@adonis-agora/agent 0.76.3 → 0.77.0

package/dist/src/poppy-client/util.js

@@ -0,0 +1,122 @@
+import { createHash, randomBytes } from 'node:crypto';
+/** A random URL-safe ID. 16 bytes = 128 random bits, the floor the spec sets for `jti` (4.2). */
+export function randomId(prefix = '', bytes = 16) {
+    return prefix + randomBytes(bytes).toString('base64url');
+}
+export function sha256b64url(input) {
+    return createHash('sha256').update(input).digest('base64url');
+}
+export function nowSeconds() {
+    return Math.floor(Date.now() / 1000);
+}
+export function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted)
+            return reject(signal.reason ?? new Error('aborted'));
+        const t = setTimeout(() => {
+            signal?.removeEventListener('abort', onAbort);
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            clearTimeout(t);
+            reject(signal?.reason ?? new Error('aborted'));
+        };
+        signal?.addEventListener('abort', onAbort, { once: true });
+    });
+}
+/** Hosts we treat as "local development" for messages and defaults. */
+export function isLoopbackHost(hostname) {
+    const h = hostname.replace(/^\[|\]$/g, '').toLowerCase();
+    return (h === 'localhost' || h.endsWith('.localhost') || h === '::1' || /^127(\.\d{1,3}){3}$/.test(h));
+}
+/**
+ * Parses `value` as an absolute URL and enforces the spec's HTTPS requirement. With
+ * `insecureDev`, plain `http:` is tolerated too.
+ */
+export function requireSecureUrl(value, what, sec) {
+    if (typeof value !== 'string' || value.length === 0) {
+        throw new TypeError(`${what} must be a URL string`);
+    }
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new TypeError(`${what} is not a valid URL: ${value}`);
+    }
+    if (url.protocol === 'https:')
+        return url;
+    if (url.protocol === 'http:' && sec.insecureDev)
+        return url;
+    throw new TypeError(`${what} must be an https:// URL (got ${url.protocol}//${url.host})${url.protocol === 'http:' ? '. Pass --insecure-dev to allow http:// for local testing.' : ''}`);
+}
+/** Strip a single leading `www.` and lowercase, as the spec compares domains (3.1). */
+export function normalizeDomain(domain) {
+    return domain.toLowerCase().replace(/^www\./, '');
+}
+/** `Retry-After` as seconds: either delta-seconds or an HTTP-date. */
+export function parseRetryAfter(value) {
+    if (!value)
+        return undefined;
+    const n = Number(value);
+    if (Number.isFinite(n) && n >= 0)
+        return n;
+    const date = Date.parse(value);
+    if (!Number.isNaN(date))
+        return Math.max(0, Math.ceil((date - Date.now()) / 1000));
+    return undefined;
+}
+/**
+ * Minimal `WWW-Authenticate` parser: enough for `DPoP error="...", scope="..."` and
+ * `Bearer error="..."` (RFC 6750 / RFC 9449). Handles several challenges in one header.
+ */
+export function parseWwwAuthenticate(header) {
+    if (!header)
+        return [];
+    const out = [];
+    let i = 0;
+    let current;
+    while (i < header.length) {
+        while (header[i] === ' ' || header[i] === ',')
+            i++;
+        if (i >= header.length)
+            break;
+        // Try param first (token "=" ...), then scheme.
+        const paramRe = /([A-Za-z0-9_-]+)\s*=\s*("((?:[^"\\]|\\.)*)"|[^,\s]+)/y;
+        paramRe.lastIndex = i;
+        const pm = paramRe.exec(header);
+        if (pm && current) {
+            current.params[(pm[1] ?? '').toLowerCase()] =
+                pm[3] !== undefined ? pm[3].replace(/\\(.)/g, '$1') : (pm[2] ?? '');
+            i = paramRe.lastIndex;
+            continue;
+        }
+        const schemeRe = /([A-Za-z][A-Za-z0-9!#$%&'*+.^_`|~-]*)/y;
+        schemeRe.lastIndex = i;
+        const sm = schemeRe.exec(header);
+        if (!sm)
+            break;
+        current = { scheme: sm[1] ?? '', params: {} };
+        out.push(current);
+        i = schemeRe.lastIndex;
+    }
+    return out;
+}
+/** The first `error` found in any challenge of a `WWW-Authenticate` header. */
+export function wwwAuthError(header) {
+    for (const c of parseWwwAuthenticate(header)) {
+        if (c.params.error) {
+            return {
+                error: c.params.error,
+                scope: c.params.scope,
+                description: c.params.error_description,
+            };
+        }
+    }
+    return {};
+}
+/** A space-separated scope string as a set (OAuth scope syntax, RFC 6749 3.3). */
+export function scopeSet(scope) {
+    return new Set((scope ?? '').split(' ').filter(Boolean));
+}
+//# sourceMappingURL=util.js.map

package/dist/src/poppy-client/util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../../../src/poppy-client/util.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,iGAAiG;AACjG,MAAM,UAAU,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,KAAK,GAAG,EAAE;IAC9C,OAAO,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,EAAU,EAAE,MAAoB;IACpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1E,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE;YACxB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC;QACF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC;AAID,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,OAAO,CACL,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAC9F,CAAC;AACJ,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,IAAY,EAAE,GAAoB;IACjF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,wBAAwB,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAC1C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO,GAAG,CAAC;IAC5D,MAAM,IAAI,SAAS,CACjB,GAAG,IAAI,iCAAiC,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,IAC/D,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,2DAA2D,CAAC,CAAC,CAAC,EAC3F,EAAE,CACH,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,eAAe,CAAC,KAAoB;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACnF,OAAO,SAAS,CAAC;AACnB,CAAC;AAOD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAqB;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,OAAqC,CAAC;IAC1C,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM;QAC9B,gDAAgD;QAChD,MAAM,OAAO,GAAG,uDAAuD,CAAC;QACxE,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC;YAClB,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBACzC,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACtE,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;YACtB,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,wCAAwC,CAAC;QAC1D,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC;QACvB,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,EAAE;YAAE,MAAM;QACf,OAAO,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClB,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,MAAqB;IAKhD,KAAK,MAAM,CAAC,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO;gBACL,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK;gBACrB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK;gBACrB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,iBAAiB;aACxC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,QAAQ,CAAC,KAAyB;IAChD,OAAO,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/src/poppy-connections/config.d.ts

@@ -0,0 +1,134 @@
+import type { Actor } from '../types.js';
+import type { PoppyConnectionStore } from './store.js';
+/** What this app's agent may do at one Company. */
+export interface PoppyCompanyPolicy {
+    /** A name for the model and the pages. Default: the Company's own `organization.name`. */
+    label?: string;
+    /** Scopes the connect step asks for. Default: every scope the sign-in offers. */
+    scopes?: string[];
+    /**
+     * Scopes that only READ — what `ask` narrows its token to, so a plain question can never make the
+     * Company act (an action takes `request`, which the person confirms). Default `['poppy:read']`.
+     */
+    readScopes?: string[];
+}
+/** A signing key of this app's agent identity: a private EC P-256 JWK (`kid` optional). */
+export type PoppyAgentKey = Record<string, unknown>;
+export interface PoppyConnectionsTexts {
+    pageTitle: string;
+    connectTitle: string;
+    connectBody: string;
+    direct: string;
+    device: string;
+    deviceBody: string;
+    deviceCheck: string;
+    mediatedTitle: string;
+    mediatedSubmit: string;
+    codeTitle: string;
+    codeLabel: string;
+    codeSubmit: string;
+    connectedTitle: string;
+    connectedBody: string;
+    failedTitle: string;
+    failedBody: string;
+    expiredTitle: string;
+    expiredBody: string;
+    pendingBody: string;
+    confirmConnectTitle: string;
+    confirmConnectVerb: string;
+    confirmConnectDetail: string;
+    /**
+     * What the conversation is continued with once the person connected (independent approvals:
+     * a new turn on the thread, in the person's voice). `{company}`.
+     */
+    continueAfterConnect: string;
+    confirmWriteTitle: string;
+    confirmRequestTitle: string;
+    confirmDisconnectTitle: string;
+    confirmVerb: string;
+}
+/** `{name}` placeholders: `{company}`, `{link}`, `{code}`, `{tool}`. */
+export declare const DEFAULT_POPPY_CONNECTIONS_TEXTS: PoppyConnectionsTexts;
+/**
+ * `config/poppy_connections.ts` — this app's agent acting on OTHER Poppy Companies for its users.
+ *
+ * @experimental Tracks Personal Agent Protocol Draft 0.1 (https://personalagentprotocol.org/docs/spec):
+ * this API WILL change as the spec evolves — possibly in breaking ways, outside semver majors.
+ */
+export interface PoppyConnectionsConfig {
+    /** This app's public origin (HTTPS). The identity lives at `{baseUrl}/{path}/agent.json`. */
+    baseUrl: string;
+    /** Where the identity, the connect pages and the callback are served. Default `'poppy-agent'`. */
+    path?: string;
+    identity: {
+        /** `client_name` — what the Company shows its users on its consent screen. */
+        name: string;
+        logoUri?: string;
+        /** Private EC P-256 JWKs (a JSON string works: an env var). The first signs; all are published. */
+        keys: PoppyAgentKey[] | string;
+    };
+    /**
+     * The Companies this agent may talk to (`domain` or `domain:port`, as discovered). **Default:
+     * none.** A list, a map to per-Company policy, or a predicate.
+     */
+    companies?: string[] | Record<string, PoppyCompanyPolicy> | ((domain: string) => boolean);
+    /** Whose connection a turn uses. Default: `actor.tenantRef ?? actor.id`. */
+    owner?: (actor: Actor) => string;
+    /** `'lucid'` (default), `'memory'`, or a store. */
+    store?: 'lucid' | 'memory' | PoppyConnectionStore;
+    connection?: string;
+    autoCreateTables?: boolean;
+    /** Seals tokens and keys at rest. Default: the app key. */
+    secret?: string;
+    /**
+     * DEVELOPMENT ONLY, not spec-compliant: accept `http://` Companies and serve the identity over
+     * http (a local app). Refused when `NODE_ENV=production`.
+     */
+    insecureDev?: boolean;
+    /**
+     * Tool names' prefix (default `'poppy_'`), the roles they require, how `connect` works
+     * (`'action'` card that resumes, or `'link'`), and whether the write tools are registered.
+     * `register: false` registers none (an app with its own per-turn registry calls
+     * `registerPoppyConnectionTools` itself).
+     */
+    tools?: {
+        prefix?: string;
+        roles?: string[];
+        ability?: string;
+        connect?: 'action' | 'link';
+        writes?: boolean;
+        register?: boolean;
+        /**
+         * Company tools that confirm in two steps (called first without `confirm` they only answer a
+         * preview and a `confirmToken`): the write tool shows that preview on its card and, once the
+         * person confirms, commits with the token. Detected by the tool's input schema having both
+         * fields. `false` turns it off. Default `{ confirm: 'confirm', token: 'confirmToken' }`.
+         */
+        twoStep?: TwoStepConvention | false;
+    };
+    /** How long a connect link works, in seconds. Default 900. */
+    connectTtlSeconds?: number;
+    /** How long `ask`/`request` wait for the Company's reply. Default 90 000 ms. */
+    replyTimeoutMs?: number;
+    texts?: Partial<PoppyConnectionsTexts>;
+    /**
+     * Routes for the app's own UI: `GET {path}/api/connections`, `DELETE {path}/api/connections/:domain`,
+     * behind the app's session. `actor` says who is asking (null → 401).
+     */
+    api?: {
+        actor: (ctx: import('@adonisjs/core/http').HttpContext) => Actor | null | Promise<Actor | null>;
+    };
+    /** `fetch` for every request to Companies (tests). */
+    fetch?: typeof fetch;
+}
+/** Field names of a Company's two-step confirmation convention (see `tools.twoStep`). */
+export interface TwoStepConvention {
+    confirm: string;
+    token: string;
+    /** Preview fields read for the card, first found wins. Default `['summary', 'resumo', 'message']`. */
+    summary?: string[];
+}
+export declare function definePoppyConnectionsConfig(config: PoppyConnectionsConfig): PoppyConnectionsConfig;
+/** `https://Acme.com/` → `acme.com`; `localhost:3333` stays. */
+export declare function normalizeDomain(value: string): string;
+//# sourceMappingURL=config.d.ts.map

package/dist/src/poppy-connections/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/poppy-connections/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IACjC,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,2FAA2F;AAC3F,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpD,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wEAAwE;AACxE,eAAO,MAAM,+BAA+B,EAAE,qBA4B7C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,6FAA6F;IAC7F,OAAO,EAAE,MAAM,CAAC;IAChB,kGAAkG;IAClG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE;QACR,8EAA8E;QAC9E,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,mGAAmG;QACnG,IAAI,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;KAChC,CAAC;IACF;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC;IAC1F,4EAA4E;IAC5E,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IACjC,mDAAmD;IACnD,KAAK,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,oBAAoB,CAAC;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;QAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB;;;;;WAKG;QACH,OAAO,CAAC,EAAE,iBAAiB,GAAG,KAAK,CAAC;KACrC,CAAC;IACF,8DAA8D;IAC9D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACvC;;;OAGG;IACH,GAAG,CAAC,EAAE;QACJ,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,qBAAqB,EAAE,WAAW,KAAK,KAAK,GAAG,IAAI,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;KACjG,CAAC;IACF,sDAAsD;IACtD,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,yFAAyF;AACzF,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,sGAAsG;IACtG,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,sBAAsB,GAC7B,sBAAsB,CAExB;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMrD"}

package/dist/src/poppy-connections/config.js

@@ -0,0 +1,44 @@
+/** `{name}` placeholders: `{company}`, `{link}`, `{code}`, `{tool}`. */
+export const DEFAULT_POPPY_CONNECTIONS_TEXTS = {
+    pageTitle: 'Connect your account',
+    connectTitle: 'Connect your {company} account',
+    connectBody: 'Your assistant asked to act on your {company} account. Sign in there to allow it.',
+    direct: 'Sign in to {company}',
+    device: 'Approve with a code instead',
+    deviceBody: 'Open {link} and enter the code {code}. Then come back here.',
+    deviceCheck: 'I approved it',
+    mediatedTitle: 'Or sign in here',
+    mediatedSubmit: 'Continue',
+    codeTitle: 'Enter the code',
+    codeLabel: 'Code sent to {sentTo}',
+    codeSubmit: 'Confirm',
+    connectedTitle: 'Connected to {company}',
+    connectedBody: 'You can go back to the conversation.',
+    failedTitle: 'Could not connect',
+    failedBody: 'The sign-in did not go through. Go back to the conversation and try again.',
+    expiredTitle: 'This link expired',
+    expiredBody: 'Ask your assistant for a new one.',
+    pendingBody: 'Not approved yet. Approve it and try again.',
+    confirmConnectTitle: 'Connect your {company} account',
+    confirmConnectVerb: 'I connected',
+    confirmConnectDetail: 'Open this link and sign in to {company}: {link}',
+    continueAfterConnect: 'I connected my account at {company}. Please go on with what I asked.',
+    confirmWriteTitle: '{company}: {tool}',
+    confirmRequestTitle: 'Ask {company} to act',
+    confirmDisconnectTitle: 'Disconnect your {company} account',
+    confirmVerb: 'Confirm',
+};
+export function definePoppyConnectionsConfig(config) {
+    return config;
+}
+/** `https://Acme.com/` → `acme.com`; `localhost:3333` stays. */
+export function normalizeDomain(value) {
+    const trimmed = value.trim().toLowerCase().replace(/\/+$/, '');
+    try {
+        if (/^[a-z]+:\/\//.test(trimmed))
+            return new URL(trimmed).host;
+    }
+    catch { }
+    return trimmed.replace(/^www\./, '');
+}
+//# sourceMappingURL=config.js.map

package/dist/src/poppy-connections/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/poppy-connections/config.ts"],"names":[],"mappings":"AAqDA,wEAAwE;AACxE,MAAM,CAAC,MAAM,+BAA+B,GAA0B;IACpE,SAAS,EAAE,sBAAsB;IACjC,YAAY,EAAE,gCAAgC;IAC9C,WAAW,EAAE,mFAAmF;IAChG,MAAM,EAAE,sBAAsB;IAC9B,MAAM,EAAE,6BAA6B;IACrC,UAAU,EAAE,6DAA6D;IACzE,WAAW,EAAE,eAAe;IAC5B,aAAa,EAAE,iBAAiB;IAChC,cAAc,EAAE,UAAU;IAC1B,SAAS,EAAE,gBAAgB;IAC3B,SAAS,EAAE,uBAAuB;IAClC,UAAU,EAAE,SAAS;IACrB,cAAc,EAAE,wBAAwB;IACxC,aAAa,EAAE,sCAAsC;IACrD,WAAW,EAAE,mBAAmB;IAChC,UAAU,EAAE,4EAA4E;IACxF,YAAY,EAAE,mBAAmB;IACjC,WAAW,EAAE,mCAAmC;IAChD,WAAW,EAAE,6CAA6C;IAC1D,mBAAmB,EAAE,gCAAgC;IACrD,kBAAkB,EAAE,aAAa;IACjC,oBAAoB,EAAE,iDAAiD;IACvE,oBAAoB,EAAE,sEAAsE;IAC5F,iBAAiB,EAAE,mBAAmB;IACtC,mBAAmB,EAAE,sBAAsB;IAC3C,sBAAsB,EAAE,mCAAmC;IAC3D,WAAW,EAAE,SAAS;CACvB,CAAC;AAmFF,MAAM,UAAU,4BAA4B,CAC1C,MAA8B;IAE9B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC"}

package/dist/src/poppy-connections/crypto.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Seals what a connection keeps at rest — the Account Token (a long-lived refresh token), the DPoP
+ * private key and the Session Tokens — with AES-256-GCM under a key derived from the app's secret
+ * (its `APP_KEY`). A database dump alone does not hand out anybody's access to another company.
+ */
+export declare class Sealer {
+    #private;
+    constructor(secret: string);
+    seal(value: unknown): string;
+    open<T>(sealed: string): T;
+}
+//# sourceMappingURL=crypto.d.ts.map

package/dist/src/poppy-connections/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../../src/poppy-connections/crypto.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,qBAAa,MAAM;;IAGjB,YAAY,MAAM,EAAE,MAAM,EAOzB;IAED,IAAI,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAO3B;IAED,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,CAWzB;CACF"}

package/dist/src/poppy-connections/crypto.js

@@ -0,0 +1,36 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';
+/**
+ * Seals what a connection keeps at rest — the Account Token (a long-lived refresh token), the DPoP
+ * private key and the Session Tokens — with AES-256-GCM under a key derived from the app's secret
+ * (its `APP_KEY`). A database dump alone does not hand out anybody's access to another company.
+ */
+export class Sealer {
+    #key;
+    constructor(secret) {
+        if (typeof secret !== 'string' || secret.length < 16) {
+            throw new Error('[@adonis-agora/agent] poppy-connections: the sealing secret must be ≥ 16 chars');
+        }
+        this.#key = createHash('sha256').update(`poppy-connections:v1:${secret}`).digest();
+    }
+    seal(value) {
+        const iv = randomBytes(12);
+        const cipher = createCipheriv('aes-256-gcm', this.#key, iv);
+        const body = Buffer.concat([cipher.update(JSON.stringify(value), 'utf8'), cipher.final()]);
+        return ['v1', iv, cipher.getAuthTag(), body]
+            .map((p) => (typeof p === 'string' ? p : p.toString('base64url')))
+            .join('.');
+    }
+    open(sealed) {
+        const [version, iv, tag, body] = sealed.split('.');
+        if (version !== 'v1' || !iv || !tag || body === undefined)
+            throw new Error('poppy-connections: unknown sealed format');
+        const decipher = createDecipheriv('aes-256-gcm', this.#key, Buffer.from(iv, 'base64url'));
+        decipher.setAuthTag(Buffer.from(tag, 'base64url'));
+        const plain = Buffer.concat([
+            decipher.update(Buffer.from(body, 'base64url')),
+            decipher.final(),
+        ]);
+        return JSON.parse(plain.toString('utf8'));
+    }
+}
+//# sourceMappingURL=crypto.js.map

package/dist/src/poppy-connections/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../../src/poppy-connections/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAExF;;;;GAIG;AACH,MAAM,OAAO,MAAM;IACR,IAAI,CAAS;IAEtB,YAAY,MAAc;QACxB,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,gFAAgF,CACjF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACrF,CAAC;IAED,IAAI,CAAC,KAAc;QACjB,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3F,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC;aACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;aACjE,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAED,IAAI,CAAI,MAAc;QACpB,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,SAAS;YACvD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QAC1F,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;YAC1B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC/C,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC;IACjD,CAAC;CACF"}

package/dist/src/poppy-connections/http.d.ts

@@ -0,0 +1,63 @@
+import type { PoppyConnectionsTexts } from './config.js';
+import type { PoppyConnections } from './service.js';
+/** The slice of a request/response the routes need — Adonis or a bare `node:http` server. */
+export interface PoppyConnectionsExchange {
+    method: string;
+    /** Path without the query string. */
+    path: string;
+    query: URLSearchParams;
+    readBody(limit: number): Promise<string>;
+    send(status: number, headers: Record<string, string>, body: string): void;
+}
+/** What a connect page shows, for an app that renders its own (`render`). */
+export type PoppyConnectView = {
+    view: 'expired';
+} | {
+    view: 'connected';
+    organization: string;
+} | {
+    view: 'failed';
+    organization: string | null;
+    retryUrl: string | null;
+} | {
+    view: 'choose';
+    organization: string;
+    directUrl: string | null;
+    deviceUrl: string | null;
+    mediated: {
+        action: string;
+        fields: {
+            name: string;
+            label: string;
+            secret: boolean;
+        }[];
+    } | null;
+} | {
+    view: 'code';
+    organization: string;
+    action: string;
+    sentTo: string;
+} | {
+    view: 'device';
+    organization: string;
+    userCode: string;
+    verificationUri: string;
+    checkUrl: string;
+    pending: boolean;
+};
+export type PoppyConnectRenderer = (view: PoppyConnectView, texts: PoppyConnectionsTexts) => string;
+/** The built-in pages: plain, accessible HTML; an app gives its own look with `render`. */
+export declare const defaultConnectRenderer: PoppyConnectRenderer;
+/** The default identity logo: the name's initial on a rounded square. */
+export declare function defaultLogoSvg(name: string): string;
+/**
+ * The routes under `/{path}`: the agent identity (`agent.json`, `jwks.json`), the connect pages and
+ * the Direct Sign-In callback. Returns `false` for anything else. Mounted ahead of the router: no
+ * session, no CSRF token — the connect id in the URL is the capability (128 bits, single-purpose,
+ * expiring), and the forms only ever post back to the same id.
+ */
+export declare function createPoppyConnectionsHandler(connections: PoppyConnections, options?: {
+    render?: PoppyConnectRenderer;
+    onError?: (error: unknown) => void;
+}): (ex: PoppyConnectionsExchange) => Promise<boolean>;
+//# sourceMappingURL=http.d.ts.map

package/dist/src/poppy-connections/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/poppy-connections/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,6FAA6F;AAC7F,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3E;AAED,6EAA6E;AAC7E,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACxE;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE;QACR,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,OAAO,CAAA;SAAE,EAAE,CAAC;KAC5D,GAAG,IAAI,CAAC;CACV,GACD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtE;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEN,MAAM,MAAM,oBAAoB,GAAG,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,qBAAqB,KAAK,MAAM,CAAC;AAcpG,2FAA2F;AAC3F,eAAO,MAAM,sBAAsB,EAAE,oBA8CpC,CAAC;AAWF,yEAAyE;AACzE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGnD;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,gBAAgB,EAC7B,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;CAAO,GAClF,CAAC,EAAE,EAAE,wBAAwB,KAAK,OAAO,CAAC,OAAO,CAAC,CA4JpD"}