gemi 0.86.1 → 0.87.0

package/dist/ai/signing.d.ts

@@ -32,6 +32,14 @@ import { type NonceStore } from "./store/Nonces";
  * output" arm of `ClientToolResult` would be fabricating a server tool's result
  * rather than approving it. Binding the kind makes that a forgery instead of a
  * shape the caller has to remember to check.
+ *
+ * Keys and principals (#447). Neither token kind is MACed with `SECRET`
+ * itself: each is keyed with its own HKDF-derived key (`purposeKey` below), so
+ * a MAC minted for one purpose — a pending call, a parked-run record, or
+ * anything else in the app keyed off `SECRET` (CSRF, sessions) — is never a
+ * MAC for another. And each binds the `subject`, the principal the run was
+ * started for (`AgentController.runOwner`), so a token minted while user A was
+ * asked cannot be answered by user B, even with A's history in hand.
  */
 /** Everything the signature commits to. */
 export type PendingCallClaims = {
@@ -51,6 +59,14 @@ export type PendingCallClaims = {
      * being replayed as a top-level call, or as one nested under Y.
      */
     path?: string[];
+    /**
+     * Who the question was asked of: the run's owner (`AgentController.runOwner`,
+     * `user:<id>` by default). `null` or absent is nobody in particular — an
+     * anonymous run — and the two are the same claim. A token minted for one
+     * subject fails verification for any other, `null` included, so an approval
+     * cannot be carried from one user's session to another's.
+     */
+    subject?: string | null;
 };
 export type SignOptions = {
     /** Overrides `process.env.SECRET`. Exists for tests; apps use the app key. */
@@ -84,6 +100,20 @@ export type VerifyResult = {
     ok: false;
     reason: "malformed" | "expired" | "forged";
 };
+/**
+ * A key for one purpose, derived from the app secret with HKDF-SHA256.
+ *
+ * `SECRET` is also what CSRF tokens and sessions are keyed with. Using it as
+ * the HMAC key here would make every one of those a potential oracle for the
+ * others; HKDF with a purpose label gives each its own independent key, so a
+ * weakness or leak in one use cannot be turned against another — including
+ * the two token kinds in this file against each other.
+ *
+ * Memoized per (purpose, secret): verification is on the request path and the
+ * derivation is pure. The map is bounded by the number of purposes times the
+ * secrets a process ever sees, which is one outside of tests.
+ */
+export declare function purposeKey(purpose: string, override?: string): Buffer;
 /**
  * Serializes a value so that the same value always produces the same string.
  *
@@ -95,7 +125,7 @@ export type VerifyResult = {
  * keep their order because in an array order *is* the value.
  */
 export declare function canonicalize(value: unknown): string;
-/** `agt1.<runId>.<nonce>.<expiry>.<mac>`, all base64url or base36. */
+/** `agt2.<runId>.<nonce>.<expiry>.<mac>`, all base64url or base36. */
 export declare function signPendingCall(claims: PendingCallClaims, options?: SignOptions): string;
 /**
  * The metadata a signature carries in the clear.
@@ -158,6 +188,9 @@ export type NestedRunClaims = {
      * pending call makes: the input executed is the input signed.
      */
     input: unknown;
+    /** The run's owner, as on `PendingCallClaims.subject`: a record parked for
+     *  one principal does not re-enter a tool for another. */
+    subject?: string | null;
 };
 /**
  * Same shape as a pending call's token, so the same reader serves both — nonce

package/dist/ai/signing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../ai/signing.ts"],"names":[],"mappings":"AACA,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,2CAA2C;AAC3C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;IACzC,KAAK,EAAE,OAAO,CAAC;IACf;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAA;CAAE,CAAC;AAkB9D;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAYnD;AAkDD,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,GAAE,WAAgB,GAAG,MAAM,CAO5F;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,GAChB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAE5D;AA6BD,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,iBAAiB,EACzB,OAAO,GAAE,aAAkB,GAC1B,YAAY,CAwBd;AAID;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,wFAAwF;IACxF,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;;;;;OAOG;IACH,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAmBF;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,GAAE,WAAgB,GAAG,MAAM,CAOxF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,EACtC,OAAO,GAAE,aAAkB,GAC1B,YAAY,CAwBd;AAID;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAErF;AAUD;qCACqC;AACrC,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAG1F;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAGxF"}
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../ai/signing.ts"],"names":[],"mappings":"AACA,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,2CAA2C;AAC3C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;IACzC,KAAK,EAAE,OAAO,CAAC;IACf;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAA;CAAE,CAAC;AAsC9D;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAUrE;AAeD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAYnD;AAoFD,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,GAAE,WAAgB,GAAG,MAAM,CAO5F;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,GAChB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAE5D;AA6BD,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,iBAAiB,EACzB,OAAO,GAAE,aAAkB,GAC1B,YAAY,CA6Bd;AAID;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,wFAAwF;IACxF,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;;;;;OAOG;IACH,KAAK,EAAE,OAAO,CAAC;IACf;8DAC0D;IAC1D,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAmCF;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,GAAE,WAAgB,GAAG,MAAM,CAOxF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,EACtC,OAAO,GAAE,aAAkB,GAC1B,YAAY,CA6Bd;AAID;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAErF;AAUD;qCACqC;AACrC,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAK1F;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAKxF"}

package/dist/app/index.js

@@ -1,4 +1,4 @@
 // @bun
-import{xa as a}from"../chunk-dadygfkf.js";import"../chunk-ndat0nf0.js";import"../chunk-9tsw1bmt.js";export{a as App};
+import{xa as a}from"../chunk-y3trr7xh.js";import"../chunk-4mynkrv4.js";import"../chunk-3bjj31n9.js";export{a as App};
 
 //# debugId=1DF7F2A4406AF3BE64756E2164756E21

package/dist/bun/plugin.js

@@ -1,4 +1,4 @@
 // @bun
-import{ca as a}from"../chunk-qje4kdff.js";import"../chunk-mk8m3ffx.js";import"../chunk-4zj05vry.js";import"../chunk-9tsw1bmt.js";export{a as gemiPlugin};
+import{ca as a}from"../chunk-h5mz3zdr.js";import"../chunk-9zkgvggh.js";import"../chunk-7bynhyt1.js";import"../chunk-3bjj31n9.js";export{a as gemiPlugin};
 
 //# debugId=DBAE3729A59FFE4464756E2164756E21

package/dist/bun/preload.js

@@ -1,4 +1,4 @@
 // @bun
-import{ca as k}from"../chunk-qje4kdff.js";import"../chunk-mk8m3ffx.js";import"../chunk-4zj05vry.js";import{ua as j}from"../chunk-gvkydx8r.js";import"../chunk-9tsw1bmt.js";var{plugin:q}=globalThis.Bun;q(k());var y=await j(process.cwd());for(let x of y.bun?.plugins??[])q(x);
+import{ca as k}from"../chunk-h5mz3zdr.js";import"../chunk-9zkgvggh.js";import"../chunk-7bynhyt1.js";import{ua as j}from"../chunk-gvkydx8r.js";import"../chunk-3bjj31n9.js";var{plugin:q}=globalThis.Bun;q(k());var y=await j(process.cwd());for(let x of y.bun?.plugins??[])q(x);
 
 //# debugId=D461962ED718EDF864756E2164756E21