@sellable/install/lib/sellable-agent/admin-endpoint-runtime.mjs

One-command installer for Sellable MCP in Claude Code, Codex, and Hermes

import { isAbsolute } from "node:path";
import { nativeGatewayRunning } from "./admin-native-gateway-supervisor.mjs";

const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;

export function projectAdminEndpointRuntime({
  activeLaunch,
  activeGateway,
  runtimeGeneration,
  trustRootPem,
  turnDescriptorPath,
}) {
  const claim = activeLaunch?.claim;
  const operation = claim?.operation;
  const authority = claim?.runtimeAuthority;
  const service = claim?.runtimeContract?.service;
  const profileId = activeLaunch?.profile?.profile;
  if (
    !nativeGatewayRunning(activeGateway) ||
    authority?.scope !== "ASSIGNED" ||
    authority.runtimeArtifactId !== authority.assignedRuntimeArtifactId ||
    !SAFE_ID.test(authority.runtimeId ?? "") ||
    !SAFE_ID.test(operation?.workspaceId ?? "") ||
    !SAFE_ID.test(operation?.agentId ?? "") ||
    !SAFE_ID.test(profileId ?? "") ||
    profileId !== operation?.profileId ||
    !Number.isSafeInteger(runtimeGeneration) ||
    runtimeGeneration < 1 ||
    !Number.isSafeInteger(service?.credentialGeneration) ||
    service.credentialGeneration < 1 ||
    typeof trustRootPem !== "string" ||
    !trustRootPem.includes("-----BEGIN PUBLIC KEY-----") ||
    !trustRootPem.includes("-----END PUBLIC KEY-----") ||
    !isAbsolute(turnDescriptorPath ?? "")
  ) {
    return null;
  }
  return Object.freeze({
    desired: Object.freeze({
      workspaceId: operation.workspaceId,
      agentId: operation.agentId,
      runtimeId: authority.runtimeId,
      profileId,
      runtimeGeneration,
      serviceCredentialGeneration: service.credentialGeneration,
    }),
    runtimeConfig: Object.freeze({ turnDescriptorPath }),
    trustRootPem,
    gateway: Object.freeze({
      readback: () => ({ running: nativeGatewayRunning(activeGateway) }),
    }),
  });
}