@adonis-agora/agent 0.93.0 → 0.95.0

package/dist/src/poppy-client/discovery.js

@@ -1,8 +1,12 @@
 import { DiscoveryError } from './errors.js';
+import { companyFetch } from './safe_fetch.js';
 import { isLoopbackHost, normalizeDomain, requireSecureUrl, } from './util.js';
-/** Major protocol versions this client implements (3.1). */
-export const SUPPORTED_MAJOR_VERSIONS = ['0'];
+/** Before 1.0 each `major.minor` can break the last, so these are exact versions (3.1). */
+export const SUPPORTED_PROTOCOL_VERSIONS = ['0.3'];
+export const WELL_KNOWN_POPPY_PATH = '/.well-known/poppy.json';
 const MAX_REDIRECTS = 5;
+const GRANT_AUTHORIZATION_CODE = 'authorization_code';
+const GRANT_DEVICE_CODE = 'urn:ietf:params:oauth:grant-type:device_code';
 /** In-memory cache of JSON documents by URL, by `Cache-Control: max-age`. */
 export class HttpJsonCache {
     entries = new Map();
@@ -25,11 +29,6 @@ export class HttpJsonCache {
         this.entries.set(url, { expires: Date.now() + Number(m[1]) * 1000, value });
     }
 }
-/**
- * Turns user input into the well-known URL. `example.com` → `https://example.com/...`.
- * With `insecureDev`, an explicit `http://host:port` is kept, and a bare loopback host
- * (`localhost:3333`) defaults to `http:`.
- */
 export function wellKnownUrlFor(input, sec = {}) {
     let base;
     if (/^[a-z]+:\/\//i.test(input)) {
@@ -40,13 +39,13 @@ export function wellKnownUrlFor(input, sec = {}) {
         base = sec.insecureDev && isLoopbackHost(guess.hostname) ? new URL(`http://${input}`) : guess;
     }
     requireSecureUrl(base.toString(), 'Company domain', sec);
-    return new URL('/.well-known/poppy.json', base.origin);
+    return new URL(WELL_KNOWN_POPPY_PATH, base.origin);
 }
 async function fetchJson(url, what, opts) {
     const cached = opts.cache?.get(url.toString());
     if (cached !== undefined)
-        return { json: cached, finalUrl: url };
-    const doFetch = opts.fetch ?? ((i, init) => globalThis.fetch(i, init));
+        return cached;
+    const doFetch = opts.fetch ?? companyFetch(opts.insecureDev);
     let current = url;
     for (let hop = 0;; hop++) {
         const res = await doFetch(current.toString(), {
@@ -67,6 +66,8 @@ async function fetchJson(url, what, opts) {
             current = next;
             continue;
         }
+        if (res.status === 404 && opts.notFoundIsNull)
+            return { json: null, finalUrl: current };
         if (!res.ok) {
             throw new DiscoveryError('fetch_failed', `${what}: HTTP ${res.status} from ${current}`);
         }
@@ -77,8 +78,9 @@ async function fetchJson(url, what, opts) {
         catch {
             throw new DiscoveryError('invalid_json', `${what}: response is not JSON`);
         }
-        opts.cache?.set(url.toString(), json, res.headers.get('cache-control'));
-        return { json, finalUrl: current };
+        const fetched = { json, finalUrl: current };
+        opts.cache?.set(url.toString(), fetched, res.headers.get('cache-control'));
+        return fetched;
     }
 }
 function fail(code, message) {
@@ -96,28 +98,27 @@ function checkUrl(value, what, sec) {
     }
 }
 /** Validates `poppy.json` against 3.1. Unknown fields are ignored, never rejected. */
-export function validatePoppyDocument(json, requestedHost, sec = {}) {
+export function validatePoppyDocument(json, servedHost, sec = {}) {
     if (!isObject(json))
         fail('invalid_document', 'poppy.json is not a JSON object');
     const version = json.protocol_version;
     if (typeof version !== 'string' || !/^\d+\.\d+$/.test(version)) {
         fail('invalid_document', 'protocol_version must be "major.minor"');
     }
-    const major = version.split('.')[0] ?? '';
-    if (!SUPPORTED_MAJOR_VERSIONS.includes(major)) {
-        fail('unsupported_protocol_version', `poppy.json protocol_version ${version} has major ${major}; this agent supports ${SUPPORTED_MAJOR_VERSIONS.join(', ')}`);
+    if (!SUPPORTED_PROTOCOL_VERSIONS.includes(version)) {
+        fail('unsupported_protocol_version', `poppy.json protocol_version ${version} is not supported; this agent supports ${SUPPORTED_PROTOCOL_VERSIONS.join(', ')}`);
     }
     const org = json.organization;
     if (!isObject(org) || typeof org.name !== 'string' || typeof org.domain !== 'string') {
         fail('invalid_document', 'organization.name and organization.domain are required');
     }
-    // organization.domain must match the host we requested, ignoring a leading www. The host
-    // after a redirect doesn't count (3.1). Ports only appear in --insecure-dev setups.
-    const requested = normalizeDomain(requestedHost);
-    const requestedNoPort = normalizeDomain(requestedHost.replace(/:\d+$/, ''));
+    // `organization.domain` is the host that served the document, compared ignoring case only (3.1).
+    // Ports only appear in --insecure-dev setups.
+    const served = normalizeDomain(servedHost);
+    const servedNoPort = sec.insecureDev ? served.replace(/:\d+$/, '') : served;
     const claimed = normalizeDomain(org.domain);
-    if (claimed !== requested && claimed !== requestedNoPort) {
-        fail('domain_mismatch', `organization.domain "${org.domain}" does not match the requested host "${requestedHost}"`);
+    if (claimed !== served && claimed !== servedNoPort) {
+        fail('domain_mismatch', `organization.domain "${org.domain}" is not the host that served the document, "${servedHost}"`);
     }
     const hasAgent = json.agent !== undefined;
     const hasApis = json.apis !== undefined;
@@ -132,33 +133,26 @@ export function validatePoppyDocument(json, requestedHost, sec = {}) {
             checkUrl(json.web.browser_session_endpoint, 'web.browser_session_endpoint', sec);
         }
     }
-    const needsAuth = hasAgent || hasApis || (isObject(json.web) && json.web.browser_session_endpoint);
-    if (needsAuth && json.auth === undefined) {
-        fail('invalid_document', 'auth is required when agent, apis or web.browser_session_endpoint is present');
-    }
     if (json.auth !== undefined) {
         const auth = json.auth;
         if (!isObject(auth))
             fail('invalid_document', 'auth must be an object');
-        checkUrl(auth.issuer, 'auth.issuer', sec);
-        for (const type of ['direct', 'device', 'mediated']) {
-            const t = auth[type];
-            if (t === undefined)
-                continue;
-            if (!isObject(t) ||
-                !Array.isArray(t.scopes) ||
-                !t.scopes.every((s) => typeof s === 'string')) {
-                fail('invalid_document', `auth.${type}.scopes must be a list of strings`);
-            }
-        }
-        if (isObject(auth.mediated)) {
-            checkUrl(auth.mediated.endpoint, 'auth.mediated.endpoint', sec);
-            const fields = auth.mediated.fields;
-            if (!Array.isArray(fields) ||
-                !fields.every((f) => isObject(f) && typeof f.name === 'string' && typeof f.label === 'string')) {
-                fail('invalid_document', 'auth.mediated.fields must list { name, label, secret }');
-            }
-        }
+        if (auth.issuer !== undefined)
+            checkUrl(auth.issuer, 'auth.issuer', sec);
+    }
+    for (const [field, key] of [
+        ['feedback', 'endpoint'],
+        ['excluded_tasks', 'url'],
+    ]) {
+        const value = json[field];
+        if (value === undefined)
+            continue;
+        if (!isObject(value))
+            fail('invalid_document', `${field} must be an object`);
+        checkUrl(value[key], `${field}.${key}`, sec);
+    }
+    if (json.extensions !== undefined && !isObject(json.extensions)) {
+        fail('invalid_document', 'extensions must be an object');
     }
     if (hasAgent) {
         if (!isObject(json.agent) || !Array.isArray(json.agent.protocols)) {
@@ -169,6 +163,44 @@ export function validatePoppyDocument(json, requestedHost, sec = {}) {
         fail('invalid_document', 'apis must be a list');
     return json;
 }
+/** RFC 9728 section 3.1: the well-known suffix goes between the host and the resource's path. */
+export function protectedResourceMetadataUrl(resource) {
+    const u = new URL(resource);
+    const path = u.pathname === '/' ? '' : u.pathname.replace(/\/$/, '');
+    return new URL(`${u.origin}/.well-known/oauth-protected-resource${path}`);
+}
+/**
+ * Validates the domain's protected resource metadata (3.2) and answers the issuer the Personal
+ * Agent uses, or `undefined` when valid metadata names none.
+ */
+export function validateProtectedResourceMetadata(json, doc, domainUrl, sec = {}) {
+    if (!isObject(json))
+        fail('invalid_metadata', 'protected resource metadata is not an object');
+    if (json.resource !== domainUrl) {
+        fail('resource_mismatch', `protected resource metadata resource "${String(json.resource)}" != "${domainUrl}"`);
+    }
+    const servers = json.authorization_servers;
+    if (servers !== undefined && !Array.isArray(servers)) {
+        fail('invalid_metadata', 'authorization_servers must be a list');
+    }
+    const list = (servers ?? []);
+    for (const entry of list)
+        checkUrl(entry, 'authorization_servers entry', sec);
+    const named = doc.auth?.issuer;
+    if (list.length === 0) {
+        if (named !== undefined) {
+            fail('issuer_mismatch', `auth.issuer "${named}" is not in authorization_servers`);
+        }
+        return undefined;
+    }
+    if (list.length > 1 && named === undefined) {
+        fail('issuer_required', 'several authorization_servers need auth.issuer to name one');
+    }
+    if (named !== undefined && !list.includes(named)) {
+        fail('issuer_mismatch', `auth.issuer "${named}" is not in authorization_servers`);
+    }
+    return named ?? list[0];
+}
 /** RFC 8414 section 3: the well-known suffix goes between the host and the issuer's path. */
 export function authServerMetadataUrl(issuer) {
     const u = new URL(issuer);
@@ -176,42 +208,76 @@ export function authServerMetadataUrl(issuer) {
     return new URL(`${u.origin}/.well-known/oauth-authorization-server${path}`);
 }
 /** Validates the issuer metadata against 3.2. */
-export function validateMetadata(json, doc, sec = {}) {
+export function validateMetadata(json, issuer, domainUrl, sec = {}) {
     if (!isObject(json))
         fail('invalid_metadata', 'authorization server metadata is not an object');
-    const auth = doc.auth;
-    if (json.issuer !== auth.issuer) {
-        fail('issuer_mismatch', `metadata issuer "${String(json.issuer)}" != auth.issuer "${auth.issuer}"`);
+    if (json.issuer !== issuer) {
+        fail('issuer_mismatch', `metadata issuer "${String(json.issuer)}" != issuer "${issuer}"`);
     }
-    const domains = json.poppy_domains;
-    if (!Array.isArray(domains)) {
-        fail('domain_not_listed', 'metadata has no poppy_domains, so it does not vouch for this domain');
-    }
-    const wanted = doc.organization.domain.toLowerCase();
-    if (!domains.some((d) => typeof d === 'string' && d.toLowerCase() === wanted)) {
-        fail('domain_not_listed', `poppy_domains of ${auth.issuer} does not include "${doc.organization.domain}"`);
+    const resources = json.protected_resources;
+    const wanted = domainUrl.toLowerCase();
+    if (!Array.isArray(resources) ||
+        !resources.some((r) => typeof r === 'string' && r.toLowerCase() === wanted)) {
+        fail('domain_not_listed', `protected_resources of ${issuer} does not include "${domainUrl}", so it does not vouch for this domain`);
     }
     checkUrl(json.token_endpoint, 'token_endpoint', sec);
     checkUrl(json.revocation_endpoint, 'revocation_endpoint', sec);
-    if (auth.direct)
+    const grants = json.grant_types_supported;
+    if (!Array.isArray(grants) || !grants.includes('refresh_token')) {
+        fail('invalid_metadata', 'grant_types_supported is required and must include refresh_token');
+    }
+    if (grants.includes(GRANT_AUTHORIZATION_CODE)) {
         checkUrl(json.authorization_endpoint, 'authorization_endpoint', sec);
-    if (auth.device)
+    }
+    if (grants.includes(GRANT_DEVICE_CODE)) {
         checkUrl(json.device_authorization_endpoint, 'device_authorization_endpoint', sec);
+    }
     return json;
 }
 /**
- * Discovery (section 3): fetches `/.well-known/poppy.json` (HTTPS-only redirects), validates
- * it, then fetches and validates the issuer's RFC 8414 metadata (3.2).
+ * Discovery (section 3): fetches `/.well-known/poppy.json`, which must end at that exact path after
+ * HTTPS-only redirects, then finds the issuer from the domain's protected resource metadata and
+ * checks both directions of the link. A timeout, another error status or invalid metadata throws:
+ * only a 404 or valid metadata without servers means there is no issuer (3.2).
  */
 export async function discover(input, opts = {}) {
     const wellKnown = wellKnownUrlFor(input, opts);
-    const { json } = await fetchJson(wellKnown, 'poppy.json', opts);
-    const document = validatePoppyDocument(json, wellKnown.host, opts);
-    let metadata;
-    if (document.auth) {
-        const { json: meta } = await fetchJson(authServerMetadataUrl(document.auth.issuer), 'authorization server metadata', opts);
-        metadata = validateMetadata(meta, document, opts);
-    }
-    return { domain: wellKnown.host, wellKnownUrl: wellKnown.toString(), document, metadata };
+    const { json, finalUrl } = await fetchJson(wellKnown, 'poppy.json', opts);
+    if (finalUrl.pathname !== WELL_KNOWN_POPPY_PATH || finalUrl.search !== '') {
+        fail('invalid_redirect', `poppy.json redirected to ${finalUrl}, not to the well-known path`);
+    }
+    const document = validatePoppyDocument(json, finalUrl.host, opts);
+    // `https://{organization.domain}`, lowercase, no trailing slash. The origin is that, in dev with
+    // its port and scheme too.
+    const domainUrl = finalUrl.origin;
+    const domain = finalUrl.host;
+    const base = {
+        domain,
+        wellKnownUrl: finalUrl.toString(),
+        document,
+    };
+    const prm = await fetchJson(protectedResourceMetadataUrl(domainUrl), 'protected resource metadata', {
+        ...opts,
+        notFoundIsNull: true,
+    });
+    const issuer = prm.json === null
+        ? undefined
+        : validateProtectedResourceMetadata(prm.json, document, domainUrl, opts);
+    if (issuer === undefined) {
+        if (document.auth?.issuer !== undefined) {
+            fail('issuer_mismatch', 'auth.issuer needs protected resource metadata that lists it');
+        }
+        return {
+            ...base,
+            identifier: domainUrl,
+            noIssuer: prm.json === null ? 'not_found' : 'metadata',
+        };
+    }
+    const { json: meta } = await fetchJson(authServerMetadataUrl(issuer), 'authorization server metadata', opts);
+    return {
+        ...base,
+        identifier: issuer,
+        metadata: validateMetadata(meta, issuer, domainUrl, opts),
+    };
 }
 //# sourceMappingURL=discovery.js.map

package/dist/src/poppy-client/discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../src/poppy-client/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EAEL,cAAc,EACd,eAAe,EACf,gBAAgB,GAEjB,MAAM,WAAW,CAAC;AAEnB,4DAA4D;AAC5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,CAAC,CAAC;AAE9C,MAAM,aAAa,GAAG,CAAC,CAAC;AAiBxB,6EAA6E;AAC7E,MAAM,OAAO,aAAa;IACP,OAAO,GAAG,IAAI,GAAG,EAA+C,CAAC;IAClF,GAAG,CAAC,GAAW;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACzB,IAAI,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,CAAC,KAAK,CAAC;IACjB,CAAC;IACD,GAAG,CAAC,GAAW,EAAE,KAAc,EAAE,YAA2B;QAC1D,IAAI,CAAC,YAAY,IAAI,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,OAAO;QACrE,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,GAAG,GAAoB,EAAE;IACtE,IAAI,IAAS,CAAC;IACd,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;QAC1C,IAAI,GAAG,GAAG,CAAC,WAAW,IAAI,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAChG,CAAC;IACD,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACzD,OAAO,IAAI,GAAG,CAAC,yBAAyB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,GAAQ,EACR,IAAY,EACZ,IAAsB;IAEtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACvE,IAAI,OAAO,GAAG,GAAG,CAAC;IAClB,KAAK,IAAI,GAAG,GAAG,CAAC,GAAI,GAAG,EAAE,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE;YAC5C,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACzE,IAAI,GAAG,IAAI,aAAa;gBACtB,MAAM,IAAI,cAAc,CAAC,oBAAoB,EAAE,GAAG,IAAI,sBAAsB,CAAC,CAAC;YAChF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAE,EAAE,OAAO,CAAC,CAAC;YAC5D,IAAI,CAAC;gBACH,8CAA8C;gBAC9C,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,WAAW,EAAE,IAAI,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,cAAc,CAAC,mBAAmB,EAAG,CAAW,CAAC,OAAO,CAAC,CAAC;YACtE,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,GAAG,IAAI,UAAU,GAAG,CAAC,MAAM,SAAS,OAAO,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,GAAG,IAAI,wBAAwB,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QACxE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACrC,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,OAAe;IACzC,MAAM,IAAI,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,IAAY,EAAE,GAAoB;IAClE,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,kBAAkB,EAAG,CAAW,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CACnC,IAAa,EACb,aAAqB,EACrB,GAAG,GAAoB,EAAE;IAEzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC;IACtC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,kBAAkB,EAAE,wCAAwC,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,IAAI,CACF,8BAA8B,EAC9B,+BAA+B,OAAO,cAAc,KAAK,yBAAyB,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxH,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;IAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACrF,IAAI,CAAC,kBAAkB,EAAE,wDAAwD,CAAC,CAAC;IACrF,CAAC;IACD,yFAAyF;IACzF,oFAAoF;IACpF,MAAM,SAAS,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,eAAe,GAAG,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QACzD,IAAI,CACF,iBAAiB,EACjB,wBAAwB,GAAG,CAAC,MAAM,wCAAwC,aAAa,GAAG,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC;IACtC,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACrC,IAAI,CAAC,kBAAkB,EAAE,uDAAuD,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;QAC3E,IAAI,IAAI,CAAC,GAAG,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GACb,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACnF,IAAI,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACzC,IAAI,CACF,kBAAkB,EAClB,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,kBAAkB,EAAE,wBAAwB,CAAC,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAU,EAAE,CAAC;YAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,IAAI,CAAC,KAAK,SAAS;gBAAE,SAAS;YAC9B,IACE,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACZ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;gBACxB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAC7C,CAAC;gBACD,IAAI,CAAC,kBAAkB,EAAE,QAAQ,IAAI,mCAAmC,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACpC,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBACtB,CAAC,MAAM,CAAC,KAAK,CACX,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAChF,EACD,CAAC;gBACD,IAAI,CAAC,kBAAkB,EAAE,wDAAwD,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,kBAAkB,EAAE,gCAAgC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;IAC1F,OAAO,IAAgC,CAAC;AAC1C,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrE,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,0CAA0C,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,gBAAgB,CAC9B,IAAa,EACb,GAAkB,EAClB,GAAG,GAAoB,EAAE;IAEzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,kBAAkB,EAAE,gDAAgD,CAAC,CAAC;IAChG,MAAM,IAAI,GAAG,GAAG,CAAC,IAAK,CAAC;IACvB,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,CACF,iBAAiB,EACjB,oBAAoB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,IAAI,CAAC,MAAM,GAAG,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,IAAI,CACF,mBAAmB,EACnB,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;QAC9E,IAAI,CACF,mBAAmB,EACnB,oBAAoB,IAAI,CAAC,MAAM,sBAAsB,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAChF,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACrD,QAAQ,CAAC,IAAI,CAAC,mBAAmB,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAC/D,IAAI,IAAI,CAAC,MAAM;QAAE,QAAQ,CAAC,IAAI,CAAC,sBAAsB,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAC;IACtF,IAAI,IAAI,CAAC,MAAM;QACb,QAAQ,CAAC,IAAI,CAAC,6BAA6B,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAC;IACrF,OAAO,IAAqC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAa,EAAE,IAAI,GAAqB,EAAE;IACvE,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,QAAwC,CAAC;IAC7C,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CACpC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAC3C,+BAA+B,EAC/B,IAAI,CACL,CAAC;QACF,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAC5F,CAAC"}
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../src/poppy-client/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAEL,cAAc,EACd,eAAe,EACf,gBAAgB,GAEjB,MAAM,WAAW,CAAC;AAEnB,2FAA2F;AAC3F,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,KAAK,CAAC,CAAC;AAEnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AAE/D,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AACtD,MAAM,iBAAiB,GAAG,8CAA8C,CAAC;AAwBzE,6EAA6E;AAC7E,MAAM,OAAO,aAAa;IACP,OAAO,GAAG,IAAI,GAAG,EAAmD,CAAC;IACtF,GAAG,CAAC,GAAW;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACzB,IAAI,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,CAAC,KAAK,CAAC;IACjB,CAAC;IACD,GAAG,CAAC,GAAW,EAAE,KAAkB,EAAE,YAA2B;QAC9D,IAAI,CAAC,YAAY,IAAI,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,OAAO;QACrE,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;CACF;AAYD,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,GAAG,GAAoB,EAAE;IACtE,IAAI,IAAS,CAAC;IACd,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;QAC1C,IAAI,GAAG,GAAG,CAAC,WAAW,IAAI,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAChG,CAAC;IACD,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACzD,OAAO,IAAI,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,GAAQ,EACR,IAAY,EACZ,IAAqD;IAErD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7D,IAAI,OAAO,GAAG,GAAG,CAAC;IAClB,KAAK,IAAI,GAAG,GAAG,CAAC,GAAI,GAAG,EAAE,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE;YAC5C,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACzE,IAAI,GAAG,IAAI,aAAa;gBACtB,MAAM,IAAI,cAAc,CAAC,oBAAoB,EAAE,GAAG,IAAI,sBAAsB,CAAC,CAAC;YAChF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAE,EAAE,OAAO,CAAC,CAAC;YAC5D,IAAI,CAAC;gBACH,8CAA8C;gBAC9C,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,WAAW,EAAE,IAAI,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,cAAc,CAAC,mBAAmB,EAAG,CAAW,CAAC,OAAO,CAAC,CAAC;YACtE,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACxF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,GAAG,IAAI,UAAU,GAAG,CAAC,MAAM,SAAS,OAAO,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,GAAG,IAAI,wBAAwB,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAC3E,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,OAAe;IACzC,MAAM,IAAI,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,IAAY,EAAE,GAAoB;IAClE,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,kBAAkB,EAAG,CAAW,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CACnC,IAAa,EACb,UAAkB,EAClB,GAAG,GAAoB,EAAE;IAEzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC;IACtC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,kBAAkB,EAAE,wCAAwC,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,2BAA2B,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,CACF,8BAA8B,EAC9B,+BAA+B,OAAO,0CAA0C,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzH,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;IAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACrF,IAAI,CAAC,kBAAkB,EAAE,wDAAwD,CAAC,CAAC;IACrF,CAAC;IACD,iGAAiG;IACjG,8CAA8C;IAC9C,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5E,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QACnD,IAAI,CACF,iBAAiB,EACjB,wBAAwB,GAAG,CAAC,MAAM,gDAAgD,UAAU,GAAG,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC;IACtC,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACrC,IAAI,CAAC,kBAAkB,EAAE,uDAAuD,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;QAC3E,IAAI,IAAI,CAAC,GAAG,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,kBAAkB,EAAE,wBAAwB,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI;QACzB,CAAC,UAAU,EAAE,UAAU,CAAC;QACxB,CAAC,gBAAgB,EAAE,KAAK,CAAC;KACjB,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,kBAAkB,EAAE,GAAG,KAAK,oBAAoB,CAAC,CAAC;QAC7E,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,IAAI,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,kBAAkB,EAAE,8BAA8B,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,kBAAkB,EAAE,gCAAgC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;IAC1F,OAAO,IAAgC,CAAC;AAC1C,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,4BAA4B,CAAC,QAAsB;IACjE,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrE,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,wCAAwC,IAAI,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iCAAiC,CAC/C,IAAa,EACb,GAAkB,EAClB,SAAiB,EACjB,GAAG,GAAoB,EAAE;IAEzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,kBAAkB,EAAE,8CAA8C,CAAC,CAAC;IAC9F,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CACF,mBAAmB,EACnB,yCAAyC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,SAAS,GAAG,CACpF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC;IAC3C,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,kBAAkB,EAAE,sCAAsC,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAc,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,IAAI;QAAE,QAAQ,CAAC,KAAK,EAAE,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC;IAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,KAAK,mCAAmC,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC3C,IAAI,CAAC,iBAAiB,EAAE,4DAA4D,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,KAAK,mCAAmC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,KAAK,IAAK,IAAI,CAAC,CAAC,CAAY,CAAC;AACtC,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrE,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,0CAA0C,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,gBAAgB,CAC9B,IAAa,EACb,MAAc,EACd,SAAiB,EACjB,GAAG,GAAoB,EAAE;IAEzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,kBAAkB,EAAE,gDAAgD,CAAC,CAAC;IAChG,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,iBAAiB,EAAE,oBAAoB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,MAAM,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IACvC,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QACzB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,EAC3E,CAAC;QACD,IAAI,CACF,mBAAmB,EACnB,0BAA0B,MAAM,sBAAsB,SAAS,yCAAyC,CACzG,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACrD,QAAQ,CAAC,IAAI,CAAC,mBAAmB,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,kBAAkB,EAAE,kEAAkE,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC,sBAAsB,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC,6BAA6B,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,IAAqC,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAa,EAAE,IAAI,GAAqB,EAAE;IACvE,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IAC1E,IAAI,QAAQ,CAAC,QAAQ,KAAK,qBAAqB,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1E,IAAI,CAAC,kBAAkB,EAAE,4BAA4B,QAAQ,8BAA8B,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClE,iGAAiG;IACjG,2BAA2B;IAC3B,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC;IAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG;QACX,MAAM;QACN,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE;QACjC,QAAQ;KACT,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,4BAA4B,CAAC,SAAS,CAAC,EACvC,6BAA6B,EAC7B;QACE,GAAG,IAAI;QACP,cAAc,EAAE,IAAI;KACrB,CACF,CAAC;IACF,MAAM,MAAM,GACV,GAAG,CAAC,IAAI,KAAK,IAAI;QACf,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,iCAAiC,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC7E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YACxC,IAAI,CAAC,iBAAiB,EAAE,6DAA6D,CAAC,CAAC;QACzF,CAAC;QACD,OAAO;YACL,GAAG,IAAI;YACP,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU;SACvD,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CACpC,qBAAqB,CAAC,MAAM,CAAC,EAC7B,+BAA+B,EAC/B,IAAI,CACL,CAAC;IACF,OAAO;QACL,GAAG,IAAI;QACP,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC;KAC1D,CAAC;AACJ,CAAC"}

package/dist/src/poppy-client/dpop.d.ts

@@ -2,7 +2,8 @@ import { type StoredKey } from './keys.js';
 /** `htu`: the request URL without query or fragment (RFC 9449 4.2). */
 export declare function htuOf(url: string | URL): string;
 /**
- * A DPoP key (RFC 9449). The agent keeps one per User per Company (4.3); it is never published.
+ * A DPoP key (RFC 9449) for this User at one Company; it is never published. Binding tokens is the
+ * Company's choice (4.5).
  */
 export declare class DpopKey {
     readonly stored: StoredKey;

package/dist/src/poppy-client/dpop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dpop.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/dpop.ts"],"names":[],"mappings":"AACA,OAAO,EAAuD,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAGhG,uEAAuE;AACvE,wBAAgB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,GAAG,MAAM,CAK/C;AAED;;GAEG;AACH,qBAAa,OAAO;IACN,QAAQ,CAAC,MAAM,EAAE,SAAS;IAAtC,YAAqB,MAAM,EAAE,SAAS,EAAI;IAE1C,OAAa,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,CAExC;IAED,gGAAgG;IAC1F,KAAK,CAAC,KAAK,EAAE;QACjB,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC5B,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBlB;CACF"}
+{"version":3,"file":"dpop.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/dpop.ts"],"names":[],"mappings":"AACA,OAAO,EAAuD,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAGhG,uEAAuE;AACvE,wBAAgB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,GAAG,MAAM,CAK/C;AAED;;;GAGG;AACH,qBAAa,OAAO;IACN,QAAQ,CAAC,MAAM,EAAE,SAAS;IAAtC,YAAqB,MAAM,EAAE,SAAS,EAAI;IAE1C,OAAa,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,CAExC;IAED,gGAAgG;IAC1F,KAAK,CAAC,KAAK,EAAE;QACjB,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC5B,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBlB;CACF"}

package/dist/src/poppy-client/dpop.js

@@ -9,7 +9,8 @@ export function htuOf(url) {
     return u.toString();
 }
 /**
- * A DPoP key (RFC 9449). The agent keeps one per User per Company (4.3); it is never published.
+ * A DPoP key (RFC 9449) for this User at one Company; it is never published. Binding tokens is the
+ * Company's choice (4.5).
  */
 export class DpopKey {
     stored;

package/dist/src/poppy-client/dpop.js.map

@@ -1 +1 @@
-{"version":3,"file":"dpop.js","sourceRoot":"","sources":["../../../src/poppy-client/dpop.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAkB,MAAM,WAAW,CAAC;AAChG,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE/D,uEAAuE;AACvE,MAAM,UAAU,KAAK,CAAC,GAAiB;IACrC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;IACd,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;IACZ,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,OAAO;IACG,MAAM;IAA3B,YAAqB,MAAiB;sBAAjB,MAAM;IAAc,CAAC;IAE1C,MAAM,CAAC,KAAK,CAAC,QAAQ;QACnB,OAAO,IAAI,OAAO,CAAC,MAAM,gBAAgB,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,gGAAgG;IAChG,KAAK,CAAC,KAAK,CAAC,KAKX;QACC,MAAM,OAAO,GAA4B;YACvC,GAAG,EAAE,QAAQ,EAAE;YACf,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE;YAC5B,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;YACrB,GAAG,EAAE,UAAU,EAAE;SAClB,CAAC;QACF,IAAI,KAAK,CAAC,WAAW;YAAE,OAAO,CAAC,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,KAAK;YAAE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAC7C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;aACxB,kBAAkB,CAAC;YAClB,GAAG,EAAE,UAAU;YACf,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;SAC5C,CAAC;aACD,IAAI,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC;CACF"}
+{"version":3,"file":"dpop.js","sourceRoot":"","sources":["../../../src/poppy-client/dpop.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAkB,MAAM,WAAW,CAAC;AAChG,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE/D,uEAAuE;AACvE,MAAM,UAAU,KAAK,CAAC,GAAiB;IACrC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;IACd,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;IACZ,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,OAAO;IACG,MAAM;IAA3B,YAAqB,MAAiB;sBAAjB,MAAM;IAAc,CAAC;IAE1C,MAAM,CAAC,KAAK,CAAC,QAAQ;QACnB,OAAO,IAAI,OAAO,CAAC,MAAM,gBAAgB,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,gGAAgG;IAChG,KAAK,CAAC,KAAK,CAAC,KAKX;QACC,MAAM,OAAO,GAA4B;YACvC,GAAG,EAAE,QAAQ,EAAE;YACf,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE;YAC5B,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;YACrB,GAAG,EAAE,UAAU,EAAE;SAClB,CAAC;QACF,IAAI,KAAK,CAAC,WAAW;YAAE,OAAO,CAAC,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,KAAK;YAAE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAC7C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;aACxB,kBAAkB,CAAC;YAClB,GAAG,EAAE,UAAU;YACf,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;SAC5C,CAAC;aACD,IAAI,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC;CACF"}

package/dist/src/poppy-client/errors.d.ts

@@ -14,7 +14,7 @@ export declare class PoppyError extends Error {
 export declare class DiscoveryError extends PoppyError {
     constructor(code: string, message: string);
 }
-/** OAuth error response from the token, device, or revocation endpoint (4.2). */
+/** OAuth error response from the token, device, or revocation endpoint (4.7). */
 export declare class OAuthError extends PoppyError {
     readonly retryAfter?: number | undefined;
     constructor(code: string, opts?: {
@@ -25,8 +25,9 @@ export declare class OAuthError extends PoppyError {
     });
 }
 /**
- * A resource (API, conversation, mediated sign-in) rejected the token, via `WWW-Authenticate`
- * (section 6): `invalid_token`, `sign_in_required`, `insufficient_scope`, DPoP errors.
+ * A resource (API, conversation, MCP server) refused the access token, or wants one, through
+ * `WWW-Authenticate` (section 7): `invalid_token`, `insufficient_scope`, DPoP errors. A challenge
+ * without an error code is reported as `insufficient_scope`, as the spec says to handle it.
  */
 export declare class ResourceAuthError extends PoppyError {
     /** Scopes the Company says are needed, for `insufficient_scope`. */
@@ -37,7 +38,7 @@ export declare class ResourceAuthError extends PoppyError {
         scope?: string | undefined;
     });
 }
-/** A conversation error with a JSON `error` body (7.13). */
+/** A request refused with a JSON `error` body (5.3, 8.13), such as `invalid_session`. */
 export declare class ConversationError extends PoppyError {
     /** For `direct_conversation_open`: the open Direct Conversation. */
     readonly conversationId?: string | undefined;

package/dist/src/poppy-client/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/errors.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAEvD,YACE,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,GAAE;QACJ,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;KAC1C,EAQP;CACF;AAED,0EAA0E;AAC1E,qBAAa,cAAe,SAAQ,UAAU;IAC5C,YAAY,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAGxC;CACF;AAED,iFAAiF;AACjF,qBAAa,UAAW,SAAQ,UAAU;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,YACE,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;QACJ,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;KAC1C,EAKP;CACF;AAED;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,UAAU;IAC/C,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,YACE,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;QACJ,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACvB,EAKP;CACF;AAED,4DAA4D;AAC5D,qBAAa,iBAAkB,SAAQ,UAAU;IAC/C,oEAAoE;IACpE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,YACE,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;QACJ,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAChC,EAKP;CACF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/errors.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAEvD,YACE,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,GAAE;QACJ,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;KAC1C,EAQP;CACF;AAED,0EAA0E;AAC1E,qBAAa,cAAe,SAAQ,UAAU;IAC5C,YAAY,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAGxC;CACF;AAED,iFAAiF;AACjF,qBAAa,UAAW,SAAQ,UAAU;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,YACE,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;QACJ,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;KAC1C,EAKP;CACF;AAED;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,UAAU;IAC/C,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,YACE,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;QACJ,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACvB,EAKP;CACF;AAED,yFAAyF;AACzF,qBAAa,iBAAkB,SAAQ,UAAU;IAC/C,oEAAoE;IACpE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,YACE,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;QACJ,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAChC,EAKP;CACF"}

package/dist/src/poppy-client/errors.js

@@ -20,7 +20,7 @@ export class DiscoveryError extends PoppyError {
         this.name = 'DiscoveryError';
     }
 }
-/** OAuth error response from the token, device, or revocation endpoint (4.2). */
+/** OAuth error response from the token, device, or revocation endpoint (4.7). */
 export class OAuthError extends PoppyError {
     retryAfter;
     constructor(code, opts = {}) {
@@ -30,8 +30,9 @@ export class OAuthError extends PoppyError {
     }
 }
 /**
- * A resource (API, conversation, mediated sign-in) rejected the token, via `WWW-Authenticate`
- * (section 6): `invalid_token`, `sign_in_required`, `insufficient_scope`, DPoP errors.
+ * A resource (API, conversation, MCP server) refused the access token, or wants one, through
+ * `WWW-Authenticate` (section 7): `invalid_token`, `insufficient_scope`, DPoP errors. A challenge
+ * without an error code is reported as `insufficient_scope`, as the spec says to handle it.
  */
 export class ResourceAuthError extends PoppyError {
     /** Scopes the Company says are needed, for `insufficient_scope`. */
@@ -42,7 +43,7 @@ export class ResourceAuthError extends PoppyError {
         this.scope = opts.scope;
     }
 }
-/** A conversation error with a JSON `error` body (7.13). */
+/** A request refused with a JSON `error` body (5.3, 8.13), such as `invalid_session`. */
 export class ConversationError extends PoppyError {
     /** For `direct_conversation_open`: the open Direct Conversation. */
     conversationId;

package/dist/src/poppy-client/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/poppy-client/errors.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,MAAM,OAAO,UAAW,SAAQ,KAAK;IAC1B,IAAI,CAAS;IACb,MAAM,CAAsB;IAC5B,WAAW,CAAsB;IACjC,OAAO,CAAuC;IAEvD,YACE,IAAY,EACZ,OAA4B,EAC5B,IAAI,GAIA,EAAE;QAEN,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,CAAC;CACF;AAED,0EAA0E;AAC1E,MAAM,OAAO,cAAe,SAAQ,UAAU;IAC5C,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,OAAO,UAAW,SAAQ,UAAU;IAC/B,UAAU,CAAsB;IACzC,YACE,IAAY,EACZ,IAAI,GAKA,EAAE;QAEN,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,oEAAoE;IAC3D,KAAK,CAAsB;IACpC,YACE,IAAY,EACZ,IAAI,GAIA,EAAE;QAEN,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAC1B,CAAC;CACF;AAED,4DAA4D;AAC5D,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,oEAAoE;IAC3D,cAAc,CAAsB;IAC7C,YACE,IAAY,EACZ,IAAI,GAIA,EAAE;QAEN,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;IAC5C,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/poppy-client/errors.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,MAAM,OAAO,UAAW,SAAQ,KAAK;IAC1B,IAAI,CAAS;IACb,MAAM,CAAsB;IAC5B,WAAW,CAAsB;IACjC,OAAO,CAAuC;IAEvD,YACE,IAAY,EACZ,OAA4B,EAC5B,IAAI,GAIA,EAAE;QAEN,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,CAAC;CACF;AAED,0EAA0E;AAC1E,MAAM,OAAO,cAAe,SAAQ,UAAU;IAC5C,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,OAAO,UAAW,SAAQ,UAAU;IAC/B,UAAU,CAAsB;IACzC,YACE,IAAY,EACZ,IAAI,GAKA,EAAE;QAEN,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,oEAAoE;IAC3D,KAAK,CAAsB;IACpC,YACE,IAAY,EACZ,IAAI,GAIA,EAAE;QAEN,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAC1B,CAAC;CACF;AAED,yFAAyF;AACzF,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,oEAAoE;IAC3D,cAAc,CAAsB;IAC7C,YACE,IAAY,EACZ,IAAI,GAIA,EAAE;QAEN,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;IAC5C,CAAC;CACF"}

package/dist/src/poppy-client/http.d.ts

@@ -16,16 +16,18 @@ export interface PoppyRequestInit {
     body?: (string | (() => Promise<string>)) | undefined;
     /** Signs a DPoP proof for every attempt when set. */
     dpop?: DpopKey | undefined;
-    /** Sent as `Authorization: {scheme} {token}`. Never put in the URL (4.3). */
+    /** Sent as `Authorization: {scheme} {token}`. Never put in the URL (5.6). */
     accessToken?: string | undefined;
     scheme?: 'DPoP' | 'Bearer' | undefined;
+    /** Signs the `Poppy-Session` JWT for every attempt, since each is good for one request (5.2). */
+    session?: (() => Promise<string>) | undefined;
     signal?: AbortSignal | undefined;
     redirect?: 'follow' | 'manual' | 'error' | undefined;
 }
 /**
  * The one place requests leave this client. It signs DPoP proofs, remembers `DPoP-Nonce`
  * values per origin and retries once on `use_dpop_nonce` (RFC 9449 section 8/9), and waits
- * out a 429 `Retry-After` once (4.3, "Rate limits").
+ * out a 429 `Retry-After` once (5.6). Secrets never follow a redirect (3).
  */
 export declare class PoppyHttp {
     readonly fetch: FetchLike;

package/dist/src/poppy-client/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,KAAK,SAAS,EAAwC,MAAM,WAAW,CAAC;AAEjF,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,kFAAkF;IAClF,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC7C;;;OAGG;IACH,IAAI,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;IACtD,qDAAqD;IACrD,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IACvC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;CACtD;AAED;;;;GAIG;AACH,qBAAa,SAAS;IACpB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAuC;IAE5D,YAAY,IAAI,GAAE,WAAgB,EAIjC;IAEK,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsDzE;CACF;AAaD,kDAAkD;AAClD,wBAAsB,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAQjG"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGzC,OAAO,EAAE,KAAK,SAAS,EAAwC,MAAM,WAAW,CAAC;AAEjF,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,kFAAkF;IAClF,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC7C;;;OAGG;IACH,IAAI,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;IACtD,qDAAqD;IACrD,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IACvC,iGAAiG;IACjG,OAAO,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IAC9C,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;CACtD;AAED;;;;GAIG;AACH,qBAAa,SAAS;IACpB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAuC;IAE5D,YAAY,IAAI,GAAE,WAAgB,EAIjC;IAEK,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAyDzE;CACF;AAaD,kDAAkD;AAClD,wBAAsB,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAQjG"}

package/dist/src/poppy-client/http.js

@@ -1,9 +1,10 @@
 import { PoppyError } from './errors.js';
+import { safeFetch } from './safe_fetch.js';
 import { parseRetryAfter, sleep, wwwAuthError } from './util.js';
 /**
  * The one place requests leave this client. It signs DPoP proofs, remembers `DPoP-Nonce`
  * values per origin and retries once on `use_dpop_nonce` (RFC 9449 section 8/9), and waits
- * out a 429 `Retry-After` once (4.3, "Rate limits").
+ * out a 429 `Retry-After` once (5.6). Secrets never follow a redirect (3).
  */
 export class PoppyHttp {
     fetch;
@@ -11,7 +12,7 @@ export class PoppyHttp {
     maxRetryAfter;
     log;
     constructor(opts = {}) {
-        this.fetch = opts.fetch ?? ((input, init) => globalThis.fetch(input, init));
+        this.fetch = opts.fetch ?? safeFetch;
         this.maxRetryAfter = opts.maxRetryAfterSeconds ?? 30;
         this.log = opts.log;
     }
@@ -25,7 +26,10 @@ export class PoppyHttp {
             const scheme = init.scheme ?? (init.dpop ? 'DPoP' : 'Bearer');
             if (init.accessToken)
                 headers.set('authorization', `${scheme} ${init.accessToken}`);
-            if (init.dpop) {
+            if (init.session)
+                headers.set('poppy-session', await init.session());
+            const proved = init.dpop && (scheme === 'DPoP' || !init.accessToken);
+            if (proved) {
                 headers.set('dpop', await init.dpop.proof({
                     htm: method,
                     htu: url,
@@ -39,8 +43,8 @@ export class PoppyHttp {
                 headers,
                 ...(body !== undefined ? { body } : {}),
                 ...(init.signal !== undefined ? { signal: init.signal } : {}),
-                // A redirect would change `htu`, so DPoP requests never follow one silently.
-                redirect: init.redirect ?? (init.dpop ? 'manual' : 'follow'),
+                // A redirect would change `htu`, and it never carries the protocol's secrets (3).
+                redirect: init.redirect ?? (init.dpop || init.session || init.accessToken ? 'manual' : 'follow'),
             });
             const nonce = res.headers.get('dpop-nonce');
             if (nonce)

package/dist/src/poppy-client/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/poppy-client/http.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAkB,eAAe,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AA0BjF;;;;GAIG;AACH,MAAM,OAAO,SAAS;IACX,KAAK,CAAY;IACT,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnC,aAAa,CAAS;IACtB,GAAG,CAAwC;IAE5D,YAAY,IAAI,GAAgB,EAAE;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,IAAI,GAAqB,EAAE;QACpD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACnC,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,SAAS,CAAC;YACR,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,IAAI,CAAC,WAAW;gBAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YACpF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CACT,MAAM,EACN,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;oBACpB,GAAG,EAAE,MAAM;oBACX,GAAG,EAAE,GAAG;oBACR,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;oBAC7D,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;iBAC/B,CAAC,CACH,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;gBAChC,MAAM;gBACN,OAAO;gBACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,6EAA6E;gBAC7E,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;aAC7D,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC5C,IAAI,KAAK;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAE1C,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACvE,YAAY,GAAG,IAAI,CAAC;gBACpB,IAAI,CAAC,GAAG,EAAE,CAAC,0BAA0B,MAAM,2BAA2B,CAAC,CAAC;gBACxE,SAAS;YACX,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBACvC,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;gBAC7D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;oBACrD,WAAW,GAAG,IAAI,CAAC;oBACnB,IAAI,CAAC,GAAG,EAAE,CAAC,mBAAmB,MAAM,aAAa,IAAI,iBAAiB,CAAC,CAAC;oBACxE,MAAM,KAAK,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;oBACtC,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,mBAAmB,MAAM,EAAE,EAAE;oBAChE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;iBAC/B,CAAC,CAAC;YACL,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;CACF;AAED,KAAK,UAAU,cAAc,CAAC,GAAa;IACzC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC3D,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAC9F,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAmC,CAAC;QAC1E,OAAO,IAAI,EAAE,KAAK,KAAK,gBAAgB,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,kDAAkD;AAClD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAA8B,GAAa;IACvE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/poppy-client/http.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAkB,eAAe,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AA4BjF;;;;GAIG;AACH,MAAM,OAAO,SAAS;IACX,KAAK,CAAY;IACT,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnC,aAAa,CAAS;IACtB,GAAG,CAAwC;IAE5D,YAAY,IAAI,GAAgB,EAAE;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,IAAI,GAAqB,EAAE;QACpD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACnC,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,SAAS,CAAC;YACR,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,IAAI,CAAC,WAAW;gBAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YACpF,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACrE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACrE,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,CAAC,GAAG,CACT,MAAM,EACN,MAAM,IAAI,CAAC,IAAK,CAAC,KAAK,CAAC;oBACrB,GAAG,EAAE,MAAM;oBACX,GAAG,EAAE,GAAG;oBACR,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;oBAC7D,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;iBAC/B,CAAC,CACH,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;gBAChC,MAAM;gBACN,OAAO;gBACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,kFAAkF;gBAClF,QAAQ,EACN,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;aACzF,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC5C,IAAI,KAAK;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAE1C,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACvE,YAAY,GAAG,IAAI,CAAC;gBACpB,IAAI,CAAC,GAAG,EAAE,CAAC,0BAA0B,MAAM,2BAA2B,CAAC,CAAC;gBACxE,SAAS;YACX,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBACvC,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;gBAC7D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;oBACrD,WAAW,GAAG,IAAI,CAAC;oBACnB,IAAI,CAAC,GAAG,EAAE,CAAC,mBAAmB,MAAM,aAAa,IAAI,iBAAiB,CAAC,CAAC;oBACxE,MAAM,KAAK,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;oBACtC,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,mBAAmB,MAAM,EAAE,EAAE;oBAChE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;iBAC/B,CAAC,CAAC;YACL,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;CACF;AAED,KAAK,UAAU,cAAc,CAAC,GAAa;IACzC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC3D,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAC9F,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAmC,CAAC;QAC1E,OAAO,IAAI,EAAE,KAAK,KAAK,gBAAgB,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,kDAAkD;AAClD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAA8B,GAAa;IACvE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/src/poppy-client/identity.d.ts

@@ -1,3 +1,4 @@
+import { type JWK } from 'jose';
 import { type StoredKey } from './keys.js';
 import type { ClientMetadata } from './types.js';
 import { type SecurityOptions } from './util.js';
@@ -14,11 +15,14 @@ export interface IdentityConfig {
         version: string;
     }> | undefined;
 }
-/** Lifetime of every assertion this agent signs. The browser assertion caps at 60s (section 5). */
+/** Lifetime of a client assertion (the guides suggest at most five minutes). */
 export declare const ASSERTION_TTL_SECONDS = 60;
+export declare const DELEGATION_TYP = "pap-delegation+jwt";
+/** How long a delegation lasts, within the 24 hours 5.2 allows. */
+export declare const DELEGATION_TTL_SECONDS: number;
 /**
  * The Personal Agent's identity (4.1): its `client_id` URL, its metadata document, and the
- * keys from `jwks_uri` that sign client assertions, Session assertions and browser assertions.
+ * keys from `jwks_uri` that sign client assertions and the delegations of Session JWT keys.
  */
 export declare class AgentIdentity {
     readonly baseUrl: string;
@@ -41,21 +45,17 @@ export declare class AgentIdentity {
     };
     private sign;
     /**
-     * `private_key_jwt` client assertion (RFC 7523 section 2.2): `iss` = `sub` = `client_id`,
-     * `aud` = the authorization server (its token endpoint by default), fresh `jti`.
+     * `private_key_jwt` client assertion (4.1, RFC 7523): `iss` = `sub` = `client_id`, `aud` = the
+     * Company's issuer as a single string, short-lived, with `iat` and a fresh `jti`.
      */
-    clientAssertion(audience: string): Promise<string>;
+    clientAssertion(issuer: string): Promise<string>;
     /**
-     * The JWT bearer grant assertion that starts or renews a Session (4.2): names the agent in
-     * `iss` and the User ID in `sub`; `aud` is the token endpoint as a single string.
+     * A delegation (5.2): vouches for one delegated public key. It names no User or Company. Its
+     * times are rounded to the hour, as the guides suggest, so they say less about when it was made.
      */
-    sessionAssertion(userId: string, tokenEndpoint: string): Promise<string>;
-    /** Browser assertion (section 5), header `typ: poppy-browser+jwt`, `exp` <= `iat` + 60. */
-    browserAssertion(input: {
-        userId: string;
-        endpoint: string;
-        sessionId: string;
-        returnTo: string;
-    }): Promise<string>;
+    delegate(publicJwk: JWK): Promise<{
+        jwt: string;
+        exp: number;
+    }>;
 }
 //# sourceMappingURL=identity.d.ts.map