runline 0.32.0 → 0.34.0

package/dist/plugins/zulip/src/index.js

@@ -1,36 +1,30 @@
-function getConn(ctx) {
-    const c = ctx.connection.config;
-    return {
-        url: c.url.replace(/\/$/, ""),
-        email: c.email,
-        apiKey: c.apiKey,
-    };
+import { credentialJson, pathSegment } from "../../_shared/credentials.js";
+import { zulipCredential } from "./credentials.js";
+/** Zulip takes form-encoded parameters; nested values are JSON strings. */
+function zulipParams(body) {
+    return Object.fromEntries(Object.entries(body).map(([k, v]) => [
+        k,
+        v && typeof v === "object" ? JSON.stringify(v) : v,
+    ]));
 }
-async function apiRequest(conn, method, endpoint, body) {
-    const url = `${conn.url}/api/v1${endpoint}`;
-    const init = {
+function apiRequest(ctx, method, path, body) {
+    const params = body && Object.keys(body).length > 0 ? zulipParams(body) : undefined;
+    // GET parameters ride in the query string; a GET carries no body.
+    return credentialJson(ctx, zulipCredential, "zulip", {
+        target: "api",
+        path,
         method,
-        headers: {
-            Authorization: `Basic ${btoa(`${conn.email}:${conn.apiKey}`)}`,
-            "Content-Type": "application/x-www-form-urlencoded",
-        },
-    };
-    if (body && Object.keys(body).length > 0) {
-        const form = new URLSearchParams();
-        for (const [k, v] of Object.entries(body)) {
-            if (v !== undefined && v !== null)
-                form.set(k, typeof v === "object" ? JSON.stringify(v) : String(v));
-        }
-        init.body = form;
-    }
-    const res = await fetch(url, init);
-    if (!res.ok)
-        throw new Error(`Zulip error ${res.status}: ${await res.text()}`);
-    return res.json();
+        ...(params && method === "GET"
+            ? { query: params }
+            : params
+                ? { form: params }
+                : {}),
+    });
 }
 export default function zulip(rl) {
     rl.setName("zulip");
     rl.setVersion("0.1.0");
+    rl.setCredential(zulipCredential);
     rl.setConnectionSchema({
         url: {
             type: "string",
@@ -65,7 +59,7 @@ export default function zulip(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            return apiRequest(getConn(ctx), "POST", "/messages", {
+            return apiRequest(ctx, "POST", "messages", {
                 type: "private",
                 to: p.to,
                 content: p.content,
@@ -86,7 +80,7 @@ export default function zulip(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            return apiRequest(getConn(ctx), "POST", "/messages", {
+            return apiRequest(ctx, "POST", "messages", {
                 type: "stream",
                 to: p.stream,
                 topic: p.topic,
@@ -99,7 +93,7 @@ export default function zulip(rl) {
         description: "Get a message by ID",
         inputSchema: { messageId: { type: "string", required: true } },
         async execute(input, ctx) {
-            return apiRequest(getConn(ctx), "GET", `/messages/${input.messageId}`);
+            return apiRequest(ctx, "GET", `messages/${pathSegment(input.messageId)}`);
         },
     });
     rl.registerAction("message.update", {
@@ -112,7 +106,7 @@ export default function zulip(rl) {
         },
         async execute(input, ctx) {
             const { messageId, ...fields } = input;
-            return apiRequest(getConn(ctx), "PATCH", `/messages/${messageId}`, fields);
+            return apiRequest(ctx, "PATCH", `messages/${pathSegment(messageId)}`, fields);
         },
     });
     rl.registerAction("message.delete", {
@@ -120,7 +114,7 @@ export default function zulip(rl) {
         description: "Delete a message",
         inputSchema: { messageId: { type: "string", required: true } },
         async execute(input, ctx) {
-            return apiRequest(getConn(ctx), "DELETE", `/messages/${input.messageId}`);
+            return apiRequest(ctx, "DELETE", `messages/${pathSegment(input.messageId)}`);
         },
     });
     // ── Stream ──────────────────────────────────────────
@@ -138,7 +132,7 @@ export default function zulip(rl) {
                 body.include_public = p.includePublic;
             if (p.includeSubscribed !== undefined)
                 body.include_subscribed = p.includeSubscribed;
-            const data = (await apiRequest(getConn(ctx), "GET", "/streams", body));
+            const data = (await apiRequest(ctx, "GET", "streams", body));
             return data.streams;
         },
     });
@@ -147,7 +141,7 @@ export default function zulip(rl) {
         description: "List subscribed streams",
         inputSchema: {},
         async execute(_input, ctx) {
-            const data = (await apiRequest(getConn(ctx), "GET", "/users/me/subscriptions"));
+            const data = (await apiRequest(ctx, "GET", "users/me/subscriptions"));
             return data.subscriptions;
         },
     });
@@ -168,7 +162,7 @@ export default function zulip(rl) {
             };
             if (p.inviteOnly !== undefined)
                 body.invite_only = p.inviteOnly;
-            return apiRequest(getConn(ctx), "POST", "/users/me/subscriptions", body);
+            return apiRequest(ctx, "POST", "users/me/subscriptions", body);
         },
     });
     rl.registerAction("stream.update", {
@@ -189,7 +183,7 @@ export default function zulip(rl) {
                 body.new_name = JSON.stringify(fields.newName);
             if (fields.isPrivate !== undefined)
                 body.is_private = fields.isPrivate;
-            return apiRequest(getConn(ctx), "PATCH", `/streams/${streamId}`, body);
+            return apiRequest(ctx, "PATCH", `streams/${pathSegment(streamId)}`, body);
         },
     });
     rl.registerAction("stream.delete", {
@@ -197,7 +191,7 @@ export default function zulip(rl) {
         description: "Delete a stream",
         inputSchema: { streamId: { type: "string", required: true } },
         async execute(input, ctx) {
-            return apiRequest(getConn(ctx), "DELETE", `/streams/${input.streamId}`);
+            return apiRequest(ctx, "DELETE", `streams/${pathSegment(input.streamId)}`);
         },
     });
     // ── User ────────────────────────────────────────────
@@ -206,7 +200,7 @@ export default function zulip(rl) {
         description: "Get a user by ID",
         inputSchema: { userId: { type: "string", required: true } },
         async execute(input, ctx) {
-            return apiRequest(getConn(ctx), "GET", `/users/${input.userId}`);
+            return apiRequest(ctx, "GET", `users/${pathSegment(input.userId)}`);
         },
     });
     rl.registerAction("user.list", {
@@ -214,7 +208,7 @@ export default function zulip(rl) {
         description: "List all users",
         inputSchema: {},
         async execute(_input, ctx) {
-            const data = (await apiRequest(getConn(ctx), "GET", "/users"));
+            const data = (await apiRequest(ctx, "GET", "users"));
             return data.members;
         },
     });
@@ -229,7 +223,7 @@ export default function zulip(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            return apiRequest(getConn(ctx), "POST", "/users", {
+            return apiRequest(ctx, "POST", "users", {
                 email: p.email,
                 password: p.password,
                 full_name: p.fullName,
@@ -252,7 +246,7 @@ export default function zulip(rl) {
                 body.full_name = JSON.stringify(fields.fullName);
             if (fields.role !== undefined)
                 body.role = fields.role;
-            return apiRequest(getConn(ctx), "PATCH", `/users/${userId}`, body);
+            return apiRequest(ctx, "PATCH", `users/${pathSegment(userId)}`, body);
         },
     });
     rl.registerAction("user.deactivate", {
@@ -260,7 +254,7 @@ export default function zulip(rl) {
         description: "Deactivate a user",
         inputSchema: { userId: { type: "string", required: true } },
         async execute(input, ctx) {
-            return apiRequest(getConn(ctx), "DELETE", `/users/${input.userId}`);
+            return apiRequest(ctx, "DELETE", `users/${pathSegment(input.userId)}`);
         },
     });
 }

package/dist/sdk.d.ts

@@ -8,6 +8,13 @@ export interface RunlineOptions {
     connections?: ConnectionConfig[];
     /** Host-owned credentials; mutually exclusive with initial connections. */
     connectionProvider?: ConnectionProvider;
+    /**
+     * Host-signed requests, built per action call of a plugin that declares
+     * its credential and handed to the action as `ctx.credentials`. For
+     * hosts that keep credentials outside the process running actions;
+     * absent, plugins sign with their connection.
+     */
+    credentialBroker?: EngineHooks["credentialBroker"];
     timeoutMs?: number;
     memoryLimitBytes?: number;
     /**
@@ -42,6 +49,7 @@ export declare class Runline {
      */
     private _engine;
     private readonly _onAction;
+    private readonly _credentialBroker;
     private constructor();
     private engine;
     /**

package/dist/sdk.js

@@ -19,9 +19,11 @@ export class Runline {
      */
     _engine = null;
     _onAction;
+    _credentialBroker;
     constructor(options) {
         this._registry = new PluginRegistry();
         this._onAction = options.onAction;
+        this._credentialBroker = options.credentialBroker;
         if (options.connectionProvider && options.connections) {
             throw new Error("Pass connections or connectionProvider, not both");
         }
@@ -50,6 +52,7 @@ export class Runline {
             this._engine = new ExecutionEngine(this._registry, this._config, {
                 onAction: this._onAction,
                 connectionProvider: this._connectionProvider,
+                credentialBroker: this._credentialBroker,
             });
         }
         return this._engine;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runline",
-  "version": "0.32.0",
+  "version": "0.34.0",
   "description": "Code mode for agents \u2014 turn any API or command into a callable action",
   "type": "module",
   "main": "dist/index.js",
@@ -95,6 +95,7 @@
     "jiti": "^2.7.0",
     "proper-lockfile": "^4.1.2",
     "rrule": "^2.8.1",
-    "typebox": "^1.1.35"
+    "typebox": "^1.1.35",
+    "zod": "^4.2.1"
   }
 }

package/dist/plugins/_shared/authedFetch.js

@@ -1,33 +0,0 @@
-/**
- * `fetch` for a request that carries a credential.
- *
- * Every plugin outside the credential registry hand-rolls its provider calls,
- * and a bare `fetch` follows redirects by default — which hands the
- * `Authorization` header to whatever host the response names. The registry's
- * own transport (`runline/src/credentials/http.ts`) refuses redirects for
- * exactly this reason; this is the same guarantee for the plugins that do not
- * go through it.
- *
- * Drop-in: same signature and same `Response` as `fetch`, so a call site
- * changes by one identifier and nothing downstream moves.
- *
- *   const res = await authedFetch(url, { headers: { Authorization: key } });
- */
-/**
- * `redirect: "error"` makes fetch reject rather than follow. The
- * `response.redirected` and 3xx checks are belt to that brace: a runtime whose
- * fetch ignores the option, or a hook that replaces it, must not silently
- * reopen the hole.
- */
-export async function authedFetch(input, init = {}) {
-    const response = await fetch(input, { ...init, redirect: "error" });
-    const followed = response.redirected;
-    const offered = response.status >= 300 && response.status < 400;
-    if (followed || offered) {
-        void response.body?.cancel().catch(() => { });
-        throw new Error(followed
-            ? "Refusing a request that followed a redirect while carrying credentials."
-            : `Refusing a redirect on a request carrying credentials (HTTP ${response.status}).`);
-    }
-    return response;
-}

package/dist/plugins/_shared/tokenRefresh.js

@@ -1,41 +0,0 @@
-import { requestOAuth2Token, } from "runline";
-const REFRESH_SKEW_MS = 60_000;
-function usableToken(config) {
-    return typeof config.accessToken === "string" &&
-        config.accessToken &&
-        (config.accessTokenExpiresAt === undefined ||
-            (typeof config.accessTokenExpiresAt === "number" &&
-                Number.isFinite(config.accessTokenExpiresAt) &&
-                Date.now() < config.accessTokenExpiresAt - REFRESH_SKEW_MS))
-        ? config.accessToken
-        : undefined;
-}
-/** Refresh ownership includes the provider request and persistence of rotated tokens. */
-export async function coordinatedAccessToken(ctx, refresh, 
-/** Renew even when the stored token is still usable, to prove it or to rotate it. */
-force = false) {
-    const cached = force ? undefined : usableToken(ctx.connection.config);
-    if (cached)
-        return cached;
-    await ctx.updateConnection(async (current) => {
-        if (!force && usableToken(current))
-            return;
-        return refresh(current);
-    });
-    const token = ctx.connection.config.accessToken;
-    if (typeof token !== "string" || !token)
-        throw new Error("Token refresh committed no access token");
-    return token;
-}
-/** Token errors exclude response bodies, parser diagnostics, and request credentials. */
-export async function requestToken(endpoint, body, application) {
-    const tokens = await requestOAuth2Token(endpoint, body, application);
-    return {
-        accessToken: tokens.accessToken,
-        // Unknown expiry replaces an old expiry; it never inherits a stale timestamp.
-        accessTokenExpiresAt: tokens.expiresAt,
-        ...(tokens.refreshToken === undefined
-            ? {}
-            : { refreshToken: tokens.refreshToken }),
-    };
-}