managed-deepagents 0.6.2-dev.36 → 0.6.2-dev.37

package/dist/channels/trigger/identity-context.js

@@ -1,171 +0,0 @@
-/**
- * Verify Trigger Server `identity_context` JWTs into Agent Auth principal ids.
- *
- * Agent Auth signs these with the LangSmith EdDSA JWKS published at
- * `{LANGSMITH_ENDPOINT}/.well-known/jwks.json`. MDA verifies the signature
- * (and typ/version/aud/iss/exp/principal UUID) before stamping `x-mda-user-id`.
- * Delivery still requires Trigger's `x-service-key` header; signature verify is
- * what stops a forged principal when that gate is weak.
- */
-import { createRemoteJWKSet, decodeProtectedHeader, jwtVerify, } from "jose";
-import { JWKS_HTTP_TIMEOUT_MS } from "../../runtime/http.js";
-import { normalizeUuid } from "./uuid.js";
-export const IDENTITY_CONTEXT_TOKEN_TYP = "identity-context+jwt";
-export const IDENTITY_CONTEXT_AUDIENCE = "mda";
-export const IDENTITY_CONTEXT_VERSION = "1";
-export const IDENTITY_CONTEXT_ALGORITHMS = ["EdDSA"];
-const DEFAULT_LANGSMITH_ENDPOINT = "https://api.smith.langchain.com";
-/** Remote JWKS key sets, cached per URI for the process lifetime. */
-const jwksCache = new Map();
-export class InvalidIdentityContextError extends Error {
-    name = "InvalidIdentityContextError";
-    constructor(message) {
-        super(message);
-    }
-}
-/** JWKS / network failure while verifying identity_context. Callers should 5xx. */
-export class IdentityContextUnavailableError extends Error {
-    name = "IdentityContextUnavailableError";
-    constructor(message) {
-        super(message);
-    }
-}
-/** LangSmith API origin used as identity-context `iss` and JWKS host. */
-export function resolveIdentityContextIssuer(env = process.env) {
-    const raw = env.LANGSMITH_ENDPOINT?.trim() ||
-        env.LANGCHAIN_ENDPOINT?.trim() ||
-        DEFAULT_LANGSMITH_ENDPOINT;
-    return raw.replace(/\/+$/, "");
-}
-/** Public JWKS URL for Agent Auth identity-context signatures. */
-export function resolveIdentityContextJwksUrl(env = process.env) {
-    return `${resolveIdentityContextIssuer(env)}/.well-known/jwks.json`;
-}
-/**
- * Extract the Agent Auth principal UUID from a Trigger `identity_context` JWT.
- *
- * @throws {InvalidIdentityContextError} when the token is missing, malformed,
- *   or fails signature / claim checks.
- */
-export async function principalIdFromIdentityContext(token, options = {}) {
-    const value = token.trim();
-    if (!value) {
-        throw new InvalidIdentityContextError("identity_context is blank");
-    }
-    let header;
-    try {
-        header = decodeProtectedHeader(value);
-    }
-    catch {
-        throw new InvalidIdentityContextError("identity_context is not a JWT");
-    }
-    if (header.typ !== IDENTITY_CONTEXT_TOKEN_TYP) {
-        throw new InvalidIdentityContextError(`identity_context typ must be ${IDENTITY_CONTEXT_TOKEN_TYP}`);
-    }
-    if (header.alg !== "EdDSA") {
-        throw new InvalidIdentityContextError("identity_context alg must be EdDSA");
-    }
-    const env = options.env ?? process.env;
-    const issuer = options.issuer ?? resolveIdentityContextIssuer(env);
-    const getKey = options.getKey ?? remoteJwks(env);
-    let claims;
-    try {
-        const verified = await jwtVerify(value, getKey, {
-            issuer,
-            audience: IDENTITY_CONTEXT_AUDIENCE,
-            algorithms: [...IDENTITY_CONTEXT_ALGORITHMS],
-            typ: IDENTITY_CONTEXT_TOKEN_TYP,
-            requiredClaims: ["exp"],
-        });
-        claims = verified.payload;
-    }
-    catch (error) {
-        if (error instanceof InvalidIdentityContextError ||
-            error instanceof IdentityContextUnavailableError) {
-            throw error;
-        }
-        if (isIdentityContextUnavailable(error)) {
-            throw new IdentityContextUnavailableError("identity_context JWKS verification is unavailable");
-        }
-        const detail = error instanceof Error ? error.message : String(error);
-        const code = error && typeof error === "object" && "code" in error
-            ? String(error.code)
-            : "";
-        if (code === "ERR_JWT_EXPIRED" || /expir|"exp"|claim.*exp/i.test(detail)) {
-            throw new InvalidIdentityContextError("identity_context is expired");
-        }
-        if (code === "ERR_JWT_CLAIM_VALIDATION_FAILED" &&
-            /required.*exp|"exp"/i.test(detail)) {
-            throw new InvalidIdentityContextError("identity_context is missing exp");
-        }
-        throw new InvalidIdentityContextError("identity_context signature verification failed");
-    }
-    if (typeof claims.exp !== "number") {
-        throw new InvalidIdentityContextError("identity_context is missing exp");
-    }
-    if (claims.version !== IDENTITY_CONTEXT_VERSION) {
-        throw new InvalidIdentityContextError(`identity_context version must be ${IDENTITY_CONTEXT_VERSION}`);
-    }
-    const fromPrincipal = principalIdClaim(claims.principal);
-    const fromSubject = typeof claims.sub === "string" ? normalizeUuid(claims.sub) : undefined;
-    if (fromPrincipal && fromSubject && fromPrincipal !== fromSubject) {
-        throw new InvalidIdentityContextError("identity_context principal.id and sub disagree");
-    }
-    const principalId = fromPrincipal ?? fromSubject;
-    if (!principalId) {
-        throw new InvalidIdentityContextError("identity_context is missing a principal UUID");
-    }
-    return principalId;
-}
-/** Resolve a principal id from an optional event field; `undefined` when absent. */
-export async function optionalPrincipalIdFromIdentityContext(token, options = {}) {
-    if (token == null) {
-        return undefined;
-    }
-    if (typeof token !== "string") {
-        throw new InvalidIdentityContextError("identity_context must be a string");
-    }
-    if (!token.trim()) {
-        return undefined;
-    }
-    return await principalIdFromIdentityContext(token, options);
-}
-function isIdentityContextUnavailable(error) {
-    if (error instanceof TypeError) {
-        return true;
-    }
-    const code = error && typeof error === "object" && "code" in error
-        ? String(error.code)
-        : "";
-    if (code === "ERR_JWKS_TIMEOUT" || code === "ABORT_ERR") {
-        return true;
-    }
-    const name = error && typeof error === "object" && "name" in error
-        ? String(error.name)
-        : "";
-    if (name === "TimeoutError" || name === "JWKSTimeout") {
-        return true;
-    }
-    if (error instanceof Error) {
-        return /fetch failed|ECONNREFUSED|ENOTFOUND|network|timed out/i.test(error.message);
-    }
-    return false;
-}
-function remoteJwks(env) {
-    const uri = resolveIdentityContextJwksUrl(env);
-    let keySet = jwksCache.get(uri);
-    if (!keySet) {
-        keySet = createRemoteJWKSet(new URL(uri), {
-            timeoutDuration: JWKS_HTTP_TIMEOUT_MS,
-        });
-        jwksCache.set(uri, keySet);
-    }
-    return keySet;
-}
-function principalIdClaim(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value)) {
-        return undefined;
-    }
-    return normalizeUuid(value.id);
-}
-//# sourceMappingURL=identity-context.js.map

package/dist/channels/trigger/identity-context.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity-context.js","sourceRoot":"","sources":["../../../src/channels/trigger/identity-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,SAAS,GAEV,MAAM,MAAM,CAAC;AAEd,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AACjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAC/C,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAC5C,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,OAAO,CAAU,CAAC;AAE9D,MAAM,0BAA0B,GAAG,iCAAiC,CAAC;AAIrE,qEAAqE;AACrE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAC;AAElD,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3C,IAAI,GAAG,6BAA6B,CAAC;IAE9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAC/C,IAAI,GAAG,iCAAiC,CAAC;IAElD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAaD,yEAAyE;AACzE,MAAM,UAAU,4BAA4B,CAC1C,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GACP,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QAC9B,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QAC9B,0BAA0B,CAAC;IAC7B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,6BAA6B,CAC3C,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,GAAG,4BAA4B,CAAC,GAAG,CAAC,wBAAwB,CAAC;AACtE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAa,EACb,OAAO,GAAiC,EAAE;IAE1C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,2BAA2B,CAAC,2BAA2B,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,MAAgD,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,2BAA2B,CAAC,+BAA+B,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,KAAK,0BAA0B,EAAE,CAAC;QAC9C,MAAM,IAAI,2BAA2B,CACnC,gCAAgC,0BAA0B,EAAE,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,2BAA2B,CAAC,oCAAoC,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAEjD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE;YAC9C,MAAM;YACN,QAAQ,EAAE,yBAAyB;YACnC,UAAU,EAAE,CAAC,GAAG,2BAA2B,CAAC;YAC5C,GAAG,EAAE,0BAA0B;YAC/B,cAAc,EAAE,CAAC,KAAK,CAAC;SACxB,CAAC,CAAC;QACH,MAAM,GAAG,QAAQ,CAAC,OAAkC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,2BAA2B;YAC5C,KAAK,YAAY,+BAA+B,EAChD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,+BAA+B,CACvC,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,GACR,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK;YACnD,CAAC,CAAC,MAAM,CAAE,KAA4B,CAAC,IAAI,CAAC;YAC5C,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,IAAI,KAAK,iBAAiB,IAAI,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,2BAA2B,CAAC,6BAA6B,CAAC,CAAC;QACvE,CAAC;QACD,IACE,IAAI,KAAK,iCAAiC;YAC1C,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,EACnC,CAAC;YACD,MAAM,IAAI,2BAA2B,CAAC,iCAAiC,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,IAAI,2BAA2B,CACnC,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,2BAA2B,CAAC,iCAAiC,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,KAAK,wBAAwB,EAAE,CAAC;QAChD,MAAM,IAAI,2BAA2B,CACnC,oCAAoC,wBAAwB,EAAE,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,WAAW,GACf,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,IAAI,aAAa,IAAI,WAAW,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;QAClE,MAAM,IAAI,2BAA2B,CACnC,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,aAAa,IAAI,WAAW,CAAC;IACjD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,2BAA2B,CACnC,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAAgC,EAChC,OAAO,GAAiC,EAAE;IAE1C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,2BAA2B,CAAC,mCAAmC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,8BAA8B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAc;IAClD,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GACR,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK;QACnD,CAAC,CAAC,MAAM,CAAE,KAA4B,CAAC,IAAI,CAAC;QAC5C,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,IAAI,KAAK,kBAAkB,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GACR,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK;QACnD,CAAC,CAAC,MAAM,CAAE,KAA4B,CAAC,IAAI,CAAC;QAC5C,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,wDAAwD,CAAC,IAAI,CAClE,KAAK,CAAC,OAAO,CACd,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,GAAsB;IACxC,MAAM,GAAG,GAAG,6BAA6B,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE;YACxC,eAAe,EAAE,oBAAoB;SACtC,CAAC,CAAC;QACH,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,aAAa,CAAE,KAA0B,CAAC,EAAE,CAAC,CAAC;AACvD,CAAC"}