agentbnb 8.4.7 → 9.0.0

package/dist/{conduct-TE4YAXKR.js → conduct-5FTKINWU.js}

@@ -1,25 +1,25 @@
 import {
   conductAction
-} from "./chunk-EKLVNIIY.js";
-import "./chunk-SME5LJTE.js";
+} from "./chunk-AZEGOADG.js";
+import "./chunk-4FK45WJI.js";
 import "./chunk-3MJT4PZG.js";
-import "./chunk-IMLFBU3H.js";
-import "./chunk-AZKVGC5T.js";
-import "./chunk-MZSVVG55.js";
+import "./chunk-LLL3KYEM.js";
+import "./chunk-TLT6F35V.js";
+import "./chunk-5PV5YCSN.js";
 import "./chunk-G5WKW3ED.js";
-import "./chunk-2PP5MQPD.js";
-import "./chunk-PIPCGRCR.js";
-import "./chunk-HU46M4JA.js";
-import "./chunk-NX27AFPA.js";
-import "./chunk-PQIP7EXY.js";
-import "./chunk-YKMBFQC2.js";
-import "./chunk-GIEJVKZZ.js";
-import "./chunk-U6LP4KWN.js";
+import "./chunk-UIPGGNRC.js";
+import "./chunk-ELFGYC22.js";
+import "./chunk-P3FDT7G5.js";
+import "./chunk-UR3MISL2.js";
+import "./chunk-3466S65P.js";
+import "./chunk-W6LOCBWQ.js";
+import "./chunk-YNBZLXYS.js";
+import "./chunk-YDGXKH2T.js";
 import "./chunk-3YQ73ZM6.js";
 import "./chunk-3XPBFF6H.js";
-import "./chunk-COA2D7QM.js";
-import "./chunk-WTHMHNKC.js";
-import "./chunk-I7KWA7OB.js";
+import "./chunk-NLQCHO7N.js";
+import "./chunk-J4RFJVXI.js";
+import "./chunk-UVCNMRPS.js";
 
 // src/mcp/tools/conduct.ts
 import { z } from "zod";

package/dist/{conductor-mode-2F5OP7Q4.js → conductor-mode-NRSVP2AU.js}

@@ -1,26 +1,30 @@
 import {
   BudgetController,
   BudgetManager,
+  createUCAN,
+  decodeUCAN,
   decompose,
   matchSubTasks,
   orchestrate,
   validateAndNormalizeSubtasks
-} from "./chunk-OPRCWXD5.js";
+} from "./chunk-SLZBE2I5.js";
 import {
   requestCapability
-} from "./chunk-YKMBFQC2.js";
-import "./chunk-4NFJ3VYZ.js";
+} from "./chunk-W6LOCBWQ.js";
+import "./chunk-DYJ7YGBM.js";
 import "./chunk-HLUEOLSZ.js";
-import "./chunk-NQANA6WH.js";
+import "./chunk-BNS76U6K.js";
 import "./chunk-6QMDJVMS.js";
-import "./chunk-GIEJVKZZ.js";
+import "./chunk-YNBZLXYS.js";
 import "./chunk-IVOYM3WG.js";
 import {
   getCardsByCapabilityType,
   getCardsBySkillCapability
-} from "./chunk-ZU2TP7CN.js";
+} from "./chunk-PG3CLSAH.js";
 import "./chunk-EE3V3DXK.js";
-import "./chunk-I7KWA7OB.js";
+import {
+  AgentBnBError
+} from "./chunk-UVCNMRPS.js";
 
 // src/conductor/team-formation.ts
 import { randomUUID } from "crypto";
@@ -112,6 +116,133 @@ async function formTeam(opts) {
   return { team_id, strategy, matched, unrouted };
 }
 
+// src/auth/ucan-resources.ts
+var SCHEME = "agentbnb";
+var URI_PREFIX = `${SCHEME}://`;
+function parseResource(uri) {
+  if (!uri.startsWith(URI_PREFIX)) {
+    throw new AgentBnBError(
+      `Invalid resource URI: must start with "${URI_PREFIX}", got "${uri}"`,
+      "INVALID_RESOURCE_URI"
+    );
+  }
+  const body = uri.slice(URI_PREFIX.length);
+  if (body.length === 0) {
+    throw new AgentBnBError(
+      `Invalid resource URI: missing resource type in "${uri}"`,
+      "INVALID_RESOURCE_URI"
+    );
+  }
+  const slashIdx = body.indexOf("/");
+  if (slashIdx === -1) {
+    return { scheme: SCHEME, resourceType: body, path: "" };
+  }
+  const resourceType = body.slice(0, slashIdx);
+  if (resourceType.length === 0) {
+    throw new AgentBnBError(
+      `Invalid resource URI: empty resource type in "${uri}"`,
+      "INVALID_RESOURCE_URI"
+    );
+  }
+  const path = body.slice(slashIdx + 1);
+  return { scheme: SCHEME, resourceType, path };
+}
+function splitPath(path) {
+  if (path === "") return [];
+  return path.split("/").filter((s) => s.length > 0);
+}
+function isAttenuation(original, narrowed) {
+  const orig = parseResource(original);
+  const narr = parseResource(narrowed);
+  if (orig.resourceType !== narr.resourceType) {
+    return false;
+  }
+  const origSegs = splitPath(orig.path);
+  const narrSegs = splitPath(narr.path);
+  return isSubPattern(origSegs, 0, narrSegs, 0);
+}
+function isSubPattern(broad, bi, narrow, ni) {
+  if (bi === broad.length && ni === narrow.length) {
+    return true;
+  }
+  if (bi < broad.length && broad[bi] === "**") {
+    if (isSubPattern(broad, bi + 1, narrow, ni)) {
+      return true;
+    }
+    if (ni < narrow.length) {
+      return isSubPattern(broad, bi, narrow, ni + 1);
+    }
+    return false;
+  }
+  if (bi === broad.length) {
+    return false;
+  }
+  if (ni === narrow.length) {
+    return false;
+  }
+  const bSeg = broad[bi];
+  const nSeg = narrow[ni];
+  if (bSeg === "*") {
+    if (nSeg === "**") {
+      return false;
+    }
+    return isSubPattern(broad, bi + 1, narrow, ni + 1);
+  }
+  if (nSeg === "**") {
+    return false;
+  }
+  if (nSeg === "*") {
+    return false;
+  }
+  if (bSeg === nSeg) {
+    return isSubPattern(broad, bi + 1, narrow, ni + 1);
+  }
+  return false;
+}
+
+// src/auth/ucan-delegation.ts
+var ACTION_HIERARCHY = {
+  delegate: 4,
+  write: 3,
+  settle: 2,
+  invoke: 1,
+  read: 0
+};
+function isNarrowed(parent, child) {
+  if (!isAttenuation(parent.with, child.with)) {
+    return false;
+  }
+  const parentLevel = ACTION_HIERARCHY[parent.can];
+  const childLevel = ACTION_HIERARCHY[child.can];
+  if (parentLevel === void 0 || childLevel === void 0) {
+    return parent.can === child.can;
+  }
+  return childLevel <= parentLevel;
+}
+function isAttenuationSubset(parentAtts, childAtts) {
+  return childAtts.every(
+    (child) => parentAtts.some((parent) => isNarrowed(parent, child))
+  );
+}
+function delegateUCAN(opts) {
+  const parent = decodeUCAN(opts.parentToken);
+  if (!isAttenuationSubset(parent.payload.att, opts.narrowedAttenuations)) {
+    throw new AgentBnBError(
+      "Delegated UCAN attenuations must be a subset of the parent token",
+      "UCAN_DELEGATION_ERROR"
+    );
+  }
+  const expiry = opts.expiresAt !== void 0 ? Math.min(opts.expiresAt, parent.payload.exp) : parent.payload.exp;
+  return createUCAN({
+    issuerDid: parent.payload.aud,
+    audienceDid: opts.newAudienceDid,
+    attenuations: opts.narrowedAttenuations,
+    signerKey: opts.signerKey,
+    expiresAt: expiry,
+    proofs: [opts.parentToken]
+  });
+}
+
 // src/conductor/conductor-mode.ts
 var ConductorMode = class {
   db;
@@ -216,6 +347,25 @@ var ConductorMode = class {
         conductorOwner: this.conductorOwner
       });
       onProgress?.({ step: 2, total: 5, message: `Formed team: ${team.matched.length} members, ${team.unrouted.length} unrouted` });
+      const conductorUCAN = typeof params.ucan_token === "string" ? params.ucan_token : void 0;
+      const conductorKey = params.conductor_private_key instanceof Buffer ? params.conductor_private_key : void 0;
+      if (conductorUCAN && conductorKey) {
+        for (const member of team.matched) {
+          try {
+            const memberAtts = [
+              { with: `agentbnb://skill/${member.skill}`, can: "invoke" }
+            ];
+            const memberUCAN = delegateUCAN({
+              parentToken: conductorUCAN,
+              newAudienceDid: `did:agentbnb:${member.agent}`,
+              narrowedAttenuations: memberAtts,
+              signerKey: conductorKey
+            });
+            member.ucan_token = memberUCAN;
+          } catch {
+          }
+        }
+      }
     }
     const budgetManager = new BudgetManager(this.creditDb, this.conductorOwner);
     const budgetController = new BudgetController(budgetManager, this.maxBudget);

package/dist/{conductor-mode-TLIQMU4A.js → conductor-mode-ZWC5BZUL.js}

@@ -4,32 +4,38 @@ import {
   matchSubTasks,
   orchestrate,
   validateAndNormalizeSubtasks
-} from "./chunk-SME5LJTE.js";
+} from "./chunk-4FK45WJI.js";
+import {
+  createUCAN,
+  decodeUCAN
+} from "./chunk-PMVHKTFG.js";
 import "./chunk-3MJT4PZG.js";
-import "./chunk-IMLFBU3H.js";
+import "./chunk-LLL3KYEM.js";
 import {
   BudgetManager
-} from "./chunk-AZKVGC5T.js";
-import "./chunk-MZSVVG55.js";
+} from "./chunk-TLT6F35V.js";
+import "./chunk-5PV5YCSN.js";
 import "./chunk-G5WKW3ED.js";
-import "./chunk-2PP5MQPD.js";
-import "./chunk-PIPCGRCR.js";
-import "./chunk-HU46M4JA.js";
-import "./chunk-NX27AFPA.js";
-import "./chunk-PQIP7EXY.js";
+import "./chunk-UIPGGNRC.js";
+import "./chunk-ELFGYC22.js";
+import "./chunk-P3FDT7G5.js";
+import "./chunk-UR3MISL2.js";
+import "./chunk-3466S65P.js";
 import {
   requestCapability
-} from "./chunk-YKMBFQC2.js";
-import "./chunk-GIEJVKZZ.js";
-import "./chunk-U6LP4KWN.js";
+} from "./chunk-W6LOCBWQ.js";
+import "./chunk-YNBZLXYS.js";
+import "./chunk-YDGXKH2T.js";
 import "./chunk-3YQ73ZM6.js";
 import "./chunk-3XPBFF6H.js";
 import {
   getCardsByCapabilityType,
   getCardsBySkillCapability
-} from "./chunk-COA2D7QM.js";
-import "./chunk-WTHMHNKC.js";
-import "./chunk-I7KWA7OB.js";
+} from "./chunk-NLQCHO7N.js";
+import "./chunk-J4RFJVXI.js";
+import {
+  AgentBnBError
+} from "./chunk-UVCNMRPS.js";
 
 // src/conductor/team-formation.ts
 import { randomUUID } from "crypto";
@@ -121,6 +127,133 @@ async function formTeam(opts) {
   return { team_id, strategy, matched, unrouted };
 }
 
+// src/auth/ucan-resources.ts
+var SCHEME = "agentbnb";
+var URI_PREFIX = `${SCHEME}://`;
+function parseResource(uri) {
+  if (!uri.startsWith(URI_PREFIX)) {
+    throw new AgentBnBError(
+      `Invalid resource URI: must start with "${URI_PREFIX}", got "${uri}"`,
+      "INVALID_RESOURCE_URI"
+    );
+  }
+  const body = uri.slice(URI_PREFIX.length);
+  if (body.length === 0) {
+    throw new AgentBnBError(
+      `Invalid resource URI: missing resource type in "${uri}"`,
+      "INVALID_RESOURCE_URI"
+    );
+  }
+  const slashIdx = body.indexOf("/");
+  if (slashIdx === -1) {
+    return { scheme: SCHEME, resourceType: body, path: "" };
+  }
+  const resourceType = body.slice(0, slashIdx);
+  if (resourceType.length === 0) {
+    throw new AgentBnBError(
+      `Invalid resource URI: empty resource type in "${uri}"`,
+      "INVALID_RESOURCE_URI"
+    );
+  }
+  const path = body.slice(slashIdx + 1);
+  return { scheme: SCHEME, resourceType, path };
+}
+function splitPath(path) {
+  if (path === "") return [];
+  return path.split("/").filter((s) => s.length > 0);
+}
+function isAttenuation(original, narrowed) {
+  const orig = parseResource(original);
+  const narr = parseResource(narrowed);
+  if (orig.resourceType !== narr.resourceType) {
+    return false;
+  }
+  const origSegs = splitPath(orig.path);
+  const narrSegs = splitPath(narr.path);
+  return isSubPattern(origSegs, 0, narrSegs, 0);
+}
+function isSubPattern(broad, bi, narrow, ni) {
+  if (bi === broad.length && ni === narrow.length) {
+    return true;
+  }
+  if (bi < broad.length && broad[bi] === "**") {
+    if (isSubPattern(broad, bi + 1, narrow, ni)) {
+      return true;
+    }
+    if (ni < narrow.length) {
+      return isSubPattern(broad, bi, narrow, ni + 1);
+    }
+    return false;
+  }
+  if (bi === broad.length) {
+    return false;
+  }
+  if (ni === narrow.length) {
+    return false;
+  }
+  const bSeg = broad[bi];
+  const nSeg = narrow[ni];
+  if (bSeg === "*") {
+    if (nSeg === "**") {
+      return false;
+    }
+    return isSubPattern(broad, bi + 1, narrow, ni + 1);
+  }
+  if (nSeg === "**") {
+    return false;
+  }
+  if (nSeg === "*") {
+    return false;
+  }
+  if (bSeg === nSeg) {
+    return isSubPattern(broad, bi + 1, narrow, ni + 1);
+  }
+  return false;
+}
+
+// src/auth/ucan-delegation.ts
+var ACTION_HIERARCHY = {
+  delegate: 4,
+  write: 3,
+  settle: 2,
+  invoke: 1,
+  read: 0
+};
+function isNarrowed(parent, child) {
+  if (!isAttenuation(parent.with, child.with)) {
+    return false;
+  }
+  const parentLevel = ACTION_HIERARCHY[parent.can];
+  const childLevel = ACTION_HIERARCHY[child.can];
+  if (parentLevel === void 0 || childLevel === void 0) {
+    return parent.can === child.can;
+  }
+  return childLevel <= parentLevel;
+}
+function isAttenuationSubset(parentAtts, childAtts) {
+  return childAtts.every(
+    (child) => parentAtts.some((parent) => isNarrowed(parent, child))
+  );
+}
+function delegateUCAN(opts) {
+  const parent = decodeUCAN(opts.parentToken);
+  if (!isAttenuationSubset(parent.payload.att, opts.narrowedAttenuations)) {
+    throw new AgentBnBError(
+      "Delegated UCAN attenuations must be a subset of the parent token",
+      "UCAN_DELEGATION_ERROR"
+    );
+  }
+  const expiry = opts.expiresAt !== void 0 ? Math.min(opts.expiresAt, parent.payload.exp) : parent.payload.exp;
+  return createUCAN({
+    issuerDid: parent.payload.aud,
+    audienceDid: opts.newAudienceDid,
+    attenuations: opts.narrowedAttenuations,
+    signerKey: opts.signerKey,
+    expiresAt: expiry,
+    proofs: [opts.parentToken]
+  });
+}
+
 // src/conductor/conductor-mode.ts
 var ConductorMode = class {
   db;
@@ -225,6 +358,25 @@ var ConductorMode = class {
         conductorOwner: this.conductorOwner
       });
       onProgress?.({ step: 2, total: 5, message: `Formed team: ${team.matched.length} members, ${team.unrouted.length} unrouted` });
+      const conductorUCAN = typeof params.ucan_token === "string" ? params.ucan_token : void 0;
+      const conductorKey = params.conductor_private_key instanceof Buffer ? params.conductor_private_key : void 0;
+      if (conductorUCAN && conductorKey) {
+        for (const member of team.matched) {
+          try {
+            const memberAtts = [
+              { with: `agentbnb://skill/${member.skill}`, can: "invoke" }
+            ];
+            const memberUCAN = delegateUCAN({
+              parentToken: conductorUCAN,
+              newAudienceDid: `did:agentbnb:${member.agent}`,
+              narrowedAttenuations: memberAtts,
+              signerKey: conductorKey
+            });
+            member.ucan_token = memberUCAN;
+          } catch {
+          }
+        }
+      }
     }
     const budgetManager = new BudgetManager(this.creditDb, this.conductorOwner);
     const budgetController = new BudgetController(budgetManager, this.maxBudget);

package/dist/did-action-MQLDT4RF.js

@@ -0,0 +1,50 @@
+import {
+  loadIdentity
+} from "./chunk-5CC6O6SO.js";
+import "./chunk-YNBZLXYS.js";
+import {
+  getConfigDir
+} from "./chunk-3XPBFF6H.js";
+import "./chunk-UVCNMRPS.js";
+
+// src/cli/did-action.ts
+async function didShow() {
+  const configDir = getConfigDir();
+  const identity = loadIdentity(configDir);
+  if (!identity) {
+    console.error("Error: no identity found. Run `agentbnb init` first.");
+    process.exit(1);
+  }
+  const didAgentBnB = identity.did ?? `did:agentbnb:${identity.agent_id}`;
+  console.log("Agent Identity (DID)");
+  console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log(`  agent_id:      ${identity.agent_id}`);
+  console.log(`  did:agentbnb:  ${didAgentBnB}`);
+  console.log(`  owner:         ${identity.owner}`);
+  console.log(`  public_key:    ${identity.public_key.slice(0, 32)}...`);
+  console.log(`  created_at:    ${identity.created_at}`);
+  if (identity.guarantor) {
+    console.log(`  guarantor:     ${identity.guarantor.github_login}`);
+  }
+}
+async function didShowJson() {
+  const configDir = getConfigDir();
+  const identity = loadIdentity(configDir);
+  if (!identity) {
+    console.error("Error: no identity found. Run `agentbnb init` first.");
+    process.exit(1);
+  }
+  const output = {
+    agent_id: identity.agent_id,
+    did: identity.did ?? `did:agentbnb:${identity.agent_id}`,
+    owner: identity.owner,
+    public_key: identity.public_key,
+    created_at: identity.created_at,
+    guarantor: identity.guarantor ?? null
+  };
+  console.log(JSON.stringify(output, null, 2));
+}
+export {
+  didShow,
+  didShowJson
+};

package/dist/{execute-VRTABQ6F.js → execute-DNRNU3HM.js}

@@ -1,14 +1,14 @@
 import {
   executeCapabilityBatch,
   executeCapabilityRequest
-} from "./chunk-5SIGMKOD.js";
-import "./chunk-NQANA6WH.js";
+} from "./chunk-77HAL2ZL.js";
+import "./chunk-BNS76U6K.js";
 import "./chunk-6QMDJVMS.js";
-import "./chunk-GIEJVKZZ.js";
+import "./chunk-YNBZLXYS.js";
 import "./chunk-IVOYM3WG.js";
-import "./chunk-ZU2TP7CN.js";
+import "./chunk-PG3CLSAH.js";
 import "./chunk-EE3V3DXK.js";
-import "./chunk-I7KWA7OB.js";
+import "./chunk-UVCNMRPS.js";
 export {
   executeCapabilityBatch,
   executeCapabilityRequest

package/dist/execute-JTPFFEH6.js

@@ -0,0 +1,20 @@
+import {
+  executeCapabilityBatch,
+  executeCapabilityRequest
+} from "./chunk-BOBND3QV.js";
+import "./chunk-W5J3PEQ6.js";
+import "./chunk-NZTLBAML.js";
+import "./chunk-5CC6O6SO.js";
+import "./chunk-UIPGGNRC.js";
+import "./chunk-ELFGYC22.js";
+import "./chunk-P3FDT7G5.js";
+import "./chunk-YNBZLXYS.js";
+import "./chunk-YDGXKH2T.js";
+import "./chunk-3XPBFF6H.js";
+import "./chunk-NLQCHO7N.js";
+import "./chunk-J4RFJVXI.js";
+import "./chunk-UVCNMRPS.js";
+export {
+  executeCapabilityBatch,
+  executeCapabilityRequest
+};