@economic/agents 2.7.2 → 2.8.1

package/README.md

@@ -501,6 +501,7 @@ export class SupportAgent extends Agent {
         userGuid: payload.user_guid as string,
         agreementNumber: payload.agreement_number as number,
       }),
+      getActorId: (claims) => `${claims.agreementNumber}_${claims.userGuid}`,
     };
   }
 
@@ -508,6 +509,11 @@ export class SupportAgent extends Agent {
 }
 ```
 
+`getActorId` derives the authenticated actor from verified claims. It must exactly match the
+actor that owns the requested Durable Object: the Assistant name, the root parent of a chat
+facet, or the prefix in a standalone `${actorId}:${chatId}` name. A valid token belonging to
+another actor is rejected with `4003` before the connection is established.
+
 On failure the socket closes (`4001` unauthorized, `4003` forbidden) and status becomes `"unauthorized"`. The token is read from `Authorization: Bearer …`, then the `Sec-WebSocket-Protocol: bearer, <token>` header.
 
 ### User context
@@ -585,18 +591,18 @@ Imported from `@economic/agents` unless noted.
 
 ### Members
 
-| Member                                         | On          | Description                                 |
-| ---------------------------------------------- | ----------- | ------------------------------------------- |
-| `getModel(ctx?)`                               | `Agent`     | Required. Model for inference.              |
-| `getSystemPrompt(ctx?)`                        | `Agent`     | Required. System prompt.                    |
-| `getTools()`                                   | `Agent`     | Always-on tools (default `{}`).             |
-| `getSkills()`                                  | `Agent`     | Local skills (default `[]`).                |
-| `static getJwtAuthConfig(env)`                 | `Agent`     | Optional JWT verification config.           |
-| `getUserContext(jwtToken)`                     | `Agent`     | Optional per-user context after auth.       |
-| `submitMessageFeedback` / `getMessageFeedback` | `ChatAgent` | Callable message feedback.                  |
-| `agent`                                        | `Assistant` | Required. Your `ChatAgent` subclass.        |
-| `fastModel`                                    | `Assistant` | Required. Cheap model for titles/summaries. |
-| `createChat` / `getChats` / `deleteChat`       | `Assistant` | Callable chat management.                   |
+| Member                                         | On          | Description                                  |
+| ---------------------------------------------- | ----------- | -------------------------------------------- |
+| `getModel(ctx?)`                               | `Agent`     | Required. Model for inference.               |
+| `getSystemPrompt(ctx?)`                        | `Agent`     | Required. System prompt.                     |
+| `getTools()`                                   | `Agent`     | Always-on tools (default `{}`).              |
+| `getSkills()`                                  | `Agent`     | Local skills (default `[]`).                 |
+| `static getJwtAuthConfig(env)`                 | `Agent`     | Optional JWT verification and actor binding. |
+| `getUserContext(jwtToken)`                     | `Agent`     | Optional per-user context after auth.        |
+| `submitMessageFeedback` / `getMessageFeedback` | `ChatAgent` | Callable message feedback.                   |
+| `agent`                                        | `Assistant` | Required. Your `ChatAgent` subclass.         |
+| `fastModel`                                    | `Assistant` | Required. Cheap model for titles/summaries.  |
+| `createChat` / `getChats` / `deleteChat`       | `Assistant` | Callable chat management.                    |
 
 ### Package root (`@economic/agents`)
 

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { n as JwtAuthConfig, t as routeAgentRequest } from "./route-agent-request-D2ll--nF.mjs";
+import { n as JwtAuthConfig, t as routeAgentRequest } from "./route-agent-request-DLlW8kZo.mjs";
 import { Agent as Agent$1, Connection, ConnectionContext, SubAgentClass } from "agents";
 import { ChatResponseResult, PrepareStepContext, Session, Think, ToolCallContext, ToolCallDecision, TurnConfig, TurnContext, skills } from "@cloudflare/think";
 import { JSONValue, LanguageModel, ModelMessage, Tool as Tool$1, UIMessage } from "ai";

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { a as verifyJwt, i as extractTokenFromConnectRequest, n as createAgentTracer, r as recordFeedbackAnalytics, t as routeAgentRequest } from "./route-agent-request-DBGSXu2O.mjs";
+import { a as isJwtActorAuthorized, i as extractTokenFromConnectRequest, n as createAgentTracer, o as verifyJwt, r as recordFeedbackAnalytics, t as routeAgentRequest } from "./route-agent-request-CYclS_5Q.mjs";
 import { Agent as Agent$1, callable, getCurrentAgent } from "agents";
 import { Think, skills } from "@cloudflare/think";
 import { Output, convertToModelMessages, generateText, jsonSchema, pruneMessages, tool as tool$1 } from "ai";
@@ -359,6 +359,15 @@ var Agent = class extends Think {
 					connection.close(result.status === 401 ? 4001 : 4003, result.message);
 					return;
 				}
+				if (!isJwtActorAuthorized(config, result.claims, {
+					durableObjectName: this.name,
+					parentPath: this.parentPath
+				})) {
+					sendConnectionStatus(connection, "unauthorized");
+					console.error("[Agent] JWT actor does not match the requested agent");
+					connection.close(4003, "Forbidden");
+					return;
+				}
 				const token = extractTokenFromConnectRequest(ctx.request);
 				let effectiveToken = token;
 				const getTokenExchangeConfig = this.constructor.getTokenExchangeConfig;
@@ -1042,6 +1051,15 @@ var Assistant = class extends Agent$1 {
 					connection.close(result.status === 401 ? 4001 : 4003, result.message);
 					return;
 				}
+				if (!isJwtActorAuthorized(config, result.claims, {
+					durableObjectName: this.name,
+					parentPath: this.parentPath
+				})) {
+					sendConnectionStatus(connection, "unauthorized");
+					console.error("[Assistant] JWT actor does not match the requested assistant");
+					connection.close(4003, "Forbidden");
+					return;
+				}
 			}
 		}
 		sendConnectionStatus(connection, "connected");

package/dist/{route-agent-request-DBGSXu2O.mjs → route-agent-request-CYclS_5Q.mjs}

@@ -3,6 +3,18 @@ import { createRemoteJWKSet, decodeJwt, errors, jwtVerify } from "jose";
 import { BasicTracerProvider, SimpleSpanProcessor } from "@opentelemetry/sdk-trace-base";
 //#region src/server/features/auth/index.ts
 const jwksByIssuer = /* @__PURE__ */ new Map();
+/** Returns the actor portion of a top-level or parent-scoped agent name. */
+function getTargetActorId(target) {
+	const rootName = target.parentPath?.[0]?.name ?? target.durableObjectName;
+	const separator = rootName.indexOf(":");
+	return separator === -1 ? rootName : rootName.slice(0, separator);
+}
+/** Checks that verified JWT claims belong to the addressed agent instance. */
+function isJwtActorAuthorized(config, claims, target) {
+	if (typeof config.getActorId !== "function") return false;
+	const authenticatedActorId = config.getActorId(claims);
+	return typeof authenticatedActorId === "string" && authenticatedActorId.length > 0 && authenticatedActorId === getTargetActorId(target);
+}
 function getJwksForIssuer(issuer) {
 	const normalized = issuer.replace(/\/$/, "");
 	let jwks = jwksByIssuer.get(normalized);
@@ -465,4 +477,4 @@ async function routeAgentRequest$1(request, env, options) {
 	return response;
 }
 //#endregion
-export { verifyJwt as a, extractTokenFromConnectRequest as i, createAgentTracer as n, recordFeedbackAnalytics as r, routeAgentRequest$1 as t };
+export { isJwtActorAuthorized as a, extractTokenFromConnectRequest as i, createAgentTracer as n, verifyJwt as o, recordFeedbackAnalytics as r, routeAgentRequest$1 as t };

package/dist/{route-agent-request-D2ll--nF.d.mts → route-agent-request-DLlW8kZo.d.mts}

@@ -13,6 +13,8 @@ interface JwtAuthConfig<TClaims extends Record<string, unknown> = Record<string,
    * These will be stored and made available in the agent's tool context.
    */
   getClaims: (payload: Record<string, unknown>) => TClaims;
+  /** Derive the actor ID represented by the verified claims. */
+  getActorId(claims: TClaims): string;
 }
 //#endregion
 //#region src/server/route-agent-request.d.ts

package/dist/v1.d.mts

@@ -1,4 +1,4 @@
-import { n as JwtAuthConfig, t as routeAgentRequest } from "./route-agent-request-D2ll--nF.mjs";
+import { n as JwtAuthConfig, t as routeAgentRequest } from "./route-agent-request-DLlW8kZo.mjs";
 import { Agent as Agent$1, Connection, ConnectionContext } from "agents";
 import { LanguageModel, StreamTextOnFinishCallback, ToolSet, UIMessage, generateText, streamText } from "ai";
 import { AIChatAgent, ChatResponseResult, OnChatMessageOptions } from "@cloudflare/ai-chat";

package/dist/v1.mjs

@@ -1,4 +1,4 @@
-import { a as verifyJwt, i as extractTokenFromConnectRequest, n as createAgentTracer, t as routeAgentRequest } from "./route-agent-request-DBGSXu2O.mjs";
+import { a as isJwtActorAuthorized, i as extractTokenFromConnectRequest, n as createAgentTracer, o as verifyJwt, t as routeAgentRequest } from "./route-agent-request-CYclS_5Q.mjs";
 import { Agent as Agent$1, callable, getCurrentAgent } from "agents";
 import { Output, convertToModelMessages, generateText, jsonSchema, stepCountIs, streamText, tool } from "ai";
 import { AIChatAgent } from "@cloudflare/ai-chat";
@@ -312,6 +312,13 @@ var Agent = class extends Agent$1 {
 					connection.close(result.status === 401 ? 4001 : 4003, result.message);
 					return;
 				}
+				if (!isJwtActorAuthorized(config, result.claims, {
+					durableObjectName: this.name,
+					parentPath: this.parentPath
+				})) {
+					connection.close(4003, "Forbidden");
+					return;
+				}
 				const token = extractTokenFromConnectRequest(ctx.request);
 				if (token) {
 					const userContext = await this.getUserContext?.(token);
@@ -895,6 +902,17 @@ var ChatAgent = class extends AIChatAgent {
 					});
 					return;
 				}
+				if (!isJwtActorAuthorized(config, result.claims, {
+					durableObjectName: this.name,
+					parentPath: this.parentPath
+				})) {
+					connection.close(4003, "Forbidden");
+					this.setState({
+						type: "chat",
+						status: "unauthorized"
+					});
+					return;
+				}
 			}
 			const token = extractTokenFromConnectRequest(ctx.request);
 			if (token) this._pendingUserContextRequest = this.getUserContext?.(token).then((userContext) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@economic/agents",
-  "version": "2.7.2",
+  "version": "2.8.1",
   "description": "A starter for creating a TypeScript package.",
   "license": "MIT",
   "files": [