@xenosystem/agent-sdk 0.10.18 → 0.10.20

package/dist/workforce/index.cjs

@@ -1 +1 @@
-"use strict";var O=Object.defineProperty;var z=Object.getOwnPropertyDescriptor;var H=Object.getOwnPropertyNames;var V=Object.prototype.hasOwnProperty;var D=(e,r)=>{for(var n in r)O(e,n,{get:r[n],enumerable:!0})},J=(e,r,n,c)=>{if(r&&typeof r=="object"||typeof r=="function")for(let o of H(r))!V.call(e,o)&&o!==n&&O(e,o,{get:()=>r[o],enumerable:!(c=z(r,o))||c.enumerable});return e};var K=e=>J(O({},"__esModule",{value:!0}),e);var le={};D(le,{RUN_LEASE_MAX_SECONDS:()=>N,RUN_LEASE_SKEW_SECONDS:()=>C,RunAuthorityRefusedError:()=>P,RunStepRefused:()=>w,WorkforceAdmissionRefused:()=>m,createWorkforceRunAdmissionClient:()=>ce,createWorkforceRunAuthority:()=>X,verifyWorkforceRunLease:()=>W});module.exports=K(le);var L=require("node:crypto"),q="/api/workforce/run-admissions/authorize-step",B="/api/oauth2/jwks",N=60,C=5,Y="xeno-run-lease+jwt",Z=1e4,j=65536,w=class extends Error{constructor(n){super(`run step refused: ${n}`);this.reason=n;this.name="RunStepRefused",this.details={reason:n}}reason;details};function W(e,r){let n=s=>({valid:!1,reason:s}),c=typeof e=="string"?e.split("."):[];if(c.length!==3)return n("malformed");let o,l;try{o=JSON.parse(Buffer.from(c[0],"base64url").toString("utf8")),l=JSON.parse(Buffer.from(c[1],"base64url").toString("utf8"))}catch{return n("malformed")}if(o.alg!=="ES256"||o.typ!==Y)return n("wrong_type");if(!r.publicKey)return n("unknown_key");if(!(0,L.verify)("sha256",Buffer.from(`${c[0]}.${c[1]}`),{key:r.publicKey,dsaEncoding:"ieee-p1363"},Buffer.from(c[2],"base64url")))return n("bad_signature");if(l.iss!=="xeno-platform"||l.aud!=="xeno-run-runtime"||l.sub!==r.admissionId)return n("wrong_subject");if(!Number.isSafeInteger(l.iat)||!Number.isSafeInteger(l.exp)||l.exp<=l.iat||l.exp-l.iat>N)return n("unbounded");if(!Array.isArray(l.caps)||!l.caps.every(s=>typeof s=="string"))return n("malformed");let d;try{d=BigInt(l.seq)}catch{return n("malformed")}if(d<r.minSequence)return n("superseded");if(r.nowWallMs/1e3>=l.exp-C)return n("expired");if(r.receivedAtMono===null)return n("requires_online_reauthorization");let i=(r.nowMono-r.receivedAtMono)/1e3;return i<0?n("requires_online_reauthorization"):i>=l.exp-l.iat-C?n("expired"):{valid:!0,sequence:d,claims:l}}async function F(e,r){let n=e.headers.get("content-length");if(n!==null&&(!/^\d+$/.test(n)||Number(n)>j))throw new Error("response too large");if(!e.body)return null;let c=e.body.getReader(),o=[],l=0;try{for(;;){let{done:i,value:s}=await c.read();if(r.aborted)throw new Error("response did not complete before the deadline");if(i)break;if(l+=s.byteLength,l>j)throw new Error("response too large");o.push(s)}}finally{try{c.releaseLock()}catch{}}let t=new Uint8Array(l),d=0;for(let i of o)t.set(i,d),d+=i.byteLength;return t.length?JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(t)):null}function X(e){let r=e.fetchImpl??globalThis.fetch,n=e.clock??{wallMs:()=>Date.now(),monoMs:()=>performance.now()},c=e.admissionId;if(!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(c))throw new Error("invalid admission id");let o;try{o=new URL(e.issuer)}catch{throw new Error("invalid issuer")}if(o.protocol!=="https:"||o.pathname!=="/"||o.username||o.password||o.search||o.hash)throw new Error("invalid issuer");let l=o.origin,t=new Map,d=new Map,i=null,s=async(a,f,u)=>{let p=`${l}${f}`,R=new AbortController,b=setTimeout(()=>R.abort(),Z);b.unref?.();try{let I=null;if(a==="POST"&&(I=await e.authorizeRequest({method:a,url:p}),!I))throw new w("authority_unavailable");let M=await r(p,{method:a,redirect:"error",signal:R.signal,headers:{accept:"application/json",...u?{"content-type":"application/json"}:{},...I?{authorization:I.authorization,...I.dpop?{dpop:I.dpop}:{}}:{}},...u?{body:JSON.stringify(u)}:{}});return{status:M.status,json:await F(M,R.signal)}}finally{clearTimeout(b)}},h=async a=>{if(t.has(a))return t.get(a);let{status:f,json:u}=await s("GET",B);if(f!==200||!u||typeof u!="object"||!Array.isArray(u.keys))return null;for(let p of u.keys)if(!(typeof p.kid!="string"||p.kty!=="EC"||p.crv!=="P-256"))try{t.set(p.kid,(0,L.createPublicKey)({key:{kty:"EC",crv:"P-256",x:p.x,y:p.y},format:"jwk"}))}catch{}return t.get(a)??null},A=()=>e.sequenceStore.read(c)??0n,y=(a,f)=>`${a}:${f??""}`,_=async a=>{let f=JSON.parse(Buffer.from(a.token.split(".")[0],"base64url").toString("utf8")).kid;return W(a.token,{publicKey:await h(f),admissionId:c,receivedAtMono:a.receivedAtMono,nowMono:n.monoMs(),nowWallMs:n.wallMs(),minSequence:A()}).valid},k=async(a,f,u)=>{if(u.throwIfAborted(),i)throw new w(i);let p=d.get(y(a,f));if(p&&await _(p).catch(()=>!1))return;let R;try{R=await s("POST",q,{admissionId:c,operation:a,...f?{capability:f}:{}})}catch(T){throw T instanceof w?T:new w("authority_unavailable")}let b=R.json;if(R.status!==200||b?.success!==!0||typeof b.token!="string"){let T=typeof b?.details?.reason=="string"&&/^[a-z_]{1,64}$/.test(b.details.reason)?b.details.reason:"authority_unavailable";throw T==="admission_revoked"&&(i=T),new w(T)}let I=n.monoMs(),M=(()=>{try{return JSON.parse(Buffer.from(b.token.split(".")[0],"base64url").toString("utf8"))}catch{return null}})();if(typeof M?.kid!="string")throw new w("authority_unavailable");let v=W(b.token,{publicKey:await h(M.kid).catch(()=>null),admissionId:c,receivedAtMono:I,nowMono:n.monoMs(),nowWallMs:n.wallMs(),minSequence:A()});if(!v.valid)throw new w("authority_unavailable");if(a==="privileged_call"&&v.claims.cap!==f)throw new w("authority_unavailable");await e.sequenceStore.write(c,v.sequence),d.set(y(a,f),{token:b.token,sequence:v.sequence,operation:a,capability:f,capabilities:v.claims.caps,iat:v.claims.iat,exp:v.claims.exp,receivedAtMono:I})};return{authorizeDispatch:(a,f)=>k("provider_dispatch",null,f),authorizeToolCall:(a,f)=>{let u=e.capabilityForTool(a.toolName);return u===null||!/^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]{0,127}$/.test(u)?Promise.reject(new w("capability_not_admitted")):k("privileged_call",u,f)}}}var Q="/api/workforce/run-admissions",G="/api/workforce/run-admissions/revoke",ee="/api/workforce/run-admissions/authority",te="/api/workforce/run-admissions/pin";var S=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,ne=/^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]{0,127}$/,$=/^[a-z_]{1,64}$/,re=new Set(["bad_input","denied","not_found","needs_approval","conflict","rate_limited","unavailable","timeout","internal"]),m=class extends Error{constructor(n,c,o={}){super(`workforce admission refused: ${n}/${c}`);this.code=n;this.reason=c;this.name="WorkforceAdmissionRefused",this.details={reason:c,...o}}code;reason;details},E=()=>new m("unavailable","authority_unavailable"),g=e=>e!==null&&typeof e=="object"&&!Array.isArray(e),x=e=>Array.isArray(e)&&e.length<=64&&e.every(r=>typeof r=="string"&&ne.test(r));function oe(e){if(!g(e)||e.schemaVersion!==1||typeof e.admissionId!="string"||!S.test(e.admissionId)||typeof e.operationId!="string"||!S.test(e.operationId))return null;let r=e.agent;if(!g(r)||typeof r.resourceId!="string"||!S.test(r.resourceId)||!Number.isSafeInteger(r.version)||typeof r.contentHash!="string")return null;let n=e.capabilities;if(!g(n)||!x(n.effective)||!x(n.requested))return null;let c=e.payer;if(!g(c)||typeof c.kind!="string")return null;let o=e.budget;return!g(o)||typeof o.ceilingMicro!="string"||!/^[1-9][0-9]{0,17}$/.test(o.ceilingMicro)||!g(e.target)||typeof e.admittedAt!="string"||!Number.isFinite(Date.parse(e.admittedAt))?null:e}var ie=/^[0-9a-f]{64}$/;function se(e,r,n,c){if(!g(e)||e.schemaVersion!==1)return null;let o=e.agent;if(!g(o)||typeof o.resourceId!="string"||o.resourceId.toLowerCase()!==r||!Number.isSafeInteger(o.version)||o.version<1||typeof o.contentHash!="string"||!ie.test(o.contentHash)||!g(e.target)||JSON.stringify(Object.entries(e.target).map(([d,i])=>[d,typeof i=="string"?i.toLowerCase():i]).sort())!==JSON.stringify(Object.entries(n).map(([d,i])=>[d,typeof i=="string"?i.toLowerCase():i]).sort()))return null;let l=e.team;if(c?!g(l)||typeof l.teamId!="string"||l.teamId.toLowerCase()!==c:l!==null)return null;let t=e.terms;return!g(t)||!x(t.definition)||!x(t.target)?null:{schemaVersion:1,agent:{resourceId:r,version:o.version,contentHash:o.contentHash},target:{...n},team:c?{teamId:c}:null,terms:{definition:[...t.definition],target:[...t.target]}}}function U(e,r){return!g(e)||e.schemaVersion!==1||e.admissionId!==r||typeof e.revoked!="boolean"?null:{schemaVersion:1,admissionId:r,revoked:e.revoked,reason:typeof e.reason=="string"&&$.test(e.reason)?e.reason:null,revokedAt:typeof e.revokedAt=="string"?e.revokedAt:null,latestLeaseSequence:typeof e.latestLeaseSequence=="string"?e.latestLeaseSequence:null}}async function ae(e,r){let n=e.headers.get("content-length");if(n!==null&&(!/^\d+$/.test(n)||Number(n)>65536))throw new Error("response too large");if(!e.body)return null;let c=e.body.getReader(),o=[],l=0;try{for(;;){let{done:i,value:s}=await c.read();if(r.aborted)throw new Error("response did not complete before the deadline");if(i)break;if(l+=s.byteLength,l>65536)throw new Error("response too large");o.push(s)}}finally{try{c.releaseLock()}catch{}}let t=new Uint8Array(l),d=0;for(let i of o)t.set(i,d),d+=i.byteLength;return t.length?JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(t)):null}function ce(e){let r=e.fetchImpl??globalThis.fetch,n;try{n=new URL(e.issuer)}catch{throw new Error("invalid issuer")}if(n.protocol!=="https:"||n.pathname!=="/"||n.username||n.password||n.search||n.hash)throw new Error("invalid issuer");let c=n.origin,o=async(t,d,i)=>{let s=`${c}${t}`,h=new AbortController,A=()=>h.abort();i?.addEventListener("abort",A,{once:!0});let y=setTimeout(A,15e3);y.unref?.();try{i?.throwIfAborted();let _=await e.authorizeRequest({method:"POST",url:s});if(!_)throw E();let k,a;try{k=await r(s,{method:"POST",redirect:"error",signal:h.signal,headers:{accept:"application/json","content-type":"application/json",authorization:_.authorization,..._.dpop?{dpop:_.dpop}:{}},body:JSON.stringify(d)}),a=await ae(k,h.signal)}catch(p){throw i?.aborted?p:E()}if(k.status===200&&g(a)&&a.success===!0)return a;let f=g(a)&&typeof a.code=="string"&&re.has(a.code)?a.code:null,u=g(a)&&g(a.details)?a.details:null;throw f&&u&&u.schemaVersion===1&&typeof u.reason=="string"&&$.test(u.reason)?new m(f,u.reason,{...Number.isSafeInteger(u.currentVersion)?{currentVersion:u.currentVersion}:{},...typeof u.availableMicro=="string"&&/^[0-9]{1,20}$/.test(u.availableMicro)?{availableMicro:u.availableMicro}:{},...typeof u.field=="string"&&/^[a-zA-Z.]{1,64}$/.test(u.field)?{field:u.field}:{}}):f?new m(f,f==="denied"&&k.status===403&&g(a)&&typeof a.required_scope=="string"?"insufficient_scope":f):E()}finally{clearTimeout(y),i?.removeEventListener("abort",A)}},l=t=>{if(typeof t!="string"||!S.test(t))throw new m("bad_input","invalid_admission");return t.toLowerCase()};return{async admit(t,d){if(!S.test(t.operationId))throw new m("bad_input","invalid_operation");if(!x(t.capabilities))throw new m("bad_input","invalid_capabilities");if(t.runtimeCapabilities!==void 0&&!x(t.runtimeCapabilities))throw new m("bad_input","invalid_runtime_capabilities");if(!/^[1-9][0-9]{0,17}$/.test(t.budget?.ceilingMicro??""))throw new m("bad_input","invalid_budget_ceiling");let i={operationId:t.operationId,agent:{resourceId:t.agent.resourceId,version:t.agent.version,contentHash:t.agent.contentHash},target:{...t.target},capabilities:[...t.capabilities],budget:{ceilingMicro:t.budget.ceilingMicro},...t.expectedActorAccountId?{expectedActorAccountId:t.expectedActorAccountId}:{},...t.team?{team:{teamId:t.team.teamId}}:{},...t.conversationId?{conversationId:t.conversationId}:{},...t.root?{root:{bindingId:t.root.bindingId,installationId:t.root.installationId}}:{},...t.runtimeCapabilities?{runtimeCapabilities:[...t.runtimeCapabilities]}:{}},s=await o(Q,i,d),h=oe(s.admission);if(!h||h.operationId.toLowerCase()!==t.operationId.toLowerCase())throw E();return{admission:h,replayed:s.replayed===!0}},async revoke(t,d){let i=l(t),s=U(await o(G,{admissionId:i},d),i);if(!s||!s.revoked)throw E();return s},async pin(t,d){let i=t?.agent?.resourceId;if(typeof i!="string"||!S.test(i))throw new m("bad_input","invalid_agent_resource");let s=t.target,h=g(s)?s.kind==="personal"?[s.ownerUserId]:s.kind==="workspace"?[s.assignmentId]:s.kind==="project"?[s.projectId,s.participationId]:null:null;if(!h||!h.every(a=>typeof a=="string"&&S.test(a)))throw new m("bad_input","invalid_target");let A=s.kind==="personal"?{kind:"personal",ownerUserId:s.ownerUserId}:s.kind==="workspace"?{kind:"workspace",assignmentId:s.assignmentId}:{kind:"project",projectId:s.projectId,participationId:s.participationId},y=t.team?t.team.teamId:null;if(y!==null&&(typeof y!="string"||!S.test(y)))throw new m("bad_input","invalid_team");let _={agent:{resourceId:i},target:A,...y?{team:{teamId:y}}:{},...t.expectedActorAccountId?{expectedActorAccountId:t.expectedActorAccountId}:{}},k=se(await o(te,_,d),i.toLowerCase(),A,y?y.toLowerCase():null);if(!k)throw E();return k},async authority(t,d){let i=l(t),s=U(await o(ee,{admissionId:i},d),i);if(!s)throw E();return s}}}var P=class extends Error{code="RUN_AUTHORITY_REFUSED";retryable=!1;reason;step;constructor(r,n,c){super(`Run authority refused the ${r==="dispatch"?"provider dispatch":"tool call"}: ${n}`,c),this.name="RunAuthorityRefusedError",this.reason=n,this.step=r}};0&&(module.exports={RUN_LEASE_MAX_SECONDS,RUN_LEASE_SKEW_SECONDS,RunAuthorityRefusedError,RunStepRefused,WorkforceAdmissionRefused,createWorkforceRunAdmissionClient,createWorkforceRunAuthority,verifyWorkforceRunLease});
+"use strict";var O=Object.defineProperty;var z=Object.getOwnPropertyDescriptor;var V=Object.getOwnPropertyNames;var D=Object.prototype.hasOwnProperty;var J=(e,i)=>{for(var n in i)O(e,n,{get:i[n],enumerable:!0})},K=(e,i,n,c)=>{if(i&&typeof i=="object"||typeof i=="function")for(let r of V(i))!D.call(e,r)&&r!==n&&O(e,r,{get:()=>i[r],enumerable:!(c=z(i,r))||c.enumerable});return e};var q=e=>K(O({},"__esModule",{value:!0}),e);var ue={};J(ue,{RUN_LEASE_MAX_SECONDS:()=>H,RUN_LEASE_SKEW_SECONDS:()=>C,RunAuthorityRefusedError:()=>P,RunStepRefused:()=>b,WorkforceAdmissionRefused:()=>w,createWorkforceRunAdmissionClient:()=>le,createWorkforceRunAuthority:()=>Q,verifyWorkforceRunLease:()=>W});module.exports=q(ue);var L=require("node:crypto"),B="/api/workforce/run-admissions/authorize-step",Y="/api/oauth2/jwks",H=60,C=5,Z="xeno-run-lease+jwt",F=1e4,N=65536,b=class extends Error{constructor(n){super(`run step refused: ${n}`);this.reason=n;this.name="RunStepRefused",this.details={reason:n}}reason;details};function W(e,i){let n=o=>({valid:!1,reason:o}),c=typeof e=="string"?e.split("."):[];if(c.length!==3)return n("malformed");let r,d;try{r=JSON.parse(Buffer.from(c[0],"base64url").toString("utf8")),d=JSON.parse(Buffer.from(c[1],"base64url").toString("utf8"))}catch{return n("malformed")}if(r.alg!=="ES256"||r.typ!==Z)return n("wrong_type");if(!i.publicKey)return n("unknown_key");if(!(0,L.verify)("sha256",Buffer.from(`${c[0]}.${c[1]}`),{key:i.publicKey,dsaEncoding:"ieee-p1363"},Buffer.from(c[2],"base64url")))return n("bad_signature");if(d.iss!=="xeno-platform"||d.aud!=="xeno-run-runtime"||d.sub!==i.admissionId)return n("wrong_subject");if(!Number.isSafeInteger(d.iat)||!Number.isSafeInteger(d.exp)||d.exp<=d.iat||d.exp-d.iat>H)return n("unbounded");if(!Array.isArray(d.caps)||!d.caps.every(o=>typeof o=="string"))return n("malformed");let l;try{l=BigInt(d.seq)}catch{return n("malformed")}if(l<i.minSequence)return n("superseded");if(i.nowWallMs/1e3>=d.exp-C)return n("expired");if(i.receivedAtMono===null)return n("requires_online_reauthorization");let s=(i.nowMono-i.receivedAtMono)/1e3;return s<0?n("requires_online_reauthorization"):s>=d.exp-d.iat-C?n("expired"):{valid:!0,sequence:l,claims:d}}async function X(e,i){let n=e.headers.get("content-length");if(n!==null&&(!/^\d+$/.test(n)||Number(n)>N))throw new Error("response too large");if(!e.body)return null;let c=e.body.getReader(),r=[],d=0;try{for(;;){let{done:s,value:o}=await c.read();if(i.aborted)throw new Error("response did not complete before the deadline");if(s)break;if(d+=o.byteLength,d>N)throw new Error("response too large");r.push(o)}}finally{try{c.releaseLock()}catch{}}let t=new Uint8Array(d),l=0;for(let s of r)t.set(s,l),l+=s.byteLength;return t.length?JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(t)):null}function Q(e){let i=e.fetchImpl??globalThis.fetch,n=e.clock??{wallMs:()=>Date.now(),monoMs:()=>performance.now()},c=e.admissionId;if(!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(c))throw new Error("invalid admission id");let r;try{r=new URL(e.issuer)}catch{throw new Error("invalid issuer")}if(r.protocol!=="https:"||r.pathname!=="/"||r.username||r.password||r.search||r.hash)throw new Error("invalid issuer");let d=r.origin,t=new Map,l=new Map,s=null,o=async(a,p,u)=>{let y=`${d}${p}`,v=new AbortController,A=setTimeout(()=>v.abort(),F);A.unref?.();try{let S=null;if(a==="POST"&&(S=await e.authorizeRequest({method:a,url:y}),!S))throw new b("authority_unavailable");let M=await i(y,{method:a,redirect:"error",signal:v.signal,headers:{accept:"application/json",...u?{"content-type":"application/json"}:{},...S?{authorization:S.authorization,...S.dpop?{dpop:S.dpop}:{}}:{}},...u?{body:JSON.stringify(u)}:{}});return{status:M.status,json:await X(M,v.signal)}}finally{clearTimeout(A)}},f=async a=>{if(t.has(a))return t.get(a);let{status:p,json:u}=await o("GET",Y);if(p!==200||!u||typeof u!="object"||!Array.isArray(u.keys))return null;for(let y of u.keys)if(!(typeof y.kid!="string"||y.kty!=="EC"||y.crv!=="P-256"))try{t.set(y.kid,(0,L.createPublicKey)({key:{kty:"EC",crv:"P-256",x:y.x,y:y.y},format:"jwk"}))}catch{}return t.get(a)??null},m=()=>e.sequenceStore.read(c)??0n,g=(a,p)=>`${a}:${p??""}`,R=async a=>{let p=JSON.parse(Buffer.from(a.token.split(".")[0],"base64url").toString("utf8")).kid;return W(a.token,{publicKey:await f(p),admissionId:c,receivedAtMono:a.receivedAtMono,nowMono:n.monoMs(),nowWallMs:n.wallMs(),minSequence:m()}).valid},_=async(a,p,u)=>{if(u.throwIfAborted(),s)throw new b(s);let y=l.get(g(a,p));if(y&&await R(y).catch(()=>!1))return;let v;try{v=await o("POST",B,{admissionId:c,operation:a,...p?{capability:p}:{}})}catch(E){throw E instanceof b?E:new b("authority_unavailable")}let A=v.json;if(v.status!==200||A?.success!==!0||typeof A.token!="string"){let E=typeof A?.details?.reason=="string"&&/^[a-z_]{1,64}$/.test(A.details.reason)?A.details.reason:"authority_unavailable";throw E==="admission_revoked"&&(s=E),new b(E)}let S=n.monoMs(),M=(()=>{try{return JSON.parse(Buffer.from(A.token.split(".")[0],"base64url").toString("utf8"))}catch{return null}})();if(typeof M?.kid!="string")throw new b("authority_unavailable");let x=W(A.token,{publicKey:await f(M.kid).catch(()=>null),admissionId:c,receivedAtMono:S,nowMono:n.monoMs(),nowWallMs:n.wallMs(),minSequence:m()});if(!x.valid)throw new b("authority_unavailable");if(a==="privileged_call"&&x.claims.cap!==p)throw new b("authority_unavailable");await e.sequenceStore.write(c,x.sequence),l.set(g(a,p),{token:A.token,sequence:x.sequence,operation:a,capability:p,capabilities:x.claims.caps,iat:x.claims.iat,exp:x.claims.exp,receivedAtMono:S})};return{authorizeDispatch:(a,p)=>_("provider_dispatch",null,p),authorizeToolCall:(a,p)=>{let u=e.capabilityForTool(a.toolName);return u===null||!/^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]{0,127}$/.test(u)?Promise.reject(new b("capability_not_admitted")):_("privileged_call",u,p)}}}var G="/api/workforce/run-admissions",ee="/api/workforce/run-admissions/revoke",te="/api/workforce/run-admissions/authority",ne="/api/workforce/run-admissions/pin",re="/api/workforce/run-admissions/read",oe="/api/workforce/run-admissions/operations/read";var I=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,ie=/^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]{0,127}$/,$=/^[a-z_]{1,64}$/,se=new Set(["bad_input","denied","not_found","needs_approval","conflict","rate_limited","unavailable","timeout","internal"]),w=class extends Error{constructor(n,c,r={}){super(`workforce admission refused: ${n}/${c}`);this.code=n;this.reason=c;this.name="WorkforceAdmissionRefused",this.details={reason:c,...r}}code;reason;details},k=()=>new w("unavailable","authority_unavailable"),h=e=>e!==null&&typeof e=="object"&&!Array.isArray(e),T=e=>Array.isArray(e)&&e.length<=64&&e.every(i=>typeof i=="string"&&ie.test(i));function j(e){if(!h(e)||e.schemaVersion!==1||typeof e.admissionId!="string"||!I.test(e.admissionId)||typeof e.operationId!="string"||!I.test(e.operationId))return null;let i=e.agent;if(!h(i)||typeof i.resourceId!="string"||!I.test(i.resourceId)||!Number.isSafeInteger(i.version)||typeof i.contentHash!="string")return null;let n=e.capabilities;if(!h(n)||!T(n.effective)||!T(n.requested))return null;let c=e.payer;if(!h(c)||typeof c.kind!="string")return null;let r=e.budget;return!h(r)||typeof r.ceilingMicro!="string"||!/^[1-9][0-9]{0,17}$/.test(r.ceilingMicro)||!h(e.target)||typeof e.admittedAt!="string"||!Number.isFinite(Date.parse(e.admittedAt))?null:e}var ae=/^[0-9a-f]{64}$/;function ce(e,i,n,c){if(!h(e)||e.schemaVersion!==1)return null;let r=e.agent;if(!h(r)||typeof r.resourceId!="string"||r.resourceId.toLowerCase()!==i||!Number.isSafeInteger(r.version)||r.version<1||typeof r.contentHash!="string"||!ae.test(r.contentHash)||!h(e.target)||JSON.stringify(Object.entries(e.target).map(([l,s])=>[l,typeof s=="string"?s.toLowerCase():s]).sort())!==JSON.stringify(Object.entries(n).map(([l,s])=>[l,typeof s=="string"?s.toLowerCase():s]).sort()))return null;let d=e.team;if(c?!h(d)||typeof d.teamId!="string"||d.teamId.toLowerCase()!==c:d!==null)return null;let t=e.terms;return!h(t)||!T(t.definition)||!T(t.target)?null:{schemaVersion:1,agent:{resourceId:i,version:r.version,contentHash:r.contentHash},target:{...n},team:c?{teamId:c}:null,terms:{definition:[...t.definition],target:[...t.target]}}}function U(e,i){return!h(e)||e.schemaVersion!==1||e.admissionId!==i||typeof e.revoked!="boolean"?null:{schemaVersion:1,admissionId:i,revoked:e.revoked,reason:typeof e.reason=="string"&&$.test(e.reason)?e.reason:null,revokedAt:typeof e.revokedAt=="string"?e.revokedAt:null,latestLeaseSequence:typeof e.latestLeaseSequence=="string"?e.latestLeaseSequence:null}}async function de(e,i){let n=e.headers.get("content-length");if(n!==null&&(!/^\d+$/.test(n)||Number(n)>65536))throw new Error("response too large");if(!e.body)return null;let c=e.body.getReader(),r=[],d=0;try{for(;;){let{done:s,value:o}=await c.read();if(i.aborted)throw new Error("response did not complete before the deadline");if(s)break;if(d+=o.byteLength,d>65536)throw new Error("response too large");r.push(o)}}finally{try{c.releaseLock()}catch{}}let t=new Uint8Array(d),l=0;for(let s of r)t.set(s,l),l+=s.byteLength;return t.length?JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(t)):null}function le(e){let i=e.fetchImpl??globalThis.fetch,n;try{n=new URL(e.issuer)}catch{throw new Error("invalid issuer")}if(n.protocol!=="https:"||n.pathname!=="/"||n.username||n.password||n.search||n.hash)throw new Error("invalid issuer");let c=n.origin,r=async(t,l,s)=>{let o=`${c}${t}`,f=new AbortController,m=()=>f.abort();s?.addEventListener("abort",m,{once:!0});let g=setTimeout(m,15e3);g.unref?.();try{s?.throwIfAborted();let R=await e.authorizeRequest({method:"POST",url:o});if(!R)throw k();let _,a;try{_=await i(o,{method:"POST",redirect:"error",signal:f.signal,headers:{accept:"application/json","content-type":"application/json",authorization:R.authorization,...R.dpop?{dpop:R.dpop}:{}},body:JSON.stringify(l)}),a=await de(_,f.signal)}catch(y){throw s?.aborted?y:k()}if(_.status===200&&h(a)&&a.success===!0)return a;let p=h(a)&&typeof a.code=="string"&&se.has(a.code)?a.code:null,u=h(a)&&h(a.details)?a.details:null;throw p&&u&&u.schemaVersion===1&&typeof u.reason=="string"&&$.test(u.reason)?new w(p,u.reason,{...Number.isSafeInteger(u.currentVersion)?{currentVersion:u.currentVersion}:{},...typeof u.availableMicro=="string"&&/^[0-9]{1,20}$/.test(u.availableMicro)?{availableMicro:u.availableMicro}:{},...typeof u.field=="string"&&/^[a-zA-Z.]{1,64}$/.test(u.field)?{field:u.field}:{}}):p?new w(p,p==="denied"&&_.status===403&&h(a)&&typeof a.required_scope=="string"?"insufficient_scope":p):k()}finally{clearTimeout(g),s?.removeEventListener("abort",m)}},d=t=>{if(typeof t!="string"||!I.test(t))throw new w("bad_input","invalid_admission");return t.toLowerCase()};return{async admit(t,l){if(!I.test(t.operationId))throw new w("bad_input","invalid_operation");if(!T(t.capabilities))throw new w("bad_input","invalid_capabilities");if(t.runtimeCapabilities!==void 0&&!T(t.runtimeCapabilities))throw new w("bad_input","invalid_runtime_capabilities");if(!/^[1-9][0-9]{0,17}$/.test(t.budget?.ceilingMicro??""))throw new w("bad_input","invalid_budget_ceiling");let s={operationId:t.operationId,agent:{resourceId:t.agent.resourceId,version:t.agent.version,contentHash:t.agent.contentHash},target:{...t.target},capabilities:[...t.capabilities],budget:{ceilingMicro:t.budget.ceilingMicro},...t.expectedActorAccountId?{expectedActorAccountId:t.expectedActorAccountId}:{},...t.team?{team:{teamId:t.team.teamId}}:{},...t.conversationId?{conversationId:t.conversationId}:{},...t.root?{root:{bindingId:t.root.bindingId,installationId:t.root.installationId}}:{},...t.runtimeCapabilities?{runtimeCapabilities:[...t.runtimeCapabilities]}:{}},o=await r(G,s,l),f=j(o.admission);if(!f||f.operationId.toLowerCase()!==t.operationId.toLowerCase())throw k();return{admission:f,replayed:o.replayed===!0}},async revoke(t,l){let s=d(t),o=U(await r(ee,{admissionId:s},l),s);if(!o||!o.revoked)throw k();return o},async pin(t,l){let s=t?.agent?.resourceId;if(typeof s!="string"||!I.test(s))throw new w("bad_input","invalid_agent_resource");let o=t.target,f=h(o)?o.kind==="personal"?[o.ownerUserId]:o.kind==="workspace"?[o.assignmentId]:o.kind==="project"?[o.projectId,o.participationId]:null:null;if(!f||!f.every(a=>typeof a=="string"&&I.test(a)))throw new w("bad_input","invalid_target");let m=o.kind==="personal"?{kind:"personal",ownerUserId:o.ownerUserId}:o.kind==="workspace"?{kind:"workspace",assignmentId:o.assignmentId}:{kind:"project",projectId:o.projectId,participationId:o.participationId},g=t.team?t.team.teamId:null;if(g!==null&&(typeof g!="string"||!I.test(g)))throw new w("bad_input","invalid_team");let R={agent:{resourceId:s},target:m,...g?{team:{teamId:g}}:{},...t.expectedActorAccountId?{expectedActorAccountId:t.expectedActorAccountId}:{}},_=ce(await r(ne,R,l),s.toLowerCase(),m,g?g.toLowerCase():null);if(!_)throw k();return _},async read(t,l,s){let o=d(t),f=l?.expectedActorAccountId;if(f!==void 0&&(typeof f!="string"||!I.test(f)))throw new w("bad_input","invalid_expected_actor");let m=await r(re,{admissionId:o,...f?{expectedActorAccountId:f}:{}},s),g=j(m.admission);if(!g||g.admissionId.toLowerCase()!==o)throw k();return g},async readOperation(t,l,s){if(typeof t!="string"||!I.test(t))throw new w("bad_input","invalid_operation");let o=l?.expectedActorAccountId;if(typeof o!="string"||!I.test(o))throw new w("bad_input","invalid_expected_actor");let f=t.toLowerCase(),m=await r(oe,{operationId:f,expectedActorAccountId:o.toLowerCase()},s);if(m.schemaVersion!==1||typeof m.operationId!="string"||m.operationId.toLowerCase()!==f)throw k();if(m.state==="not-observed"&&m.admission===null)return{state:"not-observed",operationId:f,admission:null};if(m.state!=="committed")throw k();let g=j(m.admission);if(!g||g.operationId.toLowerCase()!==f)throw k();return{state:"committed",operationId:f,admission:g}},async authority(t,l){let s=d(t),o=U(await r(te,{admissionId:s},l),s);if(!o)throw k();return o}}}var P=class extends Error{code="RUN_AUTHORITY_REFUSED";retryable=!1;reason;step;constructor(i,n,c){super(`Run authority refused the ${i==="dispatch"?"provider dispatch":"tool call"}: ${n}`,c),this.name="RunAuthorityRefusedError",this.reason=n,this.step=i}};0&&(module.exports={RUN_LEASE_MAX_SECONDS,RUN_LEASE_SKEW_SECONDS,RunAuthorityRefusedError,RunStepRefused,WorkforceAdmissionRefused,createWorkforceRunAdmissionClient,createWorkforceRunAuthority,verifyWorkforceRunLease});

package/dist/workforce/index.d.cts

@@ -201,6 +201,20 @@ interface WorkforceRunAdmissionClient {
     }>;
     revoke(admissionId: string, signal?: AbortSignal): Promise<WorkforceRunAuthorityState>;
     authority(admissionId: string, signal?: AbortSignal): Promise<WorkforceRunAuthorityState>;
+    read(admissionId: string, options?: {
+        expectedActorAccountId?: string;
+    }, signal?: AbortSignal): Promise<WorkforceAdmission>;
+    readOperation(operationId: string, options: {
+        expectedActorAccountId: string;
+    }, signal?: AbortSignal): Promise<{
+        state: "not-observed";
+        operationId: string;
+        admission: null;
+    } | {
+        state: "committed";
+        operationId: string;
+        admission: WorkforceAdmission;
+    }>;
     pin(request: {
         agent: {
             resourceId: string;

package/dist/workforce/index.d.ts

@@ -201,6 +201,20 @@ interface WorkforceRunAdmissionClient {
     }>;
     revoke(admissionId: string, signal?: AbortSignal): Promise<WorkforceRunAuthorityState>;
     authority(admissionId: string, signal?: AbortSignal): Promise<WorkforceRunAuthorityState>;
+    read(admissionId: string, options?: {
+        expectedActorAccountId?: string;
+    }, signal?: AbortSignal): Promise<WorkforceAdmission>;
+    readOperation(operationId: string, options: {
+        expectedActorAccountId: string;
+    }, signal?: AbortSignal): Promise<{
+        state: "not-observed";
+        operationId: string;
+        admission: null;
+    } | {
+        state: "committed";
+        operationId: string;
+        admission: WorkforceAdmission;
+    }>;
     pin(request: {
         agent: {
             resourceId: string;

package/dist/workforce/index.js

@@ -1 +1 @@
-import{createPublicKey as N,verify as U}from"node:crypto";var $="/api/workforce/run-admissions/authorize-step",z="/api/oauth2/jwks",H=60,P=5,V="xeno-run-lease+jwt",D=1e4,O=65536,b=class extends Error{constructor(n){super(`run step refused: ${n}`);this.reason=n;this.name="RunStepRefused",this.details={reason:n}}reason;details};function C(e,a){let n=o=>({valid:!1,reason:o}),l=typeof e=="string"?e.split("."):[];if(l.length!==3)return n("malformed");let i,c;try{i=JSON.parse(Buffer.from(l[0],"base64url").toString("utf8")),c=JSON.parse(Buffer.from(l[1],"base64url").toString("utf8"))}catch{return n("malformed")}if(i.alg!=="ES256"||i.typ!==V)return n("wrong_type");if(!a.publicKey)return n("unknown_key");if(!U("sha256",Buffer.from(`${l[0]}.${l[1]}`),{key:a.publicKey,dsaEncoding:"ieee-p1363"},Buffer.from(l[2],"base64url")))return n("bad_signature");if(c.iss!=="xeno-platform"||c.aud!=="xeno-run-runtime"||c.sub!==a.admissionId)return n("wrong_subject");if(!Number.isSafeInteger(c.iat)||!Number.isSafeInteger(c.exp)||c.exp<=c.iat||c.exp-c.iat>H)return n("unbounded");if(!Array.isArray(c.caps)||!c.caps.every(o=>typeof o=="string"))return n("malformed");let d;try{d=BigInt(c.seq)}catch{return n("malformed")}if(d<a.minSequence)return n("superseded");if(a.nowWallMs/1e3>=c.exp-P)return n("expired");if(a.receivedAtMono===null)return n("requires_online_reauthorization");let r=(a.nowMono-a.receivedAtMono)/1e3;return r<0?n("requires_online_reauthorization"):r>=c.exp-c.iat-P?n("expired"):{valid:!0,sequence:d,claims:c}}async function J(e,a){let n=e.headers.get("content-length");if(n!==null&&(!/^\d+$/.test(n)||Number(n)>O))throw new Error("response too large");if(!e.body)return null;let l=e.body.getReader(),i=[],c=0;try{for(;;){let{done:r,value:o}=await l.read();if(a.aborted)throw new Error("response did not complete before the deadline");if(r)break;if(c+=o.byteLength,c>O)throw new Error("response too large");i.push(o)}}finally{try{l.releaseLock()}catch{}}let t=new Uint8Array(c),d=0;for(let r of i)t.set(r,d),d+=r.byteLength;return t.length?JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(t)):null}function ne(e){let a=e.fetchImpl??globalThis.fetch,n=e.clock??{wallMs:()=>Date.now(),monoMs:()=>performance.now()},l=e.admissionId;if(!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(l))throw new Error("invalid admission id");let i;try{i=new URL(e.issuer)}catch{throw new Error("invalid issuer")}if(i.protocol!=="https:"||i.pathname!=="/"||i.username||i.password||i.search||i.hash)throw new Error("invalid issuer");let c=i.origin,t=new Map,d=new Map,r=null,o=async(s,f,u)=>{let p=`${c}${f}`,R=new AbortController,w=setTimeout(()=>R.abort(),D);w.unref?.();try{let I=null;if(s==="POST"&&(I=await e.authorizeRequest({method:s,url:p}),!I))throw new b("authority_unavailable");let M=await a(p,{method:s,redirect:"error",signal:R.signal,headers:{accept:"application/json",...u?{"content-type":"application/json"}:{},...I?{authorization:I.authorization,...I.dpop?{dpop:I.dpop}:{}}:{}},...u?{body:JSON.stringify(u)}:{}});return{status:M.status,json:await J(M,R.signal)}}finally{clearTimeout(w)}},m=async s=>{if(t.has(s))return t.get(s);let{status:f,json:u}=await o("GET",z);if(f!==200||!u||typeof u!="object"||!Array.isArray(u.keys))return null;for(let p of u.keys)if(!(typeof p.kid!="string"||p.kty!=="EC"||p.crv!=="P-256"))try{t.set(p.kid,N({key:{kty:"EC",crv:"P-256",x:p.x,y:p.y},format:"jwk"}))}catch{}return t.get(s)??null},A=()=>e.sequenceStore.read(l)??0n,h=(s,f)=>`${s}:${f??""}`,_=async s=>{let f=JSON.parse(Buffer.from(s.token.split(".")[0],"base64url").toString("utf8")).kid;return C(s.token,{publicKey:await m(f),admissionId:l,receivedAtMono:s.receivedAtMono,nowMono:n.monoMs(),nowWallMs:n.wallMs(),minSequence:A()}).valid},k=async(s,f,u)=>{if(u.throwIfAborted(),r)throw new b(r);let p=d.get(h(s,f));if(p&&await _(p).catch(()=>!1))return;let R;try{R=await o("POST",$,{admissionId:l,operation:s,...f?{capability:f}:{}})}catch(T){throw T instanceof b?T:new b("authority_unavailable")}let w=R.json;if(R.status!==200||w?.success!==!0||typeof w.token!="string"){let T=typeof w?.details?.reason=="string"&&/^[a-z_]{1,64}$/.test(w.details.reason)?w.details.reason:"authority_unavailable";throw T==="admission_revoked"&&(r=T),new b(T)}let I=n.monoMs(),M=(()=>{try{return JSON.parse(Buffer.from(w.token.split(".")[0],"base64url").toString("utf8"))}catch{return null}})();if(typeof M?.kid!="string")throw new b("authority_unavailable");let v=C(w.token,{publicKey:await m(M.kid).catch(()=>null),admissionId:l,receivedAtMono:I,nowMono:n.monoMs(),nowWallMs:n.wallMs(),minSequence:A()});if(!v.valid)throw new b("authority_unavailable");if(s==="privileged_call"&&v.claims.cap!==f)throw new b("authority_unavailable");await e.sequenceStore.write(l,v.sequence),d.set(h(s,f),{token:w.token,sequence:v.sequence,operation:s,capability:f,capabilities:v.claims.caps,iat:v.claims.iat,exp:v.claims.exp,receivedAtMono:I})};return{authorizeDispatch:(s,f)=>k("provider_dispatch",null,f),authorizeToolCall:(s,f)=>{let u=e.capabilityForTool(s.toolName);return u===null||!/^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]{0,127}$/.test(u)?Promise.reject(new b("capability_not_admitted")):k("privileged_call",u,f)}}}var K="/api/workforce/run-admissions",q="/api/workforce/run-admissions/revoke",B="/api/workforce/run-admissions/authority",Y="/api/workforce/run-admissions/pin";var S=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,Z=/^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]{0,127}$/,j=/^[a-z_]{1,64}$/,F=new Set(["bad_input","denied","not_found","needs_approval","conflict","rate_limited","unavailable","timeout","internal"]),y=class extends Error{constructor(n,l,i={}){super(`workforce admission refused: ${n}/${l}`);this.code=n;this.reason=l;this.name="WorkforceAdmissionRefused",this.details={reason:l,...i}}code;reason;details},E=()=>new y("unavailable","authority_unavailable"),g=e=>e!==null&&typeof e=="object"&&!Array.isArray(e),x=e=>Array.isArray(e)&&e.length<=64&&e.every(a=>typeof a=="string"&&Z.test(a));function X(e){if(!g(e)||e.schemaVersion!==1||typeof e.admissionId!="string"||!S.test(e.admissionId)||typeof e.operationId!="string"||!S.test(e.operationId))return null;let a=e.agent;if(!g(a)||typeof a.resourceId!="string"||!S.test(a.resourceId)||!Number.isSafeInteger(a.version)||typeof a.contentHash!="string")return null;let n=e.capabilities;if(!g(n)||!x(n.effective)||!x(n.requested))return null;let l=e.payer;if(!g(l)||typeof l.kind!="string")return null;let i=e.budget;return!g(i)||typeof i.ceilingMicro!="string"||!/^[1-9][0-9]{0,17}$/.test(i.ceilingMicro)||!g(e.target)||typeof e.admittedAt!="string"||!Number.isFinite(Date.parse(e.admittedAt))?null:e}var Q=/^[0-9a-f]{64}$/;function G(e,a,n,l){if(!g(e)||e.schemaVersion!==1)return null;let i=e.agent;if(!g(i)||typeof i.resourceId!="string"||i.resourceId.toLowerCase()!==a||!Number.isSafeInteger(i.version)||i.version<1||typeof i.contentHash!="string"||!Q.test(i.contentHash)||!g(e.target)||JSON.stringify(Object.entries(e.target).map(([d,r])=>[d,typeof r=="string"?r.toLowerCase():r]).sort())!==JSON.stringify(Object.entries(n).map(([d,r])=>[d,typeof r=="string"?r.toLowerCase():r]).sort()))return null;let c=e.team;if(l?!g(c)||typeof c.teamId!="string"||c.teamId.toLowerCase()!==l:c!==null)return null;let t=e.terms;return!g(t)||!x(t.definition)||!x(t.target)?null:{schemaVersion:1,agent:{resourceId:a,version:i.version,contentHash:i.contentHash},target:{...n},team:l?{teamId:l}:null,terms:{definition:[...t.definition],target:[...t.target]}}}function W(e,a){return!g(e)||e.schemaVersion!==1||e.admissionId!==a||typeof e.revoked!="boolean"?null:{schemaVersion:1,admissionId:a,revoked:e.revoked,reason:typeof e.reason=="string"&&j.test(e.reason)?e.reason:null,revokedAt:typeof e.revokedAt=="string"?e.revokedAt:null,latestLeaseSequence:typeof e.latestLeaseSequence=="string"?e.latestLeaseSequence:null}}async function ee(e,a){let n=e.headers.get("content-length");if(n!==null&&(!/^\d+$/.test(n)||Number(n)>65536))throw new Error("response too large");if(!e.body)return null;let l=e.body.getReader(),i=[],c=0;try{for(;;){let{done:r,value:o}=await l.read();if(a.aborted)throw new Error("response did not complete before the deadline");if(r)break;if(c+=o.byteLength,c>65536)throw new Error("response too large");i.push(o)}}finally{try{l.releaseLock()}catch{}}let t=new Uint8Array(c),d=0;for(let r of i)t.set(r,d),d+=r.byteLength;return t.length?JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(t)):null}function oe(e){let a=e.fetchImpl??globalThis.fetch,n;try{n=new URL(e.issuer)}catch{throw new Error("invalid issuer")}if(n.protocol!=="https:"||n.pathname!=="/"||n.username||n.password||n.search||n.hash)throw new Error("invalid issuer");let l=n.origin,i=async(t,d,r)=>{let o=`${l}${t}`,m=new AbortController,A=()=>m.abort();r?.addEventListener("abort",A,{once:!0});let h=setTimeout(A,15e3);h.unref?.();try{r?.throwIfAborted();let _=await e.authorizeRequest({method:"POST",url:o});if(!_)throw E();let k,s;try{k=await a(o,{method:"POST",redirect:"error",signal:m.signal,headers:{accept:"application/json","content-type":"application/json",authorization:_.authorization,..._.dpop?{dpop:_.dpop}:{}},body:JSON.stringify(d)}),s=await ee(k,m.signal)}catch(p){throw r?.aborted?p:E()}if(k.status===200&&g(s)&&s.success===!0)return s;let f=g(s)&&typeof s.code=="string"&&F.has(s.code)?s.code:null,u=g(s)&&g(s.details)?s.details:null;throw f&&u&&u.schemaVersion===1&&typeof u.reason=="string"&&j.test(u.reason)?new y(f,u.reason,{...Number.isSafeInteger(u.currentVersion)?{currentVersion:u.currentVersion}:{},...typeof u.availableMicro=="string"&&/^[0-9]{1,20}$/.test(u.availableMicro)?{availableMicro:u.availableMicro}:{},...typeof u.field=="string"&&/^[a-zA-Z.]{1,64}$/.test(u.field)?{field:u.field}:{}}):f?new y(f,f==="denied"&&k.status===403&&g(s)&&typeof s.required_scope=="string"?"insufficient_scope":f):E()}finally{clearTimeout(h),r?.removeEventListener("abort",A)}},c=t=>{if(typeof t!="string"||!S.test(t))throw new y("bad_input","invalid_admission");return t.toLowerCase()};return{async admit(t,d){if(!S.test(t.operationId))throw new y("bad_input","invalid_operation");if(!x(t.capabilities))throw new y("bad_input","invalid_capabilities");if(t.runtimeCapabilities!==void 0&&!x(t.runtimeCapabilities))throw new y("bad_input","invalid_runtime_capabilities");if(!/^[1-9][0-9]{0,17}$/.test(t.budget?.ceilingMicro??""))throw new y("bad_input","invalid_budget_ceiling");let r={operationId:t.operationId,agent:{resourceId:t.agent.resourceId,version:t.agent.version,contentHash:t.agent.contentHash},target:{...t.target},capabilities:[...t.capabilities],budget:{ceilingMicro:t.budget.ceilingMicro},...t.expectedActorAccountId?{expectedActorAccountId:t.expectedActorAccountId}:{},...t.team?{team:{teamId:t.team.teamId}}:{},...t.conversationId?{conversationId:t.conversationId}:{},...t.root?{root:{bindingId:t.root.bindingId,installationId:t.root.installationId}}:{},...t.runtimeCapabilities?{runtimeCapabilities:[...t.runtimeCapabilities]}:{}},o=await i(K,r,d),m=X(o.admission);if(!m||m.operationId.toLowerCase()!==t.operationId.toLowerCase())throw E();return{admission:m,replayed:o.replayed===!0}},async revoke(t,d){let r=c(t),o=W(await i(q,{admissionId:r},d),r);if(!o||!o.revoked)throw E();return o},async pin(t,d){let r=t?.agent?.resourceId;if(typeof r!="string"||!S.test(r))throw new y("bad_input","invalid_agent_resource");let o=t.target,m=g(o)?o.kind==="personal"?[o.ownerUserId]:o.kind==="workspace"?[o.assignmentId]:o.kind==="project"?[o.projectId,o.participationId]:null:null;if(!m||!m.every(s=>typeof s=="string"&&S.test(s)))throw new y("bad_input","invalid_target");let A=o.kind==="personal"?{kind:"personal",ownerUserId:o.ownerUserId}:o.kind==="workspace"?{kind:"workspace",assignmentId:o.assignmentId}:{kind:"project",projectId:o.projectId,participationId:o.participationId},h=t.team?t.team.teamId:null;if(h!==null&&(typeof h!="string"||!S.test(h)))throw new y("bad_input","invalid_team");let _={agent:{resourceId:r},target:A,...h?{team:{teamId:h}}:{},...t.expectedActorAccountId?{expectedActorAccountId:t.expectedActorAccountId}:{}},k=G(await i(Y,_,d),r.toLowerCase(),A,h?h.toLowerCase():null);if(!k)throw E();return k},async authority(t,d){let r=c(t),o=W(await i(B,{admissionId:r},d),r);if(!o)throw E();return o}}}var L=class extends Error{code="RUN_AUTHORITY_REFUSED";retryable=!1;reason;step;constructor(a,n,l){super(`Run authority refused the ${a==="dispatch"?"provider dispatch":"tool call"}: ${n}`,l),this.name="RunAuthorityRefusedError",this.reason=n,this.step=a}};export{H as RUN_LEASE_MAX_SECONDS,P as RUN_LEASE_SKEW_SECONDS,L as RunAuthorityRefusedError,b as RunStepRefused,y as WorkforceAdmissionRefused,oe as createWorkforceRunAdmissionClient,ne as createWorkforceRunAuthority,C as verifyWorkforceRunLease};
+import{createPublicKey as H,verify as U}from"node:crypto";var $="/api/workforce/run-admissions/authorize-step",z="/api/oauth2/jwks",V=60,O=5,D="xeno-run-lease+jwt",J=1e4,C=65536,A=class extends Error{constructor(n){super(`run step refused: ${n}`);this.reason=n;this.name="RunStepRefused",this.details={reason:n}}reason;details};function W(e,a){let n=r=>({valid:!1,reason:r}),d=typeof e=="string"?e.split("."):[];if(d.length!==3)return n("malformed");let i,c;try{i=JSON.parse(Buffer.from(d[0],"base64url").toString("utf8")),c=JSON.parse(Buffer.from(d[1],"base64url").toString("utf8"))}catch{return n("malformed")}if(i.alg!=="ES256"||i.typ!==D)return n("wrong_type");if(!a.publicKey)return n("unknown_key");if(!U("sha256",Buffer.from(`${d[0]}.${d[1]}`),{key:a.publicKey,dsaEncoding:"ieee-p1363"},Buffer.from(d[2],"base64url")))return n("bad_signature");if(c.iss!=="xeno-platform"||c.aud!=="xeno-run-runtime"||c.sub!==a.admissionId)return n("wrong_subject");if(!Number.isSafeInteger(c.iat)||!Number.isSafeInteger(c.exp)||c.exp<=c.iat||c.exp-c.iat>V)return n("unbounded");if(!Array.isArray(c.caps)||!c.caps.every(r=>typeof r=="string"))return n("malformed");let l;try{l=BigInt(c.seq)}catch{return n("malformed")}if(l<a.minSequence)return n("superseded");if(a.nowWallMs/1e3>=c.exp-O)return n("expired");if(a.receivedAtMono===null)return n("requires_online_reauthorization");let o=(a.nowMono-a.receivedAtMono)/1e3;return o<0?n("requires_online_reauthorization"):o>=c.exp-c.iat-O?n("expired"):{valid:!0,sequence:l,claims:c}}async function K(e,a){let n=e.headers.get("content-length");if(n!==null&&(!/^\d+$/.test(n)||Number(n)>C))throw new Error("response too large");if(!e.body)return null;let d=e.body.getReader(),i=[],c=0;try{for(;;){let{done:o,value:r}=await d.read();if(a.aborted)throw new Error("response did not complete before the deadline");if(o)break;if(c+=r.byteLength,c>C)throw new Error("response too large");i.push(r)}}finally{try{d.releaseLock()}catch{}}let t=new Uint8Array(c),l=0;for(let o of i)t.set(o,l),l+=o.byteLength;return t.length?JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(t)):null}function oe(e){let a=e.fetchImpl??globalThis.fetch,n=e.clock??{wallMs:()=>Date.now(),monoMs:()=>performance.now()},d=e.admissionId;if(!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(d))throw new Error("invalid admission id");let i;try{i=new URL(e.issuer)}catch{throw new Error("invalid issuer")}if(i.protocol!=="https:"||i.pathname!=="/"||i.username||i.password||i.search||i.hash)throw new Error("invalid issuer");let c=i.origin,t=new Map,l=new Map,o=null,r=async(s,p,u)=>{let y=`${c}${p}`,v=new AbortController,b=setTimeout(()=>v.abort(),J);b.unref?.();try{let S=null;if(s==="POST"&&(S=await e.authorizeRequest({method:s,url:y}),!S))throw new A("authority_unavailable");let M=await a(y,{method:s,redirect:"error",signal:v.signal,headers:{accept:"application/json",...u?{"content-type":"application/json"}:{},...S?{authorization:S.authorization,...S.dpop?{dpop:S.dpop}:{}}:{}},...u?{body:JSON.stringify(u)}:{}});return{status:M.status,json:await K(M,v.signal)}}finally{clearTimeout(b)}},f=async s=>{if(t.has(s))return t.get(s);let{status:p,json:u}=await r("GET",z);if(p!==200||!u||typeof u!="object"||!Array.isArray(u.keys))return null;for(let y of u.keys)if(!(typeof y.kid!="string"||y.kty!=="EC"||y.crv!=="P-256"))try{t.set(y.kid,H({key:{kty:"EC",crv:"P-256",x:y.x,y:y.y},format:"jwk"}))}catch{}return t.get(s)??null},m=()=>e.sequenceStore.read(d)??0n,g=(s,p)=>`${s}:${p??""}`,R=async s=>{let p=JSON.parse(Buffer.from(s.token.split(".")[0],"base64url").toString("utf8")).kid;return W(s.token,{publicKey:await f(p),admissionId:d,receivedAtMono:s.receivedAtMono,nowMono:n.monoMs(),nowWallMs:n.wallMs(),minSequence:m()}).valid},_=async(s,p,u)=>{if(u.throwIfAborted(),o)throw new A(o);let y=l.get(g(s,p));if(y&&await R(y).catch(()=>!1))return;let v;try{v=await r("POST",$,{admissionId:d,operation:s,...p?{capability:p}:{}})}catch(E){throw E instanceof A?E:new A("authority_unavailable")}let b=v.json;if(v.status!==200||b?.success!==!0||typeof b.token!="string"){let E=typeof b?.details?.reason=="string"&&/^[a-z_]{1,64}$/.test(b.details.reason)?b.details.reason:"authority_unavailable";throw E==="admission_revoked"&&(o=E),new A(E)}let S=n.monoMs(),M=(()=>{try{return JSON.parse(Buffer.from(b.token.split(".")[0],"base64url").toString("utf8"))}catch{return null}})();if(typeof M?.kid!="string")throw new A("authority_unavailable");let x=W(b.token,{publicKey:await f(M.kid).catch(()=>null),admissionId:d,receivedAtMono:S,nowMono:n.monoMs(),nowWallMs:n.wallMs(),minSequence:m()});if(!x.valid)throw new A("authority_unavailable");if(s==="privileged_call"&&x.claims.cap!==p)throw new A("authority_unavailable");await e.sequenceStore.write(d,x.sequence),l.set(g(s,p),{token:b.token,sequence:x.sequence,operation:s,capability:p,capabilities:x.claims.caps,iat:x.claims.iat,exp:x.claims.exp,receivedAtMono:S})};return{authorizeDispatch:(s,p)=>_("provider_dispatch",null,p),authorizeToolCall:(s,p)=>{let u=e.capabilityForTool(s.toolName);return u===null||!/^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]{0,127}$/.test(u)?Promise.reject(new A("capability_not_admitted")):_("privileged_call",u,p)}}}var q="/api/workforce/run-admissions",B="/api/workforce/run-admissions/revoke",Y="/api/workforce/run-admissions/authority",Z="/api/workforce/run-admissions/pin",F="/api/workforce/run-admissions/read",X="/api/workforce/run-admissions/operations/read";var I=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,Q=/^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]{0,127}$/,N=/^[a-z_]{1,64}$/,G=new Set(["bad_input","denied","not_found","needs_approval","conflict","rate_limited","unavailable","timeout","internal"]),w=class extends Error{constructor(n,d,i={}){super(`workforce admission refused: ${n}/${d}`);this.code=n;this.reason=d;this.name="WorkforceAdmissionRefused",this.details={reason:d,...i}}code;reason;details},k=()=>new w("unavailable","authority_unavailable"),h=e=>e!==null&&typeof e=="object"&&!Array.isArray(e),T=e=>Array.isArray(e)&&e.length<=64&&e.every(a=>typeof a=="string"&&Q.test(a));function L(e){if(!h(e)||e.schemaVersion!==1||typeof e.admissionId!="string"||!I.test(e.admissionId)||typeof e.operationId!="string"||!I.test(e.operationId))return null;let a=e.agent;if(!h(a)||typeof a.resourceId!="string"||!I.test(a.resourceId)||!Number.isSafeInteger(a.version)||typeof a.contentHash!="string")return null;let n=e.capabilities;if(!h(n)||!T(n.effective)||!T(n.requested))return null;let d=e.payer;if(!h(d)||typeof d.kind!="string")return null;let i=e.budget;return!h(i)||typeof i.ceilingMicro!="string"||!/^[1-9][0-9]{0,17}$/.test(i.ceilingMicro)||!h(e.target)||typeof e.admittedAt!="string"||!Number.isFinite(Date.parse(e.admittedAt))?null:e}var ee=/^[0-9a-f]{64}$/;function te(e,a,n,d){if(!h(e)||e.schemaVersion!==1)return null;let i=e.agent;if(!h(i)||typeof i.resourceId!="string"||i.resourceId.toLowerCase()!==a||!Number.isSafeInteger(i.version)||i.version<1||typeof i.contentHash!="string"||!ee.test(i.contentHash)||!h(e.target)||JSON.stringify(Object.entries(e.target).map(([l,o])=>[l,typeof o=="string"?o.toLowerCase():o]).sort())!==JSON.stringify(Object.entries(n).map(([l,o])=>[l,typeof o=="string"?o.toLowerCase():o]).sort()))return null;let c=e.team;if(d?!h(c)||typeof c.teamId!="string"||c.teamId.toLowerCase()!==d:c!==null)return null;let t=e.terms;return!h(t)||!T(t.definition)||!T(t.target)?null:{schemaVersion:1,agent:{resourceId:a,version:i.version,contentHash:i.contentHash},target:{...n},team:d?{teamId:d}:null,terms:{definition:[...t.definition],target:[...t.target]}}}function j(e,a){return!h(e)||e.schemaVersion!==1||e.admissionId!==a||typeof e.revoked!="boolean"?null:{schemaVersion:1,admissionId:a,revoked:e.revoked,reason:typeof e.reason=="string"&&N.test(e.reason)?e.reason:null,revokedAt:typeof e.revokedAt=="string"?e.revokedAt:null,latestLeaseSequence:typeof e.latestLeaseSequence=="string"?e.latestLeaseSequence:null}}async function ne(e,a){let n=e.headers.get("content-length");if(n!==null&&(!/^\d+$/.test(n)||Number(n)>65536))throw new Error("response too large");if(!e.body)return null;let d=e.body.getReader(),i=[],c=0;try{for(;;){let{done:o,value:r}=await d.read();if(a.aborted)throw new Error("response did not complete before the deadline");if(o)break;if(c+=r.byteLength,c>65536)throw new Error("response too large");i.push(r)}}finally{try{d.releaseLock()}catch{}}let t=new Uint8Array(c),l=0;for(let o of i)t.set(o,l),l+=o.byteLength;return t.length?JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(t)):null}function se(e){let a=e.fetchImpl??globalThis.fetch,n;try{n=new URL(e.issuer)}catch{throw new Error("invalid issuer")}if(n.protocol!=="https:"||n.pathname!=="/"||n.username||n.password||n.search||n.hash)throw new Error("invalid issuer");let d=n.origin,i=async(t,l,o)=>{let r=`${d}${t}`,f=new AbortController,m=()=>f.abort();o?.addEventListener("abort",m,{once:!0});let g=setTimeout(m,15e3);g.unref?.();try{o?.throwIfAborted();let R=await e.authorizeRequest({method:"POST",url:r});if(!R)throw k();let _,s;try{_=await a(r,{method:"POST",redirect:"error",signal:f.signal,headers:{accept:"application/json","content-type":"application/json",authorization:R.authorization,...R.dpop?{dpop:R.dpop}:{}},body:JSON.stringify(l)}),s=await ne(_,f.signal)}catch(y){throw o?.aborted?y:k()}if(_.status===200&&h(s)&&s.success===!0)return s;let p=h(s)&&typeof s.code=="string"&&G.has(s.code)?s.code:null,u=h(s)&&h(s.details)?s.details:null;throw p&&u&&u.schemaVersion===1&&typeof u.reason=="string"&&N.test(u.reason)?new w(p,u.reason,{...Number.isSafeInteger(u.currentVersion)?{currentVersion:u.currentVersion}:{},...typeof u.availableMicro=="string"&&/^[0-9]{1,20}$/.test(u.availableMicro)?{availableMicro:u.availableMicro}:{},...typeof u.field=="string"&&/^[a-zA-Z.]{1,64}$/.test(u.field)?{field:u.field}:{}}):p?new w(p,p==="denied"&&_.status===403&&h(s)&&typeof s.required_scope=="string"?"insufficient_scope":p):k()}finally{clearTimeout(g),o?.removeEventListener("abort",m)}},c=t=>{if(typeof t!="string"||!I.test(t))throw new w("bad_input","invalid_admission");return t.toLowerCase()};return{async admit(t,l){if(!I.test(t.operationId))throw new w("bad_input","invalid_operation");if(!T(t.capabilities))throw new w("bad_input","invalid_capabilities");if(t.runtimeCapabilities!==void 0&&!T(t.runtimeCapabilities))throw new w("bad_input","invalid_runtime_capabilities");if(!/^[1-9][0-9]{0,17}$/.test(t.budget?.ceilingMicro??""))throw new w("bad_input","invalid_budget_ceiling");let o={operationId:t.operationId,agent:{resourceId:t.agent.resourceId,version:t.agent.version,contentHash:t.agent.contentHash},target:{...t.target},capabilities:[...t.capabilities],budget:{ceilingMicro:t.budget.ceilingMicro},...t.expectedActorAccountId?{expectedActorAccountId:t.expectedActorAccountId}:{},...t.team?{team:{teamId:t.team.teamId}}:{},...t.conversationId?{conversationId:t.conversationId}:{},...t.root?{root:{bindingId:t.root.bindingId,installationId:t.root.installationId}}:{},...t.runtimeCapabilities?{runtimeCapabilities:[...t.runtimeCapabilities]}:{}},r=await i(q,o,l),f=L(r.admission);if(!f||f.operationId.toLowerCase()!==t.operationId.toLowerCase())throw k();return{admission:f,replayed:r.replayed===!0}},async revoke(t,l){let o=c(t),r=j(await i(B,{admissionId:o},l),o);if(!r||!r.revoked)throw k();return r},async pin(t,l){let o=t?.agent?.resourceId;if(typeof o!="string"||!I.test(o))throw new w("bad_input","invalid_agent_resource");let r=t.target,f=h(r)?r.kind==="personal"?[r.ownerUserId]:r.kind==="workspace"?[r.assignmentId]:r.kind==="project"?[r.projectId,r.participationId]:null:null;if(!f||!f.every(s=>typeof s=="string"&&I.test(s)))throw new w("bad_input","invalid_target");let m=r.kind==="personal"?{kind:"personal",ownerUserId:r.ownerUserId}:r.kind==="workspace"?{kind:"workspace",assignmentId:r.assignmentId}:{kind:"project",projectId:r.projectId,participationId:r.participationId},g=t.team?t.team.teamId:null;if(g!==null&&(typeof g!="string"||!I.test(g)))throw new w("bad_input","invalid_team");let R={agent:{resourceId:o},target:m,...g?{team:{teamId:g}}:{},...t.expectedActorAccountId?{expectedActorAccountId:t.expectedActorAccountId}:{}},_=te(await i(Z,R,l),o.toLowerCase(),m,g?g.toLowerCase():null);if(!_)throw k();return _},async read(t,l,o){let r=c(t),f=l?.expectedActorAccountId;if(f!==void 0&&(typeof f!="string"||!I.test(f)))throw new w("bad_input","invalid_expected_actor");let m=await i(F,{admissionId:r,...f?{expectedActorAccountId:f}:{}},o),g=L(m.admission);if(!g||g.admissionId.toLowerCase()!==r)throw k();return g},async readOperation(t,l,o){if(typeof t!="string"||!I.test(t))throw new w("bad_input","invalid_operation");let r=l?.expectedActorAccountId;if(typeof r!="string"||!I.test(r))throw new w("bad_input","invalid_expected_actor");let f=t.toLowerCase(),m=await i(X,{operationId:f,expectedActorAccountId:r.toLowerCase()},o);if(m.schemaVersion!==1||typeof m.operationId!="string"||m.operationId.toLowerCase()!==f)throw k();if(m.state==="not-observed"&&m.admission===null)return{state:"not-observed",operationId:f,admission:null};if(m.state!=="committed")throw k();let g=L(m.admission);if(!g||g.operationId.toLowerCase()!==f)throw k();return{state:"committed",operationId:f,admission:g}},async authority(t,l){let o=c(t),r=j(await i(Y,{admissionId:o},l),o);if(!r)throw k();return r}}}var P=class extends Error{code="RUN_AUTHORITY_REFUSED";retryable=!1;reason;step;constructor(a,n,d){super(`Run authority refused the ${a==="dispatch"?"provider dispatch":"tool call"}: ${n}`,d),this.name="RunAuthorityRefusedError",this.reason=n,this.step=a}};export{V as RUN_LEASE_MAX_SECONDS,O as RUN_LEASE_SKEW_SECONDS,P as RunAuthorityRefusedError,A as RunStepRefused,w as WorkforceAdmissionRefused,se as createWorkforceRunAdmissionClient,oe as createWorkforceRunAuthority,W as verifyWorkforceRunLease};

package/dist/workforce/metafile-cjs.json

@@ -1 +1 @@
-{"inputs":{"src/workforce/run-authority-client.ts":{"bytes":15410,"imports":[{"path":"node:crypto","kind":"import-statement","external":true}],"format":"esm"},"src/workforce/run-admission-client.ts":{"bytes":20292,"imports":[],"format":"esm"},"src/core/agent-loop/run-authority.ts":{"bytes":4631,"imports":[],"format":"esm"},"src/workforce/index.ts":{"bytes":745,"imports":[{"path":"src/workforce/run-authority-client.ts","kind":"import-statement","original":"./run-authority-client.js"},{"path":"src/workforce/run-admission-client.ts","kind":"import-statement","original":"./run-admission-client.js"},{"path":"src/core/agent-loop/run-authority.ts","kind":"import-statement","original":"../core/agent-loop/run-authority.js"}],"format":"esm"}},"outputs":{"dist/workforce/index.cjs":{"imports":[{"path":"node:crypto","kind":"require-call","external":true}],"exports":[],"entryPoint":"src/workforce/index.ts","inputs":{"src/workforce/index.ts":{"bytesInOutput":285},"src/workforce/run-authority-client.ts":{"bytesInOutput":5212},"src/workforce/run-admission-client.ts":{"bytesInOutput":7112},"src/core/agent-loop/run-authority.ts":{"bytesInOutput":257}},"bytes":13511}}}
+{"inputs":{"src/workforce/run-authority-client.ts":{"bytes":15410,"imports":[{"path":"node:crypto","kind":"import-statement","external":true}],"format":"esm"},"src/workforce/run-admission-client.ts":{"bytes":24384,"imports":[],"format":"esm"},"src/core/agent-loop/run-authority.ts":{"bytes":4631,"imports":[],"format":"esm"},"src/workforce/index.ts":{"bytes":745,"imports":[{"path":"src/workforce/run-authority-client.ts","kind":"import-statement","original":"./run-authority-client.js"},{"path":"src/workforce/run-admission-client.ts","kind":"import-statement","original":"./run-admission-client.js"},{"path":"src/core/agent-loop/run-authority.ts","kind":"import-statement","original":"../core/agent-loop/run-authority.js"}],"format":"esm"}},"outputs":{"dist/workforce/index.cjs":{"imports":[{"path":"node:crypto","kind":"require-call","external":true}],"exports":[],"entryPoint":"src/workforce/index.ts","inputs":{"src/workforce/index.ts":{"bytesInOutput":285},"src/workforce/run-authority-client.ts":{"bytesInOutput":5212},"src/workforce/run-admission-client.ts":{"bytesInOutput":8182},"src/core/agent-loop/run-authority.ts":{"bytesInOutput":257}},"bytes":14581}}}

package/dist/workforce/metafile-esm.json

@@ -1 +1 @@
-{"inputs":{"src/workforce/run-authority-client.ts":{"bytes":15410,"imports":[{"path":"node:crypto","kind":"import-statement","external":true}],"format":"esm"},"src/workforce/run-admission-client.ts":{"bytes":20292,"imports":[],"format":"esm"},"src/core/agent-loop/run-authority.ts":{"bytes":4631,"imports":[],"format":"esm"},"src/workforce/index.ts":{"bytes":745,"imports":[{"path":"src/workforce/run-authority-client.ts","kind":"import-statement","original":"./run-authority-client.js"},{"path":"src/workforce/run-admission-client.ts","kind":"import-statement","original":"./run-admission-client.js"},{"path":"src/core/agent-loop/run-authority.ts","kind":"import-statement","original":"../core/agent-loop/run-authority.js"}],"format":"esm"}},"outputs":{"dist/workforce/index.js":{"imports":[{"path":"node:crypto","kind":"import-statement","external":true}],"exports":["RUN_LEASE_MAX_SECONDS","RUN_LEASE_SKEW_SECONDS","RunAuthorityRefusedError","RunStepRefused","WorkforceAdmissionRefused","createWorkforceRunAdmissionClient","createWorkforceRunAuthority","verifyWorkforceRunLease"],"entryPoint":"src/workforce/index.ts","inputs":{"src/workforce/run-authority-client.ts":{"bytesInOutput":5215},"src/workforce/index.ts":{"bytesInOutput":0},"src/workforce/run-admission-client.ts":{"bytesInOutput":7098},"src/core/agent-loop/run-authority.ts":{"bytesInOutput":257}},"bytes":12818}}}
+{"inputs":{"src/workforce/run-authority-client.ts":{"bytes":15410,"imports":[{"path":"node:crypto","kind":"import-statement","external":true}],"format":"esm"},"src/workforce/run-admission-client.ts":{"bytes":24384,"imports":[],"format":"esm"},"src/core/agent-loop/run-authority.ts":{"bytes":4631,"imports":[],"format":"esm"},"src/workforce/index.ts":{"bytes":745,"imports":[{"path":"src/workforce/run-authority-client.ts","kind":"import-statement","original":"./run-authority-client.js"},{"path":"src/workforce/run-admission-client.ts","kind":"import-statement","original":"./run-admission-client.js"},{"path":"src/core/agent-loop/run-authority.ts","kind":"import-statement","original":"../core/agent-loop/run-authority.js"}],"format":"esm"}},"outputs":{"dist/workforce/index.js":{"imports":[{"path":"node:crypto","kind":"import-statement","external":true}],"exports":["RUN_LEASE_MAX_SECONDS","RUN_LEASE_SKEW_SECONDS","RunAuthorityRefusedError","RunStepRefused","WorkforceAdmissionRefused","createWorkforceRunAdmissionClient","createWorkforceRunAuthority","verifyWorkforceRunLease"],"entryPoint":"src/workforce/index.ts","inputs":{"src/workforce/run-authority-client.ts":{"bytesInOutput":5215},"src/workforce/index.ts":{"bytesInOutput":0},"src/workforce/run-admission-client.ts":{"bytesInOutput":8168},"src/core/agent-loop/run-authority.ts":{"bytesInOutput":257}},"bytes":13888}}}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xenosystem/agent-sdk",
-  "version": "0.10.18",
+  "version": "0.10.20",
   "description": "XENO Agent SDK built from the same engine as XENO CODE",
   "type": "module",
   "main": "dist/index.js",