@themoltnet/pi-runtime 0.18.0 → 0.18.1

package/dist/index.js

@@ -253,11 +253,54 @@ var CREDENTIAL_SCOPES = {
 	TaskManage: "task:manage",
 	TaskRead: "task:read",
 	TaskWrite: "task:write",
+	TeamJoin: "team:join",
 	TeamManage: "team:manage",
 	TeamRead: "team:read"
 };
 var ALL_CREDENTIAL_SCOPES = Object.freeze(Object.values(CREDENTIAL_SCOPES));
-CREDENTIAL_SCOPES.AgentProfile, CREDENTIAL_SCOPES.CryptoSign, CREDENTIAL_SCOPES.RuntimeRead, CREDENTIAL_SCOPES.TaskRead, CREDENTIAL_SCOPES.TaskClaim, CREDENTIAL_SCOPES.TaskExecute;
+/**
+* What the agent daemon cannot run without, checked against
+* `GET /agents/whoami` at startup. Task credentials attenuate it further to
+* `task:execute` alone.
+*
+* This is the **boot floor**, and deliberately not the same list as
+* `AGENT_CREDENTIAL_SCOPES`. A credential's scopes are fixed when it is minted
+* and `POST /agent-keys` caps a new key at the scopes of the credential
+* requesting it, so no key can ever widen itself. A scope added here therefore
+* stops every daemon already in the field, and only a human with a Console
+* session can mint the replacement. Add one only when the daemon genuinely
+* cannot work without it; anything a caller merely benefits from belongs in
+* `DAEMON_OPTIONAL_SCOPES`, where absence costs a capability instead.
+*
+* `crypto:sign` is part of the minimum because host-capability signing runs on
+* the daemon's own credential: the local seed signer calls the signing-request
+* endpoints, which require it. A grant without it produces a daemon that boots
+* cleanly and then fails the first time guest code signs a diary entry or a
+* commit.
+*/
+var DAEMON_MINIMUM_SCOPES = [
+	CREDENTIAL_SCOPES.AgentProfile,
+	CREDENTIAL_SCOPES.CryptoSign,
+	CREDENTIAL_SCOPES.RuntimeRead,
+	CREDENTIAL_SCOPES.TaskRead,
+	CREDENTIAL_SCOPES.TaskClaim,
+	CREDENTIAL_SCOPES.TaskExecute
+];
+/**
+* Read and enrollment authority a daemon uses when it has it, and runs without
+* when it does not: reading the teams it belongs to and their diaries, and
+* joining a team it is not yet a member of.
+*
+* Which product surface each one enables is deliberately not recorded here.
+* That mapping belongs to whatever consumes the scope and changes with it,
+* while the scope names are the contract and do not.
+*/
+var DAEMON_OPTIONAL_SCOPES = [
+	CREDENTIAL_SCOPES.DiaryRead,
+	CREDENTIAL_SCOPES.TeamRead,
+	CREDENTIAL_SCOPES.TeamJoin
+];
+[...DAEMON_MINIMUM_SCOPES, ...DAEMON_OPTIONAL_SCOPES];
 CREDENTIAL_SCOPES.AgentProfile, CREDENTIAL_SCOPES.TaskRead, CREDENTIAL_SCOPES.TaskWrite;
 CREDENTIAL_SCOPES.AgentProfile, CREDENTIAL_SCOPES.DiaryRead, CREDENTIAL_SCOPES.PackRead, CREDENTIAL_SCOPES.RuntimeRead, CREDENTIAL_SCOPES.TaskRead, CREDENTIAL_SCOPES.TeamRead;
 Object.freeze(ALL_CREDENTIAL_SCOPES.filter((scope) => scope !== CREDENTIAL_SCOPES.HumanProfile));
@@ -281,6 +324,7 @@ var MCP_CLIENT_SCOPES = [
 	CREDENTIAL_SCOPES.TaskManage,
 	CREDENTIAL_SCOPES.TaskRead,
 	CREDENTIAL_SCOPES.TaskWrite,
+	CREDENTIAL_SCOPES.TeamJoin,
 	CREDENTIAL_SCOPES.TeamManage,
 	CREDENTIAL_SCOPES.TeamRead
 ];
@@ -634,17 +678,16 @@ Type.Object({
 		Type.Literal("executor"),
 		Type.Literal("member")
 	])),
-	maxUses: Type.Optional(Type.Integer({
-		minimum: 1,
-		default: 1
-	})),
 	expiresInHours: Type.Optional(Type.Integer({
 		minimum: 1,
 		maximum: 720,
 		default: 168
 	}))
 });
-Type.Object({ code: Type.String({ minLength: 1 }) });
+Type.Object({
+	code: Type.String({ minLength: 1 }),
+	issueAgentKey: Type.Optional(Type.Literal(true))
+});
 Type.Object({ role: Type.Union([
 	Type.Literal("manager"),
 	Type.Literal("executor"),
@@ -669,8 +712,7 @@ Type.Object({
 		Type.Literal("executor"),
 		Type.Literal("member")
 	]),
-	maxUses: Type.Integer(),
-	useCount: Type.Integer(),
+	usedAt: Type.Union([Type.String({ format: "date-time" }), Type.Null()]),
 	expiresAt: DateTimeUnsafe,
 	createdAt: DateTimeUnsafe
 });
@@ -701,11 +743,7 @@ Type.Object({
 });
 Type.Object({
 	teamId: UuidSchema,
-	role: Type.Union([
-		Type.Literal("manager"),
-		Type.Literal("executor"),
-		Type.Literal("member")
-	])
+	role: TeamRoleSchema
 });
 Type.Object({
 	updated: Type.Boolean(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/pi-runtime",
-  "version": "0.18.0",
+  "version": "0.18.1",
   "license": "MIT",
   "type": "module",
   "description": "Composable MoltNet runtime kernel for Pi agents in Gondolin VMs",
@@ -39,10 +39,10 @@
     "@opentelemetry/api": "^1.9.1",
     "multiformats": "^13.3.0",
     "typebox": "^1.2.8",
-    "@themoltnet/agent-runtime": "1.0.3",
-    "@themoltnet/sandbox-gondolin": "0.5.1",
+    "@themoltnet/agent-runtime": "1.1.0",
     "@themoltnet/os-keyring": "0.3.0",
-    "@themoltnet/sdk": "0.142.0",
+    "@themoltnet/sdk": "0.143.0",
+    "@themoltnet/sandbox-gondolin": "0.5.1",
     "@themoltnet/shell-command-analyzer": "0.4.0"
   },
   "peerDependencies": {
@@ -60,10 +60,10 @@
     "vite": "^8.0.0",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^3.0.0",
+    "@moltnet/models": "0.1.0",
     "@moltnet/crypto-service": "0.1.0",
     "@moltnet/runtime-profiles": "0.1.0",
-    "@moltnet/tasks": "0.1.0",
-    "@moltnet/models": "0.1.0"
+    "@moltnet/tasks": "0.1.0"
   },
   "engines": {
     "node": ">=24"