@xenosystem/agent-sdk 0.10.5 → 0.10.7

package/dist/workforce/index.js

@@ -1 +1 @@
-import{createPublicKey as q,verify as I}from"node:crypto";var L="/api/workforce/run-admissions/authorize-step",O="/api/oauth2/jwks",P=60,x=5,j="xeno-run-lease+jwt",N=1e4,E=65536,f=class extends Error{constructor(e){super(`run step refused: ${e}`);this.reason=e;this.name="RunStepRefused",this.details={reason:e}}reason;details};function M(i,s){let e=y=>({valid:!1,reason:y}),n=typeof i=="string"?i.split("."):[];if(n.length!==3)return e("malformed");let a,t;try{a=JSON.parse(Buffer.from(n[0],"base64url").toString("utf8")),t=JSON.parse(Buffer.from(n[1],"base64url").toString("utf8"))}catch{return e("malformed")}if(a.alg!=="ES256"||a.typ!==j)return e("wrong_type");if(!s.publicKey)return e("unknown_key");if(!I("sha256",Buffer.from(`${n[0]}.${n[1]}`),{key:s.publicKey,dsaEncoding:"ieee-p1363"},Buffer.from(n[2],"base64url")))return e("bad_signature");if(t.iss!=="xeno-platform"||t.aud!=="xeno-run-runtime"||t.sub!==s.admissionId)return e("wrong_subject");if(!Number.isSafeInteger(t.iat)||!Number.isSafeInteger(t.exp)||t.exp<=t.iat||t.exp-t.iat>P)return e("unbounded");if(!Array.isArray(t.caps)||!t.caps.every(y=>typeof y=="string"))return e("malformed");let p;try{p=BigInt(t.seq)}catch{return e("malformed")}if(p<s.minSequence)return e("superseded");if(s.nowWallMs/1e3>=t.exp-x)return e("expired");if(s.receivedAtMono===null)return e("requires_online_reauthorization");let c=(s.nowMono-s.receivedAtMono)/1e3;return c<0?e("requires_online_reauthorization"):c>=t.exp-t.iat-x?e("expired"):{valid:!0,sequence:p,claims:t}}async function z(i,s){let e=i.headers.get("content-length");if(e!==null&&(!/^\d+$/.test(e)||Number(e)>E))throw new Error("response too large");if(!i.body)return null;let n=i.body.getReader(),a=[],t=0;try{for(;;){let{done:c,value:y}=await n.read();if(s.aborted)throw new Error("response did not complete before the deadline");if(c)break;if(t+=y.byteLength,t>E)throw new Error("response too large");a.push(y)}}finally{try{n.releaseLock()}catch{}}let h=new Uint8Array(t),p=0;for(let c of a)h.set(c,p),p+=c.byteLength;return h.length?JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(h)):null}function $(i){let s=i.fetchImpl??globalThis.fetch,e=i.clock??{wallMs:()=>Date.now(),monoMs:()=>performance.now()},n=i.admissionId;if(!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(n))throw new Error("invalid admission id");let a;try{a=new URL(i.issuer)}catch{throw new Error("invalid issuer")}if(a.protocol!=="https:"||a.pathname!=="/"||a.username||a.password||a.search||a.hash)throw new Error("invalid issuer");let t=a.origin,h=new Map,p=new Map,c=null,y=async(r,o,l)=>{let u=`${t}${o}`,m=new AbortController,d=setTimeout(()=>m.abort(),N);d.unref?.();try{let g=null;if(r==="POST"&&(g=await i.authorizeRequest({method:r,url:u}),!g))throw new f("authority_unavailable");let k=await s(u,{method:r,redirect:"error",signal:m.signal,headers:{accept:"application/json",...l?{"content-type":"application/json"}:{},...g?{authorization:g.authorization,...g.dpop?{dpop:g.dpop}:{}}:{}},...l?{body:JSON.stringify(l)}:{}});return{status:k.status,json:await z(k,m.signal)}}finally{clearTimeout(d)}},v=async r=>{if(h.has(r))return h.get(r);let{status:o,json:l}=await y("GET",O);if(o!==200||!l||typeof l!="object"||!Array.isArray(l.keys))return null;for(let u of l.keys)if(!(typeof u.kid!="string"||u.kty!=="EC"||u.crv!=="P-256"))try{h.set(u.kid,q({key:{kty:"EC",crv:"P-256",x:u.x,y:u.y},format:"jwk"}))}catch{}return h.get(r)??null},S=()=>i.sequenceStore.read(n)??0n,_=(r,o)=>`${r}:${o??""}`,T=async r=>{let o=JSON.parse(Buffer.from(r.token.split(".")[0],"base64url").toString("utf8")).kid;return M(r.token,{publicKey:await v(o),admissionId:n,receivedAtMono:r.receivedAtMono,nowMono:e.monoMs(),nowWallMs:e.wallMs(),minSequence:S()}).valid},R=async(r,o,l)=>{if(l.throwIfAborted(),c)throw new f(c);let u=p.get(_(r,o));if(u&&await T(u).catch(()=>!1))return;let m;try{m=await y("POST",L,{admissionId:n,operation:r,...o?{capability:o}:{}})}catch(b){throw b instanceof f?b:new f("authority_unavailable")}let d=m.json;if(m.status!==200||d?.success!==!0||typeof d.token!="string"){let b=typeof d?.details?.reason=="string"&&/^[a-z_]{1,64}$/.test(d.details.reason)?d.details.reason:"authority_unavailable";throw b==="admission_revoked"&&(c=b),new f(b)}let g=e.monoMs(),k=(()=>{try{return JSON.parse(Buffer.from(d.token.split(".")[0],"base64url").toString("utf8"))}catch{return null}})();if(typeof k?.kid!="string")throw new f("authority_unavailable");let w=M(d.token,{publicKey:await v(k.kid).catch(()=>null),admissionId:n,receivedAtMono:g,nowMono:e.monoMs(),nowWallMs:e.wallMs(),minSequence:S()});if(!w.valid)throw new f("authority_unavailable");if(r==="privileged_call"&&w.claims.cap!==o)throw new f("authority_unavailable");await i.sequenceStore.write(n,w.sequence),p.set(_(r,o),{token:d.token,sequence:w.sequence,operation:r,capability:o,capabilities:w.claims.caps,iat:w.claims.iat,exp:w.claims.exp,receivedAtMono:g})};return{authorizeDispatch:(r,o)=>R("provider_dispatch",null,o),authorizeToolCall:(r,o)=>{let l=i.capabilityForTool(r.toolName);return l===null||!/^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]{0,127}$/.test(l)?Promise.reject(new f("capability_not_admitted")):R("privileged_call",l,o)}}}var A=class extends Error{code="RUN_AUTHORITY_REFUSED";retryable=!1;reason;step;constructor(s,e,n){super(`Run authority refused the ${s==="dispatch"?"provider dispatch":"tool call"}: ${e}`,n),this.name="RunAuthorityRefusedError",this.reason=e,this.step=s}};export{P as RUN_LEASE_MAX_SECONDS,x as RUN_LEASE_SKEW_SECONDS,A as RunAuthorityRefusedError,f as RunStepRefused,$ as createWorkforceRunAuthority,M as verifyWorkforceRunLease};
+import{createPublicKey as N,verify as U}from"node:crypto";var $="/api/workforce/run-admissions/authorize-step",z="/api/oauth2/jwks",H=60,P=5,V="xeno-run-lease+jwt",D=1e4,O=65536,b=class extends Error{constructor(n){super(`run step refused: ${n}`);this.reason=n;this.name="RunStepRefused",this.details={reason:n}}reason;details};function C(e,a){let n=o=>({valid:!1,reason:o}),l=typeof e=="string"?e.split("."):[];if(l.length!==3)return n("malformed");let i,c;try{i=JSON.parse(Buffer.from(l[0],"base64url").toString("utf8")),c=JSON.parse(Buffer.from(l[1],"base64url").toString("utf8"))}catch{return n("malformed")}if(i.alg!=="ES256"||i.typ!==V)return n("wrong_type");if(!a.publicKey)return n("unknown_key");if(!U("sha256",Buffer.from(`${l[0]}.${l[1]}`),{key:a.publicKey,dsaEncoding:"ieee-p1363"},Buffer.from(l[2],"base64url")))return n("bad_signature");if(c.iss!=="xeno-platform"||c.aud!=="xeno-run-runtime"||c.sub!==a.admissionId)return n("wrong_subject");if(!Number.isSafeInteger(c.iat)||!Number.isSafeInteger(c.exp)||c.exp<=c.iat||c.exp-c.iat>H)return n("unbounded");if(!Array.isArray(c.caps)||!c.caps.every(o=>typeof o=="string"))return n("malformed");let d;try{d=BigInt(c.seq)}catch{return n("malformed")}if(d<a.minSequence)return n("superseded");if(a.nowWallMs/1e3>=c.exp-P)return n("expired");if(a.receivedAtMono===null)return n("requires_online_reauthorization");let r=(a.nowMono-a.receivedAtMono)/1e3;return r<0?n("requires_online_reauthorization"):r>=c.exp-c.iat-P?n("expired"):{valid:!0,sequence:d,claims:c}}async function J(e,a){let n=e.headers.get("content-length");if(n!==null&&(!/^\d+$/.test(n)||Number(n)>O))throw new Error("response too large");if(!e.body)return null;let l=e.body.getReader(),i=[],c=0;try{for(;;){let{done:r,value:o}=await l.read();if(a.aborted)throw new Error("response did not complete before the deadline");if(r)break;if(c+=o.byteLength,c>O)throw new Error("response too large");i.push(o)}}finally{try{l.releaseLock()}catch{}}let t=new Uint8Array(c),d=0;for(let r of i)t.set(r,d),d+=r.byteLength;return t.length?JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(t)):null}function ne(e){let a=e.fetchImpl??globalThis.fetch,n=e.clock??{wallMs:()=>Date.now(),monoMs:()=>performance.now()},l=e.admissionId;if(!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(l))throw new Error("invalid admission id");let i;try{i=new URL(e.issuer)}catch{throw new Error("invalid issuer")}if(i.protocol!=="https:"||i.pathname!=="/"||i.username||i.password||i.search||i.hash)throw new Error("invalid issuer");let c=i.origin,t=new Map,d=new Map,r=null,o=async(s,f,u)=>{let p=`${c}${f}`,R=new AbortController,w=setTimeout(()=>R.abort(),D);w.unref?.();try{let I=null;if(s==="POST"&&(I=await e.authorizeRequest({method:s,url:p}),!I))throw new b("authority_unavailable");let M=await a(p,{method:s,redirect:"error",signal:R.signal,headers:{accept:"application/json",...u?{"content-type":"application/json"}:{},...I?{authorization:I.authorization,...I.dpop?{dpop:I.dpop}:{}}:{}},...u?{body:JSON.stringify(u)}:{}});return{status:M.status,json:await J(M,R.signal)}}finally{clearTimeout(w)}},m=async s=>{if(t.has(s))return t.get(s);let{status:f,json:u}=await o("GET",z);if(f!==200||!u||typeof u!="object"||!Array.isArray(u.keys))return null;for(let p of u.keys)if(!(typeof p.kid!="string"||p.kty!=="EC"||p.crv!=="P-256"))try{t.set(p.kid,N({key:{kty:"EC",crv:"P-256",x:p.x,y:p.y},format:"jwk"}))}catch{}return t.get(s)??null},A=()=>e.sequenceStore.read(l)??0n,h=(s,f)=>`${s}:${f??""}`,_=async s=>{let f=JSON.parse(Buffer.from(s.token.split(".")[0],"base64url").toString("utf8")).kid;return C(s.token,{publicKey:await m(f),admissionId:l,receivedAtMono:s.receivedAtMono,nowMono:n.monoMs(),nowWallMs:n.wallMs(),minSequence:A()}).valid},k=async(s,f,u)=>{if(u.throwIfAborted(),r)throw new b(r);let p=d.get(h(s,f));if(p&&await _(p).catch(()=>!1))return;let R;try{R=await o("POST",$,{admissionId:l,operation:s,...f?{capability:f}:{}})}catch(T){throw T instanceof b?T:new b("authority_unavailable")}let w=R.json;if(R.status!==200||w?.success!==!0||typeof w.token!="string"){let T=typeof w?.details?.reason=="string"&&/^[a-z_]{1,64}$/.test(w.details.reason)?w.details.reason:"authority_unavailable";throw T==="admission_revoked"&&(r=T),new b(T)}let I=n.monoMs(),M=(()=>{try{return JSON.parse(Buffer.from(w.token.split(".")[0],"base64url").toString("utf8"))}catch{return null}})();if(typeof M?.kid!="string")throw new b("authority_unavailable");let v=C(w.token,{publicKey:await m(M.kid).catch(()=>null),admissionId:l,receivedAtMono:I,nowMono:n.monoMs(),nowWallMs:n.wallMs(),minSequence:A()});if(!v.valid)throw new b("authority_unavailable");if(s==="privileged_call"&&v.claims.cap!==f)throw new b("authority_unavailable");await e.sequenceStore.write(l,v.sequence),d.set(h(s,f),{token:w.token,sequence:v.sequence,operation:s,capability:f,capabilities:v.claims.caps,iat:v.claims.iat,exp:v.claims.exp,receivedAtMono:I})};return{authorizeDispatch:(s,f)=>k("provider_dispatch",null,f),authorizeToolCall:(s,f)=>{let u=e.capabilityForTool(s.toolName);return u===null||!/^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]{0,127}$/.test(u)?Promise.reject(new b("capability_not_admitted")):k("privileged_call",u,f)}}}var K="/api/workforce/run-admissions",q="/api/workforce/run-admissions/revoke",B="/api/workforce/run-admissions/authority",Y="/api/workforce/run-admissions/pin";var S=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,Z=/^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]{0,127}$/,j=/^[a-z_]{1,64}$/,F=new Set(["bad_input","denied","not_found","needs_approval","conflict","rate_limited","unavailable","timeout","internal"]),y=class extends Error{constructor(n,l,i={}){super(`workforce admission refused: ${n}/${l}`);this.code=n;this.reason=l;this.name="WorkforceAdmissionRefused",this.details={reason:l,...i}}code;reason;details},E=()=>new y("unavailable","authority_unavailable"),g=e=>e!==null&&typeof e=="object"&&!Array.isArray(e),x=e=>Array.isArray(e)&&e.length<=64&&e.every(a=>typeof a=="string"&&Z.test(a));function X(e){if(!g(e)||e.schemaVersion!==1||typeof e.admissionId!="string"||!S.test(e.admissionId)||typeof e.operationId!="string"||!S.test(e.operationId))return null;let a=e.agent;if(!g(a)||typeof a.resourceId!="string"||!S.test(a.resourceId)||!Number.isSafeInteger(a.version)||typeof a.contentHash!="string")return null;let n=e.capabilities;if(!g(n)||!x(n.effective)||!x(n.requested))return null;let l=e.payer;if(!g(l)||typeof l.kind!="string")return null;let i=e.budget;return!g(i)||typeof i.ceilingMicro!="string"||!/^[1-9][0-9]{0,17}$/.test(i.ceilingMicro)||!g(e.target)||typeof e.admittedAt!="string"||!Number.isFinite(Date.parse(e.admittedAt))?null:e}var Q=/^[0-9a-f]{64}$/;function G(e,a,n,l){if(!g(e)||e.schemaVersion!==1)return null;let i=e.agent;if(!g(i)||typeof i.resourceId!="string"||i.resourceId.toLowerCase()!==a||!Number.isSafeInteger(i.version)||i.version<1||typeof i.contentHash!="string"||!Q.test(i.contentHash)||!g(e.target)||JSON.stringify(Object.entries(e.target).map(([d,r])=>[d,typeof r=="string"?r.toLowerCase():r]).sort())!==JSON.stringify(Object.entries(n).map(([d,r])=>[d,typeof r=="string"?r.toLowerCase():r]).sort()))return null;let c=e.team;if(l?!g(c)||typeof c.teamId!="string"||c.teamId.toLowerCase()!==l:c!==null)return null;let t=e.terms;return!g(t)||!x(t.definition)||!x(t.target)?null:{schemaVersion:1,agent:{resourceId:a,version:i.version,contentHash:i.contentHash},target:{...n},team:l?{teamId:l}:null,terms:{definition:[...t.definition],target:[...t.target]}}}function W(e,a){return!g(e)||e.schemaVersion!==1||e.admissionId!==a||typeof e.revoked!="boolean"?null:{schemaVersion:1,admissionId:a,revoked:e.revoked,reason:typeof e.reason=="string"&&j.test(e.reason)?e.reason:null,revokedAt:typeof e.revokedAt=="string"?e.revokedAt:null,latestLeaseSequence:typeof e.latestLeaseSequence=="string"?e.latestLeaseSequence:null}}async function ee(e,a){let n=e.headers.get("content-length");if(n!==null&&(!/^\d+$/.test(n)||Number(n)>65536))throw new Error("response too large");if(!e.body)return null;let l=e.body.getReader(),i=[],c=0;try{for(;;){let{done:r,value:o}=await l.read();if(a.aborted)throw new Error("response did not complete before the deadline");if(r)break;if(c+=o.byteLength,c>65536)throw new Error("response too large");i.push(o)}}finally{try{l.releaseLock()}catch{}}let t=new Uint8Array(c),d=0;for(let r of i)t.set(r,d),d+=r.byteLength;return t.length?JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(t)):null}function oe(e){let a=e.fetchImpl??globalThis.fetch,n;try{n=new URL(e.issuer)}catch{throw new Error("invalid issuer")}if(n.protocol!=="https:"||n.pathname!=="/"||n.username||n.password||n.search||n.hash)throw new Error("invalid issuer");let l=n.origin,i=async(t,d,r)=>{let o=`${l}${t}`,m=new AbortController,A=()=>m.abort();r?.addEventListener("abort",A,{once:!0});let h=setTimeout(A,15e3);h.unref?.();try{r?.throwIfAborted();let _=await e.authorizeRequest({method:"POST",url:o});if(!_)throw E();let k,s;try{k=await a(o,{method:"POST",redirect:"error",signal:m.signal,headers:{accept:"application/json","content-type":"application/json",authorization:_.authorization,..._.dpop?{dpop:_.dpop}:{}},body:JSON.stringify(d)}),s=await ee(k,m.signal)}catch(p){throw r?.aborted?p:E()}if(k.status===200&&g(s)&&s.success===!0)return s;let f=g(s)&&typeof s.code=="string"&&F.has(s.code)?s.code:null,u=g(s)&&g(s.details)?s.details:null;throw f&&u&&u.schemaVersion===1&&typeof u.reason=="string"&&j.test(u.reason)?new y(f,u.reason,{...Number.isSafeInteger(u.currentVersion)?{currentVersion:u.currentVersion}:{},...typeof u.availableMicro=="string"&&/^[0-9]{1,20}$/.test(u.availableMicro)?{availableMicro:u.availableMicro}:{},...typeof u.field=="string"&&/^[a-zA-Z.]{1,64}$/.test(u.field)?{field:u.field}:{}}):f?new y(f,f==="denied"&&k.status===403&&g(s)&&typeof s.required_scope=="string"?"insufficient_scope":f):E()}finally{clearTimeout(h),r?.removeEventListener("abort",A)}},c=t=>{if(typeof t!="string"||!S.test(t))throw new y("bad_input","invalid_admission");return t.toLowerCase()};return{async admit(t,d){if(!S.test(t.operationId))throw new y("bad_input","invalid_operation");if(!x(t.capabilities))throw new y("bad_input","invalid_capabilities");if(t.runtimeCapabilities!==void 0&&!x(t.runtimeCapabilities))throw new y("bad_input","invalid_runtime_capabilities");if(!/^[1-9][0-9]{0,17}$/.test(t.budget?.ceilingMicro??""))throw new y("bad_input","invalid_budget_ceiling");let r={operationId:t.operationId,agent:{resourceId:t.agent.resourceId,version:t.agent.version,contentHash:t.agent.contentHash},target:{...t.target},capabilities:[...t.capabilities],budget:{ceilingMicro:t.budget.ceilingMicro},...t.expectedActorAccountId?{expectedActorAccountId:t.expectedActorAccountId}:{},...t.team?{team:{teamId:t.team.teamId}}:{},...t.conversationId?{conversationId:t.conversationId}:{},...t.root?{root:{bindingId:t.root.bindingId,installationId:t.root.installationId}}:{},...t.runtimeCapabilities?{runtimeCapabilities:[...t.runtimeCapabilities]}:{}},o=await i(K,r,d),m=X(o.admission);if(!m||m.operationId.toLowerCase()!==t.operationId.toLowerCase())throw E();return{admission:m,replayed:o.replayed===!0}},async revoke(t,d){let r=c(t),o=W(await i(q,{admissionId:r},d),r);if(!o||!o.revoked)throw E();return o},async pin(t,d){let r=t?.agent?.resourceId;if(typeof r!="string"||!S.test(r))throw new y("bad_input","invalid_agent_resource");let o=t.target,m=g(o)?o.kind==="personal"?[o.ownerUserId]:o.kind==="workspace"?[o.assignmentId]:o.kind==="project"?[o.projectId,o.participationId]:null:null;if(!m||!m.every(s=>typeof s=="string"&&S.test(s)))throw new y("bad_input","invalid_target");let A=o.kind==="personal"?{kind:"personal",ownerUserId:o.ownerUserId}:o.kind==="workspace"?{kind:"workspace",assignmentId:o.assignmentId}:{kind:"project",projectId:o.projectId,participationId:o.participationId},h=t.team?t.team.teamId:null;if(h!==null&&(typeof h!="string"||!S.test(h)))throw new y("bad_input","invalid_team");let _={agent:{resourceId:r},target:A,...h?{team:{teamId:h}}:{},...t.expectedActorAccountId?{expectedActorAccountId:t.expectedActorAccountId}:{}},k=G(await i(Y,_,d),r.toLowerCase(),A,h?h.toLowerCase():null);if(!k)throw E();return k},async authority(t,d){let r=c(t),o=W(await i(B,{admissionId:r},d),r);if(!o)throw E();return o}}}var L=class extends Error{code="RUN_AUTHORITY_REFUSED";retryable=!1;reason;step;constructor(a,n,l){super(`Run authority refused the ${a==="dispatch"?"provider dispatch":"tool call"}: ${n}`,l),this.name="RunAuthorityRefusedError",this.reason=n,this.step=a}};export{H as RUN_LEASE_MAX_SECONDS,P as RUN_LEASE_SKEW_SECONDS,L as RunAuthorityRefusedError,b as RunStepRefused,y as WorkforceAdmissionRefused,oe as createWorkforceRunAdmissionClient,ne as createWorkforceRunAuthority,C as verifyWorkforceRunLease};

package/dist/workforce/metafile-cjs.json

@@ -1 +1 @@
-{"inputs":{"src/workforce/run-authority-client.ts":{"bytes":15410,"imports":[{"path":"node:crypto","kind":"import-statement","external":true}],"format":"esm"},"src/core/agent-loop/run-authority.ts":{"bytes":4631,"imports":[],"format":"esm"},"src/workforce/index.ts":{"bytes":543,"imports":[{"path":"src/workforce/run-authority-client.ts","kind":"import-statement","original":"./run-authority-client.js"},{"path":"src/core/agent-loop/run-authority.ts","kind":"import-statement","original":"../core/agent-loop/run-authority.js"}],"format":"esm"}},"outputs":{"dist/workforce/index.cjs":{"imports":[{"path":"node:crypto","kind":"require-call","external":true}],"exports":[],"entryPoint":"src/workforce/index.ts","inputs":{"src/workforce/index.ts":{"bytesInOutput":209},"src/workforce/run-authority-client.ts":{"bytesInOutput":5212},"src/core/agent-loop/run-authority.ts":{"bytesInOutput":257}},"bytes":6263}}}
+{"inputs":{"src/workforce/run-authority-client.ts":{"bytes":15410,"imports":[{"path":"node:crypto","kind":"import-statement","external":true}],"format":"esm"},"src/workforce/run-admission-client.ts":{"bytes":20292,"imports":[],"format":"esm"},"src/core/agent-loop/run-authority.ts":{"bytes":4631,"imports":[],"format":"esm"},"src/workforce/index.ts":{"bytes":745,"imports":[{"path":"src/workforce/run-authority-client.ts","kind":"import-statement","original":"./run-authority-client.js"},{"path":"src/workforce/run-admission-client.ts","kind":"import-statement","original":"./run-admission-client.js"},{"path":"src/core/agent-loop/run-authority.ts","kind":"import-statement","original":"../core/agent-loop/run-authority.js"}],"format":"esm"}},"outputs":{"dist/workforce/index.cjs":{"imports":[{"path":"node:crypto","kind":"require-call","external":true}],"exports":[],"entryPoint":"src/workforce/index.ts","inputs":{"src/workforce/index.ts":{"bytesInOutput":285},"src/workforce/run-authority-client.ts":{"bytesInOutput":5212},"src/workforce/run-admission-client.ts":{"bytesInOutput":7112},"src/core/agent-loop/run-authority.ts":{"bytesInOutput":257}},"bytes":13511}}}

package/dist/workforce/metafile-esm.json

@@ -1 +1 @@
-{"inputs":{"src/workforce/run-authority-client.ts":{"bytes":15410,"imports":[{"path":"node:crypto","kind":"import-statement","external":true}],"format":"esm"},"src/core/agent-loop/run-authority.ts":{"bytes":4631,"imports":[],"format":"esm"},"src/workforce/index.ts":{"bytes":543,"imports":[{"path":"src/workforce/run-authority-client.ts","kind":"import-statement","original":"./run-authority-client.js"},{"path":"src/core/agent-loop/run-authority.ts","kind":"import-statement","original":"../core/agent-loop/run-authority.js"}],"format":"esm"}},"outputs":{"dist/workforce/index.js":{"imports":[{"path":"node:crypto","kind":"import-statement","external":true}],"exports":["RUN_LEASE_MAX_SECONDS","RUN_LEASE_SKEW_SECONDS","RunAuthorityRefusedError","RunStepRefused","createWorkforceRunAuthority","verifyWorkforceRunLease"],"entryPoint":"src/workforce/index.ts","inputs":{"src/workforce/run-authority-client.ts":{"bytesInOutput":5214},"src/workforce/index.ts":{"bytesInOutput":0},"src/core/agent-loop/run-authority.ts":{"bytesInOutput":257}},"bytes":5647}}}
+{"inputs":{"src/workforce/run-authority-client.ts":{"bytes":15410,"imports":[{"path":"node:crypto","kind":"import-statement","external":true}],"format":"esm"},"src/workforce/run-admission-client.ts":{"bytes":20292,"imports":[],"format":"esm"},"src/core/agent-loop/run-authority.ts":{"bytes":4631,"imports":[],"format":"esm"},"src/workforce/index.ts":{"bytes":745,"imports":[{"path":"src/workforce/run-authority-client.ts","kind":"import-statement","original":"./run-authority-client.js"},{"path":"src/workforce/run-admission-client.ts","kind":"import-statement","original":"./run-admission-client.js"},{"path":"src/core/agent-loop/run-authority.ts","kind":"import-statement","original":"../core/agent-loop/run-authority.js"}],"format":"esm"}},"outputs":{"dist/workforce/index.js":{"imports":[{"path":"node:crypto","kind":"import-statement","external":true}],"exports":["RUN_LEASE_MAX_SECONDS","RUN_LEASE_SKEW_SECONDS","RunAuthorityRefusedError","RunStepRefused","WorkforceAdmissionRefused","createWorkforceRunAdmissionClient","createWorkforceRunAuthority","verifyWorkforceRunLease"],"entryPoint":"src/workforce/index.ts","inputs":{"src/workforce/run-authority-client.ts":{"bytesInOutput":5215},"src/workforce/index.ts":{"bytesInOutput":0},"src/workforce/run-admission-client.ts":{"bytesInOutput":7098},"src/core/agent-loop/run-authority.ts":{"bytesInOutput":257}},"bytes":12818}}}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xenosystem/agent-sdk",
-  "version": "0.10.5",
+  "version": "0.10.7",
   "description": "XENO Agent SDK built from the same engine as XENO CODE",
   "type": "module",
   "main": "dist/index.js",
@@ -203,6 +203,7 @@
     "test:ga:engineering": "npm run typecheck && npm run compliance && npm run test:runtime-coordination && npm run test:tool-schema-conformance && npm run test:tool-failure-guard && npm run test:containment && npm run test:context-compaction && npm run test:provider-conformance && npm run test:app-server-v2 && npm run test:observability && npm run test:package-candidate && npm run test:release-evidence",
     "test:ga": "npm run test:ga:engineering && node scripts/verify-release-version.mjs --manifest package.json --require-unused --require-greater-than-latest && node scripts/verify-sdk-ga-evidence.mjs release/evidence",
     "bench:coding-tools": "npm run build && node scripts/run-benchmark.mjs",
+    "prepack": "npm run build && node scripts/verify-dist-exports.mjs",
     "prepublishOnly": "npm run build && npm run typecheck && node scripts/verify-dist-exports.mjs"
   },
   "optionalDependencies": {