@auth0/ai 3.5.0 → 4.0.0

package/dist/cjs/authorizers/ciba/CIBAAuthorizerBase.js

@@ -67,7 +67,7 @@ class CIBAAuthorizerBase {
         const authParams = {
             scope: ensureOpenIdScope(this.params.scopes).join(" "),
             audience: this.params.audience || "",
-            request_expiry: ((_a = this.params.requestExpiry) !== null && _a !== void 0 ? _a : 300).toString(),
+            requested_expiry: ((_a = this.params.requestedExpiry) !== null && _a !== void 0 ? _a : 300).toString(),
             binding_message: (_b = (await (0, parameters_1.resolveParameter)(this.params.bindingMessage, toolContext))) !== null && _b !== void 0 ? _b : "",
             userId: (_c = (await (0, parameters_1.resolveParameter)(this.params.userID, toolContext))) !== null && _c !== void 0 ? _c : "",
         };
@@ -97,7 +97,7 @@ class CIBAAuthorizerBase {
                 throw new interrupts_1.AuthorizationPendingInterrupt(e.error_description, authRequest);
             }
             if (e.error === "slow_down") {
-                throw new interrupts_1.AuthorizationPollingInterrupt(e.error_description, authRequest);
+                throw new interrupts_1.AuthorizationPollingInterrupt(e.error_description, authRequest, Number(e.headers.get('retry-after')));
             }
             if (e.error == "invalid_grant") {
                 throw new interrupts_1.InvalidGrantInterrupt(e.error_description, authRequest);
@@ -123,7 +123,7 @@ class CIBAAuthorizerBase {
             catch (err) {
                 if (err instanceof interrupts_1.AuthorizationPendingInterrupt ||
                     err instanceof interrupts_1.AuthorizationPollingInterrupt) {
-                    await sleep(err.request.interval * 1000);
+                    await sleep(err.nextRetryInterval() * 1000);
                 }
                 else {
                     throw err;

package/dist/cjs/authorizers/ciba/CIBAAuthorizerBase.js.map

@@ -1 +1 @@
-{"version":3,"file":"CIBAAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/ciba/CIBAAuthorizerBase.ts"],"names":[],"mappings":";;;;;;AAAA,iCAA6C;AAC7C,oDAA4B;AAC5B,8DAAqC;AAErC,mDAAwE;AACxE,iDAO0B;AAC1B,iDAAoD;AACpD,yCAAwC;AAExC,wCAA0D;AAC1D,oCAAgE;AAChE,2DAA2E;AAI3E,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAChF,SAAS,iBAAiB,CAAC,MAAgB;IACzC,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;AACpE,CAAC;AACD;;;GAGG;AACH,MAAa,kBAAkB;IAU7B,YACE,KAAiC,EACjC,MAA6C;QAE7C,IAAI,CAAC,KAAK,GAAG,IAAI,4BAAoB,CAAC,yBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB,EAAE,WAAW;YAC/B,GAAG,MAAM;SACV,CAAC;QAEF,IAAI,CAAC,iBAAiB,GAAG,IAAI,iBAAQ,CACnC,MAAM,CAAC,KAAK,EACZ;YACE,MAAM,EAAE,CAAC,YAAY,EAAE,EAAE,CACvB,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACrE,CACF,CAAC;QAEF,IAAI,CAAC,gBAAgB,GAAG,IAAI,iBAAQ,CAAW,MAAM,CAAC,KAAK,EAAE;YAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CACtB,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,eAAoB;QACxC,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,eAAe;SACxB,CAAC;QACF,MAAM,EAAE,GAAG,IAAA,qBAAU,EAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,gBAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,eAAoB;QACtC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YAEzE,OAAO;gBACL,EAAE,EAAE,QAAQ,CAAC,WAAW;gBACxB,WAAW,EAAE,WAAW;gBACxB,SAAS,EAAE,QAAQ,CAAC,UAAU;gBAC9B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACnC,MAAM,IAAI,sDAAyC,CACjD,GAAG,CAAC,iBAAiB,CACtB,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,WAA4B;;QAC3D,MAAM,UAAU,GAAwB;YACtC,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACtD,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE;YACpC,cAAc,EAAE,CAAC,MAAA,IAAI,CAAC,MAAM,CAAC,aAAa,mCAAI,GAAG,CAAC,CAAC,QAAQ,EAAE;YAC7D,eAAe,EACb,MAAA,CAAC,MAAM,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,mCAAI,EAAE;YACzE,MAAM,EAAE,MAAA,CAAC,MAAM,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,mCAAI,EAAE;SACxE,CAAC;QAEF,MAAM,oBAAoB,GAAG,MAAM,IAAA,6BAAgB,EACjD,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAChC,WAAW,CACZ,CAAC;QAEF,yEAAyE;QACzE,yDAAyD;QACzD,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACvC,UAAU,CAAC,qBAAqB,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC1E,CAAC;QAED,qDAAqD;QACrD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CACtE,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,WAAqC;QAErC,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC;YAEnE,IAAI,cAAc,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC5C,MAAM,IAAI,iDAAoC,CAC5C,wCAAwC,EACxC,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,gBAAgB,CAAC;gBAC7D,WAAW,EAAE,WAAW,CAAC,EAAE;aAC5B,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,IAAA,uCAAyB,EAAC,QAAQ,CAAC,CAAC;YAExD,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;gBACxC,MAAM,IAAI,0CAA6B,CACrC,CAAC,CAAC,iBAAiB,EACnB,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC5B,MAAM,IAAI,0CAA6B,CACrC,CAAC,CAAC,iBAAiB,EACnB,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC/B,MAAM,IAAI,kCAAqB,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;YACpE,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACjC,MAAM,IAAI,sDAAyC,CACjD,CAAC,CAAC,iBAAiB,CACpB,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC/B,MAAM,IAAI,kCAAqB,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAES,KAAK,CAAC,cAAc,CAAC,WAAqC;QAClE,OAAO,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAES,KAAK,CAAC,qBAAqB,CACnC,WAAqC;QAErC,IAAI,WAAW,GAAyB,SAAS,CAAC;QAElD,GAAG,CAAC;YACF,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IACE,GAAG,YAAY,0CAA6B;oBAC5C,GAAG,YAAY,0CAA6B,EAC5C,CAAC;oBACD,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;gBAC3C,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC,QAAQ,CAAC,WAAW,EAAE;QAEvB,OAAO,WAAW,CAAC;IACrB,CAAC;IAES,iBAAiB;;QACzB,MAAM,KAAK,GAAG,qCAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;QACjC,OAAO,MAAA,IAAI,CAAC,iBAAiB,0CAAE,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA0C,EAC1C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,IAAI,YAAkD,CAAC;YACvD,IAAI,qCAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YACpC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;YACvD,MAAM,cAAc,GAAG;gBACrB,UAAU;gBACV,eAAe;gBACf,GAAG,IAAA,uBAAa,EAAC,WAAW,EAAE,OAAO,CAAC;aACvC,CAAC;YACF,MAAM,aAAa,GAAG;gBACpB,UAAU;gBACV,aAAa;gBACb,GAAG,IAAA,uBAAa,EAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,OAAO,CAAC;aAC1D,CAAC;YAEF,MAAM,UAAU,GAA2B;gBACzC,IAAI;gBACJ,OAAO;gBACP,cAAc;aACf,CAAC;YAEF,OAAO,qCAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;;gBAClD,IAAI,WAAiC,CAAC;gBAEtC,MAAM,aAAa,GACjB,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW;oBACzD,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW,CAAC;gBAErD,IAAI,CAAC;oBACH,WAAW,GAAG,MAAM,CAAA,MAAA,IAAI,CAAC,gBAAgB,0CAAE,GAAG,CAC5C,aAAa,EACb,YAAY,CACb,CAAA,CAAC;oBACF,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,IAAI,aAAa,EAAE,CAAC;4BAClB,YAAY,GAAG,MAAM,CAAA,MAAA,IAAI,CAAC,iBAAiB,0CAAE,GAAG,CAC9C,cAAc,EACd,cAAc,CACf,CAAA,CAAC;4BACF,IAAI,CAAC,YAAY,EAAE,CAAC;gCAClB,iBAAiB;gCACjB,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;gCACjD,MAAM,CAAA,MAAA,IAAI,CAAC,iBAAiB,0CAAE,GAAG,CAC/B,cAAc,EACd,cAAc,EACd,YAAY,CACb,CAAA,CAAC;4BACJ,CAAC;4BACD,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;wBACxD,CAAC;6BAAM,CAAC;4BACN,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;4BACjD,MAAM,kBAAkB,GACtB,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;4BAC3C,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,UAAU,EAAE,CAAC;gCAC7D,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CACtC,YAAY,EACZ,kBAAkB,CACnB,CAAC;4BACJ,CAAC;4BACD,WAAW,GAAG,MAAM,kBAAkB,CAAC;wBACzC,CAAC;wBACD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBAC/B,IAAI,OAAO,WAAW,KAAK,WAAW,EAAE,CAAC;4BACvC,MAAA,IAAI,CAAC,gBAAgB,0CAAE,GAAG,CACxB,aAAa,EACb,YAAY,EACZ,WAAW,CACZ,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,eAAe,GACnB,GAAG,YAAY,0CAA6B;wBAC5C,GAAG,YAAY,0CAA6B,CAAC;oBAC/C,IAAI,eAAe,EAAE,CAAC;wBACpB,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;yBAAM,CAAC;wBACN,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBAC/B,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;4BACrD,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAY,EAAE,GAAG,IAAI,CAAC,CAAC;wBAC3D,CAAC;6BAAM,CAAC;4BACN,OAAO,GAAG,CAAC;wBACb,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;gBACrC,OAAO,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;IAES,KAAK,CAAC,6BAA6B,CAC3C,GAAkE;QAElE,IAAI,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,qCAAiB,CAAC,QAAQ,EAAE,CAAC;YAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;YAC1B,MAAM,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;CACF;AAhTD,gDAgTC","sourcesContent":["import { AuthenticationClient } from \"auth0\";\nimport crypto from \"crypto\";\nimport stableHash from \"stable-hash\";\n\nimport { TokenSet, tokenSetFromTokenResponse } from \"../../credentials\";\nimport {\n  AccessDeniedInterrupt,\n  AuthorizationPendingInterrupt,\n  AuthorizationPollingInterrupt,\n  AuthorizationRequestExpiredInterrupt,\n  InvalidGrantInterrupt,\n  UserDoesNotHavePushNotificationsInterrupt,\n} from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { SubStore } from \"../../stores\";\nimport { RequireFields } from \"../../util\";\nimport { ContextGetter, nsFromContext } from \"../context\";\nimport { Auth0ClientParams, Auth0ClientSchema } from \"../types\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport { CIBAAuthorizationRequest } from \"./CIBAAuthorizationRequest\";\nimport { CIBAAuthorizerParams } from \"./CIBAAuthorizerParams\";\n\nconst sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));\nfunction ensureOpenIdScope(scopes: string[]): string[] {\n  return scopes.includes(\"openid\") ? scopes : [\"openid\", ...scopes];\n}\n/**\n * Requests authorization by prompting the user via an out-of-band channel from\n * the backend.\n */\nexport class CIBAAuthorizerBase<ToolExecuteArgs extends any[]> {\n  private readonly auth0: AuthenticationClient;\n  private readonly authResponseStore: SubStore | undefined;\n  private readonly credentialsStore: SubStore<TokenSet> | undefined;\n\n  private readonly params: RequireFields<\n    CIBAAuthorizerParams<ToolExecuteArgs>,\n    \"credentialsContext\"\n  >;\n\n  constructor(\n    auth0: Partial<Auth0ClientParams>,\n    params: CIBAAuthorizerParams<ToolExecuteArgs>\n  ) {\n    this.auth0 = new AuthenticationClient(Auth0ClientSchema.parse(auth0));\n    this.params = {\n      credentialsContext: \"tool-call\",\n      ...params,\n    };\n\n    this.authResponseStore = new SubStore<CIBAAuthorizationRequest>(\n      params.store,\n      {\n        getTTL: (authResponse) =>\n          authResponse.expiresIn ? authResponse.expiresIn * 1000 : undefined,\n      }\n    );\n\n    this.credentialsStore = new SubStore<TokenSet>(params.store, {\n      getTTL: (credentials) =>\n        credentials.expiresIn ? credentials.expiresIn * 1000 : undefined,\n    });\n  }\n\n  private getInstanceID(authorizeParams: any): string {\n    const props = {\n      auth0: this.auth0,\n      params: authorizeParams,\n    };\n    const sh = stableHash(props);\n    return crypto.createHash(\"MD5\").update(sh).digest(\"hex\");\n  }\n\n  private async start(authorizeParams: any): Promise<CIBAAuthorizationRequest> {\n    const requestedAt = Date.now() / 1000;\n\n    try {\n      const response = await this.auth0.backchannel.authorize(authorizeParams);\n\n      return {\n        id: response.auth_req_id,\n        requestedAt: requestedAt,\n        expiresIn: response.expires_in,\n        interval: response.interval,\n      };\n    } catch (err: any) {\n      if (err.error == \"invalid_request\") {\n        throw new UserDoesNotHavePushNotificationsInterrupt(\n          err.error_description\n        );\n      }\n      throw err;\n    }\n  }\n\n  private async getAuthorizeParams(toolContext: ToolExecuteArgs) {\n    const authParams: Record<string, any> = {\n      scope: ensureOpenIdScope(this.params.scopes).join(\" \"),\n      audience: this.params.audience || \"\",\n      request_expiry: (this.params.requestExpiry ?? 300).toString(),\n      binding_message:\n        (await resolveParameter(this.params.bindingMessage, toolContext)) ?? \"\",\n      userId: (await resolveParameter(this.params.userID, toolContext)) ?? \"\",\n    };\n\n    const authorizationDetails = await resolveParameter(\n      this.params.authorizationDetails,\n      toolContext\n    );\n\n    // If authorizationDetails is an array, we need to convert it to a string\n    // because the auth0 library expects a valid JSON string.\n    if (authorizationDetails !== undefined) {\n      authParams.authorization_details = JSON.stringify(authorizationDetails);\n    }\n\n    // Remove undefined values from the authParams object\n    return Object.fromEntries(\n      Object.entries(authParams).filter(([, value]) => value !== undefined)\n    );\n  }\n\n  private async getCredentialsInternal(\n    authRequest: CIBAAuthorizationRequest\n  ): Promise<TokenSet | undefined> {\n    try {\n      const elapsedSeconds = Date.now() / 1000 - authRequest.requestedAt;\n\n      if (elapsedSeconds >= authRequest.expiresIn) {\n        throw new AuthorizationRequestExpiredInterrupt(\n          \"The authorization request has expired.\",\n          authRequest\n        );\n      }\n\n      const response = await this.auth0.backchannel.backchannelGrant({\n        auth_req_id: authRequest.id,\n      });\n\n      const credentials = tokenSetFromTokenResponse(response);\n\n      return credentials;\n    } catch (e: any) {\n      if (e.error === \"authorization_pending\") {\n        throw new AuthorizationPendingInterrupt(\n          e.error_description,\n          authRequest\n        );\n      }\n\n      if (e.error === \"slow_down\") {\n        throw new AuthorizationPollingInterrupt(\n          e.error_description,\n          authRequest\n        );\n      }\n\n      if (e.error == \"invalid_grant\") {\n        throw new InvalidGrantInterrupt(e.error_description, authRequest);\n      }\n\n      if (e.error == \"invalid_request\") {\n        throw new UserDoesNotHavePushNotificationsInterrupt(\n          e.error_description\n        );\n      }\n\n      if (e.error == \"access_denied\") {\n        throw new AccessDeniedInterrupt(e.error_description, authRequest);\n      }\n\n      throw e;\n    }\n  }\n\n  protected async getCredentials(authRequest: CIBAAuthorizationRequest) {\n    return this.getCredentialsInternal(authRequest);\n  }\n\n  protected async getCredentialsPolling(\n    authRequest: CIBAAuthorizationRequest\n  ): Promise<TokenSet | undefined> {\n    let credentials: TokenSet | undefined = undefined;\n\n    do {\n      try {\n        credentials = await this.getCredentialsInternal(authRequest);\n      } catch (err) {\n        if (\n          err instanceof AuthorizationPendingInterrupt ||\n          err instanceof AuthorizationPollingInterrupt\n        ) {\n          await sleep(err.request.interval * 1000);\n        } else {\n          throw err;\n        }\n      }\n    } while (!credentials);\n\n    return credentials;\n  }\n\n  protected deleteAuthRequest() {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\"This method should be called from within a tool.\");\n    }\n    const { authResponseNS } = store;\n    return this.authResponseStore?.delete(authResponseNS, \"authResponse\");\n  }\n\n  /**\n   *\n   * Wraps the execute method of a AI tool to handle CIBA authorization.\n   *\n   * @param getContext - A function that returns the context of the tool execution.\n   * @param execute - The tool execute method.\n   * @returns The wrapped execute method.\n   */\n  protect(\n    getContext: ContextGetter<ToolExecuteArgs>,\n    execute: (...args: ToolExecuteArgs) => any\n  ): (...args: ToolExecuteArgs) => any {\n    return async (...args: ToolExecuteArgs) => {\n      let authResponse: CIBAAuthorizationRequest | undefined;\n      if (asyncLocalStorage.getStore()) {\n        throw new Error(\n          \"Cannot nest tool calls that require CIBA authorization.\"\n        );\n      }\n\n      const context = getContext(...args);\n      const authorizeParams = await this.getAuthorizeParams(args);\n      const instanceID = this.getInstanceID(authorizeParams);\n      const authResponseNS = [\n        instanceID,\n        \"AuthResponses\",\n        ...nsFromContext(\"tool-call\", context),\n      ];\n      const credentialsNS = [\n        instanceID,\n        \"Credentials\",\n        ...nsFromContext(this.params.credentialsContext, context),\n      ];\n\n      const storeValue: AsyncStorageValue<any> = {\n        args,\n        context,\n        authResponseNS,\n      };\n\n      return asyncLocalStorage.run(storeValue, async () => {\n        let credentials: TokenSet | undefined;\n\n        const interruptMode =\n          typeof this.params.onAuthorizationRequest === \"undefined\" ||\n          this.params.onAuthorizationRequest === \"interrupt\";\n\n        try {\n          credentials = await this.credentialsStore?.get(\n            credentialsNS,\n            \"credential\"\n          );\n          if (!credentials) {\n            if (interruptMode) {\n              authResponse = await this.authResponseStore?.get(\n                authResponseNS,\n                \"authResponse\"\n              );\n              if (!authResponse) {\n                //Initial request\n                authResponse = await this.start(authorizeParams);\n                await this.authResponseStore?.put(\n                  authResponseNS,\n                  \"authResponse\",\n                  authResponse\n                );\n              }\n              credentials = await this.getCredentials(authResponse);\n            } else {\n              authResponse = await this.start(authorizeParams);\n              const credentialsPromise =\n                this.getCredentialsPolling(authResponse);\n              if (typeof this.params.onAuthorizationRequest === \"function\") {\n                await this.params.onAuthorizationRequest(\n                  authResponse,\n                  credentialsPromise\n                );\n              }\n              credentials = await credentialsPromise;\n            }\n            await this.deleteAuthRequest();\n            if (typeof credentials !== \"undefined\") {\n              this.credentialsStore?.put(\n                credentialsNS,\n                \"credential\",\n                credentials\n              );\n            }\n          }\n        } catch (err) {\n          const shouldInterrupt =\n            err instanceof AuthorizationPendingInterrupt ||\n            err instanceof AuthorizationPollingInterrupt;\n          if (shouldInterrupt) {\n            return this.handleAuthorizationInterrupts(err);\n          } else {\n            await this.deleteAuthRequest();\n            if (typeof this.params.onUnauthorized === \"function\") {\n              return this.params.onUnauthorized(err as Error, ...args);\n            } else {\n              return err;\n            }\n          }\n        }\n        storeValue.credentials = credentials;\n        return execute(...args);\n      });\n    };\n  }\n\n  protected async handleAuthorizationInterrupts(\n    err: AuthorizationPendingInterrupt | AuthorizationPollingInterrupt\n  ) {\n    if (this.params.onAuthorizationInterrupt) {\n      const store = asyncLocalStorage.getStore();\n      if (!store) {\n        throw new Error(\"This method should be called from within a tool.\");\n      }\n      const { context } = store;\n      await this.params.onAuthorizationInterrupt(err, context);\n    }\n    throw err;\n  }\n}\n"]}
+{"version":3,"file":"CIBAAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/ciba/CIBAAuthorizerBase.ts"],"names":[],"mappings":";;;;;;AAAA,iCAA6C;AAC7C,oDAA4B;AAC5B,8DAAqC;AAErC,mDAAwE;AACxE,iDAO0B;AAC1B,iDAAoD;AACpD,yCAAwC;AAExC,wCAA0D;AAC1D,oCAAgE;AAChE,2DAA2E;AAI3E,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAChF,SAAS,iBAAiB,CAAC,MAAgB;IACzC,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;AACpE,CAAC;AACD;;;GAGG;AACH,MAAa,kBAAkB;IAU7B,YACE,KAAiC,EACjC,MAA6C;QAE7C,IAAI,CAAC,KAAK,GAAG,IAAI,4BAAoB,CAAC,yBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB,EAAE,WAAW;YAC/B,GAAG,MAAM;SACV,CAAC;QAEF,IAAI,CAAC,iBAAiB,GAAG,IAAI,iBAAQ,CACnC,MAAM,CAAC,KAAK,EACZ;YACE,MAAM,EAAE,CAAC,YAAY,EAAE,EAAE,CACvB,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACrE,CACF,CAAC;QAEF,IAAI,CAAC,gBAAgB,GAAG,IAAI,iBAAQ,CAAW,MAAM,CAAC,KAAK,EAAE;YAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CACtB,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,eAAoB;QACxC,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,eAAe;SACxB,CAAC;QACF,MAAM,EAAE,GAAG,IAAA,qBAAU,EAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,gBAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,eAAoB;QACtC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YAEzE,OAAO;gBACL,EAAE,EAAE,QAAQ,CAAC,WAAW;gBACxB,WAAW,EAAE,WAAW;gBACxB,SAAS,EAAE,QAAQ,CAAC,UAAU;gBAC9B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACnC,MAAM,IAAI,sDAAyC,CACjD,GAAG,CAAC,iBAAiB,CACtB,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,WAA4B;;QAC3D,MAAM,UAAU,GAAwB;YACtC,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACtD,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE;YACpC,gBAAgB,EAAE,CAAC,MAAA,IAAI,CAAC,MAAM,CAAC,eAAe,mCAAI,GAAG,CAAC,CAAC,QAAQ,EAAE;YACjE,eAAe,EACb,MAAA,CAAC,MAAM,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,mCAAI,EAAE;YACzE,MAAM,EAAE,MAAA,CAAC,MAAM,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,mCAAI,EAAE;SACxE,CAAC;QAEF,MAAM,oBAAoB,GAAG,MAAM,IAAA,6BAAgB,EACjD,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAChC,WAAW,CACZ,CAAC;QAEF,yEAAyE;QACzE,yDAAyD;QACzD,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACvC,UAAU,CAAC,qBAAqB,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC1E,CAAC;QAED,qDAAqD;QACrD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CACtE,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,WAAqC;QAErC,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC;YAEnE,IAAI,cAAc,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC5C,MAAM,IAAI,iDAAoC,CAC5C,wCAAwC,EACxC,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,gBAAgB,CAAC;gBAC7D,WAAW,EAAE,WAAW,CAAC,EAAE;aAC5B,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,IAAA,uCAAyB,EAAC,QAAQ,CAAC,CAAC;YAExD,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;gBACxC,MAAM,IAAI,0CAA6B,CACrC,CAAC,CAAC,iBAAiB,EACnB,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC5B,MAAM,IAAI,0CAA6B,CACrC,CAAC,CAAC,iBAAiB,EACnB,WAAW,EACX,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CACrC,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC/B,MAAM,IAAI,kCAAqB,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;YACpE,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACjC,MAAM,IAAI,sDAAyC,CACjD,CAAC,CAAC,iBAAiB,CACpB,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC/B,MAAM,IAAI,kCAAqB,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAES,KAAK,CAAC,cAAc,CAAC,WAAqC;QAClE,OAAO,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAES,KAAK,CAAC,qBAAqB,CACnC,WAAqC;QAErC,IAAI,WAAW,GAAyB,SAAS,CAAC;QAElD,GAAG,CAAC;YACF,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IACE,GAAG,YAAY,0CAA6B;oBAC5C,GAAG,YAAY,0CAA6B,EAC5C,CAAC;oBACD,MAAM,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,GAAG,IAAI,CAAC,CAAC;gBAC9C,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC,QAAQ,CAAC,WAAW,EAAE;QAEvB,OAAO,WAAW,CAAC;IACrB,CAAC;IAES,iBAAiB;;QACzB,MAAM,KAAK,GAAG,qCAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;QACjC,OAAO,MAAA,IAAI,CAAC,iBAAiB,0CAAE,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA0C,EAC1C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,IAAI,YAAkD,CAAC;YACvD,IAAI,qCAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YACpC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;YACvD,MAAM,cAAc,GAAG;gBACrB,UAAU;gBACV,eAAe;gBACf,GAAG,IAAA,uBAAa,EAAC,WAAW,EAAE,OAAO,CAAC;aACvC,CAAC;YACF,MAAM,aAAa,GAAG;gBACpB,UAAU;gBACV,aAAa;gBACb,GAAG,IAAA,uBAAa,EAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,OAAO,CAAC;aAC1D,CAAC;YAEF,MAAM,UAAU,GAA2B;gBACzC,IAAI;gBACJ,OAAO;gBACP,cAAc;aACf,CAAC;YAEF,OAAO,qCAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;;gBAClD,IAAI,WAAiC,CAAC;gBAEtC,MAAM,aAAa,GACjB,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW;oBACzD,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW,CAAC;gBAErD,IAAI,CAAC;oBACH,WAAW,GAAG,MAAM,CAAA,MAAA,IAAI,CAAC,gBAAgB,0CAAE,GAAG,CAC5C,aAAa,EACb,YAAY,CACb,CAAA,CAAC;oBACF,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,IAAI,aAAa,EAAE,CAAC;4BAClB,YAAY,GAAG,MAAM,CAAA,MAAA,IAAI,CAAC,iBAAiB,0CAAE,GAAG,CAC9C,cAAc,EACd,cAAc,CACf,CAAA,CAAC;4BACF,IAAI,CAAC,YAAY,EAAE,CAAC;gCAClB,iBAAiB;gCACjB,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;gCACjD,MAAM,CAAA,MAAA,IAAI,CAAC,iBAAiB,0CAAE,GAAG,CAC/B,cAAc,EACd,cAAc,EACd,YAAY,CACb,CAAA,CAAC;4BACJ,CAAC;4BACD,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;wBACxD,CAAC;6BAAM,CAAC;4BACN,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;4BACjD,MAAM,kBAAkB,GACtB,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;4BAC3C,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,UAAU,EAAE,CAAC;gCAC7D,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CACtC,YAAY,EACZ,kBAAkB,CACnB,CAAC;4BACJ,CAAC;4BACD,WAAW,GAAG,MAAM,kBAAkB,CAAC;wBACzC,CAAC;wBACD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBAC/B,IAAI,OAAO,WAAW,KAAK,WAAW,EAAE,CAAC;4BACvC,MAAA,IAAI,CAAC,gBAAgB,0CAAE,GAAG,CACxB,aAAa,EACb,YAAY,EACZ,WAAW,CACZ,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,eAAe,GACnB,GAAG,YAAY,0CAA6B;wBAC5C,GAAG,YAAY,0CAA6B,CAAC;oBAC/C,IAAI,eAAe,EAAE,CAAC;wBACpB,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;yBAAM,CAAC;wBACN,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBAC/B,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;4BACrD,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAY,EAAE,GAAG,IAAI,CAAC,CAAC;wBAC3D,CAAC;6BAAM,CAAC;4BACN,OAAO,GAAG,CAAC;wBACb,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;gBACrC,OAAO,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;IAES,KAAK,CAAC,6BAA6B,CAC3C,GAAkE;QAElE,IAAI,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,qCAAiB,CAAC,QAAQ,EAAE,CAAC;YAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;YAC1B,MAAM,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;CACF;AAjTD,gDAiTC","sourcesContent":["import { AuthenticationClient } from \"auth0\";\nimport crypto from \"crypto\";\nimport stableHash from \"stable-hash\";\n\nimport { TokenSet, tokenSetFromTokenResponse } from \"../../credentials\";\nimport {\n  AccessDeniedInterrupt,\n  AuthorizationPendingInterrupt,\n  AuthorizationPollingInterrupt,\n  AuthorizationRequestExpiredInterrupt,\n  InvalidGrantInterrupt,\n  UserDoesNotHavePushNotificationsInterrupt,\n} from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { SubStore } from \"../../stores\";\nimport { RequireFields } from \"../../util\";\nimport { ContextGetter, nsFromContext } from \"../context\";\nimport { Auth0ClientParams, Auth0ClientSchema } from \"../types\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport { CIBAAuthorizationRequest } from \"./CIBAAuthorizationRequest\";\nimport { CIBAAuthorizerParams } from \"./CIBAAuthorizerParams\";\n\nconst sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));\nfunction ensureOpenIdScope(scopes: string[]): string[] {\n  return scopes.includes(\"openid\") ? scopes : [\"openid\", ...scopes];\n}\n/**\n * Requests authorization by prompting the user via an out-of-band channel from\n * the backend.\n */\nexport class CIBAAuthorizerBase<ToolExecuteArgs extends any[]> {\n  private readonly auth0: AuthenticationClient;\n  private readonly authResponseStore: SubStore | undefined;\n  private readonly credentialsStore: SubStore<TokenSet> | undefined;\n\n  private readonly params: RequireFields<\n    CIBAAuthorizerParams<ToolExecuteArgs>,\n    \"credentialsContext\"\n  >;\n\n  constructor(\n    auth0: Partial<Auth0ClientParams>,\n    params: CIBAAuthorizerParams<ToolExecuteArgs>\n  ) {\n    this.auth0 = new AuthenticationClient(Auth0ClientSchema.parse(auth0));\n    this.params = {\n      credentialsContext: \"tool-call\",\n      ...params,\n    };\n\n    this.authResponseStore = new SubStore<CIBAAuthorizationRequest>(\n      params.store,\n      {\n        getTTL: (authResponse) =>\n          authResponse.expiresIn ? authResponse.expiresIn * 1000 : undefined,\n      }\n    );\n\n    this.credentialsStore = new SubStore<TokenSet>(params.store, {\n      getTTL: (credentials) =>\n        credentials.expiresIn ? credentials.expiresIn * 1000 : undefined,\n    });\n  }\n\n  private getInstanceID(authorizeParams: any): string {\n    const props = {\n      auth0: this.auth0,\n      params: authorizeParams,\n    };\n    const sh = stableHash(props);\n    return crypto.createHash(\"MD5\").update(sh).digest(\"hex\");\n  }\n\n  private async start(authorizeParams: any): Promise<CIBAAuthorizationRequest> {\n    const requestedAt = Date.now() / 1000;\n\n    try {\n      const response = await this.auth0.backchannel.authorize(authorizeParams);\n\n      return {\n        id: response.auth_req_id,\n        requestedAt: requestedAt,\n        expiresIn: response.expires_in,\n        interval: response.interval,\n      };\n    } catch (err: any) {\n      if (err.error == \"invalid_request\") {\n        throw new UserDoesNotHavePushNotificationsInterrupt(\n          err.error_description\n        );\n      }\n      throw err;\n    }\n  }\n\n  private async getAuthorizeParams(toolContext: ToolExecuteArgs) {\n    const authParams: Record<string, any> = {\n      scope: ensureOpenIdScope(this.params.scopes).join(\" \"),\n      audience: this.params.audience || \"\",\n      requested_expiry: (this.params.requestedExpiry ?? 300).toString(),\n      binding_message:\n        (await resolveParameter(this.params.bindingMessage, toolContext)) ?? \"\",\n      userId: (await resolveParameter(this.params.userID, toolContext)) ?? \"\",\n    };\n\n    const authorizationDetails = await resolveParameter(\n      this.params.authorizationDetails,\n      toolContext\n    );\n\n    // If authorizationDetails is an array, we need to convert it to a string\n    // because the auth0 library expects a valid JSON string.\n    if (authorizationDetails !== undefined) {\n      authParams.authorization_details = JSON.stringify(authorizationDetails);\n    }\n\n    // Remove undefined values from the authParams object\n    return Object.fromEntries(\n      Object.entries(authParams).filter(([, value]) => value !== undefined)\n    );\n  }\n\n  private async getCredentialsInternal(\n    authRequest: CIBAAuthorizationRequest\n  ): Promise<TokenSet | undefined> {\n    try {\n      const elapsedSeconds = Date.now() / 1000 - authRequest.requestedAt;\n\n      if (elapsedSeconds >= authRequest.expiresIn) {\n        throw new AuthorizationRequestExpiredInterrupt(\n          \"The authorization request has expired.\",\n          authRequest\n        );\n      }\n\n      const response = await this.auth0.backchannel.backchannelGrant({\n        auth_req_id: authRequest.id,\n      });\n\n      const credentials = tokenSetFromTokenResponse(response);\n\n      return credentials;\n    } catch (e: any) {\n      if (e.error === \"authorization_pending\") {\n        throw new AuthorizationPendingInterrupt(\n          e.error_description,\n          authRequest\n        );\n      }\n\n      if (e.error === \"slow_down\") {\n        throw new AuthorizationPollingInterrupt(\n          e.error_description,\n          authRequest,\n          Number(e.headers.get('retry-after'))\n        );\n      }\n\n      if (e.error == \"invalid_grant\") {\n        throw new InvalidGrantInterrupt(e.error_description, authRequest);\n      }\n\n      if (e.error == \"invalid_request\") {\n        throw new UserDoesNotHavePushNotificationsInterrupt(\n          e.error_description\n        );\n      }\n\n      if (e.error == \"access_denied\") {\n        throw new AccessDeniedInterrupt(e.error_description, authRequest);\n      }\n\n      throw e;\n    }\n  }\n\n  protected async getCredentials(authRequest: CIBAAuthorizationRequest) {\n    return this.getCredentialsInternal(authRequest);\n  }\n\n  protected async getCredentialsPolling(\n    authRequest: CIBAAuthorizationRequest\n  ): Promise<TokenSet | undefined> {\n    let credentials: TokenSet | undefined = undefined;\n\n    do {\n      try {\n        credentials = await this.getCredentialsInternal(authRequest);\n      } catch (err) {\n        if (\n          err instanceof AuthorizationPendingInterrupt ||\n          err instanceof AuthorizationPollingInterrupt\n        ) {\n          await sleep(err.nextRetryInterval() * 1000);\n        } else {\n          throw err;\n        }\n      }\n    } while (!credentials);\n\n    return credentials;\n  }\n\n  protected deleteAuthRequest() {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\"This method should be called from within a tool.\");\n    }\n    const { authResponseNS } = store;\n    return this.authResponseStore?.delete(authResponseNS, \"authResponse\");\n  }\n\n  /**\n   *\n   * Wraps the execute method of a AI tool to handle CIBA authorization.\n   *\n   * @param getContext - A function that returns the context of the tool execution.\n   * @param execute - The tool execute method.\n   * @returns The wrapped execute method.\n   */\n  protect(\n    getContext: ContextGetter<ToolExecuteArgs>,\n    execute: (...args: ToolExecuteArgs) => any\n  ): (...args: ToolExecuteArgs) => any {\n    return async (...args: ToolExecuteArgs) => {\n      let authResponse: CIBAAuthorizationRequest | undefined;\n      if (asyncLocalStorage.getStore()) {\n        throw new Error(\n          \"Cannot nest tool calls that require CIBA authorization.\"\n        );\n      }\n\n      const context = getContext(...args);\n      const authorizeParams = await this.getAuthorizeParams(args);\n      const instanceID = this.getInstanceID(authorizeParams);\n      const authResponseNS = [\n        instanceID,\n        \"AuthResponses\",\n        ...nsFromContext(\"tool-call\", context),\n      ];\n      const credentialsNS = [\n        instanceID,\n        \"Credentials\",\n        ...nsFromContext(this.params.credentialsContext, context),\n      ];\n\n      const storeValue: AsyncStorageValue<any> = {\n        args,\n        context,\n        authResponseNS,\n      };\n\n      return asyncLocalStorage.run(storeValue, async () => {\n        let credentials: TokenSet | undefined;\n\n        const interruptMode =\n          typeof this.params.onAuthorizationRequest === \"undefined\" ||\n          this.params.onAuthorizationRequest === \"interrupt\";\n\n        try {\n          credentials = await this.credentialsStore?.get(\n            credentialsNS,\n            \"credential\"\n          );\n          if (!credentials) {\n            if (interruptMode) {\n              authResponse = await this.authResponseStore?.get(\n                authResponseNS,\n                \"authResponse\"\n              );\n              if (!authResponse) {\n                //Initial request\n                authResponse = await this.start(authorizeParams);\n                await this.authResponseStore?.put(\n                  authResponseNS,\n                  \"authResponse\",\n                  authResponse\n                );\n              }\n              credentials = await this.getCredentials(authResponse);\n            } else {\n              authResponse = await this.start(authorizeParams);\n              const credentialsPromise =\n                this.getCredentialsPolling(authResponse);\n              if (typeof this.params.onAuthorizationRequest === \"function\") {\n                await this.params.onAuthorizationRequest(\n                  authResponse,\n                  credentialsPromise\n                );\n              }\n              credentials = await credentialsPromise;\n            }\n            await this.deleteAuthRequest();\n            if (typeof credentials !== \"undefined\") {\n              this.credentialsStore?.put(\n                credentialsNS,\n                \"credential\",\n                credentials\n              );\n            }\n          }\n        } catch (err) {\n          const shouldInterrupt =\n            err instanceof AuthorizationPendingInterrupt ||\n            err instanceof AuthorizationPollingInterrupt;\n          if (shouldInterrupt) {\n            return this.handleAuthorizationInterrupts(err);\n          } else {\n            await this.deleteAuthRequest();\n            if (typeof this.params.onUnauthorized === \"function\") {\n              return this.params.onUnauthorized(err as Error, ...args);\n            } else {\n              return err;\n            }\n          }\n        }\n        storeValue.credentials = credentials;\n        return execute(...args);\n      });\n    };\n  }\n\n  protected async handleAuthorizationInterrupts(\n    err: AuthorizationPendingInterrupt | AuthorizationPollingInterrupt\n  ) {\n    if (this.params.onAuthorizationInterrupt) {\n      const store = asyncLocalStorage.getStore();\n      if (!store) {\n        throw new Error(\"This method should be called from within a tool.\");\n      }\n      const { context } = store;\n      await this.params.onAuthorizationInterrupt(err, context);\n    }\n    throw err;\n  }\n}\n"]}

package/dist/cjs/authorizers/ciba/CIBAAuthorizerParams.js.map

@@ -1 +1 @@
-{"version":3,"file":"CIBAAuthorizerParams.js","sourceRoot":"","sources":["../../../../src/authorizers/ciba/CIBAAuthorizerParams.ts"],"names":[],"mappings":"","sourcesContent":["import { TokenSet } from \"../../credentials\";\nimport {\n  AuthorizationPendingInterrupt,\n  AuthorizationPollingInterrupt,\n  CIBAInterrupt,\n} from \"../../interrupts\";\nimport { AuthorizerToolParameter } from \"../../parameters\";\nimport { Store } from \"../../stores\";\nimport { AuthContext, ToolCallContext } from \"../context\";\nimport { OnAuthorizationRequest } from \"../types\";\nimport { CIBAAuthorizationRequest } from \"./CIBAAuthorizationRequest\";\n\nexport type CIBAAuthorizerParams<ToolExecuteArgs extends any[]> = {\n  /**\n   * The scope to request authorization for.\n   */\n  scopes: string[];\n\n  /**\n   * The user ID to request authorization for.\n   */\n  userID: AuthorizerToolParameter<ToolExecuteArgs>;\n\n  /**\n   * The binding message to send to the user.\n   */\n  bindingMessage: AuthorizerToolParameter<ToolExecuteArgs>;\n\n  /**\n   * The authorization parameters for RAR request.\n   */\n  authorizationDetails?: AuthorizerToolParameter<\n    ToolExecuteArgs,\n    Record<string, any>[]\n  >;\n\n  /**\n   * The audience to request authorization for.\n   */\n  audience?: string;\n\n  /**\n   * The time in seconds for the authorization request to expire.\n   *\n   * Defaults to 5m.\n   */\n  requestExpiry?: number;\n\n  /**\n   * The behavior when the authorization request is made.\n   *\n   * - `block`: The tool execution is blocked until the user completes the authorization.\n   * - `interrupt`: The tool execution is interrupted until the user completes the authorization.\n   * - a callback: Same as \"block\" but give access to the auth request and executing logic.\n   *\n   * Defaults to `interrupt`.\n   * Note: The block mode is only useful for development purposes and should not be used in production.\n   */\n  onAuthorizationRequest?:\n    | OnAuthorizationRequest\n    | ((\n        authReq: CIBAAuthorizationRequest,\n        poll: Promise<TokenSet | undefined>\n      ) => Promise<void>);\n\n  /**\n   * AuthContext defines the scope of credential sharing:\n   * - \"tool-call\": Credentials are valid only for a single invocation of the tool.\n   * - \"tool\": Credentials are shared across multiple calls to the same tool within the same thread.\n   * - \"thread\": Credentials are shared across all tools using the same authorizer within the current thread.\n   * - \"agent\": Credentials are shared globally across all threads and tools in the agent.\n   *\n   * @default \"tool-call\"\n   */\n  credentialsContext?: AuthContext;\n\n  /**\n   *\n   * Optional callback to generate a tool result when the invocation is not authorized.\n   *\n   * By default it will return the instance of the Error.\n   *\n   * @param args - The tool execution arguments.\n   * @returns The response to return when the invocation is not authorized.\n   */\n  onUnauthorized?: (\n    err: Error | CIBAInterrupt,\n    ...args: ToolExecuteArgs\n  ) => any;\n\n  /**\n   * Callback called before the authorization interrupt is thrown.\n   * This callback is useful to setup CIBA pollers.\n   *\n   * @param interrupt - The interrupt that is about to be thrown.\n   * @param args - The tool execution arguments.\n   */\n  onAuthorizationInterrupt?: (\n    interrupt: AuthorizationPendingInterrupt | AuthorizationPollingInterrupt,\n    context: ToolCallContext\n  ) => void | Promise<void>;\n\n  /**\n   * An store used to temporarly store the authorization response data\n   * while the user is completing the authorization in another device.\n   */\n  store: Store;\n};\n"]}
+{"version":3,"file":"CIBAAuthorizerParams.js","sourceRoot":"","sources":["../../../../src/authorizers/ciba/CIBAAuthorizerParams.ts"],"names":[],"mappings":"","sourcesContent":["import { TokenSet } from \"../../credentials\";\nimport {\n  AuthorizationPendingInterrupt,\n  AuthorizationPollingInterrupt,\n  CIBAInterrupt,\n} from \"../../interrupts\";\nimport { AuthorizerToolParameter } from \"../../parameters\";\nimport { Store } from \"../../stores\";\nimport { AuthContext, ToolCallContext } from \"../context\";\nimport { OnAuthorizationRequest } from \"../types\";\nimport { CIBAAuthorizationRequest } from \"./CIBAAuthorizationRequest\";\n\nexport type CIBAAuthorizerParams<ToolExecuteArgs extends any[]> = {\n  /**\n   * The scope to request authorization for.\n   */\n  scopes: string[];\n\n  /**\n   * The user ID to request authorization for.\n   */\n  userID: AuthorizerToolParameter<ToolExecuteArgs>;\n\n  /**\n   * The binding message to send to the user.\n   */\n  bindingMessage: AuthorizerToolParameter<ToolExecuteArgs>;\n\n  /**\n   * The authorization parameters for RAR request.\n   */\n  authorizationDetails?: AuthorizerToolParameter<\n    ToolExecuteArgs,\n    Record<string, any>[]\n  >;\n\n  /**\n   * The audience to request authorization for.\n   */\n  audience?: string;\n\n  /**\n   * The time in seconds for the authorization request to expire.\n   *\n   * Defaults to 300 (5 minutes).\n   */\n  requestedExpiry?: number;\n\n  /**\n   * The behavior when the authorization request is made.\n   *\n   * - `block`: The tool execution is blocked until the user completes the authorization.\n   * - `interrupt`: The tool execution is interrupted until the user completes the authorization.\n   * - a callback: Same as \"block\" but give access to the auth request and executing logic.\n   *\n   * Defaults to `interrupt`.\n   * Note: The block mode is only useful for development purposes and should not be used in production.\n   */\n  onAuthorizationRequest?:\n    | OnAuthorizationRequest\n    | ((\n        authReq: CIBAAuthorizationRequest,\n        poll: Promise<TokenSet | undefined>\n      ) => Promise<void>);\n\n  /**\n   * AuthContext defines the scope of credential sharing:\n   * - \"tool-call\": Credentials are valid only for a single invocation of the tool.\n   * - \"tool\": Credentials are shared across multiple calls to the same tool within the same thread.\n   * - \"thread\": Credentials are shared across all tools using the same authorizer within the current thread.\n   * - \"agent\": Credentials are shared globally across all threads and tools in the agent.\n   *\n   * @default \"tool-call\"\n   */\n  credentialsContext?: AuthContext;\n\n  /**\n   *\n   * Optional callback to generate a tool result when the invocation is not authorized.\n   *\n   * By default it will return the instance of the Error.\n   *\n   * @param args - The tool execution arguments.\n   * @returns The response to return when the invocation is not authorized.\n   */\n  onUnauthorized?: (\n    err: Error | CIBAInterrupt,\n    ...args: ToolExecuteArgs\n  ) => any;\n\n  /**\n   * Callback called before the authorization interrupt is thrown.\n   * This callback is useful to setup CIBA pollers.\n   *\n   * @param interrupt - The interrupt that is about to be thrown.\n   * @param args - The tool execution arguments.\n   */\n  onAuthorizationInterrupt?: (\n    interrupt: AuthorizationPendingInterrupt | AuthorizationPollingInterrupt,\n    context: ToolCallContext\n  ) => void | Promise<void>;\n\n  /**\n   * An store used to temporarly store the authorization response data\n   * while the user is completing the authorization in another device.\n   */\n  store: Store;\n};\n"]}

package/dist/cjs/authorizers/types.js

@@ -1,23 +1,23 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Auth0PublicClientSchema = exports.Auth0ClientSchema = void 0;
-const zod_1 = require("zod");
-exports.Auth0ClientSchema = zod_1.z.object({
-    domain: zod_1.z.string().default(() => process.env.AUTH0_DOMAIN),
-    clientId: zod_1.z.string().default(() => process.env.AUTH0_CLIENT_ID),
-    clientSecret: zod_1.z
-        .union([zod_1.z.string(), zod_1.z.undefined()])
+const v3_1 = require("zod/v3");
+exports.Auth0ClientSchema = v3_1.z.object({
+    domain: v3_1.z.string().default(() => process.env.AUTH0_DOMAIN),
+    clientId: v3_1.z.string().default(() => process.env.AUTH0_CLIENT_ID),
+    clientSecret: v3_1.z
+        .union([v3_1.z.string(), v3_1.z.undefined()])
         .transform((v) => v !== null && v !== void 0 ? v : process.env.AUTH0_CLIENT_SECRET),
-    telemetry: zod_1.z.boolean().optional(),
-    clientInfo: zod_1.z
+    telemetry: v3_1.z.boolean().optional(),
+    clientInfo: v3_1.z
         .object({
-        name: zod_1.z.string(),
+        name: v3_1.z.string(),
     })
         .passthrough()
         .optional(),
 });
-exports.Auth0PublicClientSchema = zod_1.z.object({
-    domain: zod_1.z.string().default(() => process.env.AUTH0_DOMAIN),
-    clientId: zod_1.z.string().default(() => process.env.AUTH0_CLIENT_ID),
+exports.Auth0PublicClientSchema = v3_1.z.object({
+    domain: v3_1.z.string().default(() => process.env.AUTH0_DOMAIN),
+    clientId: v3_1.z.string().default(() => process.env.AUTH0_CLIENT_ID),
 });
 //# sourceMappingURL=types.js.map

package/dist/cjs/authorizers/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/authorizers/types.ts"],"names":[],"mappings":";;;AACA,6BAAwB;AAcX,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,YAAa,CAAC;IAC3D,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,eAAgB,CAAC;IAChE,YAAY,EAAE,OAAC;SACZ,KAAK,CAAC,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,SAAS,EAAE,CAAC,CAAC;SAClC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAD,CAAC,cAAD,CAAC,GAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACzD,SAAS,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,OAAC;SACV,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE;KACjB,CAAC;SACD,WAAW,EAAE;SACb,QAAQ,EAAE;CACd,CAAC,CAAC;AAEU,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,YAAa,CAAC;IAC3D,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,eAAgB,CAAC;CACjE,CAAC,CAAC","sourcesContent":["import * as jose from \"jose\";\nimport { z } from \"zod\";\n\nexport type AuthParams = {\n  allowed?: boolean;\n  accessToken?: string;\n  claims?: jose.JWTPayload;\n};\n\nexport type ToolWithAuthHandler<I, O, C> = (\n  authParams: AuthParams,\n  input: I,\n  config?: C\n) => Promise<O>;\n\nexport const Auth0ClientSchema = z.object({\n  domain: z.string().default(() => process.env.AUTH0_DOMAIN!),\n  clientId: z.string().default(() => process.env.AUTH0_CLIENT_ID!),\n  clientSecret: z\n    .union([z.string(), z.undefined()])\n    .transform((v) => v ?? process.env.AUTH0_CLIENT_SECRET),\n  telemetry: z.boolean().optional(),\n  clientInfo: z\n    .object({\n      name: z.string(),\n    })\n    .passthrough()\n    .optional(),\n});\n\nexport const Auth0PublicClientSchema = z.object({\n  domain: z.string().default(() => process.env.AUTH0_DOMAIN!),\n  clientId: z.string().default(() => process.env.AUTH0_CLIENT_ID!),\n});\n\nexport type Auth0ClientParams = z.infer<typeof Auth0ClientSchema>;\nexport type Auth0PublicClientParams = z.infer<typeof Auth0PublicClientSchema>;\n\nexport type OnAuthorizationRequest = \"block\" | \"interrupt\";\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/authorizers/types.ts"],"names":[],"mappings":";;;AACA,+BAA2B;AAcd,QAAA,iBAAiB,GAAG,MAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,MAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,YAAa,CAAC;IAC3D,QAAQ,EAAE,MAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,eAAgB,CAAC;IAChE,YAAY,EAAE,MAAC;SACZ,KAAK,CAAC,CAAC,MAAC,CAAC,MAAM,EAAE,EAAE,MAAC,CAAC,SAAS,EAAE,CAAC,CAAC;SAClC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAD,CAAC,cAAD,CAAC,GAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACzD,SAAS,EAAE,MAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,MAAC;SACV,MAAM,CAAC;QACN,IAAI,EAAE,MAAC,CAAC,MAAM,EAAE;KACjB,CAAC;SACD,WAAW,EAAE;SACb,QAAQ,EAAE;CACd,CAAC,CAAC;AAEU,QAAA,uBAAuB,GAAG,MAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,EAAE,MAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,YAAa,CAAC;IAC3D,QAAQ,EAAE,MAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,eAAgB,CAAC;CACjE,CAAC,CAAC","sourcesContent":["import * as jose from \"jose\";\nimport { z } from \"zod/v3\";\n\nexport type AuthParams = {\n  allowed?: boolean;\n  accessToken?: string;\n  claims?: jose.JWTPayload;\n};\n\nexport type ToolWithAuthHandler<I, O, C> = (\n  authParams: AuthParams,\n  input: I,\n  config?: C\n) => Promise<O>;\n\nexport const Auth0ClientSchema = z.object({\n  domain: z.string().default(() => process.env.AUTH0_DOMAIN!),\n  clientId: z.string().default(() => process.env.AUTH0_CLIENT_ID!),\n  clientSecret: z\n    .union([z.string(), z.undefined()])\n    .transform((v) => v ?? process.env.AUTH0_CLIENT_SECRET),\n  telemetry: z.boolean().optional(),\n  clientInfo: z\n    .object({\n      name: z.string(),\n    })\n    .passthrough()\n    .optional(),\n});\n\nexport const Auth0PublicClientSchema = z.object({\n  domain: z.string().default(() => process.env.AUTH0_DOMAIN!),\n  clientId: z.string().default(() => process.env.AUTH0_CLIENT_ID!),\n});\n\nexport type Auth0ClientParams = z.infer<typeof Auth0ClientSchema>;\nexport type Auth0PublicClientParams = z.infer<typeof Auth0PublicClientSchema>;\n\nexport type OnAuthorizationRequest = \"block\" | \"interrupt\";\n"]}

package/dist/cjs/interrupts/CIBAInterrupts.js

@@ -62,6 +62,12 @@ class AuthorizationPendingInterrupt extends CIBAInterrupt {
         super(message, AuthorizationPendingInterrupt.code);
         this.request = request;
     }
+    /**
+     * Returns the interval in seconds to wait until the next polling attempt.
+     */
+    nextRetryInterval() {
+        return this.request.interval;
+    }
 }
 exports.AuthorizationPendingInterrupt = AuthorizationPendingInterrupt;
 AuthorizationPendingInterrupt.code = "CIBA_AUTHORIZATION_PENDING";
@@ -69,9 +75,16 @@ AuthorizationPendingInterrupt.code = "CIBA_AUTHORIZATION_PENDING";
  * An interrupt that is thrown when the authorization polling fails.
  */
 class AuthorizationPollingInterrupt extends CIBAInterrupt {
-    constructor(message, request) {
+    constructor(message, request, retryAfter) {
         super(message, AuthorizationPollingInterrupt.code);
         this.request = request;
+        this.retryAfter = retryAfter;
+    }
+    /**
+     * Returns the interval in seconds to wait until the next polling attempt.
+     */
+    nextRetryInterval() {
+        return this.retryAfter || this.request.interval;
     }
 }
 exports.AuthorizationPollingInterrupt = AuthorizationPollingInterrupt;
@@ -81,7 +94,7 @@ AuthorizationPollingInterrupt.code = "CIBA_AUTHORIZATION_POLLING_ERROR";
  */
 class InvalidGrantInterrupt extends CIBAInterrupt {
     constructor(message, request) {
-        super(message, AuthorizationPollingInterrupt.code);
+        super(message, InvalidGrantInterrupt.code);
         this.request = request;
     }
 }

package/dist/cjs/interrupts/CIBAInterrupts.js.map

@@ -1 +1 @@
-{"version":3,"file":"CIBAInterrupts.js","sourceRoot":"","sources":["../../../src/interrupts/CIBAInterrupts.ts"],"names":[],"mappings":";;;AACA,qDAAsE;AAMtE;;GAEG;AACH,MAAa,aAAc,SAAQ,+BAAc;IAC/C,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,WAAW,CAEhB,SAAc;QAEd,OAAO,CACL,SAAS;YACT,+BAAc,CAAC,WAAW,CAAC,SAAS,CAAC;YACrC,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;YAClC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI;gBAC3B,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,SAAc;QAClC,OAAO,aAAa,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,SAAS,CAAC;IACxE,CAAC;CACF;AArBD,sCAqBC;AAED;;GAEG;AACH,MAAa,qBACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAF3B,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AAVH,sDAWC;AAPe,0BAAI,GAAW,oBAA6B,CAAC;AAS7D;;GAEG;AACH,MAAa,yCAA0C,SAAQ,aAAa;IAG1E,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,yCAAyC,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;;AALH,8FAMC;AALe,8CAAI,GAChB,4CAAqD,CAAC;AAM1D;;GAEG;AACH,MAAa,oCACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,oCAAoC,CAAC,IAAI,CAAC,CAAC;QAF1C,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AAVH,oFAWC;AAPe,yCAAI,GAAW,oCAA6C,CAAC;AAS7E;;;GAGG;AACH,MAAa,6BACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AAVH,sEAWC;AAPe,kCAAI,GAAW,4BAAqC,CAAC;AASrE;;GAEG;AACH,MAAa,6BACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AAVH,sEAWC;AAPe,kCAAI,GAAW,kCAA2C,CAAC;AAS3E;;GAEG;AACH,MAAa,qBACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AAVH,sDAWC;AAPe,0BAAI,GAAW,oBAA6B,CAAC","sourcesContent":["import { CIBAAuthorizationRequest } from \"../authorizers/ciba/CIBAAuthorizationRequest\";\nimport { Auth0Interrupt, Auth0InterruptData } from \"./Auth0Interrupt\";\n\nexport interface WithRequestData {\n  request: CIBAAuthorizationRequest;\n}\n\n/**\n * Base class for CIBA interrupts.\n */\nexport class CIBAInterrupt extends Auth0Interrupt {\n  constructor(message: string, code: string) {\n    super(message, code);\n  }\n\n  static isInterrupt<T extends abstract new (...args: any) => any>(\n    this: T & { code?: string },\n    interrupt: any\n  ): interrupt is Auth0InterruptData<InstanceType<T>> {\n    return (\n      interrupt &&\n      Auth0Interrupt.isInterrupt(interrupt) &&\n      typeof interrupt.code === \"string\" &&\n      (this.code === interrupt.code ||\n        (!this.code && interrupt.code.startsWith(\"CIBA_\")))\n    );\n  }\n\n  static hasRequestData(interrupt: any): interrupt is WithRequestData {\n    return CIBAInterrupt.isInterrupt(interrupt) && \"request\" in interrupt;\n  }\n}\n\n/**\n * An interrupt that is thrown when the user denies the authorization request.\n */\nexport class AccessDeniedInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_ACCESS_DENIED\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AccessDeniedInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the user does not have push notifications enabled.\n */\nexport class UserDoesNotHavePushNotificationsInterrupt extends CIBAInterrupt {\n  public static code: string =\n    \"CIBA_USER_DOES_NOT_HAVE_PUSH_NOTIFICATIONS\" as const;\n  constructor(message: string) {\n    super(message, UserDoesNotHavePushNotificationsInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization request has expired.\n */\nexport class AuthorizationRequestExpiredInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_REQUEST_EXPIRED\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationRequestExpiredInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization is still pending\n * and the Authorizer is in `mode: interrupt`.\n */\nexport class AuthorizationPendingInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_PENDING\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPendingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class AuthorizationPollingInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_POLLING_ERROR\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class InvalidGrantInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_INVALID_GRANT\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n"]}
+{"version":3,"file":"CIBAInterrupts.js","sourceRoot":"","sources":["../../../src/interrupts/CIBAInterrupts.ts"],"names":[],"mappings":";;;AACA,qDAAsE;AAMtE;;GAEG;AACH,MAAa,aAAc,SAAQ,+BAAc;IAC/C,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,WAAW,CAEhB,SAAc;QAEd,OAAO,CACL,SAAS;YACT,+BAAc,CAAC,WAAW,CAAC,SAAS,CAAC;YACrC,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;YAClC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI;gBAC3B,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,SAAc;QAClC,OAAO,aAAa,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,SAAS,CAAC;IACxE,CAAC;CACF;AArBD,sCAqBC;AAED;;GAEG;AACH,MAAa,qBACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAF3B,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AAVH,sDAWC;AAPe,0BAAI,GAAW,oBAA6B,CAAC;AAS7D;;GAEG;AACH,MAAa,yCAA0C,SAAQ,aAAa;IAG1E,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,yCAAyC,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;;AALH,8FAMC;AALe,8CAAI,GAChB,4CAAqD,CAAC;AAM1D;;GAEG;AACH,MAAa,oCACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,oCAAoC,CAAC,IAAI,CAAC,CAAC;QAF1C,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AAVH,oFAWC;AAPe,yCAAI,GAAW,oCAA6C,CAAC;AAS7E;;;GAGG;AACH,MAAa,6BACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;IAED;;OAEG;IACI,iBAAiB;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC/B,CAAC;;AAjBH,sEAkBC;AAde,kCAAI,GAAW,4BAAqC,CAAC;AAgBrE;;GAEG;AACH,MAAa,6BACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC,EACjC,UAAkB;QAElC,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAHnC,YAAO,GAAP,OAAO,CAA0B;QACjC,eAAU,GAAV,UAAU,CAAQ;IAGpC,CAAC;IAED;;OAEG;IACI,iBAAiB;QACtB,OAAO,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IAClD,CAAC;;AAlBH,sEAmBC;AAfe,kCAAI,GAAW,kCAA2C,CAAC;AAiB3E;;GAEG;AACH,MAAa,qBACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAF3B,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AAVH,sDAWC;AAPe,0BAAI,GAAW,oBAA6B,CAAC","sourcesContent":["import { CIBAAuthorizationRequest } from \"../authorizers/ciba/CIBAAuthorizationRequest\";\nimport { Auth0Interrupt, Auth0InterruptData } from \"./Auth0Interrupt\";\n\nexport interface WithRequestData {\n  request: CIBAAuthorizationRequest;\n}\n\n/**\n * Base class for CIBA interrupts.\n */\nexport class CIBAInterrupt extends Auth0Interrupt {\n  constructor(message: string, code: string) {\n    super(message, code);\n  }\n\n  static isInterrupt<T extends abstract new (...args: any) => any>(\n    this: T & { code?: string },\n    interrupt: any\n  ): interrupt is Auth0InterruptData<InstanceType<T>> {\n    return (\n      interrupt &&\n      Auth0Interrupt.isInterrupt(interrupt) &&\n      typeof interrupt.code === \"string\" &&\n      (this.code === interrupt.code ||\n        (!this.code && interrupt.code.startsWith(\"CIBA_\")))\n    );\n  }\n\n  static hasRequestData(interrupt: any): interrupt is WithRequestData {\n    return CIBAInterrupt.isInterrupt(interrupt) && \"request\" in interrupt;\n  }\n}\n\n/**\n * An interrupt that is thrown when the user denies the authorization request.\n */\nexport class AccessDeniedInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_ACCESS_DENIED\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AccessDeniedInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the user does not have push notifications enabled.\n */\nexport class UserDoesNotHavePushNotificationsInterrupt extends CIBAInterrupt {\n  public static code: string =\n    \"CIBA_USER_DOES_NOT_HAVE_PUSH_NOTIFICATIONS\" as const;\n  constructor(message: string) {\n    super(message, UserDoesNotHavePushNotificationsInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization request has expired.\n */\nexport class AuthorizationRequestExpiredInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_REQUEST_EXPIRED\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationRequestExpiredInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization is still pending\n * and the Authorizer is in `mode: interrupt`.\n */\nexport class AuthorizationPendingInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_PENDING\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPendingInterrupt.code);\n  }\n\n  /**\n   * Returns the interval in seconds to wait until the next polling attempt.\n   */\n  public nextRetryInterval(): number {\n    return this.request.interval;\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class AuthorizationPollingInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_POLLING_ERROR\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest,\n    public readonly retryAfter: number\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n\n  /**\n   * Returns the interval in seconds to wait until the next polling attempt.\n   */\n  public nextRetryInterval(): number {\n    return this.retryAfter || this.request.interval;\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class InvalidGrantInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_INVALID_GRANT\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, InvalidGrantInterrupt.code);\n  }\n}\n"]}

package/dist/esm/authorizers/ciba/CIBAAuthorizerBase.js

@@ -61,7 +61,7 @@ export class CIBAAuthorizerBase {
         const authParams = {
             scope: ensureOpenIdScope(this.params.scopes).join(" "),
             audience: this.params.audience || "",
-            request_expiry: ((_a = this.params.requestExpiry) !== null && _a !== void 0 ? _a : 300).toString(),
+            requested_expiry: ((_a = this.params.requestedExpiry) !== null && _a !== void 0 ? _a : 300).toString(),
             binding_message: (_b = (await resolveParameter(this.params.bindingMessage, toolContext))) !== null && _b !== void 0 ? _b : "",
             userId: (_c = (await resolveParameter(this.params.userID, toolContext))) !== null && _c !== void 0 ? _c : "",
         };
@@ -91,7 +91,7 @@ export class CIBAAuthorizerBase {
                 throw new AuthorizationPendingInterrupt(e.error_description, authRequest);
             }
             if (e.error === "slow_down") {
-                throw new AuthorizationPollingInterrupt(e.error_description, authRequest);
+                throw new AuthorizationPollingInterrupt(e.error_description, authRequest, Number(e.headers.get('retry-after')));
             }
             if (e.error == "invalid_grant") {
                 throw new InvalidGrantInterrupt(e.error_description, authRequest);
@@ -117,7 +117,7 @@ export class CIBAAuthorizerBase {
             catch (err) {
                 if (err instanceof AuthorizationPendingInterrupt ||
                     err instanceof AuthorizationPollingInterrupt) {
-                    await sleep(err.request.interval * 1000);
+                    await sleep(err.nextRetryInterval() * 1000);
                 }
                 else {
                     throw err;

package/dist/esm/authorizers/ciba/CIBAAuthorizerBase.js.map

@@ -1 +1 @@
-{"version":3,"file":"CIBAAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/ciba/CIBAAuthorizerBase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAC7C,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,UAAU,MAAM,aAAa,CAAC;AAErC,OAAO,EAAY,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,6BAA6B,EAC7B,oCAAoC,EACpC,qBAAqB,EACrB,yCAAyC,GAC1C,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,EAAiB,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAqB,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAqB,MAAM,qBAAqB,CAAC;AAI3E,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAChF,SAAS,iBAAiB,CAAC,MAAgB;IACzC,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;AACpE,CAAC;AACD;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IAU7B,YACE,KAAiC,EACjC,MAA6C;QAE7C,IAAI,CAAC,KAAK,GAAG,IAAI,oBAAoB,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB,EAAE,WAAW;YAC/B,GAAG,MAAM;SACV,CAAC;QAEF,IAAI,CAAC,iBAAiB,GAAG,IAAI,QAAQ,CACnC,MAAM,CAAC,KAAK,EACZ;YACE,MAAM,EAAE,CAAC,YAAY,EAAE,EAAE,CACvB,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACrE,CACF,CAAC;QAEF,IAAI,CAAC,gBAAgB,GAAG,IAAI,QAAQ,CAAW,MAAM,CAAC,KAAK,EAAE;YAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CACtB,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,eAAoB;QACxC,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,eAAe;SACxB,CAAC;QACF,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,eAAoB;QACtC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YAEzE,OAAO;gBACL,EAAE,EAAE,QAAQ,CAAC,WAAW;gBACxB,WAAW,EAAE,WAAW;gBACxB,SAAS,EAAE,QAAQ,CAAC,UAAU;gBAC9B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACnC,MAAM,IAAI,yCAAyC,CACjD,GAAG,CAAC,iBAAiB,CACtB,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,WAA4B;;QAC3D,MAAM,UAAU,GAAwB;YACtC,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACtD,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE;YACpC,cAAc,EAAE,CAAC,MAAA,IAAI,CAAC,MAAM,CAAC,aAAa,mCAAI,GAAG,CAAC,CAAC,QAAQ,EAAE;YAC7D,eAAe,EACb,MAAA,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,mCAAI,EAAE;YACzE,MAAM,EAAE,MAAA,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,mCAAI,EAAE;SACxE,CAAC;QAEF,MAAM,oBAAoB,GAAG,MAAM,gBAAgB,CACjD,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAChC,WAAW,CACZ,CAAC;QAEF,yEAAyE;QACzE,yDAAyD;QACzD,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACvC,UAAU,CAAC,qBAAqB,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC1E,CAAC;QAED,qDAAqD;QACrD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CACtE,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,WAAqC;QAErC,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC;YAEnE,IAAI,cAAc,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC5C,MAAM,IAAI,oCAAoC,CAC5C,wCAAwC,EACxC,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,gBAAgB,CAAC;gBAC7D,WAAW,EAAE,WAAW,CAAC,EAAE;aAC5B,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;YAExD,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;gBACxC,MAAM,IAAI,6BAA6B,CACrC,CAAC,CAAC,iBAAiB,EACnB,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC5B,MAAM,IAAI,6BAA6B,CACrC,CAAC,CAAC,iBAAiB,EACnB,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC/B,MAAM,IAAI,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;YACpE,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACjC,MAAM,IAAI,yCAAyC,CACjD,CAAC,CAAC,iBAAiB,CACpB,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC/B,MAAM,IAAI,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAES,KAAK,CAAC,cAAc,CAAC,WAAqC;QAClE,OAAO,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAES,KAAK,CAAC,qBAAqB,CACnC,WAAqC;QAErC,IAAI,WAAW,GAAyB,SAAS,CAAC;QAElD,GAAG,CAAC;YACF,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IACE,GAAG,YAAY,6BAA6B;oBAC5C,GAAG,YAAY,6BAA6B,EAC5C,CAAC;oBACD,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;gBAC3C,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC,QAAQ,CAAC,WAAW,EAAE;QAEvB,OAAO,WAAW,CAAC;IACrB,CAAC;IAES,iBAAiB;;QACzB,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;QACjC,OAAO,MAAA,IAAI,CAAC,iBAAiB,0CAAE,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA0C,EAC1C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,IAAI,YAAkD,CAAC;YACvD,IAAI,iBAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YACpC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;YACvD,MAAM,cAAc,GAAG;gBACrB,UAAU;gBACV,eAAe;gBACf,GAAG,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC;aACvC,CAAC;YACF,MAAM,aAAa,GAAG;gBACpB,UAAU;gBACV,aAAa;gBACb,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,OAAO,CAAC;aAC1D,CAAC;YAEF,MAAM,UAAU,GAA2B;gBACzC,IAAI;gBACJ,OAAO;gBACP,cAAc;aACf,CAAC;YAEF,OAAO,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;;gBAClD,IAAI,WAAiC,CAAC;gBAEtC,MAAM,aAAa,GACjB,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW;oBACzD,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW,CAAC;gBAErD,IAAI,CAAC;oBACH,WAAW,GAAG,MAAM,CAAA,MAAA,IAAI,CAAC,gBAAgB,0CAAE,GAAG,CAC5C,aAAa,EACb,YAAY,CACb,CAAA,CAAC;oBACF,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,IAAI,aAAa,EAAE,CAAC;4BAClB,YAAY,GAAG,MAAM,CAAA,MAAA,IAAI,CAAC,iBAAiB,0CAAE,GAAG,CAC9C,cAAc,EACd,cAAc,CACf,CAAA,CAAC;4BACF,IAAI,CAAC,YAAY,EAAE,CAAC;gCAClB,iBAAiB;gCACjB,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;gCACjD,MAAM,CAAA,MAAA,IAAI,CAAC,iBAAiB,0CAAE,GAAG,CAC/B,cAAc,EACd,cAAc,EACd,YAAY,CACb,CAAA,CAAC;4BACJ,CAAC;4BACD,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;wBACxD,CAAC;6BAAM,CAAC;4BACN,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;4BACjD,MAAM,kBAAkB,GACtB,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;4BAC3C,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,UAAU,EAAE,CAAC;gCAC7D,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CACtC,YAAY,EACZ,kBAAkB,CACnB,CAAC;4BACJ,CAAC;4BACD,WAAW,GAAG,MAAM,kBAAkB,CAAC;wBACzC,CAAC;wBACD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBAC/B,IAAI,OAAO,WAAW,KAAK,WAAW,EAAE,CAAC;4BACvC,MAAA,IAAI,CAAC,gBAAgB,0CAAE,GAAG,CACxB,aAAa,EACb,YAAY,EACZ,WAAW,CACZ,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,eAAe,GACnB,GAAG,YAAY,6BAA6B;wBAC5C,GAAG,YAAY,6BAA6B,CAAC;oBAC/C,IAAI,eAAe,EAAE,CAAC;wBACpB,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;yBAAM,CAAC;wBACN,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBAC/B,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;4BACrD,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAY,EAAE,GAAG,IAAI,CAAC,CAAC;wBAC3D,CAAC;6BAAM,CAAC;4BACN,OAAO,GAAG,CAAC;wBACb,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;gBACrC,OAAO,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;IAES,KAAK,CAAC,6BAA6B,CAC3C,GAAkE;QAElE,IAAI,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;YAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;YAC1B,MAAM,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;CACF","sourcesContent":["import { AuthenticationClient } from \"auth0\";\nimport crypto from \"crypto\";\nimport stableHash from \"stable-hash\";\n\nimport { TokenSet, tokenSetFromTokenResponse } from \"../../credentials\";\nimport {\n  AccessDeniedInterrupt,\n  AuthorizationPendingInterrupt,\n  AuthorizationPollingInterrupt,\n  AuthorizationRequestExpiredInterrupt,\n  InvalidGrantInterrupt,\n  UserDoesNotHavePushNotificationsInterrupt,\n} from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { SubStore } from \"../../stores\";\nimport { RequireFields } from \"../../util\";\nimport { ContextGetter, nsFromContext } from \"../context\";\nimport { Auth0ClientParams, Auth0ClientSchema } from \"../types\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport { CIBAAuthorizationRequest } from \"./CIBAAuthorizationRequest\";\nimport { CIBAAuthorizerParams } from \"./CIBAAuthorizerParams\";\n\nconst sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));\nfunction ensureOpenIdScope(scopes: string[]): string[] {\n  return scopes.includes(\"openid\") ? scopes : [\"openid\", ...scopes];\n}\n/**\n * Requests authorization by prompting the user via an out-of-band channel from\n * the backend.\n */\nexport class CIBAAuthorizerBase<ToolExecuteArgs extends any[]> {\n  private readonly auth0: AuthenticationClient;\n  private readonly authResponseStore: SubStore | undefined;\n  private readonly credentialsStore: SubStore<TokenSet> | undefined;\n\n  private readonly params: RequireFields<\n    CIBAAuthorizerParams<ToolExecuteArgs>,\n    \"credentialsContext\"\n  >;\n\n  constructor(\n    auth0: Partial<Auth0ClientParams>,\n    params: CIBAAuthorizerParams<ToolExecuteArgs>\n  ) {\n    this.auth0 = new AuthenticationClient(Auth0ClientSchema.parse(auth0));\n    this.params = {\n      credentialsContext: \"tool-call\",\n      ...params,\n    };\n\n    this.authResponseStore = new SubStore<CIBAAuthorizationRequest>(\n      params.store,\n      {\n        getTTL: (authResponse) =>\n          authResponse.expiresIn ? authResponse.expiresIn * 1000 : undefined,\n      }\n    );\n\n    this.credentialsStore = new SubStore<TokenSet>(params.store, {\n      getTTL: (credentials) =>\n        credentials.expiresIn ? credentials.expiresIn * 1000 : undefined,\n    });\n  }\n\n  private getInstanceID(authorizeParams: any): string {\n    const props = {\n      auth0: this.auth0,\n      params: authorizeParams,\n    };\n    const sh = stableHash(props);\n    return crypto.createHash(\"MD5\").update(sh).digest(\"hex\");\n  }\n\n  private async start(authorizeParams: any): Promise<CIBAAuthorizationRequest> {\n    const requestedAt = Date.now() / 1000;\n\n    try {\n      const response = await this.auth0.backchannel.authorize(authorizeParams);\n\n      return {\n        id: response.auth_req_id,\n        requestedAt: requestedAt,\n        expiresIn: response.expires_in,\n        interval: response.interval,\n      };\n    } catch (err: any) {\n      if (err.error == \"invalid_request\") {\n        throw new UserDoesNotHavePushNotificationsInterrupt(\n          err.error_description\n        );\n      }\n      throw err;\n    }\n  }\n\n  private async getAuthorizeParams(toolContext: ToolExecuteArgs) {\n    const authParams: Record<string, any> = {\n      scope: ensureOpenIdScope(this.params.scopes).join(\" \"),\n      audience: this.params.audience || \"\",\n      request_expiry: (this.params.requestExpiry ?? 300).toString(),\n      binding_message:\n        (await resolveParameter(this.params.bindingMessage, toolContext)) ?? \"\",\n      userId: (await resolveParameter(this.params.userID, toolContext)) ?? \"\",\n    };\n\n    const authorizationDetails = await resolveParameter(\n      this.params.authorizationDetails,\n      toolContext\n    );\n\n    // If authorizationDetails is an array, we need to convert it to a string\n    // because the auth0 library expects a valid JSON string.\n    if (authorizationDetails !== undefined) {\n      authParams.authorization_details = JSON.stringify(authorizationDetails);\n    }\n\n    // Remove undefined values from the authParams object\n    return Object.fromEntries(\n      Object.entries(authParams).filter(([, value]) => value !== undefined)\n    );\n  }\n\n  private async getCredentialsInternal(\n    authRequest: CIBAAuthorizationRequest\n  ): Promise<TokenSet | undefined> {\n    try {\n      const elapsedSeconds = Date.now() / 1000 - authRequest.requestedAt;\n\n      if (elapsedSeconds >= authRequest.expiresIn) {\n        throw new AuthorizationRequestExpiredInterrupt(\n          \"The authorization request has expired.\",\n          authRequest\n        );\n      }\n\n      const response = await this.auth0.backchannel.backchannelGrant({\n        auth_req_id: authRequest.id,\n      });\n\n      const credentials = tokenSetFromTokenResponse(response);\n\n      return credentials;\n    } catch (e: any) {\n      if (e.error === \"authorization_pending\") {\n        throw new AuthorizationPendingInterrupt(\n          e.error_description,\n          authRequest\n        );\n      }\n\n      if (e.error === \"slow_down\") {\n        throw new AuthorizationPollingInterrupt(\n          e.error_description,\n          authRequest\n        );\n      }\n\n      if (e.error == \"invalid_grant\") {\n        throw new InvalidGrantInterrupt(e.error_description, authRequest);\n      }\n\n      if (e.error == \"invalid_request\") {\n        throw new UserDoesNotHavePushNotificationsInterrupt(\n          e.error_description\n        );\n      }\n\n      if (e.error == \"access_denied\") {\n        throw new AccessDeniedInterrupt(e.error_description, authRequest);\n      }\n\n      throw e;\n    }\n  }\n\n  protected async getCredentials(authRequest: CIBAAuthorizationRequest) {\n    return this.getCredentialsInternal(authRequest);\n  }\n\n  protected async getCredentialsPolling(\n    authRequest: CIBAAuthorizationRequest\n  ): Promise<TokenSet | undefined> {\n    let credentials: TokenSet | undefined = undefined;\n\n    do {\n      try {\n        credentials = await this.getCredentialsInternal(authRequest);\n      } catch (err) {\n        if (\n          err instanceof AuthorizationPendingInterrupt ||\n          err instanceof AuthorizationPollingInterrupt\n        ) {\n          await sleep(err.request.interval * 1000);\n        } else {\n          throw err;\n        }\n      }\n    } while (!credentials);\n\n    return credentials;\n  }\n\n  protected deleteAuthRequest() {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\"This method should be called from within a tool.\");\n    }\n    const { authResponseNS } = store;\n    return this.authResponseStore?.delete(authResponseNS, \"authResponse\");\n  }\n\n  /**\n   *\n   * Wraps the execute method of a AI tool to handle CIBA authorization.\n   *\n   * @param getContext - A function that returns the context of the tool execution.\n   * @param execute - The tool execute method.\n   * @returns The wrapped execute method.\n   */\n  protect(\n    getContext: ContextGetter<ToolExecuteArgs>,\n    execute: (...args: ToolExecuteArgs) => any\n  ): (...args: ToolExecuteArgs) => any {\n    return async (...args: ToolExecuteArgs) => {\n      let authResponse: CIBAAuthorizationRequest | undefined;\n      if (asyncLocalStorage.getStore()) {\n        throw new Error(\n          \"Cannot nest tool calls that require CIBA authorization.\"\n        );\n      }\n\n      const context = getContext(...args);\n      const authorizeParams = await this.getAuthorizeParams(args);\n      const instanceID = this.getInstanceID(authorizeParams);\n      const authResponseNS = [\n        instanceID,\n        \"AuthResponses\",\n        ...nsFromContext(\"tool-call\", context),\n      ];\n      const credentialsNS = [\n        instanceID,\n        \"Credentials\",\n        ...nsFromContext(this.params.credentialsContext, context),\n      ];\n\n      const storeValue: AsyncStorageValue<any> = {\n        args,\n        context,\n        authResponseNS,\n      };\n\n      return asyncLocalStorage.run(storeValue, async () => {\n        let credentials: TokenSet | undefined;\n\n        const interruptMode =\n          typeof this.params.onAuthorizationRequest === \"undefined\" ||\n          this.params.onAuthorizationRequest === \"interrupt\";\n\n        try {\n          credentials = await this.credentialsStore?.get(\n            credentialsNS,\n            \"credential\"\n          );\n          if (!credentials) {\n            if (interruptMode) {\n              authResponse = await this.authResponseStore?.get(\n                authResponseNS,\n                \"authResponse\"\n              );\n              if (!authResponse) {\n                //Initial request\n                authResponse = await this.start(authorizeParams);\n                await this.authResponseStore?.put(\n                  authResponseNS,\n                  \"authResponse\",\n                  authResponse\n                );\n              }\n              credentials = await this.getCredentials(authResponse);\n            } else {\n              authResponse = await this.start(authorizeParams);\n              const credentialsPromise =\n                this.getCredentialsPolling(authResponse);\n              if (typeof this.params.onAuthorizationRequest === \"function\") {\n                await this.params.onAuthorizationRequest(\n                  authResponse,\n                  credentialsPromise\n                );\n              }\n              credentials = await credentialsPromise;\n            }\n            await this.deleteAuthRequest();\n            if (typeof credentials !== \"undefined\") {\n              this.credentialsStore?.put(\n                credentialsNS,\n                \"credential\",\n                credentials\n              );\n            }\n          }\n        } catch (err) {\n          const shouldInterrupt =\n            err instanceof AuthorizationPendingInterrupt ||\n            err instanceof AuthorizationPollingInterrupt;\n          if (shouldInterrupt) {\n            return this.handleAuthorizationInterrupts(err);\n          } else {\n            await this.deleteAuthRequest();\n            if (typeof this.params.onUnauthorized === \"function\") {\n              return this.params.onUnauthorized(err as Error, ...args);\n            } else {\n              return err;\n            }\n          }\n        }\n        storeValue.credentials = credentials;\n        return execute(...args);\n      });\n    };\n  }\n\n  protected async handleAuthorizationInterrupts(\n    err: AuthorizationPendingInterrupt | AuthorizationPollingInterrupt\n  ) {\n    if (this.params.onAuthorizationInterrupt) {\n      const store = asyncLocalStorage.getStore();\n      if (!store) {\n        throw new Error(\"This method should be called from within a tool.\");\n      }\n      const { context } = store;\n      await this.params.onAuthorizationInterrupt(err, context);\n    }\n    throw err;\n  }\n}\n"]}
+{"version":3,"file":"CIBAAuthorizerBase.js","sourceRoot":"","sources":["../../../../src/authorizers/ciba/CIBAAuthorizerBase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAC7C,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,UAAU,MAAM,aAAa,CAAC;AAErC,OAAO,EAAY,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,6BAA6B,EAC7B,oCAAoC,EACpC,qBAAqB,EACrB,yCAAyC,GAC1C,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,EAAiB,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAqB,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAqB,MAAM,qBAAqB,CAAC;AAI3E,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAChF,SAAS,iBAAiB,CAAC,MAAgB;IACzC,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;AACpE,CAAC;AACD;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IAU7B,YACE,KAAiC,EACjC,MAA6C;QAE7C,IAAI,CAAC,KAAK,GAAG,IAAI,oBAAoB,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,GAAG;YACZ,kBAAkB,EAAE,WAAW;YAC/B,GAAG,MAAM;SACV,CAAC;QAEF,IAAI,CAAC,iBAAiB,GAAG,IAAI,QAAQ,CACnC,MAAM,CAAC,KAAK,EACZ;YACE,MAAM,EAAE,CAAC,YAAY,EAAE,EAAE,CACvB,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACrE,CACF,CAAC;QAEF,IAAI,CAAC,gBAAgB,GAAG,IAAI,QAAQ,CAAW,MAAM,CAAC,KAAK,EAAE;YAC3D,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CACtB,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;SACnE,CAAC,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,eAAoB;QACxC,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,eAAe;SACxB,CAAC;QACF,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,eAAoB;QACtC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YAEzE,OAAO;gBACL,EAAE,EAAE,QAAQ,CAAC,WAAW;gBACxB,WAAW,EAAE,WAAW;gBACxB,SAAS,EAAE,QAAQ,CAAC,UAAU;gBAC9B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACnC,MAAM,IAAI,yCAAyC,CACjD,GAAG,CAAC,iBAAiB,CACtB,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,WAA4B;;QAC3D,MAAM,UAAU,GAAwB;YACtC,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACtD,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE;YACpC,gBAAgB,EAAE,CAAC,MAAA,IAAI,CAAC,MAAM,CAAC,eAAe,mCAAI,GAAG,CAAC,CAAC,QAAQ,EAAE;YACjE,eAAe,EACb,MAAA,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,mCAAI,EAAE;YACzE,MAAM,EAAE,MAAA,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,mCAAI,EAAE;SACxE,CAAC;QAEF,MAAM,oBAAoB,GAAG,MAAM,gBAAgB,CACjD,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAChC,WAAW,CACZ,CAAC;QAEF,yEAAyE;QACzE,yDAAyD;QACzD,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACvC,UAAU,CAAC,qBAAqB,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC1E,CAAC;QAED,qDAAqD;QACrD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CACtE,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,WAAqC;QAErC,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC;YAEnE,IAAI,cAAc,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC5C,MAAM,IAAI,oCAAoC,CAC5C,wCAAwC,EACxC,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,gBAAgB,CAAC;gBAC7D,WAAW,EAAE,WAAW,CAAC,EAAE;aAC5B,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;YAExD,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;gBACxC,MAAM,IAAI,6BAA6B,CACrC,CAAC,CAAC,iBAAiB,EACnB,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC5B,MAAM,IAAI,6BAA6B,CACrC,CAAC,CAAC,iBAAiB,EACnB,WAAW,EACX,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CACrC,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC/B,MAAM,IAAI,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;YACpE,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACjC,MAAM,IAAI,yCAAyC,CACjD,CAAC,CAAC,iBAAiB,CACpB,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC;gBAC/B,MAAM,IAAI,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAES,KAAK,CAAC,cAAc,CAAC,WAAqC;QAClE,OAAO,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAES,KAAK,CAAC,qBAAqB,CACnC,WAAqC;QAErC,IAAI,WAAW,GAAyB,SAAS,CAAC;QAElD,GAAG,CAAC;YACF,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IACE,GAAG,YAAY,6BAA6B;oBAC5C,GAAG,YAAY,6BAA6B,EAC5C,CAAC;oBACD,MAAM,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,GAAG,IAAI,CAAC,CAAC;gBAC9C,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC,QAAQ,CAAC,WAAW,EAAE;QAEvB,OAAO,WAAW,CAAC;IACrB,CAAC;IAES,iBAAiB;;QACzB,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;QACjC,OAAO,MAAA,IAAI,CAAC,iBAAiB,0CAAE,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,UAA0C,EAC1C,OAA0C;QAE1C,OAAO,KAAK,EAAE,GAAG,IAAqB,EAAE,EAAE;YACxC,IAAI,YAAkD,CAAC;YACvD,IAAI,iBAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YACpC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;YACvD,MAAM,cAAc,GAAG;gBACrB,UAAU;gBACV,eAAe;gBACf,GAAG,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC;aACvC,CAAC;YACF,MAAM,aAAa,GAAG;gBACpB,UAAU;gBACV,aAAa;gBACb,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,OAAO,CAAC;aAC1D,CAAC;YAEF,MAAM,UAAU,GAA2B;gBACzC,IAAI;gBACJ,OAAO;gBACP,cAAc;aACf,CAAC;YAEF,OAAO,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;;gBAClD,IAAI,WAAiC,CAAC;gBAEtC,MAAM,aAAa,GACjB,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW;oBACzD,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,WAAW,CAAC;gBAErD,IAAI,CAAC;oBACH,WAAW,GAAG,MAAM,CAAA,MAAA,IAAI,CAAC,gBAAgB,0CAAE,GAAG,CAC5C,aAAa,EACb,YAAY,CACb,CAAA,CAAC;oBACF,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,IAAI,aAAa,EAAE,CAAC;4BAClB,YAAY,GAAG,MAAM,CAAA,MAAA,IAAI,CAAC,iBAAiB,0CAAE,GAAG,CAC9C,cAAc,EACd,cAAc,CACf,CAAA,CAAC;4BACF,IAAI,CAAC,YAAY,EAAE,CAAC;gCAClB,iBAAiB;gCACjB,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;gCACjD,MAAM,CAAA,MAAA,IAAI,CAAC,iBAAiB,0CAAE,GAAG,CAC/B,cAAc,EACd,cAAc,EACd,YAAY,CACb,CAAA,CAAC;4BACJ,CAAC;4BACD,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;wBACxD,CAAC;6BAAM,CAAC;4BACN,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;4BACjD,MAAM,kBAAkB,GACtB,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;4BAC3C,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,UAAU,EAAE,CAAC;gCAC7D,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CACtC,YAAY,EACZ,kBAAkB,CACnB,CAAC;4BACJ,CAAC;4BACD,WAAW,GAAG,MAAM,kBAAkB,CAAC;wBACzC,CAAC;wBACD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBAC/B,IAAI,OAAO,WAAW,KAAK,WAAW,EAAE,CAAC;4BACvC,MAAA,IAAI,CAAC,gBAAgB,0CAAE,GAAG,CACxB,aAAa,EACb,YAAY,EACZ,WAAW,CACZ,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,eAAe,GACnB,GAAG,YAAY,6BAA6B;wBAC5C,GAAG,YAAY,6BAA6B,CAAC;oBAC/C,IAAI,eAAe,EAAE,CAAC;wBACpB,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;oBACjD,CAAC;yBAAM,CAAC;wBACN,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBAC/B,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;4BACrD,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAY,EAAE,GAAG,IAAI,CAAC,CAAC;wBAC3D,CAAC;6BAAM,CAAC;4BACN,OAAO,GAAG,CAAC;wBACb,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,UAAU,CAAC,WAAW,GAAG,WAAW,CAAC;gBACrC,OAAO,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;IAES,KAAK,CAAC,6BAA6B,CAC3C,GAAkE;QAElE,IAAI,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;YAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;YAC1B,MAAM,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;CACF","sourcesContent":["import { AuthenticationClient } from \"auth0\";\nimport crypto from \"crypto\";\nimport stableHash from \"stable-hash\";\n\nimport { TokenSet, tokenSetFromTokenResponse } from \"../../credentials\";\nimport {\n  AccessDeniedInterrupt,\n  AuthorizationPendingInterrupt,\n  AuthorizationPollingInterrupt,\n  AuthorizationRequestExpiredInterrupt,\n  InvalidGrantInterrupt,\n  UserDoesNotHavePushNotificationsInterrupt,\n} from \"../../interrupts\";\nimport { resolveParameter } from \"../../parameters\";\nimport { SubStore } from \"../../stores\";\nimport { RequireFields } from \"../../util\";\nimport { ContextGetter, nsFromContext } from \"../context\";\nimport { Auth0ClientParams, Auth0ClientSchema } from \"../types\";\nimport { asyncLocalStorage, AsyncStorageValue } from \"./asyncLocalStorage\";\nimport { CIBAAuthorizationRequest } from \"./CIBAAuthorizationRequest\";\nimport { CIBAAuthorizerParams } from \"./CIBAAuthorizerParams\";\n\nconst sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));\nfunction ensureOpenIdScope(scopes: string[]): string[] {\n  return scopes.includes(\"openid\") ? scopes : [\"openid\", ...scopes];\n}\n/**\n * Requests authorization by prompting the user via an out-of-band channel from\n * the backend.\n */\nexport class CIBAAuthorizerBase<ToolExecuteArgs extends any[]> {\n  private readonly auth0: AuthenticationClient;\n  private readonly authResponseStore: SubStore | undefined;\n  private readonly credentialsStore: SubStore<TokenSet> | undefined;\n\n  private readonly params: RequireFields<\n    CIBAAuthorizerParams<ToolExecuteArgs>,\n    \"credentialsContext\"\n  >;\n\n  constructor(\n    auth0: Partial<Auth0ClientParams>,\n    params: CIBAAuthorizerParams<ToolExecuteArgs>\n  ) {\n    this.auth0 = new AuthenticationClient(Auth0ClientSchema.parse(auth0));\n    this.params = {\n      credentialsContext: \"tool-call\",\n      ...params,\n    };\n\n    this.authResponseStore = new SubStore<CIBAAuthorizationRequest>(\n      params.store,\n      {\n        getTTL: (authResponse) =>\n          authResponse.expiresIn ? authResponse.expiresIn * 1000 : undefined,\n      }\n    );\n\n    this.credentialsStore = new SubStore<TokenSet>(params.store, {\n      getTTL: (credentials) =>\n        credentials.expiresIn ? credentials.expiresIn * 1000 : undefined,\n    });\n  }\n\n  private getInstanceID(authorizeParams: any): string {\n    const props = {\n      auth0: this.auth0,\n      params: authorizeParams,\n    };\n    const sh = stableHash(props);\n    return crypto.createHash(\"MD5\").update(sh).digest(\"hex\");\n  }\n\n  private async start(authorizeParams: any): Promise<CIBAAuthorizationRequest> {\n    const requestedAt = Date.now() / 1000;\n\n    try {\n      const response = await this.auth0.backchannel.authorize(authorizeParams);\n\n      return {\n        id: response.auth_req_id,\n        requestedAt: requestedAt,\n        expiresIn: response.expires_in,\n        interval: response.interval,\n      };\n    } catch (err: any) {\n      if (err.error == \"invalid_request\") {\n        throw new UserDoesNotHavePushNotificationsInterrupt(\n          err.error_description\n        );\n      }\n      throw err;\n    }\n  }\n\n  private async getAuthorizeParams(toolContext: ToolExecuteArgs) {\n    const authParams: Record<string, any> = {\n      scope: ensureOpenIdScope(this.params.scopes).join(\" \"),\n      audience: this.params.audience || \"\",\n      requested_expiry: (this.params.requestedExpiry ?? 300).toString(),\n      binding_message:\n        (await resolveParameter(this.params.bindingMessage, toolContext)) ?? \"\",\n      userId: (await resolveParameter(this.params.userID, toolContext)) ?? \"\",\n    };\n\n    const authorizationDetails = await resolveParameter(\n      this.params.authorizationDetails,\n      toolContext\n    );\n\n    // If authorizationDetails is an array, we need to convert it to a string\n    // because the auth0 library expects a valid JSON string.\n    if (authorizationDetails !== undefined) {\n      authParams.authorization_details = JSON.stringify(authorizationDetails);\n    }\n\n    // Remove undefined values from the authParams object\n    return Object.fromEntries(\n      Object.entries(authParams).filter(([, value]) => value !== undefined)\n    );\n  }\n\n  private async getCredentialsInternal(\n    authRequest: CIBAAuthorizationRequest\n  ): Promise<TokenSet | undefined> {\n    try {\n      const elapsedSeconds = Date.now() / 1000 - authRequest.requestedAt;\n\n      if (elapsedSeconds >= authRequest.expiresIn) {\n        throw new AuthorizationRequestExpiredInterrupt(\n          \"The authorization request has expired.\",\n          authRequest\n        );\n      }\n\n      const response = await this.auth0.backchannel.backchannelGrant({\n        auth_req_id: authRequest.id,\n      });\n\n      const credentials = tokenSetFromTokenResponse(response);\n\n      return credentials;\n    } catch (e: any) {\n      if (e.error === \"authorization_pending\") {\n        throw new AuthorizationPendingInterrupt(\n          e.error_description,\n          authRequest\n        );\n      }\n\n      if (e.error === \"slow_down\") {\n        throw new AuthorizationPollingInterrupt(\n          e.error_description,\n          authRequest,\n          Number(e.headers.get('retry-after'))\n        );\n      }\n\n      if (e.error == \"invalid_grant\") {\n        throw new InvalidGrantInterrupt(e.error_description, authRequest);\n      }\n\n      if (e.error == \"invalid_request\") {\n        throw new UserDoesNotHavePushNotificationsInterrupt(\n          e.error_description\n        );\n      }\n\n      if (e.error == \"access_denied\") {\n        throw new AccessDeniedInterrupt(e.error_description, authRequest);\n      }\n\n      throw e;\n    }\n  }\n\n  protected async getCredentials(authRequest: CIBAAuthorizationRequest) {\n    return this.getCredentialsInternal(authRequest);\n  }\n\n  protected async getCredentialsPolling(\n    authRequest: CIBAAuthorizationRequest\n  ): Promise<TokenSet | undefined> {\n    let credentials: TokenSet | undefined = undefined;\n\n    do {\n      try {\n        credentials = await this.getCredentialsInternal(authRequest);\n      } catch (err) {\n        if (\n          err instanceof AuthorizationPendingInterrupt ||\n          err instanceof AuthorizationPollingInterrupt\n        ) {\n          await sleep(err.nextRetryInterval() * 1000);\n        } else {\n          throw err;\n        }\n      }\n    } while (!credentials);\n\n    return credentials;\n  }\n\n  protected deleteAuthRequest() {\n    const store = asyncLocalStorage.getStore();\n    if (!store) {\n      throw new Error(\"This method should be called from within a tool.\");\n    }\n    const { authResponseNS } = store;\n    return this.authResponseStore?.delete(authResponseNS, \"authResponse\");\n  }\n\n  /**\n   *\n   * Wraps the execute method of a AI tool to handle CIBA authorization.\n   *\n   * @param getContext - A function that returns the context of the tool execution.\n   * @param execute - The tool execute method.\n   * @returns The wrapped execute method.\n   */\n  protect(\n    getContext: ContextGetter<ToolExecuteArgs>,\n    execute: (...args: ToolExecuteArgs) => any\n  ): (...args: ToolExecuteArgs) => any {\n    return async (...args: ToolExecuteArgs) => {\n      let authResponse: CIBAAuthorizationRequest | undefined;\n      if (asyncLocalStorage.getStore()) {\n        throw new Error(\n          \"Cannot nest tool calls that require CIBA authorization.\"\n        );\n      }\n\n      const context = getContext(...args);\n      const authorizeParams = await this.getAuthorizeParams(args);\n      const instanceID = this.getInstanceID(authorizeParams);\n      const authResponseNS = [\n        instanceID,\n        \"AuthResponses\",\n        ...nsFromContext(\"tool-call\", context),\n      ];\n      const credentialsNS = [\n        instanceID,\n        \"Credentials\",\n        ...nsFromContext(this.params.credentialsContext, context),\n      ];\n\n      const storeValue: AsyncStorageValue<any> = {\n        args,\n        context,\n        authResponseNS,\n      };\n\n      return asyncLocalStorage.run(storeValue, async () => {\n        let credentials: TokenSet | undefined;\n\n        const interruptMode =\n          typeof this.params.onAuthorizationRequest === \"undefined\" ||\n          this.params.onAuthorizationRequest === \"interrupt\";\n\n        try {\n          credentials = await this.credentialsStore?.get(\n            credentialsNS,\n            \"credential\"\n          );\n          if (!credentials) {\n            if (interruptMode) {\n              authResponse = await this.authResponseStore?.get(\n                authResponseNS,\n                \"authResponse\"\n              );\n              if (!authResponse) {\n                //Initial request\n                authResponse = await this.start(authorizeParams);\n                await this.authResponseStore?.put(\n                  authResponseNS,\n                  \"authResponse\",\n                  authResponse\n                );\n              }\n              credentials = await this.getCredentials(authResponse);\n            } else {\n              authResponse = await this.start(authorizeParams);\n              const credentialsPromise =\n                this.getCredentialsPolling(authResponse);\n              if (typeof this.params.onAuthorizationRequest === \"function\") {\n                await this.params.onAuthorizationRequest(\n                  authResponse,\n                  credentialsPromise\n                );\n              }\n              credentials = await credentialsPromise;\n            }\n            await this.deleteAuthRequest();\n            if (typeof credentials !== \"undefined\") {\n              this.credentialsStore?.put(\n                credentialsNS,\n                \"credential\",\n                credentials\n              );\n            }\n          }\n        } catch (err) {\n          const shouldInterrupt =\n            err instanceof AuthorizationPendingInterrupt ||\n            err instanceof AuthorizationPollingInterrupt;\n          if (shouldInterrupt) {\n            return this.handleAuthorizationInterrupts(err);\n          } else {\n            await this.deleteAuthRequest();\n            if (typeof this.params.onUnauthorized === \"function\") {\n              return this.params.onUnauthorized(err as Error, ...args);\n            } else {\n              return err;\n            }\n          }\n        }\n        storeValue.credentials = credentials;\n        return execute(...args);\n      });\n    };\n  }\n\n  protected async handleAuthorizationInterrupts(\n    err: AuthorizationPendingInterrupt | AuthorizationPollingInterrupt\n  ) {\n    if (this.params.onAuthorizationInterrupt) {\n      const store = asyncLocalStorage.getStore();\n      if (!store) {\n        throw new Error(\"This method should be called from within a tool.\");\n      }\n      const { context } = store;\n      await this.params.onAuthorizationInterrupt(err, context);\n    }\n    throw err;\n  }\n}\n"]}

package/dist/esm/authorizers/ciba/CIBAAuthorizerParams.d.ts

@@ -29,9 +29,9 @@ export type CIBAAuthorizerParams<ToolExecuteArgs extends any[]> = {
     /**
      * The time in seconds for the authorization request to expire.
      *
-     * Defaults to 5m.
+     * Defaults to 300 (5 minutes).
      */
-    requestExpiry?: number;
+    requestedExpiry?: number;
     /**
      * The behavior when the authorization request is made.
      *

package/dist/esm/authorizers/ciba/CIBAAuthorizerParams.js.map

@@ -1 +1 @@
-{"version":3,"file":"CIBAAuthorizerParams.js","sourceRoot":"","sources":["../../../../src/authorizers/ciba/CIBAAuthorizerParams.ts"],"names":[],"mappings":"","sourcesContent":["import { TokenSet } from \"../../credentials\";\nimport {\n  AuthorizationPendingInterrupt,\n  AuthorizationPollingInterrupt,\n  CIBAInterrupt,\n} from \"../../interrupts\";\nimport { AuthorizerToolParameter } from \"../../parameters\";\nimport { Store } from \"../../stores\";\nimport { AuthContext, ToolCallContext } from \"../context\";\nimport { OnAuthorizationRequest } from \"../types\";\nimport { CIBAAuthorizationRequest } from \"./CIBAAuthorizationRequest\";\n\nexport type CIBAAuthorizerParams<ToolExecuteArgs extends any[]> = {\n  /**\n   * The scope to request authorization for.\n   */\n  scopes: string[];\n\n  /**\n   * The user ID to request authorization for.\n   */\n  userID: AuthorizerToolParameter<ToolExecuteArgs>;\n\n  /**\n   * The binding message to send to the user.\n   */\n  bindingMessage: AuthorizerToolParameter<ToolExecuteArgs>;\n\n  /**\n   * The authorization parameters for RAR request.\n   */\n  authorizationDetails?: AuthorizerToolParameter<\n    ToolExecuteArgs,\n    Record<string, any>[]\n  >;\n\n  /**\n   * The audience to request authorization for.\n   */\n  audience?: string;\n\n  /**\n   * The time in seconds for the authorization request to expire.\n   *\n   * Defaults to 5m.\n   */\n  requestExpiry?: number;\n\n  /**\n   * The behavior when the authorization request is made.\n   *\n   * - `block`: The tool execution is blocked until the user completes the authorization.\n   * - `interrupt`: The tool execution is interrupted until the user completes the authorization.\n   * - a callback: Same as \"block\" but give access to the auth request and executing logic.\n   *\n   * Defaults to `interrupt`.\n   * Note: The block mode is only useful for development purposes and should not be used in production.\n   */\n  onAuthorizationRequest?:\n    | OnAuthorizationRequest\n    | ((\n        authReq: CIBAAuthorizationRequest,\n        poll: Promise<TokenSet | undefined>\n      ) => Promise<void>);\n\n  /**\n   * AuthContext defines the scope of credential sharing:\n   * - \"tool-call\": Credentials are valid only for a single invocation of the tool.\n   * - \"tool\": Credentials are shared across multiple calls to the same tool within the same thread.\n   * - \"thread\": Credentials are shared across all tools using the same authorizer within the current thread.\n   * - \"agent\": Credentials are shared globally across all threads and tools in the agent.\n   *\n   * @default \"tool-call\"\n   */\n  credentialsContext?: AuthContext;\n\n  /**\n   *\n   * Optional callback to generate a tool result when the invocation is not authorized.\n   *\n   * By default it will return the instance of the Error.\n   *\n   * @param args - The tool execution arguments.\n   * @returns The response to return when the invocation is not authorized.\n   */\n  onUnauthorized?: (\n    err: Error | CIBAInterrupt,\n    ...args: ToolExecuteArgs\n  ) => any;\n\n  /**\n   * Callback called before the authorization interrupt is thrown.\n   * This callback is useful to setup CIBA pollers.\n   *\n   * @param interrupt - The interrupt that is about to be thrown.\n   * @param args - The tool execution arguments.\n   */\n  onAuthorizationInterrupt?: (\n    interrupt: AuthorizationPendingInterrupt | AuthorizationPollingInterrupt,\n    context: ToolCallContext\n  ) => void | Promise<void>;\n\n  /**\n   * An store used to temporarly store the authorization response data\n   * while the user is completing the authorization in another device.\n   */\n  store: Store;\n};\n"]}
+{"version":3,"file":"CIBAAuthorizerParams.js","sourceRoot":"","sources":["../../../../src/authorizers/ciba/CIBAAuthorizerParams.ts"],"names":[],"mappings":"","sourcesContent":["import { TokenSet } from \"../../credentials\";\nimport {\n  AuthorizationPendingInterrupt,\n  AuthorizationPollingInterrupt,\n  CIBAInterrupt,\n} from \"../../interrupts\";\nimport { AuthorizerToolParameter } from \"../../parameters\";\nimport { Store } from \"../../stores\";\nimport { AuthContext, ToolCallContext } from \"../context\";\nimport { OnAuthorizationRequest } from \"../types\";\nimport { CIBAAuthorizationRequest } from \"./CIBAAuthorizationRequest\";\n\nexport type CIBAAuthorizerParams<ToolExecuteArgs extends any[]> = {\n  /**\n   * The scope to request authorization for.\n   */\n  scopes: string[];\n\n  /**\n   * The user ID to request authorization for.\n   */\n  userID: AuthorizerToolParameter<ToolExecuteArgs>;\n\n  /**\n   * The binding message to send to the user.\n   */\n  bindingMessage: AuthorizerToolParameter<ToolExecuteArgs>;\n\n  /**\n   * The authorization parameters for RAR request.\n   */\n  authorizationDetails?: AuthorizerToolParameter<\n    ToolExecuteArgs,\n    Record<string, any>[]\n  >;\n\n  /**\n   * The audience to request authorization for.\n   */\n  audience?: string;\n\n  /**\n   * The time in seconds for the authorization request to expire.\n   *\n   * Defaults to 300 (5 minutes).\n   */\n  requestedExpiry?: number;\n\n  /**\n   * The behavior when the authorization request is made.\n   *\n   * - `block`: The tool execution is blocked until the user completes the authorization.\n   * - `interrupt`: The tool execution is interrupted until the user completes the authorization.\n   * - a callback: Same as \"block\" but give access to the auth request and executing logic.\n   *\n   * Defaults to `interrupt`.\n   * Note: The block mode is only useful for development purposes and should not be used in production.\n   */\n  onAuthorizationRequest?:\n    | OnAuthorizationRequest\n    | ((\n        authReq: CIBAAuthorizationRequest,\n        poll: Promise<TokenSet | undefined>\n      ) => Promise<void>);\n\n  /**\n   * AuthContext defines the scope of credential sharing:\n   * - \"tool-call\": Credentials are valid only for a single invocation of the tool.\n   * - \"tool\": Credentials are shared across multiple calls to the same tool within the same thread.\n   * - \"thread\": Credentials are shared across all tools using the same authorizer within the current thread.\n   * - \"agent\": Credentials are shared globally across all threads and tools in the agent.\n   *\n   * @default \"tool-call\"\n   */\n  credentialsContext?: AuthContext;\n\n  /**\n   *\n   * Optional callback to generate a tool result when the invocation is not authorized.\n   *\n   * By default it will return the instance of the Error.\n   *\n   * @param args - The tool execution arguments.\n   * @returns The response to return when the invocation is not authorized.\n   */\n  onUnauthorized?: (\n    err: Error | CIBAInterrupt,\n    ...args: ToolExecuteArgs\n  ) => any;\n\n  /**\n   * Callback called before the authorization interrupt is thrown.\n   * This callback is useful to setup CIBA pollers.\n   *\n   * @param interrupt - The interrupt that is about to be thrown.\n   * @param args - The tool execution arguments.\n   */\n  onAuthorizationInterrupt?: (\n    interrupt: AuthorizationPendingInterrupt | AuthorizationPollingInterrupt,\n    context: ToolCallContext\n  ) => void | Promise<void>;\n\n  /**\n   * An store used to temporarly store the authorization response data\n   * while the user is completing the authorization in another device.\n   */\n  store: Store;\n};\n"]}

package/dist/esm/authorizers/types.d.ts

@@ -1,5 +1,5 @@
 import * as jose from "jose";
-import { z } from "zod";
+import { z } from "zod/v3";
 export type AuthParams = {
     allowed?: boolean;
     accessToken?: string;

package/dist/esm/authorizers/types.js

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "zod/v3";
 export const Auth0ClientSchema = z.object({
     domain: z.string().default(() => process.env.AUTH0_DOMAIN),
     clientId: z.string().default(() => process.env.AUTH0_CLIENT_ID),

package/dist/esm/authorizers/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/authorizers/types.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,YAAa,CAAC;IAC3D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,eAAgB,CAAC;IAChE,YAAY,EAAE,CAAC;SACZ,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;SAClC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAD,CAAC,cAAD,CAAC,GAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACzD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC;SACV,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC;SACD,WAAW,EAAE;SACb,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,YAAa,CAAC;IAC3D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,eAAgB,CAAC;CACjE,CAAC,CAAC","sourcesContent":["import * as jose from \"jose\";\nimport { z } from \"zod\";\n\nexport type AuthParams = {\n  allowed?: boolean;\n  accessToken?: string;\n  claims?: jose.JWTPayload;\n};\n\nexport type ToolWithAuthHandler<I, O, C> = (\n  authParams: AuthParams,\n  input: I,\n  config?: C\n) => Promise<O>;\n\nexport const Auth0ClientSchema = z.object({\n  domain: z.string().default(() => process.env.AUTH0_DOMAIN!),\n  clientId: z.string().default(() => process.env.AUTH0_CLIENT_ID!),\n  clientSecret: z\n    .union([z.string(), z.undefined()])\n    .transform((v) => v ?? process.env.AUTH0_CLIENT_SECRET),\n  telemetry: z.boolean().optional(),\n  clientInfo: z\n    .object({\n      name: z.string(),\n    })\n    .passthrough()\n    .optional(),\n});\n\nexport const Auth0PublicClientSchema = z.object({\n  domain: z.string().default(() => process.env.AUTH0_DOMAIN!),\n  clientId: z.string().default(() => process.env.AUTH0_CLIENT_ID!),\n});\n\nexport type Auth0ClientParams = z.infer<typeof Auth0ClientSchema>;\nexport type Auth0PublicClientParams = z.infer<typeof Auth0PublicClientSchema>;\n\nexport type OnAuthorizationRequest = \"block\" | \"interrupt\";\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/authorizers/types.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAc3B,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,YAAa,CAAC;IAC3D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,eAAgB,CAAC;IAChE,YAAY,EAAE,CAAC;SACZ,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;SAClC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAD,CAAC,cAAD,CAAC,GAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACzD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC;SACV,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC;SACD,WAAW,EAAE;SACb,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,YAAa,CAAC;IAC3D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,eAAgB,CAAC;CACjE,CAAC,CAAC","sourcesContent":["import * as jose from \"jose\";\nimport { z } from \"zod/v3\";\n\nexport type AuthParams = {\n  allowed?: boolean;\n  accessToken?: string;\n  claims?: jose.JWTPayload;\n};\n\nexport type ToolWithAuthHandler<I, O, C> = (\n  authParams: AuthParams,\n  input: I,\n  config?: C\n) => Promise<O>;\n\nexport const Auth0ClientSchema = z.object({\n  domain: z.string().default(() => process.env.AUTH0_DOMAIN!),\n  clientId: z.string().default(() => process.env.AUTH0_CLIENT_ID!),\n  clientSecret: z\n    .union([z.string(), z.undefined()])\n    .transform((v) => v ?? process.env.AUTH0_CLIENT_SECRET),\n  telemetry: z.boolean().optional(),\n  clientInfo: z\n    .object({\n      name: z.string(),\n    })\n    .passthrough()\n    .optional(),\n});\n\nexport const Auth0PublicClientSchema = z.object({\n  domain: z.string().default(() => process.env.AUTH0_DOMAIN!),\n  clientId: z.string().default(() => process.env.AUTH0_CLIENT_ID!),\n});\n\nexport type Auth0ClientParams = z.infer<typeof Auth0ClientSchema>;\nexport type Auth0PublicClientParams = z.infer<typeof Auth0PublicClientSchema>;\n\nexport type OnAuthorizationRequest = \"block\" | \"interrupt\";\n"]}

package/dist/esm/interrupts/CIBAInterrupts.d.ts

@@ -44,14 +44,23 @@ export declare class AuthorizationPendingInterrupt extends CIBAInterrupt impleme
     readonly request: CIBAAuthorizationRequest;
     static code: string;
     constructor(message: string, request: CIBAAuthorizationRequest);
+    /**
+     * Returns the interval in seconds to wait until the next polling attempt.
+     */
+    nextRetryInterval(): number;
 }
 /**
  * An interrupt that is thrown when the authorization polling fails.
  */
 export declare class AuthorizationPollingInterrupt extends CIBAInterrupt implements WithRequestData {
     readonly request: CIBAAuthorizationRequest;
+    readonly retryAfter: number;
     static code: string;
-    constructor(message: string, request: CIBAAuthorizationRequest);
+    constructor(message: string, request: CIBAAuthorizationRequest, retryAfter: number);
+    /**
+     * Returns the interval in seconds to wait until the next polling attempt.
+     */
+    nextRetryInterval(): number;
 }
 /**
  * An interrupt that is thrown when the authorization polling fails.

package/dist/esm/interrupts/CIBAInterrupts.js

@@ -55,15 +55,28 @@ export class AuthorizationPendingInterrupt extends CIBAInterrupt {
         super(message, AuthorizationPendingInterrupt.code);
         this.request = request;
     }
+    /**
+     * Returns the interval in seconds to wait until the next polling attempt.
+     */
+    nextRetryInterval() {
+        return this.request.interval;
+    }
 }
 AuthorizationPendingInterrupt.code = "CIBA_AUTHORIZATION_PENDING";
 /**
  * An interrupt that is thrown when the authorization polling fails.
  */
 export class AuthorizationPollingInterrupt extends CIBAInterrupt {
-    constructor(message, request) {
+    constructor(message, request, retryAfter) {
         super(message, AuthorizationPollingInterrupt.code);
         this.request = request;
+        this.retryAfter = retryAfter;
+    }
+    /**
+     * Returns the interval in seconds to wait until the next polling attempt.
+     */
+    nextRetryInterval() {
+        return this.retryAfter || this.request.interval;
     }
 }
 AuthorizationPollingInterrupt.code = "CIBA_AUTHORIZATION_POLLING_ERROR";
@@ -72,7 +85,7 @@ AuthorizationPollingInterrupt.code = "CIBA_AUTHORIZATION_POLLING_ERROR";
  */
 export class InvalidGrantInterrupt extends CIBAInterrupt {
     constructor(message, request) {
-        super(message, AuthorizationPollingInterrupt.code);
+        super(message, InvalidGrantInterrupt.code);
         this.request = request;
     }
 }

package/dist/esm/interrupts/CIBAInterrupts.js.map

@@ -1 +1 @@
-{"version":3,"file":"CIBAInterrupts.js","sourceRoot":"","sources":["../../../src/interrupts/CIBAInterrupts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAsB,MAAM,kBAAkB,CAAC;AAMtE;;GAEG;AACH,MAAM,OAAO,aAAc,SAAQ,cAAc;IAC/C,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,WAAW,CAEhB,SAAc;QAEd,OAAO,CACL,SAAS;YACT,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC;YACrC,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;YAClC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI;gBAC3B,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,SAAc;QAClC,OAAO,aAAa,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,SAAS,CAAC;IACxE,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,qBACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAF3B,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AANa,0BAAI,GAAW,oBAA6B,CAAC;AAS7D;;GAEG;AACH,MAAM,OAAO,yCAA0C,SAAQ,aAAa;IAG1E,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,yCAAyC,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;;AAJa,8CAAI,GAChB,4CAAqD,CAAC;AAM1D;;GAEG;AACH,MAAM,OAAO,oCACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,oCAAoC,CAAC,IAAI,CAAC,CAAC;QAF1C,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AANa,yCAAI,GAAW,oCAA6C,CAAC;AAS7E;;;GAGG;AACH,MAAM,OAAO,6BACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AANa,kCAAI,GAAW,4BAAqC,CAAC;AASrE;;GAEG;AACH,MAAM,OAAO,6BACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AANa,kCAAI,GAAW,kCAA2C,CAAC;AAS3E;;GAEG;AACH,MAAM,OAAO,qBACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AANa,0BAAI,GAAW,oBAA6B,CAAC","sourcesContent":["import { CIBAAuthorizationRequest } from \"../authorizers/ciba/CIBAAuthorizationRequest\";\nimport { Auth0Interrupt, Auth0InterruptData } from \"./Auth0Interrupt\";\n\nexport interface WithRequestData {\n  request: CIBAAuthorizationRequest;\n}\n\n/**\n * Base class for CIBA interrupts.\n */\nexport class CIBAInterrupt extends Auth0Interrupt {\n  constructor(message: string, code: string) {\n    super(message, code);\n  }\n\n  static isInterrupt<T extends abstract new (...args: any) => any>(\n    this: T & { code?: string },\n    interrupt: any\n  ): interrupt is Auth0InterruptData<InstanceType<T>> {\n    return (\n      interrupt &&\n      Auth0Interrupt.isInterrupt(interrupt) &&\n      typeof interrupt.code === \"string\" &&\n      (this.code === interrupt.code ||\n        (!this.code && interrupt.code.startsWith(\"CIBA_\")))\n    );\n  }\n\n  static hasRequestData(interrupt: any): interrupt is WithRequestData {\n    return CIBAInterrupt.isInterrupt(interrupt) && \"request\" in interrupt;\n  }\n}\n\n/**\n * An interrupt that is thrown when the user denies the authorization request.\n */\nexport class AccessDeniedInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_ACCESS_DENIED\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AccessDeniedInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the user does not have push notifications enabled.\n */\nexport class UserDoesNotHavePushNotificationsInterrupt extends CIBAInterrupt {\n  public static code: string =\n    \"CIBA_USER_DOES_NOT_HAVE_PUSH_NOTIFICATIONS\" as const;\n  constructor(message: string) {\n    super(message, UserDoesNotHavePushNotificationsInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization request has expired.\n */\nexport class AuthorizationRequestExpiredInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_REQUEST_EXPIRED\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationRequestExpiredInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization is still pending\n * and the Authorizer is in `mode: interrupt`.\n */\nexport class AuthorizationPendingInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_PENDING\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPendingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class AuthorizationPollingInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_POLLING_ERROR\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class InvalidGrantInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_INVALID_GRANT\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n}\n"]}
+{"version":3,"file":"CIBAInterrupts.js","sourceRoot":"","sources":["../../../src/interrupts/CIBAInterrupts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAsB,MAAM,kBAAkB,CAAC;AAMtE;;GAEG;AACH,MAAM,OAAO,aAAc,SAAQ,cAAc;IAC/C,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,WAAW,CAEhB,SAAc;QAEd,OAAO,CACL,SAAS;YACT,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC;YACrC,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;YAClC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI;gBAC3B,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,SAAc;QAClC,OAAO,aAAa,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,SAAS,CAAC;IACxE,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,qBACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAF3B,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AANa,0BAAI,GAAW,oBAA6B,CAAC;AAS7D;;GAEG;AACH,MAAM,OAAO,yCAA0C,SAAQ,aAAa;IAG1E,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,yCAAyC,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;;AAJa,8CAAI,GAChB,4CAAqD,CAAC;AAM1D;;GAEG;AACH,MAAM,OAAO,oCACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,oCAAoC,CAAC,IAAI,CAAC,CAAC;QAF1C,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AANa,yCAAI,GAAW,oCAA6C,CAAC;AAS7E;;;GAGG;AACH,MAAM,OAAO,6BACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAFnC,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;IAED;;OAEG;IACI,iBAAiB;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC/B,CAAC;;AAba,kCAAI,GAAW,4BAAqC,CAAC;AAgBrE;;GAEG;AACH,MAAM,OAAO,6BACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC,EACjC,UAAkB;QAElC,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAHnC,YAAO,GAAP,OAAO,CAA0B;QACjC,eAAU,GAAV,UAAU,CAAQ;IAGpC,CAAC;IAED;;OAEG;IACI,iBAAiB;QACtB,OAAO,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IAClD,CAAC;;AAda,kCAAI,GAAW,kCAA2C,CAAC;AAiB3E;;GAEG;AACH,MAAM,OAAO,qBACX,SAAQ,aAAa;IAIrB,YACE,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAF3B,YAAO,GAAP,OAAO,CAA0B;IAGnD,CAAC;;AANa,0BAAI,GAAW,oBAA6B,CAAC","sourcesContent":["import { CIBAAuthorizationRequest } from \"../authorizers/ciba/CIBAAuthorizationRequest\";\nimport { Auth0Interrupt, Auth0InterruptData } from \"./Auth0Interrupt\";\n\nexport interface WithRequestData {\n  request: CIBAAuthorizationRequest;\n}\n\n/**\n * Base class for CIBA interrupts.\n */\nexport class CIBAInterrupt extends Auth0Interrupt {\n  constructor(message: string, code: string) {\n    super(message, code);\n  }\n\n  static isInterrupt<T extends abstract new (...args: any) => any>(\n    this: T & { code?: string },\n    interrupt: any\n  ): interrupt is Auth0InterruptData<InstanceType<T>> {\n    return (\n      interrupt &&\n      Auth0Interrupt.isInterrupt(interrupt) &&\n      typeof interrupt.code === \"string\" &&\n      (this.code === interrupt.code ||\n        (!this.code && interrupt.code.startsWith(\"CIBA_\")))\n    );\n  }\n\n  static hasRequestData(interrupt: any): interrupt is WithRequestData {\n    return CIBAInterrupt.isInterrupt(interrupt) && \"request\" in interrupt;\n  }\n}\n\n/**\n * An interrupt that is thrown when the user denies the authorization request.\n */\nexport class AccessDeniedInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_ACCESS_DENIED\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AccessDeniedInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the user does not have push notifications enabled.\n */\nexport class UserDoesNotHavePushNotificationsInterrupt extends CIBAInterrupt {\n  public static code: string =\n    \"CIBA_USER_DOES_NOT_HAVE_PUSH_NOTIFICATIONS\" as const;\n  constructor(message: string) {\n    super(message, UserDoesNotHavePushNotificationsInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization request has expired.\n */\nexport class AuthorizationRequestExpiredInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_REQUEST_EXPIRED\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationRequestExpiredInterrupt.code);\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization is still pending\n * and the Authorizer is in `mode: interrupt`.\n */\nexport class AuthorizationPendingInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_PENDING\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, AuthorizationPendingInterrupt.code);\n  }\n\n  /**\n   * Returns the interval in seconds to wait until the next polling attempt.\n   */\n  public nextRetryInterval(): number {\n    return this.request.interval;\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class AuthorizationPollingInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_AUTHORIZATION_POLLING_ERROR\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest,\n    public readonly retryAfter: number\n  ) {\n    super(message, AuthorizationPollingInterrupt.code);\n  }\n\n  /**\n   * Returns the interval in seconds to wait until the next polling attempt.\n   */\n  public nextRetryInterval(): number {\n    return this.retryAfter || this.request.interval;\n  }\n}\n\n/**\n * An interrupt that is thrown when the authorization polling fails.\n */\nexport class InvalidGrantInterrupt\n  extends CIBAInterrupt\n  implements WithRequestData\n{\n  public static code: string = \"CIBA_INVALID_GRANT\" as const;\n  constructor(\n    message: string,\n    public readonly request: CIBAAuthorizationRequest\n  ) {\n    super(message, InvalidGrantInterrupt.code);\n  }\n}\n"]}

package/package.json

@@ -1,19 +1,20 @@
 {
   "name": "@auth0/ai",
-  "version": "3.5.0",
+  "version": "4.0.0",
   "description": "Auth0AI SDK for JavaScript",
   "types": "dist/esm/index.d.ts",
   "main": "dist/cjs/index.js",
   "module": "./dist/esm/index.js",
   "scripts": {
     "build": "npm run clean && npm run build:esm && npm run build:cjs",
-    "build:esm": "tsc --outDir ./dist/esm",
-    "build:cjs": "tsc --module nodenext --moduleResolution nodenext --declaration false --declarationMap false --outDir ./dist/cjs",
+    "build:esm": "tsc --project ./tsconfig.build.json --outDir ./dist/esm",
+    "build:cjs": "tsc --project ./tsconfig.build.json --module nodenext --moduleResolution nodenext --declaration false --declarationMap false --outDir ./dist/cjs",
     "build:watch": "run-p 'build:esm -- --watch' 'build:cjs -- -watch'",
     "clean": "rm -rf dist",
     "lint": "eslint \"./**/*.ts*\"",
     "type-check": "tsc --noEmit",
     "test": "vitest run",
+    "test:debug": "vitest --inspect-brk --no-file-parallelism run",
     "semantic-release": "npx --no semantic-release"
   },
   "author": {
@@ -79,12 +80,12 @@
   },
   "dependencies": {
     "@openfga/sdk": "^0.8.0",
-    "auth0": "^4.18.0",
+    "auth0": "^4.30.0",
     "jose": "^5.9.6",
     "openid-client": "^6.1.7",
     "stable-hash": "^0.0.5",
     "tempbox": "^1.1.1",
-    "zod": "^3.24.2"
+    "zod": "^3.25.76"
   },
   "publishConfig": {
     "access": "public"