@awiki/dsh-pap 0.0.0-stage → 0.1.0

package/lib/types.d.ts

@@ -0,0 +1,202 @@
+export type JsonObject = Record<string, unknown>;
+export interface IdentityRef {
+    readonly storeId: string;
+    readonly identityId: string;
+    readonly did: string;
+}
+export interface Binding {
+    readonly identityRef: IdentityRef;
+    readonly ownerRef: string;
+    readonly clientId: string;
+}
+export interface PublicJwk {
+    kty: 'EC';
+    crv: 'P-256';
+    x: string;
+    y: string;
+}
+export interface KeyScope {
+    owner: string;
+    company_id: string;
+    user_id: string;
+    account_slot?: string;
+}
+export interface KeyRef {
+    handle: string;
+    purpose: 'pap_session' | 'pap_dpop';
+    generation: number;
+    public_jwk: PublicJwk;
+    thumbprint: string;
+}
+export interface Route {
+    method: string;
+    template: string;
+    resource: string;
+    channel?: 'openapi' | 'mcp' | 'poppy';
+    parameters?: {
+        name: string;
+        in: 'path' | 'query';
+        required: boolean;
+    }[];
+}
+export interface ProductOperationApproval {
+    companyRef: string;
+    method: string;
+    template: string;
+    resource: string;
+    sessionRef: string;
+    scopes: string[];
+    generation: number;
+}
+export interface AsMetadata {
+    issuer: string;
+    authorization_endpoint?: string;
+    token_endpoint: string;
+    revocation_endpoint?: string;
+    grant_types_supported: string[];
+    token_endpoint_auth_methods_supported?: string[];
+    dpop_signing_alg_values_supported?: string[];
+    protected_resources: string[];
+    code_challenge_methods_supported?: string[];
+}
+export interface Company {
+    ref: string;
+    domain: string;
+    name: string;
+    companyId: string;
+    issuer?: string;
+    authDisabled: boolean;
+    authMode: 'no_as' | 'account' | 'disabled';
+    metadata?: AsMetadata;
+    routes: Route[];
+    scopes: string[];
+    metadataDigest: string;
+    expiresAt: number;
+    generation: number;
+    sources: {
+        url: string;
+        digest: string;
+    }[];
+}
+export interface Subject {
+    ref: string;
+    companyRef: string;
+    companyId: string;
+    binding: Binding;
+    mode: 'regular' | 'anonymous';
+    userId: string;
+    agentId?: string;
+}
+export interface Session {
+    ref: string;
+    subjectRef: string;
+    sid: string;
+    accountSlot?: string;
+    generation: number;
+    connected: boolean;
+}
+export interface Delegation {
+    subjectRef: string;
+    key: KeyRef;
+    compact: string;
+    expiresAt: number;
+    generation: number;
+}
+export interface Grant {
+    ref: string;
+    subjectRef: string;
+    accountSlot: string;
+    issuer: string;
+    clientId: string;
+    resource: string;
+    scope: string[];
+    accessToken: string;
+    refreshToken?: string;
+    tokenType: 'Bearer' | 'DPoP';
+    dpopKey?: KeyRef;
+    expiresAt?: number;
+    usableUntil: number;
+    generation: number;
+    accountEpoch: number;
+    status: 'active' | 'refreshing' | 'uncertain' | 'reauthorization_required' | 'revocation_pending' | 'signed_out';
+}
+export interface AuthTransaction {
+    ref: string;
+    subjectRef: string;
+    accountSlot: string;
+    issuer: string;
+    clientId: string;
+    redirectUri: string;
+    state: string;
+    verifier: string;
+    resource: string;
+    scope: string[];
+    expiresAt: number;
+    accountEpoch: number;
+    exchangeInFlight?: boolean;
+    status: 'pending' | 'exchanging' | 'consumed' | 'failed' | 'cancelled';
+    dpopKey?: KeyRef;
+    callbackRef?: string;
+}
+export interface PapState {
+    schemaVersion: 1;
+    generation: number;
+    companies: Record<string, Company>;
+    subjects: Record<string, Subject>;
+    sessions: Record<string, Session>;
+    delegations: Record<string, Delegation>;
+    grants: Record<string, Grant>;
+    transactions: Record<string, AuthTransaction>;
+    nonces: Record<string, string>;
+    cooldowns: Record<string, {
+        notBeforeMs: string;
+        generation: number;
+    }>;
+    accountSlots: Record<string, {
+        subjectRef: string;
+        epoch: number;
+        signedOut: boolean;
+    }>;
+    delegationAttempts: Record<string, {
+        sequence: number;
+        status: 'reserved' | 'issued' | 'failed';
+    }>;
+    retirements: Record<string, {
+        subjectRef: string;
+        key: KeyRef;
+    }>;
+    /** User-managed operation permissions; protected by the same encrypted store and lock. */
+    product?: {
+        operations: Record<string, ProductOperationApproval>;
+    };
+    /** Private response-redaction tombstones, stored only inside the AES-GCM state. Never a grant. */
+    credentialVault?: {
+        version: 1;
+        completeness: 'complete' | 'legacy_incomplete';
+        entries: Record<string, string>;
+        blocked: boolean;
+    };
+}
+export interface Operation {
+    url: string;
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+    resource?: string;
+    scopes?: string[];
+    idempotencyKey?: string;
+}
+export interface HttpResponse {
+    status: number;
+    headers: Record<string, string>;
+    body: Uint8Array;
+    url: string;
+}
+export interface HttpTransport {
+    request(url: string, options?: {
+        method?: string;
+        headers?: Record<string, string>;
+        body?: string;
+        signal?: AbortSignal;
+    }): Promise<HttpResponse>;
+}

package/lib/types.js

@@ -0,0 +1 @@
+export {};

package/lib/util.d.ts

@@ -0,0 +1,17 @@
+import type { HttpResponse, JsonObject, KeyScope, Subject } from './types.js';
+export declare const id: (prefix: string) => string;
+export declare const sha256: (value: string | Uint8Array) => string;
+export declare const sha256Hex: (value: string | Uint8Array) => string;
+export declare const scopeFor: (subject: Subject, accountSlot?: string) => KeyScope;
+export declare function object(value: unknown): JsonObject;
+export declare function strings(value: unknown): string[];
+export declare function httpsUrl(value: unknown): URL;
+export declare function htu(value: string): string;
+export declare function parseJson(response: HttpResponse): JsonObject;
+export declare function jwtParts(compact: string): {
+    header: JsonObject;
+    payload: JsonObject;
+};
+export declare function matchedRoute(template: string, actual: string): boolean;
+/** Explicit PAP account callback lane; this exception never applies to public or resource URLs. */
+export declare function isPapLoopbackRedirect(value: string): boolean;

package/lib/util.js

@@ -0,0 +1,66 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { strictJson } from './strict-json.js';
+import { PapError, requirePap } from './errors.js';
+export const id = (prefix) => `${prefix}_${randomBytes(24).toString('base64url')}`;
+export const sha256 = (value) => createHash('sha256').update(value).digest('base64url');
+export const sha256Hex = (value) => createHash('sha256').update(value).digest('hex');
+export const scopeFor = (subject, accountSlot) => ({ owner: subject.binding.ownerRef, company_id: subject.companyId, user_id: subject.userId, ...(accountSlot ? { account_slot: accountSlot } : {}) });
+export function object(value) {
+    requirePap(value && typeof value === 'object' && !Array.isArray(value), 'discovery_failed');
+    return value;
+}
+export function strings(value) {
+    requirePap(Array.isArray(value) && value.every(x => typeof x === 'string'), 'discovery_failed');
+    return value;
+}
+export function httpsUrl(value) {
+    requirePap(typeof value === 'string', 'unsafe_destination');
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new PapError('unsafe_destination');
+    }
+    requirePap(url.protocol === 'https:' && !url.username && !url.password && !url.hash, 'unsafe_destination');
+    return url;
+}
+export function htu(value) { const url = httpsUrl(value); url.search = ''; return url.href; }
+export function parseJson(response) {
+    try {
+        const mediaType = response.headers['content-type']?.split(';')[0]?.trim().toLowerCase();
+        requirePap(mediaType && ['application/json', 'application/problem+json', 'application/vnd.oai.openapi+json', 'application/openapi+json'].includes(mediaType), 'discovery_failed');
+        return object(strictJson(response.body));
+    }
+    catch {
+        throw new PapError('discovery_failed');
+    }
+}
+export function jwtParts(compact) {
+    try {
+        const parts = compact.split('.');
+        requirePap(compact.length <= 131072 && parts.length === 3 && parts.every(part => /^[A-Za-z0-9_-]+$/.test(part) && Buffer.from(part, 'base64url').toString('base64url') === part), 'delegation_blocked');
+        return { header: object(strictJson(Buffer.from(parts[0], 'base64url'), 32768)), payload: object(strictJson(Buffer.from(parts[1], 'base64url'), 16384)) };
+    }
+    catch {
+        throw new PapError('delegation_blocked');
+    }
+}
+export function matchedRoute(template, actual) {
+    const expected = httpsUrl(template.replace(/\{[^{}]+\}/g, '__pap_parameter__'));
+    const url = httpsUrl(actual);
+    if (url.origin !== expected.origin || /%2f|%5c|\\/i.test(url.pathname))
+        return false;
+    const parts = expected.pathname.split('/');
+    const got = url.pathname.split('/');
+    return got.length === parts.length && parts.every((part, index) => part === '__pap_parameter__' ? Boolean(got[index]) && !['.', '..'].includes(got[index]) : part === got[index]);
+}
+/** Explicit PAP account callback lane; this exception never applies to public or resource URLs. */
+export function isPapLoopbackRedirect(value) {
+    if (typeof value !== 'string' || value.length > 2048 || /[^\x21-\x7e]|\\/.test(value) || /%(?![0-9a-fA-F]{2})/.test(value))
+        return false;
+    const match = value.match(/^http:\/\/(?:127\.0\.0\.1|\[::1\]):([1-9][0-9]{0,4})(\/[^?#]*)$/);
+    if (!match || Number(match[1]) > 65535)
+        return false;
+    return match[2].split('/').every(segment => !['.', '..'].includes(segment.replace(/%2e/gi, '.')));
+}

package/package.json

@@ -1,6 +1,157 @@
 {
   "name": "@awiki/dsh-pap",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Local-custody PAP 0.3 client for DeepSeek Harness",
+  "type": "module",
+  "license": "Apache-2.0",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": "./lib/index.js",
+    "./host": "./lib/host.js",
+    "./plugin": "./lib/plugin.js",
+    "./host-secrets": "./lib/host-secrets.js",
+    "./file-secrets": "./lib/file-secrets.js",
+    "./management-remote": "./lib/management-remote.js",
+    "./remote": "./lib/remote.js",
+    "./tools": "./lib/tools.js",
+    "./product-api": "./lib/product-api.js",
+    "./client": {
+      "types": "./lib/client/index.d.ts",
+      "default": "./lib/browser-client.js"
+    },
+    "./package.json": "./package.json",
+    "./cordis.patch.yml": "./cordis.patch.yml"
+  },
+  "files": [
+    "lib",
+    "README.md",
+    "cordis.patch.yml",
+    "docs"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json && node scripts/build-client.mjs",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json --noEmit",
+    "test": "npm run build && tsx --test tests/*.test.ts",
+    "test:native-component": "tsx scripts/native-component.ts",
+    "test:frontvia-component": "tsx scripts/frontvia-component.ts",
+    "test:callback-component": "tsx scripts/callback-component.ts",
+    "test:native-account-component": "tsx scripts/native-frontvia-component.ts",
+    "test:keyring-container": "node scripts/keyring-container/run.mjs",
+    "test:p22": "npm run typecheck && tsx --test tests/cooldown-challenge.test.ts tests/client.test.ts tests/network-store.test.ts",
+    "test:relay-native-account-component": "tsx scripts/relay-native-frontvia-component.ts",
+    "test:product": "tsx --test tests/product.test.ts",
+    "test:client": "npm run build && tsx --test tests/client-ui.test.ts",
+    "test:product-native-component": "tsx scripts/product-native-component.ts",
+    "test:sidecar": "npm run build && tsx scripts/secret-service-sidecar-component.ts",
+    "test:product-account-component": "tsx scripts/product-account-component.ts",
+    "prepack": "npm run build"
+  },
+  "dependencies": {
+    "proper-lockfile": "4.1.2",
+    "zod": "4.6.2"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "4.1.0",
+    "@deepseek-ai/dsh-tools": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-typert-registry": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-api-remotes": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-client-connection": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-layout": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.2-rc.1",
+    "react": "18.3.1"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "4.1.0",
+    "@deepseek-ai/cordis-plugin-loader": "1.1.0",
+    "@deepseek-ai/dsh-api-remotes": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-client-connection": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-client-store": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-layout": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-typert-registry": "0.2.2-rc.1",
+    "@testing-library/dom": "10.4.1",
+    "@testing-library/react": "16.3.1",
+    "@types/jsdom": "21.1.7",
+    "@types/node": "24.3.0",
+    "@types/proper-lockfile": "4.1.4",
+    "@types/react": "18.3.31",
+    "@types/react-dom": "18.3.7",
+    "esbuild": "0.25.12",
+    "jsdom": "26.1.0",
+    "react": "18.3.1",
+    "react-dom": "18.3.1",
+    "tsx": "4.20.6",
+    "typescript": "6.0.3",
+    "zod": "4.6.2"
+  },
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-renderer",
+        "@deepseek-ai/dsh-api-remotes",
+        "@deepseek-ai/dsh-client-connection",
+        "@deepseek-ai/dsh-client-ui-layout",
+        "@deepseek-ai/dsh-client-ui-settings"
+      ]
+    }
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/dsh-typert-protocol": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-typert-registry": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-tools": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-api-remotes": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-connection": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-renderer": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-layout": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-settings": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-slots": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    }
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/AgentConnect/dsh-pap.git"
+  },
+  "keywords": [
+    "pap",
+    "deepseek-harness",
+    "dsh-plugin"
+  ]
+}