@themoltnet/pi-extension 0.35.2 → 0.35.4

package/dist/index.js

@@ -42,6 +42,59 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 //#endregion
+//#region ../sdk/src/errors.ts
+var MoltNetError = class extends Error {
+	code;
+	statusCode;
+	detail;
+	/**
+	* Populated when the server returned a `VALIDATION_FAILED` problem
+	* (status 400) with field-level errors. Empty / undefined for every
+	* other problem kind. Proposer scripts surface these to operators so
+	* they don't have to re-run with curl to see what was rejected.
+	*/
+	validationErrors;
+	constructor(message, options) {
+		super(message);
+		this.name = "MoltNetError";
+		this.code = options.code;
+		this.statusCode = options.statusCode;
+		this.detail = options.detail;
+		this.validationErrors = options.validationErrors;
+	}
+};
+var NetworkError = class extends MoltNetError {
+	constructor(message, options) {
+		super(message, {
+			code: "NETWORK_ERROR",
+			detail: options?.detail
+		});
+		this.name = "NetworkError";
+	}
+};
+var AuthenticationError = class extends MoltNetError {
+	constructor(message, options) {
+		super(message, {
+			code: "AUTH_FAILED",
+			statusCode: options?.statusCode,
+			detail: options?.detail
+		});
+		this.name = "AuthenticationError";
+	}
+};
+function problemToError(problem, statusCode) {
+	const title = problem.title ?? "Request failed";
+	const message = problem.detail ? `${title}: ${problem.detail}` : title;
+	const rawErrors = problem.errors;
+	const validationErrors = Array.isArray(rawErrors) ? rawErrors.filter((e) => typeof e === "object" && e !== null && typeof e.field === "string" && typeof e.message === "string") : void 0;
+	return new MoltNetError(message, {
+		code: problem.type ?? problem.code ?? "UNKNOWN",
+		statusCode,
+		detail: problem.detail,
+		validationErrors
+	});
+}
+//#endregion
 //#region ../api-client/src/generated/core/bodySerializer.gen.ts
 var jsonBodySerializer = { bodySerializer: (body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value) };
 Object.entries({
@@ -754,7 +807,7 @@ var rotateAgentKey = (options) => (options.client ?? client).post({
 	...options
 });
 /**
-* Get the authenticated agent identity (requires bearer token).
+* Get the authenticated caller identity and context. Works for both agents (identity plus, under agent-key auth, the credential binding) and humans, via bearer, session, or cookie auth.
 */
 var getWhoami = (options) => (options?.client ?? client).get({
 	security: [
@@ -837,6 +890,145 @@ var getCryptoIdentity = (options) => (options?.client ?? client).get({
 	url: "/crypto/identity",
 	...options
 });
+var listSigningCredentials = (options) => (options.client ?? client).get({
+	security: [
+		{
+			scheme: "bearer",
+			type: "http"
+		},
+		{
+			name: "X-Moltnet-Session-Token",
+			type: "apiKey"
+		},
+		{
+			in: "cookie",
+			name: "ory_kratos_session",
+			type: "apiKey"
+		}
+	],
+	url: "/crypto/signing-credentials",
+	...options
+});
+var beginSigningCredentialRegistration = (options) => (options.client ?? client).post({
+	security: [{
+		name: "X-Moltnet-Session-Token",
+		type: "apiKey"
+	}, {
+		in: "cookie",
+		name: "ory_kratos_session",
+		type: "apiKey"
+	}],
+	url: "/crypto/signing-credentials/registrations",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
+});
+var completeSigningCredentialRegistration = (options) => (options.client ?? client).post({
+	security: [{
+		name: "X-Moltnet-Session-Token",
+		type: "apiKey"
+	}, {
+		in: "cookie",
+		name: "ory_kratos_session",
+		type: "apiKey"
+	}],
+	url: "/crypto/signing-credentials/registrations/{id}/complete",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
+});
+var getSigningCredential = (options) => (options.client ?? client).get({
+	security: [
+		{
+			scheme: "bearer",
+			type: "http"
+		},
+		{
+			name: "X-Moltnet-Session-Token",
+			type: "apiKey"
+		},
+		{
+			in: "cookie",
+			name: "ory_kratos_session",
+			type: "apiKey"
+		}
+	],
+	url: "/crypto/signing-credentials/{id}",
+	...options
+});
+var approveSigningCredential = (options) => (options.client ?? client).post({
+	security: [
+		{
+			scheme: "bearer",
+			type: "http"
+		},
+		{
+			name: "X-Moltnet-Session-Token",
+			type: "apiKey"
+		},
+		{
+			in: "cookie",
+			name: "ory_kratos_session",
+			type: "apiKey"
+		}
+	],
+	url: "/crypto/signing-credentials/{id}/approve",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
+});
+var revokeSigningCredential = (options) => (options.client ?? client).post({
+	security: [
+		{
+			scheme: "bearer",
+			type: "http"
+		},
+		{
+			name: "X-Moltnet-Session-Token",
+			type: "apiKey"
+		},
+		{
+			in: "cookie",
+			name: "ory_kratos_session",
+			type: "apiKey"
+		}
+	],
+	url: "/crypto/signing-credentials/{id}/revoke",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
+});
+var suspendSigningCredential = (options) => (options.client ?? client).post({
+	security: [
+		{
+			scheme: "bearer",
+			type: "http"
+		},
+		{
+			name: "X-Moltnet-Session-Token",
+			type: "apiKey"
+		},
+		{
+			in: "cookie",
+			name: "ory_kratos_session",
+			type: "apiKey"
+		}
+	],
+	url: "/crypto/signing-credentials/{id}/suspend",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
+});
 /**
 * List signing requests for the authenticated agent.
 */
@@ -907,6 +1099,54 @@ var getSigningRequest = (options) => (options.client ?? client).get({
 	url: "/crypto/signing-requests/{id}",
 	...options
 });
+var claimSigningRequest = (options) => (options.client ?? client).post({
+	security: [{
+		name: "X-Moltnet-Session-Token",
+		type: "apiKey"
+	}, {
+		in: "cookie",
+		name: "ory_kratos_session",
+		type: "apiKey"
+	}],
+	url: "/crypto/signing-requests/{id}/claim",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
+});
+var completeSigningRequest = (options) => (options.client ?? client).post({
+	security: [{
+		name: "X-Moltnet-Session-Token",
+		type: "apiKey"
+	}, {
+		in: "cookie",
+		name: "ory_kratos_session",
+		type: "apiKey"
+	}],
+	url: "/crypto/signing-requests/{id}/complete",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
+});
+var rejectSigningRequest = (options) => (options.client ?? client).post({
+	security: [{
+		name: "X-Moltnet-Session-Token",
+		type: "apiKey"
+	}, {
+		in: "cookie",
+		name: "ory_kratos_session",
+		type: "apiKey"
+	}],
+	url: "/crypto/signing-requests/{id}/reject",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
+});
 /**
 * Submit a signature for a signing request. The DBOS workflow verifies the signature and updates the request status.
 */
@@ -2934,63 +3174,11 @@ function createRateLimitFetch(options) {
 	});
 }
 //#endregion
-//#region ../sdk/src/errors.ts
-var MoltNetError = class extends Error {
-	code;
-	statusCode;
-	detail;
-	/**
-	* Populated when the server returned a `VALIDATION_FAILED` problem
-	* (status 400) with field-level errors. Empty / undefined for every
-	* other problem kind. Proposer scripts surface these to operators so
-	* they don't have to re-run with curl to see what was rejected.
-	*/
-	validationErrors;
-	constructor(message, options) {
-		super(message);
-		this.name = "MoltNetError";
-		this.code = options.code;
-		this.statusCode = options.statusCode;
-		this.detail = options.detail;
-		this.validationErrors = options.validationErrors;
-	}
-};
-var NetworkError = class extends MoltNetError {
-	constructor(message, options) {
-		super(message, {
-			code: "NETWORK_ERROR",
-			detail: options?.detail
-		});
-		this.name = "NetworkError";
-	}
-};
-var AuthenticationError = class extends MoltNetError {
-	constructor(message, options) {
-		super(message, {
-			code: "AUTH_FAILED",
-			statusCode: options?.statusCode,
-			detail: options?.detail
-		});
-		this.name = "AuthenticationError";
-	}
-};
-function problemToError(problem, statusCode) {
-	const title = problem.title ?? "Request failed";
-	const message = problem.detail ? `${title}: ${problem.detail}` : title;
-	const rawErrors = problem.errors;
-	const validationErrors = Array.isArray(rawErrors) ? rawErrors.filter((e) => typeof e === "object" && e !== null && typeof e.field === "string" && typeof e.message === "string") : void 0;
-	return new MoltNetError(message, {
-		code: problem.type ?? problem.code ?? "UNKNOWN",
-		statusCode,
-		detail: problem.detail,
-		validationErrors
-	});
-}
-//#endregion
 //#region ../sdk/src/agent-context.ts
 function unwrapResult(result) {
 	if (result.error !== void 0 && result.error !== null) {
 		const error = result.error;
+		if (error instanceof MoltNetError) throw error;
 		if (isProblemDetails(error)) throw problemToError(error, error.status);
 		if (error instanceof Error && result.response === void 0) {
 			const networkError = new NetworkError(error.message, { detail: error.cause ? stringifyUnknown(error.cause) : void 0 });
@@ -3113,16 +3301,25 @@ function createAgentKeysNamespace(context) {
 	};
 }
 //#endregion
+//#region ../sdk/src/namespaces/whoami.ts
+/**
+* Build a `whoami()` accessor bound to an authenticated context. Returns the
+* caller's identity and context: `subjectType`, `currentTeamId`, and, for an
+* agent authenticated via an agent key, its `credentialBinding`.
+*/
+function createWhoami(context) {
+	const { client, auth } = context;
+	return async () => unwrapResult(await getWhoami({
+		client,
+		auth
+	}));
+}
+//#endregion
 //#region ../sdk/src/namespaces/agents.ts
 function createAgentsNamespace(context) {
-	const { client, auth } = context;
+	const { client } = context;
 	return {
-		async whoami() {
-			return unwrapResult(await getWhoami({
-				client,
-				auth
-			}));
-		},
+		whoami: createWhoami(context),
 		async lookup(fingerprint) {
 			return unwrapResult(await getAgentProfile({
 				client,
@@ -3151,7 +3348,7 @@ function createAuthNamespace(context) {
 }
 //#endregion
 //#region ../sdk/src/namespaces/crypto.ts
-function createCryptoNamespace(context, signingRequests) {
+function createCryptoNamespace(context, signingRequests, signingCredentials) {
 	const { client, auth } = context;
 	return {
 		async identity() {
@@ -3166,7 +3363,8 @@ function createCryptoNamespace(context, signingRequests) {
 				body
 			}));
 		},
-		signingRequests
+		signingRequests,
+		signingCredentials
 	};
 }
 //#endregion
@@ -5458,6 +5656,70 @@ function createRuntimeSlotsNamespace(context) {
 	};
 }
 //#endregion
+//#region ../sdk/src/namespaces/signing-credentials.ts
+function createSigningCredentialsNamespace(context) {
+	const { client, auth } = context;
+	return {
+		async list(query, options) {
+			return unwrapResult(await listSigningCredentials({
+				client,
+				auth,
+				headers: requiredTeamHeaders(options),
+				query
+			}));
+		},
+		async get(id, options) {
+			return unwrapResult(await getSigningCredential({
+				client,
+				auth,
+				headers: requiredTeamHeaders(options),
+				path: { id }
+			}));
+		},
+		async startRegistration(body, options) {
+			return unwrapResult(await beginSigningCredentialRegistration({
+				client,
+				auth,
+				headers: requiredTeamHeaders(options),
+				body
+			}));
+		},
+		async completeRegistration(id, body, options) {
+			return unwrapResult(await completeSigningCredentialRegistration({
+				client,
+				auth,
+				headers: requiredTeamHeaders(options),
+				path: { id },
+				body
+			}));
+		},
+		async approve(id, options) {
+			return unwrapResult(await approveSigningCredential({
+				client,
+				auth,
+				headers: requiredTeamHeaders(options),
+				path: { id }
+			}));
+		},
+		async suspend(id, options) {
+			return unwrapResult(await suspendSigningCredential({
+				client,
+				auth,
+				headers: requiredTeamHeaders(options),
+				path: { id }
+			}));
+		},
+		async revoke(id, options) {
+			return unwrapResult(await revokeSigningCredential({
+				client,
+				auth,
+				headers: requiredTeamHeaders(options),
+				path: { id }
+			}));
+		}
+	};
+}
+//#endregion
 //#region ../sdk/src/namespaces/signing-requests.ts
 function createSigningRequestsNamespace(context) {
 	const { client, auth } = context;
@@ -5490,6 +5752,33 @@ function createSigningRequestsNamespace(context) {
 				path: { id },
 				body
 			}));
+		},
+		async claim(id, body, options) {
+			return unwrapResult(await claimSigningRequest({
+				client,
+				auth,
+				headers: requiredTeamHeaders(options),
+				path: { id },
+				body
+			}));
+		},
+		async complete(id, body, options) {
+			return unwrapResult(await completeSigningRequest({
+				client,
+				auth,
+				headers: requiredTeamHeaders(options),
+				path: { id },
+				body
+			}));
+		},
+		async reject(id, body, options) {
+			return unwrapResult(await rejectSigningRequest({
+				client,
+				auth,
+				headers: requiredTeamHeaders(options),
+				path: { id },
+				body
+			}));
 		}
 	};
 }
@@ -15751,7 +16040,7 @@ function createAgent(options) {
 		packs: createPacksNamespace(context),
 		entries: createEntriesNamespace(context),
 		agents: createAgentsNamespace(context),
-		crypto: createCryptoNamespace(context, createSigningRequestsNamespace(context)),
+		crypto: createCryptoNamespace(context, createSigningRequestsNamespace(context), createSigningCredentialsNamespace(context)),
 		vouch: createVouchNamespace(context),
 		auth: createAuthNamespace(context),
 		recovery: createRecoveryNamespace(context),
@@ -15764,22 +16053,37 @@ function createAgent(options) {
 		runtimeSlots: createRuntimeSlotsNamespace(context),
 		runtimeSessions: createRuntimeSessionsNamespace(context),
 		client,
-		getToken: () => tokenManager.getToken()
+		getToken: () => {
+			if (tokenManager) return tokenManager.getToken();
+			if (auth) return auth();
+			return Promise.reject(new MoltNetError("No token source configured", { code: "NO_TOKEN_SOURCE" }));
+		}
 	};
 }
 //#endregion
 //#region ../sdk/src/config.ts
 /**
 * Read MoltNet credentials from environment variables.
-* Reads MOLTNET_CLIENT_ID, MOLTNET_CLIENT_SECRET, and MOLTNET_API_URL.
+* Reads MOLTNET_CLIENT_ID, MOLTNET_CLIENT_SECRET, MOLTNET_API_URL, and
+* MOLTNET_AGENT_KEY.
 */
 function readEnvCredentials() {
 	return {
 		clientId: process.env.MOLTNET_CLIENT_ID,
 		clientSecret: process.env.MOLTNET_CLIENT_SECRET,
-		apiUrl: process.env.MOLTNET_API_URL
+		apiUrl: process.env.MOLTNET_API_URL,
+		agentKey: process.env.MOLTNET_AGENT_KEY
 	};
 }
+/**
+* Resolve the API base URL from an ordered list of candidates, falling back to
+* the hosted default, with any trailing slash stripped. Candidates are tried in
+* order — pass them highest-precedence first (typically explicit option, then
+* env, then config file) so every caller shares one precedence rule.
+*/
+function normalizeApiUrl(...candidates) {
+	return (candidates.find((c) => c) ?? "https://api.themolt.net").replace(/\/$/, "");
+}
 //#endregion
 //#region ../sdk/src/credentials.ts
 function getConfigDir() {
@@ -15843,6 +16147,32 @@ function createRetryFetch(tokenManager, options) {
 		return doFetch(init);
 	};
 }
+/**
+* Create a fetch wrapper for agent-key (static-bearer) authentication.
+*
+* A static key cannot be refreshed, so there is no token-invalidation/replay
+* (that half of {@link createRetryFetch} is intentionally omitted). What remains
+* is orthogonal to token refresh and still matters for a long-running client:
+*
+* - **429**: delegates to `createRateLimitFetch` (Retry-After / backoff), unless
+*   `retry` is `false`.
+* - **401**: the key was rejected (revoked, expired, or not authorized for the
+*   requested team). Rather than silently returning a bare 401 on every call,
+*   throw an actionable {@link AuthenticationError}. The key value is never
+*   included in the message.
+*/
+function createAgentKeyFetch(retry) {
+	const rateLimitFetch = retry === false ? fetch : createRateLimitFetch({
+		maxRetries: retry?.maxRateLimitRetries,
+		baseDelayMs: retry?.baseDelayMs,
+		maxDelayMs: retry?.maxDelayMs
+	});
+	return async (input, init) => {
+		const response = await rateLimitFetch(input, init);
+		if (response.status === 401) throw new AuthenticationError("agent key rejected (401): the key is revoked, expired, or not authorized for the requested team — re-provision the key.", { statusCode: 401 });
+		return response;
+	};
+}
 //#endregion
 //#region ../sdk/src/token.ts
 var TokenManager = class {
@@ -15902,37 +16232,76 @@ var TokenManager = class {
 };
 //#endregion
 //#region ../sdk/src/connect.ts
-var DEFAULT_API_URL = "https://api.themolt.net";
-async function resolveCredentials(options) {
+async function resolveConnection(options) {
+	const env = readEnvCredentials();
+	const explicitAgentKey = options.agentKey?.trim();
+	if (explicitAgentKey) {
+		const config = await readConfig(options.configDir);
+		return {
+			mode: "agentKey",
+			agentKey: explicitAgentKey,
+			apiUrl: normalizeApiUrl(options.apiUrl, env.apiUrl, config?.endpoints?.api)
+		};
+	}
 	if (options.clientId && options.clientSecret) return {
+		mode: "oauth2",
 		clientId: options.clientId,
 		clientSecret: options.clientSecret,
-		apiUrl: (options.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, "")
+		apiUrl: normalizeApiUrl(options.apiUrl, env.apiUrl)
 	};
-	const env = readEnvCredentials();
+	const envAgentKey = env.agentKey?.trim();
+	if (envAgentKey) {
+		const config = await readConfig(options.configDir);
+		return {
+			mode: "agentKey",
+			agentKey: envAgentKey,
+			apiUrl: normalizeApiUrl(options.apiUrl, env.apiUrl, config?.endpoints?.api)
+		};
+	}
 	if (env.clientId && env.clientSecret) return {
+		mode: "oauth2",
 		clientId: env.clientId,
 		clientSecret: env.clientSecret,
-		apiUrl: (env.apiUrl ?? options.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, "")
+		apiUrl: normalizeApiUrl(options.apiUrl, env.apiUrl)
 	};
 	const config = await readConfig(options.configDir);
 	if (config?.oauth2?.client_id && config?.oauth2?.client_secret) return {
+		mode: "oauth2",
 		clientId: config.oauth2.client_id,
 		clientSecret: config.oauth2.client_secret,
-		apiUrl: (options.apiUrl ?? config.endpoints?.api ?? DEFAULT_API_URL).replace(/\/$/, "")
+		apiUrl: normalizeApiUrl(options.apiUrl, config.endpoints?.api)
 	};
-	throw new MoltNetError("No credentials found. Provide clientId/clientSecret, set MOLTNET_CLIENT_ID/MOLTNET_CLIENT_SECRET env vars, or run `moltnet register` first.", { code: "NO_CREDENTIALS" });
+	throw new MoltNetError("No credentials found. Provide an agentKey / MOLTNET_AGENT_KEY, clientId/clientSecret, set MOLTNET_CLIENT_ID/MOLTNET_CLIENT_SECRET, or run `moltnet register` first.", { code: "NO_CREDENTIALS" });
 }
 /**
 * Connect to MoltNet and return an authenticated Agent facade.
 *
-* Credential resolution order:
-* 1. Explicit `clientId` / `clientSecret` in options
-* 2. `MOLTNET_CLIENT_ID` / `MOLTNET_CLIENT_SECRET` environment variables
-* 3. Config file (`~/.config/moltnet/moltnet.json`)
+* Credential resolution, highest precedence first. Explicit in-code options —
+* of either kind — always win over the environment and config file:
+* 1. Explicit `agentKey` option → agent-key mode (static bearer)
+* 2. Explicit `clientId` / `clientSecret` → OAuth2 client-credentials
+* 3. `MOLTNET_AGENT_KEY` env → agent-key mode
+* 4. `MOLTNET_CLIENT_ID` / `MOLTNET_CLIENT_SECRET` env → OAuth2
+* 5. Config file (`~/.config/moltnet/moltnet.json`) → OAuth2
+*
+* In agent-key mode the key is sent directly as a bearer token — no OAuth2
+* round-trip — and 429 backoff still applies; a rejected key surfaces an
+* `AuthenticationError`.
 */
 async function connect(options = {}) {
-	const creds = await resolveCredentials(options);
+	const resolved = await resolveConnection(options);
+	if (resolved.mode === "agentKey") {
+		const client = createClient({
+			baseUrl: resolved.apiUrl,
+			fetch: createAgentKeyFetch(options.retry)
+		});
+		const auth = () => Promise.resolve(resolved.agentKey);
+		return createAgent({
+			client,
+			auth
+		});
+	}
+	const creds = resolved;
 	const autoToken = options.autoToken ?? true;
 	const tokenManager = new TokenManager({
 		clientId: creds.clientId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/pi-extension",
-  "version": "0.35.2",
+  "version": "0.35.4",
   "type": "module",
   "description": "MoltNet pi extension — sandboxed tool execution in Gondolin VMs with MoltNet identity and persistent memory",
   "keywords": [
@@ -36,8 +36,8 @@
     "@earendil-works/gondolin": "^0.9.1",
     "@opentelemetry/api": "^1.9.0",
     "typebox": "^1.2.8",
-    "@themoltnet/agent-runtime": "0.36.2",
-    "@themoltnet/sdk": "0.123.0"
+    "@themoltnet/sdk": "0.125.0",
+    "@themoltnet/agent-runtime": "0.36.4"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": ">=0.74.0",