@adonis-agora/agent 0.76.3 → 0.77.1

package/dist/src/poppy-client/mcp.d.ts

@@ -0,0 +1,16 @@
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import type { CompanyClient } from './company.js';
+import type { PoppyApiEntry } from './types.js';
+export interface McpConnection {
+    client: Client;
+    api: PoppyApiEntry;
+    close(): Promise<void>;
+}
+/**
+ * Connects to a listed MCP server over Streamable HTTP with a Bearer Session Token issued for
+ * that server's `url` (4.3 "Bearer tokens", section 6). On `invalid_token` the token is
+ * re-minted once and the request retried; a `403` `insufficient_scope` / `sign_in_required`
+ * rejects the call with a {@link ResourceAuthError} carrying the needed `scope`.
+ */
+export declare function connectMcp(company: CompanyClient, apiIndex?: number | undefined): Promise<McpConnection>;
+//# sourceMappingURL=mcp.d.ts.map

package/dist/src/poppy-client/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAGnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,aAAa,CAAC;IACnB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,aAAa,EACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,GAC5B,OAAO,CAAC,aAAa,CAAC,CAgDxB"}

package/dist/src/poppy-client/mcp.js

@@ -0,0 +1,57 @@
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { pickApi } from './api.js';
+import { ResourceAuthError } from './errors.js';
+import { wwwAuthError } from './util.js';
+/**
+ * Connects to a listed MCP server over Streamable HTTP with a Bearer Session Token issued for
+ * that server's `url` (4.3 "Bearer tokens", section 6). On `invalid_token` the token is
+ * re-minted once and the request retried; a `403` `insufficient_scope` / `sign_in_required`
+ * rejects the call with a {@link ResourceAuthError} carrying the needed `scope`.
+ */
+export async function connectMcp(company, apiIndex) {
+    const api = pickApi(company, 'mcp', apiIndex);
+    // `resource` MUST be the MCP server's `url` from poppy.json (4.3).
+    const resource = api.url;
+    let token = await company.bearerFor(resource);
+    const authedFetch = async (input, init) => {
+        for (let attempt = 0;; attempt++) {
+            const headers = new Headers(init?.headers);
+            headers.set('authorization', `Bearer ${token}`);
+            const res = await company.http.fetch(input, { ...init, headers });
+            const err = wwwAuthError(res.headers.get('www-authenticate'));
+            if (res.status === 401 && attempt === 0 && (!err.error || err.error === 'invalid_token')) {
+                token = await company.bearerFor(resource, true);
+                continue;
+            }
+            // A signed-in Bearer whose Session was signed out meanwhile (4.4): the Account Token signs
+            // it back in — or, revoked, answers invalid_grant and the client continues signed out.
+            if (res.status === 403 &&
+                attempt === 0 &&
+                err.error === 'sign_in_required' &&
+                company.accountToken) {
+                await res.body?.cancel().catch(() => { });
+                token = await company.bearerFor(resource, true);
+                continue;
+            }
+            // A tool behind a scope the user did not grant (MCP scope step-up, RFC 6750 §3.1): surface it
+            // like any other resource, so the caller can sign in again with `scope`.
+            if (res.status === 403 &&
+                (err.error === 'insufficient_scope' || err.error === 'sign_in_required')) {
+                await res.body?.cancel().catch(() => { });
+                throw new ResourceAuthError(err.error, {
+                    status: 403,
+                    description: err.description,
+                    scope: err.scope,
+                });
+            }
+            return res;
+        }
+    };
+    const transport = new StreamableHTTPClientTransport(new URL(api.url), { fetch: authedFetch });
+    const client = new Client({ name: 'poppy-agent', version: '0.0.0' });
+    // The SDK's own types disagree under `exactOptionalPropertyTypes`; the transport is the SDK's.
+    await client.connect(transport);
+    return { client, api, close: () => client.close() };
+}
+//# sourceMappingURL=mcp.js.map

package/dist/src/poppy-client/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/poppy-client/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAQzC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAsB,EACtB,QAA6B;IAE7B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9C,mEAAmE;IACnE,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC;IACzB,IAAI,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,KAAK,EAAE,KAAmB,EAAE,IAAkB,EAAqB,EAAE;QACvF,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;YAChD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAClE,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;YAC9D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,KAAK,eAAe,CAAC,EAAE,CAAC;gBACzF,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAChD,SAAS;YACX,CAAC;YACD,2FAA2F;YAC3F,uFAAuF;YACvF,IACE,GAAG,CAAC,MAAM,KAAK,GAAG;gBAClB,OAAO,KAAK,CAAC;gBACb,GAAG,CAAC,KAAK,KAAK,kBAAkB;gBAChC,OAAO,CAAC,YAAY,EACpB,CAAC;gBACD,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACzC,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAChD,SAAS;YACX,CAAC;YACD,8FAA8F;YAC9F,yEAAyE;YACzE,IACE,GAAG,CAAC,MAAM,KAAK,GAAG;gBAClB,CAAC,GAAG,CAAC,KAAK,KAAK,oBAAoB,IAAI,GAAG,CAAC,KAAK,KAAK,kBAAkB,CAAC,EACxE,CAAC;gBACD,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACzC,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE;oBACrC,MAAM,EAAE,GAAG;oBACX,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,KAAK,EAAE,GAAG,CAAC,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,+FAA+F;IAC/F,MAAM,MAAM,CAAC,OAAO,CAAC,SAAwD,CAAC,CAAC;IAC/E,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;AACtD,CAAC"}

package/dist/src/poppy-client/open_url.d.ts

@@ -0,0 +1,3 @@
+/** Best-effort: opens a URL in the desktop browser. Callers always print the URL as well. */
+export declare function openInBrowser(url: string): void;
+//# sourceMappingURL=open_url.d.ts.map

package/dist/src/poppy-client/open_url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open_url.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/open_url.ts"],"names":[],"mappings":"AAEA,6FAA6F;AAC7F,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAS/C"}

package/dist/src/poppy-client/open_url.js

@@ -0,0 +1,13 @@
+import { spawn } from 'node:child_process';
+/** Best-effort: opens a URL in the desktop browser. Callers always print the URL as well. */
+export function openInBrowser(url) {
+    const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'cmd' : 'xdg-open';
+    const args = process.platform === 'win32' ? ['/c', 'start', '""', url] : [url];
+    try {
+        const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
+        child.on('error', () => { });
+        child.unref();
+    }
+    catch { }
+}
+//# sourceMappingURL=open_url.js.map

package/dist/src/poppy-client/open_url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open_url.js","sourceRoot":"","sources":["../../../src/poppy-client/open_url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,6FAA6F;AAC7F,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,GAAG,GACP,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IAC7F,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC5B,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;AACZ,CAAC"}

package/dist/src/poppy-client/signin.d.ts

@@ -0,0 +1,59 @@
+import type { CompanyClient, SignInResult } from './company.js';
+export type SignInType = 'direct' | 'device' | 'mediated';
+/** The sign-in types this Company offers that can grant every requested scope (4.4). */
+export declare function eligibleSignInTypes(company: CompanyClient, scope: string): SignInType[];
+export interface PendingDirectSignIn {
+    url: string;
+    state: string;
+    codeVerifier: string;
+    redirectUri: string;
+    scope: string;
+    issuer: string;
+}
+/** Step 1 of 4.5: PKCE (S256) + random `state`, and the authorization URL to open. */
+export declare function startDirectSignIn(company: CompanyClient, scope: string): Promise<PendingDirectSignIn>;
+/**
+ * Steps 3–4 of 4.5: checks `state` and the RFC 9207 `iss` (exact match with the issuer we
+ * started with), then exchanges the code with PKCE, DPoP and `session_id`.
+ */
+export declare function completeDirectSignIn(company: CompanyClient, pending: PendingDirectSignIn, callback: URLSearchParams): Promise<SignInResult>;
+export interface DeviceSignInOptions {
+    /** Shows the link and code to the User. `device_code` is never passed here. */
+    display: (info: {
+        userCode: string;
+        verificationUri: string;
+        verificationUriComplete?: string | undefined;
+        expiresIn: number;
+    }) => void;
+    signal?: AbortSignal | undefined;
+    /** Hook for tests. */
+    sleep?: ((ms: number, signal?: AbortSignal) => Promise<void>) | undefined;
+    onPoll?: ((status: 'authorization_pending' | 'slow_down', intervalSeconds: number) => void) | undefined;
+}
+/** RFC 8628 device flow: start, show the code, poll every `interval`, +5s on `slow_down`. */
+export declare function deviceSignIn(company: CompanyClient, scope: string, opts: DeviceSignInOptions): Promise<SignInResult>;
+/**
+ * One device-code exchange (4.6), for a server that cannot hold a polling loop open (the user
+ * comes back and says "approved"): `'pending'` while the User has not decided, the sign-in when
+ * they approved. `access_denied` / `expired_token` throw.
+ */
+export declare function pollDeviceSignInOnce(company: CompanyClient, deviceCode: string, scope: string): Promise<SignInResult | 'pending'>;
+export type MediatedOutcome = {
+    status: 'complete';
+    result: SignInResult;
+} | {
+    status: 'code_required';
+    signInId: string;
+    sentTo?: string | undefined;
+    expiresAt?: string | undefined;
+} | {
+    status: 'failed' | 'expired';
+};
+/**
+ * Mediated Sign-In (4.7). Credentials go ONLY to `auth.mediated.endpoint`, with the current
+ * Session Token. Secret values are never logged or echoed by this module.
+ */
+export declare function mediatedSignIn(company: CompanyClient, scope: string, credentials: Record<string, string>): Promise<MediatedOutcome>;
+/** Submits only the one-time code, to `{endpoint}/{sign_in_id}` (4.7). */
+export declare function submitMediatedCode(company: CompanyClient, scope: string, signInId: string, code: string): Promise<MediatedOutcome>;
+//# sourceMappingURL=signin.d.ts.map

package/dist/src/poppy-client/signin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signin.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/signin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAMhE,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE1D,wFAAwF;AACxF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,EAAE,CAOvF;AAmBD,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,sFAAsF;AACtF,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,mBAAmB,CAAC,CAkB9B;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,YAAY,CAAC,CA2BvB;AAuBD,MAAM,WAAW,mBAAmB;IAClC,+EAA+E;IAC/E,OAAO,EAAE,CAAC,IAAI,EAAE;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,uBAAuB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC7C,SAAS,EAAE,MAAM,CAAC;KACnB,KAAK,IAAI,CAAC;IACX,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACjC,sBAAsB;IACtB,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IAC1E,MAAM,CAAC,EACH,CAAC,CAAC,MAAM,EAAE,uBAAuB,GAAG,WAAW,EAAE,eAAe,EAAE,MAAM,KAAK,IAAI,CAAC,GAClF,SAAS,CAAC;CACf;AAED,6FAA6F;AAC7F,wBAAsB,YAAY,CAChC,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,YAAY,CAAC,CAsCvB;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,aAAa,EACtB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAYnC;AAID,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GAC5C;IACE,MAAM,EAAE,eAAe,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC,GACD;IAAE,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAA;CAAE,CAAC;AA8CrC;;;GAGG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAClC,OAAO,CAAC,eAAe,CAAC,CAc1B;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,eAAe,CAAC,CAG1B"}

package/dist/src/poppy-client/signin.js

@@ -0,0 +1,210 @@
+import { randomBytes } from 'node:crypto';
+import { OAuthError, PoppyError } from './errors.js';
+import { readJson } from './http.js';
+import { requireSecureUrl, scopeSet, sha256b64url, sleep } from './util.js';
+/** The sign-in types this Company offers that can grant every requested scope (4.4). */
+export function eligibleSignInTypes(company, scope) {
+    const auth = company.document.auth;
+    const wanted = [...scopeSet(scope)];
+    return ['direct', 'device', 'mediated'].filter((t) => {
+        const cfg = auth[t];
+        return cfg && wanted.every((s) => cfg.scopes.includes(s));
+    });
+}
+function assertScopeAllowed(company, type, scope) {
+    const cfg = company.document.auth[type];
+    if (!cfg)
+        throw new PoppyError('unsupported_sign_in', `${type} sign-in is not offered`);
+    if (scopeSet(scope).size === 0) {
+        throw new PoppyError('invalid_scope', 'sign-in requests MUST include scope (4.4)');
+    }
+    const extra = [...scopeSet(scope)].filter((s) => !cfg.scopes.includes(s));
+    if (extra.length > 0) {
+        throw new PoppyError('invalid_scope', `${type} sign-in can't grant ${extra.join(', ')} (offers: ${cfg.scopes.join(' ')})`);
+    }
+}
+/** Step 1 of 4.5: PKCE (S256) + random `state`, and the authorization URL to open. */
+export async function startDirectSignIn(company, scope) {
+    assertScopeAllowed(company, 'direct', scope);
+    const endpoint = company.metadata.authorization_endpoint;
+    if (!endpoint)
+        throw new PoppyError('unsupported_sign_in', 'no authorization_endpoint');
+    // Make sure there is a Session for the code exchange to sign in.
+    await company.token();
+    const state = randomBytes(16).toString('base64url');
+    const codeVerifier = randomBytes(32).toString('base64url');
+    const redirectUri = company.agent.identity.redirectUri;
+    const url = new URL(endpoint);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('client_id', company.agent.identity.clientId);
+    url.searchParams.set('redirect_uri', redirectUri);
+    url.searchParams.set('scope', scope);
+    url.searchParams.set('state', state);
+    url.searchParams.set('code_challenge', sha256b64url(codeVerifier));
+    url.searchParams.set('code_challenge_method', 'S256');
+    return { url: url.toString(), state, codeVerifier, redirectUri, scope, issuer: company.issuer };
+}
+/**
+ * Steps 3–4 of 4.5: checks `state` and the RFC 9207 `iss` (exact match with the issuer we
+ * started with), then exchanges the code with PKCE, DPoP and `session_id`.
+ */
+export async function completeDirectSignIn(company, pending, callback) {
+    if (callback.get('state') !== pending.state) {
+        throw new PoppyError('state_mismatch', 'Direct Sign-In callback state does not match');
+    }
+    const iss = callback.get('iss');
+    if (iss !== pending.issuer) {
+        throw new PoppyError('issuer_mismatch', `Direct Sign-In callback iss "${iss ?? '(missing)'}" != "${pending.issuer}" (RFC 9207)`);
+    }
+    const error = callback.get('error');
+    if (error) {
+        throw new OAuthError(error, { description: callback.get('error_description') ?? undefined });
+    }
+    const code = callback.get('code');
+    if (!code)
+        throw new PoppyError('invalid_callback', 'callback has neither code nor error');
+    const resp = await withLiveSession(company, (sessionId) => company.tokens.authorizationCode({
+        code,
+        redirectUri: pending.redirectUri,
+        codeVerifier: pending.codeVerifier,
+        sessionId,
+        dpop: company.dpop,
+    }));
+    return company.applySignIn(resp, 'direct', pending.scope);
+}
+/**
+ * Runs a sign-in exchange with the current Session. The stored Session may have ended at the
+ * Company (expired, ended, the Company's data reset) — 4.2: on `invalid_session` the agent starts a
+ * new Session and the exchange is retried once with it (the code is not consumed by the refusal).
+ */
+async function withLiveSession(company, exchange) {
+    const sessionId = (await company.token()).sessionId;
+    try {
+        return await exchange(sessionId);
+    }
+    catch (e) {
+        if (!(e instanceof OAuthError) || e.code !== 'invalid_session')
+            throw e;
+        company.agent.log('invalid_session during sign-in: starting a new Session');
+        return exchange((await company.token({ forceRenew: true })).sessionId);
+    }
+}
+/** RFC 8628 device flow: start, show the code, poll every `interval`, +5s on `slow_down`. */
+export async function deviceSignIn(company, scope, opts) {
+    assertScopeAllowed(company, 'device', scope);
+    const d = await company.tokens.deviceAuthorization(scope);
+    opts.display({
+        userCode: d.user_code,
+        verificationUri: d.verification_uri,
+        verificationUriComplete: d.verification_uri_complete,
+        expiresIn: d.expires_in,
+    });
+    const wait = opts.sleep ?? sleep;
+    let interval = typeof d.interval === 'number' && d.interval > 0 ? d.interval : 5;
+    const deadline = Date.now() + d.expires_in * 1000;
+    for (;;) {
+        await wait(interval * 1000, opts.signal);
+        if (Date.now() > deadline)
+            throw new OAuthError('expired_token');
+        try {
+            const resp = await withLiveSession(company, (sessionId) => company.tokens.deviceToken({
+                deviceCode: d.device_code,
+                sessionId,
+                dpop: company.dpop,
+            }));
+            return await company.applySignIn(resp, 'device', scope);
+        }
+        catch (e) {
+            if (!(e instanceof OAuthError))
+                throw e;
+            if (e.code === 'authorization_pending') {
+                opts.onPoll?.('authorization_pending', interval);
+                continue;
+            }
+            if (e.code === 'slow_down') {
+                interval += 5; // RFC 8628 section 3.5
+                opts.onPoll?.('slow_down', interval);
+                continue;
+            }
+            throw e; // access_denied, expired_token, anything else: stop asking.
+        }
+    }
+}
+/**
+ * One device-code exchange (4.6), for a server that cannot hold a polling loop open (the user
+ * comes back and says "approved"): `'pending'` while the User has not decided, the sign-in when
+ * they approved. `access_denied` / `expired_token` throw.
+ */
+export async function pollDeviceSignInOnce(company, deviceCode, scope) {
+    try {
+        const resp = await withLiveSession(company, (sessionId) => company.tokens.deviceToken({ deviceCode, sessionId, dpop: company.dpop }));
+        return await company.applySignIn(resp, 'device', scope);
+    }
+    catch (e) {
+        if (e instanceof OAuthError && (e.code === 'authorization_pending' || e.code === 'slow_down')) {
+            return 'pending';
+        }
+        throw e;
+    }
+}
+async function mediatedRequest(company, url, body, scope) {
+    const res = await company.fetch(url, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', accept: 'application/json' },
+        body: JSON.stringify(body),
+    });
+    const json = await readJson(res);
+    if (!json || typeof json.status !== 'string') {
+        throw new PoppyError(json?.error ?? `http_${res.status}`, undefined, {
+            status: res.status,
+            description: 'mediated sign-in failed',
+        });
+    }
+    switch (json.status) {
+        case 'complete': {
+            const resp = json;
+            if (String(resp.token_type).toLowerCase() !== 'dpop') {
+                throw new OAuthError('invalid_response', { description: 'expected a DPoP Session Token' });
+            }
+            return { status: 'complete', result: await company.applySignIn(resp, 'mediated', scope) };
+        }
+        case 'code_required':
+            if (!json.sign_in_id || !/^[A-Za-z0-9_-]{1,256}$/.test(json.sign_in_id)) {
+                throw new PoppyError('invalid_response', 'code_required without a valid sign_in_id');
+            }
+            return {
+                status: 'code_required',
+                signInId: json.sign_in_id,
+                sentTo: json.code?.sent_to,
+                expiresAt: json.expires_at,
+            };
+        case 'failed':
+        case 'expired':
+            return { status: json.status };
+        default:
+            throw new PoppyError('invalid_response', `unknown mediated status ${String(json.status)}`);
+    }
+}
+/**
+ * Mediated Sign-In (4.7). Credentials go ONLY to `auth.mediated.endpoint`, with the current
+ * Session Token. Secret values are never logged or echoed by this module.
+ */
+export async function mediatedSignIn(company, scope, credentials) {
+    assertScopeAllowed(company, 'mediated', scope);
+    const mediated = company.document.auth.mediated;
+    const endpoint = requireSecureUrl(mediated.endpoint, 'auth.mediated.endpoint', company.security);
+    const missing = mediated.fields.filter((f) => typeof credentials[f.name] !== 'string');
+    if (missing.length > 0) {
+        throw new PoppyError('missing_credentials', `missing: ${missing.map((f) => f.name).join(', ')}`);
+    }
+    const sent = {};
+    for (const f of mediated.fields)
+        sent[f.name] = credentials[f.name] ?? '';
+    return mediatedRequest(company, endpoint.toString(), { scope, credentials: sent }, scope);
+}
+/** Submits only the one-time code, to `{endpoint}/{sign_in_id}` (4.7). */
+export function submitMediatedCode(company, scope, signInId, code) {
+    const base = company.document.auth.mediated.endpoint.replace(/\/+$/, '');
+    return mediatedRequest(company, `${base}/${encodeURIComponent(signInId)}`, { code }, scope);
+}
+//# sourceMappingURL=signin.js.map

package/dist/src/poppy-client/signin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signin.js","sourceRoot":"","sources":["../../../src/poppy-client/signin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAI5E,wFAAwF;AACxF,MAAM,UAAU,mBAAmB,CAAC,OAAsB,EAAE,KAAa;IACvE,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAK,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,OAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAsB,EAAE,IAAgB,EAAE,KAAa;IACjF,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAK,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,UAAU,CAAC,qBAAqB,EAAE,GAAG,IAAI,yBAAyB,CAAC,CAAC;IACxF,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,UAAU,CAClB,eAAe,EACf,GAAG,IAAI,wBAAwB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAaD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAsB,EACtB,KAAa;IAEb,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IACzD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,UAAU,CAAC,qBAAqB,EAAE,2BAA2B,CAAC,CAAC;IACxF,iEAAiE;IACjE,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;IACnE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AAClG,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAsB,EACtB,OAA4B,EAC5B,QAAyB;IAEzB,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QAC5C,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,8CAA8C,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,gCAAgC,GAAG,IAAI,WAAW,SAAS,OAAO,CAAC,MAAM,cAAc,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,UAAU,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,qCAAqC,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CACxD,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC/B,IAAI;QACJ,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS;QACT,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CACH,CAAC;IACF,OAAO,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAC5B,OAAsB,EACtB,QAA2C;IAE3C,MAAM,SAAS,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC;IACpD,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB;YAAE,MAAM,CAAC,CAAC;QACxE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;QAC5E,OAAO,QAAQ,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAoBD,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAsB,EACtB,KAAa,EACb,IAAyB;IAEzB,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7C,MAAM,CAAC,GAAgC,MAAM,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACvF,IAAI,CAAC,OAAO,CAAC;QACX,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,eAAe,EAAE,CAAC,CAAC,gBAAgB;QACnC,uBAAuB,EAAE,CAAC,CAAC,yBAAyB;QACpD,SAAS,EAAE,CAAC,CAAC,UAAU;KACxB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACjC,IAAI,QAAQ,GAAG,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC;IAClD,SAAS,CAAC;QACR,MAAM,IAAI,CAAC,QAAQ,GAAG,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CACxD,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;gBACzB,UAAU,EAAE,CAAC,CAAC,WAAW;gBACzB,SAAS;gBACT,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAC,CACH,CAAC;YACF,OAAO,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC;gBAAE,MAAM,CAAC,CAAC;YACxC,IAAI,CAAC,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;gBACvC,IAAI,CAAC,MAAM,EAAE,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC;gBACjD,SAAS;YACX,CAAC;YACD,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC3B,QAAQ,IAAI,CAAC,CAAC,CAAC,uBAAuB;gBACtC,IAAI,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;gBACrC,SAAS;YACX,CAAC;YACD,MAAM,CAAC,CAAC,CAAC,4DAA4D;QACvE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAsB,EACtB,UAAkB,EAClB,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CACxD,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAC1E,CAAC;QACF,OAAO,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,UAAU,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAuB,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,EAAE,CAAC;YAC9F,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAcD,KAAK,UAAU,eAAe,CAC5B,OAAsB,EACtB,GAAW,EACX,IAAa,EACb,KAAa;IAEb,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;QACnC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAoD,GAAG,CAAC,CAAC;IACpF,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE;YACnE,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,WAAW,EAAE,yBAAyB;SACvC,CAAC,CAAC;IACL,CAAC;IACD,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,IAAgC,CAAC;YAC9C,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBACrD,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC;QAC5F,CAAC;QACD,KAAK,eAAe;YAClB,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACxE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,0CAA0C,CAAC,CAAC;YACvF,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,eAAe;gBACvB,QAAQ,EAAE,IAAI,CAAC,UAAU;gBACzB,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO;gBAC1B,SAAS,EAAE,IAAI,CAAC,UAAU;aAC3B,CAAC;QACJ,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACjC;YACE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,2BAA2B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAsB,EACtB,KAAa,EACb,WAAmC;IAEnC,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAK,CAAC,QAAS,CAAC;IAClD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC;IACvF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,UAAU,CAClB,qBAAqB,EACrB,YAAY,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM;QAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1E,OAAO,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;AAC5F,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAChC,OAAsB,EACtB,KAAa,EACb,QAAgB,EAChB,IAAY;IAEZ,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAK,CAAC,QAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3E,OAAO,eAAe,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;AAC9F,CAAC"}

package/dist/src/poppy-client/sse.d.ts

@@ -0,0 +1,15 @@
+/** One dispatched server-sent event (WHATWG HTML, "Server-sent events"). */
+export interface SseEvent {
+    /** `message` when the stream gave no `event:` field. */
+    event: string;
+    data: string;
+    /** The `id:` field of this event, if it had one. */
+    id?: string | undefined;
+    retry?: number | undefined;
+}
+/**
+ * Parses an SSE byte stream. Follows the WHATWG algorithm closely enough for Poppy: CRLF/CR/LF
+ * line endings, `:` comments, multi-line `data`, `id` without NUL, `retry`.
+ */
+export declare function parseSse(stream: ReadableStream<Uint8Array>): AsyncGenerator<SseEvent>;
+//# sourceMappingURL=sse.d.ts.map

package/dist/src/poppy-client/sse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/sse.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,WAAW,QAAQ;IACvB,wDAAwD;IACxD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAuB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,cAAc,CAAC,QAAQ,CAAC,CA6D5F"}

package/dist/src/poppy-client/sse.js

@@ -0,0 +1,74 @@
+/**
+ * Parses an SSE byte stream. Follows the WHATWG algorithm closely enough for Poppy: CRLF/CR/LF
+ * line endings, `:` comments, multi-line `data`, `id` without NUL, `retry`.
+ */
+export async function* parseSse(stream) {
+    const decoder = new TextDecoder();
+    let buffer = '';
+    let data = [];
+    let event = '';
+    let id;
+    let retry;
+    let sawCr = false;
+    const dispatch = () => {
+        const out = data.length > 0 ? { event: event || 'message', data: data.join('\n'), id, retry } : undefined;
+        data = [];
+        event = '';
+        id = undefined;
+        retry = undefined;
+        return out;
+    };
+    const handleLine = (line) => {
+        if (line === '')
+            return dispatch();
+        if (line.startsWith(':'))
+            return undefined;
+        const colon = line.indexOf(':');
+        const field = colon === -1 ? line : line.slice(0, colon);
+        let value = colon === -1 ? '' : line.slice(colon + 1);
+        if (value.startsWith(' '))
+            value = value.slice(1);
+        if (field === 'data')
+            data.push(value);
+        else if (field === 'event')
+            event = value;
+        else if (field === 'id' && !value.includes('\0'))
+            id = value;
+        else if (field === 'retry' && /^\d+$/.test(value))
+            retry = Number(value);
+        return undefined;
+    };
+    const reader = stream.getReader();
+    try {
+        for (;;) {
+            const { value, done } = await reader.read();
+            if (done)
+                break;
+            buffer += decoder.decode(value, { stream: true });
+            let start = 0;
+            for (let i = 0; i < buffer.length; i++) {
+                const ch = buffer[i];
+                if (ch === '\n' && sawCr) {
+                    sawCr = false;
+                    start = i + 1;
+                    continue;
+                }
+                sawCr = false;
+                if (ch === '\r' || ch === '\n') {
+                    if (ch === '\r')
+                        sawCr = true;
+                    const ev = handleLine(buffer.slice(start, i));
+                    start = i + 1;
+                    if (ev)
+                        yield ev;
+                }
+            }
+            buffer = buffer.slice(start);
+        }
+        // An event without its terminating blank line is discarded, per the spec.
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+//# sourceMappingURL=sse.js.map

package/dist/src/poppy-client/sse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.js","sourceRoot":"","sources":["../../../src/poppy-client/sse.ts"],"names":[],"mappings":"AAUA;;;GAGG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAkC;IAChE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,IAAI,GAAa,EAAE,CAAC;IACxB,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,EAAsB,CAAC;IAC3B,IAAI,KAAyB,CAAC;IAC9B,IAAI,KAAK,GAAG,KAAK,CAAC;IAElB,MAAM,QAAQ,GAAG,GAAyB,EAAE;QAC1C,MAAM,GAAG,GACP,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,IAAI,GAAG,EAAE,CAAC;QACV,KAAK,GAAG,EAAE,CAAC;QACX,EAAE,GAAG,SAAS,CAAC;QACf,KAAK,GAAG,SAAS,CAAC;QAClB,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAwB,EAAE;QACxD,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,QAAQ,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,KAAK,KAAK,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;aAClC,IAAI,KAAK,KAAK,OAAO;YAAE,KAAK,GAAG,KAAK,CAAC;aACrC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,EAAE,GAAG,KAAK,CAAC;aACxD,IAAI,KAAK,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACzE,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACvC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBACrB,IAAI,EAAE,KAAK,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,KAAK,GAAG,KAAK,CAAC;oBACd,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;oBACd,SAAS;gBACX,CAAC;gBACD,KAAK,GAAG,KAAK,CAAC;gBACd,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;oBAC/B,IAAI,EAAE,KAAK,IAAI;wBAAE,KAAK,GAAG,IAAI,CAAC;oBAC9B,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;oBAC9C,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;oBACd,IAAI,EAAE;wBAAE,MAAM,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QACD,0EAA0E;IAC5E,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/src/poppy-client/store.d.ts

@@ -0,0 +1,89 @@
+import type { StoredKey } from './keys.js';
+export interface TokenRecord {
+    accessToken: string;
+    tokenType: string;
+    /** Epoch ms. */
+    expiresAt: number;
+    scope: string;
+    sessionId: string;
+    signedIn: boolean;
+    /** RFC 8707 resource this token was issued for, if any. */
+    resource?: string | undefined;
+}
+export interface AccountTokenRecord {
+    /** The Account Token (an OAuth refresh token). A secret: never logged or shown (4.8). */
+    refreshToken: string;
+    scope: string;
+    obtainedAt: number;
+    /** Epoch ms, from `refresh_token_expires_in` when the Company sets one. */
+    expiresAt?: number | undefined;
+    /** Which sign-in type produced it. */
+    via: 'direct' | 'device' | 'mediated';
+}
+export interface ConversationRecord {
+    endpoint: string;
+    /** Last event handled (a cursor / Last-Event-ID). */
+    cursor?: string | undefined;
+    parentConversationId?: string | undefined;
+    createdAt: number;
+    closed?: boolean | undefined;
+}
+/** Everything the agent remembers about one User at one Company (keyed by issuer, 3.2). */
+export interface CompanyState {
+    issuer: string;
+    domains: string[];
+    /** Opaque, random, per-Company User ID (4.2). Never derived from personal information. */
+    userId: string;
+    /** DPoP key for this User at this Company (4.3). Never published. */
+    dpopKey: StoredKey;
+    accountToken?: AccountTokenRecord | undefined;
+    /** Session Tokens by key: `dpop` (default) or `dpop|scope|resource` / `bearer|resource`. */
+    tokens: Record<string, TokenRecord>;
+    /** The current Session's ID. Not a credential (4.2). */
+    sessionId?: string | undefined;
+    conversations: Record<string, ConversationRecord>;
+}
+export interface IdentityState {
+    baseUrl: string;
+    clientName: string;
+    logoUri?: string | undefined;
+    keys: StoredKey[];
+}
+export interface StateFile {
+    version: 1;
+    identity?: IdentityState | undefined;
+    /** Local users ("profiles") of this agent, each with their Companies. */
+    profiles: Record<string, {
+        companies: Record<string, CompanyState>;
+    }>;
+}
+export declare function defaultStatePath(): string;
+/**
+ * The local state file. It holds private keys and Account Tokens, so it is written with mode
+ * 0600 (directory 0700) and atomically (temp file + rename).
+ */
+export declare class StateStore {
+    #private;
+    readonly path: string;
+    data: StateFile;
+    private readonly persist?;
+    private constructor();
+    /**
+     * A state kept by the caller instead of a file — a server keeping each user's Companies in its
+     * own database. `persist` receives the whole state on every save (serialized, like the file).
+     */
+    static memory(data?: StateFile, persist?: (data: StateFile) => Promise<void>): StateStore;
+    static open(path?: string): Promise<StateStore>;
+    /** Directory next to the state file, used for the Direct Sign-In callback relay. */
+    get dir(): string;
+    profile(name: string): {
+        companies: Record<string, CompanyState>;
+    };
+    /**
+     * Writes the state atomically (tmp file + rename). Saves are serialized: a conversation stream
+     * and the prompt can save at the same time, and two writes sharing one tmp file made the second
+     * `rename` fail with ENOENT.
+     */
+    save(): Promise<void>;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/src/poppy-client/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,yFAAyF;IACzF,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,sCAAsC;IACtC,GAAG,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAC;CACvC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC9B;AAED,2FAA2F;AAC3F,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,0FAA0F;IAC1F,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,OAAO,EAAE,SAAS,CAAC;IACnB,YAAY,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC9C,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,IAAI,EAAE,SAAS,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACrC,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;KAAE,CAAC,CAAC;CACvE;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAED;;;GAGG;AACH,qBAAa,UAAU;;IAEnB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACd,IAAI,EAAE,SAAS;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAH3B,OAAO,eAIH;IAEJ;;;OAGG;IACH,MAAM,CAAC,MAAM,CACX,IAAI,GAAE,SAAwC,EAC9C,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,GAC3C,UAAU,CAGZ;IAED,OAAa,IAAI,CAAC,IAAI,SAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,CAahE;IAED,oFAAoF;IACpF,IAAI,GAAG,IAAI,MAAM,CAEhB;IAED,OAAO,CAAC,IAAI,EAAE,MAAM;mBApDkB,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC;MAuDjE;IAID;;;;OAIG;IACH,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAIpB;CAYF"}