within-enforcement-sdk 1.1.2 → 1.1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/enforcement.d.ts +10 -10
- package/dist/enforcement.d.ts.map +1 -1
- package/dist/enforcement.js +127 -118
- package/dist/enforcement.js.map +1 -1
- package/dist/index.d.ts +1 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/types.d.ts +23 -7
- package/dist/types.d.ts.map +1 -1
- package/package.json +1 -1
package/dist/enforcement.d.ts
CHANGED
|
@@ -8,21 +8,21 @@ import type { EnforcementConfig, Enforcement } from './types.js';
|
|
|
8
8
|
* vendorId: 'my-vendor',
|
|
9
9
|
* apiUrl: 'https://within-actions.onrender.com',
|
|
10
10
|
* apiKey: process.env.WITHIN_API_KEY,
|
|
11
|
-
* toolScopeMap: {
|
|
12
|
-
*
|
|
13
|
-
*
|
|
14
|
-
*
|
|
15
|
-
*
|
|
16
|
-
*
|
|
17
|
-
*
|
|
18
|
-
*
|
|
11
|
+
* toolScopeMap: { search: 'data:read' },
|
|
12
|
+
* });
|
|
13
|
+
*
|
|
14
|
+
* // Create a session per connection (carries claims, IP, agent info):
|
|
15
|
+
* const session = within.createSession({
|
|
16
|
+
* claims,
|
|
17
|
+
* ipAddress: req.ip,
|
|
18
|
+
* agentClientName: 'Claude Desktop',
|
|
19
19
|
* });
|
|
20
20
|
*
|
|
21
21
|
* // In your tool handler:
|
|
22
|
-
* const decision = await
|
|
22
|
+
* const decision = await session.authorize('search');
|
|
23
23
|
* if (!decision.allowed) return `Access denied: ${decision.reason}`;
|
|
24
24
|
* // ... run tool ...
|
|
25
|
-
* await
|
|
25
|
+
* await session.complete('search', 'success', { toolArguments: { query } });
|
|
26
26
|
* ```
|
|
27
27
|
*/
|
|
28
28
|
export declare function createEnforcement(config: EnforcementConfig): Enforcement;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"enforcement.d.ts","sourceRoot":"","sources":["../src/enforcement.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,
|
|
1
|
+
{"version":3,"file":"enforcement.d.ts","sourceRoot":"","sources":["../src/enforcement.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EASjB,WAAW,EACZ,MAAM,YAAY,CAAC;AA6CpB;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,WAAW,CA6KxE"}
|
package/dist/enforcement.js
CHANGED
|
@@ -43,21 +43,21 @@ function interpolateTemplate(template, ctx) {
|
|
|
43
43
|
* vendorId: 'my-vendor',
|
|
44
44
|
* apiUrl: 'https://within-actions.onrender.com',
|
|
45
45
|
* apiKey: process.env.WITHIN_API_KEY,
|
|
46
|
-
* toolScopeMap: {
|
|
47
|
-
*
|
|
48
|
-
*
|
|
49
|
-
*
|
|
50
|
-
*
|
|
51
|
-
*
|
|
52
|
-
*
|
|
53
|
-
*
|
|
46
|
+
* toolScopeMap: { search: 'data:read' },
|
|
47
|
+
* });
|
|
48
|
+
*
|
|
49
|
+
* // Create a session per connection (carries claims, IP, agent info):
|
|
50
|
+
* const session = within.createSession({
|
|
51
|
+
* claims,
|
|
52
|
+
* ipAddress: req.ip,
|
|
53
|
+
* agentClientName: 'Claude Desktop',
|
|
54
54
|
* });
|
|
55
55
|
*
|
|
56
56
|
* // In your tool handler:
|
|
57
|
-
* const decision = await
|
|
57
|
+
* const decision = await session.authorize('search');
|
|
58
58
|
* if (!decision.allowed) return `Access denied: ${decision.reason}`;
|
|
59
59
|
* // ... run tool ...
|
|
60
|
-
* await
|
|
60
|
+
* await session.complete('search', 'success', { toolArguments: { query } });
|
|
61
61
|
* ```
|
|
62
62
|
*/
|
|
63
63
|
export function createEnforcement(config) {
|
|
@@ -70,133 +70,142 @@ export function createEnforcement(config) {
|
|
|
70
70
|
return interpolateTemplate(override, ctx);
|
|
71
71
|
return DEFAULT_MESSAGES[event](ctx);
|
|
72
72
|
}
|
|
73
|
-
|
|
74
|
-
const
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
73
|
+
function stripNulls(obj) {
|
|
74
|
+
const out = {};
|
|
75
|
+
for (const [k, v] of Object.entries(obj)) {
|
|
76
|
+
if (v !== null && v !== undefined)
|
|
77
|
+
out[k] = v;
|
|
78
78
|
}
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
event: 'scopeDenied',
|
|
90
|
-
message: resolveMessage('scopeDenied', ctx),
|
|
91
|
-
};
|
|
79
|
+
return out;
|
|
80
|
+
}
|
|
81
|
+
function createSession(sessionConfig) {
|
|
82
|
+
const { claims, agentClientName, ipAddress } = sessionConfig;
|
|
83
|
+
let agentSessionId = sessionConfig.agentSessionId;
|
|
84
|
+
async function authorize(toolName) {
|
|
85
|
+
const userType = claims['https://within.com/user_type'];
|
|
86
|
+
// Customers pass straight through — Within is not involved
|
|
87
|
+
if (userType === 'customer') {
|
|
88
|
+
return { allowed: true, bypassed: true };
|
|
92
89
|
}
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
90
|
+
const name = vendorName ?? vendorId;
|
|
91
|
+
// Scope check (from token, no network call)
|
|
92
|
+
const requiredScope = toolScopeMap[toolName];
|
|
93
|
+
if (requiredScope) {
|
|
94
|
+
const userScopes = claims['https://within.com/scopes'] ?? [];
|
|
95
|
+
if (!userScopes.includes(requiredScope)) {
|
|
96
|
+
const ctx = { toolName, remaining: 0, limit: 0, used: 0, vendorName: name, upgradeUrl };
|
|
97
|
+
return {
|
|
98
|
+
allowed: false,
|
|
99
|
+
reason: 'scope_denied',
|
|
100
|
+
event: 'scopeDenied',
|
|
101
|
+
message: resolveMessage('scopeDenied', ctx),
|
|
102
|
+
};
|
|
103
|
+
}
|
|
103
104
|
}
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
105
|
+
// Quota check (live, hits the ledger)
|
|
106
|
+
const email = claims.email;
|
|
107
|
+
if (!email) {
|
|
108
|
+
return { allowed: false, reason: 'no_entitlement' };
|
|
107
109
|
}
|
|
108
|
-
|
|
110
|
+
try {
|
|
111
|
+
const res = await fetch(`${apiUrl}/api/ledger/${encodeURIComponent(email)}?vendor_id=${vendorId}`, { headers: { Authorization: `Bearer ${apiKey}` } });
|
|
112
|
+
if (!res.ok) {
|
|
113
|
+
return { allowed: false, reason: 'no_entitlement' };
|
|
114
|
+
}
|
|
115
|
+
const ledger = (await res.json());
|
|
116
|
+
if (!ledger.isActive) {
|
|
117
|
+
return { allowed: false, reason: 'inactive' };
|
|
118
|
+
}
|
|
119
|
+
if (ledger.quotaRemaining <= 0) {
|
|
120
|
+
const ctx = {
|
|
121
|
+
toolName,
|
|
122
|
+
remaining: 0,
|
|
123
|
+
limit: ledger.quotaLimit,
|
|
124
|
+
used: ledger.quotaLimit,
|
|
125
|
+
vendorName: name,
|
|
126
|
+
upgradeUrl,
|
|
127
|
+
};
|
|
128
|
+
return {
|
|
129
|
+
allowed: false,
|
|
130
|
+
reason: 'quota_exceeded',
|
|
131
|
+
event: 'quotaExhausted',
|
|
132
|
+
quotaRemaining: 0,
|
|
133
|
+
quotaLimit: ledger.quotaLimit,
|
|
134
|
+
message: resolveMessage('quotaExhausted', ctx),
|
|
135
|
+
};
|
|
136
|
+
}
|
|
137
|
+
// Allowed — determine which usage event to fire
|
|
138
|
+
const left = ledger.quotaRemaining - 1;
|
|
139
|
+
const used = ledger.quotaLimit - ledger.quotaRemaining + 1;
|
|
109
140
|
const ctx = {
|
|
110
141
|
toolName,
|
|
111
|
-
remaining:
|
|
142
|
+
remaining: left,
|
|
112
143
|
limit: ledger.quotaLimit,
|
|
113
|
-
used
|
|
144
|
+
used,
|
|
114
145
|
vendorName: name,
|
|
115
146
|
upgradeUrl,
|
|
116
147
|
};
|
|
148
|
+
let event;
|
|
149
|
+
if (left > 2) {
|
|
150
|
+
event = 'quotaLow';
|
|
151
|
+
}
|
|
152
|
+
else if (left > 0) {
|
|
153
|
+
event = 'runningLow';
|
|
154
|
+
}
|
|
155
|
+
else {
|
|
156
|
+
event = 'lastCall';
|
|
157
|
+
}
|
|
117
158
|
return {
|
|
118
|
-
allowed:
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
quotaRemaining: 0,
|
|
159
|
+
allowed: true,
|
|
160
|
+
event,
|
|
161
|
+
quotaRemaining: ledger.quotaRemaining,
|
|
122
162
|
quotaLimit: ledger.quotaLimit,
|
|
123
|
-
message: resolveMessage(
|
|
163
|
+
message: resolveMessage(event, ctx),
|
|
124
164
|
};
|
|
125
165
|
}
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
const ctx = {
|
|
130
|
-
toolName,
|
|
131
|
-
remaining: left,
|
|
132
|
-
limit: ledger.quotaLimit,
|
|
133
|
-
used,
|
|
134
|
-
vendorName: name,
|
|
135
|
-
upgradeUrl,
|
|
136
|
-
};
|
|
137
|
-
let event;
|
|
138
|
-
if (left > 2) {
|
|
139
|
-
event = 'quotaLow';
|
|
166
|
+
catch {
|
|
167
|
+
// Network error — fail closed
|
|
168
|
+
return { allowed: false, reason: 'no_entitlement' };
|
|
140
169
|
}
|
|
141
|
-
|
|
142
|
-
|
|
170
|
+
}
|
|
171
|
+
async function complete(toolName, outcome, opts) {
|
|
172
|
+
const userType = claims['https://within.com/user_type'];
|
|
173
|
+
// No-op for customers
|
|
174
|
+
if (userType === 'customer')
|
|
175
|
+
return;
|
|
176
|
+
const email = claims.email;
|
|
177
|
+
if (!email)
|
|
178
|
+
return;
|
|
179
|
+
const toolArguments = opts?.toolArguments ? stripNulls(opts.toolArguments) : undefined;
|
|
180
|
+
try {
|
|
181
|
+
await fetch(`${apiUrl}/api/usage`, {
|
|
182
|
+
method: 'POST',
|
|
183
|
+
headers: {
|
|
184
|
+
'Content-Type': 'application/json',
|
|
185
|
+
Authorization: `Bearer ${apiKey}`,
|
|
186
|
+
},
|
|
187
|
+
body: JSON.stringify({
|
|
188
|
+
vendor_id: vendorId,
|
|
189
|
+
email,
|
|
190
|
+
domain: claims['https://within.com/domain'],
|
|
191
|
+
tool_name: toolName,
|
|
192
|
+
outcome,
|
|
193
|
+
agent_session_id: agentSessionId,
|
|
194
|
+
agent_client_name: agentClientName,
|
|
195
|
+
ip_address: ipAddress,
|
|
196
|
+
tool_arguments: toolArguments,
|
|
197
|
+
}),
|
|
198
|
+
});
|
|
143
199
|
}
|
|
144
|
-
|
|
145
|
-
|
|
200
|
+
catch {
|
|
201
|
+
// Fire-and-forget — don't break the tool call if metering fails
|
|
146
202
|
}
|
|
147
|
-
return {
|
|
148
|
-
allowed: true,
|
|
149
|
-
event,
|
|
150
|
-
quotaRemaining: ledger.quotaRemaining,
|
|
151
|
-
quotaLimit: ledger.quotaLimit,
|
|
152
|
-
message: resolveMessage(event, ctx),
|
|
153
|
-
};
|
|
154
|
-
}
|
|
155
|
-
catch {
|
|
156
|
-
// Network error — fail closed
|
|
157
|
-
return { allowed: false, reason: 'no_entitlement' };
|
|
158
|
-
}
|
|
159
|
-
}
|
|
160
|
-
function stripNulls(obj) {
|
|
161
|
-
const out = {};
|
|
162
|
-
for (const [k, v] of Object.entries(obj)) {
|
|
163
|
-
if (v !== null && v !== undefined)
|
|
164
|
-
out[k] = v;
|
|
165
|
-
}
|
|
166
|
-
return out;
|
|
167
|
-
}
|
|
168
|
-
async function complete(toolName, claims, outcome, opts) {
|
|
169
|
-
const userType = claims['https://within.com/user_type'];
|
|
170
|
-
// No-op for customers
|
|
171
|
-
if (userType === 'customer')
|
|
172
|
-
return;
|
|
173
|
-
const email = claims.email;
|
|
174
|
-
if (!email)
|
|
175
|
-
return;
|
|
176
|
-
const toolArguments = opts?.toolArguments ? stripNulls(opts.toolArguments) : undefined;
|
|
177
|
-
try {
|
|
178
|
-
await fetch(`${apiUrl}/api/usage`, {
|
|
179
|
-
method: 'POST',
|
|
180
|
-
headers: {
|
|
181
|
-
'Content-Type': 'application/json',
|
|
182
|
-
Authorization: `Bearer ${apiKey}`,
|
|
183
|
-
},
|
|
184
|
-
body: JSON.stringify({
|
|
185
|
-
vendor_id: vendorId,
|
|
186
|
-
email,
|
|
187
|
-
domain: claims['https://within.com/domain'],
|
|
188
|
-
tool_name: toolName,
|
|
189
|
-
outcome,
|
|
190
|
-
agent_session_id: opts?.agentSessionId,
|
|
191
|
-
latency_ms: opts?.latencyMs,
|
|
192
|
-
tool_arguments: toolArguments,
|
|
193
|
-
}),
|
|
194
|
-
});
|
|
195
203
|
}
|
|
196
|
-
|
|
197
|
-
|
|
204
|
+
function setSessionId(id) {
|
|
205
|
+
agentSessionId = id;
|
|
198
206
|
}
|
|
207
|
+
return { authorize, complete, setSessionId };
|
|
199
208
|
}
|
|
200
|
-
return {
|
|
209
|
+
return { createSession };
|
|
201
210
|
}
|
|
202
211
|
//# sourceMappingURL=enforcement.js.map
|
package/dist/enforcement.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"enforcement.js","sourceRoot":"","sources":["../src/enforcement.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"enforcement.js","sourceRoot":"","sources":["../src/enforcement.ts"],"names":[],"mappings":"AAaA,MAAM,gBAAgB,GAAuD;IAC3E,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAChB,6DAA6D,GAAG,CAAC,UAAU,yBAAyB,GAAG,CAAC,QAAQ,WAAW,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,KAAK,qBAAqB,GAAG,CAAC,SAAS,iFAAiF;IAExQ,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;QAClB,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU;YAC5B,CAAC,CAAC,6BAA6B,GAAG,CAAC,UAAU,cAAc;YAC3D,CAAC,CAAC,+BAA+B,GAAG,CAAC,UAAU,cAAc,CAAC;QAChE,OAAO,6EAA6E,GAAG,CAAC,UAAU,yBAAyB,GAAG,CAAC,QAAQ,YAAY,GAAG,CAAC,SAAS,QAAQ,GAAG,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,qBAAqB,GAAG,CAAC,KAAK,mFAAmF,OAAO,EAAE,CAAC;IACnU,CAAC;IAED,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;QAChB,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU;YAC5B,CAAC,CAAC,+CAA+C,GAAG,CAAC,UAAU,EAAE;YACjE,CAAC,CAAC,+BAA+B,GAAG,CAAC,UAAU,yBAAyB,CAAC;QAC3E,OAAO,mCAAmC,GAAG,CAAC,QAAQ,2CAA2C,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,wIAAwI,OAAO,EAAE,CAAC;IAC9R,CAAC;IAED,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU;YAC5B,CAAC,CAAC,iDAAiD,GAAG,CAAC,UAAU,EAAE;YACnE,CAAC,CAAC,mCAAmC,GAAG,CAAC,UAAU,yBAAyB,CAAC;QAC/E,OAAO,yDAAyD,GAAG,CAAC,QAAQ,kDAAkD,GAAG,CAAC,UAAU,+CAA+C,OAAO,EAAE,CAAC;IACvM,CAAC;IAED,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE;QACnB,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU;YAC5B,CAAC,CAAC,gDAAgD,GAAG,CAAC,UAAU,EAAE;YAClE,CAAC,CAAC,8CAA8C,GAAG,CAAC,UAAU,cAAc,CAAC;QAC/E,OAAO,mCAAmC,GAAG,CAAC,QAAQ,wEAAwE,GAAG,CAAC,UAAU,uEAAuE,OAAO,EAAE,CAAC;IAC/N,CAAC;CACF,CAAC;AAEF,SAAS,mBAAmB,CAAC,QAAgB,EAAE,GAAmB;IAChE,OAAO,QAAQ;SACZ,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,QAAQ,CAAC;SAC1C,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;SACpD,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;SAC5C,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SAC1C,OAAO,CAAC,qBAAqB,EAAE,GAAG,CAAC,UAAU,CAAC;SAC9C,OAAO,CAAC,qBAAqB,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAyB;IACzD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;IAEjG,SAAS,cAAc,CAAC,KAAgB,EAAE,GAAmB;QAC3D,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,OAAO,QAAQ,KAAK,UAAU;YAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzD,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC5E,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,SAAS,UAAU,CAAC,GAA4B;QAC9C,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,SAAS,aAAa,CAAC,aAA4B;QACjD,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC;QAC7D,IAAI,cAAc,GAAG,aAAa,CAAC,cAAc,CAAC;QAElD,KAAK,UAAU,SAAS,CAAC,QAAgB;YACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,8BAA8B,CAAC,CAAC;YAExD,2DAA2D;YAC3D,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAC3C,CAAC;YAED,MAAM,IAAI,GAAG,UAAU,IAAI,QAAQ,CAAC;YAEpC,4CAA4C;YAC5C,MAAM,aAAa,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,UAAU,GAAG,MAAM,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC;gBAC7D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;oBACxC,MAAM,GAAG,GAAmB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;oBACxG,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,cAAc;wBACtB,KAAK,EAAE,aAAa;wBACpB,OAAO,EAAE,cAAc,CAAC,aAAa,EAAE,GAAG,CAAC;qBAC5C,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,sCAAsC;YACtC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;YACtD,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,MAAM,eAAe,kBAAkB,CAAC,KAAK,CAAC,cAAc,QAAQ,EAAE,EACzE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,CACnD,CAAC;gBAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;gBACtD,CAAC;gBAED,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI/B,CAAC;gBAEF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;gBAChD,CAAC;gBAED,IAAI,MAAM,CAAC,cAAc,IAAI,CAAC,EAAE,CAAC;oBAC/B,MAAM,GAAG,GAAmB;wBAC1B,QAAQ;wBACR,SAAS,EAAE,CAAC;wBACZ,KAAK,EAAE,MAAM,CAAC,UAAU;wBACxB,IAAI,EAAE,MAAM,CAAC,UAAU;wBACvB,UAAU,EAAE,IAAI;wBAChB,UAAU;qBACX,CAAC;oBACF,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,gBAAgB;wBACxB,KAAK,EAAE,gBAAgB;wBACvB,cAAc,EAAE,CAAC;wBACjB,UAAU,EAAE,MAAM,CAAC,UAAU;wBAC7B,OAAO,EAAE,cAAc,CAAC,gBAAgB,EAAE,GAAG,CAAC;qBAC/C,CAAC;gBACJ,CAAC;gBAED,gDAAgD;gBAChD,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,GAAG,CAAC,CAAC;gBACvC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,cAAc,GAAG,CAAC,CAAC;gBAC3D,MAAM,GAAG,GAAmB;oBAC1B,QAAQ;oBACR,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,MAAM,CAAC,UAAU;oBACxB,IAAI;oBACJ,UAAU,EAAE,IAAI;oBAChB,UAAU;iBACX,CAAC;gBAEF,IAAI,KAAgB,CAAC;gBACrB,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;oBACb,KAAK,GAAG,UAAU,CAAC;gBACrB,CAAC;qBAAM,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;oBACpB,KAAK,GAAG,YAAY,CAAC;gBACvB,CAAC;qBAAM,CAAC;oBACN,KAAK,GAAG,UAAU,CAAC;gBACrB,CAAC;gBAED,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,KAAK;oBACL,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,OAAO,EAAE,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC;iBACpC,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,8BAA8B;gBAC9B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;YACtD,CAAC;QACH,CAAC;QAED,KAAK,UAAU,QAAQ,CACrB,QAAgB,EAChB,OAAgB,EAChB,IAAsB;YAEtB,MAAM,QAAQ,GAAG,MAAM,CAAC,8BAA8B,CAAC,CAAC;YAExD,sBAAsB;YACtB,IAAI,QAAQ,KAAK,UAAU;gBAAE,OAAO;YAEpC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC3B,IAAI,CAAC,KAAK;gBAAE,OAAO;YAEnB,MAAM,aAAa,GAAG,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAEvF,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,GAAG,MAAM,YAAY,EAAE;oBACjC,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;qBAClC;oBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,SAAS,EAAE,QAAQ;wBACnB,KAAK;wBACL,MAAM,EAAE,MAAM,CAAC,2BAA2B,CAAC;wBAC3C,SAAS,EAAE,QAAQ;wBACnB,OAAO;wBACP,gBAAgB,EAAE,cAAc;wBAChC,iBAAiB,EAAE,eAAe;wBAClC,UAAU,EAAE,SAAS;wBACrB,cAAc,EAAE,aAAa;qBAC9B,CAAC;iBACH,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;YAClE,CAAC;QACH,CAAC;QAED,SAAS,YAAY,CAAC,EAAU;YAC9B,cAAc,GAAG,EAAE,CAAC;QACtB,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC/C,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,CAAC;AAC3B,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -1,3 +1,3 @@
|
|
|
1
1
|
export { createEnforcement } from './enforcement.js';
|
|
2
|
-
export type { EnforcementConfig, WithinClaims, AuthorizeResult, DenialReason, EventName, MessageContext, Outcome, CompleteOptions, Enforcement, } from './types.js';
|
|
2
|
+
export type { EnforcementConfig, WithinClaims, AuthorizeResult, DenialReason, EventName, MessageContext, Outcome, CompleteOptions, SessionConfig, EnforcementSession, Enforcement, } from './types.js';
|
|
3
3
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,YAAY,EACV,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,SAAS,EACT,cAAc,EACd,OAAO,EACP,eAAe,EACf,WAAW,GACZ,MAAM,YAAY,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,YAAY,EACV,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,SAAS,EACT,cAAc,EACd,OAAO,EACP,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,WAAW,GACZ,MAAM,YAAY,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -72,21 +72,32 @@ export interface AuthorizeResult {
|
|
|
72
72
|
export type DenialReason = 'scope_denied' | 'quota_exceeded' | 'inactive' | 'no_entitlement';
|
|
73
73
|
/** Options for the complete() call. */
|
|
74
74
|
export interface CompleteOptions {
|
|
75
|
-
agentSessionId?: string;
|
|
76
|
-
latencyMs?: number;
|
|
77
75
|
/** Tool call arguments — captures what the agent passed to the tool for intent analysis. */
|
|
78
76
|
toolArguments?: Record<string, unknown>;
|
|
79
77
|
}
|
|
80
78
|
export type Outcome = 'success' | 'failure' | 'quota_exceeded' | 'scope_denied';
|
|
81
|
-
/**
|
|
82
|
-
export interface
|
|
79
|
+
/** Configuration for creating a session. */
|
|
80
|
+
export interface SessionConfig {
|
|
81
|
+
/** JWT claims from the authenticated user. */
|
|
82
|
+
claims: WithinClaims;
|
|
83
|
+
/** MCP transport session ID. */
|
|
84
|
+
agentSessionId?: string;
|
|
85
|
+
/** Name of the agent client (e.g. "Claude Desktop", "ChatGPT"). */
|
|
86
|
+
agentClientName?: string;
|
|
87
|
+
/** IP address of the connecting client. */
|
|
88
|
+
ipAddress?: string;
|
|
89
|
+
}
|
|
90
|
+
/** A session-scoped enforcement handle. Carries claims and context automatically. */
|
|
91
|
+
export interface EnforcementSession {
|
|
92
|
+
/** Set the agent session ID after transport initialization. */
|
|
93
|
+
setSessionId(id: string): void;
|
|
83
94
|
/**
|
|
84
|
-
* Check if a tool call is allowed for
|
|
95
|
+
* Check if a tool call is allowed for this session's user.
|
|
85
96
|
*
|
|
86
97
|
* - Customers: always allowed, no network calls.
|
|
87
98
|
* - Prospects: scope check (from token) + quota check (live, hits Within API).
|
|
88
99
|
*/
|
|
89
|
-
authorize(toolName: string
|
|
100
|
+
authorize(toolName: string): Promise<AuthorizeResult>;
|
|
90
101
|
/**
|
|
91
102
|
* Report the outcome of a tool call.
|
|
92
103
|
*
|
|
@@ -94,6 +105,11 @@ export interface Enforcement {
|
|
|
94
105
|
* - Prospects: records usage. Only 'success' increments quota.
|
|
95
106
|
* Fire-and-forget — never throws.
|
|
96
107
|
*/
|
|
97
|
-
complete(toolName: string,
|
|
108
|
+
complete(toolName: string, outcome: Outcome, opts?: CompleteOptions): Promise<void>;
|
|
109
|
+
}
|
|
110
|
+
/** The enforcement instance returned by createEnforcement(). */
|
|
111
|
+
export interface Enforcement {
|
|
112
|
+
/** Create a session-scoped handle that carries claims and context automatically. */
|
|
113
|
+
createSession(config: SessionConfig): EnforcementSession;
|
|
98
114
|
}
|
|
99
115
|
//# sourceMappingURL=types.d.ts.map
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,YAAY,GAAG,UAAU,GAAG,gBAAgB,GAAG,aAAa,CAAC;AAElG,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,6CAA6C;AAC7C,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IAEjB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IAEf,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IAEf;;;;;;;;;;OAUG;IACH,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAErC,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC;CACxF;AAED,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8BAA8B,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;IACtE,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAC;IACvC,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,wCAAwC;AACxC,MAAM,WAAW,eAAe;IAC9B,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,yCAAyC;IACzC,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,yDAAyD;IACzD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,YAAY,GACpB,cAAc,GACd,gBAAgB,GAChB,UAAU,GACV,gBAAgB,CAAC;AAErB,uCAAuC;AACvC,MAAM,WAAW,eAAe;IAC9B,
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,YAAY,GAAG,UAAU,GAAG,gBAAgB,GAAG,aAAa,CAAC;AAElG,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,6CAA6C;AAC7C,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IAEjB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IAEf,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IAEf;;;;;;;;;;OAUG;IACH,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAErC,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC;CACxF;AAED,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8BAA8B,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;IACtE,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAC;IACvC,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,wCAAwC;AACxC,MAAM,WAAW,eAAe;IAC9B,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,yCAAyC;IACzC,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,yDAAyD;IACzD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,YAAY,GACpB,cAAc,GACd,gBAAgB,GAChB,UAAU,GACV,gBAAgB,CAAC;AAErB,uCAAuC;AACvC,MAAM,WAAW,eAAe;IAC9B,4FAA4F;IAC5F,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,gBAAgB,GAAG,cAAc,CAAC;AAEhF,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,MAAM,EAAE,YAAY,CAAC;IACrB,gCAAgC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;;;;OAKG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAEtD;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrF;AAED,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC1B,oFAAoF;IACpF,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,kBAAkB,CAAC;CAC1D"}
|
package/package.json
CHANGED