@dudko.dev/agent-web 0.0.8 → 0.0.9

package/README.md

@@ -191,6 +191,55 @@ Browsers can only speak the **HTTP (StreamableHTTP)** transport — stdio MCP is
 Node-only. The connector lives in the `./mcp` subpath so the MCP SDK never
 enters your core bundle.
 
+`connectMcpHttp` returns `{ tools, catalog, results, refreshServer, close }`.
+`tools` and `catalog` are mutated **in place** by `refreshServer(name)`, so an
+agent built from them picks up a server's new tool list (react to it via the
+`onToolsChanged` option) without being rebuilt. Filtering is plain object work:
+delete the keys you don't want before merging.
+
+### OAuth 2.1 + Dynamic Client Registration
+
+A server behind OAuth needs more than a header: access tokens expire mid-run.
+Pass an `authProvider` and the MCP SDK discovers the authorization server
+(RFC 9728), registers this app dynamically (RFC 7591 — no client_id to
+pre-provision), runs PKCE, and **refreshes the access token on any 401 and
+retries the request**.
+
+```ts
+import { BrowserOAuthProvider, connectMcpHttp, finishMcpOAuth, readOAuthCallback }
+  from '@dudko.dev/agent-web/mcp'
+
+const provider = new BrowserOAuthProvider({
+  serverUrl: 'https://my-mcp-server.example/mcp',
+  redirectUrl: `${location.origin}/callback`, // must match on the way back
+})
+
+// 1. On the callback page: finish the flow before anything else.
+const callback = readOAuthCallback()
+if (callback) await finishMcpOAuth(provider, callback)
+
+// 2. Connect. `needsAuthorization` means "send the user to authorize".
+const mcp = await connectMcpHttp({ docs: { url: provider.serverUrl, authProvider: provider } })
+if (mcp.results[0]?.needsAuthorization) {
+  location.href = String(provider.authorizationUrl) // a button, a popup — your call
+}
+```
+
+Tokens, the dynamic registration and the PKCE verifier are stored in the same
+**encrypted IndexedDB vault** as provider API keys (`VaultOAuthStorage`; swap in
+`MemoryOAuthStorage` or your own via `storage`). `redirectToAuthorization` never
+navigates on its own — the SDK can demand authorization from inside a running
+tool call, and evicting the user then would discard the run. The URL is recorded
+on `provider.authorizationUrl` and the app decides when to use it.
+
+Two things to check on the **server** side, both invisible until they bite:
+
+- CORS must allow `Authorization` and expose `WWW-Authenticate` and
+  `mcp-session-id` (`Access-Control-Expose-Headers`). Without the first, the
+  browser cannot read the 401 challenge and discovery never starts.
+- The authorization server's `/register`, metadata and token endpoints must be
+  CORS-enabled too — a browser client calls them directly.
+
 ## Configuration (highlights)
 
 | Option | Default | Purpose |

package/dist/chunk-H7W6MBK2.js

@@ -0,0 +1,125 @@
+// src/storage/db.ts
+import { openDB } from "idb";
+var KEYS_STORE = "keys";
+var SECRETS_STORE = "secrets";
+var SESSIONS_STORE = "sessions";
+var cache = /* @__PURE__ */ new Map();
+var openAgentWebDB = (opts = {}) => {
+  const name = opts.dbName ?? "agent-web";
+  let p = cache.get(name);
+  if (!p) {
+    p = openDB(name, 1, {
+      upgrade(db) {
+        if (!db.objectStoreNames.contains(KEYS_STORE)) db.createObjectStore(KEYS_STORE);
+        if (!db.objectStoreNames.contains(SECRETS_STORE)) db.createObjectStore(SECRETS_STORE);
+        if (!db.objectStoreNames.contains(SESSIONS_STORE)) db.createObjectStore(SESSIONS_STORE);
+      }
+    });
+    cache.set(name, p);
+    p.catch(() => {
+      if (cache.get(name) === p) cache.delete(name);
+    });
+  }
+  return p;
+};
+
+// src/secrets/crypto.ts
+var KEY_ID = "vault-key-v1";
+var webcrypto = () => {
+  const c = globalThis.crypto;
+  if (!c?.subtle || !c.getRandomValues) {
+    throw new Error("WebCrypto (crypto.subtle) is unavailable in this environment");
+  }
+  return c;
+};
+var loadOrCreateKey = async (dbName) => {
+  const db = await openAgentWebDB({ dbName });
+  const existing = await db.get(KEYS_STORE, KEY_ID);
+  if (existing) return existing;
+  const key = await webcrypto().subtle.generateKey(
+    { name: "AES-GCM", length: 256 },
+    /* extractable */
+    false,
+    ["encrypt", "decrypt"]
+  );
+  const tx = db.transaction(KEYS_STORE, "readwrite");
+  const winner = await tx.store.get(KEY_ID);
+  if (winner) {
+    await tx.done;
+    return winner;
+  }
+  await tx.store.put(key, KEY_ID);
+  await tx.done;
+  return key;
+};
+var keyCache = /* @__PURE__ */ new Map();
+var getOrCreateVaultKey = (dbName) => {
+  const cacheKey = dbName ?? "agent-web";
+  let p = keyCache.get(cacheKey);
+  if (!p) {
+    p = loadOrCreateKey(dbName);
+    keyCache.set(cacheKey, p);
+    p.catch(() => {
+      if (keyCache.get(cacheKey) === p) keyCache.delete(cacheKey);
+    });
+  }
+  return p;
+};
+var textEncoder = new TextEncoder();
+var textDecoder = new TextDecoder();
+var encryptJSON = async (key, value) => {
+  const c = webcrypto();
+  const iv = c.getRandomValues(new Uint8Array(12));
+  const data = textEncoder.encode(JSON.stringify(value));
+  const ciphertext = await c.subtle.encrypt({ name: "AES-GCM", iv }, key, data);
+  return { iv, ciphertext };
+};
+var decryptJSON = async (key, blob) => {
+  const iv = new Uint8Array(blob.iv);
+  const plain = await webcrypto().subtle.decrypt({ name: "AES-GCM", iv }, key, blob.ciphertext);
+  return JSON.parse(textDecoder.decode(plain));
+};
+
+// src/secrets/vault.ts
+var IndexedDBVault = class {
+  dbName;
+  constructor(opts = {}) {
+    this.dbName = opts.dbName;
+  }
+  key() {
+    return getOrCreateVaultKey(this.dbName);
+  }
+  /** Encrypt and store a secret string under `id`. */
+  async setSecret(id, value) {
+    const blob = await encryptJSON(await this.key(), value);
+    const db = await openAgentWebDB({ dbName: this.dbName });
+    await db.put(SECRETS_STORE, blob, id);
+  }
+  /** Fetch and decrypt a secret, or undefined if absent. */
+  async getSecret(id) {
+    const db = await openAgentWebDB({ dbName: this.dbName });
+    const blob = await db.get(SECRETS_STORE, id);
+    if (!blob) return void 0;
+    return decryptJSON(await this.key(), blob);
+  }
+  async deleteSecret(id) {
+    const db = await openAgentWebDB({ dbName: this.dbName });
+    await db.delete(SECRETS_STORE, id);
+  }
+  async listSecretIds() {
+    const db = await openAgentWebDB({ dbName: this.dbName });
+    return (await db.getAllKeys(SECRETS_STORE)).map(String);
+  }
+};
+
+export {
+  KEYS_STORE,
+  SECRETS_STORE,
+  SESSIONS_STORE,
+  openAgentWebDB,
+  getOrCreateVaultKey,
+  encryptJSON,
+  decryptJSON,
+  IndexedDBVault
+};
+//# sourceMappingURL=chunk-H7W6MBK2.js.map

package/dist/chunk-H7W6MBK2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/storage/db.ts","../src/secrets/crypto.ts","../src/secrets/vault.ts"],"sourcesContent":["import { openDB, type IDBPDatabase } from 'idb'\n\nexport interface AgentWebDBOptions {\n  /** Database name (default 'agent-web'). Use a distinct name to isolate apps. */\n  dbName?: string\n}\n\nexport const KEYS_STORE = 'keys'\nexport const SECRETS_STORE = 'secrets'\nexport const SESSIONS_STORE = 'sessions'\n\nlet cache = new Map<string, Promise<IDBPDatabase>>()\n\n/**\n * The single owner of the IndexedDB database. Every persistent store — the\n * non-extractable crypto key, encrypted secrets, and session transcripts —\n * lives under ONE database name + version. Centralising `openDB` here prevents\n * the classic bug where two modules open the same DB name with different store\n * sets and the second call throws a VersionError.\n */\nexport const openAgentWebDB = (opts: AgentWebDBOptions = {}): Promise<IDBPDatabase> => {\n  const name = opts.dbName ?? 'agent-web'\n  let p = cache.get(name)\n  if (!p) {\n    p = openDB(name, 1, {\n      upgrade(db) {\n        if (!db.objectStoreNames.contains(KEYS_STORE)) db.createObjectStore(KEYS_STORE)\n        if (!db.objectStoreNames.contains(SECRETS_STORE)) db.createObjectStore(SECRETS_STORE)\n        if (!db.objectStoreNames.contains(SESSIONS_STORE)) db.createObjectStore(SESSIONS_STORE)\n      },\n    })\n    cache.set(name, p)\n    // A failed open (private mode, storage denied) must not stay cached, or\n    // every later call would replay the same rejection forever.\n    p.catch(() => {\n      if (cache.get(name) === p) cache.delete(name)\n    })\n  }\n  return p\n}\n\n/** Test hook: drop cached connections so a fresh (e.g. fake-indexeddb) DB is opened. */\nexport const _resetDBCache = (): void => {\n  cache = new Map()\n}\n","import { KEYS_STORE, openAgentWebDB } from '../storage/db.js'\n\nconst KEY_ID = 'vault-key-v1'\n\nconst webcrypto = (): Crypto => {\n  const c = (globalThis as { crypto?: Crypto }).crypto\n  if (!c?.subtle || !c.getRandomValues) {\n    throw new Error('WebCrypto (crypto.subtle) is unavailable in this environment')\n  }\n  return c\n}\n\nconst loadOrCreateKey = async (dbName?: string): Promise<CryptoKey> => {\n  const db = await openAgentWebDB({ dbName })\n  const existing = (await db.get(KEYS_STORE, KEY_ID)) as CryptoKey | undefined\n  if (existing) return existing\n  const key = await webcrypto().subtle.generateKey(\n    { name: 'AES-GCM', length: 256 },\n    /* extractable */ false,\n    ['encrypt', 'decrypt'],\n  )\n  // Double-check inside one readwrite transaction: another tab may have created\n  // a key while ours was generating. Losing that race and overwriting would\n  // leave the other tab's secrets permanently undecryptable.\n  const tx = db.transaction(KEYS_STORE, 'readwrite')\n  const winner = (await tx.store.get(KEY_ID)) as CryptoKey | undefined\n  if (winner) {\n    await tx.done\n    return winner\n  }\n  await tx.store.put(key, KEY_ID)\n  await tx.done\n  return key\n}\n\nconst keyCache = new Map<string, Promise<CryptoKey>>()\n\n/**\n * Fetch (or lazily create) the vault's AES-GCM key. The key is generated\n * NON-EXTRACTABLE and stored as a live `CryptoKey` in IndexedDB — a CryptoKey\n * is structured-cloneable, so it persists across reloads WITHOUT its raw bytes\n * ever being exposed to JavaScript. Not even in-page script can read it out; it\n * can only be used to encrypt / decrypt. That is what makes at-rest storage of\n * the secrets meaningful (see IndexedDBVault's threat model).\n *\n * Concurrent callers share one in-flight promise per DB, and creation is\n * double-checked in a single IDB transaction, so two racing writers can never\n * end up encrypting under different keys.\n */\nexport const getOrCreateVaultKey = (dbName?: string): Promise<CryptoKey> => {\n  const cacheKey = dbName ?? 'agent-web'\n  let p = keyCache.get(cacheKey)\n  if (!p) {\n    p = loadOrCreateKey(dbName)\n    keyCache.set(cacheKey, p)\n    p.catch(() => {\n      if (keyCache.get(cacheKey) === p) keyCache.delete(cacheKey)\n    })\n  }\n  return p\n}\n\nexport interface EncryptedBlob {\n  /** 96-bit random IV, fresh per write. */\n  iv: Uint8Array\n  ciphertext: ArrayBuffer\n}\n\nconst textEncoder = new TextEncoder()\nconst textDecoder = new TextDecoder()\n\n/** Encrypt a JSON-serialisable value with a fresh 96-bit IV (AES-GCM). */\nexport const encryptJSON = async (key: CryptoKey, value: unknown): Promise<EncryptedBlob> => {\n  const c = webcrypto()\n  const iv = c.getRandomValues(new Uint8Array(12))\n  const data = textEncoder.encode(JSON.stringify(value))\n  const ciphertext = await c.subtle.encrypt({ name: 'AES-GCM', iv }, key, data)\n  return { iv, ciphertext }\n}\n\n/** Decrypt a blob produced by encryptJSON. Throws if the key or blob don't match. */\nexport const decryptJSON = async <T = unknown>(key: CryptoKey, blob: EncryptedBlob): Promise<T> => {\n  // Copy the IV into a fresh ArrayBuffer-backed view: after a round-trip through\n  // IndexedDB its element buffer is typed as ArrayBufferLike, which no longer\n  // satisfies BufferSource under TS's stricter typed-array generics.\n  const iv = new Uint8Array(blob.iv)\n  const plain = await webcrypto().subtle.decrypt({ name: 'AES-GCM', iv }, key, blob.ciphertext)\n  return JSON.parse(textDecoder.decode(plain)) as T\n}\n","import { openAgentWebDB, SECRETS_STORE } from '../storage/db.js'\nimport { decryptJSON, encryptJSON, getOrCreateVaultKey, type EncryptedBlob } from './crypto.js'\n\nexport interface VaultOptions {\n  /** Database name, forwarded to the shared IDB owner (default 'agent-web'). */\n  dbName?: string\n}\n\n/**\n * Encrypted key/value secret store backed by IndexedDB. Values are encrypted at\n * rest with the non-extractable AES-GCM vault key (see crypto.ts).\n *\n * ── THREAT MODEL (read before shipping any app-owned key to a browser) ──\n * This vault PROTECTS secrets **at rest** — an IndexedDB / disk dump yields\n * only ciphertext — and against **casual DevTools inspection** — no plaintext\n * key is stored, and the AES key cannot be exported even by in-page script.\n *\n * It does **NOT** defend against **active XSS on your origin**: any script that\n * already runs on the page can call `getSecret()`, or use the live `CryptoKey`\n * to decrypt. Browser storage is not a secrets manager.\n *\n * Therefore this vault is for the **end user's OWN key on their OWN device**\n * (bring-your-own-key). A shared, app-owned key must NEVER reach the client —\n * put it behind a server proxy (`ProviderModelSpec.baseURL`) or the Vercel AI\n * Gateway instead.\n */\nexport class IndexedDBVault {\n  private readonly dbName?: string\n\n  constructor(opts: VaultOptions = {}) {\n    this.dbName = opts.dbName\n  }\n\n  private key(): Promise<CryptoKey> {\n    return getOrCreateVaultKey(this.dbName)\n  }\n\n  /** Encrypt and store a secret string under `id`. */\n  async setSecret(id: string, value: string): Promise<void> {\n    const blob = await encryptJSON(await this.key(), value)\n    const db = await openAgentWebDB({ dbName: this.dbName })\n    await db.put(SECRETS_STORE, blob, id)\n  }\n\n  /** Fetch and decrypt a secret, or undefined if absent. */\n  async getSecret(id: string): Promise<string | undefined> {\n    const db = await openAgentWebDB({ dbName: this.dbName })\n    const blob = (await db.get(SECRETS_STORE, id)) as EncryptedBlob | undefined\n    if (!blob) return undefined\n    return decryptJSON<string>(await this.key(), blob)\n  }\n\n  async deleteSecret(id: string): Promise<void> {\n    const db = await openAgentWebDB({ dbName: this.dbName })\n    await db.delete(SECRETS_STORE, id)\n  }\n\n  async listSecretIds(): Promise<string[]> {\n    const db = await openAgentWebDB({ dbName: this.dbName })\n    return (await db.getAllKeys(SECRETS_STORE)).map(String)\n  }\n}\n"],"mappings":";AAAA,SAAS,cAAiC;AAOnC,IAAM,aAAa;AACnB,IAAM,gBAAgB;AACtB,IAAM,iBAAiB;AAE9B,IAAI,QAAQ,oBAAI,IAAmC;AAS5C,IAAM,iBAAiB,CAAC,OAA0B,CAAC,MAA6B;AACrF,QAAM,OAAO,KAAK,UAAU;AAC5B,MAAI,IAAI,MAAM,IAAI,IAAI;AACtB,MAAI,CAAC,GAAG;AACN,QAAI,OAAO,MAAM,GAAG;AAAA,MAClB,QAAQ,IAAI;AACV,YAAI,CAAC,GAAG,iBAAiB,SAAS,UAAU,EAAG,IAAG,kBAAkB,UAAU;AAC9E,YAAI,CAAC,GAAG,iBAAiB,SAAS,aAAa,EAAG,IAAG,kBAAkB,aAAa;AACpF,YAAI,CAAC,GAAG,iBAAiB,SAAS,cAAc,EAAG,IAAG,kBAAkB,cAAc;AAAA,MACxF;AAAA,IACF,CAAC;AACD,UAAM,IAAI,MAAM,CAAC;AAGjB,MAAE,MAAM,MAAM;AACZ,UAAI,MAAM,IAAI,IAAI,MAAM,EAAG,OAAM,OAAO,IAAI;AAAA,IAC9C,CAAC;AAAA,EACH;AACA,SAAO;AACT;;;ACrCA,IAAM,SAAS;AAEf,IAAM,YAAY,MAAc;AAC9B,QAAM,IAAK,WAAmC;AAC9C,MAAI,CAAC,GAAG,UAAU,CAAC,EAAE,iBAAiB;AACpC,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,SAAO;AACT;AAEA,IAAM,kBAAkB,OAAO,WAAwC;AACrE,QAAM,KAAK,MAAM,eAAe,EAAE,OAAO,CAAC;AAC1C,QAAM,WAAY,MAAM,GAAG,IAAI,YAAY,MAAM;AACjD,MAAI,SAAU,QAAO;AACrB,QAAM,MAAM,MAAM,UAAU,EAAE,OAAO;AAAA,IACnC,EAAE,MAAM,WAAW,QAAQ,IAAI;AAAA;AAAA,IACb;AAAA,IAClB,CAAC,WAAW,SAAS;AAAA,EACvB;AAIA,QAAM,KAAK,GAAG,YAAY,YAAY,WAAW;AACjD,QAAM,SAAU,MAAM,GAAG,MAAM,IAAI,MAAM;AACzC,MAAI,QAAQ;AACV,UAAM,GAAG;AACT,WAAO;AAAA,EACT;AACA,QAAM,GAAG,MAAM,IAAI,KAAK,MAAM;AAC9B,QAAM,GAAG;AACT,SAAO;AACT;AAEA,IAAM,WAAW,oBAAI,IAAgC;AAc9C,IAAM,sBAAsB,CAAC,WAAwC;AAC1E,QAAM,WAAW,UAAU;AAC3B,MAAI,IAAI,SAAS,IAAI,QAAQ;AAC7B,MAAI,CAAC,GAAG;AACN,QAAI,gBAAgB,MAAM;AAC1B,aAAS,IAAI,UAAU,CAAC;AACxB,MAAE,MAAM,MAAM;AACZ,UAAI,SAAS,IAAI,QAAQ,MAAM,EAAG,UAAS,OAAO,QAAQ;AAAA,IAC5D,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAQA,IAAM,cAAc,IAAI,YAAY;AACpC,IAAM,cAAc,IAAI,YAAY;AAG7B,IAAM,cAAc,OAAO,KAAgB,UAA2C;AAC3F,QAAM,IAAI,UAAU;AACpB,QAAM,KAAK,EAAE,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAC/C,QAAM,OAAO,YAAY,OAAO,KAAK,UAAU,KAAK,CAAC;AACrD,QAAM,aAAa,MAAM,EAAE,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,KAAK,IAAI;AAC5E,SAAO,EAAE,IAAI,WAAW;AAC1B;AAGO,IAAM,cAAc,OAAoB,KAAgB,SAAoC;AAIjG,QAAM,KAAK,IAAI,WAAW,KAAK,EAAE;AACjC,QAAM,QAAQ,MAAM,UAAU,EAAE,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,KAAK,KAAK,UAAU;AAC5F,SAAO,KAAK,MAAM,YAAY,OAAO,KAAK,CAAC;AAC7C;;;AC9DO,IAAM,iBAAN,MAAqB;AAAA,EACT;AAAA,EAEjB,YAAY,OAAqB,CAAC,GAAG;AACnC,SAAK,SAAS,KAAK;AAAA,EACrB;AAAA,EAEQ,MAA0B;AAChC,WAAO,oBAAoB,KAAK,MAAM;AAAA,EACxC;AAAA;AAAA,EAGA,MAAM,UAAU,IAAY,OAA8B;AACxD,UAAM,OAAO,MAAM,YAAY,MAAM,KAAK,IAAI,GAAG,KAAK;AACtD,UAAM,KAAK,MAAM,eAAe,EAAE,QAAQ,KAAK,OAAO,CAAC;AACvD,UAAM,GAAG,IAAI,eAAe,MAAM,EAAE;AAAA,EACtC;AAAA;AAAA,EAGA,MAAM,UAAU,IAAyC;AACvD,UAAM,KAAK,MAAM,eAAe,EAAE,QAAQ,KAAK,OAAO,CAAC;AACvD,UAAM,OAAQ,MAAM,GAAG,IAAI,eAAe,EAAE;AAC5C,QAAI,CAAC,KAAM,QAAO;AAClB,WAAO,YAAoB,MAAM,KAAK,IAAI,GAAG,IAAI;AAAA,EACnD;AAAA,EAEA,MAAM,aAAa,IAA2B;AAC5C,UAAM,KAAK,MAAM,eAAe,EAAE,QAAQ,KAAK,OAAO,CAAC;AACvD,UAAM,GAAG,OAAO,eAAe,EAAE;AAAA,EACnC;AAAA,EAEA,MAAM,gBAAmC;AACvC,UAAM,KAAK,MAAM,eAAe,EAAE,QAAQ,KAAK,OAAO,CAAC;AACvD,YAAQ,MAAM,GAAG,WAAW,aAAa,GAAG,IAAI,MAAM;AAAA,EACxD;AACF;","names":[]}

package/dist/index.d.cts

@@ -1,5 +1,7 @@
 import * as ai from 'ai';
 import { LanguageModel, ToolSet, Tool, ModelMessage, generateText, streamText } from 'ai';
+import { V as VaultOptions } from './vault-BHlMmKXM.cjs';
+export { I as IndexedDBVault } from './vault-BHlMmKXM.cjs';
 import { z, ZodType } from 'zod';
 import { IDBPDatabase } from 'idb';
 
@@ -199,40 +201,6 @@ declare const defaultPrompts: Prompts;
 /** Prepend a host-supplied systemPrompt to a phase system prompt, if present. */
 declare const withSystem: (base: string, extra?: string) => string;
 
-interface VaultOptions {
-    /** Database name, forwarded to the shared IDB owner (default 'agent-web'). */
-    dbName?: string;
-}
-/**
- * Encrypted key/value secret store backed by IndexedDB. Values are encrypted at
- * rest with the non-extractable AES-GCM vault key (see crypto.ts).
- *
- * ── THREAT MODEL (read before shipping any app-owned key to a browser) ──
- * This vault PROTECTS secrets **at rest** — an IndexedDB / disk dump yields
- * only ciphertext — and against **casual DevTools inspection** — no plaintext
- * key is stored, and the AES key cannot be exported even by in-page script.
- *
- * It does **NOT** defend against **active XSS on your origin**: any script that
- * already runs on the page can call `getSecret()`, or use the live `CryptoKey`
- * to decrypt. Browser storage is not a secrets manager.
- *
- * Therefore this vault is for the **end user's OWN key on their OWN device**
- * (bring-your-own-key). A shared, app-owned key must NEVER reach the client —
- * put it behind a server proxy (`ProviderModelSpec.baseURL`) or the Vercel AI
- * Gateway instead.
- */
-declare class IndexedDBVault {
-    private readonly dbName?;
-    constructor(opts?: VaultOptions);
-    private key;
-    /** Encrypt and store a secret string under `id`. */
-    setSecret(id: string, value: string): Promise<void>;
-    /** Fetch and decrypt a secret, or undefined if absent. */
-    getSecret(id: string): Promise<string | undefined>;
-    deleteSecret(id: string): Promise<void>;
-    listSecretIds(): Promise<string[]>;
-}
-
 /**
  * The seam the provider registry uses to fetch API keys at model-build time.
  * Swap in any backend: the encrypted vault (default), an in-memory map (tests /
@@ -959,4 +927,4 @@ interface CompressOptions {
  */
 declare const compressHistory: (messages: StoredMessage[], model: LanguageModel, opts?: CompressOptions) => Promise<StoredMessage[]>;
 
-export { type Agent, type AgentContext, type AgentEvent, type AgentEventHandler, type AgentLogger, type AgentLoggerSink, type AgentTool, type AgentToolSet, type AgentWebDBOptions, type BrowserAgentConfig, type CompressOptions, type ContextStore, type CredentialStore, type EncryptedBlob, type ExecutorPromptContext, type ExecutorResult, type GenerateOptions, type IPlan, type IPlanStep, type IStepResult, type IToolCall, type IUsage, IndexedDBStore, type IndexedDBStoreOptions, IndexedDBVault, KEYS_STORE, type LogLevel, MemoryCredentialStore, MemoryStore, type ModelInput, type Phase, type PhaseBudgets, PlanSchema, type PlanShape, PlanStepSchema, type PlannerPromptContext, type PlannerResult, type PromptParts, type Prompts, type ProviderModelSpec, type ProviderType, type RawAction, type ReplanDecision, type ReplanMode, ReplanSchema, type ReplanShape, type ReplanTrigger, type ReplannerPromptContext, type ReplannerResult, type ResolvedConfig, type ResolvedStage, type RunOptions, type RunResult, SECRETS_STORE, SESSIONS_STORE, type StageInput, type StageOverride, type StoredMessage, type SynthesizerPromptContext, type ToolCallMode, type ToolLoopCallbacks, type ToolLoopOptions, type ToolLoopResult, type ToolMode, type ToolSelectionStrategy, VaultCredentialStore, type VaultOptions, type WebLLMModelOptions, buildModelFromStage, compressHistory, createAgent, createLogger, createPlan, createWebLLMModel, decideReplan, decryptJSON, defaultPrompts, defineTool, directBrowserOk, dispatch, encryptJSON, executeStep, generate, generateStructured, getOrCreateVaultKey, isDirectModel, isProviderSpec, isWebGPUAvailable, looksLikeJson, normalizeSteps, normalizeUsage, openAgentWebDB, parseExecutorResponse, parsePlainText, parsePlannerResponse, parseReplannerResponse, preloadWebLLMModel, promptHintOf, renderCatalog, replanWanted, resolveConfig, resolveModel, resolveStage, runToolLoop, selectToolMode, shouldReplan, splitBlocker, stream, supportsNativeTools, supportsStructuredOutput, synthesizeAnswer, unloadWebLLMModel, withSystem };
+export { type Agent, type AgentContext, type AgentEvent, type AgentEventHandler, type AgentLogger, type AgentLoggerSink, type AgentTool, type AgentToolSet, type AgentWebDBOptions, type BrowserAgentConfig, type CompressOptions, type ContextStore, type CredentialStore, type EncryptedBlob, type ExecutorPromptContext, type ExecutorResult, type GenerateOptions, type IPlan, type IPlanStep, type IStepResult, type IToolCall, type IUsage, IndexedDBStore, type IndexedDBStoreOptions, KEYS_STORE, type LogLevel, MemoryCredentialStore, MemoryStore, type ModelInput, type Phase, type PhaseBudgets, PlanSchema, type PlanShape, PlanStepSchema, type PlannerPromptContext, type PlannerResult, type PromptParts, type Prompts, type ProviderModelSpec, type ProviderType, type RawAction, type ReplanDecision, type ReplanMode, ReplanSchema, type ReplanShape, type ReplanTrigger, type ReplannerPromptContext, type ReplannerResult, type ResolvedConfig, type ResolvedStage, type RunOptions, type RunResult, SECRETS_STORE, SESSIONS_STORE, type StageInput, type StageOverride, type StoredMessage, type SynthesizerPromptContext, type ToolCallMode, type ToolLoopCallbacks, type ToolLoopOptions, type ToolLoopResult, type ToolMode, type ToolSelectionStrategy, VaultCredentialStore, VaultOptions, type WebLLMModelOptions, buildModelFromStage, compressHistory, createAgent, createLogger, createPlan, createWebLLMModel, decideReplan, decryptJSON, defaultPrompts, defineTool, directBrowserOk, dispatch, encryptJSON, executeStep, generate, generateStructured, getOrCreateVaultKey, isDirectModel, isProviderSpec, isWebGPUAvailable, looksLikeJson, normalizeSteps, normalizeUsage, openAgentWebDB, parseExecutorResponse, parsePlainText, parsePlannerResponse, parseReplannerResponse, preloadWebLLMModel, promptHintOf, renderCatalog, replanWanted, resolveConfig, resolveModel, resolveStage, runToolLoop, selectToolMode, shouldReplan, splitBlocker, stream, supportsNativeTools, supportsStructuredOutput, synthesizeAnswer, unloadWebLLMModel, withSystem };

package/dist/index.d.ts

@@ -1,5 +1,7 @@
 import * as ai from 'ai';
 import { LanguageModel, ToolSet, Tool, ModelMessage, generateText, streamText } from 'ai';
+import { V as VaultOptions } from './vault-BHlMmKXM.js';
+export { I as IndexedDBVault } from './vault-BHlMmKXM.js';
 import { z, ZodType } from 'zod';
 import { IDBPDatabase } from 'idb';
 
@@ -199,40 +201,6 @@ declare const defaultPrompts: Prompts;
 /** Prepend a host-supplied systemPrompt to a phase system prompt, if present. */
 declare const withSystem: (base: string, extra?: string) => string;
 
-interface VaultOptions {
-    /** Database name, forwarded to the shared IDB owner (default 'agent-web'). */
-    dbName?: string;
-}
-/**
- * Encrypted key/value secret store backed by IndexedDB. Values are encrypted at
- * rest with the non-extractable AES-GCM vault key (see crypto.ts).
- *
- * ── THREAT MODEL (read before shipping any app-owned key to a browser) ──
- * This vault PROTECTS secrets **at rest** — an IndexedDB / disk dump yields
- * only ciphertext — and against **casual DevTools inspection** — no plaintext
- * key is stored, and the AES key cannot be exported even by in-page script.
- *
- * It does **NOT** defend against **active XSS on your origin**: any script that
- * already runs on the page can call `getSecret()`, or use the live `CryptoKey`
- * to decrypt. Browser storage is not a secrets manager.
- *
- * Therefore this vault is for the **end user's OWN key on their OWN device**
- * (bring-your-own-key). A shared, app-owned key must NEVER reach the client —
- * put it behind a server proxy (`ProviderModelSpec.baseURL`) or the Vercel AI
- * Gateway instead.
- */
-declare class IndexedDBVault {
-    private readonly dbName?;
-    constructor(opts?: VaultOptions);
-    private key;
-    /** Encrypt and store a secret string under `id`. */
-    setSecret(id: string, value: string): Promise<void>;
-    /** Fetch and decrypt a secret, or undefined if absent. */
-    getSecret(id: string): Promise<string | undefined>;
-    deleteSecret(id: string): Promise<void>;
-    listSecretIds(): Promise<string[]>;
-}
-
 /**
  * The seam the provider registry uses to fetch API keys at model-build time.
  * Swap in any backend: the encrypted vault (default), an in-memory map (tests /
@@ -959,4 +927,4 @@ interface CompressOptions {
  */
 declare const compressHistory: (messages: StoredMessage[], model: LanguageModel, opts?: CompressOptions) => Promise<StoredMessage[]>;
 
-export { type Agent, type AgentContext, type AgentEvent, type AgentEventHandler, type AgentLogger, type AgentLoggerSink, type AgentTool, type AgentToolSet, type AgentWebDBOptions, type BrowserAgentConfig, type CompressOptions, type ContextStore, type CredentialStore, type EncryptedBlob, type ExecutorPromptContext, type ExecutorResult, type GenerateOptions, type IPlan, type IPlanStep, type IStepResult, type IToolCall, type IUsage, IndexedDBStore, type IndexedDBStoreOptions, IndexedDBVault, KEYS_STORE, type LogLevel, MemoryCredentialStore, MemoryStore, type ModelInput, type Phase, type PhaseBudgets, PlanSchema, type PlanShape, PlanStepSchema, type PlannerPromptContext, type PlannerResult, type PromptParts, type Prompts, type ProviderModelSpec, type ProviderType, type RawAction, type ReplanDecision, type ReplanMode, ReplanSchema, type ReplanShape, type ReplanTrigger, type ReplannerPromptContext, type ReplannerResult, type ResolvedConfig, type ResolvedStage, type RunOptions, type RunResult, SECRETS_STORE, SESSIONS_STORE, type StageInput, type StageOverride, type StoredMessage, type SynthesizerPromptContext, type ToolCallMode, type ToolLoopCallbacks, type ToolLoopOptions, type ToolLoopResult, type ToolMode, type ToolSelectionStrategy, VaultCredentialStore, type VaultOptions, type WebLLMModelOptions, buildModelFromStage, compressHistory, createAgent, createLogger, createPlan, createWebLLMModel, decideReplan, decryptJSON, defaultPrompts, defineTool, directBrowserOk, dispatch, encryptJSON, executeStep, generate, generateStructured, getOrCreateVaultKey, isDirectModel, isProviderSpec, isWebGPUAvailable, looksLikeJson, normalizeSteps, normalizeUsage, openAgentWebDB, parseExecutorResponse, parsePlainText, parsePlannerResponse, parseReplannerResponse, preloadWebLLMModel, promptHintOf, renderCatalog, replanWanted, resolveConfig, resolveModel, resolveStage, runToolLoop, selectToolMode, shouldReplan, splitBlocker, stream, supportsNativeTools, supportsStructuredOutput, synthesizeAnswer, unloadWebLLMModel, withSystem };
+export { type Agent, type AgentContext, type AgentEvent, type AgentEventHandler, type AgentLogger, type AgentLoggerSink, type AgentTool, type AgentToolSet, type AgentWebDBOptions, type BrowserAgentConfig, type CompressOptions, type ContextStore, type CredentialStore, type EncryptedBlob, type ExecutorPromptContext, type ExecutorResult, type GenerateOptions, type IPlan, type IPlanStep, type IStepResult, type IToolCall, type IUsage, IndexedDBStore, type IndexedDBStoreOptions, KEYS_STORE, type LogLevel, MemoryCredentialStore, MemoryStore, type ModelInput, type Phase, type PhaseBudgets, PlanSchema, type PlanShape, PlanStepSchema, type PlannerPromptContext, type PlannerResult, type PromptParts, type Prompts, type ProviderModelSpec, type ProviderType, type RawAction, type ReplanDecision, type ReplanMode, ReplanSchema, type ReplanShape, type ReplanTrigger, type ReplannerPromptContext, type ReplannerResult, type ResolvedConfig, type ResolvedStage, type RunOptions, type RunResult, SECRETS_STORE, SESSIONS_STORE, type StageInput, type StageOverride, type StoredMessage, type SynthesizerPromptContext, type ToolCallMode, type ToolLoopCallbacks, type ToolLoopOptions, type ToolLoopResult, type ToolMode, type ToolSelectionStrategy, VaultCredentialStore, VaultOptions, type WebLLMModelOptions, buildModelFromStage, compressHistory, createAgent, createLogger, createPlan, createWebLLMModel, decideReplan, decryptJSON, defaultPrompts, defineTool, directBrowserOk, dispatch, encryptJSON, executeStep, generate, generateStructured, getOrCreateVaultKey, isDirectModel, isProviderSpec, isWebGPUAvailable, looksLikeJson, normalizeSteps, normalizeUsage, openAgentWebDB, parseExecutorResponse, parsePlainText, parsePlannerResponse, parseReplannerResponse, preloadWebLLMModel, promptHintOf, renderCatalog, replanWanted, resolveConfig, resolveModel, resolveStage, runToolLoop, selectToolMode, shouldReplan, splitBlocker, stream, supportsNativeTools, supportsStructuredOutput, synthesizeAnswer, unloadWebLLMModel, withSystem };

package/dist/index.js

@@ -1,3 +1,13 @@
+import {
+  IndexedDBVault,
+  KEYS_STORE,
+  SECRETS_STORE,
+  SESSIONS_STORE,
+  decryptJSON,
+  encryptJSON,
+  getOrCreateVaultKey,
+  openAgentWebDB
+} from "./chunk-H7W6MBK2.js";
 import {
   createWebLLMModel,
   isWebGPUAvailable,
@@ -1281,120 +1291,6 @@ var supportsNativeTools = (p) => CLOUD.has(p);
 var supportsStructuredOutput = (p) => CLOUD.has(p);
 var directBrowserOk = (p) => p === "google" || p === "gateway" || p === "openai-compatible" || p === "anthropic";
 
-// src/storage/db.ts
-import { openDB } from "idb";
-var KEYS_STORE = "keys";
-var SECRETS_STORE = "secrets";
-var SESSIONS_STORE = "sessions";
-var cache = /* @__PURE__ */ new Map();
-var openAgentWebDB = (opts = {}) => {
-  const name = opts.dbName ?? "agent-web";
-  let p = cache.get(name);
-  if (!p) {
-    p = openDB(name, 1, {
-      upgrade(db) {
-        if (!db.objectStoreNames.contains(KEYS_STORE)) db.createObjectStore(KEYS_STORE);
-        if (!db.objectStoreNames.contains(SECRETS_STORE)) db.createObjectStore(SECRETS_STORE);
-        if (!db.objectStoreNames.contains(SESSIONS_STORE)) db.createObjectStore(SESSIONS_STORE);
-      }
-    });
-    cache.set(name, p);
-    p.catch(() => {
-      if (cache.get(name) === p) cache.delete(name);
-    });
-  }
-  return p;
-};
-
-// src/secrets/crypto.ts
-var KEY_ID = "vault-key-v1";
-var webcrypto = () => {
-  const c = globalThis.crypto;
-  if (!c?.subtle || !c.getRandomValues) {
-    throw new Error("WebCrypto (crypto.subtle) is unavailable in this environment");
-  }
-  return c;
-};
-var loadOrCreateKey = async (dbName) => {
-  const db = await openAgentWebDB({ dbName });
-  const existing = await db.get(KEYS_STORE, KEY_ID);
-  if (existing) return existing;
-  const key = await webcrypto().subtle.generateKey(
-    { name: "AES-GCM", length: 256 },
-    /* extractable */
-    false,
-    ["encrypt", "decrypt"]
-  );
-  const tx = db.transaction(KEYS_STORE, "readwrite");
-  const winner = await tx.store.get(KEY_ID);
-  if (winner) {
-    await tx.done;
-    return winner;
-  }
-  await tx.store.put(key, KEY_ID);
-  await tx.done;
-  return key;
-};
-var keyCache = /* @__PURE__ */ new Map();
-var getOrCreateVaultKey = (dbName) => {
-  const cacheKey = dbName ?? "agent-web";
-  let p = keyCache.get(cacheKey);
-  if (!p) {
-    p = loadOrCreateKey(dbName);
-    keyCache.set(cacheKey, p);
-    p.catch(() => {
-      if (keyCache.get(cacheKey) === p) keyCache.delete(cacheKey);
-    });
-  }
-  return p;
-};
-var textEncoder = new TextEncoder();
-var textDecoder = new TextDecoder();
-var encryptJSON = async (key, value) => {
-  const c = webcrypto();
-  const iv = c.getRandomValues(new Uint8Array(12));
-  const data = textEncoder.encode(JSON.stringify(value));
-  const ciphertext = await c.subtle.encrypt({ name: "AES-GCM", iv }, key, data);
-  return { iv, ciphertext };
-};
-var decryptJSON = async (key, blob) => {
-  const iv = new Uint8Array(blob.iv);
-  const plain = await webcrypto().subtle.decrypt({ name: "AES-GCM", iv }, key, blob.ciphertext);
-  return JSON.parse(textDecoder.decode(plain));
-};
-
-// src/secrets/vault.ts
-var IndexedDBVault = class {
-  dbName;
-  constructor(opts = {}) {
-    this.dbName = opts.dbName;
-  }
-  key() {
-    return getOrCreateVaultKey(this.dbName);
-  }
-  /** Encrypt and store a secret string under `id`. */
-  async setSecret(id, value) {
-    const blob = await encryptJSON(await this.key(), value);
-    const db = await openAgentWebDB({ dbName: this.dbName });
-    await db.put(SECRETS_STORE, blob, id);
-  }
-  /** Fetch and decrypt a secret, or undefined if absent. */
-  async getSecret(id) {
-    const db = await openAgentWebDB({ dbName: this.dbName });
-    const blob = await db.get(SECRETS_STORE, id);
-    if (!blob) return void 0;
-    return decryptJSON(await this.key(), blob);
-  }
-  async deleteSecret(id) {
-    const db = await openAgentWebDB({ dbName: this.dbName });
-    await db.delete(SECRETS_STORE, id);
-  }
-  async listSecretIds() {
-    const db = await openAgentWebDB({ dbName: this.dbName });
-    return (await db.getAllKeys(SECRETS_STORE)).map(String);
-  }
-};
-
 // src/secrets/store.ts
 var VaultCredentialStore = class {
   vault;