@ory/vercel-ai 0.10.0 → 0.11.1

package/README.md

@@ -27,7 +27,10 @@ each call it authorizes the tool and records spans. In **enforce** mode
 in **observe** mode (default) the tool runs and a `permission.observe_deny` span is recorded.
 Tools without an `execute` (provider-defined) pass through untouched.
 
-Derive the permission subject from per-call context with `subjectFromOptions`:
+Derive the permission subject from per-call context with `subjectFromOptions`. A non-empty
+return value takes precedence over the client's user principal and env overrides for that
+call — this is how multi-user servers attribute each request to its own acting user. When it
+returns undefined/empty, resolution falls back to the principal / env chain:
 
 ```ts
 withOry(tools, { subjectFromOptions: (o) => o?.experimental_context?.userId });

package/dist/index.d.ts

@@ -29,8 +29,10 @@ export interface WithOryOptions {
     canBlock?: boolean;
     /**
      * Derive the permission subject from the AI SDK call options (e.g. read a thread/user id
-     * from `options.experimental_context`). Falls back to the client principal / env when the
-     * function returns undefined.
+     * from `options.experimental_context`). A non-empty return value takes precedence over the
+     * client's user principal and env overrides for that call — this is how multi-user servers
+     * attribute each request to its own acting user. When the function returns
+     * undefined/empty, resolution falls back to the principal / env chain.
      */
     subjectFromOptions?: (options: unknown) => string | undefined;
 }

package/dist/index.js

@@ -26,19 +26,22 @@ const HARNESS = "vercel-ai";
 function withOry(tools, options = {}) {
     const client = options.client ?? argus_1.OryAgentClient.fromEnv(HARNESS);
     const canBlock = options.canBlock ?? true;
-    let sessionStarted = false;
-    const ensureSession = async () => {
-        if (sessionStarted)
-            return;
-        sessionStarted = true;
-        try {
-            await (0, argus_1.sessionStart)(client, { harness: HARNESS, projectUrl: options.projectUrl });
-        }
-        catch (err) {
+    let sessionPromise;
+    // Cache the in-flight promise (not a boolean) so concurrent first calls all
+    // await the same session start instead of racing past a still-running gate.
+    // Fail-open: a rejection is logged, never rethrown, and clears the cache so
+    // a later call can retry.
+    const ensureSession = () => {
+        sessionPromise ??= (0, argus_1.sessionStart)(client, {
+            harness: HARNESS,
+            projectUrl: options.projectUrl,
+        }).then(() => undefined, (err) => {
+            sessionPromise = undefined;
             client.logger.warn("session_start.failed", {
                 message: err instanceof Error ? err.message : String(err),
             });
-        }
+        });
+        return sessionPromise;
     };
     const wrapped = {};
     for (const [name, tool] of Object.entries(tools)) {
@@ -51,14 +54,14 @@ function withOry(tools, options = {}) {
             ...tool,
             execute: async (input, callOptions) => {
                 await ensureSession();
-                const subjectFallback = options.subjectFromOptions?.(callOptions);
-                const result = await (0, argus_1.gate)(client, {
+                // A per-call subject wins over the client principal / env overrides.
+                const subjectOverride = options.subjectFromOptions?.(callOptions);
+                const result = await (0, argus_1.runWithUserSubject)(subjectOverride, () => (0, argus_1.gate)(client, {
                     harness: HARNESS,
                     toolName: name,
                     toolArgs: input,
-                    subjectFallback,
                     canBlock,
-                });
+                }));
                 if (result.blocked) {
                     throw new argus_1.OryDenialError({
                         tool: name,

package/package.json

@@ -1,8 +1,13 @@
 {
   "name": "@ory/vercel-ai",
-  "version": "0.10.0",
+  "version": "0.11.1",
   "description": "Ory Agent Security for the Vercel AI SDK — per-tool authorization, tracing, and identity propagation by wrapping tool execute(). Built on @ory/argus.",
   "license": "Apache-2.0",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/",
+    "provenance": true
+  },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
@@ -25,7 +30,7 @@
     "permissions"
   ],
   "dependencies": {
-    "@ory/argus": "0.10.0"
+    "@ory/argus": "0.11.1"
   },
   "devDependencies": {
     "typescript": "^6.0.2",