experimental-ash 0.26.0 → 0.28.0

package/dist/src/runtime/framework-tools/todo.js

@@ -1,122 +1,3 @@
-import { loadContext } from "#context/container.js";
-import { ContextKey } from "#context/key.js";
-export const TodoStateKey = new ContextKey("ash.todo");
-function formatTodoSummary(state) {
-    if (state.items.length === 0)
-        return undefined;
-    const lines = state.items.map((item) => {
-        const check = item.status === "completed" ? "x" : item.status === "cancelled" ? "-" : " ";
-        return `- [${check}] [${item.priority}] ${item.content}`;
-    });
-    return `[Your task list was preserved across context compaction]\n${lines.join("\n")}`;
-}
-function formatTodoResult(state) {
-    const { items } = state;
-    const counts = {
-        cancelled: 0,
-        completed: 0,
-        in_progress: 0,
-        pending: 0,
-        total: items.length,
-    };
-    for (const item of items) {
-        counts[item.status]++;
-    }
-    return {
-        counts,
-        todos: items,
-    };
-}
-/**
- * Executes the framework todo tool.
- *
- * - Read: omit `todos` → returns the current list.
- * - Write: provide `todos` → replaces the entire list, returns the new list.
- *
- * Both paths return the same formatted output so the model always sees
- * the full current state.
- */
-export function executeTodoTool(input) {
-    const ctx = loadContext();
-    const { todos } = input ?? {};
-    if (todos !== undefined) {
-        const newState = { items: [...todos] };
-        ctx.set(TodoStateKey, newState);
-        return formatTodoResult(newState);
-    }
-    const current = ctx.ensure(TodoStateKey, () => ({ items: [] }));
-    return formatTodoResult(current);
-}
-// ---------------------------------------------------------------------------
-// Tool definition
-// ---------------------------------------------------------------------------
-export const TODO_TOOL_DEFINITION = {
-    description: [
-        "Use this tool to create and manage a structured task list for the current session.",
-        "This helps you track progress, organize complex tasks, and demonstrate thoroughness.",
-        "",
-        "When to use:",
-        "- Complex multistep tasks requiring 3 or more distinct steps",
-        "- When the user provides multiple tasks or a numbered list",
-        "- After receiving new instructions, to capture requirements",
-        "- After completing a task, to mark it complete and add follow-ups",
-        "",
-        "When NOT to use:",
-        "- Single, straightforward tasks that need no tracking",
-        "- Purely conversational or informational requests",
-        "",
-        "Usage:",
-        "- Call with `todos` to replace the entire list (full replacement write)",
-        "- Call without `todos` to read the current list",
-        "- Both return the full current list with status counts",
-        "- Mark tasks in_progress when you start, completed when done",
-        "- Only have ONE task in_progress at a time",
-    ].join("\n"),
-    execute: async (input) => executeTodoTool((input ?? {})),
-    inputSchema: {
-        additionalProperties: false,
-        properties: {
-            todos: {
-                description: "The updated todo list. Omit to read the current list without modifying it.",
-                items: {
-                    additionalProperties: false,
-                    properties: {
-                        content: {
-                            description: "Brief description of the task.",
-                            type: "string",
-                        },
-                        priority: {
-                            description: "Priority level of the task.",
-                            enum: ["high", "medium", "low"],
-                            type: "string",
-                        },
-                        status: {
-                            description: "Current status of the task.",
-                            enum: ["pending", "in_progress", "completed", "cancelled"],
-                            type: "string",
-                        },
-                    },
-                    required: ["content", "status", "priority"],
-                    type: "object",
-                },
-                type: "array",
-            },
-        },
-        type: "object",
-    },
-    logicalPath: "ash:framework/todo",
-    name: "todo",
-    onCompact({ ctx }) {
-        const state = ctx.get(TodoStateKey);
-        if (state === undefined || state.items.length === 0)
-            return {};
-        const summary = formatTodoSummary(state);
-        if (summary === undefined)
-            return {};
-        return {
-            messages: [{ content: summary, role: "user" }],
-        };
-    },
-    sourceId: "ash:todo-tool",
-    sourceKind: "module",
-};
+import{loadContext}from"#context/container.js";import{ContextKey}from"#context/key.js";var TodoStateKey=new ContextKey(`ash.todo`);function formatTodoSummary(e){return e.items.length===0?void 0:`[Your task list was preserved across context compaction]\n${e.items.map(e=>`- [${e.status===`completed`?`x`:e.status===`cancelled`?`-`:` `}] [${e.priority}] ${e.content}`).join(`
+`)}`}function formatTodoResult(e){let{items:t}=e,n={cancelled:0,completed:0,in_progress:0,pending:0,total:t.length};for(let e of t)n[e.status]++;return{counts:n,todos:t}}function executeTodoTool(t){let r=loadContext(),{todos:i}=t??{};if(i!==void 0){let e={items:[...i]};return r.set(TodoStateKey,e),formatTodoResult(e)}return formatTodoResult(r.ensure(TodoStateKey,()=>({items:[]})))}var TODO_TOOL_DEFINITION={description:[`Use this tool to create and manage a structured task list for the current session.`,`This helps you track progress, organize complex tasks, and demonstrate thoroughness.`,``,`When to use:`,`- Complex multistep tasks requiring 3 or more distinct steps`,`- When the user provides multiple tasks or a numbered list`,`- After receiving new instructions, to capture requirements`,`- After completing a task, to mark it complete and add follow-ups`,``,`When NOT to use:`,`- Single, straightforward tasks that need no tracking`,`- Purely conversational or informational requests`,``,`Usage:`,"- Call with `todos` to replace the entire list (full replacement write)","- Call without `todos` to read the current list",`- Both return the full current list with status counts`,`- Mark tasks in_progress when you start, completed when done`,`- Only have ONE task in_progress at a time`].join(`
+`),execute:async e=>executeTodoTool(e??{}),inputSchema:{additionalProperties:!1,properties:{todos:{description:`The updated todo list. Omit to read the current list without modifying it.`,items:{additionalProperties:!1,properties:{content:{description:`Brief description of the task.`,type:`string`},priority:{description:`Priority level of the task.`,enum:[`high`,`medium`,`low`],type:`string`},status:{description:`Current status of the task.`,enum:[`pending`,`in_progress`,`completed`,`cancelled`],type:`string`}},required:[`content`,`status`,`priority`],type:`object`},type:`array`}},type:`object`},logicalPath:`ash:framework/todo`,name:`todo`,onCompact({ctx:e}){let t=e.get(TodoStateKey);if(t===void 0||t.items.length===0)return{};let r=formatTodoSummary(t);return r===void 0?{}:{messages:[{content:r,role:`user`}]}},sourceId:`ash:todo-tool`,sourceKind:`module`};export{TODO_TOOL_DEFINITION,TodoStateKey,executeTodoTool};

package/dist/src/runtime/framework-tools/web-fetch.js

@@ -1,42 +1,2 @@
-import { executeWebFetchTool } from "#execution/web-fetch/tool.js";
-async function executeWebFetch(input) {
-    return executeWebFetchTool(input);
-}
-export const WEB_FETCH_TOOL_DEFINITION = {
-    description: [
-        "Fetch a webpage and return its content in the requested format. Use this to retrieve and analyze content from URLs.",
-        "",
-        "Usage notes:",
-        "- The URL must be a fully-formed valid URL starting with http:// or https://",
-        "- HTML responses are automatically converted to markdown or plain text based on the requested format",
-        '- Format options: "markdown" (default), "text", or "html"',
-        "- Default timeout is 30 seconds (max 120 seconds)",
-        "- Maximum response size is 5 MB; content is further capped at the shared tool-output budget (50 KB / 2000 lines)",
-        "- This tool is read-only and does not modify any files",
-    ].join("\n"),
-    execute: executeWebFetch,
-    inputSchema: {
-        additionalProperties: false,
-        properties: {
-            format: {
-                description: 'The format to return the content in (text, markdown, or html). HTML responses are automatically converted to the requested format. Defaults to "markdown".',
-                enum: ["markdown", "text", "html"],
-                type: "string",
-            },
-            timeout: {
-                description: "Optional timeout in seconds. Defaults to 30, max 120.",
-                type: "number",
-            },
-            url: {
-                description: "The fully-formed URL to fetch content from. Must start with http:// or https://.",
-                type: "string",
-            },
-        },
-        required: ["url"],
-        type: "object",
-    },
-    logicalPath: "ash:framework/web-fetch",
-    name: "web_fetch",
-    sourceId: "ash:web-fetch-tool",
-    sourceKind: "module",
-};
+import{executeWebFetchTool}from"#execution/web-fetch/tool.js";async function executeWebFetch(e){return executeWebFetchTool(e)}var WEB_FETCH_TOOL_DEFINITION={description:[`Fetch a webpage and return its content in the requested format. Use this to retrieve and analyze content from URLs.`,``,`Usage notes:`,`- The URL must be a fully-formed valid URL starting with http:// or https://`,`- HTML responses are automatically converted to markdown or plain text based on the requested format`,`- Format options: "markdown" (default), "text", or "html"`,`- Default timeout is 30 seconds (max 120 seconds)`,`- Maximum response size is 5 MB; content is further capped at the shared tool-output budget (50 KB / 2000 lines)`,`- This tool is read-only and does not modify any files`].join(`
+`),execute:executeWebFetch,inputSchema:{additionalProperties:!1,properties:{format:{description:`The format to return the content in (text, markdown, or html). HTML responses are automatically converted to the requested format. Defaults to "markdown".`,enum:[`markdown`,`text`,`html`],type:`string`},timeout:{description:`Optional timeout in seconds. Defaults to 30, max 120.`,type:`number`},url:{description:`The fully-formed URL to fetch content from. Must start with http:// or https://.`,type:`string`}},required:[`url`],type:`object`},logicalPath:`ash:framework/web-fetch`,name:`web_fetch`,sourceId:`ash:web-fetch-tool`,sourceKind:`module`};export{WEB_FETCH_TOOL_DEFINITION};

package/dist/src/runtime/framework-tools/web-search.js

@@ -1,15 +1 @@
-/**
- * Framework-provided web search tool definition.
- *
- * Omits `execute` — the execution layer skips executor creation for tools
- * without it, and the harness injects the real provider-managed tool at
- * step time.
- */
-export const WEB_SEARCH_TOOL_DEFINITION = {
-    description: "Search the web for real-time information. Use this to find up-to-date information about current events, recent developments, or topics that may have changed since the knowledge cutoff.",
-    inputSchema: null,
-    logicalPath: "ash:framework/web-search",
-    name: "web_search",
-    sourceId: "ash:web-search-tool",
-    sourceKind: "module",
-};
+var WEB_SEARCH_TOOL_DEFINITION={description:`Search the web for real-time information. Use this to find up-to-date information about current events, recent developments, or topics that may have changed since the knowledge cutoff.`,inputSchema:null,logicalPath:`ash:framework/web-search`,name:`web_search`,sourceId:`ash:web-search-tool`,sourceKind:`module`};export{WEB_SEARCH_TOOL_DEFINITION};

package/dist/src/runtime/framework-tools/write-file.js

@@ -1,48 +1,2 @@
-import { executeWriteFileOnSandbox, } from "#execution/sandbox/write-file-tool.js";
-/**
- * Shared input schema used by the framework `write_file` tool and any author
- * tool constructed via {@link defineWriteFileTool}.
- *
- * Exported so the public `defineWriteFileTool` factory and the framework
- * `WRITE_FILE_TOOL_DEFINITION` use the exact same schema object — keeping
- * model input contracts in sync without duplication.
- */
-export const WRITE_FILE_INPUT_SCHEMA = {
-    additionalProperties: false,
-    properties: {
-        content: {
-            description: "Complete replacement file contents.",
-            type: "string",
-        },
-        filePath: {
-            description: "The absolute path to the file to write (must be absolute, not relative).",
-            type: "string",
-        },
-    },
-    required: ["filePath", "content"],
-    type: "object",
-};
-/**
- * Framework-owned executor that delegates to the default sandbox.
- */
-async function executeWriteFile(input) {
-    return executeWriteFileOnSandbox(input);
-}
-export const WRITE_FILE_TOOL_DEFINITION = {
-    description: [
-        "Writes a file to the local filesystem.",
-        "",
-        "Usage:",
-        "- This tool will overwrite the existing file if there is one at the provided path.",
-        "- If this is an existing file, you MUST use the read_file tool first to read the file's contents. This tool will fail if you did not read the file first.",
-        "- ALWAYS prefer editing existing files in the codebase. NEVER write new files unless explicitly required.",
-        "- NEVER proactively create documentation files (*.md) or README files. Only create documentation files if explicitly requested by the User.",
-        "- Only use emojis if the user explicitly requests it. Avoid writing emojis to files unless asked.",
-    ].join("\n"),
-    execute: executeWriteFile,
-    inputSchema: WRITE_FILE_INPUT_SCHEMA,
-    logicalPath: "ash:framework/write-file",
-    name: "write_file",
-    sourceId: "ash:write-file-tool",
-    sourceKind: "module",
-};
+import{executeWriteFileOnSandbox}from"#execution/sandbox/write-file-tool.js";var WRITE_FILE_INPUT_SCHEMA={additionalProperties:!1,properties:{content:{description:`Complete replacement file contents.`,type:`string`},filePath:{description:`The absolute path to the file to write (must be absolute, not relative).`,type:`string`}},required:[`filePath`,`content`],type:`object`};async function executeWriteFile(e){return executeWriteFileOnSandbox(e)}var WRITE_FILE_TOOL_DEFINITION={description:[`Writes a file to the local filesystem.`,``,`Usage:`,`- This tool will overwrite the existing file if there is one at the provided path.`,`- If this is an existing file, you MUST use the read_file tool first to read the file's contents. This tool will fail if you did not read the file first.`,`- ALWAYS prefer editing existing files in the codebase. NEVER write new files unless explicitly required.`,`- NEVER proactively create documentation files (*.md) or README files. Only create documentation files if explicitly requested by the User.`,`- Only use emojis if the user explicitly requests it. Avoid writing emojis to files unless asked.`].join(`
+`),execute:executeWriteFile,inputSchema:WRITE_FILE_INPUT_SCHEMA,logicalPath:`ash:framework/write-file`,name:`write_file`,sourceId:`ash:write-file-tool`,sourceKind:`module`};export{WRITE_FILE_INPUT_SCHEMA,WRITE_FILE_TOOL_DEFINITION};

package/dist/src/runtime/governance/auth/http-basic.js

@@ -1,63 +1 @@
-import { createHash, timingSafeEqual } from "node:crypto";
-/**
- * Verifies one HTTP Basic credential against a resolved Ash strategy.
- */
-export function authenticateHttpBasicStrategy(input) {
-    const credentials = parseBasicAuthorizationHeader(input.authorization);
-    if (credentials === null) {
-        return {
-            kind: "not-authenticated",
-        };
-    }
-    if (credentials.username !== input.strategy.username) {
-        return {
-            kind: "not-authenticated",
-        };
-    }
-    if (!timingSafeStringEquals(credentials.password, input.strategy.password)) {
-        return {
-            kind: "not-authenticated",
-        };
-    }
-    return {
-        kind: "authenticated",
-        principal: {
-            attributes: Object.freeze({}),
-            authenticator: "http-basic",
-            claims: Object.freeze({}),
-            principalId: input.strategy.username,
-            principalType: "user",
-        },
-    };
-}
-function parseBasicAuthorizationHeader(value) {
-    const match = /^Basic\s+(.+)$/i.exec(value);
-    if (match === null) {
-        return null;
-    }
-    const encodedCredentials = match[1];
-    if (encodedCredentials === undefined) {
-        return null;
-    }
-    let decoded;
-    try {
-        decoded = Buffer.from(encodedCredentials, "base64").toString("utf8");
-    }
-    catch {
-        return null;
-    }
-    const separatorIndex = decoded.indexOf(":");
-    if (separatorIndex === -1) {
-        return null;
-    }
-    return {
-        password: decoded.slice(separatorIndex + 1),
-        username: decoded.slice(0, separatorIndex),
-    };
-}
-function timingSafeStringEquals(left, right) {
-    return timingSafeEqual(hashString(left), hashString(right));
-}
-function hashString(value) {
-    return createHash("sha256").update(value, "utf8").digest();
-}
+import{createHash,timingSafeEqual}from"node:crypto";function authenticateHttpBasicStrategy(e){let t=parseBasicAuthorizationHeader(e.authorization);return t===null||t.username!==e.strategy.username||!timingSafeStringEquals(t.password,e.strategy.password)?{kind:`not-authenticated`}:{kind:`authenticated`,principal:{attributes:Object.freeze({}),authenticator:`http-basic`,claims:Object.freeze({}),principalId:e.strategy.username,principalType:`user`}}}function parseBasicAuthorizationHeader(e){let t=/^Basic\s+(.+)$/i.exec(e);if(t===null)return null;let n=t[1];if(n===void 0)return null;let r;try{r=Buffer.from(n,`base64`).toString(`utf8`)}catch{return null}let i=r.indexOf(`:`);return i===-1?null:{password:r.slice(i+1),username:r.slice(0,i)}}function timingSafeStringEquals(e,n){return timingSafeEqual(hashString(e),hashString(n))}function hashString(t){return createHash(`sha256`).update(t,`utf8`).digest()}export{authenticateHttpBasicStrategy};

package/dist/src/runtime/governance/auth/jwt-ecdsa.js

@@ -1,69 +1 @@
-import { importJWK, importSPKI, jwtVerify } from "#compiled/jose/index.js";
-import { areTokenClaimMatchersSatisfied, createJwtAuthenticatedCallerPrincipal, } from "#runtime/governance/auth/token-claims.js";
-const importedJwtPublicKeyCache = new Map();
-/**
- * Verifies one bearer token against a resolved ECDSA JWT strategy.
- */
-export async function authenticateJwtEcdsaStrategy(input) {
-    let publicKey;
-    try {
-        publicKey = await getImportedJwtPublicKey(input.strategy);
-    }
-    catch (error) {
-        return {
-            kind: "misconfigured",
-            message: `Failed to import JWT ECDSA public key. ${error instanceof Error ? error.message : "Unknown key import failure."}`,
-        };
-    }
-    try {
-        const verified = await jwtVerify(input.token, publicKey, {
-            algorithms: [input.strategy.algorithm],
-            audience: [...input.strategy.audiences],
-            clockTolerance: input.strategy.clockSkewSeconds,
-            issuer: input.strategy.issuer,
-        });
-        if (typeof verified.payload.sub !== "string" || verified.payload.sub.length === 0) {
-            return {
-                kind: "not-authenticated",
-            };
-        }
-        if (!areTokenClaimMatchersSatisfied(verified.payload, input.strategy)) {
-            return {
-                kind: "caller-not-allowed",
-            };
-        }
-        return {
-            kind: "authenticated",
-            principal: createJwtAuthenticatedCallerPrincipal({
-                authenticator: "jwt-ecdsa",
-                payload: verified.payload,
-                principalType: "service",
-            }),
-        };
-    }
-    catch {
-        return {
-            kind: "not-authenticated",
-        };
-    }
-}
-async function getImportedJwtPublicKey(strategy) {
-    const cacheKey = `${strategy.algorithm}:${strategy.publicKey}`;
-    const cached = importedJwtPublicKeyCache.get(cacheKey);
-    if (cached !== undefined) {
-        return await cached;
-    }
-    const publicKeyPromise = importJwtPublicKey(strategy.publicKey, strategy.algorithm).catch((error) => {
-        importedJwtPublicKeyCache.delete(cacheKey);
-        throw error;
-    });
-    importedJwtPublicKeyCache.set(cacheKey, publicKeyPromise);
-    return await publicKeyPromise;
-}
-async function importJwtPublicKey(publicKey, algorithm) {
-    const trimmedKey = publicKey.trim();
-    if (trimmedKey.startsWith("{")) {
-        return await importJWK(JSON.parse(trimmedKey), algorithm);
-    }
-    return await importSPKI(trimmedKey, algorithm);
-}
+import{importJWK,importSPKI,jwtVerify}from"#compiled/jose/index.js";import{areTokenClaimMatchersSatisfied,createJwtAuthenticatedCallerPrincipal}from"#runtime/governance/auth/token-claims.js";var importedJwtPublicKeyCache=new Map;async function authenticateJwtEcdsaStrategy(e){let t;try{t=await getImportedJwtPublicKey(e.strategy)}catch(e){return{kind:`misconfigured`,message:`Failed to import JWT ECDSA public key. ${e instanceof Error?e.message:`Unknown key import failure.`}`}}try{let a=await jwtVerify(e.token,t,{algorithms:[e.strategy.algorithm],audience:[...e.strategy.audiences],clockTolerance:e.strategy.clockSkewSeconds,issuer:e.strategy.issuer});return typeof a.payload.sub!=`string`||a.payload.sub.length===0?{kind:`not-authenticated`}:areTokenClaimMatchersSatisfied(a.payload,e.strategy)?{kind:`authenticated`,principal:createJwtAuthenticatedCallerPrincipal({authenticator:`jwt-ecdsa`,payload:a.payload,principalType:`service`})}:{kind:`caller-not-allowed`}}catch{return{kind:`not-authenticated`}}}async function getImportedJwtPublicKey(e){let t=`${e.algorithm}:${e.publicKey}`,n=importedJwtPublicKeyCache.get(t);if(n!==void 0)return await n;let r=importJwtPublicKey(e.publicKey,e.algorithm).catch(e=>{throw importedJwtPublicKeyCache.delete(t),e});return importedJwtPublicKeyCache.set(t,r),await r}async function importJwtPublicKey(n,r){let i=n.trim();return i.startsWith(`{`)?await importJWK(JSON.parse(i),r):await importSPKI(i,r)}export{authenticateJwtEcdsaStrategy};

package/dist/src/runtime/governance/auth/jwt-hmac.js

@@ -1,39 +1 @@
-import { createSecretKey } from "node:crypto";
-import { jwtVerify } from "#compiled/jose/index.js";
-import { areTokenClaimMatchersSatisfied, createJwtAuthenticatedCallerPrincipal, } from "#runtime/governance/auth/token-claims.js";
-/**
- * Verifies one bearer token against a resolved HMAC JWT strategy.
- */
-export async function authenticateJwtHmacStrategy(input) {
-    try {
-        const verified = await jwtVerify(input.token, createSecretKey(Buffer.from(input.strategy.secret, "utf8")), {
-            algorithms: [input.strategy.algorithm],
-            audience: [...input.strategy.audiences],
-            clockTolerance: input.strategy.clockSkewSeconds,
-            issuer: input.strategy.issuer,
-        });
-        if (typeof verified.payload.sub !== "string" || verified.payload.sub.length === 0) {
-            return {
-                kind: "not-authenticated",
-            };
-        }
-        if (!areTokenClaimMatchersSatisfied(verified.payload, input.strategy)) {
-            return {
-                kind: "caller-not-allowed",
-            };
-        }
-        return {
-            kind: "authenticated",
-            principal: createJwtAuthenticatedCallerPrincipal({
-                authenticator: "jwt-hmac",
-                payload: verified.payload,
-                principalType: "service",
-            }),
-        };
-    }
-    catch {
-        return {
-            kind: "not-authenticated",
-        };
-    }
-}
+import{createSecretKey}from"node:crypto";import{jwtVerify}from"#compiled/jose/index.js";import{areTokenClaimMatchersSatisfied,createJwtAuthenticatedCallerPrincipal}from"#runtime/governance/auth/token-claims.js";async function authenticateJwtHmacStrategy(e){try{let t=await jwtVerify(e.token,createSecretKey(Buffer.from(e.strategy.secret,`utf8`)),{algorithms:[e.strategy.algorithm],audience:[...e.strategy.audiences],clockTolerance:e.strategy.clockSkewSeconds,issuer:e.strategy.issuer});return typeof t.payload.sub!=`string`||t.payload.sub.length===0?{kind:`not-authenticated`}:areTokenClaimMatchersSatisfied(t.payload,e.strategy)?{kind:`authenticated`,principal:createJwtAuthenticatedCallerPrincipal({authenticator:`jwt-hmac`,payload:t.payload,principalType:`service`})}:{kind:`caller-not-allowed`}}catch{return{kind:`not-authenticated`}}}export{authenticateJwtHmacStrategy};

package/dist/src/runtime/governance/auth/oidc.js

@@ -1,126 +1 @@
-import { createRemoteJWKSet, jwtVerify } from "#compiled/jose/index.js";
-import { z } from "#compiled/zod/index.js";
-import { areTokenClaimMatchersSatisfied, createJwtAuthenticatedCallerPrincipal, } from "#runtime/governance/auth/token-claims.js";
-const oidcDiscoveryDocumentSchema = z
-    .object({
-    issuer: z.string().optional(),
-    jwks_uri: z.string().url(),
-})
-    .passthrough();
-const oidcDiscoveryDocumentCache = new Map();
-const oidcJwksCache = new Map();
-/**
- * Verifies one bearer token against a resolved OIDC strategy.
- */
-export async function authenticateOidcStrategy(input) {
-    let remoteJwks;
-    try {
-        remoteJwks = await getOidcRemoteJwks(input.strategy);
-    }
-    catch (error) {
-        return {
-            kind: "misconfigured",
-            message: `Failed to load OIDC discovery metadata. ${error instanceof Error ? error.message : "Unknown discovery failure."}`,
-        };
-    }
-    try {
-        const verified = await jwtVerify(input.token, remoteJwks, {
-            audience: [...input.strategy.audiences],
-            clockTolerance: input.strategy.clockSkewSeconds,
-            issuer: input.strategy.issuer,
-        });
-        if (typeof verified.payload.sub !== "string" || verified.payload.sub.length === 0) {
-            return {
-                kind: "not-authenticated",
-            };
-        }
-        const isCurrentVercelProjectToken = input.strategy.acceptCurrentVercelProject &&
-            isCurrentVercelProject({
-                issuer: input.strategy.issuer,
-                payload: verified.payload,
-            });
-        const isCurrentVercelRuntimeToken = isCurrentVercelProjectToken && isCurrentVercelEnvironment({ payload: verified.payload });
-        if (!isCurrentVercelProjectToken &&
-            !areTokenClaimMatchersSatisfied(verified.payload, input.strategy)) {
-            return {
-                kind: "caller-not-allowed",
-            };
-        }
-        return {
-            kind: "authenticated",
-            principal: createJwtAuthenticatedCallerPrincipal({
-                authenticator: "oidc",
-                payload: verified.payload,
-                principalType: isCurrentVercelRuntimeToken ? "runtime" : "service",
-            }),
-        };
-    }
-    catch {
-        return {
-            kind: "not-authenticated",
-        };
-    }
-}
-async function getOidcRemoteJwks(strategy) {
-    const discoveryDocument = await getOidcDiscoveryDocument(strategy.discoveryUrl);
-    const existing = oidcJwksCache.get(discoveryDocument.jwks_uri);
-    if (existing !== undefined) {
-        return existing;
-    }
-    const remoteJwks = createRemoteJWKSet(new URL(discoveryDocument.jwks_uri));
-    oidcJwksCache.set(discoveryDocument.jwks_uri, remoteJwks);
-    return remoteJwks;
-}
-async function getOidcDiscoveryDocument(discoveryUrl) {
-    const cached = oidcDiscoveryDocumentCache.get(discoveryUrl);
-    if (cached !== undefined) {
-        return await cached;
-    }
-    const discoveryPromise = fetch(discoveryUrl, {
-        headers: {
-            accept: "application/json",
-        },
-    })
-        .then(async (response) => {
-        if (!response.ok) {
-            throw new Error(`Discovery route returned HTTP ${response.status}.`);
-        }
-        return oidcDiscoveryDocumentSchema.parse(await response.json());
-    })
-        .catch((error) => {
-        oidcDiscoveryDocumentCache.delete(discoveryUrl);
-        throw error;
-    });
-    oidcDiscoveryDocumentCache.set(discoveryUrl, discoveryPromise);
-    return await discoveryPromise;
-}
-/**
- * Returns whether a verified JWT was minted by Vercel OIDC for the
- * current Vercel project (any environment). Used by the verifier to
- * unconditionally accept tokens from the deployment's own project on
- * top of any author-supplied `subjects`/`claims` matchers.
- */
-function isCurrentVercelProject(input) {
-    if (!input.issuer.startsWith("https://oidc.vercel.com")) {
-        return false;
-    }
-    const currentProjectId = process.env.VERCEL_PROJECT_ID?.trim();
-    if (currentProjectId === undefined || currentProjectId.length === 0) {
-        return false;
-    }
-    return (typeof input.payload.project_id === "string" && input.payload.project_id === currentProjectId);
-}
-/**
- * Returns whether a verified JWT's `environment` claim matches the
- * current Vercel deployment environment. Combined with
- * {@link isCurrentVercelProject} to upgrade `principalType` from
- * `"service"` to `"runtime"` when the caller is the deployment itself.
- */
-function isCurrentVercelEnvironment(input) {
-    const currentEnvironment = (process.env.VERCEL_TARGET_ENV?.trim() ?? process.env.VERCEL_ENV?.trim())?.trim();
-    if (currentEnvironment === undefined || currentEnvironment.length === 0) {
-        return false;
-    }
-    return (typeof input.payload.environment === "string" &&
-        input.payload.environment === currentEnvironment);
-}
+import{z}from"#compiled/zod/index.js";import{createRemoteJWKSet,jwtVerify}from"#compiled/jose/index.js";import{areTokenClaimMatchersSatisfied,createJwtAuthenticatedCallerPrincipal}from"#runtime/governance/auth/token-claims.js";var oidcDiscoveryDocumentSchema=z.object({issuer:z.string().optional(),jwks_uri:z.string().url()}).passthrough(),oidcDiscoveryDocumentCache=new Map,oidcJwksCache=new Map;async function authenticateOidcStrategy(e){let t;try{t=await getOidcRemoteJwks(e.strategy)}catch(e){return{kind:`misconfigured`,message:`Failed to load OIDC discovery metadata. ${e instanceof Error?e.message:`Unknown discovery failure.`}`}}try{let a=await jwtVerify(e.token,t,{audience:[...e.strategy.audiences],clockTolerance:e.strategy.clockSkewSeconds,issuer:e.strategy.issuer});if(typeof a.payload.sub!=`string`||a.payload.sub.length===0)return{kind:`not-authenticated`};let o=e.strategy.acceptCurrentVercelProject&&isCurrentVercelProject({issuer:e.strategy.issuer,payload:a.payload}),s=o&&isCurrentVercelEnvironment({payload:a.payload});return!o&&!areTokenClaimMatchersSatisfied(a.payload,e.strategy)?{kind:`caller-not-allowed`}:{kind:`authenticated`,principal:createJwtAuthenticatedCallerPrincipal({authenticator:`oidc`,payload:a.payload,principalType:s?`runtime`:`service`})}}catch{return{kind:`not-authenticated`}}}async function getOidcRemoteJwks(e){let n=await getOidcDiscoveryDocument(e.discoveryUrl),r=oidcJwksCache.get(n.jwks_uri);if(r!==void 0)return r;let i=createRemoteJWKSet(new URL(n.jwks_uri));return oidcJwksCache.set(n.jwks_uri,i),i}async function getOidcDiscoveryDocument(e){let t=oidcDiscoveryDocumentCache.get(e);if(t!==void 0)return await t;let n=fetch(e,{headers:{accept:`application/json`}}).then(async e=>{if(!e.ok)throw Error(`Discovery route returned HTTP ${e.status}.`);return oidcDiscoveryDocumentSchema.parse(await e.json())}).catch(t=>{throw oidcDiscoveryDocumentCache.delete(e),t});return oidcDiscoveryDocumentCache.set(e,n),await n}function isCurrentVercelProject(e){if(!e.issuer.startsWith(`https://oidc.vercel.com`))return!1;let t=process.env.VERCEL_PROJECT_ID?.trim();return t===void 0||t.length===0?!1:typeof e.payload.project_id==`string`&&e.payload.project_id===t}function isCurrentVercelEnvironment(e){let t=(process.env.VERCEL_TARGET_ENV?.trim()??process.env.VERCEL_ENV?.trim())?.trim();return t===void 0||t.length===0?!1:typeof e.payload.environment==`string`&&e.payload.environment===t}export{authenticateOidcStrategy};

package/dist/src/runtime/governance/auth/token-claims.js

@@ -1,84 +1 @@
-const STANDARD_PROJECTED_CLAIM_KEYS = new Set(["aud", "exp", "iat", "iss", "jti", "nbf", "sub"]);
-/**
- * Returns the normalized string-valued JWT claim projection used by Ash's
- * runtime auth layer.
- */
-function normalizeJwtClaims(payload) {
-    const normalized = {};
-    for (const [key, value] of Object.entries(payload)) {
-        if (typeof value === "string") {
-            normalized[key] = value;
-            continue;
-        }
-        if (Array.isArray(value) && value.every((item) => typeof item === "string")) {
-            normalized[key] = Object.freeze([...value]);
-        }
-    }
-    return Object.freeze(normalized);
-}
-/**
- * Returns the non-standard string-valued JWT claim projection exposed as public
- * session auth attributes.
- */
-function createJwtAttributeProjection(payload) {
-    const claims = normalizeJwtClaims(payload);
-    return Object.freeze(Object.fromEntries(Object.entries(claims).filter(([key]) => !STANDARD_PROJECTED_CLAIM_KEYS.has(key))));
-}
-/**
- * Returns whether the verified JWT payload satisfies the authored subject and
- * claim selectors.
- */
-export function areTokenClaimMatchersSatisfied(payload, matchers) {
-    const normalizedClaims = normalizeJwtClaims(payload);
-    if (matchers.subjects !== undefined) {
-        const subject = typeof payload.sub === "string" ? payload.sub : null;
-        if (subject === null ||
-            !matchers.subjects.some((pattern) => matchesWildcardPattern(pattern, subject))) {
-            return false;
-        }
-    }
-    if (matchers.claims === undefined) {
-        return true;
-    }
-    return Object.entries(matchers.claims).every(([claimName, expectedValues]) => {
-        const claimValue = normalizedClaims[claimName];
-        if (claimValue === undefined) {
-            return false;
-        }
-        if (typeof claimValue === "string") {
-            return expectedValues.includes(claimValue);
-        }
-        return claimValue.some((value) => expectedValues.includes(value));
-    });
-}
-/**
- * Creates a normalized JWT-backed Ash principal from a verified payload.
- */
-export function createJwtAuthenticatedCallerPrincipal(input) {
-    const issuer = typeof input.payload.iss === "string" ? input.payload.iss : undefined;
-    const subject = typeof input.payload.sub === "string" ? input.payload.sub : undefined;
-    if (issuer === undefined || subject === undefined) {
-        throw new Error("Expected verified JWT payloads to include string iss and sub claims.");
-    }
-    const claims = normalizeJwtClaims(input.payload);
-    return {
-        attributes: createJwtAttributeProjection(input.payload),
-        authenticator: input.authenticator,
-        claims,
-        issuer,
-        principalId: `${issuer}:${subject}`,
-        principalType: input.principalType,
-        subject,
-    };
-}
-/**
- * Returns whether the value matches one AWS IAM-style whole-string wildcard
- * pattern where `*` matches zero or more characters.
- */
-function matchesWildcardPattern(pattern, value) {
-    if (!pattern.includes("*")) {
-        return pattern === value;
-    }
-    const escaped = pattern.replaceAll(/[.+?^${}()|[\]\\]/g, "\\$&").replaceAll("*", ".*");
-    return new RegExp(`^${escaped}$`).test(value);
-}
+var STANDARD_PROJECTED_CLAIM_KEYS=new Set([`aud`,`exp`,`iat`,`iss`,`jti`,`nbf`,`sub`]);function normalizeJwtClaims(e){let t={};for(let[n,r]of Object.entries(e)){if(typeof r==`string`){t[n]=r;continue}Array.isArray(r)&&r.every(e=>typeof e==`string`)&&(t[n]=Object.freeze([...r]))}return Object.freeze(t)}function createJwtAttributeProjection(t){let n=normalizeJwtClaims(t);return Object.freeze(Object.fromEntries(Object.entries(n).filter(([t])=>!STANDARD_PROJECTED_CLAIM_KEYS.has(t))))}function areTokenClaimMatchersSatisfied(e,t){let n=normalizeJwtClaims(e);if(t.subjects!==void 0){let n=typeof e.sub==`string`?e.sub:null;if(n===null||!t.subjects.some(e=>matchesWildcardPattern(e,n)))return!1}return t.claims===void 0?!0:Object.entries(t.claims).every(([e,t])=>{let r=n[e];return r===void 0?!1:typeof r==`string`?t.includes(r):r.some(e=>t.includes(e))})}function createJwtAuthenticatedCallerPrincipal(e){let t=typeof e.payload.iss==`string`?e.payload.iss:void 0,n=typeof e.payload.sub==`string`?e.payload.sub:void 0;if(t===void 0||n===void 0)throw Error(`Expected verified JWT payloads to include string iss and sub claims.`);let r=normalizeJwtClaims(e.payload);return{attributes:createJwtAttributeProjection(e.payload),authenticator:e.authenticator,claims:r,issuer:t,principalId:`${t}:${n}`,principalType:e.principalType,subject:n}}function matchesWildcardPattern(e,t){if(!e.includes(`*`))return e===t;let n=e.replaceAll(/[.+?^${}()|[\]\\]/g,`\\$&`).replaceAll(`*`,`.*`);return RegExp(`^${n}$`).test(t)}export{areTokenClaimMatchersSatisfied,createJwtAuthenticatedCallerPrincipal};

package/dist/src/runtime/governance/auth/types.js

@@ -1,14 +1 @@
-/**
- * Creates the session-auth projection persisted on runtime state and exposed to
- * authored `getSession()` calls.
- */
-export function createRuntimeSessionAuthContext(principal) {
-    return {
-        attributes: principal.attributes,
-        authenticator: principal.authenticator,
-        issuer: principal.issuer,
-        principalId: principal.principalId,
-        principalType: principal.principalType,
-        subject: principal.subject,
-    };
-}
+function createRuntimeSessionAuthContext(e){return{attributes:e.attributes,authenticator:e.authenticator,issuer:e.issuer,principalId:e.principalId,principalType:e.principalType,subject:e.subject}}export{createRuntimeSessionAuthContext};