@auth0/ai 1.0.0

package/dist/cjs/interrupts/Auth0Interrupt.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Auth0Interrupt = exports.InterruptName = void 0;
+exports.InterruptName = "AUTH0_AI_INTERRUPT";
+/**
+ * Auth0Interrupt is the base class for all interruptions
+ * in the Auth0 AI sdk.
+ *
+ * It is serializable to a JSON object.
+ */
+class Auth0Interrupt extends Error {
+    constructor(message, code) {
+        super(message);
+        this.name = exports.InterruptName;
+        this.code = code;
+    }
+    /**
+     *
+     * Serialize the interrupt to a JSON object.
+     *
+     * @returns - The JSON object representation of the interrupt.
+     */
+    toJSON() {
+        return {
+            ...Object.fromEntries(Object.entries(this).filter(([key]) => key !== "stack" && key !== "toJSON")),
+            message: this.message,
+        };
+    }
+    /**
+     *
+     * Checks if an interrupt is of a specific type asserting its data component.
+     *
+     * This method assert the data part of the interrupt.
+     *
+     * @param clazz - The class of the interrupt to check.
+     * @param interrupt - The interrupt to check.
+     *
+     * @returns - True if the interrupt is of the specified type.
+     */
+    static isInterrupt(interrupt) {
+        return (interrupt.name === "AUTH0_AI_INTERRUPT" &&
+            (typeof this.code === "undefined" || interrupt.code === this.code));
+    }
+}
+exports.Auth0Interrupt = Auth0Interrupt;
+//# sourceMappingURL=Auth0Interrupt.js.map

package/dist/cjs/interrupts/Auth0Interrupt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth0Interrupt.js","sourceRoot":"","sources":["../../../src/interrupts/Auth0Interrupt.ts"],"names":[],"mappings":";;;AAMa,QAAA,aAAa,GAAG,oBAA6B,CAAC;AAE3D;;;;;GAKG;AACH,MAAa,cAAe,SAAQ,KAAK;IAIvC,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJjB,SAAI,GAAG,qBAAa,CAAC;QAKnB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACH,MAAM;QACJ,OAAO;YACL,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CACzB,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,QAAQ,CAC/C,CACF;YACD,OAAO,EAAE,IAAI,CAAC,OAAO;SACM,CAAC;IAChC,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CAAC,WAAW,CAEhB,SAAc;QAEd,OAAO,CACL,SAAS,CAAC,IAAI,KAAK,oBAAoB;YACvC,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CACnE,CAAC;IACJ,CAAC;CACF;AA9CD,wCA8CC","sourcesContent":["// Define a type alias for the generalized type\nexport type Auth0InterruptData<T extends Auth0Interrupt> = Omit<\n  Omit<T, keyof Error>,\n  \"toJSON\"\n> & { message: string };\n\nexport const InterruptName = \"AUTH0_AI_INTERRUPT\" as const;\n\n/**\n * Auth0Interrupt is the base class for all interruptions\n * in the Auth0 AI sdk.\n *\n * It is serializable to a JSON object.\n */\nexport class Auth0Interrupt extends Error {\n  name = InterruptName;\n  code: string;\n\n  constructor(message: string, code: string) {\n    super(message);\n    this.code = code;\n  }\n\n  /**\n   *\n   * Serialize the interrupt to a JSON object.\n   *\n   * @returns - The JSON object representation of the interrupt.\n   */\n  toJSON(): Auth0InterruptData<this> {\n    return {\n      ...Object.fromEntries(\n        Object.entries(this).filter(\n          ([key]) => key !== \"stack\" && key !== \"toJSON\"\n        )\n      ),\n      message: this.message,\n    } as Auth0InterruptData<this>;\n  }\n\n  /**\n   *\n   * Checks if an interrupt is of a specific type asserting its data component.\n   *\n   * This method assert the data part of the interrupt.\n   *\n   * @param clazz - The class of the interrupt to check.\n   * @param interrupt - The interrupt to check.\n   *\n   * @returns - True if the interrupt is of the specified type.\n   */\n  static isInterrupt<T extends abstract new (...args: any) => any>(\n    this: T & { code?: string },\n    interrupt: any\n  ): interrupt is Auth0InterruptData<InstanceType<T>> {\n    return (\n      interrupt.name === \"AUTH0_AI_INTERRUPT\" &&\n      (typeof this.code === \"undefined\" || interrupt.code === this.code)\n    );\n  }\n}\n"]}

package/dist/cjs/interrupts/CIBAInterrupts.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidGrantInterrupt = exports.AuthorizationPollingInterrupt = exports.AuthorizationPendingInterrupt = exports.AuthorizationRequestExpiredInterrupt = exports.UserDoesNotHavePushNotificationsInterrupt = exports.AccessDeniedInterrupt = exports.CIBAInterrupt = void 0;
+const Auth0Interrupt_1 = require("./Auth0Interrupt");
+/**
+ * Base class for CIBA interrupts.
+ */
+class CIBAInterrupt extends Auth0Interrupt_1.Auth0Interrupt {
+    constructor(message, code) {
+        super(message, code);
+    }
+    static isInterrupt(interrupt) {
+        return (interrupt &&
+            Auth0Interrupt_1.Auth0Interrupt.isInterrupt(interrupt) &&
+            typeof interrupt.code === "string" &&
+            interrupt.code.startsWith("CIBA_"));
+    }
+    static hasRequestData(interrupt) {
+        return CIBAInterrupt.isInterrupt(interrupt) && "request" in interrupt;
+    }
+}
+exports.CIBAInterrupt = CIBAInterrupt;
+/**
+ * An interrupt that is thrown when the user denies the authorization request.
+ */
+class AccessDeniedInterrupt extends CIBAInterrupt {
+    constructor(message, request) {
+        super(message, AccessDeniedInterrupt.code);
+        this.request = request;
+    }
+}
+exports.AccessDeniedInterrupt = AccessDeniedInterrupt;
+AccessDeniedInterrupt.code = "CIBA_ACCESS_DENIED";
+/**
+ * An interrupt that is thrown when the user does not have push notifications enabled.
+ */
+class UserDoesNotHavePushNotificationsInterrupt extends CIBAInterrupt {
+    constructor(message) {
+        super(message, UserDoesNotHavePushNotificationsInterrupt.code);
+    }
+}
+exports.UserDoesNotHavePushNotificationsInterrupt = UserDoesNotHavePushNotificationsInterrupt;
+UserDoesNotHavePushNotificationsInterrupt.code = "CIBA_USER_DOES_NOT_HAVE_PUSH_NOTIFICATIONS";
+/**
+ * An interrupt that is thrown when the authorization request has expired.
+ */
+class AuthorizationRequestExpiredInterrupt extends CIBAInterrupt {
+    constructor(message, request) {
+        super(message, AuthorizationRequestExpiredInterrupt.code);
+        this.request = request;
+    }
+}
+exports.AuthorizationRequestExpiredInterrupt = AuthorizationRequestExpiredInterrupt;
+AuthorizationRequestExpiredInterrupt.code = "CIBA_AUTHORIZATION_REQUEST_EXPIRED";
+/**
+ * An interrupt that is thrown when the authorization is still pending
+ * and the Authorizer is in `mode: interrupt`.
+ */
+class AuthorizationPendingInterrupt extends CIBAInterrupt {
+    constructor(message, request) {
+        super(message, AuthorizationPendingInterrupt.code);
+        this.request = request;
+    }
+}
+exports.AuthorizationPendingInterrupt = AuthorizationPendingInterrupt;
+AuthorizationPendingInterrupt.code = "CIBA_AUTHORIZATION_PENDING";
+/**
+ * An interrupt that is thrown when the authorization polling fails.
+ */
+class AuthorizationPollingInterrupt extends Auth0Interrupt_1.Auth0Interrupt {
+    constructor(message, request) {
+        super(message, AuthorizationPollingInterrupt.code);
+        this.request = request;
+    }
+}
+exports.AuthorizationPollingInterrupt = AuthorizationPollingInterrupt;
+AuthorizationPollingInterrupt.code = "CIBA_AUTHORIZATION_POLLING_ERROR";
+/**
+ * An interrupt that is thrown when the authorization polling fails.
+ */
+class InvalidGrantInterrupt extends Auth0Interrupt_1.Auth0Interrupt {
+    constructor(message, request) {
+        super(message, AuthorizationPollingInterrupt.code);
+        this.request = request;
+    }
+}
+exports.InvalidGrantInterrupt = InvalidGrantInterrupt;
+InvalidGrantInterrupt.code = "CIBA_INVALID_GRANT";
+//# sourceMappingURL=CIBAInterrupts.js.map

package/dist/cjs/interrupts/CIBAInterrupts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CIBAInterrupts.js","sourceRoot":"","sources":["../../../src/interrupts/CIBAInterrupts.ts"],"names":[],"mappings":";;;AACA,qDAAsE;AAMtE;;GAEG;AACH,MAAa,aAAc,SAAQ,+BAAc;IAC/C,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,WAAW,CAEhB,SAAc;QAEd,OAAO,CACL,SAAS;YACT,+BAAc,CAAC,WAAW,CAAC,SAAS,CAAC;YACrC,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;YAClC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CACnC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,SAAc;QAClC,OAAO,aAAa,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,SAAS,CAAC;IACxE,CAAC;CACF;AApBD,sCAoBC;AAED;;GAEG;AACH,MAAa,qBACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAF3B,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AAVH,sDAWC;AAPe,0BAAI,GAAW,oBAA6B,CAAC;AAS7D;;GAEG;AACH,MAAa,yCAA0C,SAAQ,aAAa;IAG1E,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,yCAAyC,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;;AALH,8FAMC;AALe,8CAAI,GAChB,4CAAqD,CAAC;AAM1D;;GAEG;AACH,MAAa,oCACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,oCAAoC,CAAC,IAAI,CAAC,CAAC;QAF1C,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AAVH,oFAWC;AAPe,yCAAI,GAAW,oCAA6C,CAAC;AAS7E;;;GAGG;AACH,MAAa,6BACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AAVH,sEAWC;AAPe,kCAAI,GAAW,4BAAqC,CAAC;AASrE;;GAEG;AACH,MAAa,6BACX,SAAQ,+BAAc;IAItB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AAVH,sEAWC;AAPe,kCAAI,GAAW,kCAA2C,CAAC;AAS3E;;GAEG;AACH,MAAa,qBACX,SAAQ,+BAAc;IAItB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AAVH,sDAWC;AAPe,0BAAI,GAAW,oBAA6B,CAAC","sourcesContent":["import { CIBAAuthorizationRequest } from \"../authorizers/ciba/CIBAAuthorizationRequest\";\nimport { Auth0Interrupt, Auth0InterruptData } from \"./Auth0Interrupt\";\n\nexport interface WithRequestData {\n  request: CIBAAuthorizationRequest;\n}\n\n/**\n * Base class for CIBA interrupts.\n */\nexport class CIBAInterrupt extends Auth0Interrupt {\n  constructor(message: string, code: string) {\n    super(message, code);\n  }\n\n  static isInterrupt<T extends abstract new (...args: any) => any>(\n    this: T,\n    interrupt: any\n  ): interrupt is Auth0InterruptData<InstanceType<T>> {\n    return (\n      interrupt &&\n      Auth0Interrupt.isInterrupt(interrupt) &&\n      typeof interrupt.code === \"string\" &&\n      interrupt.code.startsWith(\"CIBA_\")\n    );\n  }\n\n  static hasRequestData(interrupt: any): interrupt is WithRequestData {\n    return CIBAInterrupt.isInterrupt(interrupt) && \"request\" in interrupt;\n  }\n}\n\n/**\n * An interrupt that is thrown when the user denies the authorization request.\n */\nexport class AccessDeniedInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_ACCESS_DENIED\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AccessDeniedInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the user does not have push notifications enabled.\n */\nexport class UserDoesNotHavePushNotificationsInterrupt extends CIBAInterrupt {\n  public static code: string =\n    \"CIBA_USER_DOES_NOT_HAVE_PUSH_NOTIFICATIONS\" as const;\n  constructor(message: string) {\n    super(message, UserDoesNotHavePushNotificationsInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization request has expired.\n */\nexport class AuthorizationRequestExpiredInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_REQUEST_EXPIRED\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationRequestExpiredInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization is still pending\n * and the Authorizer is in `mode: interrupt`.\n */\nexport class AuthorizationPendingInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_PENDING\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPendingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class AuthorizationPollingInterrupt\n  extends Auth0Interrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_POLLING_ERROR\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class InvalidGrantInterrupt\n  extends Auth0Interrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_INVALID_GRANT\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n"]}

package/dist/cjs/interrupts/FederatedConnectionInterrupt.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FederatedConnectionError = exports.FederatedConnectionInterrupt = void 0;
+const Auth0Interrupt_1 = require("./Auth0Interrupt");
+/**
+ * Error thrown when a tool call requires an access token for an external service.
+ *
+ * Throw this error if the service returns Unauthorized for the current access token.
+ */
+class FederatedConnectionInterrupt extends Auth0Interrupt_1.Auth0Interrupt {
+    constructor(message, connection, scopes, requiredScopes) {
+        super(message, FederatedConnectionInterrupt.code);
+        this.connection = connection;
+        this.scopes = scopes;
+        this.requiredScopes = requiredScopes;
+    }
+}
+exports.FederatedConnectionInterrupt = FederatedConnectionInterrupt;
+FederatedConnectionInterrupt.code = "FEDERATED_CONNECTION_ERROR";
+/**
+ * Error thrown when a tool call requires an access token for an external service.
+ *
+ * The authorizer will automatically convert this class of error to FederatedConnectionInterrupt.
+ */
+class FederatedConnectionError extends Error {
+    constructor(message) {
+        super(message);
+    }
+}
+exports.FederatedConnectionError = FederatedConnectionError;
+//# sourceMappingURL=FederatedConnectionInterrupt.js.map

package/dist/cjs/interrupts/FederatedConnectionInterrupt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FederatedConnectionInterrupt.js","sourceRoot":"","sources":["../../../src/interrupts/FederatedConnectionInterrupt.ts"],"names":[],"mappings":";;;AAAA,qDAAkD;AAElD;;;;GAIG;AACH,MAAa,4BAA6B,SAAQ,+BAAc;IAoB9D,YACE,OAAe,EACf,UAAkB,EAClB,MAAgB,EAChB,cAAwB;QAExB,KAAK,CAAC,OAAO,EAAE,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;;AA9BH,oEA+BC;AAbe,iCAAI,GAAG,4BAAqC,CAAC;AAe7D;;;;GAIG;AACH,MAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAJD,4DAIC","sourcesContent":["import { Auth0Interrupt } from \"./Auth0Interrupt\";\n\n/**\n * Error thrown when a tool call requires an access token for an external service.\n *\n * Throw this error if the service returns Unauthorized for the current access token.\n */\nexport class FederatedConnectionInterrupt extends Auth0Interrupt {\n  /**\n   * The auth0 connection name.\n   */\n  public readonly connection: string;\n\n  /**\n   * The scopes required to access the external service as stated\n   * in the authorizer.\n   */\n  public readonly scopes: string[];\n\n  /**\n   * The union between the current scopes of the Access Token plus the required scopes.\n   * This is the list of scopes that will be used to request a new Access Token.\n   */\n  public readonly requiredScopes: string[];\n\n  public static code = \"FEDERATED_CONNECTION_ERROR\" as const;\n\n  constructor(\n    message: string,\n    connection: string,\n    scopes: string[],\n    requiredScopes: string[]\n  ) {\n    super(message, FederatedConnectionInterrupt.code);\n    this.connection = connection;\n    this.scopes = scopes;\n    this.requiredScopes = requiredScopes;\n  }\n}\n\n/**\n * Error thrown when a tool call requires an access token for an external service.\n *\n * The authorizer will automatically convert this class of error to FederatedConnectionInterrupt.\n */\nexport class FederatedConnectionError extends Error {\n  constructor(message: string) {\n    super(message);\n  }\n}\n"]}

package/dist/cjs/interrupts/index.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidGrantInterrupt = exports.AuthorizationPollingInterrupt = exports.AuthorizationPendingInterrupt = exports.AuthorizationRequestExpiredInterrupt = exports.UserDoesNotHavePushNotificationsInterrupt = exports.AccessDeniedInterrupt = exports.CIBAInterrupt = exports.FederatedConnectionError = exports.FederatedConnectionInterrupt = exports.Auth0Interrupt = void 0;
+var Auth0Interrupt_1 = require("./Auth0Interrupt");
+Object.defineProperty(exports, "Auth0Interrupt", { enumerable: true, get: function () { return Auth0Interrupt_1.Auth0Interrupt; } });
+var FederatedConnectionInterrupt_1 = require("./FederatedConnectionInterrupt");
+Object.defineProperty(exports, "FederatedConnectionInterrupt", { enumerable: true, get: function () { return FederatedConnectionInterrupt_1.FederatedConnectionInterrupt; } });
+Object.defineProperty(exports, "FederatedConnectionError", { enumerable: true, get: function () { return FederatedConnectionInterrupt_1.FederatedConnectionError; } });
+var CIBAInterrupts_1 = require("./CIBAInterrupts");
+Object.defineProperty(exports, "CIBAInterrupt", { enumerable: true, get: function () { return CIBAInterrupts_1.CIBAInterrupt; } });
+Object.defineProperty(exports, "AccessDeniedInterrupt", { enumerable: true, get: function () { return CIBAInterrupts_1.AccessDeniedInterrupt; } });
+Object.defineProperty(exports, "UserDoesNotHavePushNotificationsInterrupt", { enumerable: true, get: function () { return CIBAInterrupts_1.UserDoesNotHavePushNotificationsInterrupt; } });
+Object.defineProperty(exports, "AuthorizationRequestExpiredInterrupt", { enumerable: true, get: function () { return CIBAInterrupts_1.AuthorizationRequestExpiredInterrupt; } });
+Object.defineProperty(exports, "AuthorizationPendingInterrupt", { enumerable: true, get: function () { return CIBAInterrupts_1.AuthorizationPendingInterrupt; } });
+Object.defineProperty(exports, "AuthorizationPollingInterrupt", { enumerable: true, get: function () { return CIBAInterrupts_1.AuthorizationPollingInterrupt; } });
+Object.defineProperty(exports, "InvalidGrantInterrupt", { enumerable: true, get: function () { return CIBAInterrupts_1.InvalidGrantInterrupt; } });
+//# sourceMappingURL=index.js.map

package/dist/cjs/interrupts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/interrupts/index.ts"],"names":[],"mappings":";;;AAAA,mDAAkD;AAAzC,gHAAA,cAAc,OAAA;AAEvB,+EAGwC;AAFtC,4IAAA,4BAA4B,OAAA;AAC5B,wIAAA,wBAAwB,OAAA;AAG1B,mDAQ0B;AAPxB,+GAAA,aAAa,OAAA;AACb,uHAAA,qBAAqB,OAAA;AACrB,2IAAA,yCAAyC,OAAA;AACzC,sIAAA,oCAAoC,OAAA;AACpC,+HAAA,6BAA6B,OAAA;AAC7B,+HAAA,6BAA6B,OAAA;AAC7B,uHAAA,qBAAqB,OAAA","sourcesContent":["export { Auth0Interrupt } from \"./Auth0Interrupt\";\n\nexport {\n  FederatedConnectionInterrupt,\n  FederatedConnectionError,\n} from \"./FederatedConnectionInterrupt\";\n\nexport {\n  CIBAInterrupt,\n  AccessDeniedInterrupt,\n  UserDoesNotHavePushNotificationsInterrupt,\n  AuthorizationRequestExpiredInterrupt,\n  AuthorizationPendingInterrupt,\n  AuthorizationPollingInterrupt,\n  InvalidGrantInterrupt,\n} from \"./CIBAInterrupts\";\n"]}

package/dist/cjs/parameters.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveParameter = void 0;
+/* eslint-disable @typescript-eslint/no-unsafe-function-type */
+const isCallback = (maybeFunction) => typeof maybeFunction === "function";
+const resolveParameter = (resolver, context) => {
+    if (isCallback(resolver)) {
+        return resolver(...context);
+    }
+    return resolver;
+};
+exports.resolveParameter = resolveParameter;
+//# sourceMappingURL=parameters.js.map

package/dist/cjs/parameters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parameters.js","sourceRoot":"","sources":["../../src/parameters.ts"],"names":[],"mappings":";;;AAAA,+DAA+D;AAC/D,MAAM,UAAU,GAAG,CACjB,aAA+C,EACpB,EAAE,CAAC,OAAO,aAAa,KAAK,UAAU,CAAC;AAO7D,MAAM,gBAAgB,GAAG,CAI9B,QAA2D,EAC3D,OAAwB,EACI,EAAE;IAC9B,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,QAAQ,CAAC,GAAG,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAXW,QAAA,gBAAgB,oBAW3B","sourcesContent":["/* eslint-disable @typescript-eslint/no-unsafe-function-type */\nconst isCallback = (\n  maybeFunction: any | ((...args: any[]) => void)\n): maybeFunction is Function => typeof maybeFunction === \"function\";\n\nexport type AuthorizerToolParameter<\n  ToolExecuteArgs extends any[],\n  TResult = string\n> = TResult | ((...args: ToolExecuteArgs) => Promise<TResult> | TResult);\n\nexport const resolveParameter = <\n  ToolExecuteArgs extends any[],\n  TResult = string\n>(\n  resolver: AuthorizerToolParameter<ToolExecuteArgs, TResult>,\n  context: ToolExecuteArgs\n): TResult | Promise<TResult> => {\n  if (isCallback(resolver)) {\n    return resolver(...context);\n  }\n  return resolver;\n};\n"]}

package/dist/esm/TokenResponse.d.ts

@@ -0,0 +1,15 @@
+export type TokenResponse = {
+    /** Bearer token for API authorization */
+    access_token: string;
+    /** Refresh token (requires `offline_access` scope) */
+    refresh_token?: string;
+    /** JWT containing user identity claims */
+    id_token: string;
+    /** Typically "Bearer" */
+    token_type?: string;
+    /** Token validity in seconds (default: 86400) */
+    expires_in: number;
+    /** Granted permissions space */
+    scope: string;
+};
+//# sourceMappingURL=TokenResponse.d.ts.map

package/dist/esm/TokenResponse.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=TokenResponse.js.map

package/dist/esm/TokenResponse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenResponse.js","sourceRoot":"","sources":["../../src/TokenResponse.ts"],"names":[],"mappings":"","sourcesContent":["export type TokenResponse = {\n  /** Bearer token for API authorization */\n  access_token: string;\n  /** Refresh token (requires `offline_access` scope) */\n  refresh_token?: string;\n  /** JWT containing user identity claims */\n  id_token: string;\n  /** Typically \"Bearer\" */\n  token_type?: string;\n  /** Token validity in seconds (default: 86400) */\n  expires_in: number;\n  /** Granted permissions space */\n  scope: string;\n};\n"]}

package/dist/esm/authorizers/ciba/CIBAAuthorizationRequest.d.ts

@@ -0,0 +1,20 @@
+export type CIBAAuthorizationRequest = {
+    /**
+     * The authorization request ID.
+     * Use this ID to check the status of the authorization request.
+     */
+    id: string;
+    /**
+     * The time the authorization request was made.
+     */
+    requestedAt: number;
+    /**
+     * The time in seconds for the authorization request to expire.
+     */
+    expiresIn: number;
+    /**
+     * The interval to use when polling the status.
+     */
+    interval: number;
+};
+//# sourceMappingURL=CIBAAuthorizationRequest.d.ts.map

package/dist/esm/authorizers/ciba/CIBAAuthorizationRequest.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=CIBAAuthorizationRequest.js.map

package/dist/esm/authorizers/ciba/CIBAAuthorizationRequest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CIBAAuthorizationRequest.js","sourceRoot":"","sources":["../../../../src/authorizers/ciba/CIBAAuthorizationRequest.ts"],"names":[],"mappings":"","sourcesContent":["export type CIBAAuthorizationRequest = {\n  /**\n   * The authorization request ID.\n   * Use this ID to check the status of the authorization request.\n   */\n  id: string;\n\n  /**\n   * The time the authorization request was made.\n   */\n  requestedAt: number;\n\n  /**\n   * The time in seconds for the authorization request to expire.\n   */\n  expiresIn: number;\n\n  /**\n   * The interval to use when polling the status.\n   */\n  interval: number;\n};\n"]}

package/dist/esm/authorizers/ciba/CIBAAuthorizerBase.d.ts

@@ -0,0 +1,31 @@
+import { AuthenticationClient } from "auth0";
+import { AuthorizerParams } from "../";
+import { Credentials } from "../../credentials";
+import { AuthorizationPendingInterrupt, AuthorizationPollingInterrupt } from "../../interrupts";
+import { CIBAAuthorizationRequest } from "./CIBAAuthorizationRequest";
+import { CIBAAuthorizerParams } from "./CIBAAuthorizerParams";
+/**
+ * Requests authorization by prompting the user via an out-of-band channel from
+ * the backend.
+ */
+export declare class CIBAAuthorizerBase<ToolExecuteArgs extends any[]> {
+    private readonly params;
+    auth0: AuthenticationClient;
+    constructor(auth0: AuthorizerParams, params: CIBAAuthorizerParams<ToolExecuteArgs>);
+    private start;
+    private getCredentialsInternal;
+    protected getCredentials(authRequest: CIBAAuthorizationRequest): Promise<Credentials | undefined>;
+    protected getCredentialsPolling(authRequest: CIBAAuthorizationRequest): Promise<Credentials | undefined>;
+    protected deleteAuthRequest(): Promise<void> | undefined;
+    /**
+     *
+     * Wraps the execute method of a AI tool to handle CIBA authorization.
+     *
+     * @param getContext - A function that returns the context of the tool execution.
+     * @param execute - The tool execute method.
+     * @returns The wrapped execute method.
+     */
+    protect(getContext: (...args: ToolExecuteArgs) => any, execute: (...args: ToolExecuteArgs) => any): (...args: ToolExecuteArgs) => any;
+    protected handleAuthorizationInterrupts(err: AuthorizationPendingInterrupt | AuthorizationPollingInterrupt): void;
+}
+//# sourceMappingURL=CIBAAuthorizerBase.d.ts.map

package/dist/esm/authorizers/ciba/CIBAAuthorizerBase.js

@@ -0,0 +1,197 @@
+import { AuthenticationClient } from "auth0";
+import { AccessDeniedInterrupt, AuthorizationPendingInterrupt, AuthorizationPollingInterrupt, AuthorizationRequestExpiredInterrupt, InvalidGrantInterrupt, UserDoesNotHavePushNotificationsInterrupt, } from "../../interrupts";
+import { resolveParameter } from "../../parameters";
+import { asyncLocalStorage } from "./asyncLocalStorage";
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function ensureOpenIdScope(scopes) {
+    return scopes.includes("openid") ? scopes : ["openid", ...scopes];
+}
+/**
+ * Requests authorization by prompting the user via an out-of-band channel from
+ * the backend.
+ */
+export class CIBAAuthorizerBase {
+    constructor(auth0, params) {
+        this.params = params;
+        this.auth0 = new AuthenticationClient({
+            domain: (auth0 === null || auth0 === void 0 ? void 0 : auth0.domain) || process.env.AUTH0_DOMAIN,
+            clientId: (auth0 === null || auth0 === void 0 ? void 0 : auth0.clientId) || process.env.AUTH0_CLIENT_ID,
+            clientSecret: (auth0 === null || auth0 === void 0 ? void 0 : auth0.clientSecret) || process.env.AUTH0_CLIENT_SECRET,
+            clientAssertionSigningAlg: auth0 === null || auth0 === void 0 ? void 0 : auth0.clientAssertionSigningAlg,
+            clientAssertionSigningKey: auth0 === null || auth0 === void 0 ? void 0 : auth0.clientAssertionSigningKey,
+            idTokenSigningAlg: auth0 === null || auth0 === void 0 ? void 0 : auth0.idTokenSigningAlg,
+            clockTolerance: auth0 === null || auth0 === void 0 ? void 0 : auth0.clockTolerance,
+            useMTLS: auth0 === null || auth0 === void 0 ? void 0 : auth0.useMTLS,
+        });
+    }
+    async start(toolContext) {
+        var _a;
+        const requestedAt = Date.now() / 1000;
+        const authorizeParams = {
+            scope: ensureOpenIdScope(this.params.scopes).join(" "),
+            binding_message: "",
+            userId: "",
+            audience: this.params.audience || "",
+            request_expiry: (_a = this.params.requestExpiry) === null || _a === void 0 ? void 0 : _a.toString(),
+        };
+        authorizeParams.binding_message = await resolveParameter(this.params.bindingMessage, toolContext);
+        authorizeParams.userId = await resolveParameter(this.params.userID, toolContext);
+        try {
+            const response = await this.auth0.backchannel.authorize(authorizeParams);
+            return {
+                id: response.auth_req_id,
+                requestedAt: requestedAt,
+                expiresIn: response.expires_in,
+                interval: response.interval,
+            };
+        }
+        catch (err) {
+            if (err.error == "invalid_request") {
+                throw new UserDoesNotHavePushNotificationsInterrupt(err.error_description);
+            }
+            throw err;
+        }
+    }
+    async getCredentialsInternal(authRequest) {
+        try {
+            const elapsedSeconds = Date.now() / 1000 - authRequest.requestedAt;
+            if (elapsedSeconds >= authRequest.expiresIn) {
+                throw new AuthorizationRequestExpiredInterrupt("The authorization request has expired.", authRequest);
+            }
+            const response = await this.auth0.backchannel.backchannelGrant({
+                auth_req_id: authRequest.id,
+            });
+            const credentials = {
+                accessToken: {
+                    type: response.token_type || "bearer",
+                    value: response.access_token,
+                },
+                refreshToken: response.refresh_token
+                    ? {
+                        type: response.token_type || "bearer",
+                        value: response.refresh_token,
+                    }
+                    : undefined,
+                idToken: response.id_token
+                    ? {
+                        type: response.token_type || "bearer",
+                        value: response.id_token,
+                    }
+                    : undefined,
+            };
+            return credentials;
+        }
+        catch (e) {
+            if (e.error === "authorization_pending") {
+                throw new AuthorizationPendingInterrupt(e.error_description, authRequest);
+            }
+            if (e.error === "slow_down") {
+                throw new AuthorizationPollingInterrupt(e.error_description, authRequest);
+            }
+            if (e.error == "invalid_grant") {
+                throw new InvalidGrantInterrupt(e.error_description, authRequest);
+            }
+            if (e.error == "invalid_request") {
+                throw new UserDoesNotHavePushNotificationsInterrupt(e.error_description);
+            }
+            if (e.error == "access_denied") {
+                throw new AccessDeniedInterrupt(e.error_description, authRequest);
+            }
+            throw e;
+        }
+    }
+    async getCredentials(authRequest) {
+        return this.getCredentialsInternal(authRequest);
+    }
+    async getCredentialsPolling(authRequest) {
+        let credentials = undefined;
+        do {
+            try {
+                credentials = await this.getCredentialsInternal(authRequest);
+            }
+            catch (err) {
+                if (err instanceof AuthorizationPendingInterrupt ||
+                    err instanceof AuthorizationPollingInterrupt) {
+                    await sleep(err.request.interval * 1000);
+                }
+                else {
+                    throw err;
+                }
+            }
+        } while (!credentials);
+        return credentials;
+    }
+    deleteAuthRequest() {
+        const store = asyncLocalStorage.getStore();
+        if (!store) {
+            throw new Error("This method should be called from within a tool.");
+        }
+        if (!this.params.onAuthorizationRequest ||
+            this.params.onAuthorizationRequest === "interrupt") {
+            return this.params.storeAuthorizationResponse(undefined, ...store.args);
+        }
+    }
+    /**
+     *
+     * Wraps the execute method of a AI tool to handle CIBA authorization.
+     *
+     * @param getContext - A function that returns the context of the tool execution.
+     * @param execute - The tool execute method.
+     * @returns The wrapped execute method.
+     */
+    protect(getContext, execute) {
+        return async (...args) => {
+            let authRequest;
+            if (asyncLocalStorage.getStore()) {
+                throw new Error("Cannot nest tool calls that require CIBA authorization.");
+            }
+            const storeValue = {
+                args,
+                context: getContext(...args),
+            };
+            return asyncLocalStorage.run(storeValue, async () => {
+                let credentials;
+                const interruptMode = typeof this.params.onAuthorizationRequest === "undefined" ||
+                    this.params.onAuthorizationRequest === "interrupt";
+                try {
+                    if (interruptMode) {
+                        authRequest = await resolveParameter(this.params.getAuthorizationResponse, args);
+                        if (!authRequest) {
+                            //Initial request
+                            authRequest = await this.start(args);
+                            await this.params.storeAuthorizationResponse(authRequest, ...args);
+                        }
+                        credentials = await this.getCredentials(authRequest);
+                    }
+                    else {
+                        authRequest = await this.start(args);
+                        credentials = await this.getCredentialsPolling(authRequest);
+                    }
+                }
+                catch (err) {
+                    const shouldInterrupt = err instanceof AuthorizationPendingInterrupt ||
+                        err instanceof AuthorizationPollingInterrupt;
+                    if (shouldInterrupt) {
+                        return this.handleAuthorizationInterrupts(err);
+                    }
+                    else {
+                        await this.deleteAuthRequest();
+                        if (typeof this.params.onUnauthorized === "function") {
+                            return this.params.onUnauthorized(err, ...args);
+                        }
+                        else {
+                            return err;
+                        }
+                    }
+                }
+                await this.deleteAuthRequest();
+                storeValue.credentials = credentials;
+                return execute(...args);
+            });
+        };
+    }
+    handleAuthorizationInterrupts(err) {
+        throw err;
+    }
+}
+//# sourceMappingURL=CIBAAuthorizerBase.js.map

package/dist/esm/authorizers/ciba/CIBAAuthorizerBase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CIBAAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/ciba/CIBAAuthorizerBase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAI7C,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,6BAA6B,EAC7B,oCAAoC,EACpC,qBAAqB,EACrB,yCAAyC,GAC1C,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAqB,MAAM,qBAAqB,CAAC;AAI3E,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAChF,SAAS,iBAAiB,CAAC,MAAgB;IACzC,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;AACpE,CAAC;AACD;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IAG7B,YACE,KAAuB,EACN,MAA6C;QAA7C,WAAM,GAAN,MAAM,CAAuC;QAE9D,IAAI,CAAC,KAAK,GAAG,IAAI,oBAAoB,CAAC;YACpC,MAAM,EAAE,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,MAAM,KAAI,OAAO,CAAC,GAAG,CAAC,YAAa;YAClD,QAAQ,EAAE,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,QAAQ,KAAI,OAAO,CAAC,GAAG,CAAC,eAAgB;YACzD,YAAY,EAAE,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,YAAY,KAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB;YACpE,yBAAyB,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,yBAAyB;YAC3D,yBAAyB,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,yBAAyB;YAC3D,iBAAiB,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,iBAAiB;YAC3C,cAAc,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,cAAc;YACrC,OAAO,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO;SACxB,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,KAAK,CACjB,WAA4B;;QAE5B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACtC,MAAM,eAAe,GAAG;YACtB,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACtD,eAAe,EAAE,EAAE;YACnB,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE;YACpC,cAAc,EAAE,MAAA,IAAI,CAAC,MAAM,CAAC,aAAa,0CAAE,QAAQ,EAAE;SACtD,CAAC;QAEF,eAAe,CAAC,eAAe,GAAG,MAAM,gBAAgB,CACtD,IAAI,CAAC,MAAM,CAAC,cAAc,EAC1B,WAAW,CACZ,CAAC;QAEF,eAAe,CAAC,MAAM,GAAG,MAAM,gBAAgB,CAC7C,IAAI,CAAC,MAAM,CAAC,MAAM,EAClB,WAAW,CACZ,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YAEzE,OAAO;gBACL,EAAE,EAAE,QAAQ,CAAC,WAAW;gBACxB,WAAW,EAAE,WAAW;gBACxB,SAAS,EAAE,QAAQ,CAAC,UAAU;gBAC9B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACnC,MAAM,IAAI,yCAAyC,CACjD,GAAG,CAAC,iBAAiB,CACtB,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,WAAqC;QAErC,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC;YAEnE,IAAI,cAAc,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC5C,MAAM,IAAI,oCAAoC,CAC5C,wCAAwC,EACxC,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,gBAAgB,CAAC;gBAC7D,WAAW,EAAE,WAAW,CAAC,EAAE;aAC5B,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG;gBAClB,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ,CAAC,UAAU,IAAI,QAAQ;oBACrC,KAAK,EAAE,QAAQ,CAAC,YAAY;iBAC7B;gBACD,YAAY,EAAE,QAAQ,CAAC,aAAa;oBAClC,CAAC,CAAC;wBACE,IAAI,EAAE,QAAQ,CAAC,UAAU,IAAI,QAAQ;wBACrC,KAAK,EAAE,QAAQ,CAAC,aAAa;qBAC9B;oBACH,CAAC,CAAC,SAAS;gBACb,OAAO,EAAE,QAAQ,CAAC,QAAQ;oBACxB,CAAC,CAAC;wBACE,IAAI,EAAE,QAAQ,CAAC,UAAU,IAAI,QAAQ;wBACrC,KAAK,EAAE,QAAQ,CAAC,QAAQ;qBACzB;oBACH,CAAC,CAAC,SAAS;aACd,CAAC;YAEF,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;gBACxC,MAAM,IAAI,6BAA6B,CACrC,CAAC,CAAC,iBAAiB,EACnB,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC5B,MAAM,IAAI,6BAA6B,CACrC,CAAC,CAAC,iBAAiB,EACnB,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC/B,MAAM,IAAI,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;YACpE,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACjC,MAAM,IAAI,yCAAyC,CACjD,CAAC,CAAC,iBAAiB,CACpB,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC/B,MAAM,IAAI,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAES,KAAK,CAAC,cAAc,CAAC,WAAqC;QAClE,OAAO,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAES,KAAK,CAAC,qBAAqB,CACnC,WAAqC;QAErC,IAAI,WAAW,GAA4B,SAAS,CAAC;QAErD,GAAG,CAAC;YACF,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IACE,GAAG,YAAY,6BAA6B;oBAC5C,GAAG,YAAY,6BAA6B,EAC5C,CAAC;oBACD,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;gBAC3C,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC,QAAQ,CAAC,WAAW,EAAE;QAEvB,OAAO,WAAW,CAAC;IACrB,CAAC;IAES,iBAAiB;QACzB,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IACE,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB;YACnC,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW,EAClD,CAAC;YACD,OAAO,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAC3C,SAAS,EACT,GAAI,KAAK,CAAC,IAAwB,CACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA6C,EAC7C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,IAAI,WAAiD,CAAC;YACtD,IAAI,iBAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAA2B;gBACzC,IAAI;gBACJ,OAAO,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC;aAC7B,CAAC;YAEF,OAAO,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;gBAClD,IAAI,WAAoC,CAAC;gBAEzC,MAAM,aAAa,GACjB,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW;oBACzD,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW,CAAC;gBAErD,IAAI,CAAC;oBACH,IAAI,aAAa,EAAE,CAAC;wBAClB,WAAW,GAAG,MAAM,gBAAgB,CAClC,IAAI,CAAC,MAAM,CAAC,wBAAwB,EACpC,IAAI,CACL,CAAC;wBACF,IAAI,CAAC,WAAW,EAAE,CAAC;4BACjB,iBAAiB;4BACjB,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;4BACrC,MAAM,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAC1C,WAAW,EACX,GAAG,IAAI,CACR,CAAC;wBACJ,CAAC;wBACD,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;oBACvD,CAAC;yBAAM,CAAC;wBACN,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrC,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;oBAC9D,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,eAAe,GACnB,GAAG,YAAY,6BAA6B;wBAC5C,GAAG,YAAY,6BAA6B,CAAC;oBAC/C,IAAI,eAAe,EAAE,CAAC;wBACpB,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;yBAAM,CAAC;wBACN,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBAC/B,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;4BACrD,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAY,EAAE,GAAG,IAAI,CAAC,CAAC;wBAC3D,CAAC;6BAAM,CAAC;4BACN,OAAO,GAAG,CAAC;wBACb,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC/B,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;gBACrC,OAAO,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;IAES,6BAA6B,CACrC,GAAkE;QAElE,MAAM,GAAG,CAAC;IACZ,CAAC;CACF","sourcesContent":["import { AuthenticationClient } from \"auth0\";\n\nimport { AuthorizerParams } from \"../\";\nimport { Credentials } from \"../../credentials\";\nimport {\n  AccessDeniedInterrupt,\n  AuthorizationPendingInterrupt,\n  AuthorizationPollingInterrupt,\n  AuthorizationRequestExpiredInterrupt,\n  InvalidGrantInterrupt,\n  UserDoesNotHavePushNotificationsInterrupt,\n} from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport { CIBAAuthorizationRequest } from \"./CIBAAuthorizationRequest\";\nimport { CIBAAuthorizerParams } from \"./CIBAAuthorizerParams\";\n\nconst sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));\nfunction ensureOpenIdScope(scopes: string[]): string[] {\n  return scopes.includes(\"openid\") ? scopes : [\"openid\", ...scopes];\n}\n/**\n * Requests authorization by prompting the user via an out-of-band channel from\n * the backend.\n */\nexport class CIBAAuthorizerBase<ToolExecuteArgs extends any[]> {\n  auth0: AuthenticationClient;\n\n  constructor(\n    auth0: AuthorizerParams,\n    private readonly params: CIBAAuthorizerParams<ToolExecuteArgs>\n  ) {\n    this.auth0 = new AuthenticationClient({\n      domain: auth0?.domain || process.env.AUTH0_DOMAIN!,\n      clientId: auth0?.clientId || process.env.AUTH0_CLIENT_ID!,\n      clientSecret: auth0?.clientSecret || process.env.AUTH0_CLIENT_SECRET,\n      clientAssertionSigningAlg: auth0?.clientAssertionSigningAlg,\n      clientAssertionSigningKey: auth0?.clientAssertionSigningKey,\n      idTokenSigningAlg: auth0?.idTokenSigningAlg,\n      clockTolerance: auth0?.clockTolerance,\n      useMTLS: auth0?.useMTLS,\n    });\n  }\n\n  private async start(\n    toolContext: ToolExecuteArgs\n  ): Promise<CIBAAuthorizationRequest> {\n    const requestedAt = Date.now() / 1000;\n    const authorizeParams = {\n      scope: ensureOpenIdScope(this.params.scopes).join(\" \"),\n      binding_message: \"\",\n      userId: \"\",\n      audience: this.params.audience || \"\",\n      request_expiry: this.params.requestExpiry?.toString(),\n    };\n\n    authorizeParams.binding_message = await resolveParameter(\n      this.params.bindingMessage,\n      toolContext\n    );\n\n    authorizeParams.userId = await resolveParameter(\n      this.params.userID,\n      toolContext\n    );\n\n    try {\n      const response = await this.auth0.backchannel.authorize(authorizeParams);\n\n      return {\n        id: response.auth_req_id,\n        requestedAt: requestedAt,\n        expiresIn: response.expires_in,\n        interval: response.interval,\n      };\n    } catch (err: any) {\n      if (err.error == \"invalid_request\") {\n        throw new UserDoesNotHavePushNotificationsInterrupt(\n          err.error_description\n        );\n      }\n      throw err;\n    }\n  }\n\n  private async getCredentialsInternal(\n    authRequest: CIBAAuthorizationRequest\n  ): Promise<Credentials | undefined> {\n    try {\n      const elapsedSeconds = Date.now() / 1000 - authRequest.requestedAt;\n\n      if (elapsedSeconds >= authRequest.expiresIn) {\n        throw new AuthorizationRequestExpiredInterrupt(\n          \"The authorization request has expired.\",\n          authRequest\n        );\n      }\n\n      const response = await this.auth0.backchannel.backchannelGrant({\n        auth_req_id: authRequest.id,\n      });\n\n      const credentials = {\n        accessToken: {\n          type: response.token_type || \"bearer\",\n          value: response.access_token,\n        },\n        refreshToken: response.refresh_token\n          ? {\n              type: response.token_type || \"bearer\",\n              value: response.refresh_token,\n            }\n          : undefined,\n        idToken: response.id_token\n          ? {\n              type: response.token_type || \"bearer\",\n              value: response.id_token,\n            }\n          : undefined,\n      };\n\n      return credentials;\n    } catch (e: any) {\n      if (e.error === \"authorization_pending\") {\n        throw new AuthorizationPendingInterrupt(\n          e.error_description,\n          authRequest\n        );\n      }\n\n      if (e.error === \"slow_down\") {\n        throw new AuthorizationPollingInterrupt(\n          e.error_description,\n          authRequest\n        );\n      }\n\n      if (e.error == \"invalid_grant\") {\n        throw new InvalidGrantInterrupt(e.error_description, authRequest);\n      }\n\n      if (e.error == \"invalid_request\") {\n        throw new UserDoesNotHavePushNotificationsInterrupt(\n          e.error_description\n        );\n      }\n\n      if (e.error == \"access_denied\") {\n        throw new AccessDeniedInterrupt(e.error_description, authRequest);\n      }\n\n      throw e;\n    }\n  }\n\n  protected async getCredentials(authRequest: CIBAAuthorizationRequest) {\n    return this.getCredentialsInternal(authRequest);\n  }\n\n  protected async getCredentialsPolling(\n    authRequest: CIBAAuthorizationRequest\n  ): Promise<Credentials | undefined> {\n    let credentials: Credentials | undefined = undefined;\n\n    do {\n      try {\n        credentials = await this.getCredentialsInternal(authRequest);\n      } catch (err) {\n        if (\n          err instanceof AuthorizationPendingInterrupt ||\n          err instanceof AuthorizationPollingInterrupt\n        ) {\n          await sleep(err.request.interval * 1000);\n        } else {\n          throw err;\n        }\n      }\n    } while (!credentials);\n\n    return credentials;\n  }\n\n  protected deleteAuthRequest() {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\"This method should be called from within a tool.\");\n    }\n    if (\n      !this.params.onAuthorizationRequest ||\n      this.params.onAuthorizationRequest === \"interrupt\"\n    ) {\n      return this.params.storeAuthorizationResponse(\n        undefined,\n        ...(store.args as ToolExecuteArgs)\n      );\n    }\n  }\n\n  /**\n   *\n   * Wraps the execute method of a AI tool to handle CIBA authorization.\n   *\n   * @param getContext - A function that returns the context of the tool execution.\n   * @param execute - The tool execute method.\n   * @returns The wrapped execute method.\n   */\n  protect(\n    getContext: (...args: ToolExecuteArgs) => any,\n    execute: (...args: ToolExecuteArgs) => any\n  ): (...args: ToolExecuteArgs) => any {\n    return async (...args: ToolExecuteArgs) => {\n      let authRequest: CIBAAuthorizationRequest | undefined;\n      if (asyncLocalStorage.getStore()) {\n        throw new Error(\n          \"Cannot nest tool calls that require CIBA authorization.\"\n        );\n      }\n\n      const storeValue: AsyncStorageValue<any> = {\n        args,\n        context: getContext(...args),\n      };\n\n      return asyncLocalStorage.run(storeValue, async () => {\n        let credentials: Credentials | undefined;\n\n        const interruptMode =\n          typeof this.params.onAuthorizationRequest === \"undefined\" ||\n          this.params.onAuthorizationRequest === \"interrupt\";\n\n        try {\n          if (interruptMode) {\n            authRequest = await resolveParameter(\n              this.params.getAuthorizationResponse,\n              args\n            );\n            if (!authRequest) {\n              //Initial request\n              authRequest = await this.start(args);\n              await this.params.storeAuthorizationResponse(\n                authRequest,\n                ...args\n              );\n            }\n            credentials = await this.getCredentials(authRequest);\n          } else {\n            authRequest = await this.start(args);\n            credentials = await this.getCredentialsPolling(authRequest);\n          }\n        } catch (err) {\n          const shouldInterrupt =\n            err instanceof AuthorizationPendingInterrupt ||\n            err instanceof AuthorizationPollingInterrupt;\n          if (shouldInterrupt) {\n            return this.handleAuthorizationInterrupts(err);\n          } else {\n            await this.deleteAuthRequest();\n            if (typeof this.params.onUnauthorized === \"function\") {\n              return this.params.onUnauthorized(err as Error, ...args);\n            } else {\n              return err;\n            }\n          }\n        }\n        await this.deleteAuthRequest();\n        storeValue.credentials = credentials;\n        return execute(...args);\n      });\n    };\n  }\n\n  protected handleAuthorizationInterrupts(\n    err: AuthorizationPendingInterrupt | AuthorizationPollingInterrupt\n  ) {\n    throw err;\n  }\n}\n"]}

package/dist/esm/authorizers/ciba/CIBAAuthorizerParams.d.ts

@@ -0,0 +1,66 @@
+import { CIBAInterrupt } from "../../interrupts";
+import { AuthorizerToolParameter } from "../../parameters";
+import { CIBAAuthorizationRequest } from "./CIBAAuthorizationRequest";
+export type OnAuthorizationRequest = "block" | "interrupt";
+export type CIBAAuthorizerParams<ToolExecuteArgs extends any[]> = {
+    /**
+     * The user ID to request authorization for.
+     */
+    userID: AuthorizerToolParameter<ToolExecuteArgs>;
+    /**
+     * The binding message to send to the user.
+     */
+    bindingMessage: AuthorizerToolParameter<ToolExecuteArgs>;
+    /**
+     * The scope to request authorization for.
+     */
+    scopes: string[];
+    /**
+     * The audience to request authorization for.
+     */
+    audience?: string;
+    /**
+     * The time in seconds for the authorization request to expire.
+     */
+    requestExpiry?: number;
+    /**
+     * The behavior when the authorization request is made.
+     *
+     * - `block`: The tool execution is blocked until the user completes the authorization.
+     * - `interrupt`: The tool execution is interrupted until the user completes the authorization.
+     *
+     * Defaults to `interrupt`.
+     * Note: The block mode is only useful for development purposes and should not be used in production.
+     */
+    onAuthorizationRequest?: OnAuthorizationRequest;
+    /**
+     *
+     * Optional callback to generate a tool result when the invocation is not authorized.
+     *
+     * By default it will return the instance of the Error.
+     *
+     * @param args - The tool execution arguments.
+     * @returns The response to return when the invocation is not authorized.
+     */
+    onUnauthorized?: (err: Error | CIBAInterrupt, ...args: ToolExecuteArgs) => any;
+} & ({
+    onAuthorizationRequest: "block";
+} | {
+    onAuthorizationRequest?: "interrupt";
+    /**
+     * Retrieves the authorization response data.
+     * @param args - The tool execution arguments.
+     * @returns The authorization response data.
+     * @remarks The data should be stored in a way that it can be retrieved later by the `storeAuthorizationResponse` parameter.
+     */
+    getAuthorizationResponse: AuthorizerToolParameter<ToolExecuteArgs, CIBAAuthorizationRequest | undefined>;
+    /**
+     * Stores the authorization response data.
+     * @param request - The authorization response data.
+     * @param args - The tool execution arguments.
+     * @returns A promise that resolves when the data is stored.
+     * @remarks The data should be stored in a way that it can be retrieved later by the `getAuthorizationResponse` parameter.
+     **/
+    storeAuthorizationResponse: (request: CIBAAuthorizationRequest | undefined, ...args: ToolExecuteArgs) => Promise<void>;
+});
+//# sourceMappingURL=CIBAAuthorizerParams.d.ts.map

package/dist/esm/authorizers/ciba/CIBAAuthorizerParams.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=CIBAAuthorizerParams.js.map

package/dist/esm/authorizers/ciba/CIBAAuthorizerParams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CIBAAuthorizerParams.js","sourceRoot":"","sources":["../../../../src/authorizers/ciba/CIBAAuthorizerParams.ts"],"names":[],"mappings":"","sourcesContent":["import { CIBAInterrupt } from \"../../interrupts\";\nimport { AuthorizerToolParameter } from \"../../parameters\";\nimport { CIBAAuthorizationRequest } from \"./CIBAAuthorizationRequest\";\n\nexport type OnAuthorizationRequest = \"block\" | \"interrupt\";\n\nexport type CIBAAuthorizerParams<ToolExecuteArgs extends any[]> = {\n  /**\n   * The user ID to request authorization for.\n   */\n  userID: AuthorizerToolParameter<ToolExecuteArgs>;\n\n  /**\n   * The binding message to send to the user.\n   */\n  bindingMessage: AuthorizerToolParameter<ToolExecuteArgs>;\n\n  /**\n   * The scope to request authorization for.\n   */\n  scopes: string[];\n\n  /**\n   * The audience to request authorization for.\n   */\n  audience?: string;\n\n  /**\n   * The time in seconds for the authorization request to expire.\n   */\n  requestExpiry?: number;\n\n  /**\n   * The behavior when the authorization request is made.\n   *\n   * - `block`: The tool execution is blocked until the user completes the authorization.\n   * - `interrupt`: The tool execution is interrupted until the user completes the authorization.\n   *\n   * Defaults to `interrupt`.\n   * Note: The block mode is only useful for development purposes and should not be used in production.\n   */\n  onAuthorizationRequest?: OnAuthorizationRequest;\n\n  /**\n   *\n   * Optional callback to generate a tool result when the invocation is not authorized.\n   *\n   * By default it will return the instance of the Error.\n   *\n   * @param args - The tool execution arguments.\n   * @returns The response to return when the invocation is not authorized.\n   */\n  onUnauthorized?: (\n    err: Error | CIBAInterrupt,\n    ...args: ToolExecuteArgs\n  ) => any;\n} & (\n  | {\n      onAuthorizationRequest: \"block\";\n    }\n  | {\n      onAuthorizationRequest?: \"interrupt\";\n\n      /**\n       * Retrieves the authorization response data.\n       * @param args - The tool execution arguments.\n       * @returns The authorization response data.\n       * @remarks The data should be stored in a way that it can be retrieved later by the `storeAuthorizationResponse` parameter.\n       */\n      getAuthorizationResponse: AuthorizerToolParameter<\n        ToolExecuteArgs,\n        CIBAAuthorizationRequest | undefined\n      >;\n\n      /**\n       * Stores the authorization response data.\n       * @param request - The authorization response data.\n       * @param args - The tool execution arguments.\n       * @returns A promise that resolves when the data is stored.\n       * @remarks The data should be stored in a way that it can be retrieved later by the `getAuthorizationResponse` parameter.\n       **/\n      storeAuthorizationResponse: (\n        request: CIBAAuthorizationRequest | undefined,\n        ...args: ToolExecuteArgs\n      ) => Promise<void>;\n    }\n);\n"]}