@auth0/ai 1.0.2 → 2.0.0

package/dist/cjs/authorizers/device-authorizer/DeviceAuthorizerBase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeviceAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/device-authorizer/DeviceAuthorizerBase.ts"],"names":[],"mappings":";;;;;;AAAA,8DAAiC;AACjC,iDAAuE;AACvE,6CAAyC;AAEzC,mDAAwE;AACxE,wEAK2C;AAC3C,yCAA+C;AAC/C,qCAAkC;AAClC,wCAAuE;AACvE,oCAA4E;AAC5E,2DAA2E;AAE3E,6DAG8B;AAE9B,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEhF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,oBAAoB;IAQ/B,YACE,KAAuC,EACvC,MAA+C;QAE/C,IAAI,CAAC,KAAK,GAAG,+BAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB,EAAE,QAAQ;YAC5B,GAAG,MAAM;SACV,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAExC,IAAI,CAAC,gBAAgB,GAAG,IAAI,iBAAQ,CAAC,MAAM,CAAC,KAAK,EAAE;YACjD,aAAa,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;YAC1C,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CACtB,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;QAEH,IAAI,CAAC,iBAAiB,GAAG,IAAI,iBAAQ,CAAC,MAAM,CAAC,KAAK,EAAE;YAClD,aAAa,EAAE,CAAC,UAAU,EAAE,eAAe,CAAC;YAC5C,MAAM,EAAE,CAAC,YAAY,EAAE,EAAE,CACvB,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACrE,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,KAAK;;QACjB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAS,EAC5B,IAAI,GAAG,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,MAAO,EAAE,CAAC,EACxC,IAAI,CAAC,KAAK,CAAC,QAAS,CACrB,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAA,2CAA2B,EAAC,MAAM,EAAE;YACvD,KAAK,EAAE,CAAC,MAAA,IAAI,CAAC,MAAM,CAAC,MAAM,mCAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC3C,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAS;SAChC,CAAC,CAAC;QAEH,OAAO,IAAA,4CAAuB,EAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA0C,EAC1C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,IAAI,YAAqD,CAAC;YAC1D,IAAI,qCAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YACpC,MAAM,UAAU,GAA2B;gBACzC,IAAI;gBACJ,OAAO,EAAE,OAAO;aACjB,CAAC;YAEF,OAAO,qCAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;gBAClD,IAAI,WAAiC,CAAC;gBACtC,IAAI,mBAAmB,GAAG,KAAK,CAAC;gBAChC,MAAM,cAAc,GAAG,IAAA,uBAAa,EAAC,WAAW,EAAE,OAAO,CAAC,CAAC;gBAC3D,MAAM,aAAa,GAAG,IAAA,uBAAa,EACjC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAC9B,OAAO,CACR,CAAC;gBACF,IAAI,CAAC;oBACH,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAC3C,aAAa,EACb,YAAY,CACb,CAAC;oBAEF,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,IACE,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB;4BACnC,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW,EAClD,CAAC;4BACD,YAAY,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAC7C,cAAc,EACd,cAAc,CACf,CAAC;4BAEF,IAAI,CAAC,YAAY,EAAE,CAAC;gCAClB,iBAAiB;gCACjB,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gCAClC,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAC9B,cAAc,EACd,cAAc,EACd,YAAY,CACb,CAAC;4BACJ,CAAC;4BACD,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;wBACxD,CAAC;6BAAM,CAAC;4BACN,aAAa;4BACb,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;4BAClC,MAAM,kBAAkB,GACtB,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;4BAC3C,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,UAAU,EAAE,CAAC;gCAC7D,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CACtC,YAAY,EACZ,kBAAkB,CACnB,CAAC;4BACJ,CAAC;4BACD,WAAW,GAAG,MAAM,kBAAkB,CAAC;wBACzC,CAAC;wBAED,IAAI,OAAO,WAAW,KAAK,WAAW,EAAE,CAAC;4BACvC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CACvB,aAAa,EACb,YAAY,EACZ,WAAW,CACZ,CAAC;wBACJ,CAAC;wBAED,mBAAmB,GAAG,IAAI,CAAC;oBAC7B,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,eAAe,GACnB,GAAG,YAAY,gDAA6B;wBAC5C,GAAG,YAAY,gDAA6B,CAAC;oBAC/C,IAAI,eAAe,EAAE,CAAC;wBACpB,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;yBAAM,CAAC;wBACN,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBAC/B,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;4BACrD,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAY,EAAE,GAAG,IAAI,CAAC,CAAC;wBAC3D,CAAC;6BAAM,CAAC;4BACN,OAAO,GAAG,CAAC;wBACb,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,IAAI,mBAAmB,EAAE,CAAC;oBACxB,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACjC,CAAC;gBACD,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;gBACrC,OAAO,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,YAAyC;;QAEzC,gEAAgE;QAChE,4BAA4B;QAC5B,MAAM,GAAG,GAAG,WAAW,IAAI,CAAC,KAAK,CAAC,MAAO,cAAc,CAAC;QACxD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,8CAA8C;gBAC1D,WAAW,EAAE,YAAY,CAAC,UAAU;gBACpC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAS;aAChC,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,MAAA,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,0CAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACvE,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC3D,IAAI,KAAK,KAAK,uBAAuB,EAAE,CAAC;oBACtC,MAAM,IAAI,gDAA6B,CACrC,iBAAiB,EACjB,YAAY,CACb,CAAC;gBACJ,CAAC;gBACD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;oBAC1B,MAAM,IAAI,gDAA6B,CACrC,iBAAiB,EACjB,YAAY,CACb,CAAC;gBACJ,CAAC;gBACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;oBAC9B,MAAM,IAAI,uDAAoC,CAC5C,iBAAiB,EACjB,YAAY,CACb,CAAC;gBACJ,CAAC;gBACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;oBAC9B,MAAM,IAAI,wCAAqB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACnE,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACrC,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,IAAA,uCAAyB,EAAC,EAAE,CAAC,CAAC;QAElD,OAAO,WAAW,CAAC;IACrB,CAAC;IAES,KAAK,CAAC,qBAAqB,CACnC,YAAyC;;QAEzC,IAAI,WAAW,GAAyB,SAAS,CAAC;QAElD,GAAG,CAAC;YACF,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IACE,GAAG,YAAY,gDAA6B;oBAC5C,GAAG,YAAY,gDAA6B,EAC5C,CAAC;oBACD,MAAM,KAAK,CAAC,CAAC,MAAA,GAAG,CAAC,QAAQ,CAAC,QAAQ,mCAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;gBACpD,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC,QAAQ,CAAC,WAAW,EAAE;QAEvB,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,aAAa;QACnB,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAA,WAAI,EAAC,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;SACvD,CAAC;QACF,MAAM,EAAE,GAAG,IAAA,wBAAU,EAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,qBAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAES,iBAAiB;QACzB,MAAM,KAAK,GAAG,qCAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,cAAc,GAAG,IAAA,uBAAa,EAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IACvE,CAAC;IAES,6BAA6B,CACrC,GAAkE;QAElE,MAAM,GAAG,CAAC;IACZ,CAAC;CACF;AA1QD,oDA0QC","sourcesContent":["import crypto from \"node:crypto\";\nimport { discovery, initiateDeviceAuthorization } from \"openid-client\";\nimport { stableHash } from \"stable-hash\";\n\nimport { TokenSet, tokenSetFromTokenResponse } from \"../../credentials\";\nimport {\n  AccessDeniedInterrupt,\n  AuthorizationPendingInterrupt,\n  AuthorizationPollingInterrupt,\n  AuthorizationRequestExpiredInterrupt,\n} from \"../../interrupts/DeviceInterrupts\";\nimport { Store, SubStore } from \"../../stores\";\nimport { omit } from \"../../util\";\nimport { AuthContext, ContextGetter, nsFromContext } from \"../context\";\nimport { Auth0PublicClientParams, Auth0PublicClientSchema } from \"../types\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport { DeviceAuthorizerParams } from \"./DeviceAuthorizerParams\";\nimport {\n  DeviceAuthorizationResponse,\n  parseDeviceAuthResponse,\n} from \"./DeviceAuthResponse\";\n\nconst sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));\n\n/**\n * The DeviceAuthorizerBase class acts as a guard and wrapper around tools or agent\n * capabilities that require authenticated access. It encapsulates the\n * OpenID Connect Device Authorization Flow, allowing tools to interrupt execution\n * to request user authorization and resume seamlessly once authorization is granted.\n *\n * Enable agentic tools to be wrapped with secure, lazy-triggered device authorization,\n * with a clean interrupt/resume model for user-in-the-loop authentication.\n *\n * Core Concepts\n *\n * - Interrupt-driven flow: If no valid token is present, the tool throws a DeviceAuthInterrupt,\n * which contains the verification_uri, user_code, and other relevant metadata.\n *\n * - Polling/resumption: The Agent client can poll the agent to resume execution.\n *\n * - Token management: Tokens (and refresh tokens, if applicable) are stored and reused\n * transparently.\n *\n */\nexport class DeviceAuthorizerBase<ToolExecuteArgs extends any[]> {\n  private auth0: Auth0PublicClientParams;\n  private params: DeviceAuthorizerParams<ToolExecuteArgs> & {\n    credentialsContext: AuthContext;\n  };\n  private credentialsStore: Store<TokenSet>;\n  private authResponseStore: Store<DeviceAuthorizationResponse>;\n\n  constructor(\n    auth0: Partial<Auth0PublicClientParams>,\n    params: DeviceAuthorizerParams<ToolExecuteArgs>\n  ) {\n    this.auth0 = Auth0PublicClientSchema.parse(auth0);\n    if (!this.auth0.domain) {\n      throw new Error(\"Domain is required.\");\n    }\n    if (!this.auth0.clientId) {\n      throw new Error(\"Client ID is required.\");\n    }\n    if (!params.store) {\n      throw new Error(\"Store is required.\");\n    }\n\n    this.params = {\n      credentialsContext: \"thread\",\n      ...params,\n    };\n\n    const instanceID = this.getInstanceID();\n\n    this.credentialsStore = new SubStore(params.store, {\n      baseNamespace: [instanceID, \"Credentials\"],\n      getTTL: (credentials) =>\n        credentials.expiresIn ? credentials.expiresIn * 1000 : undefined,\n    });\n\n    this.authResponseStore = new SubStore(params.store, {\n      baseNamespace: [instanceID, \"AuthResponses\"],\n      getTTL: (authResponse) =>\n        authResponse.expiresIn ? authResponse.expiresIn * 1000 : undefined,\n    });\n  }\n\n  private async start(): Promise<DeviceAuthorizationResponse> {\n    const requestedAt = Date.now() / 1000;\n    const config = await discovery(\n      new URL(`https://${this.auth0.domain!}`),\n      this.auth0.clientId!\n    );\n\n    const handle = await initiateDeviceAuthorization(config, {\n      scope: (this.params.scopes ?? []).join(\" \"),\n      audience: this.params.audience!,\n    });\n\n    return parseDeviceAuthResponse(handle, requestedAt);\n  }\n\n  /**\n   *\n   * Wraps the execute method of a AI tool to handle CIBA authorization.\n   *\n   * @param getContext - A function that returns the context of the tool execution.\n   * @param execute - The tool execute method.\n   * @returns The wrapped execute method.\n   */\n  protect(\n    getContext: ContextGetter<ToolExecuteArgs>,\n    execute: (...args: ToolExecuteArgs) => any\n  ): (...args: ToolExecuteArgs) => any {\n    return async (...args: ToolExecuteArgs) => {\n      let authResponse: DeviceAuthorizationResponse | undefined;\n      if (asyncLocalStorage.getStore()) {\n        throw new Error(\n          \"Cannot nest tool calls that require CIBA authorization.\"\n        );\n      }\n\n      const context = getContext(...args);\n      const storeValue: AsyncStorageValue<any> = {\n        args,\n        context: context,\n      };\n\n      return asyncLocalStorage.run(storeValue, async () => {\n        let credentials: TokenSet | undefined;\n        let credentialsObtained = false;\n        const authResponseNS = nsFromContext(\"tool-call\", context);\n        const credentialsNS = nsFromContext(\n          this.params.credentialsContext,\n          context\n        );\n        try {\n          credentials = await this.credentialsStore.get(\n            credentialsNS,\n            \"credential\"\n          );\n\n          if (!credentials) {\n            if (\n              !this.params.onAuthorizationRequest ||\n              this.params.onAuthorizationRequest === \"interrupt\"\n            ) {\n              authResponse = await this.authResponseStore.get(\n                authResponseNS,\n                \"authResponse\"\n              );\n\n              if (!authResponse) {\n                //Initial request\n                authResponse = await this.start();\n                await this.authResponseStore.put(\n                  authResponseNS,\n                  \"authResponse\",\n                  authResponse\n                );\n              }\n              credentials = await this.getCredentials(authResponse);\n            } else {\n              // Block mode\n              authResponse = await this.start();\n              const credentialsPromise =\n                this.getCredentialsPolling(authResponse);\n              if (typeof this.params.onAuthorizationRequest === \"function\") {\n                await this.params.onAuthorizationRequest(\n                  authResponse,\n                  credentialsPromise\n                );\n              }\n              credentials = await credentialsPromise;\n            }\n\n            if (typeof credentials !== \"undefined\") {\n              this.credentialsStore.put(\n                credentialsNS,\n                \"credential\",\n                credentials\n              );\n            }\n\n            credentialsObtained = true;\n          }\n        } catch (err) {\n          const shouldInterrupt =\n            err instanceof AuthorizationPendingInterrupt ||\n            err instanceof AuthorizationPollingInterrupt;\n          if (shouldInterrupt) {\n            return this.handleAuthorizationInterrupts(err);\n          } else {\n            await this.deleteAuthRequest();\n            if (typeof this.params.onUnauthorized === \"function\") {\n              return this.params.onUnauthorized(err as Error, ...args);\n            } else {\n              return err;\n            }\n          }\n        }\n        if (credentialsObtained) {\n          await this.deleteAuthRequest();\n        }\n        storeValue.credentials = credentials;\n        return execute(...args);\n      });\n    };\n  }\n\n  private async getCredentials(\n    authResponse: DeviceAuthorizationResponse\n  ): Promise<TokenSet | undefined> {\n    //TODO: this is not supported neither by the OIDC client library\n    //      or the auth0 client.\n    const url = `https://${this.auth0.domain!}/oauth/token`;\n    const response = await fetch(url, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/x-www-form-urlencoded\",\n      },\n      body: new URLSearchParams({\n        grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        device_code: authResponse.deviceCode,\n        client_id: this.auth0.clientId!,\n      }),\n    });\n\n    if (!response.ok) {\n      if (response.headers.get(\"content-type\")?.includes(\"application/json\")) {\n        const { error, error_description } = await response.json();\n        if (error === \"authorization_pending\") {\n          throw new AuthorizationPendingInterrupt(\n            error_description,\n            authResponse\n          );\n        }\n        if (error === \"slow_down\") {\n          throw new AuthorizationPollingInterrupt(\n            error_description,\n            authResponse\n          );\n        }\n        if (error === \"expired_token\") {\n          throw new AuthorizationRequestExpiredInterrupt(\n            error_description,\n            authResponse\n          );\n        }\n        if (error === \"access_denied\") {\n          throw new AccessDeniedInterrupt(error_description, authResponse);\n        }\n        throw new Error(error_description);\n      }\n      const errText = await response.text();\n      throw new Error(`Failed to obtain tokens: ${errText}`);\n    }\n\n    const tr = await response.json();\n    const credentials = tokenSetFromTokenResponse(tr);\n\n    return credentials;\n  }\n\n  protected async getCredentialsPolling(\n    authResponse: DeviceAuthorizationResponse\n  ): Promise<TokenSet | undefined> {\n    let credentials: TokenSet | undefined = undefined;\n\n    do {\n      try {\n        credentials = await this.getCredentials(authResponse);\n      } catch (err) {\n        if (\n          err instanceof AuthorizationPendingInterrupt ||\n          err instanceof AuthorizationPollingInterrupt\n        ) {\n          await sleep((err.response.interval ?? 10) * 1000);\n        } else {\n          throw err;\n        }\n      }\n    } while (!credentials);\n\n    return credentials;\n  }\n\n  private getInstanceID(): string {\n    const props = {\n      auth0: this.auth0,\n      params: omit(this.params, [\"store\", \"onUnauthorized\"]),\n    };\n    const sh = stableHash(props);\n    return crypto.createHash(\"MD5\").update(sh).digest(\"hex\");\n  }\n\n  protected deleteAuthRequest() {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\"This method should be called from within a tool.\");\n    }\n    const authResponseNS = nsFromContext(\"tool-call\", store.context);\n    return this.authResponseStore.delete(authResponseNS, \"authResponse\");\n  }\n\n  protected handleAuthorizationInterrupts(\n    err: AuthorizationPendingInterrupt | AuthorizationPollingInterrupt\n  ) {\n    throw err;\n  }\n}\n"]}

package/dist/cjs/{TokenResponse.js → authorizers/device-authorizer/DeviceAuthorizerParams.js}

@@ -1,3 +1,3 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=TokenResponse.js.map
+//# sourceMappingURL=DeviceAuthorizerParams.js.map

package/dist/cjs/authorizers/device-authorizer/DeviceAuthorizerParams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeviceAuthorizerParams.js","sourceRoot":"","sources":["../../../../src/authorizers/device-authorizer/DeviceAuthorizerParams.ts"],"names":[],"mappings":"","sourcesContent":["import { TokenSet } from \"../../credentials\";\nimport { DeviceInterrupt } from \"../../interrupts/DeviceInterrupts\";\nimport { Store } from \"../../stores\";\nimport { AuthContext } from \"../context\";\nimport { OnAuthorizationRequest } from \"../types\";\nimport { DeviceAuthorizationResponse } from \"./DeviceAuthResponse\";\n\n/**\n * The parameters for the DeviceAuthorizer.\n */\nexport type DeviceAuthorizerParams<ToolExecuteArgs extends any[]> = {\n  /**\n   * The scopes to request.\n   */\n  scopes: string[];\n\n  /**\n   * The audience to request.\n   */\n  audience?: string;\n\n  /**\n   * The authorization response store.\n   * Allows to store the authorization response for resuming the tool execution\n   * after the interrupt.\n   */\n  store: Store;\n\n  /**\n   * AuthContext defines the scope of credential sharing:\n   * - \"tool-call\": Credentials are valid only for a single invocation of the tool.\n   * - \"tool\": Credentials are shared across multiple calls to the same tool within the same thread.\n   * - \"thread\": Credentials are shared across all tools using the same authorizer within the current thread.\n   * - \"agent\": Credentials are shared globally across all threads and tools in the agent.\n   *\n   * @default \"thread\"\n   */\n  credentialsContext?: AuthContext;\n\n  /**\n   * The behavior when the authorization request is made.\n   *\n   * - `block`: The tool execution is blocked until the user completes the authorization.\n   * - `interrupt`: The tool execution is interrupted until the user completes the authorization.\n   * - a callback: Same as \"block\" but give access to the auth request this allow you\n   *               to show the link/code and open the browser\n   *\n   * Defaults to `interrupt`.\n   * Note: The block mode is only useful for development purposes and should not be used in production.\n   */\n  onAuthorizationRequest?:\n    | OnAuthorizationRequest\n    | ((\n        authReq: DeviceAuthorizationResponse,\n        poll: Promise<TokenSet | undefined>\n      ) => Promise<void>);\n\n  /**\n   *\n   * A callback that is called when the authorization request is unsuccessful.\n   *\n   * @param err - The error that occurred.\n   * @param args - The tool execution arguments.\n   * @returns - The final response the tool will return.\n   */\n  onUnauthorized?: (\n    err: Error | DeviceInterrupt,\n    ...args: ToolExecuteArgs\n  ) => any;\n};\n\nexport type { DeviceAuthorizationResponse };\n"]}

package/dist/cjs/authorizers/device-authorizer/asyncLocalStorage.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDeviceAuthorizerCredentials = exports.asyncLocalStorage = void 0;
+const async_hooks_1 = require("async_hooks");
+exports.asyncLocalStorage = new async_hooks_1.AsyncLocalStorage();
+const getDeviceAuthorizerCredentials = () => {
+    const t = exports.asyncLocalStorage.getStore();
+    if (typeof t === "undefined") {
+        throw new Error("The tool must be wrapped with the withAsyncUserConfirmation function.");
+    }
+    return t.credentials;
+};
+exports.getDeviceAuthorizerCredentials = getDeviceAuthorizerCredentials;
+//# sourceMappingURL=asyncLocalStorage.js.map

package/dist/cjs/authorizers/device-authorizer/asyncLocalStorage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asyncLocalStorage.js","sourceRoot":"","sources":["../../../../src/authorizers/device-authorizer/asyncLocalStorage.ts"],"names":[],"mappings":";;;AAAA,6CAAgD;AAkBnC,QAAA,iBAAiB,GAAG,IAAI,+BAAiB,EAEnD,CAAC;AAEG,MAAM,8BAA8B,GAAG,GAAG,EAAE;IACjD,MAAM,CAAC,GAAG,yBAAiB,CAAC,QAAQ,EAAE,CAAC;IACvC,IAAI,OAAO,CAAC,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC,WAAW,CAAC;AACvB,CAAC,CAAC;AARW,QAAA,8BAA8B,kCAQzC","sourcesContent":["import { AsyncLocalStorage } from \"async_hooks\";\n\nimport { TokenSet } from \"../../credentials\";\n\nexport type AsyncStorageValue<TContext> = {\n  credentials?: TokenSet;\n\n  /**\n   * The tool execution context.\n   */\n  context: TContext;\n\n  /**\n   * The tool execution arguments.\n   */\n  args: any[];\n};\n\nexport const asyncLocalStorage = new AsyncLocalStorage<\n  AsyncStorageValue<any>\n>();\n\nexport const getDeviceAuthorizerCredentials = () => {\n  const t = asyncLocalStorage.getStore();\n  if (typeof t === \"undefined\") {\n    throw new Error(\n      \"The tool must be wrapped with the withAsyncUserConfirmation function.\"\n    );\n  }\n  return t.credentials;\n};\n"]}

package/dist/cjs/authorizers/device-authorizer/index.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceAuthorizerBase = exports.asyncLocalStorage = exports.getDeviceAuthorizerCredentials = void 0;
+var asyncLocalStorage_1 = require("./asyncLocalStorage");
+Object.defineProperty(exports, "getDeviceAuthorizerCredentials", { enumerable: true, get: function () { return asyncLocalStorage_1.getDeviceAuthorizerCredentials; } });
+Object.defineProperty(exports, "asyncLocalStorage", { enumerable: true, get: function () { return asyncLocalStorage_1.asyncLocalStorage; } });
+var DeviceAuthorizerBase_1 = require("./DeviceAuthorizerBase");
+Object.defineProperty(exports, "DeviceAuthorizerBase", { enumerable: true, get: function () { return DeviceAuthorizerBase_1.DeviceAuthorizerBase; } });
+//# sourceMappingURL=index.js.map

package/dist/cjs/authorizers/device-authorizer/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/authorizers/device-authorizer/index.ts"],"names":[],"mappings":";;;AAAA,yDAG6B;AAF3B,mIAAA,8BAA8B,OAAA;AAC9B,sHAAA,iBAAiB,OAAA;AAGnB,+DAA8D;AAArD,4HAAA,oBAAoB,OAAA","sourcesContent":["export {\n  getDeviceAuthorizerCredentials,\n  asyncLocalStorage,\n} from \"./asyncLocalStorage\";\n\nexport { DeviceAuthorizerBase } from \"./DeviceAuthorizerBase\";\n\nexport type {\n  DeviceAuthorizerParams,\n  DeviceAuthorizationResponse,\n} from \"./DeviceAuthorizerParams\";\n"]}

package/dist/cjs/authorizers/federated-connections/FederatedConnectionAuthorizerBase.js

@@ -0,0 +1,158 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FederatedConnectionAuthorizerBase = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+const stable_hash_1 = __importDefault(require("stable-hash"));
+const credentials_1 = require("../../credentials");
+const interrupts_1 = require("../../interrupts");
+const parameters_1 = require("../../parameters");
+const stores_1 = require("../../stores");
+const util_1 = require("../../util");
+const context_1 = require("../context");
+const types_1 = require("../types");
+const asyncLocalStorage_1 = require("./asyncLocalStorage");
+/**
+ * Requests authorization to a third party service via Federated Connection.
+ */
+class FederatedConnectionAuthorizerBase {
+    constructor(auth0, params) {
+        this.auth0 = types_1.Auth0ClientSchema.parse(auth0);
+        this.params = {
+            credentialsContext: "thread",
+            ...params,
+        };
+        const instanceID = this.getInstanceID();
+        this.credentialsStore = new stores_1.SubStore(params.store, {
+            baseNamespace: [instanceID, "Credentials"],
+            getTTL: (credentials) => credentials.expiresIn ? credentials.expiresIn * 1000 : undefined,
+        });
+        if (typeof params.refreshToken === "undefined" &&
+            typeof params.accessToken === "undefined") {
+            throw new Error("Either refreshToken or accessToken must be provided to initialize the Authorizer.");
+        }
+        if (typeof params.accessToken !== "undefined" &&
+            typeof params.refreshToken !== "undefined") {
+            throw new Error("Only one of refreshToken or accessToken can be provided to initialize the Authorizer.");
+        }
+    }
+    getInstanceID() {
+        const props = {
+            auth0: this.auth0,
+            params: (0, util_1.omit)(this.params, ["store", "refreshToken", "accessToken"]),
+        };
+        const sh = (0, stable_hash_1.default)(props);
+        return crypto_1.default.createHash("MD5").update(sh).digest("hex");
+    }
+    handleAuthorizationInterrupts(err) {
+        throw err;
+    }
+    validateToken(tokenResponse) {
+        var _a;
+        const store = asyncLocalStorage_1.asyncLocalStorage.getStore();
+        if (!store) {
+            throw new Error("The tool must be wrapped with the FederationConnectionAuthorizer.");
+        }
+        const { scopes, connection } = store;
+        if (!tokenResponse) {
+            throw new interrupts_1.FederatedConnectionInterrupt(`Authorization required to access the Federated Connection: ${this.params.connection}`, connection, scopes, scopes);
+        }
+        const currentScopes = ((_a = tokenResponse.scope) !== null && _a !== void 0 ? _a : "").split(" ");
+        const missingScopes = scopes.filter((s) => !currentScopes.includes(s));
+        store.currentScopes = currentScopes;
+        if (missingScopes.length > 0) {
+            throw new interrupts_1.FederatedConnectionInterrupt(`Authorization required to access the Federated Connection: ${this.params.connection}. Missing scopes: ${missingScopes.join(", ")}`, connection, scopes, [...currentScopes, ...scopes]);
+        }
+    }
+    async getAccessTokenImpl(...toolContext) {
+        const store = asyncLocalStorage_1.asyncLocalStorage.getStore();
+        if (!store) {
+            throw new Error("The tool must be wrapped with the FederationConnectionAuthorizer.");
+        }
+        const { connection } = store;
+        const subjectToken = await this.getRefreshToken(...toolContext);
+        if (!subjectToken) {
+            return;
+        }
+        const exchangeParams = {
+            grant_type: "urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token",
+            client_id: this.auth0.clientId,
+            client_secret: this.auth0.clientSecret,
+            subject_token_type: "urn:ietf:params:oauth:token-type:refresh_token",
+            subject_token: subjectToken,
+            connection: connection,
+            requested_token_type: "http://auth0.com/oauth/token-type/federated-connection-access-token",
+        };
+        const res = await fetch(`https://${this.auth0.domain}/oauth/token`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(exchangeParams),
+        });
+        if (!res.ok) {
+            return;
+        }
+        const tokenResponse = await res.json();
+        return tokenResponse;
+    }
+    async getAccessToken(...toolContext) {
+        let tokenResponse;
+        if (typeof this.params.refreshToken === "function") {
+            tokenResponse = await this.getAccessTokenImpl(...toolContext);
+        }
+        else {
+            tokenResponse = await (0, parameters_1.resolveParameter)(this.params.accessToken, toolContext);
+        }
+        this.validateToken(tokenResponse);
+        return (0, credentials_1.tokenSetFromTokenResponse)(tokenResponse);
+    }
+    async getRefreshToken(...toolContext) {
+        return await (0, parameters_1.resolveParameter)(this.params.refreshToken, toolContext);
+    }
+    /**
+     *
+     * Wraps the execute method of an AI tool to handle Federated Connections authorization.
+     *
+     * @param getContext - A function that returns the context of the tool execution.
+     * @param execute - The tool execute method.
+     * @returns The wrapped execute method.
+     */
+    protect(getContext, execute) {
+        return async (...args) => {
+            const context = getContext(...args);
+            const asyncStore = {
+                context: context,
+                scopes: this.params.scopes,
+                connection: this.params.connection,
+            };
+            if (asyncLocalStorage_1.asyncLocalStorage.getStore()) {
+                throw new Error("Cannot nest tool calls that require federated connection authorization.");
+            }
+            return asyncLocalStorage_1.asyncLocalStorage.run(asyncStore, async () => {
+                const credentialsNS = (0, context_1.nsFromContext)(this.params.credentialsContext, context);
+                try {
+                    let credentials = await this.credentialsStore.get(credentialsNS, "credential");
+                    if (!credentials) {
+                        credentials = await this.getAccessToken(...args);
+                        await this.credentialsStore.put(credentialsNS, "credential", credentials);
+                    }
+                    asyncStore.credentials = credentials;
+                    return await execute(...args);
+                }
+                catch (err) {
+                    if (err instanceof interrupts_1.FederatedConnectionError) {
+                        const interrupt = new interrupts_1.FederatedConnectionInterrupt(err.message, asyncStore.connection, asyncStore.scopes, asyncStore.scopes);
+                        return this.handleAuthorizationInterrupts(interrupt);
+                    }
+                    if (err instanceof interrupts_1.Auth0Interrupt) {
+                        return this.handleAuthorizationInterrupts(err);
+                    }
+                    throw err;
+                }
+            });
+        };
+    }
+}
+exports.FederatedConnectionAuthorizerBase = FederatedConnectionAuthorizerBase;
+//# sourceMappingURL=FederatedConnectionAuthorizerBase.js.map

package/dist/cjs/authorizers/federated-connections/FederatedConnectionAuthorizerBase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FederatedConnectionAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/federated-connections/FederatedConnectionAuthorizerBase.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AAC5B,8DAAqC;AAErC,mDAI2B;AAC3B,iDAI0B;AAC1B,iDAAoD;AACpD,yCAAwC;AACxC,qCAAiD;AACjD,wCAA0D;AAC1D,oCAAgE;AAChE,2DAA2E;AAG3E;;GAEG;AAEH,MAAa,iCAAiC;IAQ5C,YACE,KAAiC,EACjC,MAA4D;QAE5D,IAAI,CAAC,KAAK,GAAG,yBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB,EAAE,QAAQ;YAC5B,GAAG,MAAM;SACV,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAExC,IAAI,CAAC,gBAAgB,GAAG,IAAI,iBAAQ,CAAW,MAAM,CAAC,KAAK,EAAE;YAC3D,aAAa,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;YAC1C,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CACtB,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;QAEH,IACE,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW;YAC1C,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW,EACzC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QAED,IACE,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW;YACzC,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW,EAC1C,CAAC;YACD,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAA,WAAI,EAAC,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;SACpE,CAAC;QACF,MAAM,EAAE,GAAG,IAAA,qBAAU,EAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,gBAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAES,6BAA6B,CAAC,GAAmB;QACzD,MAAM,GAAG,CAAC;IACZ,CAAC;IAES,aAAa,CAAC,aAA6B;;QACnD,MAAM,KAAK,GAAG,qCAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAErC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,yCAA4B,CACpC,8DAA8D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EACtF,UAAU,EACV,MAAM,EACN,MAAM,CACP,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,MAAA,aAAa,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;QAEpC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,yCAA4B,CACpC,8DAA8D,IAAI,CAAC,MAAM,CAAC,UAAU,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACnI,UAAU,EACV,MAAM,EACN,CAAC,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC,CAC9B,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,GAAG,WAA4B;QAE/B,MAAM,KAAK,GAAG,qCAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAE7B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC,CAAC;QAEhE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG;YACrB,UAAU,EACR,oFAAoF;YACtF,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;YAC9B,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;YACtC,kBAAkB,EAAE,gDAAgD;YACpE,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,UAAU;YACtB,oBAAoB,EAClB,qEAAqE;SACxE,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,cAAc,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAkB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,aAAa,CAAC;IACvB,CAAC;IAES,KAAK,CAAC,cAAc,CAC5B,GAAG,WAA4B;QAE/B,IAAI,aAAwC,CAAC;QAC7C,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACnD,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,WAAW,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,MAAM,IAAA,6BAAgB,EACpC,IAAI,CAAC,MAAM,CAAC,WAAY,EACxB,WAAW,CACZ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAClC,OAAO,IAAA,uCAAyB,EAAC,aAAc,CAAC,CAAC;IACnD,CAAC;IAES,KAAK,CAAC,eAAe,CAAC,GAAG,WAA4B;QAC7D,OAAO,MAAM,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA0C,EAC1C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YACpC,MAAM,UAAU,GAAsB;gBACpC,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;aACnC,CAAC;YAEF,IAAI,qCAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;YACJ,CAAC;YAED,OAAO,qCAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;gBAClD,MAAM,aAAa,GAAG,IAAA,uBAAa,EACjC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAC9B,OAAO,CACR,CAAC;gBACF,IAAI,CAAC;oBACH,IAAI,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAC/C,aAAa,EACb,YAAY,CACb,CAAC;oBACF,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;wBACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAC7B,aAAa,EACb,YAAY,EACZ,WAAW,CACZ,CAAC;oBACJ,CAAC;oBACD,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;oBACrC,OAAO,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,qCAAwB,EAAE,CAAC;wBAC5C,MAAM,SAAS,GAAG,IAAI,yCAA4B,CAChD,GAAG,CAAC,OAAO,EACX,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,MAAM,CAClB,CAAC;wBACF,OAAO,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC;oBACvD,CAAC;oBACD,IAAI,GAAG,YAAY,2BAAc,EAAE,CAAC;wBAClC,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;CACF;AA3ND,8EA2NC","sourcesContent":["import crypto from \"crypto\";\nimport stableHash from \"stable-hash\";\n\nimport {\n  TokenResponse,\n  TokenSet,\n  tokenSetFromTokenResponse,\n} from \"../../credentials\";\nimport {\n  Auth0Interrupt,\n  FederatedConnectionError,\n  FederatedConnectionInterrupt,\n} from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { SubStore } from \"../../stores\";\nimport { omit, RequireFields } from \"../../util\";\nimport { ContextGetter, nsFromContext } from \"../context\";\nimport { Auth0ClientParams, Auth0ClientSchema } from \"../types\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport { FederatedConnectionAuthorizerParams } from \"./FederatedConnectionAuthorizerParams\";\n\n/**\n * Requests authorization to a third party service via Federated Connection.\n */\n\nexport class FederatedConnectionAuthorizerBase<ToolExecuteArgs extends any[]> {\n  private readonly auth0: Auth0ClientParams;\n  private readonly params: RequireFields<\n    FederatedConnectionAuthorizerParams<ToolExecuteArgs>,\n    \"credentialsContext\"\n  >;\n  private readonly credentialsStore: SubStore<TokenSet>;\n\n  constructor(\n    auth0: Partial<Auth0ClientParams>,\n    params: FederatedConnectionAuthorizerParams<ToolExecuteArgs>\n  ) {\n    this.auth0 = Auth0ClientSchema.parse(auth0);\n    this.params = {\n      credentialsContext: \"thread\",\n      ...params,\n    };\n\n    const instanceID = this.getInstanceID();\n\n    this.credentialsStore = new SubStore<TokenSet>(params.store, {\n      baseNamespace: [instanceID, \"Credentials\"],\n      getTTL: (credentials) =>\n        credentials.expiresIn ? credentials.expiresIn * 1000 : undefined,\n    });\n\n    if (\n      typeof params.refreshToken === \"undefined\" &&\n      typeof params.accessToken === \"undefined\"\n    ) {\n      throw new Error(\n        \"Either refreshToken or accessToken must be provided to initialize the Authorizer.\"\n      );\n    }\n\n    if (\n      typeof params.accessToken !== \"undefined\" &&\n      typeof params.refreshToken !== \"undefined\"\n    ) {\n      throw new Error(\n        \"Only one of refreshToken or accessToken can be provided to initialize the Authorizer.\"\n      );\n    }\n  }\n\n  private getInstanceID(): string {\n    const props = {\n      auth0: this.auth0,\n      params: omit(this.params, [\"store\", \"refreshToken\", \"accessToken\"]),\n    };\n    const sh = stableHash(props);\n    return crypto.createHash(\"MD5\").update(sh).digest(\"hex\");\n  }\n\n  protected handleAuthorizationInterrupts(err: Auth0Interrupt) {\n    throw err;\n  }\n\n  protected validateToken(tokenResponse?: TokenResponse) {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\n        \"The tool must be wrapped with the FederationConnectionAuthorizer.\"\n      );\n    }\n\n    const { scopes, connection } = store;\n\n    if (!tokenResponse) {\n      throw new FederatedConnectionInterrupt(\n        `Authorization required to access the Federated Connection: ${this.params.connection}`,\n        connection,\n        scopes,\n        scopes\n      );\n    }\n\n    const currentScopes = (tokenResponse.scope ?? \"\").split(\" \");\n    const missingScopes = scopes.filter((s) => !currentScopes.includes(s));\n    store.currentScopes = currentScopes;\n\n    if (missingScopes.length > 0) {\n      throw new FederatedConnectionInterrupt(\n        `Authorization required to access the Federated Connection: ${this.params.connection}. Missing scopes: ${missingScopes.join(\", \")}`,\n        connection,\n        scopes,\n        [...currentScopes, ...scopes]\n      );\n    }\n  }\n\n  private async getAccessTokenImpl(\n    ...toolContext: ToolExecuteArgs\n  ): Promise<TokenResponse | undefined> {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\n        \"The tool must be wrapped with the FederationConnectionAuthorizer.\"\n      );\n    }\n\n    const { connection } = store;\n\n    const subjectToken = await this.getRefreshToken(...toolContext);\n\n    if (!subjectToken) {\n      return;\n    }\n\n    const exchangeParams = {\n      grant_type:\n        \"urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token\",\n      client_id: this.auth0.clientId,\n      client_secret: this.auth0.clientSecret,\n      subject_token_type: \"urn:ietf:params:oauth:token-type:refresh_token\",\n      subject_token: subjectToken,\n      connection: connection,\n      requested_token_type:\n        \"http://auth0.com/oauth/token-type/federated-connection-access-token\",\n    };\n\n    const res = await fetch(`https://${this.auth0.domain}/oauth/token`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(exchangeParams),\n    });\n\n    if (!res.ok) {\n      return;\n    }\n\n    const tokenResponse: TokenResponse = await res.json();\n    return tokenResponse;\n  }\n\n  protected async getAccessToken(\n    ...toolContext: ToolExecuteArgs\n  ): Promise<TokenSet> {\n    let tokenResponse: TokenResponse | undefined;\n    if (typeof this.params.refreshToken === \"function\") {\n      tokenResponse = await this.getAccessTokenImpl(...toolContext);\n    } else {\n      tokenResponse = await resolveParameter(\n        this.params.accessToken!,\n        toolContext\n      );\n    }\n    this.validateToken(tokenResponse);\n    return tokenSetFromTokenResponse(tokenResponse!);\n  }\n\n  protected async getRefreshToken(...toolContext: ToolExecuteArgs) {\n    return await resolveParameter(this.params.refreshToken, toolContext);\n  }\n\n  /**\n   *\n   * Wraps the execute method of an AI tool to handle Federated Connections authorization.\n   *\n   * @param getContext - A function that returns the context of the tool execution.\n   * @param execute - The tool execute method.\n   * @returns The wrapped execute method.\n   */\n  protect(\n    getContext: ContextGetter<ToolExecuteArgs>,\n    execute: (...args: ToolExecuteArgs) => any\n  ): (...args: ToolExecuteArgs) => any {\n    return async (...args: ToolExecuteArgs) => {\n      const context = getContext(...args);\n      const asyncStore: AsyncStorageValue = {\n        context: context,\n        scopes: this.params.scopes,\n        connection: this.params.connection,\n      };\n\n      if (asyncLocalStorage.getStore()) {\n        throw new Error(\n          \"Cannot nest tool calls that require federated connection authorization.\"\n        );\n      }\n\n      return asyncLocalStorage.run(asyncStore, async () => {\n        const credentialsNS = nsFromContext(\n          this.params.credentialsContext,\n          context\n        );\n        try {\n          let credentials = await this.credentialsStore.get(\n            credentialsNS,\n            \"credential\"\n          );\n          if (!credentials) {\n            credentials = await this.getAccessToken(...args);\n            await this.credentialsStore.put(\n              credentialsNS,\n              \"credential\",\n              credentials\n            );\n          }\n          asyncStore.credentials = credentials;\n          return await execute(...args);\n        } catch (err) {\n          if (err instanceof FederatedConnectionError) {\n            const interrupt = new FederatedConnectionInterrupt(\n              err.message,\n              asyncStore.connection,\n              asyncStore.scopes,\n              asyncStore.scopes\n            );\n            return this.handleAuthorizationInterrupts(interrupt);\n          }\n          if (err instanceof Auth0Interrupt) {\n            return this.handleAuthorizationInterrupts(err);\n          }\n          throw err;\n        }\n      });\n    };\n  }\n}\n"]}

package/dist/cjs/authorizers/federated-connections/FederatedConnectionAuthorizerParams.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=FederatedConnectionAuthorizerParams.js.map

package/dist/cjs/authorizers/federated-connections/FederatedConnectionAuthorizerParams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FederatedConnectionAuthorizerParams.js","sourceRoot":"","sources":["../../../../src/authorizers/federated-connections/FederatedConnectionAuthorizerParams.ts"],"names":[],"mappings":"","sourcesContent":["import { TokenResponse } from \"../../credentials\";\nimport { AuthorizerToolParameter } from \"../../parameters\";\nimport { Store } from \"../../stores\";\nimport { AuthContext } from \"../context\";\n\nexport type FederatedConnectionAuthorizerParams<ToolExecuteArgs extends any[]> =\n  {\n    /**\n     * The Auth0 refresh token to exchange for an Federated Connection access token.\n     */\n    refreshToken?: AuthorizerToolParameter<ToolExecuteArgs, string | undefined>;\n\n    /**\n     * The Federated connection access token if available in the tool context.\n     */\n    accessToken?: AuthorizerToolParameter<\n      ToolExecuteArgs,\n      TokenResponse | undefined\n    >;\n\n    /**\n     * The scopes required in the access token of the federated connection provider.\n     */\n    scopes: string[];\n\n    /**\n     * The connection name of the federated connection provider.\n     */\n    connection: string;\n\n    /**\n     * AuthContext defines the scope of credential sharing:\n     * - \"tool-call\": Credentials are valid only for a single invocation of the tool.\n     * - \"tool\": Credentials are shared across multiple calls to the same tool within the same thread.\n     * - \"thread\": Credentials are shared across all tools using the same authorizer within the current thread.\n     * - \"agent\": Credentials are shared globally across all threads and tools in the agent.\n     *\n     * @default \"thread\"\n     */\n    credentialsContext?: AuthContext;\n\n    /**\n     * An store used to store the authorization credentials according\n     * to the `credentialsContext` scope.\n     */\n    store: Store;\n  };\n"]}

package/dist/cjs/authorizers/federated-connections/asyncLocalStorage.js

@@ -1,14 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getAccessTokenForConnection = exports.asyncLocalStorage = void 0;
+exports.getCredentialsForConnection = exports.asyncLocalStorage = void 0;
 const node_async_hooks_1 = require("node:async_hooks");
 exports.asyncLocalStorage = new node_async_hooks_1.AsyncLocalStorage();
-const getAccessTokenForConnection = () => {
+const getCredentialsForConnection = () => {
     const store = exports.asyncLocalStorage.getStore();
     if (typeof store === "undefined") {
-        throw new Error("The tool must be wrapped with the withFederatedConnections function.");
+        throw new Error("The tool must be wrapped with the withTokenForConnections function.");
     }
-    return store === null || store === void 0 ? void 0 : store.accessToken;
+    return store === null || store === void 0 ? void 0 : store.credentials;
 };
-exports.getAccessTokenForConnection = getAccessTokenForConnection;
+exports.getCredentialsForConnection = getCredentialsForConnection;
 //# sourceMappingURL=asyncLocalStorage.js.map

package/dist/cjs/authorizers/federated-connections/asyncLocalStorage.js.map

@@ -1 +1 @@
-{"version":3,"file":"asyncLocalStorage.js","sourceRoot":"","sources":["../../../../src/authorizers/federated-connections/asyncLocalStorage.ts"],"names":[],"mappings":";;;AAAA,uDAAqD;AA6BxC,QAAA,iBAAiB,GAAG,IAAI,oCAAiB,EAEnD,CAAC;AAEG,MAAM,2BAA2B,GAAG,GAAG,EAAE;IAC9C,MAAM,KAAK,GAAG,yBAAiB,CAAC,QAAQ,EAAE,CAAC;IAC3C,IAAI,OAAO,KAAK,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,WAAW,CAAC;AAC5B,CAAC,CAAC;AARW,QAAA,2BAA2B,+BAQtC","sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\n\nexport type AsyncStorageValue<TContext> = {\n  /**\n   * The Federated Connection access token.\n   */\n  accessToken?: string;\n\n  /**\n   * The tool execution context.\n   */\n  context: TContext;\n\n  /**\n   * The federated connection name.\n   */\n  connection: string;\n\n  /**\n   * The scopes required to access the federated connection.\n   */\n  scopes: string[];\n\n  /**\n   * The scopes that the current access token has.\n   */\n  currentScopes?: string[];\n};\n\nexport const asyncLocalStorage = new AsyncLocalStorage<\n  AsyncStorageValue<any>\n>();\n\nexport const getAccessTokenForConnection = () => {\n  const store = asyncLocalStorage.getStore();\n  if (typeof store === \"undefined\") {\n    throw new Error(\n      \"The tool must be wrapped with the withFederatedConnections function.\"\n    );\n  }\n  return store?.accessToken;\n};\n"]}
+{"version":3,"file":"asyncLocalStorage.js","sourceRoot":"","sources":["../../../../src/authorizers/federated-connections/asyncLocalStorage.ts"],"names":[],"mappings":";;;AAAA,uDAAqD;AAgCxC,QAAA,iBAAiB,GAAG,IAAI,oCAAiB,EAAqB,CAAC;AAErE,MAAM,2BAA2B,GAAG,GAAG,EAAE;IAC9C,MAAM,KAAK,GAAG,yBAAiB,CAAC,QAAQ,EAAE,CAAC;IAC3C,IAAI,OAAO,KAAK,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,WAAW,CAAC;AAC5B,CAAC,CAAC;AARW,QAAA,2BAA2B,+BAQtC","sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\n\nimport { TokenSet } from \"../../credentials\";\nimport { ToolCallContext } from \"../context\";\n\nexport type AsyncStorageValue = {\n  /**\n   * The Federated Connection access token.\n   */\n  credentials?: TokenSet;\n\n  /**\n   * The tool execution context.\n   */\n  context: ToolCallContext;\n\n  /**\n   * The federated connection name.\n   */\n  connection: string;\n\n  /**\n   * The scopes required to access the federated connection.\n   */\n  scopes: string[];\n\n  /**\n   * The scopes that the current access token has.\n   */\n  currentScopes?: string[];\n};\n\nexport const asyncLocalStorage = new AsyncLocalStorage<AsyncStorageValue>();\n\nexport const getCredentialsForConnection = () => {\n  const store = asyncLocalStorage.getStore();\n  if (typeof store === \"undefined\") {\n    throw new Error(\n      \"The tool must be wrapped with the withTokenForConnections function.\"\n    );\n  }\n  return store?.credentials;\n};\n"]}

package/dist/cjs/authorizers/federated-connections/index.js

@@ -1,129 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FederatedConnectionAuthorizerBase = exports.getAccessTokenForConnection = exports.asyncLocalStorage = void 0;
-const interrupts_1 = require("../../interrupts");
-const parameters_1 = require("../../parameters");
-const asyncLocalStorage_1 = require("./asyncLocalStorage");
-var asyncLocalStorage_2 = require("./asyncLocalStorage");
-Object.defineProperty(exports, "asyncLocalStorage", { enumerable: true, get: function () { return asyncLocalStorage_2.asyncLocalStorage; } });
-Object.defineProperty(exports, "getAccessTokenForConnection", { enumerable: true, get: function () { return asyncLocalStorage_2.getAccessTokenForConnection; } });
-/**
- * Requests authorization to a third party service via Federated Connection.
- */
-class FederatedConnectionAuthorizerBase {
-    constructor(auth0, params) {
-        this.auth0 = auth0;
-        this.params = params;
-        if (typeof params.refreshToken === "undefined" &&
-            typeof params.accessToken === "undefined") {
-            throw new Error("Either refreshToken or accessToken must be provided to initialize the Authorizer.");
-        }
-        if (typeof params.accessToken !== "undefined" &&
-            typeof params.refreshToken !== "undefined") {
-            throw new Error("Only one of refreshToken or accessToken can be provided to initialize the Authorizer.");
-        }
-    }
-    handleAuthorizationInterrupts(err) {
-        throw err;
-    }
-    validateToken(tokenResponse) {
-        var _a;
-        const store = asyncLocalStorage_1.asyncLocalStorage.getStore();
-        if (!store) {
-            throw new Error("The tool must be wrapped with the FederationConnectionAuthorizer.");
-        }
-        const { scopes, connection } = store;
-        if (!tokenResponse) {
-            throw new interrupts_1.FederatedConnectionInterrupt(`Authorization required to access the Federated Connection: ${this.params.connection}`, connection, scopes, scopes);
-        }
-        const currentScopes = ((_a = tokenResponse.scope) !== null && _a !== void 0 ? _a : "").split(" ");
-        const missingScopes = scopes.filter((s) => !currentScopes.includes(s));
-        store.currentScopes = currentScopes;
-        if (missingScopes.length > 0) {
-            throw new interrupts_1.FederatedConnectionInterrupt(`Authorization required to access the Federated Connection: ${this.params.connection}. Missing scopes: ${missingScopes.join(", ")}`, connection, scopes, [...currentScopes, ...scopes]);
-        }
-    }
-    async getAccessTokenImpl(...toolContext) {
-        const store = asyncLocalStorage_1.asyncLocalStorage.getStore();
-        if (!store) {
-            throw new Error("The tool must be wrapped with the FederationConnectionAuthorizer.");
-        }
-        const { connection } = store;
-        const subjectToken = await this.getRefreshToken(...toolContext);
-        if (!subjectToken) {
-            return;
-        }
-        const exchangeParams = {
-            grant_type: "urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token",
-            client_id: this.auth0.clientId,
-            client_secret: this.auth0.clientSecret,
-            subject_token_type: "urn:ietf:params:oauth:token-type:refresh_token",
-            subject_token: subjectToken,
-            connection: connection,
-            requested_token_type: "http://auth0.com/oauth/token-type/federated-connection-access-token",
-        };
-        const res = await fetch(`https://${this.auth0.domain}/oauth/token`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify(exchangeParams),
-        });
-        if (!res.ok) {
-            return;
-        }
-        const tokenResponse = await res.json();
-        return tokenResponse;
-    }
-    async getAccessToken(...toolContext) {
-        let tokenResponse;
-        if (typeof this.params.refreshToken === "function") {
-            tokenResponse = await this.getAccessTokenImpl(...toolContext);
-        }
-        else {
-            tokenResponse = await (0, parameters_1.resolveParameter)(this.params.accessToken, toolContext);
-        }
-        this.validateToken(tokenResponse);
-        return tokenResponse;
-    }
-    async getRefreshToken(...toolContext) {
-        return await (0, parameters_1.resolveParameter)(this.params.refreshToken, toolContext);
-    }
-    /**
-     *
-     * Wraps the execute method of an AI tool to handle Federated Connections authorization.
-     *
-     * @param getContext - A function that returns the context of the tool execution.
-     * @param execute - The tool execute method.
-     * @returns The wrapped execute method.
-     */
-    protect(getContext, execute) {
-        return async (...args) => {
-            const asyncStore = {
-                context: await getContext(...args),
-                scopes: await (0, parameters_1.resolveParameter)(this.params.scopes, args),
-                connection: await (0, parameters_1.resolveParameter)(this.params.connection, args),
-            };
-            if (asyncLocalStorage_1.asyncLocalStorage.getStore()) {
-                throw new Error("Cannot nest tool calls that require federated connection authorization.");
-            }
-            return asyncLocalStorage_1.asyncLocalStorage.run(asyncStore, async () => {
-                try {
-                    const tokenResponse = await this.getAccessToken(...args);
-                    asyncStore.accessToken = tokenResponse.access_token;
-                    return await execute(...args);
-                }
-                catch (err) {
-                    if (err instanceof interrupts_1.FederatedConnectionError) {
-                        const interrupt = new interrupts_1.FederatedConnectionInterrupt(err.message, asyncStore.connection, asyncStore.scopes, asyncStore.scopes);
-                        return this.handleAuthorizationInterrupts(interrupt);
-                    }
-                    if (err instanceof interrupts_1.Auth0Interrupt) {
-                        return this.handleAuthorizationInterrupts(err);
-                    }
-                    throw err;
-                }
-            });
-        };
-    }
-}
-exports.FederatedConnectionAuthorizerBase = FederatedConnectionAuthorizerBase;
+var asyncLocalStorage_1 = require("./asyncLocalStorage");
+Object.defineProperty(exports, "asyncLocalStorage", { enumerable: true, get: function () { return asyncLocalStorage_1.asyncLocalStorage; } });
+Object.defineProperty(exports, "getAccessTokenForConnection", { enumerable: true, get: function () { return asyncLocalStorage_1.getCredentialsForConnection; } });
+var FederatedConnectionAuthorizerBase_1 = require("./FederatedConnectionAuthorizerBase");
+Object.defineProperty(exports, "FederatedConnectionAuthorizerBase", { enumerable: true, get: function () { return FederatedConnectionAuthorizerBase_1.FederatedConnectionAuthorizerBase; } });
 //# sourceMappingURL=index.js.map

package/dist/cjs/authorizers/federated-connections/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/authorizers/federated-connections/index.ts"],"names":[],"mappings":";;;AAAA,iDAI0B;AAC1B,iDAA6E;AAE7E,2DAA2E;AAI3E,yDAG6B;AAF3B,sHAAA,iBAAiB,OAAA;AACjB,gIAAA,2BAA2B,OAAA;AAc7B;;GAEG;AACH,MAAa,iCAAiC;IAC5C,YACmB,KAIhB,EACO,MAA4D;QALnD,UAAK,GAAL,KAAK,CAIrB;QACO,WAAM,GAAN,MAAM,CAAsD;QAEpE,IACE,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW;YAC1C,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW,EACzC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QAED,IACE,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW;YACzC,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW,EAC1C,CAAC;YACD,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAES,6BAA6B,CAAC,GAAmB;QACzD,MAAM,GAAG,CAAC;IACZ,CAAC;IAES,aAAa,CAAC,aAA6B;;QACnD,MAAM,KAAK,GAAG,qCAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAErC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,yCAA4B,CACpC,8DAA8D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EACtF,UAAU,EACV,MAAM,EACN,MAAM,CACP,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,MAAA,aAAa,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;QAEpC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,yCAA4B,CACpC,8DACE,IAAI,CAAC,MAAM,CAAC,UACd,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC/C,UAAU,EACV,MAAM,EACN,CAAC,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC,CAC9B,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,GAAG,WAA4B;QAE/B,MAAM,KAAK,GAAG,qCAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAE7B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC,CAAC;QAEhE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG;YACrB,UAAU,EACR,oFAAoF;YACtF,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;YAC9B,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;YACtC,kBAAkB,EAAE,gDAAgD;YACpE,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,UAAU;YACtB,oBAAoB,EAClB,qEAAqE;SACxE,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,cAAc,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAkB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,aAAa,CAAC;IACvB,CAAC;IAES,KAAK,CAAC,cAAc,CAC5B,GAAG,WAA4B;QAE/B,IAAI,aAAwC,CAAC;QAC7C,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACnD,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,WAAW,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,MAAM,IAAA,6BAAgB,EACpC,IAAI,CAAC,MAAM,CAAC,WAAY,EACxB,WAAW,CACZ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAClC,OAAO,aAAa,CAAC;IACvB,CAAC;IAES,KAAK,CAAC,eAAe,CAAC,GAAG,WAA4B;QAC7D,OAAO,MAAM,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA6C,EAC7C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,MAAM,UAAU,GAA2B;gBACzC,OAAO,EAAE,MAAM,UAAU,CAAC,GAAG,IAAI,CAAC;gBAClC,MAAM,EAAE,MAAM,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;gBACxD,UAAU,EAAE,MAAM,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC;aACjE,CAAC;YAEF,IAAI,qCAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;YACJ,CAAC;YAED,OAAO,qCAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;gBAClD,IAAI,CAAC;oBACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;oBACzD,UAAU,CAAC,WAAW,GAAG,aAAc,CAAC,YAAY,CAAC;oBACrD,OAAO,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,qCAAwB,EAAE,CAAC;wBAC5C,MAAM,SAAS,GAAG,IAAI,yCAA4B,CAChD,GAAG,CAAC,OAAO,EACX,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,MAAM,CAClB,CAAC;wBACF,OAAO,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC;oBACvD,CAAC;oBACD,IAAI,GAAG,YAAY,2BAAc,EAAE,CAAC;wBAClC,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;CACF;AAnLD,8EAmLC","sourcesContent":["import {\n  Auth0Interrupt,\n  FederatedConnectionError,\n  FederatedConnectionInterrupt,\n} from \"../../interrupts\";\nimport { AuthorizerToolParameter, resolveParameter } from \"../../parameters\";\nimport { TokenResponse } from \"../../TokenResponse\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\n\nexport type { AsyncStorageValue } from \"./asyncLocalStorage\";\n\nexport {\n  asyncLocalStorage,\n  getAccessTokenForConnection,\n} from \"./asyncLocalStorage\";\n\nexport type FederatedConnectionAuthorizerParams<ToolExecuteArgs extends any[]> =\n  {\n    refreshToken?: AuthorizerToolParameter<ToolExecuteArgs, string | undefined>;\n    accessToken?: AuthorizerToolParameter<\n      ToolExecuteArgs,\n      TokenResponse | undefined\n    >;\n    scopes: AuthorizerToolParameter<ToolExecuteArgs, string[]>;\n    connection: AuthorizerToolParameter<ToolExecuteArgs, string>;\n  };\n\n/**\n * Requests authorization to a third party service via Federated Connection.\n */\nexport class FederatedConnectionAuthorizerBase<ToolExecuteArgs extends any[]> {\n  constructor(\n    private readonly auth0: {\n      domain: string;\n      clientId: string;\n      clientSecret: string | undefined;\n    },\n    private params: FederatedConnectionAuthorizerParams<ToolExecuteArgs>\n  ) {\n    if (\n      typeof params.refreshToken === \"undefined\" &&\n      typeof params.accessToken === \"undefined\"\n    ) {\n      throw new Error(\n        \"Either refreshToken or accessToken must be provided to initialize the Authorizer.\"\n      );\n    }\n\n    if (\n      typeof params.accessToken !== \"undefined\" &&\n      typeof params.refreshToken !== \"undefined\"\n    ) {\n      throw new Error(\n        \"Only one of refreshToken or accessToken can be provided to initialize the Authorizer.\"\n      );\n    }\n  }\n\n  protected handleAuthorizationInterrupts(err: Auth0Interrupt) {\n    throw err;\n  }\n\n  protected validateToken(tokenResponse?: TokenResponse) {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\n        \"The tool must be wrapped with the FederationConnectionAuthorizer.\"\n      );\n    }\n\n    const { scopes, connection } = store;\n\n    if (!tokenResponse) {\n      throw new FederatedConnectionInterrupt(\n        `Authorization required to access the Federated Connection: ${this.params.connection}`,\n        connection,\n        scopes,\n        scopes\n      );\n    }\n\n    const currentScopes = (tokenResponse.scope ?? \"\").split(\" \");\n    const missingScopes = scopes.filter((s) => !currentScopes.includes(s));\n    store.currentScopes = currentScopes;\n\n    if (missingScopes.length > 0) {\n      throw new FederatedConnectionInterrupt(\n        `Authorization required to access the Federated Connection: ${\n          this.params.connection\n        }. Missing scopes: ${missingScopes.join(\", \")}`,\n        connection,\n        scopes,\n        [...currentScopes, ...scopes]\n      );\n    }\n  }\n\n  private async getAccessTokenImpl(\n    ...toolContext: ToolExecuteArgs\n  ): Promise<TokenResponse | undefined> {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\n        \"The tool must be wrapped with the FederationConnectionAuthorizer.\"\n      );\n    }\n\n    const { connection } = store;\n\n    const subjectToken = await this.getRefreshToken(...toolContext);\n\n    if (!subjectToken) {\n      return;\n    }\n\n    const exchangeParams = {\n      grant_type:\n        \"urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token\",\n      client_id: this.auth0.clientId,\n      client_secret: this.auth0.clientSecret,\n      subject_token_type: \"urn:ietf:params:oauth:token-type:refresh_token\",\n      subject_token: subjectToken,\n      connection: connection,\n      requested_token_type:\n        \"http://auth0.com/oauth/token-type/federated-connection-access-token\",\n    };\n\n    const res = await fetch(`https://${this.auth0.domain}/oauth/token`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(exchangeParams),\n    });\n\n    if (!res.ok) {\n      return;\n    }\n\n    const tokenResponse: TokenResponse = await res.json();\n    return tokenResponse;\n  }\n\n  protected async getAccessToken(\n    ...toolContext: ToolExecuteArgs\n  ): Promise<TokenResponse | undefined> {\n    let tokenResponse: TokenResponse | undefined;\n    if (typeof this.params.refreshToken === \"function\") {\n      tokenResponse = await this.getAccessTokenImpl(...toolContext);\n    } else {\n      tokenResponse = await resolveParameter(\n        this.params.accessToken!,\n        toolContext\n      );\n    }\n    this.validateToken(tokenResponse);\n    return tokenResponse;\n  }\n\n  protected async getRefreshToken(...toolContext: ToolExecuteArgs) {\n    return await resolveParameter(this.params.refreshToken, toolContext);\n  }\n\n  /**\n   *\n   * Wraps the execute method of an AI tool to handle Federated Connections authorization.\n   *\n   * @param getContext - A function that returns the context of the tool execution.\n   * @param execute - The tool execute method.\n   * @returns The wrapped execute method.\n   */\n  protect(\n    getContext: (...args: ToolExecuteArgs) => any,\n    execute: (...args: ToolExecuteArgs) => any\n  ): (...args: ToolExecuteArgs) => any {\n    return async (...args: ToolExecuteArgs) => {\n      const asyncStore: AsyncStorageValue<any> = {\n        context: await getContext(...args),\n        scopes: await resolveParameter(this.params.scopes, args),\n        connection: await resolveParameter(this.params.connection, args),\n      };\n\n      if (asyncLocalStorage.getStore()) {\n        throw new Error(\n          \"Cannot nest tool calls that require federated connection authorization.\"\n        );\n      }\n\n      return asyncLocalStorage.run(asyncStore, async () => {\n        try {\n          const tokenResponse = await this.getAccessToken(...args);\n          asyncStore.accessToken = tokenResponse!.access_token;\n          return await execute(...args);\n        } catch (err) {\n          if (err instanceof FederatedConnectionError) {\n            const interrupt = new FederatedConnectionInterrupt(\n              err.message,\n              asyncStore.connection,\n              asyncStore.scopes,\n              asyncStore.scopes\n            );\n            return this.handleAuthorizationInterrupts(interrupt);\n          }\n          if (err instanceof Auth0Interrupt) {\n            return this.handleAuthorizationInterrupts(err);\n          }\n          throw err;\n        }\n      });\n    };\n  }\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/authorizers/federated-connections/index.ts"],"names":[],"mappings":";;;AAEA,yDAG6B;AAF3B,sHAAA,iBAAiB,OAAA;AACjB,gIAAA,2BAA2B,OAA+B;AAG5D,yFAAwF;AAA/E,sJAAA,iCAAiC,OAAA","sourcesContent":["export type { AsyncStorageValue } from \"./asyncLocalStorage\";\n\nexport {\n  asyncLocalStorage,\n  getCredentialsForConnection as getAccessTokenForConnection,\n} from \"./asyncLocalStorage\";\n\nexport { FederatedConnectionAuthorizerBase } from \"./FederatedConnectionAuthorizerBase\";\n\nexport type { FederatedConnectionAuthorizerParams } from \"./FederatedConnectionAuthorizerParams\";\n"]}

package/dist/cjs/authorizers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authorizers/index.ts"],"names":[],"mappings":"","sourcesContent":["import { AuthenticationClientOptions } from \"auth0\";\nimport * as jose from \"jose\";\n\nexport type AuthParams = {\n  allowed?: boolean;\n  accessToken?: string;\n  claims?: jose.JWTPayload;\n};\n\nexport type ToolWithAuthHandler<I, O, C> = (\n  authParams: AuthParams,\n  input: I,\n  config?: C\n) => Promise<O>;\n\nexport type AuthorizerParams = Omit<\n  AuthenticationClientOptions,\n  \"domain\" | \"clientId\"\n> & {\n  domain?: string;\n  clientId?: string;\n};\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authorizers/index.ts"],"names":[],"mappings":"","sourcesContent":["export type { ContextGetter } from \"./context\";\n"]}

package/dist/cjs/authorizers/types.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Auth0PublicClientSchema = exports.Auth0ClientSchema = void 0;
+const zod_1 = require("zod");
+exports.Auth0ClientSchema = zod_1.z.object({
+    domain: zod_1.z.string().default(() => process.env.AUTH0_DOMAIN),
+    clientId: zod_1.z.string().default(() => process.env.AUTH0_CLIENT_ID),
+    clientSecret: zod_1.z.string().default(() => process.env.AUTH0_CLIENT_SECRET),
+});
+exports.Auth0PublicClientSchema = zod_1.z.object({
+    domain: zod_1.z.string().default(() => process.env.AUTH0_DOMAIN),
+    clientId: zod_1.z.string().default(() => process.env.AUTH0_CLIENT_ID),
+});
+//# sourceMappingURL=types.js.map

package/dist/cjs/authorizers/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/authorizers/types.ts"],"names":[],"mappings":";;;AAEA,6BAAwB;AAcX,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,YAAa,CAAC;IAC3D,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,eAAgB,CAAC;IAChE,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAoB,CAAC;CACzE,CAAC,CAAC;AAEU,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,YAAa,CAAC;IAC3D,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,eAAgB,CAAC;CACjE,CAAC,CAAC","sourcesContent":["import { AuthenticationClientOptions } from \"auth0\";\nimport * as jose from \"jose\";\nimport { z } from \"zod\";\n\nexport type AuthParams = {\n  allowed?: boolean;\n  accessToken?: string;\n  claims?: jose.JWTPayload;\n};\n\nexport type ToolWithAuthHandler<I, O, C> = (\n  authParams: AuthParams,\n  input: I,\n  config?: C\n) => Promise<O>;\n\nexport const Auth0ClientSchema = z.object({\n  domain: z.string().default(() => process.env.AUTH0_DOMAIN!),\n  clientId: z.string().default(() => process.env.AUTH0_CLIENT_ID!),\n  clientSecret: z.string().default(() => process.env.AUTH0_CLIENT_SECRET!),\n});\n\nexport const Auth0PublicClientSchema = z.object({\n  domain: z.string().default(() => process.env.AUTH0_DOMAIN!),\n  clientId: z.string().default(() => process.env.AUTH0_CLIENT_ID!),\n});\n\nexport type Auth0ClientParams = z.infer<typeof Auth0ClientSchema>;\nexport type Auth0PublicClientParams = z.infer<typeof Auth0PublicClientSchema>;\n\nexport type AuthorizerParams = Pick<\n  AuthenticationClientOptions,\n  \"domain\" | \"clientId\" | \"clientSecret\"\n>;\n\nexport type OnAuthorizationRequest = \"block\" | \"interrupt\";\n"]}

package/dist/cjs/credentials.js

@@ -1,3 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.tokenSetFromTokenResponse = void 0;
+const tokenSetFromTokenResponse = (tr) => {
+    var _a;
+    return {
+        tokenType: (_a = tr.token_type) !== null && _a !== void 0 ? _a : "Bearer",
+        accessToken: tr.access_token,
+        idToken: tr.id_token,
+        refreshToken: tr.refresh_token,
+        expiresIn: tr.expires_in,
+        scopes: tr.scope ? tr.scope.split(" ") : undefined,
+    };
+};
+exports.tokenSetFromTokenResponse = tokenSetFromTokenResponse;
 //# sourceMappingURL=credentials.js.map

package/dist/cjs/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/credentials.ts"],"names":[],"mappings":"","sourcesContent":["export interface Credential {\n  type: string;\n  value: string;\n}\n\nexport interface Credentials {\n  idToken?: Credential;\n  accessToken: Credential;\n  refreshToken?: Credential;\n}\n"]}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/credentials.ts"],"names":[],"mappings":";;;AAoCO,MAAM,yBAAyB,GAAG,CAAC,EAAiB,EAAY,EAAE;;IACvE,OAAO;QACL,SAAS,EAAE,MAAA,EAAE,CAAC,UAAU,mCAAI,QAAQ;QACpC,WAAW,EAAE,EAAE,CAAC,YAAY;QAC5B,OAAO,EAAE,EAAE,CAAC,QAAQ;QACpB,YAAY,EAAE,EAAE,CAAC,aAAa;QAC9B,SAAS,EAAE,EAAE,CAAC,UAAU;QACxB,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;KACnD,CAAC;AACJ,CAAC,CAAC;AATW,QAAA,yBAAyB,6BASpC","sourcesContent":["export type TokenResponse = {\n  /** Bearer token for API authorization */\n  access_token: string;\n  /** Refresh token (requires `offline_access` scope) */\n  refresh_token?: string;\n  /** JWT containing user identity claims */\n  id_token: string;\n  /** Typically \"Bearer\" */\n  token_type?: string;\n  /** Token validity in seconds (default: 86400) */\n  expires_in: number;\n  /** Granted permissions space */\n  scope: string;\n};\n\n/**\n * Represents a set of authentication tokens returned after a successful authentication flow.\n *\n * @interface TokenSet\n * @property {string[]} [scopes] - Optional array of permission scopes granted for the token.\n * @property {string} [idToken] - Optional JWT ID token containing user claims.\n * @property {string} [refreshToken] - Optional token used to obtain new access tokens without re-authentication.\n * @property {number} [expiresIn] - Optional time in seconds until the access token expires.\n * @property {string} accessToken - The access token string used for API requests.\n * @property {string} tokenType - The type of the token, typically \"Bearer\".\n */\nexport interface TokenSet {\n  scopes?: string[];\n  idToken?: string;\n  refreshToken?: string;\n\n  expiresIn?: number;\n  accessToken: string;\n  tokenType: string;\n}\n\nexport const tokenSetFromTokenResponse = (tr: TokenResponse): TokenSet => {\n  return {\n    tokenType: tr.token_type ?? \"Bearer\",\n    accessToken: tr.access_token,\n    idToken: tr.id_token,\n    refreshToken: tr.refresh_token,\n    expiresIn: tr.expires_in,\n    scopes: tr.scope ? tr.scope.split(\" \") : undefined,\n  };\n};\n"]}

package/dist/cjs/index.js

@@ -14,7 +14,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./authorizers/device-authorizer"), exports);
 __exportStar(require("./errors"), exports);
 __exportStar(require("./authorizers/fga/fga-filter"), exports);
 __exportStar(require("./authorizers/fga/fga-client"), exports);

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAEA,kEAAgD;AAChD,2CAAyB;AAEzB,+DAA6C;AAC7C,+DAA6C;AAC7C,+CAA6B","sourcesContent":["export type { AuthParams, AuthorizerParams } from \"./authorizers\";\nexport type * from \"./credentials\";\nexport * from \"./authorizers/device-authorizer\";\nexport * from \"./errors\";\nexport type { TokenResponse } from \"./TokenResponse\";\nexport * from \"./authorizers/fga/fga-filter\";\nexport * from \"./authorizers/fga/fga-client\";\nexport * from \"./parameters\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAEA,2CAAyB;AACzB,+DAA6C;AAC7C,+DAA6C;AAC7C,+CAA6B","sourcesContent":["export type { AuthParams, AuthorizerParams } from \"./authorizers/types\";\nexport type * from \"./credentials\";\nexport * from \"./errors\";\nexport * from \"./authorizers/fga/fga-filter\";\nexport * from \"./authorizers/fga/fga-client\";\nexport * from \"./parameters\";\n"]}