@auth0/ai 2.0.1 → 2.1.1

package/dist/cjs/authorizers/federated-connections/FederatedConnectionAuthorizerBase.js

@@ -59,7 +59,9 @@ class FederatedConnectionAuthorizerBase {
         if (!tokenResponse) {
             throw new interrupts_1.FederatedConnectionInterrupt(`Authorization required to access the Federated Connection: ${this.params.connection}`, connection, scopes, scopes);
         }
-        const currentScopes = ((_a = tokenResponse.scope) !== null && _a !== void 0 ? _a : "").split(" ");
+        const currentScopes = ((_a = tokenResponse.scope) !== null && _a !== void 0 ? _a : "")
+            .replace(/,/g, " ")
+            .split(" ");
         const missingScopes = scopes.filter((s) => !currentScopes.includes(s));
         store.currentScopes = currentScopes;
         if (missingScopes.length > 0) {

package/dist/cjs/authorizers/federated-connections/FederatedConnectionAuthorizerBase.js.map

@@ -1 +1 @@
-{"version":3,"file":"FederatedConnectionAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/federated-connections/FederatedConnectionAuthorizerBase.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AAC5B,8DAAqC;AAErC,mDAI2B;AAC3B,iDAI0B;AAC1B,iDAAoD;AACpD,yCAAwC;AACxC,qCAAiD;AACjD,wCAA0D;AAC1D,oCAAgE;AAChE,2DAA2E;AAG3E;;GAEG;AAEH,MAAa,iCAAiC;IAQ5C,YACE,KAAiC,EACjC,MAA4D;QAE5D,IAAI,CAAC,KAAK,GAAG,yBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB,EAAE,QAAQ;YAC5B,GAAG,MAAM;SACV,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAExC,IAAI,CAAC,gBAAgB,GAAG,IAAI,iBAAQ,CAAW,MAAM,CAAC,KAAK,EAAE;YAC3D,aAAa,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;YAC1C,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CACtB,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;QAEH,IACE,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW;YAC1C,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW,EACzC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QAED,IACE,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW;YACzC,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW,EAC1C,CAAC;YACD,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAA,WAAI,EAAC,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;SACpE,CAAC;QACF,MAAM,EAAE,GAAG,IAAA,qBAAU,EAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,gBAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAES,6BAA6B,CAAC,GAAmB;QACzD,MAAM,GAAG,CAAC;IACZ,CAAC;IAES,aAAa,CAAC,aAA6B;;QACnD,MAAM,KAAK,GAAG,qCAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAErC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,yCAA4B,CACpC,8DAA8D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EACtF,UAAU,EACV,MAAM,EACN,MAAM,CACP,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,MAAA,aAAa,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;QAEpC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,yCAA4B,CACpC,8DAA8D,IAAI,CAAC,MAAM,CAAC,UAAU,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACnI,UAAU,EACV,MAAM,EACN,CAAC,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC,CAC9B,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,GAAG,WAA4B;QAE/B,MAAM,KAAK,GAAG,qCAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAE7B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC,CAAC;QAEhE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG;YACrB,UAAU,EACR,oFAAoF;YACtF,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;YAC9B,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;YACtC,kBAAkB,EAAE,gDAAgD;YACpE,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,UAAU;YACtB,oBAAoB,EAClB,qEAAqE;SACxE,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,cAAc,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,2CAA2C;YAC3C,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAkB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,aAAa,CAAC;IACvB,CAAC;IAES,KAAK,CAAC,cAAc,CAC5B,GAAG,WAA4B;QAE/B,IAAI,aAAwC,CAAC;QAC7C,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACnD,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,WAAW,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,MAAM,IAAA,6BAAgB,EACpC,IAAI,CAAC,MAAM,CAAC,WAAY,EACxB,WAAW,CACZ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAClC,OAAO,IAAA,uCAAyB,EAAC,aAAc,CAAC,CAAC;IACnD,CAAC;IAES,KAAK,CAAC,eAAe,CAAC,GAAG,WAA4B;QAC7D,OAAO,MAAM,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA0C,EAC1C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YACpC,MAAM,UAAU,GAAsB;gBACpC,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;aACnC,CAAC;YAEF,IAAI,qCAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;YACJ,CAAC;YAED,OAAO,qCAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;gBAClD,MAAM,aAAa,GAAG,IAAA,uBAAa,EACjC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAC9B,OAAO,CACR,CAAC;gBACF,IAAI,CAAC;oBACH,IAAI,WAAW,GAAa,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CACzD,aAAa,EACb,YAAY,CACb,CAAC;oBACF,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;wBACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAC7B,aAAa,EACb,YAAY,EACZ,WAAW,CACZ,CAAC;oBACJ,CAAC;oBACD,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;oBACrC,OAAO,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,qCAAwB,EAAE,CAAC;wBAC5C,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,MAAM,SAAS,GAAG,IAAI,yCAA4B,CAChD,GAAG,CAAC,OAAO,EACX,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,MAAM,CAClB,CAAC;wBACF,OAAO,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC;oBACvD,CAAC;oBACD,IAAI,GAAG,YAAY,2BAAc,EAAE,CAAC;wBAClC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;CACF;AA9ND,8EA8NC","sourcesContent":["import crypto from \"crypto\";\nimport stableHash from \"stable-hash\";\n\nimport {\n  TokenResponse,\n  TokenSet,\n  tokenSetFromTokenResponse,\n} from \"../../credentials\";\nimport {\n  Auth0Interrupt,\n  FederatedConnectionError,\n  FederatedConnectionInterrupt,\n} from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { SubStore } from \"../../stores\";\nimport { omit, RequireFields } from \"../../util\";\nimport { ContextGetter, nsFromContext } from \"../context\";\nimport { Auth0ClientParams, Auth0ClientSchema } from \"../types\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport { FederatedConnectionAuthorizerParams } from \"./FederatedConnectionAuthorizerParams\";\n\n/**\n * Requests authorization to a third party service via Federated Connection.\n */\n\nexport class FederatedConnectionAuthorizerBase<ToolExecuteArgs extends any[]> {\n  private readonly auth0: Auth0ClientParams;\n  private readonly params: RequireFields<\n    FederatedConnectionAuthorizerParams<ToolExecuteArgs>,\n    \"credentialsContext\"\n  >;\n  private readonly credentialsStore: SubStore<TokenSet>;\n\n  constructor(\n    auth0: Partial<Auth0ClientParams>,\n    params: FederatedConnectionAuthorizerParams<ToolExecuteArgs>\n  ) {\n    this.auth0 = Auth0ClientSchema.parse(auth0);\n    this.params = {\n      credentialsContext: \"thread\",\n      ...params,\n    };\n\n    const instanceID = this.getInstanceID();\n\n    this.credentialsStore = new SubStore<TokenSet>(params.store, {\n      baseNamespace: [instanceID, \"Credentials\"],\n      getTTL: (credentials) =>\n        credentials.expiresIn ? credentials.expiresIn * 1000 : undefined,\n    });\n\n    if (\n      typeof params.refreshToken === \"undefined\" &&\n      typeof params.accessToken === \"undefined\"\n    ) {\n      throw new Error(\n        \"Either refreshToken or accessToken must be provided to initialize the Authorizer.\"\n      );\n    }\n\n    if (\n      typeof params.accessToken !== \"undefined\" &&\n      typeof params.refreshToken !== \"undefined\"\n    ) {\n      throw new Error(\n        \"Only one of refreshToken or accessToken can be provided to initialize the Authorizer.\"\n      );\n    }\n  }\n\n  private getInstanceID(): string {\n    const props = {\n      auth0: this.auth0,\n      params: omit(this.params, [\"store\", \"refreshToken\", \"accessToken\"]),\n    };\n    const sh = stableHash(props);\n    return crypto.createHash(\"MD5\").update(sh).digest(\"hex\");\n  }\n\n  protected handleAuthorizationInterrupts(err: Auth0Interrupt) {\n    throw err;\n  }\n\n  protected validateToken(tokenResponse?: TokenResponse) {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\n        \"The tool must be wrapped with the FederationConnectionAuthorizer.\"\n      );\n    }\n\n    const { scopes, connection } = store;\n\n    if (!tokenResponse) {\n      throw new FederatedConnectionInterrupt(\n        `Authorization required to access the Federated Connection: ${this.params.connection}`,\n        connection,\n        scopes,\n        scopes\n      );\n    }\n\n    const currentScopes = (tokenResponse.scope ?? \"\").split(\" \");\n    const missingScopes = scopes.filter((s) => !currentScopes.includes(s));\n    store.currentScopes = currentScopes;\n\n    if (missingScopes.length > 0) {\n      throw new FederatedConnectionInterrupt(\n        `Authorization required to access the Federated Connection: ${this.params.connection}. Missing scopes: ${missingScopes.join(\", \")}`,\n        connection,\n        scopes,\n        [...currentScopes, ...scopes]\n      );\n    }\n  }\n\n  private async getAccessTokenImpl(\n    ...toolContext: ToolExecuteArgs\n  ): Promise<TokenResponse | undefined> {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\n        \"The tool must be wrapped with the FederationConnectionAuthorizer.\"\n      );\n    }\n\n    const { connection } = store;\n\n    const subjectToken = await this.getRefreshToken(...toolContext);\n\n    if (!subjectToken) {\n      return;\n    }\n\n    const exchangeParams = {\n      grant_type:\n        \"urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token\",\n      client_id: this.auth0.clientId,\n      client_secret: this.auth0.clientSecret,\n      subject_token_type: \"urn:ietf:params:oauth:token-type:refresh_token\",\n      subject_token: subjectToken,\n      connection: connection,\n      requested_token_type:\n        \"http://auth0.com/oauth/token-type/federated-connection-access-token\",\n    };\n\n    const res = await fetch(`https://${this.auth0.domain}/oauth/token`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(exchangeParams),\n    });\n\n    if (!res.ok) {\n      //TODO: handle all type of response errors.\n      return;\n    }\n\n    const tokenResponse: TokenResponse = await res.json();\n    return tokenResponse;\n  }\n\n  protected async getAccessToken(\n    ...toolContext: ToolExecuteArgs\n  ): Promise<TokenSet> {\n    let tokenResponse: TokenResponse | undefined;\n    if (typeof this.params.refreshToken === \"function\") {\n      tokenResponse = await this.getAccessTokenImpl(...toolContext);\n    } else {\n      tokenResponse = await resolveParameter(\n        this.params.accessToken!,\n        toolContext\n      );\n    }\n    this.validateToken(tokenResponse);\n    return tokenSetFromTokenResponse(tokenResponse!);\n  }\n\n  protected async getRefreshToken(...toolContext: ToolExecuteArgs) {\n    return await resolveParameter(this.params.refreshToken, toolContext);\n  }\n\n  /**\n   *\n   * Wraps the execute method of an AI tool to handle Federated Connections authorization.\n   *\n   * @param getContext - A function that returns the context of the tool execution.\n   * @param execute - The tool execute method.\n   * @returns The wrapped execute method.\n   */\n  protect(\n    getContext: ContextGetter<ToolExecuteArgs>,\n    execute: (...args: ToolExecuteArgs) => any\n  ): (...args: ToolExecuteArgs) => any {\n    return async (...args: ToolExecuteArgs) => {\n      const context = getContext(...args);\n      const asyncStore: AsyncStorageValue = {\n        context: context,\n        scopes: this.params.scopes,\n        connection: this.params.connection,\n      };\n\n      if (asyncLocalStorage.getStore()) {\n        throw new Error(\n          \"Cannot nest tool calls that require federated connection authorization.\"\n        );\n      }\n\n      return asyncLocalStorage.run(asyncStore, async () => {\n        const credentialsNS = nsFromContext(\n          this.params.credentialsContext,\n          context\n        );\n        try {\n          let credentials: TokenSet = await this.credentialsStore.get(\n            credentialsNS,\n            \"credential\"\n          );\n          if (!credentials) {\n            credentials = await this.getAccessToken(...args);\n            await this.credentialsStore.put(\n              credentialsNS,\n              \"credential\",\n              credentials\n            );\n          }\n          asyncStore.credentials = credentials;\n          return await execute(...args);\n        } catch (err) {\n          if (err instanceof FederatedConnectionError) {\n            this.credentialsStore.delete(credentialsNS, \"credential\");\n            const interrupt = new FederatedConnectionInterrupt(\n              err.message,\n              asyncStore.connection,\n              asyncStore.scopes,\n              asyncStore.scopes\n            );\n            return this.handleAuthorizationInterrupts(interrupt);\n          }\n          if (err instanceof Auth0Interrupt) {\n            this.credentialsStore.delete(credentialsNS, \"credential\");\n            return this.handleAuthorizationInterrupts(err);\n          }\n          throw err;\n        }\n      });\n    };\n  }\n}\n"]}
+{"version":3,"file":"FederatedConnectionAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/federated-connections/FederatedConnectionAuthorizerBase.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AAC5B,8DAAqC;AAErC,mDAI2B;AAC3B,iDAI0B;AAC1B,iDAAoD;AACpD,yCAAwC;AACxC,qCAAiD;AACjD,wCAA0D;AAC1D,oCAAgE;AAChE,2DAA2E;AAG3E;;GAEG;AAEH,MAAa,iCAAiC;IAQ5C,YACE,KAAiC,EACjC,MAA4D;QAE5D,IAAI,CAAC,KAAK,GAAG,yBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB,EAAE,QAAQ;YAC5B,GAAG,MAAM;SACV,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAExC,IAAI,CAAC,gBAAgB,GAAG,IAAI,iBAAQ,CAAW,MAAM,CAAC,KAAK,EAAE;YAC3D,aAAa,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;YAC1C,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CACtB,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;QAEH,IACE,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW;YAC1C,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW,EACzC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QAED,IACE,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW;YACzC,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW,EAC1C,CAAC;YACD,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAA,WAAI,EAAC,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;SACpE,CAAC;QACF,MAAM,EAAE,GAAG,IAAA,qBAAU,EAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,gBAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAES,6BAA6B,CAAC,GAAmB;QACzD,MAAM,GAAG,CAAC;IACZ,CAAC;IAES,aAAa,CAAC,aAA6B;;QACnD,MAAM,KAAK,GAAG,qCAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAErC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,yCAA4B,CACpC,8DAA8D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EACtF,UAAU,EACV,MAAM,EACN,MAAM,CACP,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,MAAA,aAAa,CAAC,KAAK,mCAAI,EAAE,CAAC;aAC9C,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;QAEpC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,yCAA4B,CACpC,8DAA8D,IAAI,CAAC,MAAM,CAAC,UAAU,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACnI,UAAU,EACV,MAAM,EACN,CAAC,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC,CAC9B,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,GAAG,WAA4B;QAE/B,MAAM,KAAK,GAAG,qCAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAE7B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC,CAAC;QAEhE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG;YACrB,UAAU,EACR,oFAAoF;YACtF,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;YAC9B,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;YACtC,kBAAkB,EAAE,gDAAgD;YACpE,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,UAAU;YACtB,oBAAoB,EAClB,qEAAqE;SACxE,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,cAAc,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,2CAA2C;YAC3C,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAkB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,aAAa,CAAC;IACvB,CAAC;IAES,KAAK,CAAC,cAAc,CAC5B,GAAG,WAA4B;QAE/B,IAAI,aAAwC,CAAC;QAC7C,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACnD,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,WAAW,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,MAAM,IAAA,6BAAgB,EACpC,IAAI,CAAC,MAAM,CAAC,WAAY,EACxB,WAAW,CACZ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAClC,OAAO,IAAA,uCAAyB,EAAC,aAAc,CAAC,CAAC;IACnD,CAAC;IAES,KAAK,CAAC,eAAe,CAAC,GAAG,WAA4B;QAC7D,OAAO,MAAM,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA0C,EAC1C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YACpC,MAAM,UAAU,GAAsB;gBACpC,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;aACnC,CAAC;YAEF,IAAI,qCAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;YACJ,CAAC;YAED,OAAO,qCAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;gBAClD,MAAM,aAAa,GAAG,IAAA,uBAAa,EACjC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAC9B,OAAO,CACR,CAAC;gBACF,IAAI,CAAC;oBACH,IAAI,WAAW,GAAa,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CACzD,aAAa,EACb,YAAY,CACb,CAAC;oBACF,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;wBACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAC7B,aAAa,EACb,YAAY,EACZ,WAAW,CACZ,CAAC;oBACJ,CAAC;oBACD,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;oBACrC,OAAO,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,qCAAwB,EAAE,CAAC;wBAC5C,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,MAAM,SAAS,GAAG,IAAI,yCAA4B,CAChD,GAAG,CAAC,OAAO,EACX,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,MAAM,CAClB,CAAC;wBACF,OAAO,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC;oBACvD,CAAC;oBACD,IAAI,GAAG,YAAY,2BAAc,EAAE,CAAC;wBAClC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;CACF;AAhOD,8EAgOC","sourcesContent":["import crypto from \"crypto\";\nimport stableHash from \"stable-hash\";\n\nimport {\n  TokenResponse,\n  TokenSet,\n  tokenSetFromTokenResponse,\n} from \"../../credentials\";\nimport {\n  Auth0Interrupt,\n  FederatedConnectionError,\n  FederatedConnectionInterrupt,\n} from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { SubStore } from \"../../stores\";\nimport { omit, RequireFields } from \"../../util\";\nimport { ContextGetter, nsFromContext } from \"../context\";\nimport { Auth0ClientParams, Auth0ClientSchema } from \"../types\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport { FederatedConnectionAuthorizerParams } from \"./FederatedConnectionAuthorizerParams\";\n\n/**\n * Requests authorization to a third party service via Federated Connection.\n */\n\nexport class FederatedConnectionAuthorizerBase<ToolExecuteArgs extends any[]> {\n  private readonly auth0: Auth0ClientParams;\n  private readonly params: RequireFields<\n    FederatedConnectionAuthorizerParams<ToolExecuteArgs>,\n    \"credentialsContext\"\n  >;\n  private readonly credentialsStore: SubStore<TokenSet>;\n\n  constructor(\n    auth0: Partial<Auth0ClientParams>,\n    params: FederatedConnectionAuthorizerParams<ToolExecuteArgs>\n  ) {\n    this.auth0 = Auth0ClientSchema.parse(auth0);\n    this.params = {\n      credentialsContext: \"thread\",\n      ...params,\n    };\n\n    const instanceID = this.getInstanceID();\n\n    this.credentialsStore = new SubStore<TokenSet>(params.store, {\n      baseNamespace: [instanceID, \"Credentials\"],\n      getTTL: (credentials) =>\n        credentials.expiresIn ? credentials.expiresIn * 1000 : undefined,\n    });\n\n    if (\n      typeof params.refreshToken === \"undefined\" &&\n      typeof params.accessToken === \"undefined\"\n    ) {\n      throw new Error(\n        \"Either refreshToken or accessToken must be provided to initialize the Authorizer.\"\n      );\n    }\n\n    if (\n      typeof params.accessToken !== \"undefined\" &&\n      typeof params.refreshToken !== \"undefined\"\n    ) {\n      throw new Error(\n        \"Only one of refreshToken or accessToken can be provided to initialize the Authorizer.\"\n      );\n    }\n  }\n\n  private getInstanceID(): string {\n    const props = {\n      auth0: this.auth0,\n      params: omit(this.params, [\"store\", \"refreshToken\", \"accessToken\"]),\n    };\n    const sh = stableHash(props);\n    return crypto.createHash(\"MD5\").update(sh).digest(\"hex\");\n  }\n\n  protected handleAuthorizationInterrupts(err: Auth0Interrupt) {\n    throw err;\n  }\n\n  protected validateToken(tokenResponse?: TokenResponse) {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\n        \"The tool must be wrapped with the FederationConnectionAuthorizer.\"\n      );\n    }\n\n    const { scopes, connection } = store;\n\n    if (!tokenResponse) {\n      throw new FederatedConnectionInterrupt(\n        `Authorization required to access the Federated Connection: ${this.params.connection}`,\n        connection,\n        scopes,\n        scopes\n      );\n    }\n\n    const currentScopes = (tokenResponse.scope ?? \"\")\n      .replace(/,/g, \" \")\n      .split(\" \");\n    const missingScopes = scopes.filter((s) => !currentScopes.includes(s));\n    store.currentScopes = currentScopes;\n\n    if (missingScopes.length > 0) {\n      throw new FederatedConnectionInterrupt(\n        `Authorization required to access the Federated Connection: ${this.params.connection}. Missing scopes: ${missingScopes.join(\", \")}`,\n        connection,\n        scopes,\n        [...currentScopes, ...scopes]\n      );\n    }\n  }\n\n  private async getAccessTokenImpl(\n    ...toolContext: ToolExecuteArgs\n  ): Promise<TokenResponse | undefined> {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\n        \"The tool must be wrapped with the FederationConnectionAuthorizer.\"\n      );\n    }\n\n    const { connection } = store;\n\n    const subjectToken = await this.getRefreshToken(...toolContext);\n\n    if (!subjectToken) {\n      return;\n    }\n\n    const exchangeParams = {\n      grant_type:\n        \"urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token\",\n      client_id: this.auth0.clientId,\n      client_secret: this.auth0.clientSecret,\n      subject_token_type: \"urn:ietf:params:oauth:token-type:refresh_token\",\n      subject_token: subjectToken,\n      connection: connection,\n      requested_token_type:\n        \"http://auth0.com/oauth/token-type/federated-connection-access-token\",\n    };\n\n    const res = await fetch(`https://${this.auth0.domain}/oauth/token`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(exchangeParams),\n    });\n\n    if (!res.ok) {\n      //TODO: handle all type of response errors.\n      return;\n    }\n\n    const tokenResponse: TokenResponse = await res.json();\n    return tokenResponse;\n  }\n\n  protected async getAccessToken(\n    ...toolContext: ToolExecuteArgs\n  ): Promise<TokenSet> {\n    let tokenResponse: TokenResponse | undefined;\n    if (typeof this.params.refreshToken === \"function\") {\n      tokenResponse = await this.getAccessTokenImpl(...toolContext);\n    } else {\n      tokenResponse = await resolveParameter(\n        this.params.accessToken!,\n        toolContext\n      );\n    }\n    this.validateToken(tokenResponse);\n    return tokenSetFromTokenResponse(tokenResponse!);\n  }\n\n  protected async getRefreshToken(...toolContext: ToolExecuteArgs) {\n    return await resolveParameter(this.params.refreshToken, toolContext);\n  }\n\n  /**\n   *\n   * Wraps the execute method of an AI tool to handle Federated Connections authorization.\n   *\n   * @param getContext - A function that returns the context of the tool execution.\n   * @param execute - The tool execute method.\n   * @returns The wrapped execute method.\n   */\n  protect(\n    getContext: ContextGetter<ToolExecuteArgs>,\n    execute: (...args: ToolExecuteArgs) => any\n  ): (...args: ToolExecuteArgs) => any {\n    return async (...args: ToolExecuteArgs) => {\n      const context = getContext(...args);\n      const asyncStore: AsyncStorageValue = {\n        context: context,\n        scopes: this.params.scopes,\n        connection: this.params.connection,\n      };\n\n      if (asyncLocalStorage.getStore()) {\n        throw new Error(\n          \"Cannot nest tool calls that require federated connection authorization.\"\n        );\n      }\n\n      return asyncLocalStorage.run(asyncStore, async () => {\n        const credentialsNS = nsFromContext(\n          this.params.credentialsContext,\n          context\n        );\n        try {\n          let credentials: TokenSet = await this.credentialsStore.get(\n            credentialsNS,\n            \"credential\"\n          );\n          if (!credentials) {\n            credentials = await this.getAccessToken(...args);\n            await this.credentialsStore.put(\n              credentialsNS,\n              \"credential\",\n              credentials\n            );\n          }\n          asyncStore.credentials = credentials;\n          return await execute(...args);\n        } catch (err) {\n          if (err instanceof FederatedConnectionError) {\n            this.credentialsStore.delete(credentialsNS, \"credential\");\n            const interrupt = new FederatedConnectionInterrupt(\n              err.message,\n              asyncStore.connection,\n              asyncStore.scopes,\n              asyncStore.scopes\n            );\n            return this.handleAuthorizationInterrupts(interrupt);\n          }\n          if (err instanceof Auth0Interrupt) {\n            this.credentialsStore.delete(credentialsNS, \"credential\");\n            return this.handleAuthorizationInterrupts(err);\n          }\n          throw err;\n        }\n      });\n    };\n  }\n}\n"]}

package/dist/cjs/interrupts/CIBAInterrupts.js

@@ -13,7 +13,8 @@ class CIBAInterrupt extends Auth0Interrupt_1.Auth0Interrupt {
         return (interrupt &&
             Auth0Interrupt_1.Auth0Interrupt.isInterrupt(interrupt) &&
             typeof interrupt.code === "string" &&
-            interrupt.code.startsWith("CIBA_"));
+            (this.code === interrupt.code ||
+                (!this.code && interrupt.code.startsWith("CIBA_"))));
     }
     static hasRequestData(interrupt) {
         return CIBAInterrupt.isInterrupt(interrupt) && "request" in interrupt;
@@ -67,7 +68,7 @@ AuthorizationPendingInterrupt.code = "CIBA_AUTHORIZATION_PENDING";
 /**
  * An interrupt that is thrown when the authorization polling fails.
  */
-class AuthorizationPollingInterrupt extends Auth0Interrupt_1.Auth0Interrupt {
+class AuthorizationPollingInterrupt extends CIBAInterrupt {
     constructor(message, request) {
         super(message, AuthorizationPollingInterrupt.code);
         this.request = request;
@@ -78,7 +79,7 @@ AuthorizationPollingInterrupt.code = "CIBA_AUTHORIZATION_POLLING_ERROR";
 /**
  * An interrupt that is thrown when the authorization polling fails.
  */
-class InvalidGrantInterrupt extends Auth0Interrupt_1.Auth0Interrupt {
+class InvalidGrantInterrupt extends CIBAInterrupt {
     constructor(message, request) {
         super(message, AuthorizationPollingInterrupt.code);
         this.request = request;

package/dist/cjs/interrupts/CIBAInterrupts.js.map

@@ -1 +1 @@
-{"version":3,"file":"CIBAInterrupts.js","sourceRoot":"","sources":["../../../src/interrupts/CIBAInterrupts.ts"],"names":[],"mappings":";;;AACA,qDAAsE;AAMtE;;GAEG;AACH,MAAa,aAAc,SAAQ,+BAAc;IAC/C,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,WAAW,CAEhB,SAAc;QAEd,OAAO,CACL,SAAS;YACT,+BAAc,CAAC,WAAW,CAAC,SAAS,CAAC;YACrC,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;YAClC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CACnC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,SAAc;QAClC,OAAO,aAAa,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,SAAS,CAAC;IACxE,CAAC;CACF;AApBD,sCAoBC;AAED;;GAEG;AACH,MAAa,qBACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAF3B,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AAVH,sDAWC;AAPe,0BAAI,GAAW,oBAA6B,CAAC;AAS7D;;GAEG;AACH,MAAa,yCAA0C,SAAQ,aAAa;IAG1E,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,yCAAyC,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;;AALH,8FAMC;AALe,8CAAI,GAChB,4CAAqD,CAAC;AAM1D;;GAEG;AACH,MAAa,oCACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,oCAAoC,CAAC,IAAI,CAAC,CAAC;QAF1C,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AAVH,oFAWC;AAPe,yCAAI,GAAW,oCAA6C,CAAC;AAS7E;;;GAGG;AACH,MAAa,6BACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AAVH,sEAWC;AAPe,kCAAI,GAAW,4BAAqC,CAAC;AASrE;;GAEG;AACH,MAAa,6BACX,SAAQ,+BAAc;IAItB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AAVH,sEAWC;AAPe,kCAAI,GAAW,kCAA2C,CAAC;AAS3E;;GAEG;AACH,MAAa,qBACX,SAAQ,+BAAc;IAItB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AAVH,sDAWC;AAPe,0BAAI,GAAW,oBAA6B,CAAC","sourcesContent":["import { CIBAAuthorizationRequest } from \"../authorizers/ciba/CIBAAuthorizationRequest\";\nimport { Auth0Interrupt, Auth0InterruptData } from \"./Auth0Interrupt\";\n\nexport interface WithRequestData {\n  request: CIBAAuthorizationRequest;\n}\n\n/**\n * Base class for CIBA interrupts.\n */\nexport class CIBAInterrupt extends Auth0Interrupt {\n  constructor(message: string, code: string) {\n    super(message, code);\n  }\n\n  static isInterrupt<T extends abstract new (...args: any) => any>(\n    this: T,\n    interrupt: any\n  ): interrupt is Auth0InterruptData<InstanceType<T>> {\n    return (\n      interrupt &&\n      Auth0Interrupt.isInterrupt(interrupt) &&\n      typeof interrupt.code === \"string\" &&\n      interrupt.code.startsWith(\"CIBA_\")\n    );\n  }\n\n  static hasRequestData(interrupt: any): interrupt is WithRequestData {\n    return CIBAInterrupt.isInterrupt(interrupt) && \"request\" in interrupt;\n  }\n}\n\n/**\n * An interrupt that is thrown when the user denies the authorization request.\n */\nexport class AccessDeniedInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_ACCESS_DENIED\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AccessDeniedInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the user does not have push notifications enabled.\n */\nexport class UserDoesNotHavePushNotificationsInterrupt extends CIBAInterrupt {\n  public static code: string =\n    \"CIBA_USER_DOES_NOT_HAVE_PUSH_NOTIFICATIONS\" as const;\n  constructor(message: string) {\n    super(message, UserDoesNotHavePushNotificationsInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization request has expired.\n */\nexport class AuthorizationRequestExpiredInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_REQUEST_EXPIRED\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationRequestExpiredInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization is still pending\n * and the Authorizer is in `mode: interrupt`.\n */\nexport class AuthorizationPendingInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_PENDING\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPendingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class AuthorizationPollingInterrupt\n  extends Auth0Interrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_POLLING_ERROR\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class InvalidGrantInterrupt\n  extends Auth0Interrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_INVALID_GRANT\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n"]}
+{"version":3,"file":"CIBAInterrupts.js","sourceRoot":"","sources":["../../../src/interrupts/CIBAInterrupts.ts"],"names":[],"mappings":";;;AACA,qDAAsE;AAMtE;;GAEG;AACH,MAAa,aAAc,SAAQ,+BAAc;IAC/C,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,WAAW,CAEhB,SAAc;QAEd,OAAO,CACL,SAAS;YACT,+BAAc,CAAC,WAAW,CAAC,SAAS,CAAC;YACrC,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;YAClC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI;gBAC3B,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,SAAc;QAClC,OAAO,aAAa,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,SAAS,CAAC;IACxE,CAAC;CACF;AArBD,sCAqBC;AAED;;GAEG;AACH,MAAa,qBACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAF3B,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AAVH,sDAWC;AAPe,0BAAI,GAAW,oBAA6B,CAAC;AAS7D;;GAEG;AACH,MAAa,yCAA0C,SAAQ,aAAa;IAG1E,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,yCAAyC,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;;AALH,8FAMC;AALe,8CAAI,GAChB,4CAAqD,CAAC;AAM1D;;GAEG;AACH,MAAa,oCACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,oCAAoC,CAAC,IAAI,CAAC,CAAC;QAF1C,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AAVH,oFAWC;AAPe,yCAAI,GAAW,oCAA6C,CAAC;AAS7E;;;GAGG;AACH,MAAa,6BACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AAVH,sEAWC;AAPe,kCAAI,GAAW,4BAAqC,CAAC;AASrE;;GAEG;AACH,MAAa,6BACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AAVH,sEAWC;AAPe,kCAAI,GAAW,kCAA2C,CAAC;AAS3E;;GAEG;AACH,MAAa,qBACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AAVH,sDAWC;AAPe,0BAAI,GAAW,oBAA6B,CAAC","sourcesContent":["import { CIBAAuthorizationRequest } from \"../authorizers/ciba/CIBAAuthorizationRequest\";\nimport { Auth0Interrupt, Auth0InterruptData } from \"./Auth0Interrupt\";\n\nexport interface WithRequestData {\n  request: CIBAAuthorizationRequest;\n}\n\n/**\n * Base class for CIBA interrupts.\n */\nexport class CIBAInterrupt extends Auth0Interrupt {\n  constructor(message: string, code: string) {\n    super(message, code);\n  }\n\n  static isInterrupt<T extends abstract new (...args: any) => any>(\n    this: T & { code?: string },\n    interrupt: any\n  ): interrupt is Auth0InterruptData<InstanceType<T>> {\n    return (\n      interrupt &&\n      Auth0Interrupt.isInterrupt(interrupt) &&\n      typeof interrupt.code === \"string\" &&\n      (this.code === interrupt.code ||\n        (!this.code && interrupt.code.startsWith(\"CIBA_\")))\n    );\n  }\n\n  static hasRequestData(interrupt: any): interrupt is WithRequestData {\n    return CIBAInterrupt.isInterrupt(interrupt) && \"request\" in interrupt;\n  }\n}\n\n/**\n * An interrupt that is thrown when the user denies the authorization request.\n */\nexport class AccessDeniedInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_ACCESS_DENIED\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AccessDeniedInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the user does not have push notifications enabled.\n */\nexport class UserDoesNotHavePushNotificationsInterrupt extends CIBAInterrupt {\n  public static code: string =\n    \"CIBA_USER_DOES_NOT_HAVE_PUSH_NOTIFICATIONS\" as const;\n  constructor(message: string) {\n    super(message, UserDoesNotHavePushNotificationsInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization request has expired.\n */\nexport class AuthorizationRequestExpiredInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_REQUEST_EXPIRED\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationRequestExpiredInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization is still pending\n * and the Authorizer is in `mode: interrupt`.\n */\nexport class AuthorizationPendingInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_PENDING\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPendingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class AuthorizationPollingInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_POLLING_ERROR\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class InvalidGrantInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_INVALID_GRANT\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n"]}

package/dist/cjs/interrupts/DeviceInterrupts.js

@@ -13,7 +13,8 @@ class DeviceInterrupt extends Auth0Interrupt_1.Auth0Interrupt {
         return (interrupt &&
             Auth0Interrupt_1.Auth0Interrupt.isInterrupt(interrupt) &&
             typeof interrupt.code === "string" &&
-            interrupt.code.startsWith("DEVICE_"));
+            (this.code === interrupt.code ||
+                (!this.code && interrupt.code.startsWith("DEVICE_"))));
     }
     static hasRequestData(interrupt) {
         return DeviceInterrupt.isInterrupt(interrupt) && "response" in interrupt;

package/dist/cjs/interrupts/DeviceInterrupts.js.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceInterrupts.js","sourceRoot":"","sources":["../../../src/interrupts/DeviceInterrupts.ts"],"names":[],"mappings":";;;AACA,qDAAsE;AAMtE;;GAEG;AACH,MAAa,eAAgB,SAAQ,+BAAc;IACjD,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,WAAW,CAEhB,SAAc;QAEd,OAAO,CACL,SAAS;YACT,+BAAc,CAAC,WAAW,CAAC,SAAS,CAAC;YACrC,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;YAClC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CACrC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,cAAc,CACnB,SAAc;QAEd,OAAO,eAAe,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,UAAU,IAAI,SAAS,CAAC;IAC3E,CAAC;CACF;AAtBD,0CAsBC;AAED;;GAEG;AACH,MAAa,qBACX,SAAQ,eAAe;IAIvB,YACE,OAAe,EACC,QAAqC;QAErD,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAF3B,aAAQ,GAAR,QAAQ,CAA6B;IAGvD,CAAC;;AAVH,sDAWC;AAPe,0BAAI,GAAW,sBAA+B,CAAC;AAS/D;;GAEG;AACH,MAAa,oCACX,SAAQ,eAAe;IAIvB,YACE,OAAe,EACC,QAAqC;QAErD,KAAK,CAAC,OAAO,EAAE,oCAAoC,CAAC,IAAI,CAAC,CAAC;QAF1C,aAAQ,GAAR,QAAQ,CAA6B;IAGvD,CAAC;;AAVH,oFAWC;AAPe,yCAAI,GAAW,sCAA+C,CAAC;AAS/E;;;GAGG;AACH,MAAa,6BACX,SAAQ,eAAe;IAIvB,YACE,OAAe,EACC,QAAqC;QAErD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,aAAQ,GAAR,QAAQ,CAA6B;IAGvD,CAAC;;AAVH,sEAWC;AAPe,kCAAI,GAAW,8BAAuC,CAAC;AASvE;;GAEG;AACH,MAAa,6BACX,SAAQ,+BAAc;IAItB,YACE,OAAe,EACC,QAAqC;QAErD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,aAAQ,GAAR,QAAQ,CAA6B;IAGvD,CAAC;;AAVH,sEAWC;AAPe,kCAAI,GAAW,oCAA6C,CAAC;AAS7E;;GAEG;AACH,MAAa,qBACX,SAAQ,+BAAc;IAItB,YACE,OAAe,EACC,QAAqC;QAErD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,aAAQ,GAAR,QAAQ,CAA6B;IAGvD,CAAC;;AAVH,sDAWC;AAPe,0BAAI,GAAW,sBAA+B,CAAC","sourcesContent":["import { DeviceAuthorizationResponse } from \"../authorizers/device-authorizer/DeviceAuthResponse\";\nimport { Auth0Interrupt, Auth0InterruptData } from \"./Auth0Interrupt\";\n\nexport interface WithDeviceAuthResponseData {\n  response: DeviceAuthorizationResponse;\n}\n\n/**\n * Base class for Device interrupts.\n */\nexport class DeviceInterrupt extends Auth0Interrupt {\n  constructor(message: string, code: string) {\n    super(message, code);\n  }\n\n  static isInterrupt<T extends abstract new (...args: any) => any>(\n    this: T,\n    interrupt: any\n  ): interrupt is Auth0InterruptData<InstanceType<T>> {\n    return (\n      interrupt &&\n      Auth0Interrupt.isInterrupt(interrupt) &&\n      typeof interrupt.code === \"string\" &&\n      interrupt.code.startsWith(\"DEVICE_\")\n    );\n  }\n\n  static hasRequestData(\n    interrupt: any\n  ): interrupt is WithDeviceAuthResponseData {\n    return DeviceInterrupt.isInterrupt(interrupt) && \"response\" in interrupt;\n  }\n}\n\n/**\n * An interrupt that is thrown when the user denies the authorization request.\n */\nexport class AccessDeniedInterrupt\n  extends DeviceInterrupt\n  implements WithDeviceAuthResponseData\n{\n  public static code: string = \"DEVICE_ACCESS_DENIED\" as const;\n  constructor(\n    message: string,\n    public readonly response: DeviceAuthorizationResponse\n  ) {\n    super(message, AccessDeniedInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization request has expired.\n */\nexport class AuthorizationRequestExpiredInterrupt\n  extends DeviceInterrupt\n  implements WithDeviceAuthResponseData\n{\n  public static code: string = \"DEVICE_AUTHORIZATION_REQUEST_EXPIRED\" as const;\n  constructor(\n    message: string,\n    public readonly response: DeviceAuthorizationResponse\n  ) {\n    super(message, AuthorizationRequestExpiredInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization is still pending\n * and the Authorizer is in `mode: interrupt`.\n */\nexport class AuthorizationPendingInterrupt\n  extends DeviceInterrupt\n  implements WithDeviceAuthResponseData\n{\n  public static code: string = \"DEVICE_AUTHORIZATION_PENDING\" as const;\n  constructor(\n    message: string,\n    public readonly response: DeviceAuthorizationResponse\n  ) {\n    super(message, AuthorizationPendingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class AuthorizationPollingInterrupt\n  extends Auth0Interrupt\n  implements WithDeviceAuthResponseData\n{\n  public static code: string = \"DEVICE_AUTHORIZATION_POLLING_ERROR\" as const;\n  constructor(\n    message: string,\n    public readonly response: DeviceAuthorizationResponse\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the grant is invalid.\n */\nexport class InvalidGrantInterrupt\n  extends Auth0Interrupt\n  implements WithDeviceAuthResponseData\n{\n  public static code: string = \"DEVICE_INVALID_GRANT\" as const;\n  constructor(\n    message: string,\n    public readonly response: DeviceAuthorizationResponse\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n"]}
+{"version":3,"file":"DeviceInterrupts.js","sourceRoot":"","sources":["../../../src/interrupts/DeviceInterrupts.ts"],"names":[],"mappings":";;;AACA,qDAAsE;AAMtE;;GAEG;AACH,MAAa,eAAgB,SAAQ,+BAAc;IACjD,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,WAAW,CAEhB,SAAc;QAEd,OAAO,CACL,SAAS;YACT,+BAAc,CAAC,WAAW,CAAC,SAAS,CAAC;YACrC,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;YAClC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI;gBAC3B,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CACxD,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,cAAc,CACnB,SAAc;QAEd,OAAO,eAAe,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,UAAU,IAAI,SAAS,CAAC;IAC3E,CAAC;CACF;AAvBD,0CAuBC;AAED;;GAEG;AACH,MAAa,qBACX,SAAQ,eAAe;IAIvB,YACE,OAAe,EACC,QAAqC;QAErD,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAF3B,aAAQ,GAAR,QAAQ,CAA6B;IAGvD,CAAC;;AAVH,sDAWC;AAPe,0BAAI,GAAW,sBAA+B,CAAC;AAS/D;;GAEG;AACH,MAAa,oCACX,SAAQ,eAAe;IAIvB,YACE,OAAe,EACC,QAAqC;QAErD,KAAK,CAAC,OAAO,EAAE,oCAAoC,CAAC,IAAI,CAAC,CAAC;QAF1C,aAAQ,GAAR,QAAQ,CAA6B;IAGvD,CAAC;;AAVH,oFAWC;AAPe,yCAAI,GAAW,sCAA+C,CAAC;AAS/E;;;GAGG;AACH,MAAa,6BACX,SAAQ,eAAe;IAIvB,YACE,OAAe,EACC,QAAqC;QAErD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,aAAQ,GAAR,QAAQ,CAA6B;IAGvD,CAAC;;AAVH,sEAWC;AAPe,kCAAI,GAAW,8BAAuC,CAAC;AASvE;;GAEG;AACH,MAAa,6BACX,SAAQ,+BAAc;IAItB,YACE,OAAe,EACC,QAAqC;QAErD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,aAAQ,GAAR,QAAQ,CAA6B;IAGvD,CAAC;;AAVH,sEAWC;AAPe,kCAAI,GAAW,oCAA6C,CAAC;AAS7E;;GAEG;AACH,MAAa,qBACX,SAAQ,+BAAc;IAItB,YACE,OAAe,EACC,QAAqC;QAErD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,aAAQ,GAAR,QAAQ,CAA6B;IAGvD,CAAC;;AAVH,sDAWC;AAPe,0BAAI,GAAW,sBAA+B,CAAC","sourcesContent":["import { DeviceAuthorizationResponse } from \"../authorizers/device-authorizer/DeviceAuthResponse\";\nimport { Auth0Interrupt, Auth0InterruptData } from \"./Auth0Interrupt\";\n\nexport interface WithDeviceAuthResponseData {\n  response: DeviceAuthorizationResponse;\n}\n\n/**\n * Base class for Device interrupts.\n */\nexport class DeviceInterrupt extends Auth0Interrupt {\n  constructor(message: string, code: string) {\n    super(message, code);\n  }\n\n  static isInterrupt<T extends abstract new (...args: any) => any>(\n    this: T & { code?: string },\n    interrupt: any\n  ): interrupt is Auth0InterruptData<InstanceType<T>> {\n    return (\n      interrupt &&\n      Auth0Interrupt.isInterrupt(interrupt) &&\n      typeof interrupt.code === \"string\" &&\n      (this.code === interrupt.code ||\n        (!this.code && interrupt.code.startsWith(\"DEVICE_\")))\n    );\n  }\n\n  static hasRequestData(\n    interrupt: any\n  ): interrupt is WithDeviceAuthResponseData {\n    return DeviceInterrupt.isInterrupt(interrupt) && \"response\" in interrupt;\n  }\n}\n\n/**\n * An interrupt that is thrown when the user denies the authorization request.\n */\nexport class AccessDeniedInterrupt\n  extends DeviceInterrupt\n  implements WithDeviceAuthResponseData\n{\n  public static code: string = \"DEVICE_ACCESS_DENIED\" as const;\n  constructor(\n    message: string,\n    public readonly response: DeviceAuthorizationResponse\n  ) {\n    super(message, AccessDeniedInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization request has expired.\n */\nexport class AuthorizationRequestExpiredInterrupt\n  extends DeviceInterrupt\n  implements WithDeviceAuthResponseData\n{\n  public static code: string = \"DEVICE_AUTHORIZATION_REQUEST_EXPIRED\" as const;\n  constructor(\n    message: string,\n    public readonly response: DeviceAuthorizationResponse\n  ) {\n    super(message, AuthorizationRequestExpiredInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization is still pending\n * and the Authorizer is in `mode: interrupt`.\n */\nexport class AuthorizationPendingInterrupt\n  extends DeviceInterrupt\n  implements WithDeviceAuthResponseData\n{\n  public static code: string = \"DEVICE_AUTHORIZATION_PENDING\" as const;\n  constructor(\n    message: string,\n    public readonly response: DeviceAuthorizationResponse\n  ) {\n    super(message, AuthorizationPendingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class AuthorizationPollingInterrupt\n  extends Auth0Interrupt\n  implements WithDeviceAuthResponseData\n{\n  public static code: string = \"DEVICE_AUTHORIZATION_POLLING_ERROR\" as const;\n  constructor(\n    message: string,\n    public readonly response: DeviceAuthorizationResponse\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the grant is invalid.\n */\nexport class InvalidGrantInterrupt\n  extends Auth0Interrupt\n  implements WithDeviceAuthResponseData\n{\n  public static code: string = \"DEVICE_INVALID_GRANT\" as const;\n  constructor(\n    message: string,\n    public readonly response: DeviceAuthorizationResponse\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n"]}

package/dist/cjs/interrupts/FederatedConnectionInterrupt.js

@@ -8,8 +8,9 @@ const Auth0Interrupt_1 = require("./Auth0Interrupt");
  * Throw this error if the service returns Unauthorized for the current access token.
  */
 class FederatedConnectionInterrupt extends Auth0Interrupt_1.Auth0Interrupt {
-    constructor(message, connection, scopes, requiredScopes) {
+    constructor(message, connection, scopes, requiredScopes, behavior = "resume") {
         super(message, FederatedConnectionInterrupt.code);
+        this.behavior = behavior;
         this.connection = connection;
         this.scopes = scopes;
         this.requiredScopes = requiredScopes;

package/dist/cjs/interrupts/FederatedConnectionInterrupt.js.map

@@ -1 +1 @@
-{"version":3,"file":"FederatedConnectionInterrupt.js","sourceRoot":"","sources":["../../../src/interrupts/FederatedConnectionInterrupt.ts"],"names":[],"mappings":";;;AAAA,qDAAkD;AAElD;;;;GAIG;AACH,MAAa,4BAA6B,SAAQ,+BAAc;IAoB9D,YACE,OAAe,EACf,UAAkB,EAClB,MAAgB,EAChB,cAAwB;QAExB,KAAK,CAAC,OAAO,EAAE,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;;AA9BH,oEA+BC;AAbe,iCAAI,GAAG,4BAAqC,CAAC;AAe7D;;;;GAIG;AACH,MAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAJD,4DAIC","sourcesContent":["import { Auth0Interrupt } from \"./Auth0Interrupt\";\n\n/**\n * Error thrown when a tool call requires an access token for an external service.\n *\n * Throw this error if the service returns Unauthorized for the current access token.\n */\nexport class FederatedConnectionInterrupt extends Auth0Interrupt {\n  /**\n   * The auth0 connection name.\n   */\n  public readonly connection: string;\n\n  /**\n   * The scopes required to access the external service as stated\n   * in the authorizer.\n   */\n  public readonly scopes: string[];\n\n  /**\n   * The union between the current scopes of the Access Token plus the required scopes.\n   * This is the list of scopes that will be used to request a new Access Token.\n   */\n  public readonly requiredScopes: string[];\n\n  public static code = \"FEDERATED_CONNECTION_ERROR\" as const;\n\n  constructor(\n    message: string,\n    connection: string,\n    scopes: string[],\n    requiredScopes: string[]\n  ) {\n    super(message, FederatedConnectionInterrupt.code);\n    this.connection = connection;\n    this.scopes = scopes;\n    this.requiredScopes = requiredScopes;\n  }\n}\n\n/**\n * Error thrown when a tool call requires an access token for an external service.\n *\n * The authorizer will automatically convert this class of error to FederatedConnectionInterrupt.\n */\nexport class FederatedConnectionError extends Error {\n  constructor(message: string) {\n    super(message);\n  }\n}\n"]}
+{"version":3,"file":"FederatedConnectionInterrupt.js","sourceRoot":"","sources":["../../../src/interrupts/FederatedConnectionInterrupt.ts"],"names":[],"mappings":";;;AAAA,qDAAkD;AAElD;;;;GAIG;AACH,MAAa,4BAA6B,SAAQ,+BAAc;IAsB9D,YACE,OAAe,EACf,UAAkB,EAClB,MAAgB,EAChB,cAAwB,EACxB,WAAgC,QAAQ;QAExC,KAAK,CAAC,OAAO,EAAE,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;;AAlCH,oEAmCC;AAfe,iCAAI,GAAG,4BAAqC,CAAC;AAiB7D;;;;GAIG;AACH,MAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAJD,4DAIC","sourcesContent":["import { Auth0Interrupt } from \"./Auth0Interrupt\";\n\n/**\n * Error thrown when a tool call requires an access token for an external service.\n *\n * Throw this error if the service returns Unauthorized for the current access token.\n */\nexport class FederatedConnectionInterrupt extends Auth0Interrupt {\n  public behavior: \"resume\" | \"reload\";\n\n  /**\n   * The auth0 connection name.\n   */\n  public readonly connection: string;\n\n  /**\n   * The scopes required to access the external service as stated\n   * in the authorizer.\n   */\n  public readonly scopes: string[];\n\n  /**\n   * The union between the current scopes of the Access Token plus the required scopes.\n   * This is the list of scopes that will be used to request a new Access Token.\n   */\n  public readonly requiredScopes: string[];\n\n  public static code = \"FEDERATED_CONNECTION_ERROR\" as const;\n\n  constructor(\n    message: string,\n    connection: string,\n    scopes: string[],\n    requiredScopes: string[],\n    behavior: \"resume\" | \"reload\" = \"resume\"\n  ) {\n    super(message, FederatedConnectionInterrupt.code);\n    this.behavior = behavior;\n    this.connection = connection;\n    this.scopes = scopes;\n    this.requiredScopes = requiredScopes;\n  }\n}\n\n/**\n * Error thrown when a tool call requires an access token for an external service.\n *\n * The authorizer will automatically convert this class of error to FederatedConnectionInterrupt.\n */\nexport class FederatedConnectionError extends Error {\n  constructor(message: string) {\n    super(message);\n  }\n}\n"]}

package/dist/esm/authorizers/federated-connections/FederatedConnectionAuthorizerBase.js

@@ -53,7 +53,9 @@ export class FederatedConnectionAuthorizerBase {
         if (!tokenResponse) {
             throw new FederatedConnectionInterrupt(`Authorization required to access the Federated Connection: ${this.params.connection}`, connection, scopes, scopes);
         }
-        const currentScopes = ((_a = tokenResponse.scope) !== null && _a !== void 0 ? _a : "").split(" ");
+        const currentScopes = ((_a = tokenResponse.scope) !== null && _a !== void 0 ? _a : "")
+            .replace(/,/g, " ")
+            .split(" ");
         const missingScopes = scopes.filter((s) => !currentScopes.includes(s));
         store.currentScopes = currentScopes;
         if (missingScopes.length > 0) {

package/dist/esm/authorizers/federated-connections/FederatedConnectionAuthorizerBase.js.map

@@ -1 +1 @@
-{"version":3,"file":"FederatedConnectionAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/federated-connections/FederatedConnectionAuthorizerBase.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,UAAU,MAAM,aAAa,CAAC;AAErC,OAAO,EAGL,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,IAAI,EAAiB,MAAM,YAAY,CAAC;AACjD,OAAO,EAAiB,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAqB,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAqB,MAAM,qBAAqB,CAAC;AAG3E;;GAEG;AAEH,MAAM,OAAO,iCAAiC;IAQ5C,YACE,KAAiC,EACjC,MAA4D;QAE5D,IAAI,CAAC,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB,EAAE,QAAQ;YAC5B,GAAG,MAAM;SACV,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAExC,IAAI,CAAC,gBAAgB,GAAG,IAAI,QAAQ,CAAW,MAAM,CAAC,KAAK,EAAE;YAC3D,aAAa,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;YAC1C,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CACtB,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;QAEH,IACE,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW;YAC1C,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW,EACzC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QAED,IACE,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW;YACzC,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW,EAC1C,CAAC;YACD,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;SACpE,CAAC;QACF,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAES,6BAA6B,CAAC,GAAmB;QACzD,MAAM,GAAG,CAAC;IACZ,CAAC;IAES,aAAa,CAAC,aAA6B;;QACnD,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAErC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,4BAA4B,CACpC,8DAA8D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EACtF,UAAU,EACV,MAAM,EACN,MAAM,CACP,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,MAAA,aAAa,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;QAEpC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,4BAA4B,CACpC,8DAA8D,IAAI,CAAC,MAAM,CAAC,UAAU,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACnI,UAAU,EACV,MAAM,EACN,CAAC,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC,CAC9B,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,GAAG,WAA4B;QAE/B,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAE7B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC,CAAC;QAEhE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG;YACrB,UAAU,EACR,oFAAoF;YACtF,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;YAC9B,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;YACtC,kBAAkB,EAAE,gDAAgD;YACpE,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,UAAU;YACtB,oBAAoB,EAClB,qEAAqE;SACxE,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,cAAc,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,2CAA2C;YAC3C,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAkB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,aAAa,CAAC;IACvB,CAAC;IAES,KAAK,CAAC,cAAc,CAC5B,GAAG,WAA4B;QAE/B,IAAI,aAAwC,CAAC;QAC7C,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACnD,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,WAAW,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,MAAM,gBAAgB,CACpC,IAAI,CAAC,MAAM,CAAC,WAAY,EACxB,WAAW,CACZ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAClC,OAAO,yBAAyB,CAAC,aAAc,CAAC,CAAC;IACnD,CAAC;IAES,KAAK,CAAC,eAAe,CAAC,GAAG,WAA4B;QAC7D,OAAO,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA0C,EAC1C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YACpC,MAAM,UAAU,GAAsB;gBACpC,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;aACnC,CAAC;YAEF,IAAI,iBAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;YACJ,CAAC;YAED,OAAO,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;gBAClD,MAAM,aAAa,GAAG,aAAa,CACjC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAC9B,OAAO,CACR,CAAC;gBACF,IAAI,CAAC;oBACH,IAAI,WAAW,GAAa,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CACzD,aAAa,EACb,YAAY,CACb,CAAC;oBACF,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;wBACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAC7B,aAAa,EACb,YAAY,EACZ,WAAW,CACZ,CAAC;oBACJ,CAAC;oBACD,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;oBACrC,OAAO,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;wBAC5C,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,MAAM,SAAS,GAAG,IAAI,4BAA4B,CAChD,GAAG,CAAC,OAAO,EACX,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,MAAM,CAClB,CAAC;wBACF,OAAO,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC;oBACvD,CAAC;oBACD,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;wBAClC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;CACF","sourcesContent":["import crypto from \"crypto\";\nimport stableHash from \"stable-hash\";\n\nimport {\n  TokenResponse,\n  TokenSet,\n  tokenSetFromTokenResponse,\n} from \"../../credentials\";\nimport {\n  Auth0Interrupt,\n  FederatedConnectionError,\n  FederatedConnectionInterrupt,\n} from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { SubStore } from \"../../stores\";\nimport { omit, RequireFields } from \"../../util\";\nimport { ContextGetter, nsFromContext } from \"../context\";\nimport { Auth0ClientParams, Auth0ClientSchema } from \"../types\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport { FederatedConnectionAuthorizerParams } from \"./FederatedConnectionAuthorizerParams\";\n\n/**\n * Requests authorization to a third party service via Federated Connection.\n */\n\nexport class FederatedConnectionAuthorizerBase<ToolExecuteArgs extends any[]> {\n  private readonly auth0: Auth0ClientParams;\n  private readonly params: RequireFields<\n    FederatedConnectionAuthorizerParams<ToolExecuteArgs>,\n    \"credentialsContext\"\n  >;\n  private readonly credentialsStore: SubStore<TokenSet>;\n\n  constructor(\n    auth0: Partial<Auth0ClientParams>,\n    params: FederatedConnectionAuthorizerParams<ToolExecuteArgs>\n  ) {\n    this.auth0 = Auth0ClientSchema.parse(auth0);\n    this.params = {\n      credentialsContext: \"thread\",\n      ...params,\n    };\n\n    const instanceID = this.getInstanceID();\n\n    this.credentialsStore = new SubStore<TokenSet>(params.store, {\n      baseNamespace: [instanceID, \"Credentials\"],\n      getTTL: (credentials) =>\n        credentials.expiresIn ? credentials.expiresIn * 1000 : undefined,\n    });\n\n    if (\n      typeof params.refreshToken === \"undefined\" &&\n      typeof params.accessToken === \"undefined\"\n    ) {\n      throw new Error(\n        \"Either refreshToken or accessToken must be provided to initialize the Authorizer.\"\n      );\n    }\n\n    if (\n      typeof params.accessToken !== \"undefined\" &&\n      typeof params.refreshToken !== \"undefined\"\n    ) {\n      throw new Error(\n        \"Only one of refreshToken or accessToken can be provided to initialize the Authorizer.\"\n      );\n    }\n  }\n\n  private getInstanceID(): string {\n    const props = {\n      auth0: this.auth0,\n      params: omit(this.params, [\"store\", \"refreshToken\", \"accessToken\"]),\n    };\n    const sh = stableHash(props);\n    return crypto.createHash(\"MD5\").update(sh).digest(\"hex\");\n  }\n\n  protected handleAuthorizationInterrupts(err: Auth0Interrupt) {\n    throw err;\n  }\n\n  protected validateToken(tokenResponse?: TokenResponse) {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\n        \"The tool must be wrapped with the FederationConnectionAuthorizer.\"\n      );\n    }\n\n    const { scopes, connection } = store;\n\n    if (!tokenResponse) {\n      throw new FederatedConnectionInterrupt(\n        `Authorization required to access the Federated Connection: ${this.params.connection}`,\n        connection,\n        scopes,\n        scopes\n      );\n    }\n\n    const currentScopes = (tokenResponse.scope ?? \"\").split(\" \");\n    const missingScopes = scopes.filter((s) => !currentScopes.includes(s));\n    store.currentScopes = currentScopes;\n\n    if (missingScopes.length > 0) {\n      throw new FederatedConnectionInterrupt(\n        `Authorization required to access the Federated Connection: ${this.params.connection}. Missing scopes: ${missingScopes.join(\", \")}`,\n        connection,\n        scopes,\n        [...currentScopes, ...scopes]\n      );\n    }\n  }\n\n  private async getAccessTokenImpl(\n    ...toolContext: ToolExecuteArgs\n  ): Promise<TokenResponse | undefined> {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\n        \"The tool must be wrapped with the FederationConnectionAuthorizer.\"\n      );\n    }\n\n    const { connection } = store;\n\n    const subjectToken = await this.getRefreshToken(...toolContext);\n\n    if (!subjectToken) {\n      return;\n    }\n\n    const exchangeParams = {\n      grant_type:\n        \"urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token\",\n      client_id: this.auth0.clientId,\n      client_secret: this.auth0.clientSecret,\n      subject_token_type: \"urn:ietf:params:oauth:token-type:refresh_token\",\n      subject_token: subjectToken,\n      connection: connection,\n      requested_token_type:\n        \"http://auth0.com/oauth/token-type/federated-connection-access-token\",\n    };\n\n    const res = await fetch(`https://${this.auth0.domain}/oauth/token`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(exchangeParams),\n    });\n\n    if (!res.ok) {\n      //TODO: handle all type of response errors.\n      return;\n    }\n\n    const tokenResponse: TokenResponse = await res.json();\n    return tokenResponse;\n  }\n\n  protected async getAccessToken(\n    ...toolContext: ToolExecuteArgs\n  ): Promise<TokenSet> {\n    let tokenResponse: TokenResponse | undefined;\n    if (typeof this.params.refreshToken === \"function\") {\n      tokenResponse = await this.getAccessTokenImpl(...toolContext);\n    } else {\n      tokenResponse = await resolveParameter(\n        this.params.accessToken!,\n        toolContext\n      );\n    }\n    this.validateToken(tokenResponse);\n    return tokenSetFromTokenResponse(tokenResponse!);\n  }\n\n  protected async getRefreshToken(...toolContext: ToolExecuteArgs) {\n    return await resolveParameter(this.params.refreshToken, toolContext);\n  }\n\n  /**\n   *\n   * Wraps the execute method of an AI tool to handle Federated Connections authorization.\n   *\n   * @param getContext - A function that returns the context of the tool execution.\n   * @param execute - The tool execute method.\n   * @returns The wrapped execute method.\n   */\n  protect(\n    getContext: ContextGetter<ToolExecuteArgs>,\n    execute: (...args: ToolExecuteArgs) => any\n  ): (...args: ToolExecuteArgs) => any {\n    return async (...args: ToolExecuteArgs) => {\n      const context = getContext(...args);\n      const asyncStore: AsyncStorageValue = {\n        context: context,\n        scopes: this.params.scopes,\n        connection: this.params.connection,\n      };\n\n      if (asyncLocalStorage.getStore()) {\n        throw new Error(\n          \"Cannot nest tool calls that require federated connection authorization.\"\n        );\n      }\n\n      return asyncLocalStorage.run(asyncStore, async () => {\n        const credentialsNS = nsFromContext(\n          this.params.credentialsContext,\n          context\n        );\n        try {\n          let credentials: TokenSet = await this.credentialsStore.get(\n            credentialsNS,\n            \"credential\"\n          );\n          if (!credentials) {\n            credentials = await this.getAccessToken(...args);\n            await this.credentialsStore.put(\n              credentialsNS,\n              \"credential\",\n              credentials\n            );\n          }\n          asyncStore.credentials = credentials;\n          return await execute(...args);\n        } catch (err) {\n          if (err instanceof FederatedConnectionError) {\n            this.credentialsStore.delete(credentialsNS, \"credential\");\n            const interrupt = new FederatedConnectionInterrupt(\n              err.message,\n              asyncStore.connection,\n              asyncStore.scopes,\n              asyncStore.scopes\n            );\n            return this.handleAuthorizationInterrupts(interrupt);\n          }\n          if (err instanceof Auth0Interrupt) {\n            this.credentialsStore.delete(credentialsNS, \"credential\");\n            return this.handleAuthorizationInterrupts(err);\n          }\n          throw err;\n        }\n      });\n    };\n  }\n}\n"]}
+{"version":3,"file":"FederatedConnectionAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/federated-connections/FederatedConnectionAuthorizerBase.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,UAAU,MAAM,aAAa,CAAC;AAErC,OAAO,EAGL,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,IAAI,EAAiB,MAAM,YAAY,CAAC;AACjD,OAAO,EAAiB,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAqB,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAqB,MAAM,qBAAqB,CAAC;AAG3E;;GAEG;AAEH,MAAM,OAAO,iCAAiC;IAQ5C,YACE,KAAiC,EACjC,MAA4D;QAE5D,IAAI,CAAC,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB,EAAE,QAAQ;YAC5B,GAAG,MAAM;SACV,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAExC,IAAI,CAAC,gBAAgB,GAAG,IAAI,QAAQ,CAAW,MAAM,CAAC,KAAK,EAAE;YAC3D,aAAa,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;YAC1C,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CACtB,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;QAEH,IACE,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW;YAC1C,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW,EACzC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QAED,IACE,OAAO,MAAM,CAAC,WAAW,KAAK,WAAW;YACzC,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW,EAC1C,CAAC;YACD,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;SACpE,CAAC;QACF,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAES,6BAA6B,CAAC,GAAmB;QACzD,MAAM,GAAG,CAAC;IACZ,CAAC;IAES,aAAa,CAAC,aAA6B;;QACnD,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAErC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,4BAA4B,CACpC,8DAA8D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EACtF,UAAU,EACV,MAAM,EACN,MAAM,CACP,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,MAAA,aAAa,CAAC,KAAK,mCAAI,EAAE,CAAC;aAC9C,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;QAEpC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,4BAA4B,CACpC,8DAA8D,IAAI,CAAC,MAAM,CAAC,UAAU,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACnI,UAAU,EACV,MAAM,EACN,CAAC,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC,CAC9B,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,GAAG,WAA4B;QAE/B,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAE7B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC,CAAC;QAEhE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG;YACrB,UAAU,EACR,oFAAoF;YACtF,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;YAC9B,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;YACtC,kBAAkB,EAAE,gDAAgD;YACpE,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,UAAU;YACtB,oBAAoB,EAClB,qEAAqE;SACxE,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,cAAc,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,2CAA2C;YAC3C,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAkB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,aAAa,CAAC;IACvB,CAAC;IAES,KAAK,CAAC,cAAc,CAC5B,GAAG,WAA4B;QAE/B,IAAI,aAAwC,CAAC;QAC7C,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACnD,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,WAAW,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,MAAM,gBAAgB,CACpC,IAAI,CAAC,MAAM,CAAC,WAAY,EACxB,WAAW,CACZ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAClC,OAAO,yBAAyB,CAAC,aAAc,CAAC,CAAC;IACnD,CAAC;IAES,KAAK,CAAC,eAAe,CAAC,GAAG,WAA4B;QAC7D,OAAO,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA0C,EAC1C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YACpC,MAAM,UAAU,GAAsB;gBACpC,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;aACnC,CAAC;YAEF,IAAI,iBAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;YACJ,CAAC;YAED,OAAO,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;gBAClD,MAAM,aAAa,GAAG,aAAa,CACjC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAC9B,OAAO,CACR,CAAC;gBACF,IAAI,CAAC;oBACH,IAAI,WAAW,GAAa,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CACzD,aAAa,EACb,YAAY,CACb,CAAC;oBACF,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;wBACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAC7B,aAAa,EACb,YAAY,EACZ,WAAW,CACZ,CAAC;oBACJ,CAAC;oBACD,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;oBACrC,OAAO,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;wBAC5C,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,MAAM,SAAS,GAAG,IAAI,4BAA4B,CAChD,GAAG,CAAC,OAAO,EACX,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,MAAM,CAClB,CAAC;wBACF,OAAO,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC;oBACvD,CAAC;oBACD,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;wBAClC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;wBAC1D,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;CACF","sourcesContent":["import crypto from \"crypto\";\nimport stableHash from \"stable-hash\";\n\nimport {\n  TokenResponse,\n  TokenSet,\n  tokenSetFromTokenResponse,\n} from \"../../credentials\";\nimport {\n  Auth0Interrupt,\n  FederatedConnectionError,\n  FederatedConnectionInterrupt,\n} from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { SubStore } from \"../../stores\";\nimport { omit, RequireFields } from \"../../util\";\nimport { ContextGetter, nsFromContext } from \"../context\";\nimport { Auth0ClientParams, Auth0ClientSchema } from \"../types\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport { FederatedConnectionAuthorizerParams } from \"./FederatedConnectionAuthorizerParams\";\n\n/**\n * Requests authorization to a third party service via Federated Connection.\n */\n\nexport class FederatedConnectionAuthorizerBase<ToolExecuteArgs extends any[]> {\n  private readonly auth0: Auth0ClientParams;\n  private readonly params: RequireFields<\n    FederatedConnectionAuthorizerParams<ToolExecuteArgs>,\n    \"credentialsContext\"\n  >;\n  private readonly credentialsStore: SubStore<TokenSet>;\n\n  constructor(\n    auth0: Partial<Auth0ClientParams>,\n    params: FederatedConnectionAuthorizerParams<ToolExecuteArgs>\n  ) {\n    this.auth0 = Auth0ClientSchema.parse(auth0);\n    this.params = {\n      credentialsContext: \"thread\",\n      ...params,\n    };\n\n    const instanceID = this.getInstanceID();\n\n    this.credentialsStore = new SubStore<TokenSet>(params.store, {\n      baseNamespace: [instanceID, \"Credentials\"],\n      getTTL: (credentials) =>\n        credentials.expiresIn ? credentials.expiresIn * 1000 : undefined,\n    });\n\n    if (\n      typeof params.refreshToken === \"undefined\" &&\n      typeof params.accessToken === \"undefined\"\n    ) {\n      throw new Error(\n        \"Either refreshToken or accessToken must be provided to initialize the Authorizer.\"\n      );\n    }\n\n    if (\n      typeof params.accessToken !== \"undefined\" &&\n      typeof params.refreshToken !== \"undefined\"\n    ) {\n      throw new Error(\n        \"Only one of refreshToken or accessToken can be provided to initialize the Authorizer.\"\n      );\n    }\n  }\n\n  private getInstanceID(): string {\n    const props = {\n      auth0: this.auth0,\n      params: omit(this.params, [\"store\", \"refreshToken\", \"accessToken\"]),\n    };\n    const sh = stableHash(props);\n    return crypto.createHash(\"MD5\").update(sh).digest(\"hex\");\n  }\n\n  protected handleAuthorizationInterrupts(err: Auth0Interrupt) {\n    throw err;\n  }\n\n  protected validateToken(tokenResponse?: TokenResponse) {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\n        \"The tool must be wrapped with the FederationConnectionAuthorizer.\"\n      );\n    }\n\n    const { scopes, connection } = store;\n\n    if (!tokenResponse) {\n      throw new FederatedConnectionInterrupt(\n        `Authorization required to access the Federated Connection: ${this.params.connection}`,\n        connection,\n        scopes,\n        scopes\n      );\n    }\n\n    const currentScopes = (tokenResponse.scope ?? \"\")\n      .replace(/,/g, \" \")\n      .split(\" \");\n    const missingScopes = scopes.filter((s) => !currentScopes.includes(s));\n    store.currentScopes = currentScopes;\n\n    if (missingScopes.length > 0) {\n      throw new FederatedConnectionInterrupt(\n        `Authorization required to access the Federated Connection: ${this.params.connection}. Missing scopes: ${missingScopes.join(\", \")}`,\n        connection,\n        scopes,\n        [...currentScopes, ...scopes]\n      );\n    }\n  }\n\n  private async getAccessTokenImpl(\n    ...toolContext: ToolExecuteArgs\n  ): Promise<TokenResponse | undefined> {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\n        \"The tool must be wrapped with the FederationConnectionAuthorizer.\"\n      );\n    }\n\n    const { connection } = store;\n\n    const subjectToken = await this.getRefreshToken(...toolContext);\n\n    if (!subjectToken) {\n      return;\n    }\n\n    const exchangeParams = {\n      grant_type:\n        \"urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token\",\n      client_id: this.auth0.clientId,\n      client_secret: this.auth0.clientSecret,\n      subject_token_type: \"urn:ietf:params:oauth:token-type:refresh_token\",\n      subject_token: subjectToken,\n      connection: connection,\n      requested_token_type:\n        \"http://auth0.com/oauth/token-type/federated-connection-access-token\",\n    };\n\n    const res = await fetch(`https://${this.auth0.domain}/oauth/token`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(exchangeParams),\n    });\n\n    if (!res.ok) {\n      //TODO: handle all type of response errors.\n      return;\n    }\n\n    const tokenResponse: TokenResponse = await res.json();\n    return tokenResponse;\n  }\n\n  protected async getAccessToken(\n    ...toolContext: ToolExecuteArgs\n  ): Promise<TokenSet> {\n    let tokenResponse: TokenResponse | undefined;\n    if (typeof this.params.refreshToken === \"function\") {\n      tokenResponse = await this.getAccessTokenImpl(...toolContext);\n    } else {\n      tokenResponse = await resolveParameter(\n        this.params.accessToken!,\n        toolContext\n      );\n    }\n    this.validateToken(tokenResponse);\n    return tokenSetFromTokenResponse(tokenResponse!);\n  }\n\n  protected async getRefreshToken(...toolContext: ToolExecuteArgs) {\n    return await resolveParameter(this.params.refreshToken, toolContext);\n  }\n\n  /**\n   *\n   * Wraps the execute method of an AI tool to handle Federated Connections authorization.\n   *\n   * @param getContext - A function that returns the context of the tool execution.\n   * @param execute - The tool execute method.\n   * @returns The wrapped execute method.\n   */\n  protect(\n    getContext: ContextGetter<ToolExecuteArgs>,\n    execute: (...args: ToolExecuteArgs) => any\n  ): (...args: ToolExecuteArgs) => any {\n    return async (...args: ToolExecuteArgs) => {\n      const context = getContext(...args);\n      const asyncStore: AsyncStorageValue = {\n        context: context,\n        scopes: this.params.scopes,\n        connection: this.params.connection,\n      };\n\n      if (asyncLocalStorage.getStore()) {\n        throw new Error(\n          \"Cannot nest tool calls that require federated connection authorization.\"\n        );\n      }\n\n      return asyncLocalStorage.run(asyncStore, async () => {\n        const credentialsNS = nsFromContext(\n          this.params.credentialsContext,\n          context\n        );\n        try {\n          let credentials: TokenSet = await this.credentialsStore.get(\n            credentialsNS,\n            \"credential\"\n          );\n          if (!credentials) {\n            credentials = await this.getAccessToken(...args);\n            await this.credentialsStore.put(\n              credentialsNS,\n              \"credential\",\n              credentials\n            );\n          }\n          asyncStore.credentials = credentials;\n          return await execute(...args);\n        } catch (err) {\n          if (err instanceof FederatedConnectionError) {\n            this.credentialsStore.delete(credentialsNS, \"credential\");\n            const interrupt = new FederatedConnectionInterrupt(\n              err.message,\n              asyncStore.connection,\n              asyncStore.scopes,\n              asyncStore.scopes\n            );\n            return this.handleAuthorizationInterrupts(interrupt);\n          }\n          if (err instanceof Auth0Interrupt) {\n            this.credentialsStore.delete(credentialsNS, \"credential\");\n            return this.handleAuthorizationInterrupts(err);\n          }\n          throw err;\n        }\n      });\n    };\n  }\n}\n"]}

package/dist/esm/interrupts/CIBAInterrupts.d.ts

@@ -8,7 +8,9 @@ export interface WithRequestData {
  */
 export declare class CIBAInterrupt extends Auth0Interrupt {
     constructor(message: string, code: string);
-    static isInterrupt<T extends abstract new (...args: any) => any>(this: T, interrupt: any): interrupt is Auth0InterruptData<InstanceType<T>>;
+    static isInterrupt<T extends abstract new (...args: any) => any>(this: T & {
+        code?: string;
+    }, interrupt: any): interrupt is Auth0InterruptData<InstanceType<T>>;
     static hasRequestData(interrupt: any): interrupt is WithRequestData;
 }
 /**
@@ -46,7 +48,7 @@ export declare class AuthorizationPendingInterrupt extends CIBAInterrupt impleme
 /**
  * An interrupt that is thrown when the authorization polling fails.
  */
-export declare class AuthorizationPollingInterrupt extends Auth0Interrupt implements WithRequestData {
+export declare class AuthorizationPollingInterrupt extends CIBAInterrupt implements WithRequestData {
     readonly request: CIBAAuthorizationRequest;
     static code: string;
     constructor(message: string, request: CIBAAuthorizationRequest);
@@ -54,7 +56,7 @@ export declare class AuthorizationPollingInterrupt extends Auth0Interrupt implem
 /**
  * An interrupt that is thrown when the authorization polling fails.
  */
-export declare class InvalidGrantInterrupt extends Auth0Interrupt implements WithRequestData {
+export declare class InvalidGrantInterrupt extends CIBAInterrupt implements WithRequestData {
     readonly request: CIBAAuthorizationRequest;
     static code: string;
     constructor(message: string, request: CIBAAuthorizationRequest);

package/dist/esm/interrupts/CIBAInterrupts.js

@@ -10,7 +10,8 @@ export class CIBAInterrupt extends Auth0Interrupt {
         return (interrupt &&
             Auth0Interrupt.isInterrupt(interrupt) &&
             typeof interrupt.code === "string" &&
-            interrupt.code.startsWith("CIBA_"));
+            (this.code === interrupt.code ||
+                (!this.code && interrupt.code.startsWith("CIBA_"))));
     }
     static hasRequestData(interrupt) {
         return CIBAInterrupt.isInterrupt(interrupt) && "request" in interrupt;
@@ -59,7 +60,7 @@ AuthorizationPendingInterrupt.code = "CIBA_AUTHORIZATION_PENDING";
 /**
  * An interrupt that is thrown when the authorization polling fails.
  */
-export class AuthorizationPollingInterrupt extends Auth0Interrupt {
+export class AuthorizationPollingInterrupt extends CIBAInterrupt {
     constructor(message, request) {
         super(message, AuthorizationPollingInterrupt.code);
         this.request = request;
@@ -69,7 +70,7 @@ AuthorizationPollingInterrupt.code = "CIBA_AUTHORIZATION_POLLING_ERROR";
 /**
  * An interrupt that is thrown when the authorization polling fails.
  */
-export class InvalidGrantInterrupt extends Auth0Interrupt {
+export class InvalidGrantInterrupt extends CIBAInterrupt {
     constructor(message, request) {
         super(message, AuthorizationPollingInterrupt.code);
         this.request = request;

package/dist/esm/interrupts/CIBAInterrupts.js.map

@@ -1 +1 @@
-{"version":3,"file":"CIBAInterrupts.js","sourceRoot":"","sources":["../../../src/interrupts/CIBAInterrupts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAsB,MAAM,kBAAkB,CAAC;AAMtE;;GAEG;AACH,MAAM,OAAO,aAAc,SAAQ,cAAc;IAC/C,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,WAAW,CAEhB,SAAc;QAEd,OAAO,CACL,SAAS;YACT,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC;YACrC,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;YAClC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CACnC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,SAAc;QAClC,OAAO,aAAa,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,SAAS,CAAC;IACxE,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,qBACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAF3B,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AANa,0BAAI,GAAW,oBAA6B,CAAC;AAS7D;;GAEG;AACH,MAAM,OAAO,yCAA0C,SAAQ,aAAa;IAG1E,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,yCAAyC,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;;AAJa,8CAAI,GAChB,4CAAqD,CAAC;AAM1D;;GAEG;AACH,MAAM,OAAO,oCACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,oCAAoC,CAAC,IAAI,CAAC,CAAC;QAF1C,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AANa,yCAAI,GAAW,oCAA6C,CAAC;AAS7E;;;GAGG;AACH,MAAM,OAAO,6BACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AANa,kCAAI,GAAW,4BAAqC,CAAC;AASrE;;GAEG;AACH,MAAM,OAAO,6BACX,SAAQ,cAAc;IAItB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AANa,kCAAI,GAAW,kCAA2C,CAAC;AAS3E;;GAEG;AACH,MAAM,OAAO,qBACX,SAAQ,cAAc;IAItB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AANa,0BAAI,GAAW,oBAA6B,CAAC","sourcesContent":["import { CIBAAuthorizationRequest } from \"../authorizers/ciba/CIBAAuthorizationRequest\";\nimport { Auth0Interrupt, Auth0InterruptData } from \"./Auth0Interrupt\";\n\nexport interface WithRequestData {\n  request: CIBAAuthorizationRequest;\n}\n\n/**\n * Base class for CIBA interrupts.\n */\nexport class CIBAInterrupt extends Auth0Interrupt {\n  constructor(message: string, code: string) {\n    super(message, code);\n  }\n\n  static isInterrupt<T extends abstract new (...args: any) => any>(\n    this: T,\n    interrupt: any\n  ): interrupt is Auth0InterruptData<InstanceType<T>> {\n    return (\n      interrupt &&\n      Auth0Interrupt.isInterrupt(interrupt) &&\n      typeof interrupt.code === \"string\" &&\n      interrupt.code.startsWith(\"CIBA_\")\n    );\n  }\n\n  static hasRequestData(interrupt: any): interrupt is WithRequestData {\n    return CIBAInterrupt.isInterrupt(interrupt) && \"request\" in interrupt;\n  }\n}\n\n/**\n * An interrupt that is thrown when the user denies the authorization request.\n */\nexport class AccessDeniedInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_ACCESS_DENIED\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AccessDeniedInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the user does not have push notifications enabled.\n */\nexport class UserDoesNotHavePushNotificationsInterrupt extends CIBAInterrupt {\n  public static code: string =\n    \"CIBA_USER_DOES_NOT_HAVE_PUSH_NOTIFICATIONS\" as const;\n  constructor(message: string) {\n    super(message, UserDoesNotHavePushNotificationsInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization request has expired.\n */\nexport class AuthorizationRequestExpiredInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_REQUEST_EXPIRED\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationRequestExpiredInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization is still pending\n * and the Authorizer is in `mode: interrupt`.\n */\nexport class AuthorizationPendingInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_PENDING\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPendingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class AuthorizationPollingInterrupt\n  extends Auth0Interrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_POLLING_ERROR\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class InvalidGrantInterrupt\n  extends Auth0Interrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_INVALID_GRANT\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n"]}
+{"version":3,"file":"CIBAInterrupts.js","sourceRoot":"","sources":["../../../src/interrupts/CIBAInterrupts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAsB,MAAM,kBAAkB,CAAC;AAMtE;;GAEG;AACH,MAAM,OAAO,aAAc,SAAQ,cAAc;IAC/C,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,WAAW,CAEhB,SAAc;QAEd,OAAO,CACL,SAAS;YACT,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC;YACrC,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;YAClC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI;gBAC3B,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,SAAc;QAClC,OAAO,aAAa,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,SAAS,CAAC;IACxE,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,qBACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAF3B,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AANa,0BAAI,GAAW,oBAA6B,CAAC;AAS7D;;GAEG;AACH,MAAM,OAAO,yCAA0C,SAAQ,aAAa;IAG1E,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,yCAAyC,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;;AAJa,8CAAI,GAChB,4CAAqD,CAAC;AAM1D;;GAEG;AACH,MAAM,OAAO,oCACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,oCAAoC,CAAC,IAAI,CAAC,CAAC;QAF1C,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AANa,yCAAI,GAAW,oCAA6C,CAAC;AAS7E;;;GAGG;AACH,MAAM,OAAO,6BACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AANa,kCAAI,GAAW,4BAAqC,CAAC;AASrE;;GAEG;AACH,MAAM,OAAO,6BACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AANa,kCAAI,GAAW,kCAA2C,CAAC;AAS3E;;GAEG;AACH,MAAM,OAAO,qBACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AANa,0BAAI,GAAW,oBAA6B,CAAC","sourcesContent":["import { CIBAAuthorizationRequest } from \"../authorizers/ciba/CIBAAuthorizationRequest\";\nimport { Auth0Interrupt, Auth0InterruptData } from \"./Auth0Interrupt\";\n\nexport interface WithRequestData {\n  request: CIBAAuthorizationRequest;\n}\n\n/**\n * Base class for CIBA interrupts.\n */\nexport class CIBAInterrupt extends Auth0Interrupt {\n  constructor(message: string, code: string) {\n    super(message, code);\n  }\n\n  static isInterrupt<T extends abstract new (...args: any) => any>(\n    this: T & { code?: string },\n    interrupt: any\n  ): interrupt is Auth0InterruptData<InstanceType<T>> {\n    return (\n      interrupt &&\n      Auth0Interrupt.isInterrupt(interrupt) &&\n      typeof interrupt.code === \"string\" &&\n      (this.code === interrupt.code ||\n        (!this.code && interrupt.code.startsWith(\"CIBA_\")))\n    );\n  }\n\n  static hasRequestData(interrupt: any): interrupt is WithRequestData {\n    return CIBAInterrupt.isInterrupt(interrupt) && \"request\" in interrupt;\n  }\n}\n\n/**\n * An interrupt that is thrown when the user denies the authorization request.\n */\nexport class AccessDeniedInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_ACCESS_DENIED\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AccessDeniedInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the user does not have push notifications enabled.\n */\nexport class UserDoesNotHavePushNotificationsInterrupt extends CIBAInterrupt {\n  public static code: string =\n    \"CIBA_USER_DOES_NOT_HAVE_PUSH_NOTIFICATIONS\" as const;\n  constructor(message: string) {\n    super(message, UserDoesNotHavePushNotificationsInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization request has expired.\n */\nexport class AuthorizationRequestExpiredInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_REQUEST_EXPIRED\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationRequestExpiredInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization is still pending\n * and the Authorizer is in `mode: interrupt`.\n */\nexport class AuthorizationPendingInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_PENDING\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPendingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class AuthorizationPollingInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_POLLING_ERROR\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class InvalidGrantInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_INVALID_GRANT\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n"]}

package/dist/esm/interrupts/DeviceInterrupts.d.ts

@@ -8,7 +8,9 @@ export interface WithDeviceAuthResponseData {
  */
 export declare class DeviceInterrupt extends Auth0Interrupt {
     constructor(message: string, code: string);
-    static isInterrupt<T extends abstract new (...args: any) => any>(this: T, interrupt: any): interrupt is Auth0InterruptData<InstanceType<T>>;
+    static isInterrupt<T extends abstract new (...args: any) => any>(this: T & {
+        code?: string;
+    }, interrupt: any): interrupt is Auth0InterruptData<InstanceType<T>>;
     static hasRequestData(interrupt: any): interrupt is WithDeviceAuthResponseData;
 }
 /**

package/dist/esm/interrupts/DeviceInterrupts.js

@@ -10,7 +10,8 @@ export class DeviceInterrupt extends Auth0Interrupt {
         return (interrupt &&
             Auth0Interrupt.isInterrupt(interrupt) &&
             typeof interrupt.code === "string" &&
-            interrupt.code.startsWith("DEVICE_"));
+            (this.code === interrupt.code ||
+                (!this.code && interrupt.code.startsWith("DEVICE_"))));
     }
     static hasRequestData(interrupt) {
         return DeviceInterrupt.isInterrupt(interrupt) && "response" in interrupt;

package/dist/esm/interrupts/DeviceInterrupts.js.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceInterrupts.js","sourceRoot":"","sources":["../../../src/interrupts/DeviceInterrupts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAsB,MAAM,kBAAkB,CAAC;AAMtE;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,cAAc;IACjD,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,WAAW,CAEhB,SAAc;QAEd,OAAO,CACL,SAAS;YACT,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC;YACrC,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;YAClC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CACrC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,cAAc,CACnB,SAAc;QAEd,OAAO,eAAe,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,UAAU,IAAI,SAAS,CAAC;IAC3E,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,qBACX,SAAQ,eAAe;IAIvB,YACE,OAAe,EACC,QAAqC;QAErD,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAF3B,aAAQ,GAAR,QAAQ,CAA6B;IAGvD,CAAC;;AANa,0BAAI,GAAW,sBAA+B,CAAC;AAS/D;;GAEG;AACH,MAAM,OAAO,oCACX,SAAQ,eAAe;IAIvB,YACE,OAAe,EACC,QAAqC;QAErD,KAAK,CAAC,OAAO,EAAE,oCAAoC,CAAC,IAAI,CAAC,CAAC;QAF1C,aAAQ,GAAR,QAAQ,CAA6B;IAGvD,CAAC;;AANa,yCAAI,GAAW,sCAA+C,CAAC;AAS/E;;;GAGG;AACH,MAAM,OAAO,6BACX,SAAQ,eAAe;IAIvB,YACE,OAAe,EACC,QAAqC;QAErD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,aAAQ,GAAR,QAAQ,CAA6B;IAGvD,CAAC;;AANa,kCAAI,GAAW,8BAAuC,CAAC;AASvE;;GAEG;AACH,MAAM,OAAO,6BACX,SAAQ,cAAc;IAItB,YACE,OAAe,EACC,QAAqC;QAErD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,aAAQ,GAAR,QAAQ,CAA6B;IAGvD,CAAC;;AANa,kCAAI,GAAW,oCAA6C,CAAC;AAS7E;;GAEG;AACH,MAAM,OAAO,qBACX,SAAQ,cAAc;IAItB,YACE,OAAe,EACC,QAAqC;QAErD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,aAAQ,GAAR,QAAQ,CAA6B;IAGvD,CAAC;;AANa,0BAAI,GAAW,sBAA+B,CAAC","sourcesContent":["import { DeviceAuthorizationResponse } from \"../authorizers/device-authorizer/DeviceAuthResponse\";\nimport { Auth0Interrupt, Auth0InterruptData } from \"./Auth0Interrupt\";\n\nexport interface WithDeviceAuthResponseData {\n  response: DeviceAuthorizationResponse;\n}\n\n/**\n * Base class for Device interrupts.\n */\nexport class DeviceInterrupt extends Auth0Interrupt {\n  constructor(message: string, code: string) {\n    super(message, code);\n  }\n\n  static isInterrupt<T extends abstract new (...args: any) => any>(\n    this: T,\n    interrupt: any\n  ): interrupt is Auth0InterruptData<InstanceType<T>> {\n    return (\n      interrupt &&\n      Auth0Interrupt.isInterrupt(interrupt) &&\n      typeof interrupt.code === \"string\" &&\n      interrupt.code.startsWith(\"DEVICE_\")\n    );\n  }\n\n  static hasRequestData(\n    interrupt: any\n  ): interrupt is WithDeviceAuthResponseData {\n    return DeviceInterrupt.isInterrupt(interrupt) && \"response\" in interrupt;\n  }\n}\n\n/**\n * An interrupt that is thrown when the user denies the authorization request.\n */\nexport class AccessDeniedInterrupt\n  extends DeviceInterrupt\n  implements WithDeviceAuthResponseData\n{\n  public static code: string = \"DEVICE_ACCESS_DENIED\" as const;\n  constructor(\n    message: string,\n    public readonly response: DeviceAuthorizationResponse\n  ) {\n    super(message, AccessDeniedInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization request has expired.\n */\nexport class AuthorizationRequestExpiredInterrupt\n  extends DeviceInterrupt\n  implements WithDeviceAuthResponseData\n{\n  public static code: string = \"DEVICE_AUTHORIZATION_REQUEST_EXPIRED\" as const;\n  constructor(\n    message: string,\n    public readonly response: DeviceAuthorizationResponse\n  ) {\n    super(message, AuthorizationRequestExpiredInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization is still pending\n * and the Authorizer is in `mode: interrupt`.\n */\nexport class AuthorizationPendingInterrupt\n  extends DeviceInterrupt\n  implements WithDeviceAuthResponseData\n{\n  public static code: string = \"DEVICE_AUTHORIZATION_PENDING\" as const;\n  constructor(\n    message: string,\n    public readonly response: DeviceAuthorizationResponse\n  ) {\n    super(message, AuthorizationPendingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class AuthorizationPollingInterrupt\n  extends Auth0Interrupt\n  implements WithDeviceAuthResponseData\n{\n  public static code: string = \"DEVICE_AUTHORIZATION_POLLING_ERROR\" as const;\n  constructor(\n    message: string,\n    public readonly response: DeviceAuthorizationResponse\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the grant is invalid.\n */\nexport class InvalidGrantInterrupt\n  extends Auth0Interrupt\n  implements WithDeviceAuthResponseData\n{\n  public static code: string = \"DEVICE_INVALID_GRANT\" as const;\n  constructor(\n    message: string,\n    public readonly response: DeviceAuthorizationResponse\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n"]}
+{"version":3,"file":"DeviceInterrupts.js","sourceRoot":"","sources":["../../../src/interrupts/DeviceInterrupts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAsB,MAAM,kBAAkB,CAAC;AAMtE;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,cAAc;IACjD,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,WAAW,CAEhB,SAAc;QAEd,OAAO,CACL,SAAS;YACT,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC;YACrC,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;YAClC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI;gBAC3B,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CACxD,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,cAAc,CACnB,SAAc;QAEd,OAAO,eAAe,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,UAAU,IAAI,SAAS,CAAC;IAC3E,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,qBACX,SAAQ,eAAe;IAIvB,YACE,OAAe,EACC,QAAqC;QAErD,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAF3B,aAAQ,GAAR,QAAQ,CAA6B;IAGvD,CAAC;;AANa,0BAAI,GAAW,sBAA+B,CAAC;AAS/D;;GAEG;AACH,MAAM,OAAO,oCACX,SAAQ,eAAe;IAIvB,YACE,OAAe,EACC,QAAqC;QAErD,KAAK,CAAC,OAAO,EAAE,oCAAoC,CAAC,IAAI,CAAC,CAAC;QAF1C,aAAQ,GAAR,QAAQ,CAA6B;IAGvD,CAAC;;AANa,yCAAI,GAAW,sCAA+C,CAAC;AAS/E;;;GAGG;AACH,MAAM,OAAO,6BACX,SAAQ,eAAe;IAIvB,YACE,OAAe,EACC,QAAqC;QAErD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,aAAQ,GAAR,QAAQ,CAA6B;IAGvD,CAAC;;AANa,kCAAI,GAAW,8BAAuC,CAAC;AASvE;;GAEG;AACH,MAAM,OAAO,6BACX,SAAQ,cAAc;IAItB,YACE,OAAe,EACC,QAAqC;QAErD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,aAAQ,GAAR,QAAQ,CAA6B;IAGvD,CAAC;;AANa,kCAAI,GAAW,oCAA6C,CAAC;AAS7E;;GAEG;AACH,MAAM,OAAO,qBACX,SAAQ,cAAc;IAItB,YACE,OAAe,EACC,QAAqC;QAErD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,aAAQ,GAAR,QAAQ,CAA6B;IAGvD,CAAC;;AANa,0BAAI,GAAW,sBAA+B,CAAC","sourcesContent":["import { DeviceAuthorizationResponse } from \"../authorizers/device-authorizer/DeviceAuthResponse\";\nimport { Auth0Interrupt, Auth0InterruptData } from \"./Auth0Interrupt\";\n\nexport interface WithDeviceAuthResponseData {\n  response: DeviceAuthorizationResponse;\n}\n\n/**\n * Base class for Device interrupts.\n */\nexport class DeviceInterrupt extends Auth0Interrupt {\n  constructor(message: string, code: string) {\n    super(message, code);\n  }\n\n  static isInterrupt<T extends abstract new (...args: any) => any>(\n    this: T & { code?: string },\n    interrupt: any\n  ): interrupt is Auth0InterruptData<InstanceType<T>> {\n    return (\n      interrupt &&\n      Auth0Interrupt.isInterrupt(interrupt) &&\n      typeof interrupt.code === \"string\" &&\n      (this.code === interrupt.code ||\n        (!this.code && interrupt.code.startsWith(\"DEVICE_\")))\n    );\n  }\n\n  static hasRequestData(\n    interrupt: any\n  ): interrupt is WithDeviceAuthResponseData {\n    return DeviceInterrupt.isInterrupt(interrupt) && \"response\" in interrupt;\n  }\n}\n\n/**\n * An interrupt that is thrown when the user denies the authorization request.\n */\nexport class AccessDeniedInterrupt\n  extends DeviceInterrupt\n  implements WithDeviceAuthResponseData\n{\n  public static code: string = \"DEVICE_ACCESS_DENIED\" as const;\n  constructor(\n    message: string,\n    public readonly response: DeviceAuthorizationResponse\n  ) {\n    super(message, AccessDeniedInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization request has expired.\n */\nexport class AuthorizationRequestExpiredInterrupt\n  extends DeviceInterrupt\n  implements WithDeviceAuthResponseData\n{\n  public static code: string = \"DEVICE_AUTHORIZATION_REQUEST_EXPIRED\" as const;\n  constructor(\n    message: string,\n    public readonly response: DeviceAuthorizationResponse\n  ) {\n    super(message, AuthorizationRequestExpiredInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization is still pending\n * and the Authorizer is in `mode: interrupt`.\n */\nexport class AuthorizationPendingInterrupt\n  extends DeviceInterrupt\n  implements WithDeviceAuthResponseData\n{\n  public static code: string = \"DEVICE_AUTHORIZATION_PENDING\" as const;\n  constructor(\n    message: string,\n    public readonly response: DeviceAuthorizationResponse\n  ) {\n    super(message, AuthorizationPendingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class AuthorizationPollingInterrupt\n  extends Auth0Interrupt\n  implements WithDeviceAuthResponseData\n{\n  public static code: string = \"DEVICE_AUTHORIZATION_POLLING_ERROR\" as const;\n  constructor(\n    message: string,\n    public readonly response: DeviceAuthorizationResponse\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the grant is invalid.\n */\nexport class InvalidGrantInterrupt\n  extends Auth0Interrupt\n  implements WithDeviceAuthResponseData\n{\n  public static code: string = \"DEVICE_INVALID_GRANT\" as const;\n  constructor(\n    message: string,\n    public readonly response: DeviceAuthorizationResponse\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n"]}

package/dist/esm/interrupts/FederatedConnectionInterrupt.d.ts

@@ -5,6 +5,7 @@ import { Auth0Interrupt } from "./Auth0Interrupt";
  * Throw this error if the service returns Unauthorized for the current access token.
  */
 export declare class FederatedConnectionInterrupt extends Auth0Interrupt {
+    behavior: "resume" | "reload";
     /**
      * The auth0 connection name.
      */
@@ -20,7 +21,7 @@ export declare class FederatedConnectionInterrupt extends Auth0Interrupt {
      */
     readonly requiredScopes: string[];
     static code: "FEDERATED_CONNECTION_ERROR";
-    constructor(message: string, connection: string, scopes: string[], requiredScopes: string[]);
+    constructor(message: string, connection: string, scopes: string[], requiredScopes: string[], behavior?: "resume" | "reload");
 }
 /**
  * Error thrown when a tool call requires an access token for an external service.

package/dist/esm/interrupts/FederatedConnectionInterrupt.js

@@ -5,8 +5,9 @@ import { Auth0Interrupt } from "./Auth0Interrupt";
  * Throw this error if the service returns Unauthorized for the current access token.
  */
 export class FederatedConnectionInterrupt extends Auth0Interrupt {
-    constructor(message, connection, scopes, requiredScopes) {
+    constructor(message, connection, scopes, requiredScopes, behavior = "resume") {
         super(message, FederatedConnectionInterrupt.code);
+        this.behavior = behavior;
         this.connection = connection;
         this.scopes = scopes;
         this.requiredScopes = requiredScopes;

package/dist/esm/interrupts/FederatedConnectionInterrupt.js.map

@@ -1 +1 @@
-{"version":3,"file":"FederatedConnectionInterrupt.js","sourceRoot":"","sources":["../../../src/interrupts/FederatedConnectionInterrupt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD;;;;GAIG;AACH,MAAM,OAAO,4BAA6B,SAAQ,cAAc;IAoB9D,YACE,OAAe,EACf,UAAkB,EAClB,MAAgB,EAChB,cAAwB;QAExB,KAAK,CAAC,OAAO,EAAE,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;;AAZa,iCAAI,GAAG,4BAAqC,CAAC;AAe7D;;;;GAIG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF","sourcesContent":["import { Auth0Interrupt } from \"./Auth0Interrupt\";\n\n/**\n * Error thrown when a tool call requires an access token for an external service.\n *\n * Throw this error if the service returns Unauthorized for the current access token.\n */\nexport class FederatedConnectionInterrupt extends Auth0Interrupt {\n  /**\n   * The auth0 connection name.\n   */\n  public readonly connection: string;\n\n  /**\n   * The scopes required to access the external service as stated\n   * in the authorizer.\n   */\n  public readonly scopes: string[];\n\n  /**\n   * The union between the current scopes of the Access Token plus the required scopes.\n   * This is the list of scopes that will be used to request a new Access Token.\n   */\n  public readonly requiredScopes: string[];\n\n  public static code = \"FEDERATED_CONNECTION_ERROR\" as const;\n\n  constructor(\n    message: string,\n    connection: string,\n    scopes: string[],\n    requiredScopes: string[]\n  ) {\n    super(message, FederatedConnectionInterrupt.code);\n    this.connection = connection;\n    this.scopes = scopes;\n    this.requiredScopes = requiredScopes;\n  }\n}\n\n/**\n * Error thrown when a tool call requires an access token for an external service.\n *\n * The authorizer will automatically convert this class of error to FederatedConnectionInterrupt.\n */\nexport class FederatedConnectionError extends Error {\n  constructor(message: string) {\n    super(message);\n  }\n}\n"]}
+{"version":3,"file":"FederatedConnectionInterrupt.js","sourceRoot":"","sources":["../../../src/interrupts/FederatedConnectionInterrupt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD;;;;GAIG;AACH,MAAM,OAAO,4BAA6B,SAAQ,cAAc;IAsB9D,YACE,OAAe,EACf,UAAkB,EAClB,MAAgB,EAChB,cAAwB,EACxB,WAAgC,QAAQ;QAExC,KAAK,CAAC,OAAO,EAAE,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;;AAda,iCAAI,GAAG,4BAAqC,CAAC;AAiB7D;;;;GAIG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF","sourcesContent":["import { Auth0Interrupt } from \"./Auth0Interrupt\";\n\n/**\n * Error thrown when a tool call requires an access token for an external service.\n *\n * Throw this error if the service returns Unauthorized for the current access token.\n */\nexport class FederatedConnectionInterrupt extends Auth0Interrupt {\n  public behavior: \"resume\" | \"reload\";\n\n  /**\n   * The auth0 connection name.\n   */\n  public readonly connection: string;\n\n  /**\n   * The scopes required to access the external service as stated\n   * in the authorizer.\n   */\n  public readonly scopes: string[];\n\n  /**\n   * The union between the current scopes of the Access Token plus the required scopes.\n   * This is the list of scopes that will be used to request a new Access Token.\n   */\n  public readonly requiredScopes: string[];\n\n  public static code = \"FEDERATED_CONNECTION_ERROR\" as const;\n\n  constructor(\n    message: string,\n    connection: string,\n    scopes: string[],\n    requiredScopes: string[],\n    behavior: \"resume\" | \"reload\" = \"resume\"\n  ) {\n    super(message, FederatedConnectionInterrupt.code);\n    this.behavior = behavior;\n    this.connection = connection;\n    this.scopes = scopes;\n    this.requiredScopes = requiredScopes;\n  }\n}\n\n/**\n * Error thrown when a tool call requires an access token for an external service.\n *\n * The authorizer will automatically convert this class of error to FederatedConnectionInterrupt.\n */\nexport class FederatedConnectionError extends Error {\n  constructor(message: string) {\n    super(message);\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auth0/ai",
-  "version": "2.0.1",
+  "version": "2.1.1",
   "description": "Auth0AI SDK for JavaScript",
   "types": "dist/esm/index.d.ts",
   "main": "dist/cjs/index.js",
@@ -70,7 +70,7 @@
   "devDependencies": {
     "@eslint/js": "^9.18.0",
     "@types/node": "^22.10.6",
-    "eslint": "^8.57.0",
+    "eslint": "^9",
     "globals": "^15.11.0",
     "typedoc": "^0.27.6",
     "typescript": "^5.7.3",