@adukilabs/sdk 0.1.1 → 0.1.2

package/dist/api/tenant.js

@@ -0,0 +1,429 @@
+// The workspace (tenant) routes of Aduki Mail an API key may call:
+// `/v1/tenant/*`. Each handler checks a `tenant` scope; a key holds the
+// scopes stored on it while the owner who made it still holds them. Making a
+// key and changing a key's scopes stay with a signed-in owner (`api.keys`).
+// Members, roles, invitations and apps live in Aduki ID, which takes no API
+// key: here a member can be listed and removed from mail, not invited.
+import { ProtocolError } from '../errors.js';
+const seg = (value) => encodeURIComponent(value);
+/** The workspace: profile, members, audits, usage and the mail admin routes. */
+export class Tenant {
+    members;
+    audits;
+    usage;
+    domains;
+    aliases;
+    quotas;
+    rules;
+    webhooks;
+    holidays;
+    schedule;
+    #api;
+    constructor(api) {
+        this.#api = api;
+        this.members = new TenantMembers(api);
+        this.audits = new TenantAudits(api);
+        this.usage = new TenantUsage(api);
+        this.domains = new TenantDomains(api);
+        this.aliases = new TenantAliases(api);
+        this.quotas = new TenantQuotas(api);
+        this.rules = new TenantRules(api);
+        this.webhooks = new TenantWebhooks(api);
+        this.holidays = new TenantHolidays(api);
+        this.schedule = new TenantSchedule(api);
+    }
+    /** `GET /v1/tenant`: the workspace's profile (scope `tenants:read`). */
+    get() {
+        return this.#api.call('GET', 'tenant');
+    }
+    /** `GET /v1/tenant/view/slug/{slug}` (`tenants:read`; another workspace's slug is `403`). */
+    bySlug(slug) {
+        return this.#api.call('GET', `tenant/view/slug/${seg(slug)}`);
+    }
+    /** `GET /v1/tenant/security`: MTA-STS, TLSA, BIMI and the DMARC/TLS reports (`security:read`). */
+    security() {
+        return this.#api.call('GET', 'tenant/security');
+    }
+    /** `GET /v1/tenant/mail/services`: the mail services and whether this workspace may use each (`mailservices:read`). */
+    services() {
+        return this.#api.call('GET', 'tenant/mail/services');
+    }
+}
+/**
+ * The members as Aduki Mail sees them. Listing all needs `tenants:read`, the
+ * filtered lists `members:read`; removing `tenants:write`. Inviting, roles
+ * and closing an account are Aduki ID's and need a signed-in person.
+ */
+export class TenantMembers {
+    #api;
+    constructor(api) {
+        this.#api = api;
+    }
+    /** `GET /v1/tenant/members`, `.../active` or `.../owners`. */
+    list(query = {}) {
+        const { state, ...rest } = query;
+        return this.#api.page(state ? `tenant/members/${state}` : 'tenant/members', rest);
+    }
+    /** `GET /v1/tenant/members/search/{q}`. */
+    search(text, query = {}) {
+        return this.#api.page(`tenant/members/search/${seg(text)}`, query);
+    }
+    /** `DELETE /v1/tenant/members/{user}`: removes the member's mail account from the workspace (`404` for a non-member). */
+    async remove(user) {
+        await this.#api.call('DELETE', `tenant/members/${seg(user)}`);
+    }
+}
+/** The workspace's audit trail (`audits:read`; one record by hex: `tenants:read`). */
+export class TenantAudits {
+    #api;
+    constructor(api) {
+        this.#api = api;
+    }
+    /**
+     * `GET /v1/tenant/audits[/user/{user}][/action/{action} | /failed |
+     * /successful | /ip/{ip}]`: one filter besides `user` at a time (the
+     * server has no route for two).
+     */
+    list(query = {}) {
+        const { user, action, outcome, ip, ...rest } = query;
+        if ([action, outcome, ip].filter((v) => v !== undefined).length > 1) {
+            throw new TypeError('Filter audits by one of action, outcome or ip');
+        }
+        let path = user ? `tenant/audits/user/${seg(user)}` : 'tenant/audits';
+        if (action !== undefined)
+            path += `/action/${seg(action)}`;
+        else if (outcome)
+            path += `/${outcome}`;
+        else if (ip !== undefined)
+            path += `/ip/${seg(ip)}`;
+        return this.#api.page(path, rest);
+    }
+    /** `GET /v1/tenant/view/audit/{hex}`: one record with its `meta` (`tenants:read`). */
+    get(hex) {
+        return this.#api.call('GET', `tenant/view/audit/${seg(hex)}`);
+    }
+}
+/** Metered usage (`usage:read`). */
+export class TenantUsage {
+    #api;
+    constructor(api) {
+        this.#api = api;
+    }
+    /** `GET /v1/tenant/usage`. */
+    list(query = {}) {
+        return this.#api.page('tenant/usage', query);
+    }
+    /** `GET /v1/tenant/usage/summary`: one row per metric, no paging. */
+    summary() {
+        return this.#api.call('GET', 'tenant/usage/summary');
+    }
+    /** `GET /v1/tenant/usage/metric/{metric}`. */
+    metric(metric, query = {}) {
+        return this.#api.page(`tenant/usage/metric/${seg(metric)}`, query);
+    }
+}
+/**
+ * Mail domains: `domains:read`, `domains:write` to change. The DNS records
+ * to publish are on the domain (`dkim`, and `pending` of a DKIM rotation).
+ */
+export class TenantDomains {
+    dkim;
+    #api;
+    constructor(api) {
+        this.#api = api;
+        this.dkim = new TenantDkim(api);
+    }
+    /** `POST /v1/tenant/domains`: registers a domain (status `pending`); returns its hex. */
+    async add(input) {
+        const data = await this.#api.call('POST', 'tenant/domains', { body: input });
+        if (typeof data?.hex !== 'string')
+            throw new ProtocolError('Domain answer has no hex');
+        return data.hex;
+    }
+    /** `GET /v1/tenant/domains`, `.../active` or `.../pending`. */
+    list(query = {}) {
+        const { state, ...rest } = query;
+        return this.#api.page(state ? `tenant/domains/${state}` : 'tenant/domains', rest);
+    }
+    /** `GET /v1/tenant/domains/{hex}`: the full record with its DNS snapshots. */
+    get(hex) {
+        return this.#api.call('GET', `tenant/domains/${seg(hex)}`);
+    }
+    /** `GET /v1/tenant/domains/lookup/name?name=`: a domain by name (`404` when none). */
+    byName(name) {
+        return this.#api.call('GET', 'tenant/domains/lookup/name', { query: { name } });
+    }
+    /** `PATCH /v1/tenant/domains/{hex}/name`. */
+    async rename(hex, name) {
+        await this.#api.call('PATCH', `tenant/domains/${seg(hex)}/name`, { body: { name } });
+    }
+    /** `PATCH /v1/tenant/domains/{hex}/kind`: `primary`, `sending`, `receiving` or `alias`. */
+    async kind(hex, kind) {
+        await this.#api.call('PATCH', `tenant/domains/${seg(hex)}/kind`, { body: { kind } });
+    }
+    /** `PATCH /v1/tenant/domains/{hex}/selector`: the DKIM selector, before the domain has a key (`409` after). */
+    async selector(hex, selector) {
+        await this.#api.call('PATCH', `tenant/domains/${seg(hex)}/selector`, { body: { selector } });
+    }
+    /** `PATCH /v1/tenant/domains/{hex}/auth`: the SPF, DMARC, MTA-STS and BIMI settings, all four. */
+    async auth(hex, input) {
+        await this.#api.call('PATCH', `tenant/domains/${seg(hex)}/auth`, { body: input });
+    }
+    /** `PATCH /v1/tenant/domains/{hex}/meta`. */
+    async meta(hex, meta) {
+        await this.#api.call('PATCH', `tenant/domains/${seg(hex)}/meta`, { body: { meta } });
+    }
+    /** `DELETE /v1/tenant/domains/{hex}`. */
+    async delete(hex) {
+        await this.#api.call('DELETE', `tenant/domains/${seg(hex)}`);
+    }
+}
+/**
+ * DKIM key rotation without a gap: stage a key the server makes, publish its
+ * TXT record, check, confirm. No private key is sent or returned.
+ */
+export class TenantDkim {
+    #api;
+    constructor(api) {
+        this.#api = api;
+    }
+    /** `GET /v1/tenant/domains/{hex}/dkim/rotation`: the active, staged and retired records (`domains:read`). */
+    state(hex) {
+        return this.#api.call('GET', `tenant/domains/${seg(hex)}/dkim/rotation`);
+    }
+    /** `POST .../dkim/rotation`: stages the next key (a retry returns the same one); publish `pending.value` at `pending.name`. */
+    stage(hex, input = {}) {
+        return this.#api.call('POST', `tenant/domains/${seg(hex)}/dkim/rotation`, { body: input });
+    }
+    /** `POST .../dkim/rotation/check`: whether DNS carries the staged record; changes nothing (`domains:read`). */
+    check(hex) {
+        return this.#api.call('POST', `tenant/domains/${seg(hex)}/dkim/rotation/check`);
+    }
+    /** `POST .../dkim/rotation/confirm`: switches signing to the staged key (`409` while DNS does not carry it). */
+    confirm(hex) {
+        return this.#api.call('POST', `tenant/domains/${seg(hex)}/dkim/rotation/confirm`);
+    }
+    /** `DELETE .../dkim/rotation`: drops the staged key (`404` when none). */
+    async cancel(hex) {
+        await this.#api.call('DELETE', `tenant/domains/${seg(hex)}/dkim/rotation`);
+    }
+}
+/** Members' extra addresses on the workspace's verified domains: `aliases:read`, `aliases:write`. */
+export class TenantAliases {
+    #api;
+    constructor(api) {
+        this.#api = api;
+    }
+    /** `POST /v1/tenant/aliases`: `created` is false when the member already had it. */
+    add(user, address) {
+        return this.#api.call('POST', 'tenant/aliases', { body: { user, address } });
+    }
+    /** `GET /v1/tenant/aliases[?user=]`: at most 1000, by address. */
+    list(query = {}) {
+        return this.#api.call('GET', 'tenant/aliases', { query: { user: query.user } });
+    }
+    /** `DELETE /v1/tenant/aliases/{address}`. */
+    async remove(address) {
+        await this.#api.call('DELETE', `tenant/aliases/${seg(address)}`);
+    }
+}
+/** The workspace's own usage ceilings per metric: `quotas:read`, `quotas:write`. */
+export class TenantQuotas {
+    #api;
+    constructor(api) {
+        this.#api = api;
+    }
+    /** `POST /v1/tenant/quotas`. */
+    add(input) {
+        return this.#api.call('POST', 'tenant/quotas', { body: input });
+    }
+    /** `GET /v1/tenant/quotas`. */
+    list(query = {}) {
+        return this.#api.page('tenant/quotas', query);
+    }
+    /** `GET /v1/tenant/quotas/{metric}`. */
+    get(metric) {
+        return this.#api.call('GET', `tenant/quotas/${seg(metric)}`);
+    }
+    /** `PATCH /v1/tenant/quotas/{metric}/ceiling`, `/expires`, `/reason`: the fields given, one call each. */
+    async edit(metric, change) {
+        for (const field of ['ceiling', 'expires', 'reason']) {
+            if (change[field] !== undefined) {
+                await this.#api.call('PATCH', `tenant/quotas/${seg(metric)}/${field}`, { body: { [field]: change[field] } });
+            }
+        }
+    }
+    /** `DELETE /v1/tenant/quotas/{metric}`. */
+    async delete(metric) {
+        await this.#api.call('DELETE', `tenant/quotas/${seg(metric)}`);
+    }
+}
+/** Spam rules of the workspace: `rules:read`, `rules:write`. */
+export class TenantRules {
+    #api;
+    constructor(api) {
+        this.#api = api;
+    }
+    /** `POST /v1/tenant/rules`. */
+    add(input) {
+        return this.#api.call('POST', 'tenant/rules', { body: input });
+    }
+    /** `GET /v1/tenant/rules`, `.../active`, or `.../target/{target}`. */
+    list(query = {}) {
+        const { active, target, ...rest } = query;
+        if (active && target !== undefined)
+            throw new TypeError('Filter rules by active or by target');
+        const path = active ? 'tenant/rules/active' : target !== undefined ? `tenant/rules/target/${seg(target)}` : 'tenant/rules';
+        return this.#api.page(path, rest);
+    }
+    /** `GET /v1/tenant/rules/{hex}/detail`: the rule with its `meta`. */
+    get(hex) {
+        return this.#api.call('GET', `tenant/rules/${seg(hex)}/detail`);
+    }
+    /** `GET /v1/tenant/rules/name/{name}`. */
+    byName(name) {
+        return this.#api.call('GET', `tenant/rules/name/${seg(name)}`);
+    }
+    /**
+     * `PATCH /v1/tenant/rules/{hex}/{field}` for each field given (`regex` is
+     * sent after `pattern`, so a new pattern and `regex: true` go together).
+     */
+    async edit(hex, change) {
+        for (const field of ['name', 'target', 'pattern', 'regex', 'score', 'active']) {
+            if (change[field] !== undefined) {
+                await this.#api.call('PATCH', `tenant/rules/${seg(hex)}/${field}`, { body: { [field]: change[field] } });
+            }
+        }
+    }
+    /** `DELETE /v1/tenant/rules/{hex}`. */
+    async delete(hex) {
+        await this.#api.call('DELETE', `tenant/rules/${seg(hex)}`);
+    }
+}
+/** Delivery-event webhooks: `webhooks:read`, `webhooks:write`. */
+export class TenantWebhooks {
+    #api;
+    constructor(api) {
+        this.#api = api;
+    }
+    /** `POST /v1/tenant/webhooks`: returns the hex and the signing secret, shown this once. */
+    add(input) {
+        return this.#api.call('POST', 'tenant/webhooks', { body: input });
+    }
+    /** `GET /v1/tenant/webhooks`, `.../active`, or `.../subscribers/{event}`. */
+    list(query = {}) {
+        const { active, event, ...rest } = query;
+        if (active && event !== undefined)
+            throw new TypeError('Filter webhooks by active or by event');
+        const path = active ? 'tenant/webhooks/active' : event !== undefined ? `tenant/webhooks/subscribers/${seg(event)}` : 'tenant/webhooks';
+        return this.#api.page(path, rest);
+    }
+    /** `GET /v1/tenant/webhooks/{hex}`: the record, never the secret. */
+    get(hex) {
+        return this.#api.call('GET', `tenant/webhooks/${seg(hex)}`);
+    }
+    /** `PATCH /v1/tenant/webhooks/{hex}/{field}` for each field given (`url` is checked again: `https`, a public host). */
+    async edit(hex, change) {
+        for (const field of ['url', 'events', 'domains', 'secret', 'active']) {
+            if (change[field] !== undefined) {
+                await this.#api.call('PATCH', `tenant/webhooks/${seg(hex)}/${field}`, { body: { [field]: change[field] } });
+            }
+        }
+    }
+    /** `POST /v1/tenant/webhooks/{hex}/secret/rotate`: a new secret made by the server, returned once. */
+    async rotate(hex) {
+        const data = await this.#api.call('POST', `tenant/webhooks/${seg(hex)}/secret/rotate`);
+        if (typeof data?.secret !== 'string')
+            throw new ProtocolError('Rotate answer has no secret');
+        return data.secret;
+    }
+    /** `DELETE /v1/tenant/webhooks/{hex}`. */
+    async delete(hex) {
+        await this.#api.call('DELETE', `tenant/webhooks/${seg(hex)}`);
+    }
+}
+/** The workspace's holidays and closures: reading `tenant:read`, writing `tenants:write`. */
+export class TenantHolidays {
+    #api;
+    constructor(api) {
+        this.#api = api;
+    }
+    /** `GET /v1/tenant/holidays?region&year`: the effective days (`region` defaults to the workspace's). */
+    list(query = {}) {
+        return this.#api.call('GET', 'tenant/holidays', { query: { region: query.region, year: query.year } });
+    }
+    /**
+     * `POST /v1/tenant/holidays`: a day or range of the workspace's own
+     * (`kind` `closure` by default, or `observance`), or `{exclude: true,
+     * region, date}` to drop the platform's day on that date.
+     */
+    add(input) {
+        return this.#api.call('POST', 'tenant/holidays', { body: input });
+    }
+    /** `DELETE /v1/tenant/holidays/{hex}`: one of the workspace's own rows. */
+    async remove(hex) {
+        await this.#api.call('DELETE', `tenant/holidays/${seg(hex)}`);
+    }
+    /** `GET /v1/tenant/holidays/region`: the default region, or null. */
+    region() {
+        return this.#api.call('GET', 'tenant/holidays/region');
+    }
+    /** `PUT /v1/tenant/holidays/region` (`422` for a region with no data); `null` clears it (`DELETE`). */
+    async setRegion(region) {
+        if (region === null)
+            await this.#api.call('DELETE', 'tenant/holidays/region');
+        else
+            await this.#api.call('PUT', 'tenant/holidays/region', { body: region });
+    }
+}
+/** Scheduling templates and resources: reading `tenant:read`, writing `tenants:write`. */
+export class TenantSchedule {
+    #api;
+    constructor(api) {
+        this.#api = api;
+    }
+    /** `GET /v1/tenant/schedule/templates`. */
+    templates() {
+        return this.#api.call('GET', 'tenant/schedule/templates');
+    }
+    /** `GET /v1/tenant/schedule/templates/{hex}`. */
+    template(hex) {
+        return this.#api.call('GET', `tenant/schedule/templates/${seg(hex)}`);
+    }
+    /** `POST /v1/tenant/schedule/templates` (rules default to weekdays 09:00-17:00, zone to UTC). */
+    addTemplate(input) {
+        return this.#api.call('POST', 'tenant/schedule/templates', { body: input });
+    }
+    /** `PATCH /v1/tenant/schedule/templates/{hex}`: name and zone. */
+    editTemplate(hex, change) {
+        return this.#api.call('PATCH', `tenant/schedule/templates/${seg(hex)}`, { body: change });
+    }
+    /** `PUT /v1/tenant/schedule/templates/{hex}/rules`: replaces the weekly rules. */
+    setRules(hex, rules) {
+        return this.#api.call('PUT', `tenant/schedule/templates/${seg(hex)}/rules`, { body: rules });
+    }
+    /** `DELETE /v1/tenant/schedule/templates/{hex}` (`409` while followed or used). */
+    async deleteTemplate(hex) {
+        await this.#api.call('DELETE', `tenant/schedule/templates/${seg(hex)}`);
+    }
+    /** `GET /v1/tenant/schedule/resources`: rooms and equipment, live ones first. */
+    resources() {
+        return this.#api.call('GET', 'tenant/schedule/resources');
+    }
+    /** `GET /v1/tenant/schedule/resources/{hex}`. */
+    resource(hex) {
+        return this.#api.call('GET', `tenant/schedule/resources/${seg(hex)}`);
+    }
+    /** `POST /v1/tenant/schedule/resources` (`409` for a name in use). */
+    addResource(input) {
+        return this.#api.call('POST', 'tenant/schedule/resources', { body: input });
+    }
+    /** `PATCH /v1/tenant/schedule/resources/{hex}`: `null` clears `capacity` and `schedule`; `retired` stops offering it. */
+    editResource(hex, change) {
+        return this.#api.call('PATCH', `tenant/schedule/resources/${seg(hex)}`, { body: change });
+    }
+    /** `DELETE /v1/tenant/schedule/resources/{hex}` (`409` once booked: retire it instead). */
+    async deleteResource(hex) {
+        await this.#api.call('DELETE', `tenant/schedule/resources/${seg(hex)}`);
+    }
+}

package/dist/base64.d.ts

@@ -0,0 +1,11 @@
+/** JWT claims as decoded from JSON; the SDK never trusts their shape. */
+export type Claims = Record<string, any>;
+export declare function encode(bytes: ArrayBuffer | Uint8Array): string;
+/** @param text base64url (padding and the standard alphabet are tolerated) */
+export declare function decode(text: string): Uint8Array<ArrayBuffer>;
+/** base64url of the UTF-8 bytes */
+export declare function encodeText(text: string): string;
+/** @param text base64url @returns the UTF-8 string */
+export declare function decodeText(text: string): string;
+/** The payload claims of a JWT, unverified. */
+export declare function claims(jwt: string): Claims;

package/dist/base64.js

@@ -0,0 +1,40 @@
+// base64url without padding (RFC 4648 section 5), on bytes.
+export function encode(bytes) {
+    const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+    let text = '';
+    for (let i = 0; i < view.length; i += 0x8000) {
+        text += String.fromCharCode(...view.subarray(i, i + 0x8000));
+    }
+    return btoa(text).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
+}
+/** @param text base64url (padding and the standard alphabet are tolerated) */
+export function decode(text) {
+    const plain = text.replaceAll('-', '+').replaceAll('_', '/');
+    const padded = plain + '='.repeat((4 - (plain.length % 4)) % 4);
+    const raw = atob(padded);
+    const out = new Uint8Array(raw.length);
+    for (let i = 0; i < raw.length; i++)
+        out[i] = raw.charCodeAt(i);
+    return out;
+}
+/** base64url of the UTF-8 bytes */
+export function encodeText(text) {
+    return encode(new TextEncoder().encode(text));
+}
+/** @param text base64url @returns the UTF-8 string */
+export function decodeText(text) {
+    return new TextDecoder().decode(decode(text));
+}
+/** The payload claims of a JWT, unverified. */
+export function claims(jwt) {
+    const part = String(jwt).split('.')[1];
+    if (!part)
+        return {};
+    try {
+        const value = JSON.parse(decodeText(part));
+        return value && typeof value === 'object' ? value : {};
+    }
+    catch {
+        return {};
+    }
+}

package/dist/client.d.ts

@@ -0,0 +1,29 @@
+import type { Dpop } from './dpop.js';
+/** Where the client gets its access tokens: `Tokens` (id/tokens.ts) or `Session.tokens`. */
+export interface TokenSource {
+    /** a valid access token for the audience */
+    token(audience: string): Promise<string>;
+    /** renews the audience token unless another caller already replaced `stale` */
+    rotate(audience: string, stale: string | null): Promise<{
+        token: string;
+    }>;
+}
+export interface ClientOptions {
+    tokens: TokenSource;
+    /** the transport (default global fetch) */
+    fetch?: typeof fetch | undefined;
+    /** when given, bound tokens are sent with the DPoP scheme */
+    dpop?: Dpop | undefined;
+}
+export interface Client {
+    /**
+     * Sends the request with the audience's token. On a 401 (`auth.stale`
+     * included) the token is renewed once, unless another caller already did,
+     * and the request is sent once more; a second 401 is returned as is. The body
+     * must be re-sendable (a string, bytes or form data, not a stream).
+     */
+    fetch: (audience: string, input: Request | string | URL, init?: RequestInit) => Promise<Response>;
+    /** A fetch-shaped function for one audience (used for the rights stream). */
+    bind: (audience: string) => typeof fetch;
+}
+export declare function createClient({ tokens, fetch: transport, dpop }: ClientOptions): Client;

package/dist/client.js

@@ -0,0 +1,22 @@
+export function createClient({ tokens, fetch: transport, dpop }) {
+    const inner = transport ?? ((...args) => globalThis.fetch(...args));
+    const out = dpop ? dpop.wrap(inner) : inner;
+    const call = async (audience, input, init) => {
+        const proto = new Request(input, init);
+        const token = await tokens.token(audience);
+        const first = await out(withBearer(proto.clone(), token));
+        if (first.status !== 401)
+            return first;
+        await first.arrayBuffer().catch(() => { });
+        const fresh = (await tokens.rotate(audience, token)).token;
+        return out(withBearer(proto.clone(), fresh));
+    };
+    return {
+        fetch: call,
+        bind: (audience) => (input, init) => call(audience, input, init),
+    };
+}
+function withBearer(request, token) {
+    request.headers.set('Authorization', `Bearer ${token}`);
+    return request;
+}

package/dist/dpop.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Where `Dpop.load` keeps its key: any async key/value store that holds a
+ * CryptoKeyPair as is (the core `Storage`, IndexedDB, an in-process map).
+ * Declared here so the DPoP code does not depend on the browser storage
+ * module.
+ */
+export interface KeyStore {
+    get: (key: string) => Promise<any>;
+    set: (key: string, value: any) => Promise<void>;
+}
+/** A public key as RFC 7638 hashes it. */
+export interface PublicJwk {
+    kty: string;
+    crv?: string | undefined;
+    x?: string | undefined;
+    y?: string | undefined;
+}
+/** The part of a Web Lock manager (`navigator.locks`) that `Dpop.load` uses. */
+export interface Locks {
+    request<T>(name: string, run: () => Promise<T>): Promise<T>;
+}
+export declare class Dpop {
+    #private;
+    /** Use `Dpop.load` or `Dpop.generate`. */
+    constructor(pair: CryptoKeyPair, jwk: PublicJwk, thumbprint: string, clock?: () => number);
+    /** Generates a new non-extractable key. */
+    static generate(options?: {
+        clock?: () => number;
+    }): Promise<Dpop>;
+    /** Wraps an existing key pair (its private key must be a P-256 ECDSA signing key). */
+    static from(pair: CryptoKeyPair, options?: {
+        clock?: () => number;
+    }): Promise<Dpop>;
+    /**
+     * Loads the key from `storage` (key `dpop.key`), or generates and saves one.
+     * Two tabs loading at the same time must end with the same key, so the
+     * read-or-create runs under a Web Lock when the browser has one (a key made by
+     * a tab that lost the race would otherwise be overwritten and its tokens
+     * bound to a key nobody holds any more).
+     */
+    static load(storage: KeyStore, options?: {
+        clock?: () => number;
+        locks?: Locks | null;
+    }): Promise<Dpop>;
+    /** The key's thumbprint (RFC 7638), as stored by Aduki ID in `cnf.jkt`. */
+    get thumbprint(): string;
+    /** The public JWK (kty, crv, x, y). */
+    get jwk(): PublicJwk;
+    /**
+     * One proof for `method` on `url` (query and fragment are not signed). Pass
+     * `access` to bind the proof to a token with `ath`, and `nonce` when the
+     * server asked for one.
+     */
+    proof({ method, url, access, nonce }: {
+        method: string;
+        url: string | URL;
+        access?: string | null;
+        nonce?: string | null;
+    }): Promise<string>;
+    /**
+     * One proof with `htm` and `htu` exactly as given (no upper-casing, no URL
+     * trimming), for proofs outside HTTP: the Chats handshake signs
+     * `htm = "ae09"`, `htu = "identity.response"` with the challenge as `nonce`.
+     */
+    sign({ htm, htu, access, nonce }: {
+        htm: string;
+        htu: string;
+        access?: string | null;
+        nonce?: string | null;
+    }): Promise<string>;
+    /**
+     * Returns `request` with its DPoP header and scheme applied by the rules above.
+     * @param nonce defaults to the one remembered for the origin
+     */
+    apply(request: Request, nonce?: string | null): Promise<Request>;
+    /** True when the access token (a JWT) is bound to this key. */
+    bound(token: string): boolean;
+    /** A fetch that applies DPoP and retries once on a fresh `DPoP-Nonce`. */
+    wrap(inner?: typeof fetch): typeof fetch;
+}
+/** The RFC 7638 JWK thumbprint of an EC or OKP public key. */
+export declare function thumbprint(jwk: PublicJwk): Promise<string>;