@adonis-agora/agent 0.76.2 → 0.77.0

package/dist/src/poppy-client/discovery.js

@@ -0,0 +1,217 @@
+import { DiscoveryError } from './errors.js';
+import { isLoopbackHost, normalizeDomain, requireSecureUrl, } from './util.js';
+/** Major protocol versions this client implements (3.1). */
+export const SUPPORTED_MAJOR_VERSIONS = ['0'];
+const MAX_REDIRECTS = 5;
+/** In-memory cache of JSON documents by URL, by `Cache-Control: max-age`. */
+export class HttpJsonCache {
+    entries = new Map();
+    get(url) {
+        const e = this.entries.get(url);
+        if (!e)
+            return undefined;
+        if (e.expires < Date.now()) {
+            this.entries.delete(url);
+            return undefined;
+        }
+        return e.value;
+    }
+    set(url, value, cacheControl) {
+        if (!cacheControl || /no-store|no-cache/i.test(cacheControl))
+            return;
+        const m = /max-age=(\d+)/i.exec(cacheControl);
+        if (!m)
+            return;
+        this.entries.set(url, { expires: Date.now() + Number(m[1]) * 1000, value });
+    }
+}
+/**
+ * Turns user input into the well-known URL. `example.com` → `https://example.com/...`.
+ * With `insecureDev`, an explicit `http://host:port` is kept, and a bare loopback host
+ * (`localhost:3333`) defaults to `http:`.
+ */
+export function wellKnownUrlFor(input, sec = {}) {
+    let base;
+    if (/^[a-z]+:\/\//i.test(input)) {
+        base = new URL(input);
+    }
+    else {
+        const guess = new URL(`https://${input}`);
+        base = sec.insecureDev && isLoopbackHost(guess.hostname) ? new URL(`http://${input}`) : guess;
+    }
+    requireSecureUrl(base.toString(), 'Company domain', sec);
+    return new URL('/.well-known/poppy.json', base.origin);
+}
+async function fetchJson(url, what, opts) {
+    const cached = opts.cache?.get(url.toString());
+    if (cached !== undefined)
+        return { json: cached, finalUrl: url };
+    const doFetch = opts.fetch ?? ((i, init) => globalThis.fetch(i, init));
+    let current = url;
+    for (let hop = 0;; hop++) {
+        const res = await doFetch(current.toString(), {
+            redirect: 'manual',
+            headers: { accept: 'application/json' },
+        });
+        if (res.status >= 300 && res.status < 400 && res.headers.get('location')) {
+            if (hop >= MAX_REDIRECTS)
+                throw new DiscoveryError('too_many_redirects', `${what}: too many redirects`);
+            const next = new URL(res.headers.get('location'), current);
+            try {
+                // Every redirect MUST be to an HTTPS URL (3).
+                requireSecureUrl(next.toString(), `${what} redirect`, opts);
+            }
+            catch (e) {
+                throw new DiscoveryError('insecure_redirect', e.message);
+            }
+            current = next;
+            continue;
+        }
+        if (!res.ok) {
+            throw new DiscoveryError('fetch_failed', `${what}: HTTP ${res.status} from ${current}`);
+        }
+        let json;
+        try {
+            json = await res.json();
+        }
+        catch {
+            throw new DiscoveryError('invalid_json', `${what}: response is not JSON`);
+        }
+        opts.cache?.set(url.toString(), json, res.headers.get('cache-control'));
+        return { json, finalUrl: current };
+    }
+}
+function fail(code, message) {
+    throw new DiscoveryError(code, message);
+}
+function isObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function checkUrl(value, what, sec) {
+    try {
+        return requireSecureUrl(value, what, sec).toString();
+    }
+    catch (e) {
+        fail('invalid_document', e.message);
+    }
+}
+/** Validates `poppy.json` against 3.1. Unknown fields are ignored, never rejected. */
+export function validatePoppyDocument(json, requestedHost, sec = {}) {
+    if (!isObject(json))
+        fail('invalid_document', 'poppy.json is not a JSON object');
+    const version = json.protocol_version;
+    if (typeof version !== 'string' || !/^\d+\.\d+$/.test(version)) {
+        fail('invalid_document', 'protocol_version must be "major.minor"');
+    }
+    const major = version.split('.')[0] ?? '';
+    if (!SUPPORTED_MAJOR_VERSIONS.includes(major)) {
+        fail('unsupported_protocol_version', `poppy.json protocol_version ${version} has major ${major}; this agent supports ${SUPPORTED_MAJOR_VERSIONS.join(', ')}`);
+    }
+    const org = json.organization;
+    if (!isObject(org) || typeof org.name !== 'string' || typeof org.domain !== 'string') {
+        fail('invalid_document', 'organization.name and organization.domain are required');
+    }
+    // organization.domain must match the host we requested, ignoring a leading www. The host
+    // after a redirect doesn't count (3.1). Ports only appear in --insecure-dev setups.
+    const requested = normalizeDomain(requestedHost);
+    const requestedNoPort = normalizeDomain(requestedHost.replace(/:\d+$/, ''));
+    const claimed = normalizeDomain(org.domain);
+    if (claimed !== requested && claimed !== requestedNoPort) {
+        fail('domain_mismatch', `organization.domain "${org.domain}" does not match the requested host "${requestedHost}"`);
+    }
+    const hasAgent = json.agent !== undefined;
+    const hasApis = json.apis !== undefined;
+    const hasWeb = json.web !== undefined;
+    if (!hasAgent && !hasApis && !hasWeb) {
+        fail('invalid_document', 'poppy.json must have at least one of agent, apis, web');
+    }
+    if (hasWeb) {
+        if (!isObject(json.web))
+            fail('invalid_document', 'web must be an object');
+        if (json.web.browser_session_endpoint !== undefined) {
+            checkUrl(json.web.browser_session_endpoint, 'web.browser_session_endpoint', sec);
+        }
+    }
+    const needsAuth = hasAgent || hasApis || (isObject(json.web) && json.web.browser_session_endpoint);
+    if (needsAuth && json.auth === undefined) {
+        fail('invalid_document', 'auth is required when agent, apis or web.browser_session_endpoint is present');
+    }
+    if (json.auth !== undefined) {
+        const auth = json.auth;
+        if (!isObject(auth))
+            fail('invalid_document', 'auth must be an object');
+        checkUrl(auth.issuer, 'auth.issuer', sec);
+        for (const type of ['direct', 'device', 'mediated']) {
+            const t = auth[type];
+            if (t === undefined)
+                continue;
+            if (!isObject(t) ||
+                !Array.isArray(t.scopes) ||
+                !t.scopes.every((s) => typeof s === 'string')) {
+                fail('invalid_document', `auth.${type}.scopes must be a list of strings`);
+            }
+        }
+        if (isObject(auth.mediated)) {
+            checkUrl(auth.mediated.endpoint, 'auth.mediated.endpoint', sec);
+            const fields = auth.mediated.fields;
+            if (!Array.isArray(fields) ||
+                !fields.every((f) => isObject(f) && typeof f.name === 'string' && typeof f.label === 'string')) {
+                fail('invalid_document', 'auth.mediated.fields must list { name, label, secret }');
+            }
+        }
+    }
+    if (hasAgent) {
+        if (!isObject(json.agent) || !Array.isArray(json.agent.protocols)) {
+            fail('invalid_document', 'agent.protocols must be a list');
+        }
+    }
+    if (hasApis && !Array.isArray(json.apis))
+        fail('invalid_document', 'apis must be a list');
+    return json;
+}
+/** RFC 8414 section 3: the well-known suffix goes between the host and the issuer's path. */
+export function authServerMetadataUrl(issuer) {
+    const u = new URL(issuer);
+    const path = u.pathname === '/' ? '' : u.pathname.replace(/\/$/, '');
+    return new URL(`${u.origin}/.well-known/oauth-authorization-server${path}`);
+}
+/** Validates the issuer metadata against 3.2. */
+export function validateMetadata(json, doc, sec = {}) {
+    if (!isObject(json))
+        fail('invalid_metadata', 'authorization server metadata is not an object');
+    const auth = doc.auth;
+    if (json.issuer !== auth.issuer) {
+        fail('issuer_mismatch', `metadata issuer "${String(json.issuer)}" != auth.issuer "${auth.issuer}"`);
+    }
+    const domains = json.poppy_domains;
+    if (!Array.isArray(domains)) {
+        fail('domain_not_listed', 'metadata has no poppy_domains, so it does not vouch for this domain');
+    }
+    const wanted = doc.organization.domain.toLowerCase();
+    if (!domains.some((d) => typeof d === 'string' && d.toLowerCase() === wanted)) {
+        fail('domain_not_listed', `poppy_domains of ${auth.issuer} does not include "${doc.organization.domain}"`);
+    }
+    checkUrl(json.token_endpoint, 'token_endpoint', sec);
+    checkUrl(json.revocation_endpoint, 'revocation_endpoint', sec);
+    if (auth.direct)
+        checkUrl(json.authorization_endpoint, 'authorization_endpoint', sec);
+    if (auth.device)
+        checkUrl(json.device_authorization_endpoint, 'device_authorization_endpoint', sec);
+    return json;
+}
+/**
+ * Discovery (section 3): fetches `/.well-known/poppy.json` (HTTPS-only redirects), validates
+ * it, then fetches and validates the issuer's RFC 8414 metadata (3.2).
+ */
+export async function discover(input, opts = {}) {
+    const wellKnown = wellKnownUrlFor(input, opts);
+    const { json } = await fetchJson(wellKnown, 'poppy.json', opts);
+    const document = validatePoppyDocument(json, wellKnown.host, opts);
+    let metadata;
+    if (document.auth) {
+        const { json: meta } = await fetchJson(authServerMetadataUrl(document.auth.issuer), 'authorization server metadata', opts);
+        metadata = validateMetadata(meta, document, opts);
+    }
+    return { domain: wellKnown.host, wellKnownUrl: wellKnown.toString(), document, metadata };
+}
+//# sourceMappingURL=discovery.js.map

package/dist/src/poppy-client/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../src/poppy-client/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EAEL,cAAc,EACd,eAAe,EACf,gBAAgB,GAEjB,MAAM,WAAW,CAAC;AAEnB,4DAA4D;AAC5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,CAAC,CAAC;AAE9C,MAAM,aAAa,GAAG,CAAC,CAAC;AAiBxB,6EAA6E;AAC7E,MAAM,OAAO,aAAa;IACP,OAAO,GAAG,IAAI,GAAG,EAA+C,CAAC;IAClF,GAAG,CAAC,GAAW;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACzB,IAAI,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,CAAC,KAAK,CAAC;IACjB,CAAC;IACD,GAAG,CAAC,GAAW,EAAE,KAAc,EAAE,YAA2B;QAC1D,IAAI,CAAC,YAAY,IAAI,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,OAAO;QACrE,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,GAAG,GAAoB,EAAE;IACtE,IAAI,IAAS,CAAC;IACd,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;QAC1C,IAAI,GAAG,GAAG,CAAC,WAAW,IAAI,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAChG,CAAC;IACD,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACzD,OAAO,IAAI,GAAG,CAAC,yBAAyB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,GAAQ,EACR,IAAY,EACZ,IAAsB;IAEtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACvE,IAAI,OAAO,GAAG,GAAG,CAAC;IAClB,KAAK,IAAI,GAAG,GAAG,CAAC,GAAI,GAAG,EAAE,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE;YAC5C,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACzE,IAAI,GAAG,IAAI,aAAa;gBACtB,MAAM,IAAI,cAAc,CAAC,oBAAoB,EAAE,GAAG,IAAI,sBAAsB,CAAC,CAAC;YAChF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAE,EAAE,OAAO,CAAC,CAAC;YAC5D,IAAI,CAAC;gBACH,8CAA8C;gBAC9C,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,WAAW,EAAE,IAAI,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,cAAc,CAAC,mBAAmB,EAAG,CAAW,CAAC,OAAO,CAAC,CAAC;YACtE,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,GAAG,IAAI,UAAU,GAAG,CAAC,MAAM,SAAS,OAAO,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,GAAG,IAAI,wBAAwB,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QACxE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACrC,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,OAAe;IACzC,MAAM,IAAI,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,IAAY,EAAE,GAAoB;IAClE,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,kBAAkB,EAAG,CAAW,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CACnC,IAAa,EACb,aAAqB,EACrB,GAAG,GAAoB,EAAE;IAEzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC;IACtC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,kBAAkB,EAAE,wCAAwC,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,IAAI,CACF,8BAA8B,EAC9B,+BAA+B,OAAO,cAAc,KAAK,yBAAyB,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxH,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;IAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACrF,IAAI,CAAC,kBAAkB,EAAE,wDAAwD,CAAC,CAAC;IACrF,CAAC;IACD,yFAAyF;IACzF,oFAAoF;IACpF,MAAM,SAAS,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,eAAe,GAAG,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QACzD,IAAI,CACF,iBAAiB,EACjB,wBAAwB,GAAG,CAAC,MAAM,wCAAwC,aAAa,GAAG,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC;IACtC,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACrC,IAAI,CAAC,kBAAkB,EAAE,uDAAuD,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;QAC3E,IAAI,IAAI,CAAC,GAAG,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GACb,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACnF,IAAI,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACzC,IAAI,CACF,kBAAkB,EAClB,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,kBAAkB,EAAE,wBAAwB,CAAC,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAU,EAAE,CAAC;YAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,IAAI,CAAC,KAAK,SAAS;gBAAE,SAAS;YAC9B,IACE,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACZ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;gBACxB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAC7C,CAAC;gBACD,IAAI,CAAC,kBAAkB,EAAE,QAAQ,IAAI,mCAAmC,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACpC,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBACtB,CAAC,MAAM,CAAC,KAAK,CACX,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAChF,EACD,CAAC;gBACD,IAAI,CAAC,kBAAkB,EAAE,wDAAwD,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,kBAAkB,EAAE,gCAAgC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;IAC1F,OAAO,IAAgC,CAAC;AAC1C,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrE,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,0CAA0C,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,gBAAgB,CAC9B,IAAa,EACb,GAAkB,EAClB,GAAG,GAAoB,EAAE;IAEzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,kBAAkB,EAAE,gDAAgD,CAAC,CAAC;IAChG,MAAM,IAAI,GAAG,GAAG,CAAC,IAAK,CAAC;IACvB,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,CACF,iBAAiB,EACjB,oBAAoB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,IAAI,CAAC,MAAM,GAAG,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,IAAI,CACF,mBAAmB,EACnB,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;QAC9E,IAAI,CACF,mBAAmB,EACnB,oBAAoB,IAAI,CAAC,MAAM,sBAAsB,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAChF,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACrD,QAAQ,CAAC,IAAI,CAAC,mBAAmB,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAC/D,IAAI,IAAI,CAAC,MAAM;QAAE,QAAQ,CAAC,IAAI,CAAC,sBAAsB,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAC;IACtF,IAAI,IAAI,CAAC,MAAM;QACb,QAAQ,CAAC,IAAI,CAAC,6BAA6B,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAC;IACrF,OAAO,IAAqC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAa,EAAE,IAAI,GAAqB,EAAE;IACvE,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,QAAwC,CAAC;IAC7C,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CACpC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAC3C,+BAA+B,EAC/B,IAAI,CACL,CAAC;QACF,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAC5F,CAAC"}

package/dist/src/poppy-client/dpop.d.ts

@@ -0,0 +1,19 @@
+import { type StoredKey } from './keys.js';
+/** `htu`: the request URL without query or fragment (RFC 9449 4.2). */
+export declare function htuOf(url: string | URL): string;
+/**
+ * A DPoP key (RFC 9449). The agent keeps one per User per Company (4.3); it is never published.
+ */
+export declare class DpopKey {
+    readonly stored: StoredKey;
+    constructor(stored: StoredKey);
+    static generate(): Promise<DpopKey>;
+    /** A fresh proof for one request. `accessToken` adds `ath`; token-endpoint proofs have none. */
+    proof(input: {
+        htm: string;
+        htu: string | URL;
+        accessToken?: string | undefined;
+        nonce?: string | undefined;
+    }): Promise<string>;
+}
+//# sourceMappingURL=dpop.d.ts.map

package/dist/src/poppy-client/dpop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dpop.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/dpop.ts"],"names":[],"mappings":"AACA,OAAO,EAAuD,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAGhG,uEAAuE;AACvE,wBAAgB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,GAAG,MAAM,CAK/C;AAED;;GAEG;AACH,qBAAa,OAAO;IACN,QAAQ,CAAC,MAAM,EAAE,SAAS;IAAtC,YAAqB,MAAM,EAAE,SAAS,EAAI;IAE1C,OAAa,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,CAExC;IAED,gGAAgG;IAC1F,KAAK,CAAC,KAAK,EAAE;QACjB,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC5B,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBlB;CACF"}

package/dist/src/poppy-client/dpop.js

@@ -0,0 +1,43 @@
+import { SignJWT } from 'jose';
+import { bareEcPublicJwk, generateEs256Key, importSigningKey } from './keys.js';
+import { nowSeconds, randomId, sha256b64url } from './util.js';
+/** `htu`: the request URL without query or fragment (RFC 9449 4.2). */
+export function htuOf(url) {
+    const u = new URL(url);
+    u.search = '';
+    u.hash = '';
+    return u.toString();
+}
+/**
+ * A DPoP key (RFC 9449). The agent keeps one per User per Company (4.3); it is never published.
+ */
+export class DpopKey {
+    stored;
+    constructor(stored) {
+        this.stored = stored;
+    }
+    static async generate() {
+        return new DpopKey(await generateEs256Key());
+    }
+    /** A fresh proof for one request. `accessToken` adds `ath`; token-endpoint proofs have none. */
+    async proof(input) {
+        const payload = {
+            jti: randomId(),
+            htm: input.htm.toUpperCase(),
+            htu: htuOf(input.htu),
+            iat: nowSeconds(),
+        };
+        if (input.accessToken)
+            payload.ath = sha256b64url(input.accessToken);
+        if (input.nonce)
+            payload.nonce = input.nonce;
+        return new SignJWT(payload)
+            .setProtectedHeader({
+            typ: 'dpop+jwt',
+            alg: 'ES256',
+            jwk: bareEcPublicJwk(this.stored.publicJwk),
+        })
+            .sign(await importSigningKey(this.stored));
+    }
+}
+//# sourceMappingURL=dpop.js.map

package/dist/src/poppy-client/dpop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dpop.js","sourceRoot":"","sources":["../../../src/poppy-client/dpop.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAkB,MAAM,WAAW,CAAC;AAChG,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE/D,uEAAuE;AACvE,MAAM,UAAU,KAAK,CAAC,GAAiB;IACrC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;IACd,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;IACZ,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,OAAO;IACG,MAAM;IAA3B,YAAqB,MAAiB;sBAAjB,MAAM;IAAc,CAAC;IAE1C,MAAM,CAAC,KAAK,CAAC,QAAQ;QACnB,OAAO,IAAI,OAAO,CAAC,MAAM,gBAAgB,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,gGAAgG;IAChG,KAAK,CAAC,KAAK,CAAC,KAKX;QACC,MAAM,OAAO,GAA4B;YACvC,GAAG,EAAE,QAAQ,EAAE;YACf,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE;YAC5B,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;YACrB,GAAG,EAAE,UAAU,EAAE;SAClB,CAAC;QACF,IAAI,KAAK,CAAC,WAAW;YAAE,OAAO,CAAC,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,KAAK;YAAE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAC7C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;aACxB,kBAAkB,CAAC;YAClB,GAAG,EAAE,UAAU;YACf,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;SAC5C,CAAC;aACD,IAAI,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC;CACF"}

package/dist/src/poppy-client/errors.d.ts

@@ -0,0 +1,50 @@
+/** Base error for everything this client raises on a protocol-level failure. */
+export declare class PoppyError extends Error {
+    readonly code: string;
+    readonly status?: number | undefined;
+    readonly description?: string | undefined;
+    readonly details?: Record<string, unknown> | undefined;
+    constructor(code: string, message?: string | undefined, opts?: {
+        status?: number | undefined;
+        description?: string | undefined;
+        details?: Record<string, unknown> | undefined;
+    });
+}
+/** Discovery failed or a document didn't pass the checks of section 3. */
+export declare class DiscoveryError extends PoppyError {
+    constructor(code: string, message: string);
+}
+/** OAuth error response from the token, device, or revocation endpoint (4.2). */
+export declare class OAuthError extends PoppyError {
+    readonly retryAfter?: number | undefined;
+    constructor(code: string, opts?: {
+        status?: number | undefined;
+        description?: string | undefined;
+        retryAfter?: number | undefined;
+        details?: Record<string, unknown> | undefined;
+    });
+}
+/**
+ * A resource (API, conversation, mediated sign-in) rejected the token, via `WWW-Authenticate`
+ * (section 6): `invalid_token`, `sign_in_required`, `insufficient_scope`, DPoP errors.
+ */
+export declare class ResourceAuthError extends PoppyError {
+    /** Scopes the Company says are needed, for `insufficient_scope`. */
+    readonly scope?: string | undefined;
+    constructor(code: string, opts?: {
+        status?: number | undefined;
+        description?: string | undefined;
+        scope?: string | undefined;
+    });
+}
+/** A conversation error with a JSON `error` body (7.13). */
+export declare class ConversationError extends PoppyError {
+    /** For `direct_conversation_open`: the open Direct Conversation. */
+    readonly conversationId?: string | undefined;
+    constructor(code: string, opts?: {
+        status?: number | undefined;
+        description?: string | undefined;
+        conversationId?: string | undefined;
+    });
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/src/poppy-client/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/errors.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAEvD,YACE,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,GAAE;QACJ,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;KAC1C,EAQP;CACF;AAED,0EAA0E;AAC1E,qBAAa,cAAe,SAAQ,UAAU;IAC5C,YAAY,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAGxC;CACF;AAED,iFAAiF;AACjF,qBAAa,UAAW,SAAQ,UAAU;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,YACE,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;QACJ,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;KAC1C,EAKP;CACF;AAED;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,UAAU;IAC/C,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,YACE,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;QACJ,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACvB,EAKP;CACF;AAED,4DAA4D;AAC5D,qBAAa,iBAAkB,SAAQ,UAAU;IAC/C,oEAAoE;IACpE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,YACE,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;QACJ,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAChC,EAKP;CACF"}

package/dist/src/poppy-client/errors.js

@@ -0,0 +1,55 @@
+/** Base error for everything this client raises on a protocol-level failure. */
+export class PoppyError extends Error {
+    code;
+    status;
+    description;
+    details;
+    constructor(code, message, opts = {}) {
+        super(message ?? (opts.description ? `${code}: ${opts.description}` : code));
+        this.name = 'PoppyError';
+        this.code = code;
+        this.status = opts.status;
+        this.description = opts.description;
+        this.details = opts.details;
+    }
+}
+/** Discovery failed or a document didn't pass the checks of section 3. */
+export class DiscoveryError extends PoppyError {
+    constructor(code, message) {
+        super(code, message);
+        this.name = 'DiscoveryError';
+    }
+}
+/** OAuth error response from the token, device, or revocation endpoint (4.2). */
+export class OAuthError extends PoppyError {
+    retryAfter;
+    constructor(code, opts = {}) {
+        super(code, undefined, opts);
+        this.name = 'OAuthError';
+        this.retryAfter = opts.retryAfter;
+    }
+}
+/**
+ * A resource (API, conversation, mediated sign-in) rejected the token, via `WWW-Authenticate`
+ * (section 6): `invalid_token`, `sign_in_required`, `insufficient_scope`, DPoP errors.
+ */
+export class ResourceAuthError extends PoppyError {
+    /** Scopes the Company says are needed, for `insufficient_scope`. */
+    scope;
+    constructor(code, opts = {}) {
+        super(code, undefined, opts);
+        this.name = 'ResourceAuthError';
+        this.scope = opts.scope;
+    }
+}
+/** A conversation error with a JSON `error` body (7.13). */
+export class ConversationError extends PoppyError {
+    /** For `direct_conversation_open`: the open Direct Conversation. */
+    conversationId;
+    constructor(code, opts = {}) {
+        super(code, undefined, opts);
+        this.name = 'ConversationError';
+        this.conversationId = opts.conversationId;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/src/poppy-client/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/poppy-client/errors.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,MAAM,OAAO,UAAW,SAAQ,KAAK;IAC1B,IAAI,CAAS;IACb,MAAM,CAAsB;IAC5B,WAAW,CAAsB;IACjC,OAAO,CAAuC;IAEvD,YACE,IAAY,EACZ,OAA4B,EAC5B,IAAI,GAIA,EAAE;QAEN,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,CAAC;CACF;AAED,0EAA0E;AAC1E,MAAM,OAAO,cAAe,SAAQ,UAAU;IAC5C,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,OAAO,UAAW,SAAQ,UAAU;IAC/B,UAAU,CAAsB;IACzC,YACE,IAAY,EACZ,IAAI,GAKA,EAAE;QAEN,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,oEAAoE;IAC3D,KAAK,CAAsB;IACpC,YACE,IAAY,EACZ,IAAI,GAIA,EAAE;QAEN,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAC1B,CAAC;CACF;AAED,4DAA4D;AAC5D,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,oEAAoE;IAC3D,cAAc,CAAsB;IAC7C,YACE,IAAY,EACZ,IAAI,GAIA,EAAE;QAEN,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;IAC5C,CAAC;CACF"}

package/dist/src/poppy-client/http.d.ts

@@ -0,0 +1,40 @@
+import type { DpopKey } from './dpop.js';
+import { type FetchLike } from './util.js';
+export interface HttpOptions {
+    fetch?: FetchLike | undefined;
+    /** Longest `Retry-After` we wait out automatically before giving up (seconds). */
+    maxRetryAfterSeconds?: number | undefined;
+    log?: ((line: string) => void) | undefined;
+}
+export interface PoppyRequestInit {
+    method?: string | undefined;
+    headers?: Record<string, string> | undefined;
+    /**
+     * The body, or a builder called once per attempt. Token requests pass a builder so each
+     * retry carries brand-new assertions (fresh `jti`s), never a replayed one.
+     */
+    body?: (string | (() => Promise<string>)) | undefined;
+    /** Signs a DPoP proof for every attempt when set. */
+    dpop?: DpopKey | undefined;
+    /** Sent as `Authorization: {scheme} {token}`. Never put in the URL (4.3). */
+    accessToken?: string | undefined;
+    scheme?: 'DPoP' | 'Bearer' | undefined;
+    signal?: AbortSignal | undefined;
+    redirect?: 'follow' | 'manual' | 'error' | undefined;
+}
+/**
+ * The one place requests leave this client. It signs DPoP proofs, remembers `DPoP-Nonce`
+ * values per origin and retries once on `use_dpop_nonce` (RFC 9449 section 8/9), and waits
+ * out a 429 `Retry-After` once (4.3, "Rate limits").
+ */
+export declare class PoppyHttp {
+    readonly fetch: FetchLike;
+    private readonly nonces;
+    private readonly maxRetryAfter;
+    private readonly log?;
+    constructor(opts?: HttpOptions);
+    request(url: string, init?: PoppyRequestInit): Promise<Response>;
+}
+/** Reads a JSON body, tolerating an empty one. */
+export declare function readJson<T = Record<string, unknown>>(res: Response): Promise<T | undefined>;
+//# sourceMappingURL=http.d.ts.map

package/dist/src/poppy-client/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,KAAK,SAAS,EAAwC,MAAM,WAAW,CAAC;AAEjF,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,kFAAkF;IAClF,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC7C;;;OAGG;IACH,IAAI,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;IACtD,qDAAqD;IACrD,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IACvC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;CACtD;AAED;;;;GAIG;AACH,qBAAa,SAAS;IACpB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAuC;IAE5D,YAAY,IAAI,GAAE,WAAgB,EAIjC;IAEK,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsDzE;CACF;AAaD,kDAAkD;AAClD,wBAAsB,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAQjG"}

package/dist/src/poppy-client/http.js

@@ -0,0 +1,95 @@
+import { PoppyError } from './errors.js';
+import { parseRetryAfter, sleep, wwwAuthError } from './util.js';
+/**
+ * The one place requests leave this client. It signs DPoP proofs, remembers `DPoP-Nonce`
+ * values per origin and retries once on `use_dpop_nonce` (RFC 9449 section 8/9), and waits
+ * out a 429 `Retry-After` once (4.3, "Rate limits").
+ */
+export class PoppyHttp {
+    fetch;
+    nonces = new Map();
+    maxRetryAfter;
+    log;
+    constructor(opts = {}) {
+        this.fetch = opts.fetch ?? ((input, init) => globalThis.fetch(input, init));
+        this.maxRetryAfter = opts.maxRetryAfterSeconds ?? 30;
+        this.log = opts.log;
+    }
+    async request(url, init = {}) {
+        const method = (init.method ?? 'GET').toUpperCase();
+        const origin = new URL(url).origin;
+        let nonceRetried = false;
+        let rateRetried = false;
+        for (;;) {
+            const headers = new Headers(init.headers);
+            const scheme = init.scheme ?? (init.dpop ? 'DPoP' : 'Bearer');
+            if (init.accessToken)
+                headers.set('authorization', `${scheme} ${init.accessToken}`);
+            if (init.dpop) {
+                headers.set('dpop', await init.dpop.proof({
+                    htm: method,
+                    htu: url,
+                    accessToken: scheme === 'DPoP' ? init.accessToken : undefined,
+                    nonce: this.nonces.get(origin),
+                }));
+            }
+            const body = typeof init.body === 'function' ? await init.body() : init.body;
+            const res = await this.fetch(url, {
+                method,
+                headers,
+                ...(body !== undefined ? { body } : {}),
+                ...(init.signal !== undefined ? { signal: init.signal } : {}),
+                // A redirect would change `htu`, so DPoP requests never follow one silently.
+                redirect: init.redirect ?? (init.dpop ? 'manual' : 'follow'),
+            });
+            const nonce = res.headers.get('dpop-nonce');
+            if (nonce)
+                this.nonces.set(origin, nonce);
+            if (init.dpop && nonce && !nonceRetried && (await isUseDpopNonce(res))) {
+                nonceRetried = true;
+                this.log?.(`DPoP nonce required by ${origin}; retrying with the nonce`);
+                continue;
+            }
+            if (res.status === 429 && !rateRetried) {
+                const wait = parseRetryAfter(res.headers.get('retry-after'));
+                if (wait !== undefined && wait <= this.maxRetryAfter) {
+                    rateRetried = true;
+                    this.log?.(`rate limited by ${origin}; waiting ${wait}s (Retry-After)`);
+                    await sleep(wait * 1000, init.signal);
+                    continue;
+                }
+                throw new PoppyError('rate_limited', `rate limited by ${origin}`, {
+                    status: 429,
+                    details: { retry_after: wait },
+                });
+            }
+            return res;
+        }
+    }
+}
+async function isUseDpopNonce(res) {
+    if (res.status !== 400 && res.status !== 401)
+        return false;
+    if (wwwAuthError(res.headers.get('www-authenticate')).error === 'use_dpop_nonce')
+        return true;
+    try {
+        const body = (await res.clone().json());
+        return body?.error === 'use_dpop_nonce';
+    }
+    catch {
+        return false;
+    }
+}
+/** Reads a JSON body, tolerating an empty one. */
+export async function readJson(res) {
+    const text = await res.text();
+    if (!text)
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=http.js.map

package/dist/src/poppy-client/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/poppy-client/http.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAkB,eAAe,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AA0BjF;;;;GAIG;AACH,MAAM,OAAO,SAAS;IACX,KAAK,CAAY;IACT,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnC,aAAa,CAAS;IACtB,GAAG,CAAwC;IAE5D,YAAY,IAAI,GAAgB,EAAE;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,IAAI,GAAqB,EAAE;QACpD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACnC,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,SAAS,CAAC;YACR,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,IAAI,CAAC,WAAW;gBAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YACpF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CACT,MAAM,EACN,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;oBACpB,GAAG,EAAE,MAAM;oBACX,GAAG,EAAE,GAAG;oBACR,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;oBAC7D,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;iBAC/B,CAAC,CACH,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;gBAChC,MAAM;gBACN,OAAO;gBACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,6EAA6E;gBAC7E,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;aAC7D,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC5C,IAAI,KAAK;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAE1C,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACvE,YAAY,GAAG,IAAI,CAAC;gBACpB,IAAI,CAAC,GAAG,EAAE,CAAC,0BAA0B,MAAM,2BAA2B,CAAC,CAAC;gBACxE,SAAS;YACX,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBACvC,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;gBAC7D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;oBACrD,WAAW,GAAG,IAAI,CAAC;oBACnB,IAAI,CAAC,GAAG,EAAE,CAAC,mBAAmB,MAAM,aAAa,IAAI,iBAAiB,CAAC,CAAC;oBACxE,MAAM,KAAK,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;oBACtC,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,mBAAmB,MAAM,EAAE,EAAE;oBAChE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;iBAC/B,CAAC,CAAC;YACL,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;CACF;AAED,KAAK,UAAU,cAAc,CAAC,GAAa;IACzC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC3D,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAC9F,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAmC,CAAC;QAC1E,OAAO,IAAI,EAAE,KAAK,KAAK,gBAAgB,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,kDAAkD;AAClD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAA8B,GAAa;IACvE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/src/poppy-client/identity.d.ts

@@ -0,0 +1,61 @@
+import { type StoredKey } from './keys.js';
+import type { ClientMetadata } from './types.js';
+import { type SecurityOptions } from './util.js';
+export interface IdentityConfig {
+    /** Where the identity documents are served, e.g. `https://agent.example`. */
+    baseUrl: string;
+    clientName: string;
+    /** Defaults to `{baseUrl}/logo.svg`, which `serve-identity` serves. */
+    logoUri?: string | undefined;
+    /** Signing keys; the first one signs. Public halves go in `jwks_uri`. */
+    keys: StoredKey[];
+    /** Extensions this agent supports (3.3). None by default. */
+    extensions?: Record<string, {
+        version: string;
+    }> | undefined;
+}
+/** Lifetime of every assertion this agent signs. The browser assertion caps at 60s (section 5). */
+export declare const ASSERTION_TTL_SECONDS = 60;
+/**
+ * The Personal Agent's identity (4.1): its `client_id` URL, its metadata document, and the
+ * keys from `jwks_uri` that sign client assertions, Session assertions and browser assertions.
+ */
+export declare class AgentIdentity {
+    readonly baseUrl: string;
+    readonly clientName: string;
+    readonly logoUri: string;
+    readonly keys: StoredKey[];
+    readonly extensions?: Record<string, {
+        version: string;
+    }> | undefined;
+    constructor(cfg: IdentityConfig, sec?: SecurityOptions);
+    /** `client_id` is the URL the metadata document is fetched from (4.1). */
+    get clientId(): string;
+    get jwksUri(): string;
+    /** Same origin as `client_id`, as 4.1 requires for `redirect_uris`. */
+    get redirectUri(): string;
+    metadata(): ClientMetadata;
+    /** The public key set. Never contains private members. */
+    jwks(): {
+        keys: Record<string, unknown>[];
+    };
+    private sign;
+    /**
+     * `private_key_jwt` client assertion (RFC 7523 section 2.2): `iss` = `sub` = `client_id`,
+     * `aud` = the authorization server (its token endpoint by default), fresh `jti`.
+     */
+    clientAssertion(audience: string): Promise<string>;
+    /**
+     * The JWT bearer grant assertion that starts or renews a Session (4.2): names the agent in
+     * `iss` and the User ID in `sub`; `aud` is the token endpoint as a single string.
+     */
+    sessionAssertion(userId: string, tokenEndpoint: string): Promise<string>;
+    /** Browser assertion (section 5), header `typ: poppy-browser+jwt`, `exp` <= `iat` + 60. */
+    browserAssertion(input: {
+        userId: string;
+        endpoint: string;
+        sessionId: string;
+        returnTo: string;
+    }): Promise<string>;
+}
+//# sourceMappingURL=identity.d.ts.map

package/dist/src/poppy-client/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/identity.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAA0C,KAAK,eAAe,EAAE,MAAM,WAAW,CAAC;AAEzF,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,yEAAyE;IACzE,IAAI,EAAE,SAAS,EAAE,CAAC;IAClB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;CAC9D;AAED,mGAAmG;AACnG,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC;;;GAGG;AACH,qBAAa,aAAa;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;IAEtE,YAAY,GAAG,EAAE,cAAc,EAAE,GAAG,GAAE,eAAoB,EASzD;IAED,0EAA0E;IAC1E,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,uEAAuE;IACvE,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,QAAQ,IAAI,cAAc,CAazB;IAED,0DAA0D;IAC1D,IAAI,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;KAAE,CAE1C;YAEa,IAAI;IAQlB;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUjD;IAED;;;OAGG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUvE;IAED,2FAA2F;IAC3F,gBAAgB,CAAC,KAAK,EAAE;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,MAAM,CAAC,CAelB;CACF"}