agentfootprint
Version:
The explainable agent framework — backtrack a wrong answer to the exact context that caused it (evidence, not guesses). Built on footprintjs.
30 lines (29 loc) • 1.39 kB
TypeScript
/**
* verifiedThreads — the {@link ThreadBinder} that binds a thread to a VERIFIED
* caller, so the secure binding is the one-line one.
*
* A request names a thread; naming one proves nothing. This binder checks the
* caller's credential with the door's own identity verification
* (`verifyRequestIdentity` — the bearer token, through your verifier), never a
* header read as a name, and keys the conversation by WHO
* plus WHICH: the same thread id from two people is two conversations. The
* run's `identity` names the verified person, so a stored conversation records
* its owner and a later request from anyone else is refused as not found.
*
* A caller with no credential is REFUSED (401), even at a door that allows
* anonymous requests elsewhere: a thread with no owner would be anybody's who
* guessed its id.
*/
import { type IdentityVerificationOptions } from './identityVerification.js';
import type { ThreadBinder } from './protocolAdapter.js';
/**
* Bind every thread to the caller `identity` verifies.
*
* @example
* ```ts
* import { jwksIdentity } from 'agentfootprint/security';
* const threads = verifiedThreads(jwksIdentity({ jwksUrl, issuer, audience }));
* streamHandler({ agent, adapter: agUi(), threads, sessions: memorySessions() });
* ```
*/
export declare function verifiedThreads(identity: IdentityVerificationOptions): ThreadBinder;