKey,
+			apiUrl: normalizeApiUrl(options.apiUrl, env.apiUrl, config?.endpoints?.api)
+		};
+	}
 	if (env.clientId && env.clientSecret) return {
+		mode: "oauth2",
 		clientId: env.clientId,
 		clientSecret: env.clientSecret,
-		apiUrl: (env.apiUrl ?? options.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, "")
+		apiUrl: normalizeApiUrl(options.apiUrl, env.apiUrl)
 	};
 	const config = await readConfig(options.configDir);
 	if (config?.oauth2?.client_id && config?.oauth2?.client_secret) return {
+		mode: "oauth2",
 		clientId: config.oauth2.client_id,
 		clientSecret: config.oauth2.client_secret,
-		apiUrl: (options.apiUrl ?? config.endpoints?.api ?? DEFAULT_API_URL).replace(/\/$/, "")
+		apiUrl: normalizeApiUrl(options.apiUrl, config.endpoints?.api)
 	};
-	throw new MoltNetError("No credentials found. Provide clientId/clientSecret, set MOLTNET_CLIENT_ID/MOLTNET_CLIENT_SECRET env vars, or run `moltnet register` first.", { code: "NO_CREDENTIALS" });
+	throw new MoltNetError("No credentials found. Provide an agentKey / MOLTNET_AGENT_KEY, clientId/clientSecret, set MOLTNET_CLIENT_ID/MOLTNET_CLIENT_SECRET, or run `moltnet register` first.", { code: "NO_CREDENTIALS" });
 }
 /**
 * Connect to MoltNet and return an authenticated Agent facade.
 *
-* Credential resolution order:
-* 1. Explicit `clientId` / `clientSecret` in options
-* 2. `MOLTNET_CLIENT_ID` / `MOLTNET_CLIENT_SECRET` environment variables
-* 3. Config file (`~/.config/moltnet/moltnet.json`)
+* Credential resolution, highest precedence first. Explicit in-code options —
+* of either kind — always win over the environment and config file:
+* 1. Explicit `agentKey` option → agent-key mode (static bearer)
+* 2. Explicit `clientId` / `clientSecret` → OAuth2 client-credentials
+* 3. `MOLTNET_AGENT_KEY` env → agent-key mode
+* 4. `MOLTNET_CLIENT_ID` / `MOLTNET_CLIENT_SECRET` env → OAuth2
+* 5. Config file (`~/.config/moltnet/moltnet.json`) → OAuth2
+*
+* In agent-key mode the key is sent directly as a bearer token — no OAuth2
+* round-trip — and 429 backoff still applies; a rejected key surfaces an
+* `AuthenticationError`.
 */
 async function connect(options = {}) {
-	const creds = await resolveCredentials(options);
+	const resolved = await resolveConnection(options);
+	if (resolved.mode === "agentKey") {
+		const client = createClient({
+			baseUrl: resolved.apiUrl,
+			fetch: createAgentKeyFetch(options.retry)
+		});
+		const auth = () => Promise.resolve(resolved.agentKey);
+		return createAgent({
+			client,
+			auth
+		});
+	}
+	const creds = resolved;
 	const autoToken = options.autoToken ?? true;
 	const tokenManager = new TokenManager({
 		clientId: creds.clientId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/pi-extension",
-  "version": "0.35.2",
+  "version": "0.35.3",
   "type": "module",
   "description": "MoltNet pi extension — sandboxed tool execution in Gondolin VMs with MoltNet identity and persistent memory",
   "keywords": [
@@ -36,8 +36,8 @@
     "@earendil-works/gondolin": "^0.9.1",
     "@opentelemetry/api": "^1.9.0",
     "typebox": "^1.2.8",
-    "@themoltnet/agent-runtime": "0.36.2",
-    "@themoltnet/sdk": "0.123.0"
+    "@themoltnet/agent-runtime": "0.36.3",
+    "@themoltnet/sdk": "0.124.0"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": ">=0.74.0",