@awiki/dsh-pap 0.0.0-stage → 0.1.0

package/lib/client.js

@@ -0,0 +1,833 @@
+import { setTimeout as delay } from 'node:timers/promises';
+import { asCooldownKey, assertCooldownElapsed, cooldownError, recordCooldown, remainingCooldownMs, resourceCooldownKey, responseHeader } from './cooldown.js';
+import { protocolFailure } from './auth-challenge.js';
+import { archiveCredentials } from './credential-history.js';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { PapDiscovery } from './discovery.js';
+import { PapError, requirePap } from './errors.js';
+import { PapStore } from './store.js';
+import { DelegationAttemptFailure, newDelegation, thumbprint, verifyCompact } from './delegation.js';
+import { httpsUrl, htu, id, isPapLoopbackRedirect, jwtParts, matchedRoute, parseJson, scopeFor, sha256 } from './util.js';
+function secureEqual(a, b) {
+    return typeof a === 'string' && Buffer.byteLength(a) === Buffer.byteLength(b) && timingSafeEqual(Buffer.from(a), Buffer.from(b));
+}
+const protectedHeaders = new Set(['authorization', 'dpop', 'poppy-session', 'host', 'cookie', 'proxy-authorization', 'content-length', 'connection', 'transfer-encoding']);
+function authenticationError(code, hint) {
+    if (code === 'insufficient_scope' || code === 'invalid_scope' || code === 'invalid_target' || code === 'invalid_client' || code === 'invalid_token' || code === 'invalid_dpop_proof' || code === 'unauthorized_client')
+        return new PapError(code, undefined, hint);
+    if (code === 'invalid_grant')
+        return new PapError('reauthorization_required', undefined, hint);
+    if (code === 'access_denied')
+        return new PapError('permission_denied', undefined, hint);
+    return new PapError('oauth_error', undefined, hint);
+}
+function sameBinding(subject, options) {
+    return JSON.stringify(subject.binding) === JSON.stringify(options.binding);
+}
+/** Host-only engine. UI receives safe summaries, never this object or signer capabilities. */
+export class PapClient {
+    options;
+    transport;
+    store;
+    discovery;
+    clock;
+    closed = false;
+    discoveryFlights = new Map();
+    recentJtis = new Map();
+    cooldownWaiters = new Set();
+    refreshFlights = new Map();
+    abortedSessions = new Map();
+    constructor(options, transport) {
+        this.options = options;
+        this.transport = transport;
+        requirePap(options.inlineCooldownWaitMs === undefined || Number.isInteger(options.inlineCooldownWaitMs) && options.inlineCooldownWaitMs >= 0 && options.inlineCooldownWaitMs <= 5000, 'permission_denied');
+        this.clock = options.clock ?? (() => Date.now());
+        this.store = new PapStore(options.stateRoot, options.secretStore, sha256(JSON.stringify(options.binding)));
+        this.discovery = new PapDiscovery(transport, this.clock);
+    }
+    close() { this.closed = true; for (const waiter of this.cooldownWaiters)
+        waiter.controller.abort(new PapError('disconnected')); for (const active of this.abortedSessions.values())
+        for (const controller of active)
+            controller.abort(); this.options.identityHost.dispose?.(); }
+    async recover() { await this.store.recover(); }
+    async resolvePapCompany(domain) {
+        // Failed discovery never commits or erases a previous issuer.
+        const discovered = await this.discovery.resolve(domain);
+        const company = await this.store.transaction(state => {
+            const previous = Object.values(state.companies).find(x => x.domain === discovered.domain && x.companyId === discovered.companyId);
+            if (previous)
+                discovered.ref = previous.ref;
+            discovered.generation = state.generation + 1;
+            state.companies[discovered.ref] = discovered;
+            return discovered;
+        });
+        return { companyRef: company.ref, companyId: company.companyId, name: company.name, authMode: company.authMode, scopes: company.scopes };
+    }
+    async getOrCreatePapUser(companyRef, mode = 'regular', agent = false) {
+        requirePap(mode === 'regular' || mode === 'anonymous', 'permission_denied');
+        return this.store.transaction(state => {
+            const company = this.company(state, companyRef);
+            let subject = Object.values(state.subjects).find(x => x.companyId === company.companyId && sameBinding(x, this.options) && mode !== 'anonymous' && x.mode === mode && Boolean(x.agentId) === agent);
+            if (!subject) {
+                const sameUser = mode === 'regular' ? Object.values(state.subjects).find(x => x.companyId === company.companyId && sameBinding(x, this.options) && x.mode === 'regular') : undefined;
+                subject = { ref: id('subj'), companyRef, companyId: company.companyId, binding: this.options.binding, mode, userId: sameUser?.userId ?? id('usr'), ...(agent ? { agentId: id('agt') } : {}) };
+                state.subjects[subject.ref] = subject;
+            }
+            return { subjectRef: subject.ref };
+        });
+    }
+    async openPapSession(subjectRef, accountSlot) {
+        return this.store.transaction(state => {
+            const subject = this.subject(state, subjectRef);
+            requirePap(!accountSlot || subject.mode === 'regular', 'permission_denied');
+            requirePap(subject.mode !== 'anonymous' || !Object.values(state.sessions).some(x => x.subjectRef === subjectRef), 'permission_denied');
+            if (accountSlot)
+                requirePap(Object.values(state.grants).some(x => this.sameUser(state, x.subjectRef, subject) && x.accountSlot === accountSlot && x.status === 'active'), 'reauthorization_required');
+            const session = { ref: id('sesref'), subjectRef, sid: id('ses'), generation: 1, connected: true, ...(accountSlot ? { accountSlot } : {}) };
+            state.sessions[session.ref] = session;
+            return { sessionRef: session.ref };
+        });
+    }
+    company(state, ref) {
+        const company = state.companies[ref];
+        requirePap(company, 'discovery_failed');
+        const latest = Object.values(state.companies).filter(x => x.domain === company.domain).sort((a, b) => b.generation - a.generation)[0];
+        requirePap(!latest || latest.companyId === company.companyId, 'namespace_changed');
+        return company;
+    }
+    subject(state, ref) {
+        const subject = state.subjects[ref];
+        requirePap(subject && sameBinding(subject, this.options), 'permission_denied');
+        this.company(state, subject.companyRef);
+        return subject;
+    }
+    sameUser(state, subjectRef, expected) {
+        const subject = state.subjects[subjectRef];
+        return Boolean(subject && sameBinding(subject, this.options) && subject.companyId === expected.companyId && subject.userId === expected.userId);
+    }
+    assertAccountEpoch(state, subject, accountSlot, epoch) {
+        const slot = state.accountSlots[accountSlot];
+        requirePap(slot && this.sameUser(state, slot.subjectRef, subject) && slot.epoch === epoch && !slot.signedOut, 'reauthorization_required');
+    }
+    session(state, ref) {
+        const session = state.sessions[ref];
+        requirePap(session?.connected, 'disconnected');
+        this.subject(state, session.subjectRef);
+        return session;
+    }
+    async ensureCompanyFresh(subjectRef) {
+        const state = await this.store.read();
+        const subject = this.subject(state, subjectRef);
+        const company = this.company(state, subject.companyRef);
+        if (company.expiresAt > this.clock())
+            return;
+        const existing = this.discoveryFlights.get(company.domain);
+        if (existing)
+            return existing;
+        const flight = this.resolvePapCompany(company.domain).then(result => { requirePap(result.companyId === company.companyId, 'namespace_changed'); });
+        this.discoveryFlights.set(company.domain, flight);
+        try {
+            await flight;
+        }
+        finally {
+            if (this.discoveryFlights.get(company.domain) === flight)
+                this.discoveryFlights.delete(company.domain);
+        }
+    }
+    async lease(subject, purpose, resource, destination, requestedScopes = []) {
+        requirePap(!this.closed, 'disconnected');
+        const state = await this.store.read();
+        const company = this.company(state, subject.companyRef);
+        requirePap(company.expiresAt > this.clock(), 'discovery_failed');
+        const lease = await this.options.identityHost.acquire(subject.binding, company, purpose, resource, destination, requestedScopes);
+        const identity = await lease.getOAuthClientIdentity();
+        requirePap(identity.clientId === subject.binding.clientId, 'permission_denied');
+        await lease.assertActive();
+        return lease;
+    }
+    assertWaitActive(state, context) {
+        requirePap(!this.closed, 'disconnected');
+        const subject = this.subject(state, context.subjectRef);
+        if (context.sessionRef) {
+            const session = this.session(state, context.sessionRef);
+            requirePap(this.sameUser(state, session.subjectRef, subject), 'permission_denied');
+            if (context.accountSlot)
+                requirePap(session.accountSlot === context.accountSlot, 'reauthorization_required');
+        }
+        if (context.accountSlot && context.accountEpoch !== undefined) {
+            const slot = state.accountSlots[context.accountSlot];
+            requirePap(slot && this.sameUser(state, slot.subjectRef, subject) && slot.epoch === context.accountEpoch && slot.signedOut === Boolean(context.allowSignedOut), 'reauthorization_required');
+        }
+        if (context.transactionRef) {
+            const transaction = state.transactions[context.transactionRef];
+            requirePap(transaction?.status === 'exchanging' && transaction.expiresAt > this.clock() && transaction.accountSlot === context.accountSlot && transaction.accountEpoch === context.accountEpoch, 'reauthorization_required');
+        }
+        if (context.grantRef) {
+            const grant = state.grants[context.grantRef];
+            requirePap(grant && grant.generation === context.grantGeneration && grant.status === (context.allowSignedOut ? 'revocation_pending' : 'refreshing'), 'state_conflict');
+        }
+    }
+    async awaitCooldown(key, context) {
+        const controller = new AbortController();
+        const waiter = { controller, context };
+        this.cooldownWaiters.add(waiter);
+        try {
+            for (;;) {
+                if (controller.signal.aborted)
+                    throw controller.signal.reason;
+                const state = await this.store.read();
+                this.assertWaitActive(state, context);
+                const remaining = remainingCooldownMs(state, key, this.clock());
+                if (remaining === 0n)
+                    return;
+                if (remaining > BigInt(this.options.inlineCooldownWaitMs ?? 1500))
+                    throw cooldownError(state, key, this.clock());
+                try {
+                    await delay(Math.min(Number(remaining), 50), undefined, { signal: controller.signal });
+                }
+                catch {
+                    if (controller.signal.aborted)
+                        throw controller.signal.reason;
+                    throw new PapError('disconnected');
+                }
+            }
+        }
+        finally {
+            this.cooldownWaiters.delete(waiter);
+        }
+    }
+    async rotateDelegation(subjectRef) {
+        const subject = this.subject(await this.store.read(), subjectRef);
+        const lease = await this.lease(subject, 'pap_session', subject.companyId);
+        await this.delegation(subject, lease, true);
+    }
+    async delegation(subject, lease, force = false, assertAllowed) {
+        await this.cleanupRetirements(subject, lease);
+        // Reserve before creating a key: failure/retirement must never roll back the create operation id.
+        const reservation = await this.store.transaction(state => {
+            this.subject(state, subject.ref);
+            assertAllowed?.(state);
+            const existing = state.delegations[subject.ref];
+            if (!force && existing && existing.expiresAt > this.clock() + 30000)
+                return { existing };
+            requirePap(!Object.values(state.retirements).some(x => x.subjectRef === subject.ref), 'delegation_blocked');
+            const current = state.delegationAttempts[subject.ref];
+            const attempt = current?.status === 'reserved' ? current : { sequence: (current?.sequence ?? 0) + 1, status: 'reserved' };
+            state.delegationAttempts[subject.ref] = attempt;
+            return { attempt };
+        });
+        if (reservation.existing) {
+            await this.cleanupRetirements(subject, lease);
+            return reservation.existing;
+        }
+        const attempt = reservation.attempt;
+        const result = await this.store.transaction(async (state) => {
+            this.subject(state, subject.ref);
+            assertAllowed?.(state);
+            const current = state.delegationAttempts[subject.ref];
+            requirePap(current?.sequence === attempt.sequence, 'state_conflict');
+            const existing = state.delegations[subject.ref];
+            if (current.status === 'issued' && existing)
+                return { delegation: existing };
+            requirePap(current.status === 'reserved', 'delegation_blocked');
+            try {
+                const next = await newDelegation(subject, lease, (existing?.generation ?? 0) + 1, this.clock(), `pap-delegation/${subject.ref}/attempt-${attempt.sequence}`);
+                state.delegations[subject.ref] = next;
+                current.status = 'issued';
+                if (existing)
+                    state.retirements[existing.key.handle] = { subjectRef: subject.ref, key: existing.key };
+                return { delegation: next };
+            }
+            catch (error) {
+                if (error instanceof DelegationAttemptFailure) {
+                    current.status = 'failed';
+                    if (!error.retired)
+                        state.retirements[error.key.handle] = { subjectRef: subject.ref, key: error.key };
+                }
+                // Before a handle was returned, creation may have succeeded: preserve its operation id for recovery.
+                if (!force && existing && existing.expiresAt > this.clock()) {
+                    try {
+                        await lease.assertActive();
+                        return { delegation: existing };
+                    }
+                    catch (authorizationError) {
+                        return { errorCode: authorizationError instanceof PapError ? authorizationError.code : 'permission_denied' };
+                    }
+                }
+                return { errorCode: error instanceof PapError || error instanceof DelegationAttemptFailure ? error.code : 'delegation_blocked' };
+            }
+        });
+        if (result.errorCode)
+            throw new PapError(result.errorCode);
+        await this.cleanupRetirements(subject, lease);
+        return result.delegation;
+    }
+    async cleanupRetirements(subject, lease) {
+        const pending = Object.values((await this.store.read()).retirements).filter(x => x.subjectRef === subject.ref);
+        for (const item of pending) {
+            try {
+                await lease.retireTemporaryKey(item.key, scopeFor(subject));
+                await this.store.transaction(state => { delete state.retirements[item.key.handle]; });
+            }
+            catch { /* Keep the durable retry reference; an old Delegation is never selected again. */ }
+        }
+    }
+    async dispatchPap(sessionRef, operation, control = {}) {
+        // Freeze all caller inputs before any await, including the exact body and business idempotency key.
+        const frozen = structuredClone(operation);
+        const headers = {};
+        for (const [name, value] of Object.entries(frozen.headers ?? {})) {
+            requirePap(!protectedHeaders.has(name.toLowerCase()) && !/[\r\n]/.test(value), 'permission_denied');
+            headers[name.toLowerCase()] = value;
+        }
+        if (frozen.idempotencyKey) {
+            requirePap(!headers['idempotency-key'] || headers['idempotency-key'] === frozen.idempotencyKey, 'permission_denied');
+            headers['idempotency-key'] = frozen.idempotencyKey;
+        }
+        let retriedSession = false;
+        let retriedToken = false;
+        let retriedNonce = false;
+        let accountContext;
+        for (;;) {
+            requirePap(!control.signal?.aborted, 'disconnected');
+            const initial = await this.store.read();
+            const initialSession = this.session(initial, sessionRef);
+            const initialSubject = this.subject(initial, initialSession.subjectRef);
+            const initialCompany = this.company(initial, initialSubject.companyRef);
+            control.assertAllowed?.(initial);
+            const initialMethod = (frozen.method ?? 'GET').toUpperCase();
+            const initialUrl = httpsUrl(frozen.url).href;
+            const initialRoute = initialCompany.routes.find(route => route.method === initialMethod && matchedRoute(route.template, initialUrl));
+            requirePap(initialRoute, 'unsafe_destination');
+            const waitContext = { subjectRef: initialSubject.ref, sessionRef, accountSlot: initialSession.accountSlot, accountEpoch: initialSession.accountSlot ? initial.accountSlots[initialSession.accountSlot]?.epoch : undefined };
+            if (waitContext.accountSlot) {
+                requirePap(waitContext.accountEpoch !== undefined, 'reauthorization_required');
+                accountContext ??= { slot: waitContext.accountSlot, epoch: waitContext.accountEpoch };
+            }
+            await this.awaitCooldown(resourceCooldownKey(initialCompany.companyId, initialRoute.resource), waitContext);
+            await this.ensureCompanyFresh(initialSession.subjectRef);
+            const state = await this.store.read();
+            const session = this.session(state, sessionRef);
+            const subject = this.subject(state, session.subjectRef);
+            const company = this.company(state, subject.companyRef);
+            const method = (frozen.method ?? 'GET').toUpperCase();
+            const url = httpsUrl(frozen.url).href;
+            requirePap(/^[A-Z]+$/.test(method), 'unsafe_destination');
+            const reserved = [...company.sources.map(x => x.url), company.metadata?.token_endpoint, company.metadata?.authorization_endpoint, company.metadata?.revocation_endpoint].filter((x) => Boolean(x));
+            requirePap(!reserved.some(value => htu(value) === htu(url)), 'unsafe_destination');
+            const route = company.routes.find(x => x.method === method && matchedRoute(x.template, url));
+            requirePap(route, 'unsafe_destination');
+            requirePap(!frozen.resource || frozen.resource === route.resource, 'unsafe_destination');
+            let grant = session.accountSlot ? Object.values(state.grants).find(x => this.sameUser(state, x.subjectRef, subject) && x.accountSlot === session.accountSlot && x.resource === route.resource && ['active', 'refreshing'].includes(x.status)) : undefined;
+            if (session.accountSlot && !grant)
+                throw new PapError('reauthorization_required');
+            if (!session.accountSlot)
+                requirePap(!accountContext, 'reauthorization_required');
+            if (grant) {
+                this.assertAccountEpoch(state, subject, grant.accountSlot, grant.accountEpoch);
+                requirePap(!accountContext || accountContext.slot === grant.accountSlot && accountContext.epoch === grant.accountEpoch, 'reauthorization_required');
+                accountContext ??= { slot: grant.accountSlot, epoch: grant.accountEpoch };
+                if (grant.status === 'refreshing') {
+                    await this.waitForRefresh(grant.ref, grant.accountEpoch, grant.generation);
+                    retriedToken = true;
+                    continue;
+                }
+                requirePap(subject.mode === 'regular' && grant.clientId === subject.binding.clientId && grant.issuer === company.issuer, 'permission_denied');
+                requirePap((frozen.scopes ?? []).every(x => grant.scope.includes(x)), 'insufficient_scope');
+                if ((grant.expiresAt !== undefined && grant.expiresAt <= this.clock()) || grant.usableUntil <= this.clock()) {
+                    if (!retriedToken && grant.refreshToken) {
+                        await this.refreshAccountGrant(grant.ref, sessionRef);
+                        retriedToken = true;
+                        continue;
+                    }
+                    throw new PapError('reauthorization_required');
+                }
+            }
+            else
+                requirePap((frozen.scopes?.length ?? 0) === 0, 'reauthorization_required');
+            const cooldownKey = resourceCooldownKey(company.companyId, route.resource);
+            const allowed = (current) => { requirePap(!control.signal?.aborted, 'disconnected'); control.assertAllowed?.(current); this.assertWaitActive(current, waitContext); assertCooldownElapsed(current, cooldownKey, this.clock()); };
+            const lease = await this.lease(subject, 'pap_session', route.resource, url);
+            const delegation = await this.delegation(subject, lease, false, allowed);
+            await this.store.transaction(current => allowed(current));
+            const sessionJwt = await lease.signPapSessionRequest({ key: delegation.key, scope: scopeFor(subject), delegation: delegation.compact, clientId: subject.binding.clientId, sid: session.sid, sub: subject.userId, agentId: subject.agentId, httpMethod: method, httpUri: url, accessToken: grant?.accessToken });
+            this.checkSessionJwt(sessionJwt, delegation, subject, session, method, url, grant?.accessToken);
+            const sentHeaders = { ...headers, 'poppy-session': sessionJwt };
+            let dpopLease;
+            if (grant) {
+                sentHeaders.authorization = `${grant.tokenType} ${grant.accessToken}`;
+                if (grant.tokenType === 'DPoP') {
+                    requirePap(grant.dpopKey, 'credential_unavailable');
+                    dpopLease = await this.lease(subject, 'pap_account', grant.resource, url, grant.scope);
+                    try {
+                        const nonce = await this.store.transaction(current => { allowed(current); return current.nonces[`resource:${new URL(url).origin}`]; });
+                        sentHeaders.dpop = await dpopLease.signDpopProof({ key: grant.dpopKey, scope: scopeFor(subject, grant.accountSlot), httpMethod: method, httpUri: url, accessToken: grant.accessToken, nonce });
+                    }
+                    catch (error) {
+                        if (error instanceof PapError && error.code === 'credential_unavailable')
+                            await this.store.transaction(current => { const item = current.grants[grant.ref]; if (item?.generation === grant.generation) {
+                                item.status = 'reauthorization_required';
+                                item.generation++;
+                            } });
+                        throw error;
+                    }
+                    await dpopLease.assertActive();
+                }
+            }
+            await lease.assertActive();
+            const controller = new AbortController();
+            const cancel = () => controller.abort();
+            control.signal?.addEventListener('abort', cancel, { once: true });
+            if (control.signal?.aborted)
+                controller.abort();
+            const active = this.abortedSessions.get(sessionRef) ?? new Set();
+            active.add(controller);
+            this.abortedSessions.set(sessionRef, active);
+            let response;
+            try {
+                // Same lock orders local disconnect/signout versus actual dispatch. No await between final CAS and HTTP start.
+                response = await this.store.transaction(async (current) => {
+                    try {
+                        await lease.assertActive();
+                        await dpopLease?.assertActive();
+                    }
+                    catch {
+                        throw new PapError('permission_denied');
+                    }
+                    allowed(current);
+                    requirePap(!controller.signal.aborted, 'disconnected');
+                    const currentSession = this.session(current, sessionRef);
+                    requirePap(this.company(current, subject.companyRef).generation === company.generation && currentSession.generation === session.generation && current.delegations[subject.ref]?.generation === delegation.generation, 'state_conflict');
+                    if (grant) {
+                        this.assertAccountEpoch(current, subject, grant.accountSlot, grant.accountEpoch);
+                        requirePap(current.grants[grant.ref]?.generation === grant.generation && current.grants[grant.ref]?.status === 'active', 'state_conflict');
+                    }
+                    control.captureSecrets?.([sessionJwt, sentHeaders.dpop, sentHeaders.authorization, grant?.accessToken, grant?.refreshToken, subject.userId, subject.agentId, session.sid].filter((value) => Boolean(value)), grant ? { accessToken: grant.accessToken, refreshToken: grant.refreshToken, accessExpiresInMs: grant.expiresAt === undefined ? undefined : Math.max(0, grant.expiresAt - this.clock()) } : undefined);
+                    const response = await this.transport.request(url, { method, headers: sentHeaders, body: frozen.body, signal: controller.signal });
+                    if (response.status === 429)
+                        recordCooldown(current, cooldownKey, response, this.clock());
+                    return response;
+                });
+            }
+            catch (error) {
+                if (error instanceof PapError)
+                    throw error;
+                throw new PapError('request_uncertain');
+            }
+            finally {
+                control.signal?.removeEventListener('abort', cancel);
+                active.delete(controller);
+                if (active.size === 0)
+                    this.abortedSessions.delete(sessionRef);
+            }
+            if (response.status >= 300 && response.status < 400)
+                throw new PapError('redirect_blocked');
+            if (response.status === 429) {
+                const limited = await this.store.read();
+                throw cooldownError(limited, cooldownKey, this.clock());
+            }
+            const failure = protocolFailure(response, company, route.resource, grant?.tokenType);
+            const error = failure.code;
+            if (error === 'session_ended') {
+                if (retriedSession)
+                    throw new PapError('session_ended');
+                retriedSession = true;
+                await this.store.transaction(current => { const value = this.session(current, sessionRef); requirePap(value.generation === session.generation, 'state_conflict'); value.sid = id('ses'); value.generation++; });
+                continue;
+            }
+            if (error === 'invalid_session')
+                throw new PapError('invalid_session');
+            if (grant && error === 'use_dpop_nonce' && responseHeader(response, 'dpop-nonce') && !retriedNonce) {
+                retriedNonce = true;
+                await this.saveNonce(`resource:${new URL(url).origin}`, responseHeader(response, 'dpop-nonce'));
+                if (['GET', 'HEAD', 'OPTIONS'].includes(method))
+                    continue;
+                throw authenticationError('invalid_dpop_proof', failure.hint);
+            }
+            if (grant && error === 'invalid_token') {
+                if (!retriedToken && grant.refreshToken && ['GET', 'HEAD', 'OPTIONS'].includes(method)) {
+                    retriedToken = true;
+                    await this.refreshAccountGrant(grant.ref, sessionRef);
+                    continue;
+                }
+                throw authenticationError('invalid_token', failure.hint);
+            }
+            if (error === 'insufficient_scope' || error === 'unauthorized_client' || failure.challenge)
+                throw authenticationError(error, failure.hint);
+            return response;
+        }
+    }
+    checkSessionJwt(jwt, delegation, subject, session, method, url, token) {
+        const { header, payload } = jwtParts(jwt);
+        requirePap(header.typ === 'poppy-session+jwt' && header.alg === 'ES256' && header.kid === delegation.key.thumbprint && header.poppy_dlg === delegation.compact && verifyCompact(jwt, delegation.key.public_jwk), 'delegation_blocked');
+        requirePap(payload.iss === subject.binding.clientId && payload.aud === subject.companyId && payload.sid === session.sid && payload.sub === subject.userId && payload.agent_id === subject.agentId && payload.htm === method && payload.htu === htu(url), 'delegation_blocked');
+        requirePap(Number.isSafeInteger(payload.iat) && Math.abs(Number(payload.iat) * 1000 - this.clock()) <= 10000 && typeof payload.jti === 'string' && payload.jti.length >= 16, 'delegation_blocked');
+        requirePap(Object.keys(payload).every(key => ['iss', 'aud', 'sid', 'sub', 'agent_id', 'htm', 'htu', 'iat', 'jti', 'ath'].includes(key)), 'delegation_blocked');
+        for (const [jti, expires] of this.recentJtis)
+            if (expires < this.clock())
+                this.recentJtis.delete(jti);
+        requirePap(!this.recentJtis.has(String(payload.jti)) && this.recentJtis.size < 8192, 'delegation_blocked');
+        this.recentJtis.set(String(payload.jti), this.clock() + 120000);
+        requirePap(token ? payload.ath === sha256(token) : !Object.hasOwn(payload, 'ath'), 'delegation_blocked');
+    }
+    async saveNonce(target, nonce) {
+        requirePap(nonce.length > 0 && nonce.length <= 1024 && !/[\r\n]/.test(nonce), 'oauth_error');
+        await this.store.transaction(state => { state.nonces[target] = nonce; });
+    }
+    async startSignIn(subjectRef, input) {
+        requirePap(input.method === undefined || input.method === 'direct', 'unsupported_sign_in');
+        await this.ensureCompanyFresh(subjectRef);
+        const state = await this.store.read();
+        const subject = this.subject(state, subjectRef);
+        const company = this.company(state, subject.companyRef);
+        requirePap(subject.mode === 'regular' && company.issuer && company.metadata && !company.authDisabled, 'unsupported_sign_in');
+        const metadata = company.metadata;
+        requirePap(metadata.grant_types_supported.includes('authorization_code') && metadata.grant_types_supported.includes('refresh_token') && metadata.revocation_endpoint && metadata.authorization_endpoint && metadata.token_endpoint_auth_methods_supported?.includes('private_key_jwt') && metadata.code_challenge_methods_supported?.includes('S256'), 'unsupported_sign_in');
+        requirePap(!metadata.dpop_signing_alg_values_supported?.length || metadata.dpop_signing_alg_values_supported.includes('ES256'), 'unsupported_sign_in');
+        const scope = [...new Set(input.scopes)].sort();
+        requirePap(scope.length > 0 && scope.every(x => company.scopes.includes(x) && /^[\x21\x23-\x5b\x5d-\x7e]+$/.test(x)) && company.routes.some(x => x.resource === input.resource), 'insufficient_scope');
+        const lease = await this.lease(subject, 'pap_account', input.resource, undefined, scope);
+        const identity = await lease.getOAuthClientIdentity();
+        const client = httpsUrl(subject.binding.clientId);
+        const loopback = isPapLoopbackRedirect(input.redirectUri);
+        requirePap(input.callbackMode === 'handoff' ? httpsUrl(input.redirectUri).hostname === client.hostname && this.options.callbackHandoff : loopback, 'unsupported_sign_in');
+        requirePap(identity.redirectUris?.some(value => {
+            if (value === input.redirectUri)
+                return true;
+            if (!loopback || !isPapLoopbackRedirect(value))
+                return false;
+            const configured = new URL(value);
+            configured.port = '';
+            const actual = new URL(input.redirectUri);
+            actual.port = '';
+            return configured.href === actual.href;
+        }), 'unsupported_sign_in');
+        const tx = { ref: id('auth'), subjectRef, accountSlot: id('acct'), issuer: company.issuer, clientId: subject.binding.clientId, redirectUri: input.redirectUri, state: id('state'), verifier: randomBytes(32).toString('base64url'), resource: input.resource, scope, expiresAt: this.clock() + 600000, accountEpoch: 1, status: 'pending' };
+        if (metadata.dpop_signing_alg_values_supported?.includes('ES256'))
+            tx.dpopKey = await lease.createDpopKey(scopeFor(subject, tx.accountSlot), `pap-dpop/${tx.ref}`);
+        await this.store.transaction(current => { this.subject(current, subjectRef); current.accountSlots[tx.accountSlot] = { subjectRef, epoch: tx.accountEpoch, signedOut: false }; current.transactions[tx.ref] = tx; });
+        if (input.callbackMode === 'handoff') {
+            const registered = await this.options.callbackHandoff.register({ transactionId: tx.ref, issuer: tx.issuer, clientId: tx.clientId, redirectUri: tx.redirectUri, state: tx.state, expiresAt: tx.expiresAt });
+            await this.store.transaction(current => { requirePap(current.transactions[tx.ref]?.status === 'pending', 'state_conflict'); current.transactions[tx.ref].callbackRef = registered.callbackRef; });
+        }
+        const authorize = httpsUrl(metadata.authorization_endpoint);
+        const params = authorize.searchParams;
+        for (const [key, value] of Object.entries({ response_type: 'code', client_id: tx.clientId, redirect_uri: tx.redirectUri, scope: scope.join(' '), state: tx.state, code_challenge: sha256(tx.verifier), code_challenge_method: 'S256', resource: tx.resource }))
+            params.set(key, value);
+        // This is user-only browser data. It must not be emitted to an LLM tool response.
+        return { transactionRef: tx.ref, authorizationUrl: authorize.href, accountSlot: tx.accountSlot };
+    }
+    async collectSignIn(transactionRef) {
+        const tx = (await this.store.read()).transactions[transactionRef];
+        requirePap(tx?.callbackRef && this.options.callbackHandoff, 'invalid_authorization_response');
+        return this.completeSignIn(transactionRef, await this.options.callbackHandoff.collect(tx.callbackRef));
+    }
+    /** Called only by an authenticated Host callback listener or handoff, never an arbitrary model tool. */
+    async completeSignIn(transactionRef, response) {
+        const tx = await this.store.transaction(state => {
+            const tx = state.transactions[transactionRef];
+            requirePap(tx && tx.status === 'pending' && tx.expiresAt > this.clock(), 'invalid_authorization_response');
+            const subject = this.subject(state, tx.subjectRef);
+            this.assertAccountEpoch(state, subject, tx.accountSlot, tx.accountEpoch);
+            requirePap(secureEqual(response.state, tx.state) && secureEqual(response.iss, tx.issuer), 'invalid_authorization_response');
+            if (response.error) {
+                tx.status = 'failed';
+                return { ...tx, status: 'failed' };
+            }
+            requirePap(typeof response.code === 'string' && response.code.length > 0 && response.code.length <= 8192, 'invalid_authorization_response');
+            tx.status = 'exchanging';
+            tx.exchangeInFlight = true;
+            return tx;
+        });
+        if (tx.status === 'failed')
+            throw new PapError('oauth_error');
+        const state = await this.store.read();
+        const subject = this.subject(state, tx.subjectRef);
+        const company = this.company(state, subject.companyRef);
+        try {
+            const result = await this.tokenRequest(subject, company, tx.resource, tx.accountSlot, tx.dpopKey, { grant_type: 'authorization_code', code: response.code, redirect_uri: tx.redirectUri, code_verifier: tx.verifier, resource: tx.resource }, { scopes: tx.scope, accountEpoch: tx.accountEpoch, transactionRef: tx.ref });
+            const grant = this.parseGrant(result, tx, tx.dpopKey);
+            requirePap(grant.refreshToken, 'oauth_error');
+            const committed = await this.store.transaction(current => {
+                archiveCredentials(current, [grant.accessToken, grant.refreshToken]);
+                const subject = this.subject(current, tx.subjectRef);
+                const active = current.transactions[tx.ref];
+                const slot = current.accountSlots[tx.accountSlot];
+                const valid = active?.status === 'exchanging' && active.expiresAt > this.clock() && slot?.epoch === tx.accountEpoch && !slot.signedOut && this.sameUser(current, slot.subjectRef, subject);
+                if (valid)
+                    current.grants[grant.ref] = grant;
+                else
+                    current.grants[grant.ref] = { ...grant, accessToken: '', status: 'revocation_pending' };
+                delete current.transactions[tx.ref];
+                return valid;
+            });
+            requirePap(committed, 'revocation_pending');
+            return { grantRef: grant.ref, accountSlot: grant.accountSlot };
+        }
+        catch (error) {
+            await this.store.transaction(current => {
+                const active = current.transactions[tx.ref];
+                if (active) {
+                    if (active.status !== 'cancelled')
+                        active.status = 'failed';
+                    active.verifier = '';
+                    active.exchangeInFlight = error instanceof PapError && error.code === 'request_uncertain';
+                }
+            });
+            throw error;
+        }
+    }
+    parseGrant(response, tx, dpopKey, prior) {
+        const body = parseJson(response);
+        requirePap(response.status === 200 && body.error === undefined && typeof body.access_token === 'string' && body.access_token.length > 0 && body.access_token.length <= 65536 && !/[\r\n]/.test(body.access_token), 'oauth_error');
+        requirePap(typeof body.token_type === 'string' && ['bearer', 'dpop'].includes(body.token_type.toLowerCase()), 'oauth_error');
+        const type = body.token_type.toLowerCase() === 'dpop' ? 'DPoP' : 'Bearer';
+        requirePap(type !== 'DPoP' || dpopKey, 'credential_unavailable');
+        requirePap(!prior || prior.tokenType !== 'DPoP' || type === 'DPoP', 'credential_unavailable');
+        const scope = body.scope === undefined ? tx.scope : typeof body.scope === 'string' ? [...new Set(body.scope.split(' ').filter(Boolean))].sort() : [];
+        requirePap(scope.length > 0 && scope.every(x => tx.scope.includes(x)), 'insufficient_scope');
+        requirePap(body.expires_in === undefined || typeof body.expires_in === 'number' && Number.isFinite(body.expires_in) && body.expires_in > 0, 'oauth_error');
+        requirePap(body.refresh_token === undefined || typeof body.refresh_token === 'string' && body.refresh_token.length > 0 && body.refresh_token.length <= 65536, 'oauth_error');
+        const grant = { ref: prior?.ref ?? id('grant'), subjectRef: tx.subjectRef, accountSlot: tx.accountSlot, issuer: tx.issuer, clientId: tx.clientId, resource: tx.resource, scope,
+            accessToken: body.access_token, refreshToken: body.refresh_token ?? prior?.refreshToken, tokenType: type, dpopKey,
+            expiresAt: body.expires_in === undefined ? undefined : this.clock() + Number(body.expires_in) * 1000,
+            usableUntil: this.clock() + 86400000, accountEpoch: tx.accountEpoch, generation: (prior?.generation ?? 0) + 1, status: 'active' };
+        this.options.observeCredentials?.({ accessToken: grant.accessToken, refreshToken: grant.refreshToken, accessExpiresInMs: body.expires_in === undefined ? undefined : Number(body.expires_in) * 1000 });
+        return grant;
+    }
+    async tokenRequest(subject, company, resource, accountSlot, key, fields, control) {
+        requirePap(company.issuer, 'unsupported_sign_in');
+        const cooldownKey = asCooldownKey(company.companyId, company.issuer);
+        const context = { subjectRef: subject.ref, sessionRef: control.sessionRef, accountSlot, accountEpoch: control.accountEpoch, allowSignedOut: control.purpose === 'revoke', grantRef: control.grantRef, grantGeneration: control.grantGeneration, transactionRef: control.transactionRef };
+        let retriedNonce = false;
+        for (;;) {
+            await this.awaitCooldown(cooldownKey, context);
+            await this.ensureCompanyFresh(subject.ref);
+            const latest = await this.store.read();
+            const currentSubject = this.subject(latest, subject.ref);
+            const currentCompany = this.company(latest, currentSubject.companyRef);
+            this.assertWaitActive(latest, context);
+            requirePap(currentCompany.issuer === company.issuer && currentCompany.routes.some(route => route.resource === resource), 'namespace_changed');
+            if (control.purpose !== 'revoke') {
+                const currentScopes = control.grantRef ? latest.grants[control.grantRef]?.scope : control.transactionRef ? latest.transactions[control.transactionRef]?.scope : undefined;
+                requirePap(currentScopes && control.scopes.every(scope => currentScopes.includes(scope)), 'insufficient_scope');
+            }
+            const target = control.purpose === 'revoke' ? currentCompany.metadata?.revocation_endpoint : currentCompany.metadata?.token_endpoint;
+            requirePap(target, 'unsupported_sign_in');
+            httpsUrl(target);
+            const lease = await this.lease(currentSubject, 'pap_account', resource, target, control.scopes);
+            await this.store.transaction(state => { this.assertWaitActive(state, context); assertCooldownElapsed(state, cooldownKey, this.clock()); });
+            const assertion = await lease.signOAuthClientAssertion();
+            const parts = jwtParts(assertion);
+            requirePap(parts.payload.iss === subject.binding.clientId && parts.payload.sub === subject.binding.clientId && parts.payload.aud === company.issuer, 'permission_denied');
+            const body = new URLSearchParams({ ...fields, client_id: subject.binding.clientId, client_assertion_type: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer', client_assertion: assertion }).toString();
+            const headers = { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' };
+            if (key) {
+                requirePap(key.purpose === 'pap_dpop' && thumbprint(key.public_jwk) === key.thumbprint, 'credential_unavailable');
+                const nonce = await this.store.transaction(state => { this.assertWaitActive(state, context); assertCooldownElapsed(state, cooldownKey, this.clock()); return state.nonces[`authorization:${company.issuer}`]; });
+                headers.dpop = await lease.signDpopProof({ key, scope: scopeFor(subject, accountSlot), httpMethod: 'POST', httpUri: target, nonce });
+            }
+            await lease.assertActive();
+            const signed = { body, headers };
+            let sent;
+            await this.store.transaction(async (state) => {
+                try {
+                    await lease.assertActive();
+                }
+                catch {
+                    throw new PapError('permission_denied');
+                }
+                this.assertWaitActive(state, context);
+                assertCooldownElapsed(state, cooldownKey, this.clock());
+                archiveCredentials(state, [fields.refresh_token, control.purpose === 'revoke' ? fields.token : undefined]);
+                sent = this.transport.request(target, { method: 'POST', headers: signed.headers, body: signed.body }).then(response => ({ response }), () => ({ failed: true }));
+            });
+            const outcome = await sent;
+            requirePap(outcome.response && !outcome.failed, 'request_uncertain');
+            const result = outcome.response;
+            if (control.purpose !== 'revoke' && result.status === 200) {
+                const received = parseJson(result);
+                const values = [received.access_token, received.refresh_token].filter((value) => typeof value === 'string' && value.length > 0 && value.length <= 65536);
+                if (values.length)
+                    await this.store.transaction(state => archiveCredentials(state, values));
+            }
+            if (result.status === 429) {
+                await this.store.transaction(state => recordCooldown(state, cooldownKey, result, this.clock()));
+                throw cooldownError(await this.store.read(), cooldownKey, this.clock());
+            }
+            requirePap(result.status < 300 || result.status >= 400, 'redirect_blocked');
+            const failure = protocolFailure(result, currentCompany, resource, key ? 'DPoP' : undefined);
+            if (key && failure.code === 'use_dpop_nonce' && responseHeader(result, 'dpop-nonce') && !retriedNonce) {
+                retriedNonce = true;
+                await this.saveNonce(`authorization:${company.issuer}`, responseHeader(result, 'dpop-nonce'));
+                continue;
+            }
+            if (failure.code === 'invalid_grant' || failure.code === 'unauthorized_client' || failure.challenge)
+                throw authenticationError(failure.code, failure.hint);
+            return result;
+        }
+    }
+    async refreshAccountGrant(grantRef, sessionRef) {
+        const prior = this.refreshFlights.get(grantRef);
+        if (prior)
+            return prior;
+        const flight = this.refresh(grantRef, sessionRef);
+        this.refreshFlights.set(grantRef, flight);
+        try {
+            await flight;
+        }
+        finally {
+            if (this.refreshFlights.get(grantRef) === flight)
+                this.refreshFlights.delete(grantRef);
+        }
+    }
+    async waitForRefresh(grantRef, accountEpoch, refreshingGeneration, joinLocal = true) {
+        const local = joinLocal ? this.refreshFlights.get(grantRef) : undefined;
+        if (local)
+            await local;
+        for (let attempt = 0; attempt < 120; attempt++) {
+            const state = await this.store.read();
+            const grant = state.grants[grantRef];
+            requirePap(grant && grant.accountEpoch === accountEpoch, 'reauthorization_required');
+            this.assertAccountEpoch(state, this.subject(state, grant.subjectRef), grant.accountSlot, accountEpoch);
+            if (grant.status === 'active' && grant.generation > refreshingGeneration) {
+                const subject = this.subject(state, grant.subjectRef);
+                assertCooldownElapsed(state, asCooldownKey(subject.companyId, grant.issuer), this.clock());
+                return;
+            }
+            requirePap(grant.status === 'refreshing' && grant.generation === refreshingGeneration, 'reauthorization_required');
+            await new Promise(resolve => setTimeout(resolve, 100));
+        }
+        throw new PapError('reauthorization_required');
+    }
+    async refresh(grantRef, sessionRef) {
+        const claim = await this.store.transaction(state => {
+            const grant = state.grants[grantRef];
+            requirePap(grant && grant.refreshToken, 'reauthorization_required');
+            this.assertAccountEpoch(state, this.subject(state, grant.subjectRef), grant.accountSlot, grant.accountEpoch);
+            if (grant.status === 'refreshing')
+                return { waiting: grant };
+            requirePap(grant.status === 'active', 'reauthorization_required');
+            grant.status = 'refreshing';
+            grant.generation++;
+            return { claimed: grant };
+        });
+        if (claim.waiting) {
+            await this.waitForRefresh(grantRef, claim.waiting.accountEpoch, claim.waiting.generation, false);
+            return;
+        }
+        const claimed = claim.claimed;
+        const state = await this.store.read();
+        const subject = this.subject(state, claimed.subjectRef);
+        const company = this.company(state, subject.companyRef);
+        try {
+            const response = await this.tokenRequest(subject, company, claimed.resource, claimed.accountSlot, claimed.dpopKey, { grant_type: 'refresh_token', refresh_token: claimed.refreshToken, resource: claimed.resource, scope: claimed.scope.join(' ') }, { scopes: claimed.scope, accountEpoch: claimed.accountEpoch, sessionRef, grantRef: claimed.ref, grantGeneration: claimed.generation });
+            const next = this.parseGrant(response, claimed, claimed.dpopKey, claimed);
+            const committed = await this.store.transaction(current => {
+                archiveCredentials(current, [claimed.accessToken, claimed.refreshToken, next.accessToken, next.refreshToken]);
+                const grant = current.grants[grantRef];
+                if (grant?.generation === claimed.generation && grant.status === 'refreshing' && current.accountSlots[claimed.accountSlot]?.epoch === claimed.accountEpoch && !current.accountSlots[claimed.accountSlot]?.signedOut) {
+                    current.grants[grantRef] = next;
+                    return true;
+                }
+                if (grant && ['signed_out', 'revocation_pending'].includes(grant.status) && next.refreshToken) {
+                    const pending = { ...next, ref: id('pending_revoke'), accessToken: '', status: 'revocation_pending' };
+                    current.grants[pending.ref] = pending;
+                }
+                return false;
+            });
+            requirePap(committed, 'revocation_pending');
+        }
+        catch (error) {
+            await this.store.transaction(current => { const grant = current.grants[grantRef]; if (grant?.generation === claimed.generation && grant.status === 'refreshing') {
+                grant.status = error instanceof PapError && error.code === 'request_uncertain' ? 'uncertain' : error instanceof PapError && ['rate_limited', 'disconnected'].includes(error.code) ? 'active' : 'reauthorization_required';
+                grant.generation++;
+            } });
+            throw error;
+        }
+    }
+    async signOutAccount(subjectRef, accountSlot) {
+        let refreshInFlight = false;
+        const grants = await this.store.transaction(state => {
+            const subject = this.subject(state, subjectRef);
+            const slot = state.accountSlots[accountSlot];
+            requirePap(!slot || this.sameUser(state, slot.subjectRef, subject), 'permission_denied');
+            state.accountSlots[accountSlot] = { subjectRef, epoch: (slot?.epoch ?? 0) + 1, signedOut: true };
+            for (const tx of Object.values(state.transactions))
+                if (this.sameUser(state, tx.subjectRef, subject) && tx.accountSlot === accountSlot) {
+                    if (tx.status === 'exchanging' || tx.exchangeInFlight)
+                        refreshInFlight = true;
+                    tx.status = 'cancelled';
+                    tx.verifier = '';
+                    delete tx.callbackRef;
+                }
+            const grants = Object.values(state.grants).filter(x => this.sameUser(state, x.subjectRef, subject) && x.accountSlot === accountSlot && x.status !== 'signed_out');
+            for (const grant of grants) {
+                archiveCredentials(state, [grant.accessToken, grant.refreshToken]);
+                if (grant.status === 'refreshing')
+                    refreshInFlight = true;
+                grant.status = grant.refreshToken ? 'revocation_pending' : 'signed_out';
+                grant.accessToken = '';
+                grant.generation++;
+            }
+            for (const session of Object.values(state.sessions))
+                if (this.sameUser(state, session.subjectRef, subject) && session.accountSlot === accountSlot) {
+                    delete session.accountSlot;
+                    session.generation++;
+                }
+            return grants;
+        });
+        for (const waiter of this.cooldownWaiters)
+            if (waiter.context.accountSlot === accountSlot)
+                waiter.controller.abort(new PapError('reauthorization_required'));
+        let pending = refreshInFlight;
+        for (const grant of grants) {
+            if (!grant.refreshToken)
+                continue;
+            const state = await this.store.read();
+            const subject = this.subject(state, subjectRef);
+            const company = this.company(state, subject.companyRef);
+            try {
+                requirePap(company.metadata?.revocation_endpoint, 'revocation_pending');
+                const result = await this.tokenRequest(subject, company, grant.resource, grant.accountSlot, grant.dpopKey, { token: grant.refreshToken, token_type_hint: 'refresh_token' }, { purpose: 'revoke', scopes: grant.scope, accountEpoch: state.accountSlots[grant.accountSlot].epoch, grantRef: grant.ref, grantGeneration: grant.generation });
+                requirePap(result.status === 200, 'revocation_pending');
+                await this.store.transaction(current => { const item = current.grants[grant.ref]; if (item && item.generation === grant.generation && item.status === 'revocation_pending') {
+                    item.status = 'signed_out';
+                    delete item.refreshToken;
+                    item.generation++;
+                } });
+            }
+            catch {
+                pending = true;
+            }
+        }
+        return { status: pending ? 'revocation_pending' : 'signed_out' };
+    }
+    async disconnectPap(sessionRef) {
+        for (const waiter of this.cooldownWaiters)
+            if (waiter.context.sessionRef === sessionRef)
+                waiter.controller.abort(new PapError('disconnected'));
+        for (const controller of this.abortedSessions.get(sessionRef) ?? [])
+            controller.abort();
+        const ended = await this.store.transaction(state => { const session = state.sessions[sessionRef]; requirePap(session, 'disconnected'); const subject = this.subject(state, session.subjectRef); session.connected = false; session.generation++; return { subject, delegation: state.delegations[subject.ref] }; });
+        if (ended.subject.mode === 'anonymous') {
+            try {
+                if (ended.delegation) {
+                    const lease = await this.lease(ended.subject, 'pap_session', ended.subject.companyId);
+                    await lease.retireTemporaryKey(ended.delegation.key, scopeFor(ended.subject));
+                }
+            }
+            finally {
+                await this.store.transaction(state => { delete state.subjects[ended.subject.ref]; delete state.delegations[ended.subject.ref]; delete state.delegationAttempts[ended.subject.ref]; for (const [key, value] of Object.entries(state.retirements))
+                    if (value.subjectRef === ended.subject.ref)
+                        delete state.retirements[key]; });
+            }
+        }
+    }
+    async getPapStatus() {
+        const state = await this.store.read();
+        return { companies: Object.values(state.companies).map(x => ({ companyRef: x.ref, name: x.name, authMode: x.authMode })),
+            sessions: Object.values(state.sessions).map(x => ({ sessionRef: x.ref, connected: x.connected, account: Boolean(x.accountSlot) })),
+            accounts: Object.values(state.grants).map(x => ({ grantRef: x.ref, status: x.status, scopes: x.scope })), supportedSignIn: ['direct'] };
+    }
+}