@themoltnet/pi-runtime 0.14.2 → 0.15.0

package/dist/index.d.ts

@@ -56,13 +56,17 @@ import { WriteOperations } from '@earendil-works/pi-coding-agent';
 
 export { activateAgentEnv }
 
+declare const AGENT_SIGNING_PROTOCOL_VERSION: 1;
+
 /**
  * Non-secret identity of the agent a daemon runs as. Everything here may be
  * projected into a sandbox guest; nothing here can sign.
  */
 declare interface AgentIdentity {
+    protocolVersion: typeof AGENT_SIGNING_PROTOCOL_VERSION;
     agentName: string;
-    identityId: string;
+    subjectId: string;
+    subjectType: 'agent';
     /** `ed25519:<base64>` */
     publicKey: string;
     fingerprint: string;

package/dist/index.js

@@ -1741,7 +1741,14 @@ var CREDENTIAL_SCOPES = {
 var ALL_CREDENTIAL_SCOPES = Object.freeze(Object.values(CREDENTIAL_SCOPES));
 CREDENTIAL_SCOPES.AgentProfile, CREDENTIAL_SCOPES.CryptoSign, CREDENTIAL_SCOPES.RuntimeRead, CREDENTIAL_SCOPES.TaskRead, CREDENTIAL_SCOPES.TaskClaim, CREDENTIAL_SCOPES.TaskExecute;
 Object.freeze(ALL_CREDENTIAL_SCOPES.filter((scope) => scope !== CREDENTIAL_SCOPES.HumanProfile));
-[
+/**
+* REST capabilities exercised by the current MCP tool surface.
+*
+* Intentionally excludes connector invocation, key management, runtime
+* management/read, and task claiming because MCP exposes none of those
+* operations.
+*/
+var MCP_CLIENT_SCOPES = [
 	CREDENTIAL_SCOPES.AgentProfile,
 	CREDENTIAL_SCOPES.CryptoSign,
 	CREDENTIAL_SCOPES.DiaryManage,
@@ -1755,7 +1762,13 @@ Object.freeze(ALL_CREDENTIAL_SCOPES.filter((scope) => scope !== CREDENTIAL_SCOPE
 	CREDENTIAL_SCOPES.TaskRead,
 	CREDENTIAL_SCOPES.TeamManage,
 	CREDENTIAL_SCOPES.TeamRead
-].filter((scope) => scope !== CREDENTIAL_SCOPES.HumanProfile);
+];
+MCP_CLIENT_SCOPES.filter((scope) => scope !== CREDENTIAL_SCOPES.HumanProfile);
+Object.freeze([...[
+	"openid",
+	"offline",
+	"offline_access"
+], ...MCP_CLIENT_SCOPES]);
 //#endregion
 //#region ../models/src/preview-sign.ts
 function schemaRef$1(schema, id) {
@@ -2296,7 +2309,8 @@ Type.Object({ "x-moltnet-team-id": Type.Optional(Type.String({
 })) });
 Type.Object({
 	kind: Type.Literal("agent"),
-	identityId: UuidSchema,
+	agentId: UuidSchema,
+	identityId: Type.Union([UuidSchema, Type.Null()]),
 	fingerprint: FingerprintSchema,
 	publicKey: PublicKeySchema
 }, {
@@ -2313,7 +2327,8 @@ Type.Object({
 });
 var principalUnionVariants = [Type.Object({
 	kind: Type.Literal("agent"),
-	identityId: UuidSchema,
+	agentId: UuidSchema,
+	identityId: Type.Union([UuidSchema, Type.Null()]),
 	fingerprint: FingerprintSchema,
 	publicKey: PublicKeySchema
 }, { additionalProperties: false }), Type.Object({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/pi-runtime",
-  "version": "0.14.2",
+  "version": "0.15.0",
   "license": "MIT",
   "type": "module",
   "description": "Composable MoltNet runtime kernel for Pi agents in Gondolin VMs",
@@ -35,11 +35,11 @@
     "@opentelemetry/api": "^1.9.1",
     "multiformats": "^13.3.0",
     "typebox": "^1.2.8",
+    "@themoltnet/agent-runtime": "1.0.0",
+    "@themoltnet/sandbox-gondolin": "0.5.1",
+    "@themoltnet/sdk": "0.141.0",
     "@themoltnet/os-keyring": "0.3.0",
-    "@themoltnet/agent-runtime": "0.45.3",
-    "@themoltnet/sdk": "0.140.1",
-    "@themoltnet/shell-command-analyzer": "0.3.0",
-    "@themoltnet/sandbox-gondolin": "0.5.1"
+    "@themoltnet/shell-command-analyzer": "0.3.0"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": "0.84.4",
@@ -56,10 +56,10 @@
     "vite": "^8.0.0",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
-    "@moltnet/crypto-service": "0.1.0",
     "@moltnet/models": "0.1.0",
     "@moltnet/runtime-profiles": "0.1.0",
-    "@moltnet/tasks": "0.1.0"
+    "@moltnet/tasks": "0.1.0",
+    "@moltnet/crypto-service": "0.1.0"
   },
   "engines": {
     "node": ">=24"