@auth0/ai 1.0.0

package/dist/esm/authorizers/fga/index.d.ts

@@ -0,0 +1,21 @@
+import { ClientCheckRequest, OpenFgaClient } from "@openfga/sdk";
+import { FGAClientParams } from "./fga-client";
+export type { FGAClientParams };
+export type FGAAuthorizerOptions<ToolExecuteArgs extends any[]> = {
+    buildQuery: (...args: ToolExecuteArgs) => Promise<ClientCheckRequest>;
+    onUnauthorized?: (...args: ToolExecuteArgs) => any;
+};
+export declare class FGAAuthorizerBase<ToolExecuteArgs extends any[]> {
+    private authorizeOptions;
+    fgaClient: OpenFgaClient;
+    constructor(fgaClientParams: FGAClientParams | undefined | null, authorizeOptions: FGAAuthorizerOptions<ToolExecuteArgs>);
+    /**
+     *
+     * Wraps the execute method of an AI tool to handle FGA authorization.
+     *
+     * @param execute - The tool execute method.
+     * @returns The wrapped execute method.
+     */
+    protect(execute: (...args: ToolExecuteArgs) => any): (...args: ToolExecuteArgs) => any;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/authorizers/fga/index.js

@@ -0,0 +1,33 @@
+import { ConsistencyPreference, } from "@openfga/sdk";
+import { buildOpenFgaClient } from "./fga-client";
+export class FGAAuthorizerBase {
+    constructor(fgaClientParams, authorizeOptions) {
+        this.authorizeOptions = authorizeOptions;
+        this.fgaClient = buildOpenFgaClient(fgaClientParams);
+    }
+    /**
+     *
+     * Wraps the execute method of an AI tool to handle FGA authorization.
+     *
+     * @param execute - The tool execute method.
+     * @returns The wrapped execute method.
+     */
+    protect(execute) {
+        return async (...args) => {
+            const check = await this.authorizeOptions.buildQuery(...args);
+            const { allowed } = await this.fgaClient.check(check, {
+                consistency: ConsistencyPreference.HigherConsistency,
+            });
+            if (!allowed) {
+                if (typeof this.authorizeOptions.onUnauthorized === "function") {
+                    return this.authorizeOptions.onUnauthorized(...args);
+                }
+                else {
+                    return "The user is not allowed to perform the action.";
+                }
+            }
+            return execute(...args);
+        };
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/esm/authorizers/fga/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/authorizers/fga/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,qBAAqB,GAEtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,kBAAkB,EAAmB,MAAM,cAAc,CAAC;AASnE,MAAM,OAAO,iBAAiB;IAG5B,YACE,eAAmD,EAC3C,gBAAuD;QAAvD,qBAAgB,GAAhB,gBAAgB,CAAuC;QAE/D,IAAI,CAAC,SAAS,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CACL,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YAC9D,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE;gBACpD,WAAW,EAAE,qBAAqB,CAAC,iBAAiB;aACrD,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,OAAO,IAAI,CAAC,gBAAgB,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;oBAC/D,OAAO,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;gBACvD,CAAC;qBAAM,CAAC;oBACN,OAAO,gDAAgD,CAAC;gBAC1D,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QAC1B,CAAC,CAAC;IACJ,CAAC;CACF","sourcesContent":["import {\n  ClientCheckRequest,\n  ConsistencyPreference,\n  OpenFgaClient,\n} from \"@openfga/sdk\";\n\nimport { buildOpenFgaClient, FGAClientParams } from \"./fga-client\";\n\nexport type { FGAClientParams };\n\nexport type FGAAuthorizerOptions<ToolExecuteArgs extends any[]> = {\n  buildQuery: (...args: ToolExecuteArgs) => Promise<ClientCheckRequest>;\n  onUnauthorized?: (...args: ToolExecuteArgs) => any;\n};\n\nexport class FGAAuthorizerBase<ToolExecuteArgs extends any[]> {\n  fgaClient: OpenFgaClient;\n\n  constructor(\n    fgaClientParams: FGAClientParams | undefined | null,\n    private authorizeOptions: FGAAuthorizerOptions<ToolExecuteArgs>\n  ) {\n    this.fgaClient = buildOpenFgaClient(fgaClientParams);\n  }\n\n  /**\n   *\n   * Wraps the execute method of an AI tool to handle FGA authorization.\n   *\n   * @param execute - The tool execute method.\n   * @returns The wrapped execute method.\n   */\n  protect(\n    execute: (...args: ToolExecuteArgs) => any\n  ): (...args: ToolExecuteArgs) => any {\n    return async (...args: ToolExecuteArgs) => {\n      const check = await this.authorizeOptions.buildQuery(...args);\n      const { allowed } = await this.fgaClient.check(check, {\n        consistency: ConsistencyPreference.HigherConsistency,\n      });\n      if (!allowed) {\n        if (typeof this.authorizeOptions.onUnauthorized === \"function\") {\n          return this.authorizeOptions.onUnauthorized(...args);\n        } else {\n          return \"The user is not allowed to perform the action.\";\n        }\n      }\n      return execute(...args);\n    };\n  }\n}\n"]}

package/dist/esm/authorizers/index.d.ts

@@ -0,0 +1,13 @@
+import { AuthenticationClientOptions } from "auth0";
+import * as jose from "jose";
+export type AuthParams = {
+    allowed?: boolean;
+    accessToken?: string;
+    claims?: jose.JWTPayload;
+};
+export type ToolWithAuthHandler<I, O, C> = (authParams: AuthParams, input: I, config?: C) => Promise<O>;
+export type AuthorizerParams = Omit<AuthenticationClientOptions, "domain" | "clientId"> & {
+    domain?: string;
+    clientId?: string;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/authorizers/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/dist/esm/authorizers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authorizers/index.ts"],"names":[],"mappings":"","sourcesContent":["import { AuthenticationClientOptions } from \"auth0\";\nimport * as jose from \"jose\";\n\nexport type AuthParams = {\n  allowed?: boolean;\n  accessToken?: string;\n  claims?: jose.JWTPayload;\n};\n\nexport type ToolWithAuthHandler<I, O, C> = (\n  authParams: AuthParams,\n  input: I,\n  config?: C\n) => Promise<O>;\n\nexport type AuthorizerParams = Omit<\n  AuthenticationClientOptions,\n  \"domain\" | \"clientId\"\n> & {\n  domain?: string;\n  clientId?: string;\n};\n"]}

package/dist/esm/credentials.d.ts

@@ -0,0 +1,10 @@
+export interface Credential {
+    type: string;
+    value: string;
+}
+export interface Credentials {
+    idToken?: Credential;
+    accessToken: Credential;
+    refreshToken?: Credential;
+}
+//# sourceMappingURL=credentials.d.ts.map

package/dist/esm/credentials.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=credentials.js.map

package/dist/esm/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/credentials.ts"],"names":[],"mappings":"","sourcesContent":["export interface Credential {\n  type: string;\n  value: string;\n}\n\nexport interface Credentials {\n  idToken?: Credential;\n  accessToken: Credential;\n  refreshToken?: Credential;\n}\n"]}

package/dist/esm/errors.d.ts

@@ -0,0 +1,19 @@
+export declare class AccessDeniedError extends Error {
+    constructor(message: string);
+}
+export declare class UserDoesNotHavePushNotificationsError extends Error {
+    constructor(message: string);
+}
+export declare class AuthorizationRequestExpiredError extends Error {
+    constructor(message: string);
+}
+export declare class AuthorizationPending extends Error {
+    constructor(message: string);
+}
+export declare class AuthorizationRequired extends Error {
+    constructor(message: string);
+}
+export declare class AuthorizationPollingError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/esm/errors.js

@@ -0,0 +1,37 @@
+export class AccessDeniedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = AccessDeniedError.name;
+    }
+}
+export class UserDoesNotHavePushNotificationsError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = UserDoesNotHavePushNotificationsError.name;
+    }
+}
+export class AuthorizationRequestExpiredError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = AuthorizationRequestExpiredError.name;
+    }
+}
+export class AuthorizationPending extends Error {
+    constructor(message) {
+        super(message);
+        this.name = AuthorizationPending.name;
+    }
+}
+export class AuthorizationRequired extends Error {
+    constructor(message) {
+        super(message);
+        this.name = AuthorizationRequired.name;
+    }
+}
+export class AuthorizationPollingError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = AuthorizationPollingError.name;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/esm/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,qCAAsC,SAAQ,KAAK;IAC9D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qCAAqC,CAAC,IAAI,CAAC;IACzD,CAAC;CACF;AAED,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IACzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC,IAAI,CAAC;IACpD,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC,IAAI,CAAC;IAC7C,CAAC;CACF","sourcesContent":["export class AccessDeniedError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = AccessDeniedError.name;\n  }\n}\n\nexport class UserDoesNotHavePushNotificationsError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = UserDoesNotHavePushNotificationsError.name;\n  }\n}\n\nexport class AuthorizationRequestExpiredError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = AuthorizationRequestExpiredError.name;\n  }\n}\n\nexport class AuthorizationPending extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = AuthorizationPending.name;\n  }\n}\n\nexport class AuthorizationRequired extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = AuthorizationRequired.name;\n  }\n}\n\nexport class AuthorizationPollingError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = AuthorizationPollingError.name;\n  }\n}\n"]}

package/dist/esm/index.d.ts

@@ -0,0 +1,9 @@
+export type { AuthParams, AuthorizerParams } from "./authorizers";
+export type * from "./credentials";
+export * from "./authorizers/device-authorizer";
+export * from "./errors";
+export type { TokenResponse } from "./TokenResponse";
+export * from "./authorizers/fga/fga-filter";
+export * from "./authorizers/fga/fga-client";
+export * from "./parameters";
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/index.js

@@ -0,0 +1,6 @@
+export * from "./authorizers/device-authorizer";
+export * from "./errors";
+export * from "./authorizers/fga/fga-filter";
+export * from "./authorizers/fga/fga-client";
+export * from "./parameters";
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,iCAAiC,CAAC;AAChD,cAAc,UAAU,CAAC;AAEzB,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,cAAc,CAAC","sourcesContent":["export type { AuthParams, AuthorizerParams } from \"./authorizers\";\nexport type * from \"./credentials\";\nexport * from \"./authorizers/device-authorizer\";\nexport * from \"./errors\";\nexport type { TokenResponse } from \"./TokenResponse\";\nexport * from \"./authorizers/fga/fga-filter\";\nexport * from \"./authorizers/fga/fga-client\";\nexport * from \"./parameters\";\n"]}

package/dist/esm/interrupts/Auth0Interrupt.d.ts

@@ -0,0 +1,37 @@
+export type Auth0InterruptData<T extends Auth0Interrupt> = Omit<Omit<T, keyof Error>, "toJSON"> & {
+    message: string;
+};
+export declare const InterruptName: "AUTH0_AI_INTERRUPT";
+/**
+ * Auth0Interrupt is the base class for all interruptions
+ * in the Auth0 AI sdk.
+ *
+ * It is serializable to a JSON object.
+ */
+export declare class Auth0Interrupt extends Error {
+    name: "AUTH0_AI_INTERRUPT";
+    code: string;
+    constructor(message: string, code: string);
+    /**
+     *
+     * Serialize the interrupt to a JSON object.
+     *
+     * @returns - The JSON object representation of the interrupt.
+     */
+    toJSON(): Auth0InterruptData<this>;
+    /**
+     *
+     * Checks if an interrupt is of a specific type asserting its data component.
+     *
+     * This method assert the data part of the interrupt.
+     *
+     * @param clazz - The class of the interrupt to check.
+     * @param interrupt - The interrupt to check.
+     *
+     * @returns - True if the interrupt is of the specified type.
+     */
+    static isInterrupt<T extends abstract new (...args: any) => any>(this: T & {
+        code?: string;
+    }, interrupt: any): interrupt is Auth0InterruptData<InstanceType<T>>;
+}
+//# sourceMappingURL=Auth0Interrupt.d.ts.map

package/dist/esm/interrupts/Auth0Interrupt.js

@@ -0,0 +1,42 @@
+export const InterruptName = "AUTH0_AI_INTERRUPT";
+/**
+ * Auth0Interrupt is the base class for all interruptions
+ * in the Auth0 AI sdk.
+ *
+ * It is serializable to a JSON object.
+ */
+export class Auth0Interrupt extends Error {
+    constructor(message, code) {
+        super(message);
+        this.name = InterruptName;
+        this.code = code;
+    }
+    /**
+     *
+     * Serialize the interrupt to a JSON object.
+     *
+     * @returns - The JSON object representation of the interrupt.
+     */
+    toJSON() {
+        return {
+            ...Object.fromEntries(Object.entries(this).filter(([key]) => key !== "stack" && key !== "toJSON")),
+            message: this.message,
+        };
+    }
+    /**
+     *
+     * Checks if an interrupt is of a specific type asserting its data component.
+     *
+     * This method assert the data part of the interrupt.
+     *
+     * @param clazz - The class of the interrupt to check.
+     * @param interrupt - The interrupt to check.
+     *
+     * @returns - True if the interrupt is of the specified type.
+     */
+    static isInterrupt(interrupt) {
+        return (interrupt.name === "AUTH0_AI_INTERRUPT" &&
+            (typeof this.code === "undefined" || interrupt.code === this.code));
+    }
+}
+//# sourceMappingURL=Auth0Interrupt.js.map

package/dist/esm/interrupts/Auth0Interrupt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth0Interrupt.js","sourceRoot":"","sources":["../../../src/interrupts/Auth0Interrupt.ts"],"names":[],"mappings":"AAMA,MAAM,CAAC,MAAM,aAAa,GAAG,oBAA6B,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IAIvC,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJjB,SAAI,GAAG,aAAa,CAAC;QAKnB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACH,MAAM;QACJ,OAAO;YACL,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CACzB,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,QAAQ,CAC/C,CACF;YACD,OAAO,EAAE,IAAI,CAAC,OAAO;SACM,CAAC;IAChC,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CAAC,WAAW,CAEhB,SAAc;QAEd,OAAO,CACL,SAAS,CAAC,IAAI,KAAK,oBAAoB;YACvC,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CACnE,CAAC;IACJ,CAAC;CACF","sourcesContent":["// Define a type alias for the generalized type\nexport type Auth0InterruptData<T extends Auth0Interrupt> = Omit<\n  Omit<T, keyof Error>,\n  \"toJSON\"\n> & { message: string };\n\nexport const InterruptName = \"AUTH0_AI_INTERRUPT\" as const;\n\n/**\n * Auth0Interrupt is the base class for all interruptions\n * in the Auth0 AI sdk.\n *\n * It is serializable to a JSON object.\n */\nexport class Auth0Interrupt extends Error {\n  name = InterruptName;\n  code: string;\n\n  constructor(message: string, code: string) {\n    super(message);\n    this.code = code;\n  }\n\n  /**\n   *\n   * Serialize the interrupt to a JSON object.\n   *\n   * @returns - The JSON object representation of the interrupt.\n   */\n  toJSON(): Auth0InterruptData<this> {\n    return {\n      ...Object.fromEntries(\n        Object.entries(this).filter(\n          ([key]) => key !== \"stack\" && key !== \"toJSON\"\n        )\n      ),\n      message: this.message,\n    } as Auth0InterruptData<this>;\n  }\n\n  /**\n   *\n   * Checks if an interrupt is of a specific type asserting its data component.\n   *\n   * This method assert the data part of the interrupt.\n   *\n   * @param clazz - The class of the interrupt to check.\n   * @param interrupt - The interrupt to check.\n   *\n   * @returns - True if the interrupt is of the specified type.\n   */\n  static isInterrupt<T extends abstract new (...args: any) => any>(\n    this: T & { code?: string },\n    interrupt: any\n  ): interrupt is Auth0InterruptData<InstanceType<T>> {\n    return (\n      interrupt.name === \"AUTH0_AI_INTERRUPT\" &&\n      (typeof this.code === \"undefined\" || interrupt.code === this.code)\n    );\n  }\n}\n"]}

package/dist/esm/interrupts/CIBAInterrupts.d.ts

@@ -0,0 +1,62 @@
+import { CIBAAuthorizationRequest } from "../authorizers/ciba/CIBAAuthorizationRequest";
+import { Auth0Interrupt, Auth0InterruptData } from "./Auth0Interrupt";
+export interface WithRequestData {
+    request: CIBAAuthorizationRequest;
+}
+/**
+ * Base class for CIBA interrupts.
+ */
+export declare class CIBAInterrupt extends Auth0Interrupt {
+    constructor(message: string, code: string);
+    static isInterrupt<T extends abstract new (...args: any) => any>(this: T, interrupt: any): interrupt is Auth0InterruptData<InstanceType<T>>;
+    static hasRequestData(interrupt: any): interrupt is WithRequestData;
+}
+/**
+ * An interrupt that is thrown when the user denies the authorization request.
+ */
+export declare class AccessDeniedInterrupt extends CIBAInterrupt implements WithRequestData {
+    readonly request: CIBAAuthorizationRequest;
+    static code: string;
+    constructor(message: string, request: CIBAAuthorizationRequest);
+}
+/**
+ * An interrupt that is thrown when the user does not have push notifications enabled.
+ */
+export declare class UserDoesNotHavePushNotificationsInterrupt extends CIBAInterrupt {
+    static code: string;
+    constructor(message: string);
+}
+/**
+ * An interrupt that is thrown when the authorization request has expired.
+ */
+export declare class AuthorizationRequestExpiredInterrupt extends CIBAInterrupt implements WithRequestData {
+    readonly request: CIBAAuthorizationRequest;
+    static code: string;
+    constructor(message: string, request: CIBAAuthorizationRequest);
+}
+/**
+ * An interrupt that is thrown when the authorization is still pending
+ * and the Authorizer is in `mode: interrupt`.
+ */
+export declare class AuthorizationPendingInterrupt extends CIBAInterrupt implements WithRequestData {
+    readonly request: CIBAAuthorizationRequest;
+    static code: string;
+    constructor(message: string, request: CIBAAuthorizationRequest);
+}
+/**
+ * An interrupt that is thrown when the authorization polling fails.
+ */
+export declare class AuthorizationPollingInterrupt extends Auth0Interrupt implements WithRequestData {
+    readonly request: CIBAAuthorizationRequest;
+    static code: string;
+    constructor(message: string, request: CIBAAuthorizationRequest);
+}
+/**
+ * An interrupt that is thrown when the authorization polling fails.
+ */
+export declare class InvalidGrantInterrupt extends Auth0Interrupt implements WithRequestData {
+    readonly request: CIBAAuthorizationRequest;
+    static code: string;
+    constructor(message: string, request: CIBAAuthorizationRequest);
+}
+//# sourceMappingURL=CIBAInterrupts.d.ts.map

package/dist/esm/interrupts/CIBAInterrupts.js

@@ -0,0 +1,79 @@
+import { Auth0Interrupt } from "./Auth0Interrupt";
+/**
+ * Base class for CIBA interrupts.
+ */
+export class CIBAInterrupt extends Auth0Interrupt {
+    constructor(message, code) {
+        super(message, code);
+    }
+    static isInterrupt(interrupt) {
+        return (interrupt &&
+            Auth0Interrupt.isInterrupt(interrupt) &&
+            typeof interrupt.code === "string" &&
+            interrupt.code.startsWith("CIBA_"));
+    }
+    static hasRequestData(interrupt) {
+        return CIBAInterrupt.isInterrupt(interrupt) && "request" in interrupt;
+    }
+}
+/**
+ * An interrupt that is thrown when the user denies the authorization request.
+ */
+export class AccessDeniedInterrupt extends CIBAInterrupt {
+    constructor(message, request) {
+        super(message, AccessDeniedInterrupt.code);
+        this.request = request;
+    }
+}
+AccessDeniedInterrupt.code = "CIBA_ACCESS_DENIED";
+/**
+ * An interrupt that is thrown when the user does not have push notifications enabled.
+ */
+export class UserDoesNotHavePushNotificationsInterrupt extends CIBAInterrupt {
+    constructor(message) {
+        super(message, UserDoesNotHavePushNotificationsInterrupt.code);
+    }
+}
+UserDoesNotHavePushNotificationsInterrupt.code = "CIBA_USER_DOES_NOT_HAVE_PUSH_NOTIFICATIONS";
+/**
+ * An interrupt that is thrown when the authorization request has expired.
+ */
+export class AuthorizationRequestExpiredInterrupt extends CIBAInterrupt {
+    constructor(message, request) {
+        super(message, AuthorizationRequestExpiredInterrupt.code);
+        this.request = request;
+    }
+}
+AuthorizationRequestExpiredInterrupt.code = "CIBA_AUTHORIZATION_REQUEST_EXPIRED";
+/**
+ * An interrupt that is thrown when the authorization is still pending
+ * and the Authorizer is in `mode: interrupt`.
+ */
+export class AuthorizationPendingInterrupt extends CIBAInterrupt {
+    constructor(message, request) {
+        super(message, AuthorizationPendingInterrupt.code);
+        this.request = request;
+    }
+}
+AuthorizationPendingInterrupt.code = "CIBA_AUTHORIZATION_PENDING";
+/**
+ * An interrupt that is thrown when the authorization polling fails.
+ */
+export class AuthorizationPollingInterrupt extends Auth0Interrupt {
+    constructor(message, request) {
+        super(message, AuthorizationPollingInterrupt.code);
+        this.request = request;
+    }
+}
+AuthorizationPollingInterrupt.code = "CIBA_AUTHORIZATION_POLLING_ERROR";
+/**
+ * An interrupt that is thrown when the authorization polling fails.
+ */
+export class InvalidGrantInterrupt extends Auth0Interrupt {
+    constructor(message, request) {
+        super(message, AuthorizationPollingInterrupt.code);
+        this.request = request;
+    }
+}
+InvalidGrantInterrupt.code = "CIBA_INVALID_GRANT";
+//# sourceMappingURL=CIBAInterrupts.js.map

package/dist/esm/interrupts/CIBAInterrupts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CIBAInterrupts.js","sourceRoot":"","sources":["../../../src/interrupts/CIBAInterrupts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAsB,MAAM,kBAAkB,CAAC;AAMtE;;GAEG;AACH,MAAM,OAAO,aAAc,SAAQ,cAAc;IAC/C,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,WAAW,CAEhB,SAAc;QAEd,OAAO,CACL,SAAS;YACT,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC;YACrC,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;YAClC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CACnC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,SAAc;QAClC,OAAO,aAAa,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,SAAS,CAAC;IACxE,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,qBACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAF3B,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AANa,0BAAI,GAAW,oBAA6B,CAAC;AAS7D;;GAEG;AACH,MAAM,OAAO,yCAA0C,SAAQ,aAAa;IAG1E,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,yCAAyC,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;;AAJa,8CAAI,GAChB,4CAAqD,CAAC;AAM1D;;GAEG;AACH,MAAM,OAAO,oCACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,oCAAoC,CAAC,IAAI,CAAC,CAAC;QAF1C,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AANa,yCAAI,GAAW,oCAA6C,CAAC;AAS7E;;;GAGG;AACH,MAAM,OAAO,6BACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AANa,kCAAI,GAAW,4BAAqC,CAAC;AASrE;;GAEG;AACH,MAAM,OAAO,6BACX,SAAQ,cAAc;IAItB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AANa,kCAAI,GAAW,kCAA2C,CAAC;AAS3E;;GAEG;AACH,MAAM,OAAO,qBACX,SAAQ,cAAc;IAItB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AANa,0BAAI,GAAW,oBAA6B,CAAC","sourcesContent":["import { CIBAAuthorizationRequest } from \"../authorizers/ciba/CIBAAuthorizationRequest\";\nimport { Auth0Interrupt, Auth0InterruptData } from \"./Auth0Interrupt\";\n\nexport interface WithRequestData {\n  request: CIBAAuthorizationRequest;\n}\n\n/**\n * Base class for CIBA interrupts.\n */\nexport class CIBAInterrupt extends Auth0Interrupt {\n  constructor(message: string, code: string) {\n    super(message, code);\n  }\n\n  static isInterrupt<T extends abstract new (...args: any) => any>(\n    this: T,\n    interrupt: any\n  ): interrupt is Auth0InterruptData<InstanceType<T>> {\n    return (\n      interrupt &&\n      Auth0Interrupt.isInterrupt(interrupt) &&\n      typeof interrupt.code === \"string\" &&\n      interrupt.code.startsWith(\"CIBA_\")\n    );\n  }\n\n  static hasRequestData(interrupt: any): interrupt is WithRequestData {\n    return CIBAInterrupt.isInterrupt(interrupt) && \"request\" in interrupt;\n  }\n}\n\n/**\n * An interrupt that is thrown when the user denies the authorization request.\n */\nexport class AccessDeniedInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_ACCESS_DENIED\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AccessDeniedInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the user does not have push notifications enabled.\n */\nexport class UserDoesNotHavePushNotificationsInterrupt extends CIBAInterrupt {\n  public static code: string =\n    \"CIBA_USER_DOES_NOT_HAVE_PUSH_NOTIFICATIONS\" as const;\n  constructor(message: string) {\n    super(message, UserDoesNotHavePushNotificationsInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization request has expired.\n */\nexport class AuthorizationRequestExpiredInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_REQUEST_EXPIRED\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationRequestExpiredInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization is still pending\n * and the Authorizer is in `mode: interrupt`.\n */\nexport class AuthorizationPendingInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_PENDING\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPendingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class AuthorizationPollingInterrupt\n  extends Auth0Interrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_POLLING_ERROR\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class InvalidGrantInterrupt\n  extends Auth0Interrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_INVALID_GRANT\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n"]}

package/dist/esm/interrupts/FederatedConnectionInterrupt.d.ts

@@ -0,0 +1,33 @@
+import { Auth0Interrupt } from "./Auth0Interrupt";
+/**
+ * Error thrown when a tool call requires an access token for an external service.
+ *
+ * Throw this error if the service returns Unauthorized for the current access token.
+ */
+export declare class FederatedConnectionInterrupt extends Auth0Interrupt {
+    /**
+     * The auth0 connection name.
+     */
+    readonly connection: string;
+    /**
+     * The scopes required to access the external service as stated
+     * in the authorizer.
+     */
+    readonly scopes: string[];
+    /**
+     * The union between the current scopes of the Access Token plus the required scopes.
+     * This is the list of scopes that will be used to request a new Access Token.
+     */
+    readonly requiredScopes: string[];
+    static code: "FEDERATED_CONNECTION_ERROR";
+    constructor(message: string, connection: string, scopes: string[], requiredScopes: string[]);
+}
+/**
+ * Error thrown when a tool call requires an access token for an external service.
+ *
+ * The authorizer will automatically convert this class of error to FederatedConnectionInterrupt.
+ */
+export declare class FederatedConnectionError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=FederatedConnectionInterrupt.d.ts.map

package/dist/esm/interrupts/FederatedConnectionInterrupt.js

@@ -0,0 +1,26 @@
+import { Auth0Interrupt } from "./Auth0Interrupt";
+/**
+ * Error thrown when a tool call requires an access token for an external service.
+ *
+ * Throw this error if the service returns Unauthorized for the current access token.
+ */
+export class FederatedConnectionInterrupt extends Auth0Interrupt {
+    constructor(message, connection, scopes, requiredScopes) {
+        super(message, FederatedConnectionInterrupt.code);
+        this.connection = connection;
+        this.scopes = scopes;
+        this.requiredScopes = requiredScopes;
+    }
+}
+FederatedConnectionInterrupt.code = "FEDERATED_CONNECTION_ERROR";
+/**
+ * Error thrown when a tool call requires an access token for an external service.
+ *
+ * The authorizer will automatically convert this class of error to FederatedConnectionInterrupt.
+ */
+export class FederatedConnectionError extends Error {
+    constructor(message) {
+        super(message);
+    }
+}
+//# sourceMappingURL=FederatedConnectionInterrupt.js.map

package/dist/esm/interrupts/FederatedConnectionInterrupt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FederatedConnectionInterrupt.js","sourceRoot":"","sources":["../../../src/interrupts/FederatedConnectionInterrupt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD;;;;GAIG;AACH,MAAM,OAAO,4BAA6B,SAAQ,cAAc;IAoB9D,YACE,OAAe,EACf,UAAkB,EAClB,MAAgB,EAChB,cAAwB;QAExB,KAAK,CAAC,OAAO,EAAE,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;;AAZa,iCAAI,GAAG,4BAAqC,CAAC;AAe7D;;;;GAIG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF","sourcesContent":["import { Auth0Interrupt } from \"./Auth0Interrupt\";\n\n/**\n * Error thrown when a tool call requires an access token for an external service.\n *\n * Throw this error if the service returns Unauthorized for the current access token.\n */\nexport class FederatedConnectionInterrupt extends Auth0Interrupt {\n  /**\n   * The auth0 connection name.\n   */\n  public readonly connection: string;\n\n  /**\n   * The scopes required to access the external service as stated\n   * in the authorizer.\n   */\n  public readonly scopes: string[];\n\n  /**\n   * The union between the current scopes of the Access Token plus the required scopes.\n   * This is the list of scopes that will be used to request a new Access Token.\n   */\n  public readonly requiredScopes: string[];\n\n  public static code = \"FEDERATED_CONNECTION_ERROR\" as const;\n\n  constructor(\n    message: string,\n    connection: string,\n    scopes: string[],\n    requiredScopes: string[]\n  ) {\n    super(message, FederatedConnectionInterrupt.code);\n    this.connection = connection;\n    this.scopes = scopes;\n    this.requiredScopes = requiredScopes;\n  }\n}\n\n/**\n * Error thrown when a tool call requires an access token for an external service.\n *\n * The authorizer will automatically convert this class of error to FederatedConnectionInterrupt.\n */\nexport class FederatedConnectionError extends Error {\n  constructor(message: string) {\n    super(message);\n  }\n}\n"]}

package/dist/esm/interrupts/index.d.ts

@@ -0,0 +1,4 @@
+export { Auth0Interrupt } from "./Auth0Interrupt";
+export { FederatedConnectionInterrupt, FederatedConnectionError, } from "./FederatedConnectionInterrupt";
+export { CIBAInterrupt, AccessDeniedInterrupt, UserDoesNotHavePushNotificationsInterrupt, AuthorizationRequestExpiredInterrupt, AuthorizationPendingInterrupt, AuthorizationPollingInterrupt, InvalidGrantInterrupt, } from "./CIBAInterrupts";
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/interrupts/index.js

@@ -0,0 +1,4 @@
+export { Auth0Interrupt } from "./Auth0Interrupt";
+export { FederatedConnectionInterrupt, FederatedConnectionError, } from "./FederatedConnectionInterrupt";
+export { CIBAInterrupt, AccessDeniedInterrupt, UserDoesNotHavePushNotificationsInterrupt, AuthorizationRequestExpiredInterrupt, AuthorizationPendingInterrupt, AuthorizationPollingInterrupt, InvalidGrantInterrupt, } from "./CIBAInterrupts";
+//# sourceMappingURL=index.js.map

package/dist/esm/interrupts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/interrupts/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,yCAAyC,EACzC,oCAAoC,EACpC,6BAA6B,EAC7B,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,kBAAkB,CAAC","sourcesContent":["export { Auth0Interrupt } from \"./Auth0Interrupt\";\n\nexport {\n  FederatedConnectionInterrupt,\n  FederatedConnectionError,\n} from \"./FederatedConnectionInterrupt\";\n\nexport {\n  CIBAInterrupt,\n  AccessDeniedInterrupt,\n  UserDoesNotHavePushNotificationsInterrupt,\n  AuthorizationRequestExpiredInterrupt,\n  AuthorizationPendingInterrupt,\n  AuthorizationPollingInterrupt,\n  InvalidGrantInterrupt,\n} from \"./CIBAInterrupts\";\n"]}

package/dist/esm/parameters.d.ts

@@ -0,0 +1,3 @@
+export type AuthorizerToolParameter<ToolExecuteArgs extends any[], TResult = string> = TResult | ((...args: ToolExecuteArgs) => Promise<TResult> | TResult);
+export declare const resolveParameter: <ToolExecuteArgs extends any[], TResult = string>(resolver: AuthorizerToolParameter<ToolExecuteArgs, TResult>, context: ToolExecuteArgs) => TResult | Promise<TResult>;
+//# sourceMappingURL=parameters.d.ts.map

package/dist/esm/parameters.js

@@ -0,0 +1,9 @@
+/* eslint-disable @typescript-eslint/no-unsafe-function-type */
+const isCallback = (maybeFunction) => typeof maybeFunction === "function";
+export const resolveParameter = (resolver, context) => {
+    if (isCallback(resolver)) {
+        return resolver(...context);
+    }
+    return resolver;
+};
+//# sourceMappingURL=parameters.js.map

package/dist/esm/parameters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parameters.js","sourceRoot":"","sources":["../../src/parameters.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,MAAM,UAAU,GAAG,CACjB,aAA+C,EACpB,EAAE,CAAC,OAAO,aAAa,KAAK,UAAU,CAAC;AAOpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAI9B,QAA2D,EAC3D,OAAwB,EACI,EAAE;IAC9B,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,QAAQ,CAAC,GAAG,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC","sourcesContent":["/* eslint-disable @typescript-eslint/no-unsafe-function-type */\nconst isCallback = (\n  maybeFunction: any | ((...args: any[]) => void)\n): maybeFunction is Function => typeof maybeFunction === \"function\";\n\nexport type AuthorizerToolParameter<\n  ToolExecuteArgs extends any[],\n  TResult = string\n> = TResult | ((...args: ToolExecuteArgs) => Promise<TResult> | TResult);\n\nexport const resolveParameter = <\n  ToolExecuteArgs extends any[],\n  TResult = string\n>(\n  resolver: AuthorizerToolParameter<ToolExecuteArgs, TResult>,\n  context: ToolExecuteArgs\n): TResult | Promise<TResult> => {\n  if (isCallback(resolver)) {\n    return resolver(...context);\n  }\n  return resolver;\n};\n"]}

package/package.json

@@ -0,0 +1,76 @@
+{
+  "name": "@auth0/ai",
+  "version": "1.0.0",
+  "description": "Auth0AI SDK for JavaScript",
+  "types": "dist/esm/index.d.ts",
+  "main": "dist/cjs/index.js",
+  "module": "./dist/esm/index.js",
+  "scripts": {
+    "build": "npm run clean && npm run build:esm && npm run build:cjs",
+    "build:esm": "tsc --outDir ./dist/esm",
+    "build:cjs": "tsc --module nodenext --moduleResolution nodenext --declaration false --declarationMap false --outDir ./dist/cjs",
+    "build:watch": "run-p 'build:esm -- --watch' 'build:cjs -- -watch'",
+    "clean": "rm -rf dist",
+    "lint": "eslint \"./**/*.ts*\"",
+    "type-check": "tsc --noEmit",
+    "test": "vitest run",
+    "semantic-release": "npx --no semantic-release"
+  },
+  "author": {
+    "name": "Auth0 Inc.",
+    "url": "https://auth0.com"
+  },
+  "files": [
+    "dist/**/*.{*js,*js.map,d.ts}"
+  ],
+  "exports": {
+    "./package.json": "./package.json",
+    ".": {
+      "types": "./dist/esm/index.d.ts",
+      "import": "./dist/esm/index.js",
+      "require": "./dist/cjs/index.js"
+    },
+    "./interrupts": {
+      "types": "./dist/esm/interrupts/index.d.ts",
+      "import": "./dist/esm/interrupts/index.js",
+      "require": "./dist/cjs/interrupts/index.js"
+    },
+    "./FederatedConnections": {
+      "types": "./dist/esm/authorizers/federated-connections/index.d.ts",
+      "import": "./dist/esm/authorizers/federated-connections/index.js",
+      "require": "./dist/cjs/authorizers/federated-connections/index.js"
+    },
+    "./CIBA": {
+      "types": "./dist/esm/authorizers/ciba/index.d.ts",
+      "import": "./dist/esm/authorizers/ciba/index.js",
+      "require": "./dist/cjs/authorizers/ciba/index.js"
+    },
+    "./FGA": {
+      "types": "./dist/esm/authorizers/fga/index.d.ts",
+      "import": "./dist/esm/authorizers/fga/index.js",
+      "require": "./dist/cjs/authorizers/fga/index.js"
+    }
+  },
+  "license": "Apache-2.0",
+  "devDependencies": {
+    "@eslint/js": "^9.18.0",
+    "@types/node": "^22.10.6",
+    "eslint": "^8.57.0",
+    "globals": "^15.11.0",
+    "typedoc": "^0.27.6",
+    "typescript": "^5.7.3",
+    "typescript-eslint": "^8.20.0",
+    "vitest": "^3.0.8"
+  },
+  "dependencies": {
+    "@openfga/sdk": "^0.8.0",
+    "auth0": "^4.18.0",
+    "enquirer": "^2.4.1",
+    "jose": "^5.9.6",
+    "open": "^10.1.0",
+    "openid-client": "^6.1.7"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}