experimental-ash 0.25.2 → 0.27.0

package/dist/src/runtime/framework-tools/pending-connection-tool-calls.js

@@ -1,63 +1 @@
-/**
- * Durable bookkeeping for connection tool calls that are pending
- * authorization.
- *
- * Pending calls are replaced with a placeholder result, then replayed
- * after webhook completion and spliced back into history before the next
- * model step sees them.
- */
-import { ContextKey } from "#context/key.js";
-/**
- * Opaque sentinel written to the session history as the tool-call
- * result while authorization is in flight. Always swapped for the
- * real result by `splicePendingToolResults` before the next model
- * fragment runs, so the model never sees it.
- */
-export const CONNECTION_AUTHORIZATION_PLACEHOLDER = Object.freeze({
-    __ashPlaceholder: "connection-authorization",
-});
-/**
- * Durable context key carrying pending tool calls across the workflow
- * pause/resume boundary.
- *
- * Entries are cleared per authorization cycle only for the connections
- * that resolved during that cycle; residual entries for connections
- * still awaiting auth (e.g. because the same turn observed a fresh
- * `Required` during retry) stay for the next cycle.
- */
-export const PendingConnectionToolCallsKey = new ContextKey("ash.pendingConnectionToolCalls");
-/**
- * Appends new pending tool calls to the context, deduplicated by
- * `toolCallId` so repeated retries in the same cycle don't grow the
- * list unboundedly. Existing order is preserved so the splice order
- * stays deterministic on replay.
- */
-export function appendPendingConnectionToolCalls(existing, additions) {
-    if (additions.length === 0) {
-        return existing ?? [];
-    }
-    const seen = new Set();
-    const base = existing ?? [];
-    for (const entry of base) {
-        seen.add(entry.toolCallId);
-    }
-    const next = [...base];
-    for (const addition of additions) {
-        if (seen.has(addition.toolCallId))
-            continue;
-        seen.add(addition.toolCallId);
-        next.push(addition);
-    }
-    return next;
-}
-/**
- * Narrow `value` to the placeholder sentinel. Used by the splice
- * helper and by tests to assert that a pre-splice tool-result is a
- * placeholder rather than a real value.
- */
-export function isConnectionAuthorizationPlaceholder(value) {
-    if (typeof value !== "object" || value === null)
-        return false;
-    const v = value;
-    return v.__ashPlaceholder === "connection-authorization";
-}
+import{ContextKey}from"#context/key.js";var CONNECTION_AUTHORIZATION_PLACEHOLDER=Object.freeze({__ashPlaceholder:`connection-authorization`}),PendingConnectionToolCallsKey=new ContextKey(`ash.pendingConnectionToolCalls`);function appendPendingConnectionToolCalls(e,t){if(t.length===0)return e??[];let n=new Set,r=e??[];for(let e of r)n.add(e.toolCallId);let i=[...r];for(let e of t)n.has(e.toolCallId)||(n.add(e.toolCallId),i.push(e));return i}function isConnectionAuthorizationPlaceholder(e){return typeof e!=`object`||!e?!1:e.__ashPlaceholder===`connection-authorization`}export{CONNECTION_AUTHORIZATION_PLACEHOLDER,PendingConnectionToolCallsKey,appendPendingConnectionToolCalls,isConnectionAuthorizationPlaceholder};

package/dist/src/runtime/framework-tools/read-file.js

@@ -1,64 +1,2 @@
-import { executeReadFileOnSandbox } from "#execution/sandbox/read-file-tool.js";
-import { clearReadFileState } from "#runtime/framework-tools/file-state.js";
-/**
- * Shared input schema used by the framework `read_file` tool and any author
- * tool constructed via {@link defineReadFileTool}.
- *
- * Exported so the public `defineReadFileTool` factory and the framework
- * `READ_FILE_TOOL_DEFINITION` use the exact same schema object — keeping
- * model input contracts in sync without duplication.
- */
-export const READ_FILE_INPUT_SCHEMA = {
-    additionalProperties: false,
-    properties: {
-        filePath: {
-            description: "The absolute path to the file to read.",
-            type: "string",
-        },
-        limit: {
-            description: "Maximum number of lines to return. Defaults to 2000.",
-            minimum: 1,
-            type: "integer",
-        },
-        offset: {
-            description: "1-based line number to start from. Defaults to 1.",
-            minimum: 1,
-            type: "integer",
-        },
-    },
-    required: ["filePath"],
-    type: "object",
-};
-/**
- * Framework-owned executor that delegates to the default sandbox.
- */
-async function executeReadFile(input) {
-    return executeReadFileOnSandbox(input);
-}
-export const READ_FILE_TOOL_DEFINITION = {
-    description: [
-        "Read a file from the local filesystem. If the path does not exist, an error is returned.",
-        "",
-        "Usage:",
-        "- The filePath parameter should be an absolute path.",
-        "- By default, this tool returns up to 2000 lines from the start of the file.",
-        "- The offset parameter is the line number to start from (1-indexed).",
-        "- To read later sections, call this tool again with a larger offset.",
-        "- Use the grep tool to find specific content in large files or files with long lines.",
-        "- If you are unsure of the correct file path, use the glob tool to look up filenames by glob pattern.",
-        '- Contents are returned with each line prefixed by its line number as `<line>: <content>`. For example, if a file has contents "foo\\n", you will receive "1: foo\\n".',
-        "- Any line longer than 2000 characters is truncated.",
-        "- Call this tool in parallel when you know there are multiple files you want to read.",
-        "- Avoid tiny repeated slices (30 line chunks). If you need more context, read a larger window.",
-    ].join("\n"),
-    execute: executeReadFile,
-    inputSchema: READ_FILE_INPUT_SCHEMA,
-    logicalPath: "ash:framework/read-file",
-    name: "read_file",
-    onCompact({ ctx }) {
-        clearReadFileState(ctx);
-        return {};
-    },
-    sourceId: "ash:read-file-tool",
-    sourceKind: "module",
-};
+import{clearReadFileState}from"#runtime/framework-tools/file-state.js";import{executeReadFileOnSandbox}from"#execution/sandbox/read-file-tool.js";var READ_FILE_INPUT_SCHEMA={additionalProperties:!1,properties:{filePath:{description:`The absolute path to the file to read.`,type:`string`},limit:{description:`Maximum number of lines to return. Defaults to 2000.`,minimum:1,type:`integer`},offset:{description:`1-based line number to start from. Defaults to 1.`,minimum:1,type:`integer`}},required:[`filePath`],type:`object`};async function executeReadFile(e){return executeReadFileOnSandbox(e)}var READ_FILE_TOOL_DEFINITION={description:[`Read a file from the local filesystem. If the path does not exist, an error is returned.`,``,`Usage:`,`- The filePath parameter should be an absolute path.`,`- By default, this tool returns up to 2000 lines from the start of the file.`,`- The offset parameter is the line number to start from (1-indexed).`,`- To read later sections, call this tool again with a larger offset.`,`- Use the grep tool to find specific content in large files or files with long lines.`,`- If you are unsure of the correct file path, use the glob tool to look up filenames by glob pattern.`,'- Contents are returned with each line prefixed by its line number as `<line>: <content>`. For example, if a file has contents "foo\\n", you will receive "1: foo\\n".',`- Any line longer than 2000 characters is truncated.`,`- Call this tool in parallel when you know there are multiple files you want to read.`,`- Avoid tiny repeated slices (30 line chunks). If you need more context, read a larger window.`].join(`
+`),execute:executeReadFile,inputSchema:READ_FILE_INPUT_SCHEMA,logicalPath:`ash:framework/read-file`,name:`read_file`,onCompact({ctx:t}){return clearReadFileState(t),{}},sourceId:`ash:read-file-tool`,sourceKind:`module`};export{READ_FILE_INPUT_SCHEMA,READ_FILE_TOOL_DEFINITION};

package/dist/src/runtime/framework-tools/skill.js

@@ -1,47 +1 @@
-import { loadContext } from "#context/container.js";
-import { SandboxKey } from "#context/keys.js";
-import { loadSkillFromSandbox } from "#runtime/skills/sandbox-access.js";
-/**
- * Executes the `load_skill` tool.
- *
- * Reads the requested skill's `SKILL.md` from the active sandbox and
- * returns it as the tool result.
- */
-async function executeLoadSkillTool(args) {
-    const ctx = loadContext();
-    const sandbox = ctx.get(SandboxKey);
-    if (sandbox === undefined) {
-        throw new Error("The load_skill tool requires sandbox access on the runtime context. " +
-            "Ensure the step is running inside a managed runtime context with sandbox support.");
-    }
-    const { skill } = args;
-    return await loadSkillFromSandbox(sandbox, skill);
-}
-// ---------------------------------------------------------------------------
-// Tool definition
-// ---------------------------------------------------------------------------
-export const SKILL_TOOL_DEFINITION = {
-    description: [
-        "Load the full instructions for one available skill by name or id.",
-        "Use this tool when the request clearly matches a listed skill description or when the user explicitly asks for that skill.",
-        "Loading adds the skill instructions to the current turn.",
-        'Choose the "skill" value from the Available skills block.',
-    ].join(" "),
-    execute: (input) => executeLoadSkillTool(input),
-    inputSchema: {
-        additionalProperties: false,
-        properties: {
-            skill: {
-                description: "Available skill name or id.",
-                type: "string",
-            },
-        },
-        required: ["skill"],
-        type: "object",
-    },
-    logicalPath: "ash:framework/load-skill",
-    name: "load_skill",
-    retentionPolicy: "keep",
-    sourceId: "ash:load-skill-tool",
-    sourceKind: "module",
-};
+import{loadSkillFromSandbox}from"#runtime/skills/sandbox-access.js";import{loadContext}from"#context/container.js";import{SandboxKey}from"#context/keys.js";async function executeLoadSkillTool(t){let n=loadContext().get(SandboxKey);if(n===void 0)throw Error(`The load_skill tool requires sandbox access on the runtime context. Ensure the step is running inside a managed runtime context with sandbox support.`);let{skill:r}=t;return await loadSkillFromSandbox(n,r)}var SKILL_TOOL_DEFINITION={description:[`Load the full instructions for one available skill by name or id.`,`Use this tool when the request clearly matches a listed skill description or when the user explicitly asks for that skill.`,`Loading adds the skill instructions to the current turn.`,`Choose the "skill" value from the Available skills block.`].join(` `),execute:e=>executeLoadSkillTool(e),inputSchema:{additionalProperties:!1,properties:{skill:{description:`Available skill name or id.`,type:`string`}},required:[`skill`],type:`object`},logicalPath:`ash:framework/load-skill`,name:`load_skill`,retentionPolicy:`keep`,sourceId:`ash:load-skill-tool`,sourceKind:`module`};export{SKILL_TOOL_DEFINITION};

package/dist/src/runtime/framework-tools/todo.js

@@ -1,122 +1,3 @@
-import { loadContext } from "#context/container.js";
-import { ContextKey } from "#context/key.js";
-export const TodoStateKey = new ContextKey("ash.todo");
-function formatTodoSummary(state) {
-    if (state.items.length === 0)
-        return undefined;
-    const lines = state.items.map((item) => {
-        const check = item.status === "completed" ? "x" : item.status === "cancelled" ? "-" : " ";
-        return `- [${check}] [${item.priority}] ${item.content}`;
-    });
-    return `[Your task list was preserved across context compaction]\n${lines.join("\n")}`;
-}
-function formatTodoResult(state) {
-    const { items } = state;
-    const counts = {
-        cancelled: 0,
-        completed: 0,
-        in_progress: 0,
-        pending: 0,
-        total: items.length,
-    };
-    for (const item of items) {
-        counts[item.status]++;
-    }
-    return {
-        counts,
-        todos: items,
-    };
-}
-/**
- * Executes the framework todo tool.
- *
- * - Read: omit `todos` → returns the current list.
- * - Write: provide `todos` → replaces the entire list, returns the new list.
- *
- * Both paths return the same formatted output so the model always sees
- * the full current state.
- */
-export function executeTodoTool(input) {
-    const ctx = loadContext();
-    const { todos } = input ?? {};
-    if (todos !== undefined) {
-        const newState = { items: [...todos] };
-        ctx.set(TodoStateKey, newState);
-        return formatTodoResult(newState);
-    }
-    const current = ctx.ensure(TodoStateKey, () => ({ items: [] }));
-    return formatTodoResult(current);
-}
-// ---------------------------------------------------------------------------
-// Tool definition
-// ---------------------------------------------------------------------------
-export const TODO_TOOL_DEFINITION = {
-    description: [
-        "Use this tool to create and manage a structured task list for the current session.",
-        "This helps you track progress, organize complex tasks, and demonstrate thoroughness.",
-        "",
-        "When to use:",
-        "- Complex multistep tasks requiring 3 or more distinct steps",
-        "- When the user provides multiple tasks or a numbered list",
-        "- After receiving new instructions, to capture requirements",
-        "- After completing a task, to mark it complete and add follow-ups",
-        "",
-        "When NOT to use:",
-        "- Single, straightforward tasks that need no tracking",
-        "- Purely conversational or informational requests",
-        "",
-        "Usage:",
-        "- Call with `todos` to replace the entire list (full replacement write)",
-        "- Call without `todos` to read the current list",
-        "- Both return the full current list with status counts",
-        "- Mark tasks in_progress when you start, completed when done",
-        "- Only have ONE task in_progress at a time",
-    ].join("\n"),
-    execute: async (input) => executeTodoTool((input ?? {})),
-    inputSchema: {
-        additionalProperties: false,
-        properties: {
-            todos: {
-                description: "The updated todo list. Omit to read the current list without modifying it.",
-                items: {
-                    additionalProperties: false,
-                    properties: {
-                        content: {
-                            description: "Brief description of the task.",
-                            type: "string",
-                        },
-                        priority: {
-                            description: "Priority level of the task.",
-                            enum: ["high", "medium", "low"],
-                            type: "string",
-                        },
-                        status: {
-                            description: "Current status of the task.",
-                            enum: ["pending", "in_progress", "completed", "cancelled"],
-                            type: "string",
-                        },
-                    },
-                    required: ["content", "status", "priority"],
-                    type: "object",
-                },
-                type: "array",
-            },
-        },
-        type: "object",
-    },
-    logicalPath: "ash:framework/todo",
-    name: "todo",
-    onCompact({ ctx }) {
-        const state = ctx.get(TodoStateKey);
-        if (state === undefined || state.items.length === 0)
-            return {};
-        const summary = formatTodoSummary(state);
-        if (summary === undefined)
-            return {};
-        return {
-            messages: [{ content: summary, role: "user" }],
-        };
-    },
-    sourceId: "ash:todo-tool",
-    sourceKind: "module",
-};
+import{loadContext}from"#context/container.js";import{ContextKey}from"#context/key.js";var TodoStateKey=new ContextKey(`ash.todo`);function formatTodoSummary(e){return e.items.length===0?void 0:`[Your task list was preserved across context compaction]\n${e.items.map(e=>`- [${e.status===`completed`?`x`:e.status===`cancelled`?`-`:` `}] [${e.priority}] ${e.content}`).join(`
+`)}`}function formatTodoResult(e){let{items:t}=e,n={cancelled:0,completed:0,in_progress:0,pending:0,total:t.length};for(let e of t)n[e.status]++;return{counts:n,todos:t}}function executeTodoTool(t){let r=loadContext(),{todos:i}=t??{};if(i!==void 0){let e={items:[...i]};return r.set(TodoStateKey,e),formatTodoResult(e)}return formatTodoResult(r.ensure(TodoStateKey,()=>({items:[]})))}var TODO_TOOL_DEFINITION={description:[`Use this tool to create and manage a structured task list for the current session.`,`This helps you track progress, organize complex tasks, and demonstrate thoroughness.`,``,`When to use:`,`- Complex multistep tasks requiring 3 or more distinct steps`,`- When the user provides multiple tasks or a numbered list`,`- After receiving new instructions, to capture requirements`,`- After completing a task, to mark it complete and add follow-ups`,``,`When NOT to use:`,`- Single, straightforward tasks that need no tracking`,`- Purely conversational or informational requests`,``,`Usage:`,"- Call with `todos` to replace the entire list (full replacement write)","- Call without `todos` to read the current list",`- Both return the full current list with status counts`,`- Mark tasks in_progress when you start, completed when done`,`- Only have ONE task in_progress at a time`].join(`
+`),execute:async e=>executeTodoTool(e??{}),inputSchema:{additionalProperties:!1,properties:{todos:{description:`The updated todo list. Omit to read the current list without modifying it.`,items:{additionalProperties:!1,properties:{content:{description:`Brief description of the task.`,type:`string`},priority:{description:`Priority level of the task.`,enum:[`high`,`medium`,`low`],type:`string`},status:{description:`Current status of the task.`,enum:[`pending`,`in_progress`,`completed`,`cancelled`],type:`string`}},required:[`content`,`status`,`priority`],type:`object`},type:`array`}},type:`object`},logicalPath:`ash:framework/todo`,name:`todo`,onCompact({ctx:e}){let t=e.get(TodoStateKey);if(t===void 0||t.items.length===0)return{};let r=formatTodoSummary(t);return r===void 0?{}:{messages:[{content:r,role:`user`}]}},sourceId:`ash:todo-tool`,sourceKind:`module`};export{TODO_TOOL_DEFINITION,TodoStateKey,executeTodoTool};

package/dist/src/runtime/framework-tools/web-fetch.js

@@ -1,42 +1,2 @@
-import { executeWebFetchTool } from "#execution/web-fetch/tool.js";
-async function executeWebFetch(input) {
-    return executeWebFetchTool(input);
-}
-export const WEB_FETCH_TOOL_DEFINITION = {
-    description: [
-        "Fetch a webpage and return its content in the requested format. Use this to retrieve and analyze content from URLs.",
-        "",
-        "Usage notes:",
-        "- The URL must be a fully-formed valid URL starting with http:// or https://",
-        "- HTML responses are automatically converted to markdown or plain text based on the requested format",
-        '- Format options: "markdown" (default), "text", or "html"',
-        "- Default timeout is 30 seconds (max 120 seconds)",
-        "- Maximum response size is 5 MB; content is further capped at the shared tool-output budget (50 KB / 2000 lines)",
-        "- This tool is read-only and does not modify any files",
-    ].join("\n"),
-    execute: executeWebFetch,
-    inputSchema: {
-        additionalProperties: false,
-        properties: {
-            format: {
-                description: 'The format to return the content in (text, markdown, or html). HTML responses are automatically converted to the requested format. Defaults to "markdown".',
-                enum: ["markdown", "text", "html"],
-                type: "string",
-            },
-            timeout: {
-                description: "Optional timeout in seconds. Defaults to 30, max 120.",
-                type: "number",
-            },
-            url: {
-                description: "The fully-formed URL to fetch content from. Must start with http:// or https://.",
-                type: "string",
-            },
-        },
-        required: ["url"],
-        type: "object",
-    },
-    logicalPath: "ash:framework/web-fetch",
-    name: "web_fetch",
-    sourceId: "ash:web-fetch-tool",
-    sourceKind: "module",
-};
+import{executeWebFetchTool}from"#execution/web-fetch/tool.js";async function executeWebFetch(e){return executeWebFetchTool(e)}var WEB_FETCH_TOOL_DEFINITION={description:[`Fetch a webpage and return its content in the requested format. Use this to retrieve and analyze content from URLs.`,``,`Usage notes:`,`- The URL must be a fully-formed valid URL starting with http:// or https://`,`- HTML responses are automatically converted to markdown or plain text based on the requested format`,`- Format options: "markdown" (default), "text", or "html"`,`- Default timeout is 30 seconds (max 120 seconds)`,`- Maximum response size is 5 MB; content is further capped at the shared tool-output budget (50 KB / 2000 lines)`,`- This tool is read-only and does not modify any files`].join(`
+`),execute:executeWebFetch,inputSchema:{additionalProperties:!1,properties:{format:{description:`The format to return the content in (text, markdown, or html). HTML responses are automatically converted to the requested format. Defaults to "markdown".`,enum:[`markdown`,`text`,`html`],type:`string`},timeout:{description:`Optional timeout in seconds. Defaults to 30, max 120.`,type:`number`},url:{description:`The fully-formed URL to fetch content from. Must start with http:// or https://.`,type:`string`}},required:[`url`],type:`object`},logicalPath:`ash:framework/web-fetch`,name:`web_fetch`,sourceId:`ash:web-fetch-tool`,sourceKind:`module`};export{WEB_FETCH_TOOL_DEFINITION};

package/dist/src/runtime/framework-tools/web-search.js

@@ -1,15 +1 @@
-/**
- * Framework-provided web search tool definition.
- *
- * Omits `execute` — the execution layer skips executor creation for tools
- * without it, and the harness injects the real provider-managed tool at
- * step time.
- */
-export const WEB_SEARCH_TOOL_DEFINITION = {
-    description: "Search the web for real-time information. Use this to find up-to-date information about current events, recent developments, or topics that may have changed since the knowledge cutoff.",
-    inputSchema: null,
-    logicalPath: "ash:framework/web-search",
-    name: "web_search",
-    sourceId: "ash:web-search-tool",
-    sourceKind: "module",
-};
+var WEB_SEARCH_TOOL_DEFINITION={description:`Search the web for real-time information. Use this to find up-to-date information about current events, recent developments, or topics that may have changed since the knowledge cutoff.`,inputSchema:null,logicalPath:`ash:framework/web-search`,name:`web_search`,sourceId:`ash:web-search-tool`,sourceKind:`module`};export{WEB_SEARCH_TOOL_DEFINITION};

package/dist/src/runtime/framework-tools/write-file.js

@@ -1,48 +1,2 @@
-import { executeWriteFileOnSandbox, } from "#execution/sandbox/write-file-tool.js";
-/**
- * Shared input schema used by the framework `write_file` tool and any author
- * tool constructed via {@link defineWriteFileTool}.
- *
- * Exported so the public `defineWriteFileTool` factory and the framework
- * `WRITE_FILE_TOOL_DEFINITION` use the exact same schema object — keeping
- * model input contracts in sync without duplication.
- */
-export const WRITE_FILE_INPUT_SCHEMA = {
-    additionalProperties: false,
-    properties: {
-        content: {
-            description: "Complete replacement file contents.",
-            type: "string",
-        },
-        filePath: {
-            description: "The absolute path to the file to write (must be absolute, not relative).",
-            type: "string",
-        },
-    },
-    required: ["filePath", "content"],
-    type: "object",
-};
-/**
- * Framework-owned executor that delegates to the default sandbox.
- */
-async function executeWriteFile(input) {
-    return executeWriteFileOnSandbox(input);
-}
-export const WRITE_FILE_TOOL_DEFINITION = {
-    description: [
-        "Writes a file to the local filesystem.",
-        "",
-        "Usage:",
-        "- This tool will overwrite the existing file if there is one at the provided path.",
-        "- If this is an existing file, you MUST use the read_file tool first to read the file's contents. This tool will fail if you did not read the file first.",
-        "- ALWAYS prefer editing existing files in the codebase. NEVER write new files unless explicitly required.",
-        "- NEVER proactively create documentation files (*.md) or README files. Only create documentation files if explicitly requested by the User.",
-        "- Only use emojis if the user explicitly requests it. Avoid writing emojis to files unless asked.",
-    ].join("\n"),
-    execute: executeWriteFile,
-    inputSchema: WRITE_FILE_INPUT_SCHEMA,
-    logicalPath: "ash:framework/write-file",
-    name: "write_file",
-    sourceId: "ash:write-file-tool",
-    sourceKind: "module",
-};
+import{executeWriteFileOnSandbox}from"#execution/sandbox/write-file-tool.js";var WRITE_FILE_INPUT_SCHEMA={additionalProperties:!1,properties:{content:{description:`Complete replacement file contents.`,type:`string`},filePath:{description:`The absolute path to the file to write (must be absolute, not relative).`,type:`string`}},required:[`filePath`,`content`],type:`object`};async function executeWriteFile(e){return executeWriteFileOnSandbox(e)}var WRITE_FILE_TOOL_DEFINITION={description:[`Writes a file to the local filesystem.`,``,`Usage:`,`- This tool will overwrite the existing file if there is one at the provided path.`,`- If this is an existing file, you MUST use the read_file tool first to read the file's contents. This tool will fail if you did not read the file first.`,`- ALWAYS prefer editing existing files in the codebase. NEVER write new files unless explicitly required.`,`- NEVER proactively create documentation files (*.md) or README files. Only create documentation files if explicitly requested by the User.`,`- Only use emojis if the user explicitly requests it. Avoid writing emojis to files unless asked.`].join(`
+`),execute:executeWriteFile,inputSchema:WRITE_FILE_INPUT_SCHEMA,logicalPath:`ash:framework/write-file`,name:`write_file`,sourceId:`ash:write-file-tool`,sourceKind:`module`};export{WRITE_FILE_INPUT_SCHEMA,WRITE_FILE_TOOL_DEFINITION};

package/dist/src/runtime/governance/auth/http-basic.js

@@ -1,63 +1 @@
-import { createHash, timingSafeEqual } from "node:crypto";
-/**
- * Verifies one HTTP Basic credential against a resolved Ash strategy.
- */
-export function authenticateHttpBasicStrategy(input) {
-    const credentials = parseBasicAuthorizationHeader(input.authorization);
-    if (credentials === null) {
-        return {
-            kind: "not-authenticated",
-        };
-    }
-    if (credentials.username !== input.strategy.username) {
-        return {
-            kind: "not-authenticated",
-        };
-    }
-    if (!timingSafeStringEquals(credentials.password, input.strategy.password)) {
-        return {
-            kind: "not-authenticated",
-        };
-    }
-    return {
-        kind: "authenticated",
-        principal: {
-            attributes: Object.freeze({}),
-            authenticator: "http-basic",
-            claims: Object.freeze({}),
-            principalId: input.strategy.username,
-            principalType: "user",
-        },
-    };
-}
-function parseBasicAuthorizationHeader(value) {
-    const match = /^Basic\s+(.+)$/i.exec(value);
-    if (match === null) {
-        return null;
-    }
-    const encodedCredentials = match[1];
-    if (encodedCredentials === undefined) {
-        return null;
-    }
-    let decoded;
-    try {
-        decoded = Buffer.from(encodedCredentials, "base64").toString("utf8");
-    }
-    catch {
-        return null;
-    }
-    const separatorIndex = decoded.indexOf(":");
-    if (separatorIndex === -1) {
-        return null;
-    }
-    return {
-        password: decoded.slice(separatorIndex + 1),
-        username: decoded.slice(0, separatorIndex),
-    };
-}
-function timingSafeStringEquals(left, right) {
-    return timingSafeEqual(hashString(left), hashString(right));
-}
-function hashString(value) {
-    return createHash("sha256").update(value, "utf8").digest();
-}
+import{createHash,timingSafeEqual}from"node:crypto";function authenticateHttpBasicStrategy(e){let t=parseBasicAuthorizationHeader(e.authorization);return t===null||t.username!==e.strategy.username||!timingSafeStringEquals(t.password,e.strategy.password)?{kind:`not-authenticated`}:{kind:`authenticated`,principal:{attributes:Object.freeze({}),authenticator:`http-basic`,claims:Object.freeze({}),principalId:e.strategy.username,principalType:`user`}}}function parseBasicAuthorizationHeader(e){let t=/^Basic\s+(.+)$/i.exec(e);if(t===null)return null;let n=t[1];if(n===void 0)return null;let r;try{r=Buffer.from(n,`base64`).toString(`utf8`)}catch{return null}let i=r.indexOf(`:`);return i===-1?null:{password:r.slice(i+1),username:r.slice(0,i)}}function timingSafeStringEquals(e,n){return timingSafeEqual(hashString(e),hashString(n))}function hashString(t){return createHash(`sha256`).update(t,`utf8`).digest()}export{authenticateHttpBasicStrategy};

package/dist/src/runtime/governance/auth/jwt-ecdsa.js

@@ -1,69 +1 @@
-import { importJWK, importSPKI, jwtVerify } from "#compiled/jose/index.js";
-import { areTokenClaimMatchersSatisfied, createJwtAuthenticatedCallerPrincipal, } from "#runtime/governance/auth/token-claims.js";
-const importedJwtPublicKeyCache = new Map();
-/**
- * Verifies one bearer token against a resolved ECDSA JWT strategy.
- */
-export async function authenticateJwtEcdsaStrategy(input) {
-    let publicKey;
-    try {
-        publicKey = await getImportedJwtPublicKey(input.strategy);
-    }
-    catch (error) {
-        return {
-            kind: "misconfigured",
-            message: `Failed to import JWT ECDSA public key. ${error instanceof Error ? error.message : "Unknown key import failure."}`,
-        };
-    }
-    try {
-        const verified = await jwtVerify(input.token, publicKey, {
-            algorithms: [input.strategy.algorithm],
-            audience: [...input.strategy.audiences],
-            clockTolerance: input.strategy.clockSkewSeconds,
-            issuer: input.strategy.issuer,
-        });
-        if (typeof verified.payload.sub !== "string" || verified.payload.sub.length === 0) {
-            return {
-                kind: "not-authenticated",
-            };
-        }
-        if (!areTokenClaimMatchersSatisfied(verified.payload, input.strategy)) {
-            return {
-                kind: "caller-not-allowed",
-            };
-        }
-        return {
-            kind: "authenticated",
-            principal: createJwtAuthenticatedCallerPrincipal({
-                authenticator: "jwt-ecdsa",
-                payload: verified.payload,
-                principalType: "service",
-            }),
-        };
-    }
-    catch {
-        return {
-            kind: "not-authenticated",
-        };
-    }
-}
-async function getImportedJwtPublicKey(strategy) {
-    const cacheKey = `${strategy.algorithm}:${strategy.publicKey}`;
-    const cached = importedJwtPublicKeyCache.get(cacheKey);
-    if (cached !== undefined) {
-        return await cached;
-    }
-    const publicKeyPromise = importJwtPublicKey(strategy.publicKey, strategy.algorithm).catch((error) => {
-        importedJwtPublicKeyCache.delete(cacheKey);
-        throw error;
-    });
-    importedJwtPublicKeyCache.set(cacheKey, publicKeyPromise);
-    return await publicKeyPromise;
-}
-async function importJwtPublicKey(publicKey, algorithm) {
-    const trimmedKey = publicKey.trim();
-    if (trimmedKey.startsWith("{")) {
-        return await importJWK(JSON.parse(trimmedKey), algorithm);
-    }
-    return await importSPKI(trimmedKey, algorithm);
-}
+import{importJWK,importSPKI,jwtVerify}from"#compiled/jose/index.js";import{areTokenClaimMatchersSatisfied,createJwtAuthenticatedCallerPrincipal}from"#runtime/governance/auth/token-claims.js";var importedJwtPublicKeyCache=new Map;async function authenticateJwtEcdsaStrategy(e){let t;try{t=await getImportedJwtPublicKey(e.strategy)}catch(e){return{kind:`misconfigured`,message:`Failed to import JWT ECDSA public key. ${e instanceof Error?e.message:`Unknown key import failure.`}`}}try{let a=await jwtVerify(e.token,t,{algorithms:[e.strategy.algorithm],audience:[...e.strategy.audiences],clockTolerance:e.strategy.clockSkewSeconds,issuer:e.strategy.issuer});return typeof a.payload.sub!=`string`||a.payload.sub.length===0?{kind:`not-authenticated`}:areTokenClaimMatchersSatisfied(a.payload,e.strategy)?{kind:`authenticated`,principal:createJwtAuthenticatedCallerPrincipal({authenticator:`jwt-ecdsa`,payload:a.payload,principalType:`service`})}:{kind:`caller-not-allowed`}}catch{return{kind:`not-authenticated`}}}async function getImportedJwtPublicKey(e){let t=`${e.algorithm}:${e.publicKey}`,n=importedJwtPublicKeyCache.get(t);if(n!==void 0)return await n;let r=importJwtPublicKey(e.publicKey,e.algorithm).catch(e=>{throw importedJwtPublicKeyCache.delete(t),e});return importedJwtPublicKeyCache.set(t,r),await r}async function importJwtPublicKey(n,r){let i=n.trim();return i.startsWith(`{`)?await importJWK(JSON.parse(i),r):await importSPKI(i,r)}export{authenticateJwtEcdsaStrategy};

package/dist/src/runtime/governance/auth/jwt-hmac.js

@@ -1,39 +1 @@
-import { createSecretKey } from "node:crypto";
-import { jwtVerify } from "#compiled/jose/index.js";
-import { areTokenClaimMatchersSatisfied, createJwtAuthenticatedCallerPrincipal, } from "#runtime/governance/auth/token-claims.js";
-/**
- * Verifies one bearer token against a resolved HMAC JWT strategy.
- */
-export async function authenticateJwtHmacStrategy(input) {
-    try {
-        const verified = await jwtVerify(input.token, createSecretKey(Buffer.from(input.strategy.secret, "utf8")), {
-            algorithms: [input.strategy.algorithm],
-            audience: [...input.strategy.audiences],
-            clockTolerance: input.strategy.clockSkewSeconds,
-            issuer: input.strategy.issuer,
-        });
-        if (typeof verified.payload.sub !== "string" || verified.payload.sub.length === 0) {
-            return {
-                kind: "not-authenticated",
-            };
-        }
-        if (!areTokenClaimMatchersSatisfied(verified.payload, input.strategy)) {
-            return {
-                kind: "caller-not-allowed",
-            };
-        }
-        return {
-            kind: "authenticated",
-            principal: createJwtAuthenticatedCallerPrincipal({
-                authenticator: "jwt-hmac",
-                payload: verified.payload,
-                principalType: "service",
-            }),
-        };
-    }
-    catch {
-        return {
-            kind: "not-authenticated",
-        };
-    }
-}
+import{createSecretKey}from"node:crypto";import{jwtVerify}from"#compiled/jose/index.js";import{areTokenClaimMatchersSatisfied,createJwtAuthenticatedCallerPrincipal}from"#runtime/governance/auth/token-claims.js";async function authenticateJwtHmacStrategy(e){try{let t=await jwtVerify(e.token,createSecretKey(Buffer.from(e.strategy.secret,`utf8`)),{algorithms:[e.strategy.algorithm],audience:[...e.strategy.audiences],clockTolerance:e.strategy.clockSkewSeconds,issuer:e.strategy.issuer});return typeof t.payload.sub!=`string`||t.payload.sub.length===0?{kind:`not-authenticated`}:areTokenClaimMatchersSatisfied(t.payload,e.strategy)?{kind:`authenticated`,principal:createJwtAuthenticatedCallerPrincipal({authenticator:`jwt-hmac`,payload:t.payload,principalType:`service`})}:{kind:`caller-not-allowed`}}catch{return{kind:`not-authenticated`}}}export{authenticateJwtHmacStrategy};