@adonis-agora/agent 0.93.0 → 0.95.0

package/dist/src/poppy-client/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/identity.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAA0C,KAAK,eAAe,EAAE,MAAM,WAAW,CAAC;AAEzF,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,yEAAyE;IACzE,IAAI,EAAE,SAAS,EAAE,CAAC;IAClB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;CAC9D;AAED,mGAAmG;AACnG,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC;;;GAGG;AACH,qBAAa,aAAa;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;IAEtE,YAAY,GAAG,EAAE,cAAc,EAAE,GAAG,GAAE,eAAoB,EASzD;IAED,0EAA0E;IAC1E,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,uEAAuE;IACvE,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,QAAQ,IAAI,cAAc,CAazB;IAED,0DAA0D;IAC1D,IAAI,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;KAAE,CAE1C;YAEa,IAAI;IAQlB;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUjD;IAED;;;OAGG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUvE;IAED,2FAA2F;IAC3F,gBAAgB,CAAC,KAAK,EAAE;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,MAAM,CAAC,CAelB;CACF"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,GAAG,EAAW,MAAM,MAAM,CAAC;AACzC,OAAO,EAAqC,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAA0C,KAAK,eAAe,EAAE,MAAM,WAAW,CAAC;AAEzF,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,yEAAyE;IACzE,IAAI,EAAE,SAAS,EAAE,CAAC;IAClB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;CAC9D;AAED,gFAAgF;AAChF,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,eAAO,MAAM,cAAc,uBAAuB,CAAC;AACnD,mEAAmE;AACnE,eAAO,MAAM,sBAAsB,QAAW,CAAC;AAE/C;;;GAGG;AACH,qBAAa,aAAa;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;IAEtE,YAAY,GAAG,EAAE,cAAc,EAAE,GAAG,GAAE,eAAoB,EASzD;IAED,0EAA0E;IAC1E,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,uEAAuE;IACvE,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,QAAQ,IAAI,cAAc,CAazB;IAED,0DAA0D;IAC1D,IAAI,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;KAAE,CAE1C;YAEa,IAAI;IAQlB;;;OAGG;IACH,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAU/C;IAED;;;OAGG;IACG,QAAQ,CAAC,SAAS,EAAE,GAAG,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAQpE;CACF"}

package/dist/src/poppy-client/identity.js

@@ -1,11 +1,14 @@
 import { SignJWT } from 'jose';
-import { importSigningKey } from './keys.js';
+import { bareEcPublicJwk, importSigningKey } from './keys.js';
 import { nowSeconds, randomId, requireSecureUrl } from './util.js';
-/** Lifetime of every assertion this agent signs. The browser assertion caps at 60s (section 5). */
+/** Lifetime of a client assertion (the guides suggest at most five minutes). */
 export const ASSERTION_TTL_SECONDS = 60;
+export const DELEGATION_TYP = 'pap-delegation+jwt';
+/** How long a delegation lasts, within the 24 hours 5.2 allows. */
+export const DELEGATION_TTL_SECONDS = 7 * 3600;
 /**
  * The Personal Agent's identity (4.1): its `client_id` URL, its metadata document, and the
- * keys from `jwks_uri` that sign client assertions, Session assertions and browser assertions.
+ * keys from `jwks_uri` that sign client assertions and the delegations of Session JWT keys.
  */
 export class AgentIdentity {
     baseUrl;
@@ -64,48 +67,29 @@ export class AgentIdentity {
         return new SignJWT(payload).setProtectedHeader(header).sign(await importSigningKey(key));
     }
     /**
-     * `private_key_jwt` client assertion (RFC 7523 section 2.2): `iss` = `sub` = `client_id`,
-     * `aud` = the authorization server (its token endpoint by default), fresh `jti`.
+     * `private_key_jwt` client assertion (4.1, RFC 7523): `iss` = `sub` = `client_id`, `aud` = the
+     * Company's issuer as a single string, short-lived, with `iat` and a fresh `jti`.
      */
-    clientAssertion(audience) {
+    clientAssertion(issuer) {
         const iat = nowSeconds();
         return this.sign({
             iss: this.clientId,
             sub: this.clientId,
-            aud: audience,
+            aud: issuer,
             iat,
             exp: iat + ASSERTION_TTL_SECONDS,
             jti: randomId(),
         });
     }
     /**
-     * The JWT bearer grant assertion that starts or renews a Session (4.2): names the agent in
-     * `iss` and the User ID in `sub`; `aud` is the token endpoint as a single string.
+     * A delegation (5.2): vouches for one delegated public key. It names no User or Company. Its
+     * times are rounded to the hour, as the guides suggest, so they say less about when it was made.
      */
-    sessionAssertion(userId, tokenEndpoint) {
-        const iat = nowSeconds();
-        return this.sign({
-            iss: this.clientId,
-            sub: userId,
-            aud: tokenEndpoint,
-            iat,
-            exp: iat + ASSERTION_TTL_SECONDS,
-            jti: randomId(),
-        });
-    }
-    /** Browser assertion (section 5), header `typ: poppy-browser+jwt`, `exp` <= `iat` + 60. */
-    browserAssertion(input) {
-        const iat = nowSeconds();
-        return this.sign({
-            iss: this.clientId,
-            sub: input.userId,
-            aud: input.endpoint,
-            session_id: input.sessionId,
-            return_to: input.returnTo,
-            iat,
-            exp: iat + ASSERTION_TTL_SECONDS,
-            jti: randomId(),
-        }, 'poppy-browser+jwt');
+    async delegate(publicJwk) {
+        const iat = Math.floor(nowSeconds() / 3600) * 3600;
+        const exp = iat + DELEGATION_TTL_SECONDS;
+        const jwt = await this.sign({ iss: this.clientId, cnf: { jwk: bareEcPublicJwk(publicJwk) }, iat, exp, jti: randomId() }, DELEGATION_TYP);
+        return { jwt, exp };
     }
 }
 //# sourceMappingURL=identity.js.map

package/dist/src/poppy-client/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/poppy-client/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAkB,MAAM,WAAW,CAAC;AAE7D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,EAAwB,MAAM,WAAW,CAAC;AAczF,mGAAmG;AACnG,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC;;;GAGG;AACH,MAAM,OAAO,aAAa;IACf,OAAO,CAAS;IAChB,UAAU,CAAS;IACnB,OAAO,CAAS;IAChB,IAAI,CAAc;IAClB,UAAU,CAAmD;IAEtE,YAAY,GAAmB,EAAE,GAAG,GAAoB,EAAE;QACxD,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;QAC7F,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,IAAI,CAAC,OAAO,WAAW,CAAC;QACzD,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;QAC1F,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IACnC,CAAC;IAED,0EAA0E;IAC1E,IAAI,QAAQ;QACV,OAAO,GAAG,IAAI,CAAC,OAAO,aAAa,CAAC;IACtC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,GAAG,IAAI,CAAC,OAAO,YAAY,CAAC;IACrC,CAAC;IAED,uEAAuE;IACvE,IAAI,WAAW;QACb,OAAO,GAAG,IAAI,CAAC,OAAO,iBAAiB,CAAC;IAC1C,CAAC;IAED,QAAQ;QACN,MAAM,GAAG,GAAmB;YAC1B,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,WAAW,EAAE,IAAI,CAAC,UAAU;YAC5B,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,aAAa,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC;YACjC,0BAA0B,EAAE,iBAAiB;SAC9C,CAAC;QACF,IAAI,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,0DAA0D;IAC1D,IAAI;QACF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;IAC9D,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,OAAgC,EAAE,GAAY;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,6BAA6B,CAAC,CAAC;QAC7D,MAAM,MAAM,GAA+C,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QAC1F,IAAI,GAAG;YAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;QAC1B,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,QAAgB;QAC9B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC;YACf,GAAG,EAAE,IAAI,CAAC,QAAQ;YAClB,GAAG,EAAE,IAAI,CAAC,QAAQ;YAClB,GAAG,EAAE,QAAQ;YACb,GAAG;YACH,GAAG,EAAE,GAAG,GAAG,qBAAqB;YAChC,GAAG,EAAE,QAAQ,EAAE;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,gBAAgB,CAAC,MAAc,EAAE,aAAqB;QACpD,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC;YACf,GAAG,EAAE,IAAI,CAAC,QAAQ;YAClB,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,aAAa;YAClB,GAAG;YACH,GAAG,EAAE,GAAG,GAAG,qBAAqB;YAChC,GAAG,EAAE,QAAQ,EAAE;SAChB,CAAC,CAAC;IACL,CAAC;IAED,2FAA2F;IAC3F,gBAAgB,CAAC,KAKhB;QACC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,IAAI,CACd;YACE,GAAG,EAAE,IAAI,CAAC,QAAQ;YAClB,GAAG,EAAE,KAAK,CAAC,MAAM;YACjB,GAAG,EAAE,KAAK,CAAC,QAAQ;YACnB,UAAU,EAAE,KAAK,CAAC,SAAS;YAC3B,SAAS,EAAE,KAAK,CAAC,QAAQ;YACzB,GAAG;YACH,GAAG,EAAE,GAAG,GAAG,qBAAqB;YAChC,GAAG,EAAE,QAAQ,EAAE;SAChB,EACD,mBAAmB,CACpB,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/poppy-client/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,OAAO,EAAE,MAAM,MAAM,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAkB,MAAM,WAAW,CAAC;AAE9E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,EAAwB,MAAM,WAAW,CAAC;AAczF,gFAAgF;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACxC,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AACnD,mEAAmE;AACnE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,IAAI,CAAC;AAE/C;;;GAGG;AACH,MAAM,OAAO,aAAa;IACf,OAAO,CAAS;IAChB,UAAU,CAAS;IACnB,OAAO,CAAS;IAChB,IAAI,CAAc;IAClB,UAAU,CAAmD;IAEtE,YAAY,GAAmB,EAAE,GAAG,GAAoB,EAAE;QACxD,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;QAC7F,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,IAAI,CAAC,OAAO,WAAW,CAAC;QACzD,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;QAC1F,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IACnC,CAAC;IAED,0EAA0E;IAC1E,IAAI,QAAQ;QACV,OAAO,GAAG,IAAI,CAAC,OAAO,aAAa,CAAC;IACtC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,GAAG,IAAI,CAAC,OAAO,YAAY,CAAC;IACrC,CAAC;IAED,uEAAuE;IACvE,IAAI,WAAW;QACb,OAAO,GAAG,IAAI,CAAC,OAAO,iBAAiB,CAAC;IAC1C,CAAC;IAED,QAAQ;QACN,MAAM,GAAG,GAAmB;YAC1B,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,WAAW,EAAE,IAAI,CAAC,UAAU;YAC5B,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,aAAa,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC;YACjC,0BAA0B,EAAE,iBAAiB;SAC9C,CAAC;QACF,IAAI,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,0DAA0D;IAC1D,IAAI;QACF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;IAC9D,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,OAAgC,EAAE,GAAY;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,6BAA6B,CAAC,CAAC;QAC7D,MAAM,MAAM,GAA+C,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QAC1F,IAAI,GAAG;YAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;QAC1B,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,MAAc;QAC5B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC;YACf,GAAG,EAAE,IAAI,CAAC,QAAQ;YAClB,GAAG,EAAE,IAAI,CAAC,QAAQ;YAClB,GAAG,EAAE,MAAM;YACX,GAAG;YACH,GAAG,EAAE,GAAG,GAAG,qBAAqB;YAChC,GAAG,EAAE,QAAQ,EAAE;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,SAAc;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;QACnD,MAAM,GAAG,GAAG,GAAG,GAAG,sBAAsB,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CACzB,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,eAAe,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAC3F,cAAc,CACf,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACtB,CAAC;CACF"}

package/dist/src/poppy-client/index.d.ts

@@ -1,8 +1,8 @@
 export { apiBaseUrl, callOpenApi, listApis, loadOpenApi, pickApi } from './api.js';
-export { autoSubmitFormHtml, createBrowserAssertion, serveOneShotPage } from './browser.js';
+export { authorizeBrowserJoin, browserJoinCode, browserSessionEndpoint } from './browser.js';
 export { CompanyClient, PoppyAgent, type PoppyAgentOptions, type SignInResult, throwForResponse, } from './company.js';
 export { ConversationClient, type FollowOptions, newMessageId, poppyProtocol, type StreamItem, } from './conversations.js';
-export { authServerMetadataUrl, type Discovered, discover, HttpJsonCache, SUPPORTED_MAJOR_VERSIONS, validateMetadata, validatePoppyDocument, wellKnownUrlFor, } from './discovery.js';
+export { authServerMetadataUrl, type Discovered, discover, HttpJsonCache, SUPPORTED_PROTOCOL_VERSIONS, validateMetadata, validatePoppyDocument, validateProtectedResourceMetadata, wellKnownUrlFor, } from './discovery.js';
 export { DpopKey, htuOf } from './dpop.js';
 export { ConversationError, DiscoveryError, OAuthError, PoppyError, ResourceAuthError, } from './errors.js';
 export { PoppyHttp } from './http.js';
@@ -11,9 +11,12 @@ export { startIdentityServer, waitForRelayedCallback } from './identity_server.j
 export { generateEs256Key, type StoredKey } from './keys.js';
 export { ask, DEFAULT_MODEL } from './llm.js';
 export { connectMcp, type McpConnection } from './mcp.js';
-export { completeDirectSignIn, deviceSignIn, eligibleSignInTypes, type MediatedOutcome, mediatedSignIn, type PendingDirectSignIn, pollDeviceSignInOnce, type SignInType, startDirectSignIn, submitMediatedCode, } from './signin.js';
+export { createSafeFetch, isBlockedAddress, safeFetch } from './safe_fetch.js';
+export { SESSION_JWT_TYP, signSessionJwt } from './session_jwt.js';
+export { completeDirectSignIn, deviceSignIn, eligibleSignInTypes, type MediatedOutcome, mediatedExtension, mediatedSignIn, offeredSignInTypes, type PendingDirectSignIn, pollDeviceSignInOnce, type SignInType, startDirectSignIn, submitMediatedCode, } from './signin.js';
 export { parseSse } from './sse.js';
 export { defaultStatePath, StateStore } from './store.js';
+export { excludedTasks, sendFeedback } from './task_coverage.js';
 export { TokenClient } from './token_client.js';
 export type * from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/poppy-client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC5F,OAAO,EACL,aAAa,EACb,UAAU,EACV,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,KAAK,aAAa,EAClB,YAAY,EACZ,aAAa,EACb,KAAK,UAAU,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,KAAK,UAAU,EACf,QAAQ,EACR,aAAa,EACb,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,UAAU,EACV,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,KAAK,eAAe,EACpB,cAAc,EACd,KAAK,mBAAmB,EACxB,oBAAoB,EACpB,KAAK,UAAU,EACf,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,mBAAmB,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC7F,OAAO,EACL,aAAa,EACb,UAAU,EACV,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,KAAK,aAAa,EAClB,YAAY,EACZ,aAAa,EACb,KAAK,UAAU,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,KAAK,UAAU,EACf,QAAQ,EACR,aAAa,EACb,2BAA2B,EAC3B,gBAAgB,EAChB,qBAAqB,EACrB,iCAAiC,EACjC,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,UAAU,EACV,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,KAAK,eAAe,EACpB,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,oBAAoB,EACpB,KAAK,UAAU,EACf,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,mBAAmB,YAAY,CAAC"}

package/dist/src/poppy-client/index.js

@@ -1,8 +1,8 @@
 export { apiBaseUrl, callOpenApi, listApis, loadOpenApi, pickApi } from './api.js';
-export { autoSubmitFormHtml, createBrowserAssertion, serveOneShotPage } from './browser.js';
+export { authorizeBrowserJoin, browserJoinCode, browserSessionEndpoint } from './browser.js';
 export { CompanyClient, PoppyAgent, throwForResponse, } from './company.js';
 export { ConversationClient, newMessageId, poppyProtocol, } from './conversations.js';
-export { authServerMetadataUrl, discover, HttpJsonCache, SUPPORTED_MAJOR_VERSIONS, validateMetadata, validatePoppyDocument, wellKnownUrlFor, } from './discovery.js';
+export { authServerMetadataUrl, discover, HttpJsonCache, SUPPORTED_PROTOCOL_VERSIONS, validateMetadata, validatePoppyDocument, validateProtectedResourceMetadata, wellKnownUrlFor, } from './discovery.js';
 export { DpopKey, htuOf } from './dpop.js';
 export { ConversationError, DiscoveryError, OAuthError, PoppyError, ResourceAuthError, } from './errors.js';
 export { PoppyHttp } from './http.js';
@@ -11,8 +11,11 @@ export { startIdentityServer, waitForRelayedCallback } from './identity_server.j
 export { generateEs256Key } from './keys.js';
 export { ask, DEFAULT_MODEL } from './llm.js';
 export { connectMcp } from './mcp.js';
-export { completeDirectSignIn, deviceSignIn, eligibleSignInTypes, mediatedSignIn, pollDeviceSignInOnce, startDirectSignIn, submitMediatedCode, } from './signin.js';
+export { createSafeFetch, isBlockedAddress, safeFetch } from './safe_fetch.js';
+export { SESSION_JWT_TYP, signSessionJwt } from './session_jwt.js';
+export { completeDirectSignIn, deviceSignIn, eligibleSignInTypes, mediatedExtension, mediatedSignIn, offeredSignInTypes, pollDeviceSignInOnce, startDirectSignIn, submitMediatedCode, } from './signin.js';
 export { parseSse } from './sse.js';
 export { defaultStatePath, StateStore } from './store.js';
+export { excludedTasks, sendFeedback } from './task_coverage.js';
 export { TokenClient } from './token_client.js';
 //# sourceMappingURL=index.js.map

package/dist/src/poppy-client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/poppy-client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC5F,OAAO,EACL,aAAa,EACb,UAAU,EAGV,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAElB,YAAY,EACZ,aAAa,GAEd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EAErB,QAAQ,EACR,aAAa,EACb,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,UAAU,EACV,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,aAAa,EAAuB,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAkB,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAsB,MAAM,UAAU,CAAC;AAC1D,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EAEnB,cAAc,EAEd,oBAAoB,EAEpB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/poppy-client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC7F,OAAO,EACL,aAAa,EACb,UAAU,EAGV,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAElB,YAAY,EACZ,aAAa,GAEd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EAErB,QAAQ,EACR,aAAa,EACb,2BAA2B,EAC3B,gBAAgB,EAChB,qBAAqB,EACrB,iCAAiC,EACjC,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,UAAU,EACV,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,aAAa,EAAuB,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAkB,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAsB,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EAEnB,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAElB,oBAAoB,EAEpB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/src/poppy-client/llm.js

@@ -9,7 +9,7 @@ function summarize(events) {
     for (const ev of events) {
         if (ev.type === 'message' && ev.message?.role !== 'user') {
             out.push({
-                from: `company:${ev.message?.sender}`,
+                from: `company:${ev.message?.author?.type}`,
                 text: ev.message?.text,
                 data: ev.message?.data,
             });
@@ -109,7 +109,7 @@ export async function ask(company, task, opts) {
         if (name === 'talk_to_company' && conv) {
             const message = {
                 id: newMessageId(),
-                sender: 'agent',
+                author: { type: 'agent' },
                 text: String(args.text ?? ''),
                 data: typeof args.data === 'object' && args.data
                     ? args.data
@@ -126,13 +126,13 @@ export async function ask(company, task, opts) {
             const { events, state } = await conv.collect(conversationId);
             for (const ev of events) {
                 if (ev.type === 'message' && ev.message?.role !== 'user') {
-                    opts.log(`  company[${ev.message?.sender}]: ${ev.message?.text ?? ''}${ev.message?.data ? ` ${JSON.stringify(ev.message.data)}` : ''}`);
+                    opts.log(`  company[${ev.message?.author?.type}]: ${ev.message?.text ?? ''}${ev.message?.data ? ` ${JSON.stringify(ev.message.data)}` : ''}`);
                 }
                 if (ev.type === 'user_requested') {
                     // 7.10: only the Personal Agent starts Direct Conversations; the user isn't here.
                     await conv.send(conversationId, {
                         id: newMessageId(),
-                        sender: 'agent',
+                        author: { type: 'agent' },
                         text: 'The user is not available to talk right now.',
                         context: { user_available: false },
                     });

package/dist/src/poppy-client/llm.js.map

@@ -1 +1 @@
-{"version":3,"file":"llm.js","sourceRoot":"","sources":["../../../src/poppy-client/llm.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAsB,MAAM,UAAU,CAAC;AAI1D,mGAAmG;AACnG,MAAM,CAAC,MAAM,aAAa,GAAG,4BAA4B,CAAC;AAC1D,MAAM,CAAC,MAAM,cAAc,GAAG,+CAA+C,CAAC;AA+B9E,SAAS,SAAS,CAAC,MAA2B;IAC5C,MAAM,GAAG,GAA8B,EAAE,CAAC;IAC1C,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;YACzD,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE;gBACrC,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,IAAI;gBACtB,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,IAAI;aACvB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,EAAE,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,0CAA0C,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,4EAA4E;aACjL,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,EAAE,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACxC,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,qDAAqD,EAAE,CAAC,MAAM,2CAA2C;aAClH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,OAAsB,EACtB,IAAY,EACZ,IAAgB;IAEhB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,IAAI,cAAkC,CAAC;IACvC,IAAI,GAA8B,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+C,CAAC;IAExE,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE;gBACR,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,8GAA8G;gBAChH,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE;qBACtE;oBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;iBACnB;aACF;SACF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;YAChC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACrD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1E,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,YAAY,KAAK,IAAI,EAAE,CAAC,CAAC;gBACrF,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE;wBACR,IAAI;wBACJ,WAAW,EAAE,sBAAsB,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,EAAE;wBAC5D,UAAU,EAAG,CAAC,CAAC,WAAuC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;qBAC7E;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,sBAAuB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,sDAAsD,CAAC,CAAC;IACjG,CAAC;IACD,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,sCAAsC;YACnD,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gBAC1C,QAAQ,EAAE,CAAC,QAAQ,CAAC;aACrB;SACF;KACF,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAkB;QAC9B;YACE,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE;gBACP,mDAAmD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,IAAI;gBAClI,yFAAyF;gBACzF,yJAAyJ;gBACzJ,qCAAqC;aACtC,CAAC,IAAI,CAAC,GAAG,CAAC;SACZ;QACD,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;KAChC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EAAE,IAAY,EAAE,IAA6B,EAAoB,EAAE;QACtF,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG;gBACd,EAAE,EAAE,YAAY,EAAE;gBAClB,MAAM,EAAE,OAAgB;gBACxB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC7B,IAAI,EACF,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI;oBACxC,CAAC,CAAE,IAAI,CAAC,IAAgC;oBACxC,CAAC,CAAC,SAAS;gBACf,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE;aACjF,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,cAAc,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBAC7D,IAAI,CAAC,GAAG,CAAC,mBAAmB,cAAc,GAAG,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAC7D,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;gBACxB,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;oBACzD,IAAI,CAAC,GAAG,CACN,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9H,CAAC;gBACJ,CAAC;gBACD,IAAI,EAAE,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;oBACjC,kFAAkF;oBAClF,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;wBAC9B,EAAE,EAAE,YAAY,EAAE;wBAClB,MAAM,EAAE,OAAO;wBACf,IAAI,EAAE,8CAA8C;wBACpD,OAAO,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE;qBACnC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1F,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,EAAE,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACtC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO;oBACrB,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC3E,CAAC,CAAC,KAAK,CAAC;gBACV,IAAI,CAAC,EAAE;oBACL,OAAO,EAAE,KAAK,EAAE,oEAAoE,EAAE,CAAC;YAC3F,CAAC;YACD,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,gBAAgB,IAAI,EAAE,EAAE,CAAC;IAC3C,CAAC,CAAC;IAEF,IAAI,MAA0B,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,OAAO,KAAK,GAAG,QAAQ,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAChD,KAAK,EAAE,CAAC;YACR,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,cAAc,EAAE;gBACxD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,SAAS,EAAE,aAAa;iBACzB;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,aAAa;oBAClC,QAAQ;oBACR,KAAK;oBACL,WAAW,EAAE,MAAM;iBACpB,CAAC;aACH,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBACT,MAAM,IAAI,UAAU,CAClB,WAAW,EACX,YAAY,GAAG,CAAC,MAAM,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC9D,CAAC;YACJ,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA6C,CAAC;YAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;YACvC,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;YACvE,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;gBAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;aAC3B,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,OAAO;gBAAE,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;gBAC3B,MAAM;YACR,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;gBAClC,IAAI,IAAI,GAA4B,EAAE,CAAC;gBACvC,IAAI,CAAC;oBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;gBACrD,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;gBACV,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC7D,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACpC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;oBACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBACtE,SAAS;gBACX,CAAC;gBACD,IAAI,MAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACnD,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM;wBACJ,CAAC,YAAY,iBAAiB;4BAC5B,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;4BACjE,CAAC,CAAC,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;gBACxC,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACpC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACrE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,IAAI,cAAc,IAAI,IAAI;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,GAAG,CAAC,mBAAmB,QAAQ,0BAA0B,CAAC,CAAC;IAC1F,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"llm.js","sourceRoot":"","sources":["../../../src/poppy-client/llm.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAsB,MAAM,UAAU,CAAC;AAI1D,mGAAmG;AACnG,MAAM,CAAC,MAAM,aAAa,GAAG,4BAA4B,CAAC;AAC1D,MAAM,CAAC,MAAM,cAAc,GAAG,+CAA+C,CAAC;AA+B9E,SAAS,SAAS,CAAC,MAA2B;IAC5C,MAAM,GAAG,GAA8B,EAAE,CAAC;IAC1C,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;YACzD,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE;gBAC3C,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,IAAI;gBACtB,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,IAAI;aACvB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,EAAE,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,0CAA0C,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,4EAA4E;aACjL,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,EAAE,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACxC,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,qDAAqD,EAAE,CAAC,MAAM,2CAA2C;aAClH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,OAAsB,EACtB,IAAY,EACZ,IAAgB;IAEhB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,IAAI,cAAkC,CAAC;IACvC,IAAI,GAA8B,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+C,CAAC;IAExE,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE;gBACR,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,8GAA8G;gBAChH,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE;qBACtE;oBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;iBACnB;aACF;SACF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;YAChC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACrD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1E,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,YAAY,KAAK,IAAI,EAAE,CAAC,CAAC;gBACrF,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE;wBACR,IAAI;wBACJ,WAAW,EAAE,sBAAsB,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,EAAE;wBAC5D,UAAU,EAAG,CAAC,CAAC,WAAuC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;qBAC7E;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,sBAAuB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,sDAAsD,CAAC,CAAC;IACjG,CAAC;IACD,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,sCAAsC;YACnD,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gBAC1C,QAAQ,EAAE,CAAC,QAAQ,CAAC;aACrB;SACF;KACF,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAkB;QAC9B;YACE,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE;gBACP,mDAAmD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,IAAI;gBAClI,yFAAyF;gBACzF,yJAAyJ;gBACzJ,qCAAqC;aACtC,CAAC,IAAI,CAAC,GAAG,CAAC;SACZ;QACD,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;KAChC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EAAE,IAAY,EAAE,IAA6B,EAAoB,EAAE;QACtF,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG;gBACd,EAAE,EAAE,YAAY,EAAE;gBAClB,MAAM,EAAE,EAAE,IAAI,EAAE,OAAgB,EAAE;gBAClC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC7B,IAAI,EACF,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI;oBACxC,CAAC,CAAE,IAAI,CAAC,IAAgC;oBACxC,CAAC,CAAC,SAAS;gBACf,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE;aACjF,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,cAAc,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBAC7D,IAAI,CAAC,GAAG,CAAC,mBAAmB,cAAc,GAAG,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAC7D,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;gBACxB,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;oBACzD,IAAI,CAAC,GAAG,CACN,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACpI,CAAC;gBACJ,CAAC;gBACD,IAAI,EAAE,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;oBACjC,kFAAkF;oBAClF,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;wBAC9B,EAAE,EAAE,YAAY,EAAE;wBAClB,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;wBACzB,IAAI,EAAE,8CAA8C;wBACpD,OAAO,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE;qBACnC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1F,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,EAAE,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACtC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO;oBACrB,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC3E,CAAC,CAAC,KAAK,CAAC;gBACV,IAAI,CAAC,EAAE;oBACL,OAAO,EAAE,KAAK,EAAE,oEAAoE,EAAE,CAAC;YAC3F,CAAC;YACD,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,gBAAgB,IAAI,EAAE,EAAE,CAAC;IAC3C,CAAC,CAAC;IAEF,IAAI,MAA0B,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,OAAO,KAAK,GAAG,QAAQ,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAChD,KAAK,EAAE,CAAC;YACR,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,cAAc,EAAE;gBACxD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,SAAS,EAAE,aAAa;iBACzB;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,aAAa;oBAClC,QAAQ;oBACR,KAAK;oBACL,WAAW,EAAE,MAAM;iBACpB,CAAC;aACH,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBACT,MAAM,IAAI,UAAU,CAClB,WAAW,EACX,YAAY,GAAG,CAAC,MAAM,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC9D,CAAC;YACJ,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA6C,CAAC;YAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;YACvC,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;YACvE,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;gBAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;aAC3B,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,OAAO;gBAAE,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;gBAC3B,MAAM;YACR,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;gBAClC,IAAI,IAAI,GAA4B,EAAE,CAAC;gBACvC,IAAI,CAAC;oBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;gBACrD,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;gBACV,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC7D,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACpC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;oBACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBACtE,SAAS;gBACX,CAAC;gBACD,IAAI,MAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACnD,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM;wBACJ,CAAC,YAAY,iBAAiB;4BAC5B,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;4BACjE,CAAC,CAAC,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;gBACxC,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACpC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACrE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,IAAI,cAAc,IAAI,IAAI;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,GAAG,CAAC,mBAAmB,QAAQ,0BAA0B,CAAC,CAAC;IAC1F,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;AAC3C,CAAC"}

package/dist/src/poppy-client/mcp.d.ts

@@ -7,10 +7,9 @@ export interface McpConnection {
     close(): Promise<void>;
 }
 /**
- * Connects to a listed MCP server over Streamable HTTP with a Bearer Session Token issued for
- * that server's `url` (4.3 "Bearer tokens", section 6). On `invalid_token` the token is
- * re-minted once and the request retried; a `403` `insufficient_scope` / `sign_in_required`
- * rejects the call with a {@link ResourceAuthError} carrying the needed `scope`.
+ * Connects to a listed MCP server over Streamable HTTP (section 7): the Session header on every
+ * request and, when signed in, a Bearer access token requested with `resource` set to the server's
+ * `url`. A challenge rejects the call with a {@link ResourceAuthError} naming the needed `scope`.
  */
 export declare function connectMcp(company: CompanyClient, apiIndex?: number | undefined): Promise<McpConnection>;
 //# sourceMappingURL=mcp.d.ts.map

package/dist/src/poppy-client/mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAGnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,aAAa,CAAC;IACnB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,aAAa,EACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,GAC5B,OAAO,CAAC,aAAa,CAAC,CAgDxB"}
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAGnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,aAAa,CAAC;IACnB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,aAAa,EACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,GAC5B,OAAO,CAAC,aAAa,CAAC,CAiCxB"}

package/dist/src/poppy-client/mcp.js

@@ -4,49 +4,37 @@ import { pickApi } from './api.js';
 import { ResourceAuthError } from './errors.js';
 import { wwwAuthError } from './util.js';
 /**
- * Connects to a listed MCP server over Streamable HTTP with a Bearer Session Token issued for
- * that server's `url` (4.3 "Bearer tokens", section 6). On `invalid_token` the token is
- * re-minted once and the request retried; a `403` `insufficient_scope` / `sign_in_required`
- * rejects the call with a {@link ResourceAuthError} carrying the needed `scope`.
+ * Connects to a listed MCP server over Streamable HTTP (section 7): the Session header on every
+ * request and, when signed in, a Bearer access token requested with `resource` set to the server's
+ * `url`. A challenge rejects the call with a {@link ResourceAuthError} naming the needed `scope`.
  */
 export async function connectMcp(company, apiIndex) {
     const api = pickApi(company, 'mcp', apiIndex);
-    // `resource` MUST be the MCP server's `url` from poppy.json (4.3).
-    const resource = api.url;
-    let token = await company.bearerFor(resource);
     const authedFetch = async (input, init) => {
-        for (let attempt = 0;; attempt++) {
-            const headers = new Headers(init?.headers);
-            headers.set('authorization', `Bearer ${token}`);
-            const res = await company.http.fetch(input, { ...init, headers });
-            const err = wwwAuthError(res.headers.get('www-authenticate'));
-            if (res.status === 401 && attempt === 0 && (!err.error || err.error === 'invalid_token')) {
-                token = await company.bearerFor(resource, true);
-                continue;
-            }
-            // A signed-in Bearer whose Session was signed out meanwhile (4.4): the Account Token signs
-            // it back in — or, revoked, answers invalid_grant and the client continues signed out.
-            if (res.status === 403 &&
-                attempt === 0 &&
-                err.error === 'sign_in_required' &&
-                company.accountToken) {
-                await res.body?.cancel().catch(() => { });
-                token = await company.bearerFor(resource, true);
-                continue;
-            }
-            // A tool behind a scope the user did not grant (MCP scope step-up, RFC 6750 §3.1): surface it
-            // like any other resource, so the caller can sign in again with `scope`.
-            if (res.status === 403 &&
-                (err.error === 'insufficient_scope' || err.error === 'sign_in_required')) {
-                await res.body?.cancel().catch(() => { });
-                throw new ResourceAuthError(err.error, {
-                    status: 403,
-                    description: err.description,
-                    scope: err.scope,
-                });
-            }
-            return res;
+        const headers = {};
+        new Headers(init?.headers).forEach((value, key) => {
+            headers[key] = value;
+        });
+        const res = await company.fetch(String(input), {
+            method: init?.method ?? 'GET',
+            headers,
+            ...(typeof init?.body === 'string' ? { body: init.body } : {}),
+            ...(init?.signal ? { signal: init.signal } : {}),
+            // `resource` MUST be the MCP server's `url` from poppy.json, and Bearer is MCP's baseline (7).
+            resource: api.url,
+            bearer: true,
+        });
+        const challenge = res.headers.get('www-authenticate');
+        if ((res.status === 401 || res.status === 403) && challenge) {
+            const err = wwwAuthError(challenge);
+            await res.body?.cancel().catch(() => { });
+            throw new ResourceAuthError(err.error ?? 'insufficient_scope', {
+                status: res.status,
+                description: err.description,
+                scope: err.scope,
+            });
         }
+        return res;
     };
     const transport = new StreamableHTTPClientTransport(new URL(api.url), { fetch: authedFetch });
     const client = new Client({ name: 'poppy-agent', version: '0.0.0' });

package/dist/src/poppy-client/mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/poppy-client/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAQzC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAsB,EACtB,QAA6B;IAE7B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9C,mEAAmE;IACnE,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC;IACzB,IAAI,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,KAAK,EAAE,KAAmB,EAAE,IAAkB,EAAqB,EAAE;QACvF,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;YAChD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAClE,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;YAC9D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,KAAK,eAAe,CAAC,EAAE,CAAC;gBACzF,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAChD,SAAS;YACX,CAAC;YACD,2FAA2F;YAC3F,uFAAuF;YACvF,IACE,GAAG,CAAC,MAAM,KAAK,GAAG;gBAClB,OAAO,KAAK,CAAC;gBACb,GAAG,CAAC,KAAK,KAAK,kBAAkB;gBAChC,OAAO,CAAC,YAAY,EACpB,CAAC;gBACD,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACzC,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAChD,SAAS;YACX,CAAC;YACD,8FAA8F;YAC9F,yEAAyE;YACzE,IACE,GAAG,CAAC,MAAM,KAAK,GAAG;gBAClB,CAAC,GAAG,CAAC,KAAK,KAAK,oBAAoB,IAAI,GAAG,CAAC,KAAK,KAAK,kBAAkB,CAAC,EACxE,CAAC;gBACD,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACzC,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE;oBACrC,MAAM,EAAE,GAAG;oBACX,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,KAAK,EAAE,GAAG,CAAC,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,+FAA+F;IAC/F,MAAM,MAAM,CAAC,OAAO,CAAC,SAAwD,CAAC,CAAC;IAC/E,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;AACtD,CAAC"}
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/poppy-client/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAQzC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAsB,EACtB,QAA6B;IAE7B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,KAAK,EAAE,KAAmB,EAAE,IAAkB,EAAqB,EAAE;QACvF,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAChD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YAC7C,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK;YAC7B,OAAO;YACP,GAAG,CAAC,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,+FAA+F;YAC/F,QAAQ,EAAE,GAAG,CAAC,GAAG;YACjB,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACtD,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;YACpC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACzC,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,IAAI,oBAAoB,EAAE;gBAC7D,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,KAAK,EAAE,GAAG,CAAC,KAAK;aACjB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,+FAA+F;IAC/F,MAAM,MAAM,CAAC,OAAO,CAAC,SAAwD,CAAC,CAAC;IAC/E,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;AACtD,CAAC"}

package/dist/src/poppy-client/safe_fetch.d.ts

@@ -0,0 +1,30 @@
+import { type LookupAddress } from 'node:dns';
+import type { FetchLike } from './util.js';
+/**
+ * `fetch` for URLs a Company gave (section 3): HTTPS only, and never to a loopback, private or
+ * link-local address. The address is checked in the socket's own `lookup`, so what was checked is
+ * what gets connected to, with no window for DNS rebinding, and each request opens its own
+ * connection. Every redirect hop goes through the same check.
+ */
+export type LookupFn = (hostname: string, options: {
+    all: true;
+}, callback: (err: NodeJS.ErrnoException | null, addresses: LookupAddress[]) => void) => void;
+export interface SafeFetchOptions {
+    /** Name resolution, for tests. Default: `dns.lookup`. */
+    lookup?: LookupFn | undefined;
+    /** Address policy, for tests. Default: {@link isBlockedAddress}. */
+    isBlocked?: ((address: string) => boolean) | undefined;
+    connectTimeoutMs?: number | undefined;
+}
+/** Whether this client must not connect to `ip`. Anything that isn't an IP counts as blocked. */
+export declare function isBlockedAddress(ip: string): boolean;
+/** A `fetch` that refuses internal addresses (section 3). */
+export declare function createSafeFetch(opts?: SafeFetchOptions): FetchLike;
+/** The default `fetch` of this client, unless `insecureDev` asked for the plain one. */
+export declare const safeFetch: FetchLike;
+/**
+ * The `fetch` for a Company's URLs. `insecureDev` is the explicit opt-in that reaches local servers.
+ * A caller that injects its own `fetch` takes over this check.
+ */
+export declare function companyFetch(insecureDev: boolean | undefined): FetchLike;
+//# sourceMappingURL=safe_fetch.d.ts.map

package/dist/src/poppy-client/safe_fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe_fetch.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/safe_fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAMnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C;;;;;GAKG;AAEH,MAAM,MAAM,QAAQ,GAAG,CACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE;IAAE,GAAG,EAAE,IAAI,CAAA;CAAE,EACtB,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,IAAI,KAC9E,IAAI,CAAC;AAEV,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC9B,oEAAoE;IACpE,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,SAAS,CAAC;IACvD,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AA+CD,iGAAiG;AACjG,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAkCpD;AAwFD,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,IAAI,GAAE,gBAAqB,GAAG,SAAS,CAiCtE;AAED,wFAAwF;AACxF,eAAO,MAAM,SAAS,EAAE,SAA6B,CAAC;AAItD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAExE"}

package/dist/src/poppy-client/safe_fetch.js

@@ -0,0 +1,210 @@
+import { lookup as dnsLookup } from 'node:dns';
+import { request as httpsRequest } from 'node:https';
+import { isIP } from 'node:net';
+import { Readable } from 'node:stream';
+import { PoppyError } from './errors.js';
+const MAX_REDIRECTS = 5;
+const DEFAULT_CONNECT_TIMEOUT_MS = 15_000;
+/** Headers that don't follow a redirect (section 3). */
+const SECRET_HEADERS = ['authorization', 'cookie', 'dpop', 'poppy-session'];
+const BLOCKED_V4 = [
+    ['0.0.0.0', 8],
+    ['10.0.0.0', 8],
+    ['100.64.0.0', 10],
+    ['127.0.0.0', 8],
+    ['169.254.0.0', 16],
+    ['172.16.0.0', 12],
+    ['192.0.0.0', 24],
+    ['192.0.2.0', 24],
+    ['192.88.99.0', 24],
+    ['192.168.0.0', 16],
+    ['198.18.0.0', 15],
+    ['198.51.100.0', 24],
+    ['203.0.113.0', 24],
+    ['224.0.0.0', 4],
+    ['240.0.0.0', 4],
+];
+function ipv4ToInt(ip) {
+    return ip.split('.').reduce((acc, part) => (acc << 8) + Number(part), 0) >>> 0;
+}
+/** An IPv6 address as 8 groups of 16 bits. */
+function ipv6Groups(ip) {
+    let addr = ip.toLowerCase().split('%')[0] ?? '';
+    const v4 = /(\d+\.\d+\.\d+\.\d+)$/.exec(addr)?.[1];
+    if (v4) {
+        const n = ipv4ToInt(v4);
+        addr = `${addr.slice(0, -v4.length)}${(n >>> 16).toString(16)}:${(n & 0xffff).toString(16)}`;
+    }
+    const [head, tail] = addr.split('::');
+    const h = head ? head.split(':') : [];
+    const t = tail ? tail.split(':') : [];
+    const fill = addr.includes('::') ? 8 - h.length - t.length : 0;
+    const groups = [...h, ...Array(Math.max(fill, 0)).fill('0'), ...t].map((g) => Number.parseInt(g || '0', 16));
+    return groups.length === 8 && groups.every((g) => g >= 0 && g <= 0xffff) ? groups : null;
+}
+/** Whether this client must not connect to `ip`. Anything that isn't an IP counts as blocked. */
+export function isBlockedAddress(ip) {
+    const family = isIP(ip);
+    if (family === 4) {
+        const n = ipv4ToInt(ip);
+        return BLOCKED_V4.some(([base, bits]) => {
+            const mask = bits === 0 ? 0 : (~0 << (32 - bits)) >>> 0;
+            return (n & mask) >>> 0 === (ipv4ToInt(base) & mask) >>> 0;
+        });
+    }
+    if (family !== 6)
+        return true;
+    const g = ipv6Groups(ip);
+    if (!g)
+        return true;
+    const [a = 0, b = 0, c = 0] = g;
+    const g5 = g[5] ?? 0;
+    const g6 = g[6] ?? 0;
+    const g7 = g[7] ?? 0;
+    if (g.every((x) => x === 0))
+        return true; // ::
+    if (g.slice(0, 7).every((x) => x === 0) && g7 === 1)
+        return true; // ::1
+    // IPv4-mapped and IPv4-compatible: the IPv4 address decides.
+    // IPv4-translated (::ffff:0:a.b.c.d) and NAT64 (64:ff9b::a.b.c.d) also reach an IPv4 address.
+    const translated = g.slice(0, 4).every((x) => x === 0) && g[4] === 0xffff && g5 === 0;
+    const nat64 = g[0] === 0x64 && g[1] === 0xff9b && g.slice(2, 6).every((x) => x === 0);
+    if (translated || nat64)
+        return isBlockedAddress(`${g6 >> 8}.${g6 & 255}.${g7 >> 8}.${g7 & 255}`);
+    if (g.slice(0, 5).every((x) => x === 0) && (g5 === 0xffff || g5 === 0)) {
+        return isBlockedAddress(`${g6 >> 8}.${g6 & 255}.${g7 >> 8}.${g7 & 255}`);
+    }
+    if ((a & 0xfe00) === 0xfc00)
+        return true; // fc00::/7, unique local
+    if ((a & 0xffc0) === 0xfe80)
+        return true; // fe80::/10, link-local
+    if ((a & 0xffc0) === 0xfec0)
+        return true; // fec0::/10, site-local
+    if ((a & 0xff00) === 0xff00)
+        return true; // ff00::/8, multicast
+    if (a === 0x2001 && b === 0x0db8)
+        return true; // 2001:db8::/32, documentation
+    if (a === 0x64 && b === 0xff9b)
+        return true; // 64:ff9b::/96, NAT64
+    if (a === 0x2002)
+        return isBlockedAddress(`${b >> 8}.${b & 255}.${c >> 8}.${c & 255}`); // 6to4
+    return false;
+}
+function refused(message) {
+    return new PoppyError('blocked_address', message);
+}
+/** One request, one connection, the address checked in the socket's `lookup`. */
+function requestOnce(url, init, opts) {
+    const isBlocked = opts.isBlocked ?? isBlockedAddress;
+    const resolve = opts.lookup ?? dnsLookup;
+    const host = url.hostname.replace(/^\[|\]$/g, '');
+    if (url.protocol !== 'https:')
+        return Promise.reject(refused(`${url.protocol} is not HTTPS`));
+    if (url.username || url.password)
+        return Promise.reject(refused('credentials in the URL'));
+    if (isIP(host) && isBlocked(host))
+        return Promise.reject(refused(`blocked address ${host}`));
+    const lookup = (hostname, options, callback) => {
+        resolve(hostname, { all: true }, (err, list) => {
+            if (err)
+                return callback(err);
+            const addresses = list ?? [];
+            const first = addresses[0];
+            if (!first)
+                return callback(refused(`no address for ${hostname}`));
+            // Any internal address refuses the name: the connection may try them all.
+            const bad = addresses.find((a) => isBlocked(a.address));
+            if (bad)
+                return callback(refused(`${hostname} resolves to a blocked address`));
+            if (options?.all)
+                return callback(null, addresses);
+            return callback(null, first.address, first.family);
+        });
+    };
+    return new Promise((done, reject) => {
+        const headers = {};
+        init.headers.forEach((value, key) => {
+            headers[key] = value;
+        });
+        const req = httpsRequest(url, {
+            method: init.method,
+            headers,
+            agent: false,
+            lookup: lookup,
+            ...(init.signal ? { signal: init.signal } : {}),
+        }, done);
+        const timer = setTimeout(() => req.destroy(new PoppyError('connect_timeout', `timed out connecting to ${url.host}`)), opts.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS);
+        timer.unref();
+        req.once('socket', (socket) => {
+            socket.once('secureConnect', () => clearTimeout(timer));
+        });
+        req.once('close', () => clearTimeout(timer));
+        req.once('error', reject);
+        req.end(init.body);
+    });
+}
+function toResponse(res, url) {
+    const headers = new Headers();
+    for (let i = 0; i + 1 < res.rawHeaders.length; i += 2) {
+        headers.append(res.rawHeaders[i], res.rawHeaders[i + 1]);
+    }
+    const status = res.statusCode ?? 502;
+    const empty = status === 204 || status === 205 || status === 304;
+    if (empty)
+        res.resume();
+    const response = new Response(empty ? null : Readable.toWeb(res), { status, headers });
+    Object.defineProperty(response, 'url', { value: url.toString() });
+    return response;
+}
+/** A `fetch` that refuses internal addresses (section 3). */
+export function createSafeFetch(opts = {}) {
+    return async (input, init = {}) => {
+        const request = input instanceof Request ? input : undefined;
+        let url = new URL(request ? request.url : input.toString());
+        let method = (init.method ?? request?.method ?? 'GET').toUpperCase();
+        const headers = new Headers(init.headers ?? request?.headers);
+        let body;
+        const raw = init.body ?? undefined;
+        if (typeof raw === 'string')
+            body = raw;
+        else if (raw !== undefined)
+            body = await new Response(raw).text();
+        else if (request?.body)
+            body = await request.text();
+        const signal = init.signal ?? request?.signal ?? null;
+        const mode = init.redirect ?? request?.redirect ?? 'follow';
+        for (let hop = 0;; hop++) {
+            const res = await requestOnce(url, { method, headers, body, signal }, opts);
+            const location = res.headers.location;
+            const isRedirect = (res.statusCode ?? 0) >= 300 && (res.statusCode ?? 0) < 400 && location;
+            if (!isRedirect || mode === 'manual')
+                return toResponse(res, url);
+            res.resume();
+            if (mode === 'error')
+                throw new TypeError(`unexpected redirect from ${url}`);
+            if (hop >= MAX_REDIRECTS)
+                throw new TypeError(`too many redirects from ${url}`);
+            url = new URL(location, url);
+            for (const name of SECRET_HEADERS)
+                headers.delete(name);
+            const status = res.statusCode;
+            if (status === 303 || ((status === 301 || status === 302) && method === 'POST')) {
+                method = 'GET';
+                body = undefined;
+                headers.delete('content-type');
+                headers.delete('content-length');
+            }
+        }
+    };
+}
+/** The default `fetch` of this client, unless `insecureDev` asked for the plain one. */
+export const safeFetch = createSafeFetch();
+const plainFetch = (input, init) => globalThis.fetch(input, init);
+/**
+ * The `fetch` for a Company's URLs. `insecureDev` is the explicit opt-in that reaches local servers.
+ * A caller that injects its own `fetch` takes over this check.
+ */
+export function companyFetch(insecureDev) {
+    return insecureDev ? plainFetch : safeFetch;
+}
+//# sourceMappingURL=safe_fetch.js.map