@adonis-agora/agent 0.94.0 → 0.95.0

package/dist/src/poppy-client/store.d.ts

@@ -5,21 +5,26 @@ export interface TokenRecord {
     /** Epoch ms. */
     expiresAt: number;
     scope: string;
-    sessionId: string;
-    signedIn: boolean;
     /** RFC 8707 resource this token was issued for, if any. */
     resource?: string | undefined;
 }
+/** The refresh token of a sign-in (4.4). Stored as `accountToken`, its name before Draft 0.3. */
 export interface AccountTokenRecord {
-    /** The Account Token (an OAuth refresh token). A secret: never logged or shown (4.8). */
+    /** A secret: never logged or shown (10.2). */
     refreshToken: string;
     scope: string;
     obtainedAt: number;
-    /** Epoch ms, from `refresh_token_expires_in` when the Company sets one. */
-    expiresAt?: number | undefined;
     /** Which sign-in type produced it. */
     via: 'direct' | 'device' | 'mediated';
 }
+/** The delegated key that signs this User ID's Session JWTs, with its delegation (5.2). */
+export interface DelegationRecord {
+    key: StoredKey;
+    /** The `pap-delegation+jwt`, compact. */
+    jwt: string;
+    /** Epoch seconds: the delegation's `exp`. */
+    exp: number;
+}
 export interface ConversationRecord {
     endpoint: string;
     /** Last event handled (a cursor / Last-Event-ID). */
@@ -28,18 +33,25 @@ export interface ConversationRecord {
     createdAt: number;
     closed?: boolean | undefined;
 }
-/** Everything the agent remembers about one User at one Company (keyed by issuer, 3.2). */
+/** Everything the agent remembers about one User at one Company, by its identifier (3.2). */
 export interface CompanyState {
+    /** The Company's identifier: its issuer, or `https://{domain}` without one (3.2). */
     issuer: string;
+    /** Whether `issuer` is a real OAuth issuer, not the domain fallback. */
+    hasIssuer?: boolean | undefined;
+    /** The protocol version this state was written for; an older one drops tokens and Session. */
+    protocol?: string | undefined;
     domains: string[];
-    /** Opaque, random, per-Company User ID (4.2). Never derived from personal information. */
+    /** Opaque, random, per-Company User ID (5.1). Never derived from personal information. */
     userId: string;
-    /** DPoP key for this User at this Company (4.3). Never published. */
+    /** DPoP key for this User at this Company. Never published. */
     dpopKey: StoredKey;
+    /** One User ID's delegated key: never shared with another User ID (5.2). */
+    delegation?: DelegationRecord | undefined;
     accountToken?: AccountTokenRecord | undefined;
-    /** Session Tokens by key: `dpop` (default) or `dpop|scope|resource` / `bearer|resource`. */
+    /** Access tokens by key: `default`, or `{resource}|{scope}|{bearer}`. */
     tokens: Record<string, TokenRecord>;
-    /** The current Session's ID. Not a credential (4.2). */
+    /** The current Session's `sid`: random, used for no other Session (5.2). Not a credential. */
     sessionId?: string | undefined;
     conversations: Record<string, ConversationRecord>;
 }
@@ -59,7 +71,7 @@ export interface StateFile {
 }
 export declare function defaultStatePath(): string;
 /**
- * The local state file. It holds private keys and Account Tokens, so it is written with mode
+ * The local state file. It holds private keys and refresh tokens, so it is written with mode
  * 0600 (directory 0700) and atomically (temp file + rename).
  */
 export declare class StateStore {

package/dist/src/poppy-client/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,yFAAyF;IACzF,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,sCAAsC;IACtC,GAAG,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAC;CACvC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC9B;AAED,2FAA2F;AAC3F,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,0FAA0F;IAC1F,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,OAAO,EAAE,SAAS,CAAC;IACnB,YAAY,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC9C,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,IAAI,EAAE,SAAS,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACrC,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;KAAE,CAAC,CAAC;CACvE;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAED;;;GAGG;AACH,qBAAa,UAAU;;IAEnB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACd,IAAI,EAAE,SAAS;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAH3B,OAAO,eAIH;IAEJ;;;OAGG;IACH,MAAM,CAAC,MAAM,CACX,IAAI,GAAE,SAAwC,EAC9C,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,GAC3C,UAAU,CAGZ;IAED,OAAa,IAAI,CAAC,IAAI,SAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,CAahE;IAED,oFAAoF;IACpF,IAAI,GAAG,IAAI,MAAM,CAEhB;IAED,OAAO,CAAC,IAAI,EAAE,MAAM;mBApDkB,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC;MAuDjE;IAID;;;;OAIG;IACH,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAIpB;CAYF"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,iGAAiG;AACjG,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,GAAG,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAC;CACvC;AAED,2FAA2F;AAC3F,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,SAAS,CAAC;IACf,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC9B;AAED,6FAA6F;AAC7F,MAAM,WAAW,YAAY;IAC3B,qFAAqF;IACrF,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAChC,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,0FAA0F;IAC1F,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,OAAO,EAAE,SAAS,CAAC;IACnB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC1C,YAAY,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC9C,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,IAAI,EAAE,SAAS,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACrC,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;KAAE,CAAC,CAAC;CACvE;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAED;;;GAGG;AACH,qBAAa,UAAU;;IAEnB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACd,IAAI,EAAE,SAAS;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAH3B,OAAO,eAIH;IAEJ;;;OAGG;IACH,MAAM,CAAC,MAAM,CACX,IAAI,GAAE,SAAwC,EAC9C,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,GAC3C,UAAU,CAGZ;IAED,OAAa,IAAI,CAAC,IAAI,SAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,CAahE;IAED,oFAAoF;IACpF,IAAI,GAAG,IAAI,MAAM,CAEhB;IAED,OAAO,CAAC,IAAI,EAAE,MAAM;mBApDkB,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC;MAuDjE;IAID;;;;OAIG;IACH,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAIpB;CAYF"}

package/dist/src/poppy-client/store.js

@@ -9,7 +9,7 @@ export function defaultStatePath() {
     return join(base, 'poppy-agent', 'state.json');
 }
 /**
- * The local state file. It holds private keys and Account Tokens, so it is written with mode
+ * The local state file. It holds private keys and refresh tokens, so it is written with mode
  * 0600 (directory 0700) and atomically (temp file + rename).
  */
 export class StateStore {

package/dist/src/poppy-client/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/poppy-client/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAiE1C,MAAM,UAAU,gBAAgB;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,UAAU;IAEV,IAAI;IACN,IAAI;IACM,OAAO;IAH1B,YACW,IAAY,EACd,IAAe,EACL,OAA0D;oBAFlE,IAAI;oBACN,IAAI;uBACM,OAAO;IACvB,CAAC;IAEJ;;;OAGG;IACH,MAAM,CAAC,MAAM,CACX,IAAI,GAAc,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAC9C,OAA4C;QAE5C,IAAI,CAAC,QAAQ,KAAK,EAAE,CAAC;QACrB,OAAO,IAAI,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,gBAAgB,EAAE;QACzC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,IAAI,IAAI,GAAc,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACzC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC;YACpC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,QAAQ,KAAK,EAAE,CAAC;QACrB,OAAO,IAAI,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,oFAAoF;IACpF,IAAI,GAAG;QACL,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,CAAC,IAAY;QAClB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAE3C;;;;OAIG;IACH,IAAI;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QAChF,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxB,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;CACF"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/poppy-client/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA8E1C,MAAM,UAAU,gBAAgB;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,UAAU;IAEV,IAAI;IACN,IAAI;IACM,OAAO;IAH1B,YACW,IAAY,EACd,IAAe,EACL,OAA0D;oBAFlE,IAAI;oBACN,IAAI;uBACM,OAAO;IACvB,CAAC;IAEJ;;;OAGG;IACH,MAAM,CAAC,MAAM,CACX,IAAI,GAAc,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAC9C,OAA4C;QAE5C,IAAI,CAAC,QAAQ,KAAK,EAAE,CAAC;QACrB,OAAO,IAAI,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,gBAAgB,EAAE;QACzC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,IAAI,IAAI,GAAc,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACzC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC;YACpC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,QAAQ,KAAK,EAAE,CAAC;QACrB,OAAO,IAAI,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,oFAAoF;IACpF,IAAI,GAAG;QACL,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,CAAC,IAAY;QAClB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAE3C;;;;OAIG;IACH,IAAI;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QAChF,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxB,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;CACF"}

package/dist/src/poppy-client/task_coverage.d.ts

@@ -0,0 +1,13 @@
+import type { CompanyClient } from './company.js';
+import type { ExcludedTask, TaskAlternative } from './types.js';
+/** The public list of tasks the Company chose not to offer (9.1): a GET with no token. */
+export declare function excludedTasks(company: CompanyClient): Promise<ExcludedTask[]>;
+/**
+ * Reports a task that can't be done through this protocol (9.3). Answers the Company's alternative
+ * when it has one (HTTP 200), or `null` (HTTP 202). No personal data or secrets in the report.
+ */
+export declare function sendFeedback(company: CompanyClient, report: {
+    task: string;
+    description: string;
+}): Promise<TaskAlternative | null>;
+//# sourceMappingURL=task_coverage.d.ts.map

package/dist/src/poppy-client/task_coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task_coverage.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/task_coverage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAIlD,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAiB,MAAM,YAAY,CAAC;AAyB/E,0FAA0F;AAC1F,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAenF;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAajC"}

package/dist/src/poppy-client/task_coverage.js

@@ -0,0 +1,66 @@
+import { throwForResponse } from './company.js';
+import { PoppyError } from './errors.js';
+import { readJson } from './http.js';
+import { requireSecureUrl } from './util.js';
+/**
+ * Drops what 9.2 says to ignore: references of a type this client doesn't know, and `openapi` or
+ * `mcp` references to an API the Company doesn't list, so an alternative can't aim it elsewhere.
+ */
+function safeAlternative(company, alternative) {
+    if (!alternative || typeof alternative !== 'object')
+        return undefined;
+    const listed = (type, url) => (company.document.apis ?? []).some((a) => a?.type === type && a.url === url);
+    const references = Array.isArray(alternative.references)
+        ? alternative.references.filter((r) => {
+            if (r?.type === 'web')
+                return typeof r.url === 'string';
+            return (r?.type === 'openapi' || r?.type === 'mcp') && listed(r.type, r.url);
+        })
+        : undefined;
+    if (typeof alternative.instructions !== 'string' && !references?.length)
+        return undefined;
+    const { references: _raw, ...rest } = alternative;
+    return { ...rest, ...(references ? { references } : {}) };
+}
+/** The public list of tasks the Company chose not to offer (9.1): a GET with no token. */
+export async function excludedTasks(company) {
+    const url = company.document.excluded_tasks?.url;
+    if (!url)
+        return [];
+    requireSecureUrl(url, 'excluded_tasks.url', company.security);
+    const res = await company.http.request(url, { headers: { accept: 'application/json' } });
+    if (!res.ok)
+        throw new PoppyError(`http_${res.status}`, `could not load ${url}`);
+    const doc = await readJson(res);
+    if (!Array.isArray(doc?.tasks))
+        throw new PoppyError('invalid_response', 'tasks must be a list');
+    return doc.tasks
+        .filter((t) => typeof t?.task === 'string')
+        .map((t) => {
+        const alternative = safeAlternative(company, t.alternative);
+        const { alternative: _raw, ...rest } = t;
+        return alternative ? { ...rest, alternative } : rest;
+    });
+}
+/**
+ * Reports a task that can't be done through this protocol (9.3). Answers the Company's alternative
+ * when it has one (HTTP 200), or `null` (HTTP 202). No personal data or secrets in the report.
+ */
+export async function sendFeedback(company, report) {
+    const endpoint = company.document.feedback?.endpoint;
+    if (!endpoint)
+        throw new PoppyError('no_feedback_endpoint', 'Company lists no feedback endpoint');
+    requireSecureUrl(endpoint, 'feedback.endpoint', company.security);
+    const res = await company.fetch(endpoint, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', accept: 'application/json' },
+        body: JSON.stringify({ task: report.task, description: report.description }),
+        signedOut: true,
+    });
+    if (res.status === 202)
+        return null;
+    if (!res.ok)
+        await throwForResponse(res);
+    return safeAlternative(company, await readJson(res)) ?? null;
+}
+//# sourceMappingURL=task_coverage.js.map

package/dist/src/poppy-client/task_coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"task_coverage.js","sourceRoot":"","sources":["../../../src/poppy-client/task_coverage.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C;;;GAGG;AACH,SAAS,eAAe,CACtB,OAAsB,EACtB,WAAwC;IAExC,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,GAAY,EAAE,EAAE,CAC5C,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC;QACtD,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAgB,EAAE,EAAE;YACjD,IAAI,CAAC,EAAE,IAAI,KAAK,KAAK;gBAAE,OAAO,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC;YACxD,OAAO,CAAC,CAAC,EAAE,IAAI,KAAK,SAAS,IAAI,CAAC,EAAE,IAAI,KAAK,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/E,CAAC,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,OAAO,WAAW,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,UAAU,EAAE,MAAM;QAAE,OAAO,SAAS,CAAC;IAC1F,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,WAAW,CAAC;IAClD,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAsB;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,gBAAgB,CAAC,GAAG,EAAE,oBAAoB,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,UAAU,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,kBAAkB,GAAG,EAAE,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAsB,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;IACjG,OAAQ,GAAG,CAAC,KAAwB;SACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC;SAC1C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAsB,EACtB,MAA6C;IAE7C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACrD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,oCAAoC,CAAC,CAAC;IAClG,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE;QACxC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5E,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,eAAe,CAAC,OAAO,EAAE,MAAM,QAAQ,CAAkB,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;AAChF,CAAC"}

package/dist/src/poppy-client/token_client.d.ts

@@ -2,68 +2,71 @@ import type { DpopKey } from './dpop.js';
 import { type PoppyHttp } from './http.js';
 import type { AgentIdentity } from './identity.js';
 import type { AuthServerMetadata, DeviceAuthorizationResponse, TokenResponse } from './types.js';
-export declare const GRANT_JWT_BEARER = "urn:ietf:params:oauth:grant-type:jwt-bearer";
 export declare const GRANT_DEVICE_CODE = "urn:ietf:params:oauth:grant-type:device_code";
+export declare const GRANT_MEDIATED_SIGN_IN = "https://personalagentprotocol.org/grant/mediated-sign-in";
 export declare const CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
-export interface TokenClientOptions {
-    /**
-     * `aud` of the client assertion. RFC 7523 allows the token endpoint URL (the default here,
-     * matching the spec's examples) or the issuer identifier.
-     */
-    clientAssertionAudience?: 'token_endpoint' | 'issuer' | undefined;
-}
 export interface NarrowingParams {
-    /** Ask for fewer scopes than the Session has (4.3 "Narrower tokens"). */
+    /** Ask for fewer scopes than the refresh token has (4.4). */
     scope?: string | undefined;
-    /** RFC 8707 resource indicator. */
+    /** RFC 8707 resource indicator (4.5). */
     resource?: string | undefined;
 }
 /**
- * OAuth calls against the Company's authorization server (section 4): every request carries
- * a `private_key_jwt` client assertion (4.1), and token requests carry a DPoP proof unless a
- * Bearer token (MCP) is wanted (4.3).
+ * OAuth calls against the Company's authorization server (section 4): every request carries a
+ * `private_key_jwt` client assertion addressed to the issuer (4.1). Token requests carry a DPoP
+ * proof when one is given, and the response's `token_type` says what the Company did with it (4.5).
  */
 export declare class TokenClient {
     private readonly identity;
     readonly metadata: AuthServerMetadata;
     private readonly http;
-    private readonly opts;
-    constructor(identity: AgentIdentity, metadata: AuthServerMetadata, http: PoppyHttp, opts?: TokenClientOptions);
+    constructor(identity: AgentIdentity, metadata: AuthServerMetadata, http: PoppyHttp);
     private clientAuth;
     /** POSTs a form; the builder runs per attempt so retries get fresh assertions. */
     private post;
     private toError;
-    /** Any token-endpoint grant. Validates the response shape of 4.2/4.4. */
-    token(params: () => Promise<Record<string, string | undefined>>, dpop?: DpopKey | undefined): Promise<TokenResponse>;
-    /** JWT bearer grant: starts a Session, or renews a signed-out one with `sessionId` (4.2). */
-    jwtBearer(input: {
-        userId: string;
-        sessionId?: string | undefined;
-        dpop?: DpopKey | undefined;
-    } & NarrowingParams): Promise<TokenResponse>;
-    /** Account Token grant (4.8): signs a Session in, or starts a new signed-in Session. */
+    /**
+     * Any token-endpoint grant (4.7). `requested` is what `scope` means when the response leaves it
+     * out: the Company granted exactly the scopes requested (RFC 6749 section 5.1).
+     */
+    token(params: () => Promise<Record<string, string | undefined>>, requested: string | undefined, dpop?: DpopKey | undefined): Promise<TokenResponse>;
+    /** Refresh (4.4). A token response may leave `refresh_token` out: keep using the one you have. */
     refresh(input: {
         refreshToken: string;
-        sessionId?: string | undefined;
+        /** The refresh token's scopes: what `scope` means when the response omits it. */
+        grantedScope: string;
         dpop?: DpopKey | undefined;
     } & NarrowingParams): Promise<TokenResponse>;
-    /** Direct Sign-In code exchange (4.5 step 4). */
+    /** Direct Sign-In code exchange (4.2). */
     authorizationCode(input: {
         code: string;
         redirectUri: string;
         codeVerifier: string;
-        sessionId: string;
-        dpop: DpopKey;
+        scope: string;
+        dpop?: DpopKey | undefined;
     }): Promise<TokenResponse>;
-    /** Device Sign-In step 1 (4.6). */
+    /** Device Sign-In step 1 (4.3). */
     deviceAuthorization(scope: string): Promise<DeviceAuthorizationResponse>;
-    /** Device Sign-In polling (4.6 step 3). Throws `authorization_pending` / `slow_down` etc. */
+    /** Device Sign-In polling (4.3). Throws `authorization_pending` / `slow_down` etc. */
     deviceToken(input: {
         deviceCode: string;
-        sessionId: string;
-        dpop: DpopKey;
+        scope: string;
+        dpop?: DpopKey | undefined;
+    }): Promise<TokenResponse>;
+    /** The Mediated Sign-In grant (extension, section 3): credentials as form parameters. */
+    mediated(input: {
+        scope: string;
+        credentials: Record<string, string>;
+        dpop?: DpopKey | undefined;
+    }): Promise<TokenResponse>;
+    /** The same grant again with the one-time code, without credentials or `scope` (section 4). */
+    mediatedCode(input: {
+        signInId: string;
+        code: string;
+        scope: string;
+        dpop?: DpopKey | undefined;
     }): Promise<TokenResponse>;
-    /** RFC 7009 revocation of an Account Token (4.9). */
+    /** RFC 7009 revocation of a refresh token (4.6). */
     revoke(token: string, hint?: 'refresh_token' | 'access_token'): Promise<void>;
 }
 //# sourceMappingURL=token_client.d.ts.map

package/dist/src/poppy-client/token_client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token_client.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/token_client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,KAAK,SAAS,EAAY,MAAM,WAAW,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGjG,eAAO,MAAM,gBAAgB,gDAAgD,CAAC;AAC9E,eAAO,MAAM,iBAAiB,iDAAiD,CAAC;AAChF,eAAO,MAAM,qBAAqB,2DAA2D,CAAC;AAE9F,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,gBAAgB,GAAG,QAAQ,GAAG,SAAS,CAAC;CACnE;AAED,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,mCAAmC;IACnC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED;;;;GAIG;AACH,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB;IACrC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJvB,YACmB,QAAQ,EAAE,aAAa,EAC/B,QAAQ,EAAE,kBAAkB,EACpB,IAAI,EAAE,SAAS,EACf,IAAI,GAAE,kBAAuB,EAC5C;YAEU,UAAU;IAYxB,kFAAkF;YACpE,IAAI;IAuBlB,OAAO,CAAC,OAAO;IAef,yEAAyE;IACnE,KAAK,CACT,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EACzD,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,GACzB,OAAO,CAAC,aAAa,CAAC,CAyBxB;IAED,6FAA6F;IAC7F,SAAS,CACP,KAAK,EAAE;QACL,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC/B,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;KAC5B,GAAG,eAAe,GAClB,OAAO,CAAC,aAAa,CAAC,CAWxB;IAED,wFAAwF;IACxF,OAAO,CACL,KAAK,EAAE;QACL,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC/B,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;KAC5B,GAAG,eAAe,GAClB,OAAO,CAAC,aAAa,CAAC,CAWxB;IAED,iDAAiD;IACjD,iBAAiB,CAAC,KAAK,EAAE;QACvB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,OAAO,CAAC;KACf,GAAG,OAAO,CAAC,aAAa,CAAC,CAWzB;IAED,mCAAmC;IAC7B,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAa7E;IAED,6FAA6F;IAC7F,WAAW,CAAC,KAAK,EAAE;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,OAAO,CAAC;KACf,GAAG,OAAO,CAAC,aAAa,CAAC,CASzB;IAED,qDAAqD;IAC/C,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE,eAAe,GAAG,cAAgC,iBAMnF;CACF"}
+{"version":3,"file":"token_client.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/token_client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,KAAK,SAAS,EAAY,MAAM,WAAW,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGjG,eAAO,MAAM,iBAAiB,iDAAiD,CAAC;AAChF,eAAO,MAAM,sBAAsB,6DAA6D,CAAC;AACjG,eAAO,MAAM,qBAAqB,2DAA2D,CAAC;AAE9F,MAAM,WAAW,eAAe;IAC9B,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAKD;;;;GAIG;AACH,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB;IACrC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHvB,YACmB,QAAQ,EAAE,aAAa,EAC/B,QAAQ,EAAE,kBAAkB,EACpB,IAAI,EAAE,SAAS,EAC9B;YAEU,UAAU;IAQxB,kFAAkF;YACpE,IAAI;IAwBlB,OAAO,CAAC,OAAO;IAef;;;OAGG;IACG,KAAK,CACT,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EACzD,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,GACzB,OAAO,CAAC,aAAa,CAAC,CAuBxB;IAED,kGAAkG;IAClG,OAAO,CACL,KAAK,EAAE;QACL,YAAY,EAAE,MAAM,CAAC;QACrB,iFAAiF;QACjF,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;KAC5B,GAAG,eAAe,GAClB,OAAO,CAAC,aAAa,CAAC,CAWxB;IAED,0CAA0C;IAC1C,iBAAiB,CAAC,KAAK,EAAE;QACvB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;KAC5B,GAAG,OAAO,CAAC,aAAa,CAAC,CAWzB;IAED,mCAAmC;IAC7B,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAa7E;IAED,sFAAsF;IACtF,WAAW,CAAC,KAAK,EAAE;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;KAC5B,GAAG,OAAO,CAAC,aAAa,CAAC,CAMzB;IAED,yFAAyF;IACzF,QAAQ,CAAC,KAAK,EAAE;QACd,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;KAC5B,GAAG,OAAO,CAAC,aAAa,CAAC,CAUzB;IAED,+FAA+F;IAC/F,YAAY,CAAC,KAAK,EAAE;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;KAC5B,GAAG,OAAO,CAAC,aAAa,CAAC,CAUzB;IAED,oDAAoD;IAC9C,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE,eAAe,GAAG,cAAgC,iBAMnF;CACF"}

package/dist/src/poppy-client/token_client.js

@@ -1,33 +1,30 @@
 import { OAuthError } from './errors.js';
 import { readJson } from './http.js';
 import { parseRetryAfter } from './util.js';
-export const GRANT_JWT_BEARER = 'urn:ietf:params:oauth:grant-type:jwt-bearer';
 export const GRANT_DEVICE_CODE = 'urn:ietf:params:oauth:grant-type:device_code';
+export const GRANT_MEDIATED_SIGN_IN = 'https://personalagentprotocol.org/grant/mediated-sign-in';
 export const CLIENT_ASSERTION_TYPE = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer';
+/** Client-side RFC 6749 defaults for what a token response may leave out. */
+const DEFAULT_EXPIRES_IN = 3600;
 /**
- * OAuth calls against the Company's authorization server (section 4): every request carries
- * a `private_key_jwt` client assertion (4.1), and token requests carry a DPoP proof unless a
- * Bearer token (MCP) is wanted (4.3).
+ * OAuth calls against the Company's authorization server (section 4): every request carries a
+ * `private_key_jwt` client assertion addressed to the issuer (4.1). Token requests carry a DPoP
+ * proof when one is given, and the response's `token_type` says what the Company did with it (4.5).
  */
 export class TokenClient {
     identity;
     metadata;
     http;
-    opts;
-    constructor(identity, metadata, http, opts = {}) {
+    constructor(identity, metadata, http) {
         this.identity = identity;
         this.metadata = metadata;
         this.http = http;
-        this.opts = opts;
     }
     async clientAuth() {
-        const aud = this.opts.clientAssertionAudience === 'issuer'
-            ? this.metadata.issuer
-            : this.metadata.token_endpoint;
         return {
             client_id: this.identity.clientId,
             client_assertion_type: CLIENT_ASSERTION_TYPE,
-            client_assertion: await this.identity.clientAssertion(aud),
+            client_assertion: await this.identity.clientAssertion(this.metadata.issuer),
         };
     }
     /** POSTs a form; the builder runs per attempt so retries get fresh assertions. */
@@ -39,6 +36,7 @@ export class TokenClient {
                 accept: 'application/json',
             },
             dpop,
+            redirect: 'manual',
             body: async () => {
                 const params = { ...(await build()), ...(await this.clientAuth()) };
                 const form = new URLSearchParams();
@@ -59,8 +57,11 @@ export class TokenClient {
             details: r.body,
         });
     }
-    /** Any token-endpoint grant. Validates the response shape of 4.2/4.4. */
-    async token(params, dpop) {
+    /**
+     * Any token-endpoint grant (4.7). `requested` is what `scope` means when the response leaves it
+     * out: the Company granted exactly the scopes requested (RFC 6749 section 5.1).
+     */
+    async token(params, requested, dpop) {
         const r = await this.post(this.metadata.token_endpoint, params, dpop);
         if (r.status !== 200 || !r.body)
             throw this.toError(r);
@@ -70,54 +71,41 @@ export class TokenClient {
                 description: 'no access_token in token response',
             });
         }
-        if (typeof t.expires_in !== 'number' || !(t.expires_in > 0)) {
-            throw new OAuthError('invalid_response', { description: 'expires_in must be > 0 (4.2)' });
-        }
-        if (typeof t.session_id !== 'string' || !t.session_id) {
-            throw new OAuthError('invalid_response', { description: 'no session_id in token response' });
+        const type = String(t.token_type).toLowerCase();
+        if (type !== 'bearer' && type !== 'dpop') {
+            throw new OAuthError('invalid_response', {
+                description: `unsupported token_type ${t.token_type}`,
+            });
         }
-        const expected = dpop ? 'dpop' : 'bearer';
-        if (String(t.token_type).toLowerCase() !== expected) {
-            // RFC 9449 section 5: a client that sent a proof must not accept a downgraded token.
+        if (type === 'dpop' && !dpop) {
             throw new OAuthError('invalid_response', {
-                description: `token_type is ${t.token_type}, expected ${dpop ? 'DPoP' : 'Bearer'}`,
+                description: 'a DPoP-bound token for a request without a proof',
             });
         }
-        t.signed_in = t.signed_in === true;
-        t.scope = typeof t.scope === 'string' ? t.scope : '';
+        if (typeof t.expires_in !== 'number' || !(t.expires_in > 0))
+            t.expires_in = DEFAULT_EXPIRES_IN;
+        t.scope = typeof t.scope === 'string' ? t.scope : (requested ?? '');
         return t;
     }
-    /** JWT bearer grant: starts a Session, or renews a signed-out one with `sessionId` (4.2). */
-    jwtBearer(input) {
-        return this.token(async () => ({
-            grant_type: GRANT_JWT_BEARER,
-            assertion: await this.identity.sessionAssertion(input.userId, this.metadata.token_endpoint),
-            session_id: input.sessionId,
-            scope: input.scope,
-            resource: input.resource,
-        }), input.dpop);
-    }
-    /** Account Token grant (4.8): signs a Session in, or starts a new signed-in Session. */
+    /** Refresh (4.4). A token response may leave `refresh_token` out: keep using the one you have. */
     refresh(input) {
         return this.token(async () => ({
             grant_type: 'refresh_token',
             refresh_token: input.refreshToken,
-            session_id: input.sessionId,
             scope: input.scope,
             resource: input.resource,
-        }), input.dpop);
+        }), input.scope ?? input.grantedScope, input.dpop);
     }
-    /** Direct Sign-In code exchange (4.5 step 4). */
+    /** Direct Sign-In code exchange (4.2). */
     authorizationCode(input) {
         return this.token(async () => ({
             grant_type: 'authorization_code',
             code: input.code,
             redirect_uri: input.redirectUri,
             code_verifier: input.codeVerifier,
-            session_id: input.sessionId,
-        }), input.dpop);
+        }), input.scope, input.dpop);
     }
-    /** Device Sign-In step 1 (4.6). */
+    /** Device Sign-In step 1 (4.3). */
     async deviceAuthorization(scope) {
         const endpoint = this.metadata.device_authorization_endpoint;
         if (!endpoint)
@@ -133,15 +121,27 @@ export class TokenClient {
         }
         return d;
     }
-    /** Device Sign-In polling (4.6 step 3). Throws `authorization_pending` / `slow_down` etc. */
+    /** Device Sign-In polling (4.3). Throws `authorization_pending` / `slow_down` etc. */
     deviceToken(input) {
+        return this.token(async () => ({ grant_type: GRANT_DEVICE_CODE, device_code: input.deviceCode }), input.scope, input.dpop);
+    }
+    /** The Mediated Sign-In grant (extension, section 3): credentials as form parameters. */
+    mediated(input) {
+        return this.token(async () => ({
+            ...input.credentials,
+            grant_type: GRANT_MEDIATED_SIGN_IN,
+            scope: input.scope,
+        }), input.scope, input.dpop);
+    }
+    /** The same grant again with the one-time code, without credentials or `scope` (section 4). */
+    mediatedCode(input) {
         return this.token(async () => ({
-            grant_type: GRANT_DEVICE_CODE,
-            device_code: input.deviceCode,
-            session_id: input.sessionId,
-        }), input.dpop);
+            grant_type: GRANT_MEDIATED_SIGN_IN,
+            sign_in_id: input.signInId,
+            one_time_code: input.code,
+        }), input.scope, input.dpop);
     }
-    /** RFC 7009 revocation of an Account Token (4.9). */
+    /** RFC 7009 revocation of a refresh token (4.6). */
     async revoke(token, hint = 'refresh_token') {
         const r = await this.post(this.metadata.revocation_endpoint, async () => ({
             token,

package/dist/src/poppy-client/token_client.js.map

@@ -1 +1 @@
-{"version":3,"file":"token_client.js","sourceRoot":"","sources":["../../../src/poppy-client/token_client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAkB,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGrD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,MAAM,CAAC,MAAM,gBAAgB,GAAG,6CAA6C,CAAC;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,8CAA8C,CAAC;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAG,wDAAwD,CAAC;AAiB9F;;;;GAIG;AACH,MAAM,OAAO,WAAW;IAEH,QAAQ;IAChB,QAAQ;IACA,IAAI;IACJ,IAAI;IAJvB,YACmB,QAAuB,EAC/B,QAA4B,EACpB,IAAe,EACf,IAAI,GAAuB,EAAE;wBAH7B,QAAQ;wBAChB,QAAQ;oBACA,IAAI;oBACJ,IAAI;IACpB,CAAC;IAEI,KAAK,CAAC,UAAU;QACtB,MAAM,GAAG,GACP,IAAI,CAAC,IAAI,CAAC,uBAAuB,KAAK,QAAQ;YAC5C,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM;YACtB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;QACnC,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;YACjC,qBAAqB,EAAE,qBAAqB;YAC5C,gBAAgB,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC;SAC3D,CAAC;IACJ,CAAC;IAED,kFAAkF;IAC1E,KAAK,CAAC,IAAI,CAChB,QAAgB,EAChB,KAAwD,EACxD,IAA0B;QAE1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI;YACJ,IAAI,EAAE,KAAK,IAAI,EAAE;gBACf,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;gBACnC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;oBACzC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;wBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAClD,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzB,CAAC;SACF,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IACjF,CAAC;IAEO,OAAO,CAAC,CAIf;QACC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QACnF,OAAO,IAAI,UAAU,CAAC,IAAI,EAAE;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,WAAW,EACT,OAAO,CAAC,CAAC,IAAI,EAAE,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;YACtF,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACzD,OAAO,EAAE,CAAC,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,KAAK,CACT,MAAyD,EACzD,IAA0B;QAE1B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACtE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAgC,CAAC;QAC7C,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;YAC1D,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE;gBACvC,WAAW,EAAE,mCAAmC;aACjD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YACtD,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC1C,IAAI,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;YACpD,qFAAqF;YACrF,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE;gBACvC,WAAW,EAAE,iBAAiB,CAAC,CAAC,UAAU,cAAc,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;aACnF,CAAC,CAAC;QACL,CAAC;QACD,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC;QACnC,CAAC,CAAC,KAAK,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,6FAA6F;IAC7F,SAAS,CACP,KAImB;QAEnB,OAAO,IAAI,CAAC,KAAK,CACf,KAAK,IAAI,EAAE,CAAC,CAAC;YACX,UAAU,EAAE,gBAAgB;YAC5B,SAAS,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC3F,UAAU,EAAE,KAAK,CAAC,SAAS;YAC3B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,EACF,KAAK,CAAC,IAAI,CACX,CAAC;IACJ,CAAC;IAED,wFAAwF;IACxF,OAAO,CACL,KAImB;QAEnB,OAAO,IAAI,CAAC,KAAK,CACf,KAAK,IAAI,EAAE,CAAC,CAAC;YACX,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;YACjC,UAAU,EAAE,KAAK,CAAC,SAAS;YAC3B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,EACF,KAAK,CAAC,IAAI,CACX,CAAC;IACJ,CAAC;IAED,iDAAiD;IACjD,iBAAiB,CAAC,KAMjB;QACC,OAAO,IAAI,CAAC,KAAK,CACf,KAAK,IAAI,EAAE,CAAC,CAAC;YACX,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,aAAa,EAAE,KAAK,CAAC,YAAY;YACjC,UAAU,EAAE,KAAK,CAAC,SAAS;SAC5B,CAAC,EACF,KAAK,CAAC,IAAI,CACX,CAAC;IACJ,CAAC;IAED,mCAAmC;IACnC,KAAK,CAAC,mBAAmB,CAAC,KAAa;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,6BAA6B,CAAC;QAC7D,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,UAAU,CAAC,aAAa,EAAE,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC,CAAC;QAC3F,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,CAAC,IAA8C,CAAC;QAC3D,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAC1D,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE;gBACvC,WAAW,EAAE,0CAA0C;aACxD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,6FAA6F;IAC7F,WAAW,CAAC,KAIX;QACC,OAAO,IAAI,CAAC,KAAK,CACf,KAAK,IAAI,EAAE,CAAC,CAAC;YACX,UAAU,EAAE,iBAAiB;YAC7B,WAAW,EAAE,KAAK,CAAC,UAAU;YAC7B,UAAU,EAAE,KAAK,CAAC,SAAS;SAC5B,CAAC,EACF,KAAK,CAAC,IAAI,CACX,CAAC;IACJ,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,IAAI,GAAqC,eAAe;QAClF,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACxE,KAAK;YACL,eAAe,EAAE,IAAI;SACtB,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;CACF"}
+{"version":3,"file":"token_client.js","sourceRoot":"","sources":["../../../src/poppy-client/token_client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAkB,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGrD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,8CAA8C,CAAC;AAChF,MAAM,CAAC,MAAM,sBAAsB,GAAG,0DAA0D,CAAC;AACjG,MAAM,CAAC,MAAM,qBAAqB,GAAG,wDAAwD,CAAC;AAS9F,6EAA6E;AAC7E,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC;;;;GAIG;AACH,MAAM,OAAO,WAAW;IAEH,QAAQ;IAChB,QAAQ;IACA,IAAI;IAHvB,YACmB,QAAuB,EAC/B,QAA4B,EACpB,IAAe;wBAFf,QAAQ;wBAChB,QAAQ;oBACA,IAAI;IACpB,CAAC;IAEI,KAAK,CAAC,UAAU;QACtB,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;YACjC,qBAAqB,EAAE,qBAAqB;YAC5C,gBAAgB,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;SAC5E,CAAC;IACJ,CAAC;IAED,kFAAkF;IAC1E,KAAK,CAAC,IAAI,CAChB,QAAgB,EAChB,KAAwD,EACxD,IAA0B;QAE1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI;YACJ,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,KAAK,IAAI,EAAE;gBACf,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;gBACnC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;oBACzC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;wBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAClD,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzB,CAAC;SACF,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IACjF,CAAC;IAEO,OAAO,CAAC,CAIf;QACC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QACnF,OAAO,IAAI,UAAU,CAAC,IAAI,EAAE;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,WAAW,EACT,OAAO,CAAC,CAAC,IAAI,EAAE,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;YACtF,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACzD,OAAO,EAAE,CAAC,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CACT,MAAyD,EACzD,SAA6B,EAC7B,IAA0B;QAE1B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACtE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAgC,CAAC;QAC7C,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;YAC1D,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE;gBACvC,WAAW,EAAE,mCAAmC;aACjD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QAChD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACzC,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE;gBACvC,WAAW,EAAE,0BAA0B,CAAC,CAAC,UAAU,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE;gBACvC,WAAW,EAAE,kDAAkD;aAChE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC;YAAE,CAAC,CAAC,UAAU,GAAG,kBAAkB,CAAC;QAC/F,CAAC,CAAC,KAAK,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,kGAAkG;IAClG,OAAO,CACL,KAKmB;QAEnB,OAAO,IAAI,CAAC,KAAK,CACf,KAAK,IAAI,EAAE,CAAC,CAAC;YACX,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;YACjC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,EACF,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,YAAY,EACjC,KAAK,CAAC,IAAI,CACX,CAAC;IACJ,CAAC;IAED,0CAA0C;IAC1C,iBAAiB,CAAC,KAMjB;QACC,OAAO,IAAI,CAAC,KAAK,CACf,KAAK,IAAI,EAAE,CAAC,CAAC;YACX,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,aAAa,EAAE,KAAK,CAAC,YAAY;SAClC,CAAC,EACF,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,CACX,CAAC;IACJ,CAAC;IAED,mCAAmC;IACnC,KAAK,CAAC,mBAAmB,CAAC,KAAa;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,6BAA6B,CAAC;QAC7D,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,UAAU,CAAC,aAAa,EAAE,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC,CAAC;QAC3F,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,CAAC,IAA8C,CAAC;QAC3D,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAC1D,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE;gBACvC,WAAW,EAAE,0CAA0C;aACxD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sFAAsF;IACtF,WAAW,CAAC,KAIX;QACC,OAAO,IAAI,CAAC,KAAK,CACf,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,EAC9E,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,CACX,CAAC;IACJ,CAAC;IAED,yFAAyF;IACzF,QAAQ,CAAC,KAIR;QACC,OAAO,IAAI,CAAC,KAAK,CACf,KAAK,IAAI,EAAE,CAAC,CAAC;YACX,GAAG,KAAK,CAAC,WAAW;YACpB,UAAU,EAAE,sBAAsB;YAClC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,EACF,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,CACX,CAAC;IACJ,CAAC;IAED,+FAA+F;IAC/F,YAAY,CAAC,KAKZ;QACC,OAAO,IAAI,CAAC,KAAK,CACf,KAAK,IAAI,EAAE,CAAC,CAAC;YACX,UAAU,EAAE,sBAAsB;YAClC,UAAU,EAAE,KAAK,CAAC,QAAQ;YAC1B,aAAa,EAAE,KAAK,CAAC,IAAI;SAC1B,CAAC,EACF,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,CACX,CAAC;IACJ,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,IAAI,GAAqC,eAAe;QAClF,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACxE,KAAK;YACL,eAAe,EAAE,IAAI;SACtB,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;CACF"}