robotrock 1.3.2 → 1.3.3

package/dist/eve/agent/index.d.ts

@@ -33,9 +33,72 @@ declare function robotrockUserContextAuth(options?: RobotrockUserContextAuthOpti
  * (`GET /eve/v1/info` during verify and tenant connect).
  */
 declare function robotrockAgentServiceAuth(): AuthFn<Request>;
-/** Bearer token used by the RobotRock webhook resume self-call. */
+/**
+ * Bearer token for RobotRock platform reachability and dashboard proxy calls.
+ *
+ * When a workspace admin connects a protected single-tenant deployment, they
+ * enter a Bearer token in **Settings → Agents**. RobotRock stores it in
+ * WorkOS Vault and sends `Authorization: Bearer <token>` on:
+ *
+ * - `GET /eve/v1/info` and `GET /eve/v1/health` (connect / re-sync)
+ * - `POST /eve/v1/session` and `POST /eve/v1/session/:sessionId` (chat + resume)
+ * - `GET /eve/v1/session/:sessionId/stream` (chat streaming)
+ * - optional icon paths (`/favicon.ico`, `/icon.svg`, `/icon.png`)
+ *
+ * Set `EVE_SELF_AUTH_TOKEN` on the agent to the same value. Use
+ * `robotrockEveChannel()` so this authenticator is registered on the Eve channel.
+ */
 declare function eveSelfServiceAuth(): AuthFn<Request>;
 
+/**
+ * Eve HTTP routes RobotRock reaches when connecting, re-syncing, or proxying
+ * dashboard chat. Use these paths when smoke-testing a protected deployment.
+ *
+ * Self-hosted agents that require deployment access: set `EVE_SELF_AUTH_TOKEN` on
+ * the agent to the same value the workspace admin enters under **Settings →
+ * Agents → Deployment access → Bearer token**. RobotRock stores that token in
+ * WorkOS Vault and sends it as `Authorization: Bearer <token>` on every call
+ * below (plus `X-RobotRock-User-Token` during inbox chat).
+ */
+/** Routes RobotRock calls directly from the dashboard backend (connect / re-sync). */
+declare const ROBOTROCK_EVE_CONNECT_ROUTES: {
+    /** Agent manifest + `robotrock-ready` hook detection. */
+    readonly info: {
+        readonly method: "GET";
+        readonly path: "/eve/v1/info";
+    };
+    /** Optional health probe (same auth as `/info` when the channel is protected). */
+    readonly health: {
+        readonly method: "GET";
+        readonly path: "/eve/v1/health";
+    };
+};
+/** Static assets RobotRock may HEAD/GET for the agent avatar in Settings. */
+declare const ROBOTROCK_EVE_ICON_PATHS: readonly ["/favicon.ico", "/icon.svg", "/icon.png"];
+/**
+ * Routes proxied through `/{tenant}/api/eve/{connectionId}/…` during inbox chat
+ * and task-handled resume. The Eve client issues these against the proxy host;
+ * the proxy forwards them to the deployment with vault credentials attached.
+ */
+declare const ROBOTROCK_EVE_CHAT_ROUTES: {
+    readonly createSession: {
+        readonly method: "POST";
+        readonly path: "/eve/v1/session";
+    };
+    readonly continueSession: {
+        readonly method: "POST";
+        readonly path: "/eve/v1/session/:sessionId";
+    };
+    readonly messageStream: {
+        readonly method: "GET";
+        readonly path: "/eve/v1/session/:sessionId/stream";
+    };
+};
+/** Env var on the Eve agent that must match the dashboard Bearer token. */
+declare const EVE_SELF_AUTH_TOKEN_ENV_VAR = "EVE_SELF_AUTH_TOKEN";
+/** All Eve route paths that should accept the dashboard Bearer token on protected deployments. */
+declare const ROBOTROCK_EVE_BEARER_PROTECTED_PATHS: readonly ["/eve/v1/info", "/eve/v1/health", "/eve/v1/session", "/eve/v1/session/:sessionId", "/eve/v1/session/:sessionId/stream", "/favicon.ico", "/icon.svg", "/icon.png"];
+
 /** Resolve the platform RS256 public key used to verify dashboard user-context JWTs. */
 declare function resolvePlatformUserContextPublicKeyPem(): Promise<string | null>;
 
@@ -161,4 +224,4 @@ declare const robotrockChatAuditHook: HookDefinition;
 /** Alias for agents that prefer a factory name. */
 declare function defineRobotRockChatAuditHook(): HookDefinition;
 
-export { type CreateRobotRockCronChatInput, type CreateRobotRockTaskInput, ROBOTROCK_USER_CONTEXT_HEADER, type RobotRockChatAuditPayload, type RobotRockTaskActionInput, type RobotRockTaskAssignToInput, type RobotRockTaskContextInput, type RobotRockTaskToolInput, type RobotrockEveChannelOptions, type RobotrockUserContextAuthOptions, buildRobotRockTaskPayload, createRobotRockCronChat, createRobotRockTask, defineRobotRockChatAuditHook, defineRobotRockReadyHook, eveSelfServiceAuth, fetchRobotRockStagedHitl, postRobotRockChatInputAudit, postRobotRockLinkChatTask, postRobotRockStageHitl, resetBoundClientAuthWarning, resetChatAuditWarnings, resetRobotrockChatAuditIdempotencyKeys, resolvePlatformUserContextPublicKeyPem, resolveTaskHandledWebhookUrl, robotrockAgentServiceAuth, robotrockChatAuditHook, robotrockEveChannel, robotrockReadyHook, robotrockUserContextAuth, tryCreateBoundRobotRockClient };
+export { type CreateRobotRockCronChatInput, type CreateRobotRockTaskInput, EVE_SELF_AUTH_TOKEN_ENV_VAR, ROBOTROCK_EVE_BEARER_PROTECTED_PATHS, ROBOTROCK_EVE_CHAT_ROUTES, ROBOTROCK_EVE_CONNECT_ROUTES, ROBOTROCK_EVE_ICON_PATHS, ROBOTROCK_USER_CONTEXT_HEADER, type RobotRockChatAuditPayload, type RobotRockTaskActionInput, type RobotRockTaskAssignToInput, type RobotRockTaskContextInput, type RobotRockTaskToolInput, type RobotrockEveChannelOptions, type RobotrockUserContextAuthOptions, buildRobotRockTaskPayload, createRobotRockCronChat, createRobotRockTask, defineRobotRockChatAuditHook, defineRobotRockReadyHook, eveSelfServiceAuth, fetchRobotRockStagedHitl, postRobotRockChatInputAudit, postRobotRockLinkChatTask, postRobotRockStageHitl, resetBoundClientAuthWarning, resetChatAuditWarnings, resetRobotrockChatAuditIdempotencyKeys, resolvePlatformUserContextPublicKeyPem, resolveTaskHandledWebhookUrl, robotrockAgentServiceAuth, robotrockChatAuditHook, robotrockEveChannel, robotrockReadyHook, robotrockUserContextAuth, tryCreateBoundRobotRockClient };

package/dist/eve/agent/index.js

@@ -638,6 +638,39 @@ function eveSelfServiceAuth() {
   };
 }
 
+// src/eve/agent/deployment-access.ts
+var ROBOTROCK_EVE_CONNECT_ROUTES = {
+  /** Agent manifest + `robotrock-ready` hook detection. */
+  info: { method: "GET", path: "/eve/v1/info" },
+  /** Optional health probe (same auth as `/info` when the channel is protected). */
+  health: { method: "GET", path: "/eve/v1/health" }
+};
+var ROBOTROCK_EVE_ICON_PATHS = [
+  "/favicon.ico",
+  "/icon.svg",
+  "/icon.png"
+];
+var ROBOTROCK_EVE_CHAT_ROUTES = {
+  createSession: { method: "POST", path: "/eve/v1/session" },
+  continueSession: {
+    method: "POST",
+    path: "/eve/v1/session/:sessionId"
+  },
+  messageStream: {
+    method: "GET",
+    path: "/eve/v1/session/:sessionId/stream"
+  }
+};
+var EVE_SELF_AUTH_TOKEN_ENV_VAR = "EVE_SELF_AUTH_TOKEN";
+var ROBOTROCK_EVE_BEARER_PROTECTED_PATHS = [
+  ROBOTROCK_EVE_CONNECT_ROUTES.info.path,
+  ROBOTROCK_EVE_CONNECT_ROUTES.health.path,
+  ROBOTROCK_EVE_CHAT_ROUTES.createSession.path,
+  ROBOTROCK_EVE_CHAT_ROUTES.continueSession.path,
+  ROBOTROCK_EVE_CHAT_ROUTES.messageStream.path,
+  ...ROBOTROCK_EVE_ICON_PATHS
+];
+
 // src/eve/agent/channel.ts
 import { eveChannel } from "eve/channels/eve";
 import { localDev, vercelOidc } from "eve/channels/auth";
@@ -2706,6 +2739,11 @@ function requireBoundAgentAdminClient(ctx) {
   return createBoundAgentAdminClient(ctx);
 }
 export {
+  EVE_SELF_AUTH_TOKEN_ENV_VAR,
+  ROBOTROCK_EVE_BEARER_PROTECTED_PATHS,
+  ROBOTROCK_EVE_CHAT_ROUTES,
+  ROBOTROCK_EVE_CONNECT_ROUTES,
+  ROBOTROCK_EVE_ICON_PATHS,
   ROBOTROCK_PLATFORM_USER_CONTEXT_PUBLIC_KEY_URL,
   ROBOTROCK_READY_HOOK_SLUG,
   ROBOTROCK_USER_CONTEXT_AUDIENCE,