rivetkit 2.3.20 → 2.3.21

package/dist/tsup/agent-os/index.d.cts

@@ -2,6 +2,7 @@ import * as _rivet_dev_agent_os_core from '@rivet-dev/agent-os-core';
 import { AgentOs, JsonRpcNotification, PermissionRequest, CronEvent, AgentCapabilities, AgentInfo, JsonRpcResponse, AgentOsOptions, BatchReadResult, BatchWriteEntry, BatchWriteResult, ReaddirRecursiveOptions, DirEntry, AgentRegistryEntry, SpawnedProcessInfo, ProcessInfo, ProcessTreeNode, SessionModeState, SessionConfigOption, GetEventsOptions, SequencedEvent, PermissionReply, AgentType, CreateSessionOptions, SessionInfo, OpenShellOptions } from '@rivet-dev/agent-os-core';
 import { z as z$1 } from 'zod/v4';
 import { StandardSchemaV1 } from '@standard-schema/spec';
+import { Rivet } from '@rivetkit/engine-api-full';
 import { Context, Handler, Hono } from 'hono';
 import { UniversalWebSocket } from '@rivetkit/virtual-websocket';
 import * as _rivetkit_rivetkit_wasm from '@rivetkit/rivetkit-wasm';
@@ -272,7 +273,7 @@ declare const RegistryConfigSchema: z.ZodPipe<z.ZodObject<{
     endpoint: string | undefined;
     startServices: boolean;
     namespace: string;
-    token: string;
+    token: string | undefined;
     publicEndpoint: string | undefined;
     publicNamespace: string | undefined;
     publicToken: string | undefined;
@@ -445,6 +446,24 @@ declare class ActorDefinition<S, CP, CS, V, I, DB extends AnyDatabaseProvider, E
     get config(): ActorConfig<S, CP, CS, V, I, DB, E, Q, R>;
 }
 
+/** Options for `client.auth.issueToken()`. `expiresIn` is in seconds. */
+type IssueTokenOptions = Pick<Rivet.AuthTokenCreateRequest, "subject" | "grants"> & {
+    expiresIn?: Rivet.AuthTokenCreateRequest["duration"];
+};
+/** Token timestamps are Unix milliseconds. */
+interface IssuedToken {
+    token: Rivet.AuthTokenCreateResponse["token"];
+    issuedAt: Rivet.AuthTokenCreateResponse["issuedTs"];
+    expiresAt: Rivet.AuthTokenCreateResponse["expiresTs"];
+}
+/** Resources that can be scoped to a single actor ID. */
+type ActorTokenResource = Extract<Rivet.AuthTokenGrant["resource"], "actor_gateway" | "actor" | "actor_kv">;
+type ActorTokenPermissions = Partial<Record<ActorTokenResource, Rivet.AuthTokenGrant["operations"]>>;
+/** Options for `actor.issueToken()`. Omit permissions for gateway read access only. */
+type ActorIssueTokenOptions = Pick<IssueTokenOptions, "subject" | "expiresIn"> & {
+    permissions?: ActorTokenPermissions;
+};
+
 declare const EncodingSchema: z$1.ZodEnum<{
     json: "json";
     cbor: "cbor";
@@ -576,6 +595,7 @@ interface GatewayRequestOptions {
     skipReadyWait?: boolean;
 }
 interface EngineControlClient {
+    issueToken(options: IssueTokenOptions): Promise<IssuedToken>;
     getForId(input: GetForIdInput): Promise<ActorOutput | undefined>;
     getWithKey(input: GetWithKeyInput): Promise<ActorOutput | undefined>;
     getOrCreateWithKey(input: GetOrCreateWithKeyInput): Promise<ActorOutput>;
@@ -583,6 +603,8 @@ interface EngineControlClient {
     listActors(input: ListActorsInput): Promise<ActorOutput[]>;
     sendRequest(target: GatewayTarget, actorRequest: Request, options?: GatewayRequestOptions): Promise<Response>;
     openWebSocket(path: string, target: GatewayTarget, encoding: Encoding, params: unknown, options?: GatewayRequestOptions): Promise<UniversalWebSocket>;
+    /** Refresh a credential rejected during this WebSocket handshake, if supported. */
+    refreshAuthToken?(ws: UniversalWebSocket): Promise<boolean>;
     proxyRequest(c: Context, actorRequest: Request, actorId: string): Promise<Response>;
     proxyWebSocket(c: Context, path: string, actorId: string, encoding: Encoding, params: unknown): Promise<Response>;
     buildGatewayUrl(target: GatewayTarget, options?: GatewayRequestOptions): Promise<string>;
@@ -1572,6 +1594,8 @@ declare class ActorHandleRaw {
      * Resolves the actor to get its unique actor ID.
      */
     resolve(): Promise<string>;
+    /** Issue a token scoped to this actor. Defaults to actor gateway read access. */
+    issueToken(options?: ActorIssueTokenOptions): Promise<IssuedToken>;
     /**
      * Returns the raw URL for routing traffic to the actor.
      */
@@ -1597,7 +1621,7 @@ declare class ActorHandleRaw {
 type ActorHandle<AD extends AnyActorDefinition> = Omit<ActorHandleRaw, "connect" | "send"> & {
     connect(params?: unknown, options?: ActorConnectOptions): ActorConn<AD>;
     resolve(): Promise<string>;
-} & ActorDefinitionQueueSend<AD> & ActorDefinitionActions<AD>;
+} & ActorDefinitionQueueSend<AD> & Omit<ActorDefinitionActions<AD>, keyof ActorHandleRaw>;
 
 /** Extract the actor registry from the registry definition. */
 type ExtractActorsFromRegistry<A extends Registry<any>> = A extends Registry<infer Actors> ? Actors : never;
@@ -1733,6 +1757,10 @@ interface ActorClientRuntimeOptions {
  */
 declare class ClientRaw {
     #private;
+    /** Issue namespace-scoped tokens with an explicit grant list. */
+    readonly auth: {
+        issueToken(options: IssueTokenOptions): Promise<IssuedToken>;
+    };
     [ACTOR_CONNS_SYMBOL]: Set<ActorConnRaw>;
     /**
      * Creates an instance of Client.
@@ -1793,9 +1821,9 @@ declare class ClientRaw {
  *
  * @template A The actor registry type.
  */
-type Client<A extends Registry<any>> = ClientRaw & {
+type Client<A extends Registry<any>> = ClientRaw & Omit<{
     [K in keyof ExtractActorsFromRegistry<A>]: ActorAccessor<ExtractActorsFromRegistry<A>[K]>;
-};
+}, keyof ClientRaw>;
 
 /** @experimental State exposed by a durable workflow run handler to the Inspector. */
 type WorkflowState = "pending" | "running" | "sleeping" | "failed" | "completed" | "cancelled" | "rolling_back";

package/dist/tsup/agent-os/index.d.ts

@@ -2,6 +2,7 @@ import * as _rivet_dev_agent_os_core from '@rivet-dev/agent-os-core';
 import { AgentOs, JsonRpcNotification, PermissionRequest, CronEvent, AgentCapabilities, AgentInfo, JsonRpcResponse, AgentOsOptions, BatchReadResult, BatchWriteEntry, BatchWriteResult, ReaddirRecursiveOptions, DirEntry, AgentRegistryEntry, SpawnedProcessInfo, ProcessInfo, ProcessTreeNode, SessionModeState, SessionConfigOption, GetEventsOptions, SequencedEvent, PermissionReply, AgentType, CreateSessionOptions, SessionInfo, OpenShellOptions } from '@rivet-dev/agent-os-core';
 import { z as z$1 } from 'zod/v4';
 import { StandardSchemaV1 } from '@standard-schema/spec';
+import { Rivet } from '@rivetkit/engine-api-full';
 import { Context, Handler, Hono } from 'hono';
 import { UniversalWebSocket } from '@rivetkit/virtual-websocket';
 import * as _rivetkit_rivetkit_wasm from '@rivetkit/rivetkit-wasm';
@@ -272,7 +273,7 @@ declare const RegistryConfigSchema: z.ZodPipe<z.ZodObject<{
     endpoint: string | undefined;
     startServices: boolean;
     namespace: string;
-    token: string;
+    token: string | undefined;
     publicEndpoint: string | undefined;
     publicNamespace: string | undefined;
     publicToken: string | undefined;
@@ -445,6 +446,24 @@ declare class ActorDefinition<S, CP, CS, V, I, DB extends AnyDatabaseProvider, E
     get config(): ActorConfig<S, CP, CS, V, I, DB, E, Q, R>;
 }
 
+/** Options for `client.auth.issueToken()`. `expiresIn` is in seconds. */
+type IssueTokenOptions = Pick<Rivet.AuthTokenCreateRequest, "subject" | "grants"> & {
+    expiresIn?: Rivet.AuthTokenCreateRequest["duration"];
+};
+/** Token timestamps are Unix milliseconds. */
+interface IssuedToken {
+    token: Rivet.AuthTokenCreateResponse["token"];
+    issuedAt: Rivet.AuthTokenCreateResponse["issuedTs"];
+    expiresAt: Rivet.AuthTokenCreateResponse["expiresTs"];
+}
+/** Resources that can be scoped to a single actor ID. */
+type ActorTokenResource = Extract<Rivet.AuthTokenGrant["resource"], "actor_gateway" | "actor" | "actor_kv">;
+type ActorTokenPermissions = Partial<Record<ActorTokenResource, Rivet.AuthTokenGrant["operations"]>>;
+/** Options for `actor.issueToken()`. Omit permissions for gateway read access only. */
+type ActorIssueTokenOptions = Pick<IssueTokenOptions, "subject" | "expiresIn"> & {
+    permissions?: ActorTokenPermissions;
+};
+
 declare const EncodingSchema: z$1.ZodEnum<{
     json: "json";
     cbor: "cbor";
@@ -576,6 +595,7 @@ interface GatewayRequestOptions {
     skipReadyWait?: boolean;
 }
 interface EngineControlClient {
+    issueToken(options: IssueTokenOptions): Promise<IssuedToken>;
     getForId(input: GetForIdInput): Promise<ActorOutput | undefined>;
     getWithKey(input: GetWithKeyInput): Promise<ActorOutput | undefined>;
     getOrCreateWithKey(input: GetOrCreateWithKeyInput): Promise<ActorOutput>;
@@ -583,6 +603,8 @@ interface EngineControlClient {
     listActors(input: ListActorsInput): Promise<ActorOutput[]>;
     sendRequest(target: GatewayTarget, actorRequest: Request, options?: GatewayRequestOptions): Promise<Response>;
     openWebSocket(path: string, target: GatewayTarget, encoding: Encoding, params: unknown, options?: GatewayRequestOptions): Promise<UniversalWebSocket>;
+    /** Refresh a credential rejected during this WebSocket handshake, if supported. */
+    refreshAuthToken?(ws: UniversalWebSocket): Promise<boolean>;
     proxyRequest(c: Context, actorRequest: Request, actorId: string): Promise<Response>;
     proxyWebSocket(c: Context, path: string, actorId: string, encoding: Encoding, params: unknown): Promise<Response>;
     buildGatewayUrl(target: GatewayTarget, options?: GatewayRequestOptions): Promise<string>;
@@ -1572,6 +1594,8 @@ declare class ActorHandleRaw {
      * Resolves the actor to get its unique actor ID.
      */
     resolve(): Promise<string>;
+    /** Issue a token scoped to this actor. Defaults to actor gateway read access. */
+    issueToken(options?: ActorIssueTokenOptions): Promise<IssuedToken>;
     /**
      * Returns the raw URL for routing traffic to the actor.
      */
@@ -1597,7 +1621,7 @@ declare class ActorHandleRaw {
 type ActorHandle<AD extends AnyActorDefinition> = Omit<ActorHandleRaw, "connect" | "send"> & {
     connect(params?: unknown, options?: ActorConnectOptions): ActorConn<AD>;
     resolve(): Promise<string>;
-} & ActorDefinitionQueueSend<AD> & ActorDefinitionActions<AD>;
+} & ActorDefinitionQueueSend<AD> & Omit<ActorDefinitionActions<AD>, keyof ActorHandleRaw>;
 
 /** Extract the actor registry from the registry definition. */
 type ExtractActorsFromRegistry<A extends Registry<any>> = A extends Registry<infer Actors> ? Actors : never;
@@ -1733,6 +1757,10 @@ interface ActorClientRuntimeOptions {
  */
 declare class ClientRaw {
     #private;
+    /** Issue namespace-scoped tokens with an explicit grant list. */
+    readonly auth: {
+        issueToken(options: IssueTokenOptions): Promise<IssuedToken>;
+    };
     [ACTOR_CONNS_SYMBOL]: Set<ActorConnRaw>;
     /**
      * Creates an instance of Client.
@@ -1793,9 +1821,9 @@ declare class ClientRaw {
  *
  * @template A The actor registry type.
  */
-type Client<A extends Registry<any>> = ClientRaw & {
+type Client<A extends Registry<any>> = ClientRaw & Omit<{
     [K in keyof ExtractActorsFromRegistry<A>]: ActorAccessor<ExtractActorsFromRegistry<A>[K]>;
-};
+}, keyof ClientRaw>;
 
 /** @experimental State exposed by a durable workflow run handler to the Inspector. */
 type WorkflowState = "pending" | "running" | "sleeping" | "failed" | "completed" | "cancelled" | "rolling_back";

package/dist/tsup/agent-os/index.js

@@ -451,7 +451,7 @@ function isRivetErrorCode(error, group, code) {
 // package.json
 var package_default = {
   name: "rivetkit",
-  version: "2.3.20",
+  version: "2.3.21",
   description: "Lightweight libraries for building stateful actors on edge platforms",
   license: "Apache-2.0",
   keywords: [
@@ -664,6 +664,7 @@ var package_default = {
     "@rivet-dev/agent-os-core": "^0.1.1",
     "@rivet-dev/services": "^0.1.5",
     "@rivetkit/bare-ts": "^0.6.2",
+    "@rivetkit/engine-api-full": "workspace:*",
     "@rivetkit/engine-cli": "workspace:*",
     "@rivetkit/engine-envoy-protocol": "workspace:*",
     "@rivetkit/on-change": "6.0.1",