@cboxdk/id-js 0.20.0 → 0.21.0

package/CHANGELOG.md

@@ -3,6 +3,34 @@
 All notable changes to `@cboxdk/id-js` are recorded here. Earlier releases are described
 in their [GitHub releases](https://github.com/cboxdk/id-js/releases).
 
+## [Unreleased]
+
+## [0.21.0] - 2026-11-08
+
+### Added
+
+- `@cboxdk/id-js/agent`: OpenID CIBA (poll mode) and the RFC 8628 device grant for agents and
+  CLIs, so they no longer need their own polling loop. `startBackchannel` / `pollBackchannel` /
+  `waitForBackchannelToken`, `startDeviceAuthorization` / `pollDeviceAuthorization` /
+  `waitForDeviceToken` and `refreshAgentTokens`. The wait helpers use the server's `interval`,
+  add 5 s on `slow_down` (and on 429, waiting at least `Retry-After`), keep polling on
+  `authorization_pending`, stop at `expires_in`, and take an `AbortSignal` and an injectable
+  `sleep`. `resource` (RFC 8707) is re-sent on every poll. No `user_code` is ever sent.
+- `registerAgentClient()`: RFC 7591 dynamic registration with `private_key_jwt` (an ES256 or
+  RS256 key from `generateClientKeyPair()`, sent inline as `jwks`) or `none`.
+  `createClientAssertion()` signs the RFC 7523 assertion (`aud` = token endpoint, single-use
+  `jti`, at most 60 s). `startBackchannel` also accepts a keyless `none` client (sends
+  `client_id` only), which Cbox ID allows only where the resource permits it.
+- `discoverAuthorizationServer()` reads `/.well-known/oauth-authorization-server` and checks
+  the issuer.
+- `createBindingCode()`: a short code from an alphabet without look-alike characters, for the
+  `binding_message` that Cbox ID requires from self-registered clients.
+- Typed errors: `AccessDeniedError`, `ExpiredTokenError`, `InvalidGrantError`,
+  `InvalidTargetError`, `InvalidClientError`, `UnknownUserIdError`,
+  `InvalidBindingMessageError`, `SlowDownError` (with `retryAfter`), all subclasses of
+  `AgentGrantError` (an `AuthenticationError`), plus `GrantCancelledError`.
+- Guide: `docs/ciba-and-device-grant.md`.
+
 ## [0.20.0] - 2026-11-07
 
 ### Upgrade

package/README.md

@@ -276,6 +276,33 @@ want the person re-approving every hour.
 See [Sign in from a CLI](https://github.com/cboxdk/cbox-id/blob/main/docs/getting-started/sign-in-from-a-cli.md)
 for the protocol itself and where to store the tokens.
 
+### Agents and self-registering CLIs (CIBA and device grant)
+
+`@cboxdk/id-js/agent` is for a CLI or an agent that registers itself (RFC 7591) and gets a
+token for a person without a redirect: OpenID CIBA, where the person taps Approve in Cbox ID,
+or the device grant. It generates a `private_key_jwt` key with WebCrypto, signs the client
+assertions, and polls following the server's rules (`interval`, `slow_down`, 429
+`Retry-After`, expiry, Ctrl-C). Refusals are typed errors.
+
+```ts
+import { startBackchannel, waitForBackchannelToken, createBindingCode } from '@cboxdk/id-js/agent';
+
+const code = createBindingCode(); // e.g. "K7QM", shown beside Approve
+const authorization = await startBackchannel({
+  issuer, client, loginHint: 'ada@acme.com', scope: 'openid mcp:read',
+  bindingMessage: `Brain CLI: ${code}`, resource: 'https://app.cboxbrain.com/mcp',
+});
+console.log(`Approve in Cbox ID. Check that it shows ${code}.`);
+const tokens = await waitForBackchannelToken({ issuer, client, authorization });
+```
+
+Self-registered clients must send `resource` and `binding_message`. Register with
+`private_key_jwt` for CIBA: a keyless (`none`) client can use CIBA only where the resource
+allows it, and is otherwise refused with `invalid_target`.
+
+See [docs/ciba-and-device-grant.md](docs/ciba-and-device-grant.md) for when to use each flow,
+a complete Node CLI and the error table.
+
 ## In the browser (publishable keys)
 
 Everything above needs a server: it holds your client secret. A **publishable key** is the

package/dist/agent.cjs

@@ -0,0 +1,613 @@
+'use strict';
+
+var jose = require('jose');
+
+// src/errors.ts
+var CboxIdError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = new.target.name;
+  }
+};
+var ConfigurationError = class extends CboxIdError {
+};
+var AuthenticationError = class extends CboxIdError {
+  constructor(message, error, errorDescription, status, retryAfter) {
+    super(message);
+    this.error = error;
+    this.errorDescription = errorDescription;
+    this.status = status;
+    this.retryAfter = retryAfter;
+  }
+  error;
+  errorDescription;
+  status;
+  retryAfter;
+  /** Whether waiting `retryAfter` seconds and repeating the same request is worth it. */
+  get isRateLimited() {
+    return this.status === 429;
+  }
+};
+
+// src/issuer.ts
+function assertSecureIssuer(issuer) {
+  let url;
+  try {
+    url = new URL(issuer);
+  } catch {
+    throw new ConfigurationError("Cbox ID config `issuer` is not a valid URL.");
+  }
+  if (url.protocol === "https:") {
+    return;
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]" || url.hostname === "::1";
+  if (url.protocol === "http:" && loopback) {
+    return;
+  }
+  throw new ConfigurationError(
+    `Cbox ID config \`issuer\` must be https (got ${url.protocol}//${url.hostname}).`
+  );
+}
+
+// src/agent/errors.ts
+var AgentGrantError = class extends AuthenticationError {
+};
+var AccessDeniedError = class extends AgentGrantError {
+};
+var ExpiredTokenError = class extends AgentGrantError {
+};
+var InvalidGrantError = class extends AgentGrantError {
+};
+var InvalidTargetError = class extends AgentGrantError {
+};
+var InvalidClientError = class extends AgentGrantError {
+};
+var UnknownUserIdError = class extends AgentGrantError {
+};
+var InvalidBindingMessageError = class extends AgentGrantError {
+};
+var SlowDownError = class extends AgentGrantError {
+};
+var GrantCancelledError = class extends CboxIdError {
+};
+var BY_CODE = {
+  access_denied: AccessDeniedError,
+  expired_token: ExpiredTokenError,
+  invalid_grant: InvalidGrantError,
+  invalid_target: InvalidTargetError,
+  invalid_client: InvalidClientError,
+  unknown_user_id: UnknownUserIdError,
+  invalid_binding_message: InvalidBindingMessageError,
+  slow_down: SlowDownError
+};
+async function readOAuthFailure(response) {
+  const text = await response.text().catch(() => "");
+  let error;
+  let errorDescription;
+  try {
+    const parsed = JSON.parse(text);
+    if (typeof parsed === "object" && parsed !== null) {
+      const record = parsed;
+      error = typeof record["error"] === "string" ? record["error"] : void 0;
+      errorDescription = typeof record["error_description"] === "string" ? record["error_description"] : void 0;
+    }
+  } catch {
+  }
+  if (response.status === 429 && error === void 0) {
+    error = "slow_down";
+  }
+  const header = response.headers.get("retry-after");
+  const retryAfter = header !== null && /^\d+$/.test(header.trim()) ? Number(header.trim()) : void 0;
+  return { error, errorDescription, status: response.status, retryAfter };
+}
+function grantError(failure, fallback) {
+  const Klass = (failure.error !== void 0 ? BY_CODE[failure.error] : void 0) ?? AgentGrantError;
+  const detail = failure.error ?? `HTTP ${failure.status}`;
+  return new Klass(`${fallback}: ${detail}`, failure.error, failure.errorDescription, failure.status, failure.retryAfter);
+}
+
+// src/agent/http.ts
+async function discoverAuthorizationServer(issuer, options = {}) {
+  if (!issuer) {
+    throw new ConfigurationError("An `issuer` is required.");
+  }
+  assertSecureIssuer(issuer);
+  const url = `${trimSlash(issuer)}/.well-known/oauth-authorization-server`;
+  const response = await send(url, { method: "GET", headers: { accept: "application/json" } }, options);
+  if (!response.ok) {
+    throw new AuthenticationError(`Discovery request failed with status ${response.status}.`, void 0, void 0, response.status);
+  }
+  let doc;
+  try {
+    doc = await response.json();
+  } catch {
+    throw new AuthenticationError("The authorization server metadata was not JSON.");
+  }
+  if (typeof doc !== "object" || doc === null) {
+    throw new AuthenticationError("The authorization server metadata was not an object.");
+  }
+  const metadata = doc;
+  if (typeof metadata.issuer !== "string" || trimSlash(metadata.issuer) !== trimSlash(issuer)) {
+    throw new AuthenticationError(`The authorization server metadata is for a different issuer (${String(metadata.issuer)}).`);
+  }
+  if (typeof metadata.token_endpoint !== "string" || metadata.token_endpoint === "") {
+    throw new AuthenticationError("The authorization server metadata has no token_endpoint.");
+  }
+  return metadata;
+}
+function resolveMetadata(options) {
+  return options.metadata !== void 0 ? Promise.resolve(options.metadata) : discoverAuthorizationServer(options.issuer, options);
+}
+function requireEndpoint(metadata, name, what) {
+  const value = metadata[name];
+  if (typeof value !== "string" || value === "") {
+    throw new ConfigurationError(`This Cbox ID instance does not advertise a ${name}, so it does not support ${what}.`);
+  }
+  return value;
+}
+async function send(url, init, options) {
+  const fetchImpl = options.fetch ?? globalThis.fetch;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 1e4);
+  const onAbort = () => controller.abort();
+  if (options.signal?.aborted === true) {
+    clearTimeout(timer);
+    throw new GrantCancelledError("The request was cancelled.");
+  }
+  options.signal?.addEventListener("abort", onAbort, { once: true });
+  try {
+    return await fetchImpl(url, { ...init, signal: controller.signal });
+  } catch (error) {
+    if (options.signal?.aborted === true) {
+      throw new GrantCancelledError("The request was cancelled.");
+    }
+    if (controller.signal.aborted) {
+      throw new AuthenticationError(`The request to ${new URL(url).origin} timed out.`);
+    }
+    throw new AuthenticationError(`The request to ${new URL(url).origin} failed: ${String(error)}`);
+  } finally {
+    clearTimeout(timer);
+    options.signal?.removeEventListener("abort", onAbort);
+  }
+}
+function trimSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+
+// src/pkce.ts
+function base64url(bytes) {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomToken(bytes = 32) {
+  return base64url(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+
+// src/agent/client-auth.ts
+async function generateClientKeyPair(alg = "ES256") {
+  const { publicKey, privateKey } = await jose.generateKeyPair(alg, { extractable: true });
+  const publicBare = await jose.exportJWK(publicKey);
+  const kid = await jose.calculateJwkThumbprint(publicBare, "sha256");
+  const publicJwk = { ...publicBare, kid, alg, use: "sig" };
+  const privateJwk = { ...await jose.exportJWK(privateKey), kid, alg, use: "sig" };
+  return { alg, kid, publicJwk, privateJwk, privateKey };
+}
+async function createClientAssertion(auth, audience, options = {}) {
+  const lifetime = Math.min(Math.max(options.lifetimeSeconds ?? 60, 1), 60);
+  const nowSeconds = Math.floor((options.now ?? Date.now)() / 1e3);
+  const { key, alg, kid } = await signingKey(auth);
+  const header = { alg };
+  if (kid !== void 0) {
+    header.kid = kid;
+  }
+  return new jose.SignJWT({}).setProtectedHeader(header).setIssuer(auth.clientId).setSubject(auth.clientId).setAudience(audience).setJti(randomToken(16)).setIssuedAt(nowSeconds).setExpirationTime(nowSeconds + lifetime).sign(key);
+}
+async function applyClientAuth(auth, body, headers, audience) {
+  if (!auth.clientId) {
+    throw new ConfigurationError("A `clientId` is required.");
+  }
+  switch (auth.method) {
+    case "private_key_jwt":
+      body.set("client_id", auth.clientId);
+      body.set("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
+      body.set("client_assertion", await createClientAssertion(auth, audience));
+      return;
+    case "client_secret_basic":
+      if (!auth.clientSecret) {
+        throw new ConfigurationError("`client_secret_basic` needs a `clientSecret`.");
+      }
+      headers["authorization"] = `Basic ${btoa(`${formEncode(auth.clientId)}:${formEncode(auth.clientSecret)}`)}`;
+      return;
+    case "client_secret_post":
+      if (!auth.clientSecret) {
+        throw new ConfigurationError("`client_secret_post` needs a `clientSecret`.");
+      }
+      body.set("client_id", auth.clientId);
+      body.set("client_secret", auth.clientSecret);
+      return;
+    case "none":
+      body.set("client_id", auth.clientId);
+      return;
+  }
+}
+async function signingKey(auth) {
+  const source = auth.privateKey;
+  if (isCryptoKey(source)) {
+    const alg2 = auth.alg ?? algFromCryptoKey(source);
+    return { key: source, alg: alg2, kid: auth.kid };
+  }
+  if (typeof source !== "object" || source === null || typeof source.d !== "string") {
+    throw new ConfigurationError("`privateKey` must be a CryptoKey or a private JWK (with `d`).");
+  }
+  const alg = auth.alg ?? algFromJwk(source);
+  const key = await jose.importJWK(source, alg);
+  return { key, alg, kid: auth.kid ?? (typeof source.kid === "string" ? source.kid : void 0) };
+}
+function isCryptoKey(value) {
+  return typeof CryptoKey !== "undefined" && value instanceof CryptoKey;
+}
+function algFromCryptoKey(key) {
+  if (key.algorithm.name === "ECDSA") {
+    return "ES256";
+  }
+  if (key.algorithm.name === "RSASSA-PKCS1-v1_5") {
+    return "RS256";
+  }
+  throw new ConfigurationError(`Unsupported client key algorithm ${key.algorithm.name}; use ES256 or RS256.`);
+}
+function algFromJwk(jwk) {
+  if (jwk.alg === "ES256" || jwk.alg === "RS256") {
+    return jwk.alg;
+  }
+  if (jwk.alg === void 0 && jwk.kty === "EC" && jwk.crv === "P-256") {
+    return "ES256";
+  }
+  if (jwk.alg === void 0 && jwk.kty === "RSA") {
+    return "RS256";
+  }
+  throw new ConfigurationError("The private JWK is not an ES256 (P-256) or RS256 key.");
+}
+function formEncode(value) {
+  return encodeURIComponent(value).replace(/%20/g, "+");
+}
+
+// src/agent/register.ts
+var CIBA_GRANT_TYPE = "urn:openid:params:grant-type:ciba";
+var DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+async function registerAgentClient(options) {
+  if (!options.clientName) {
+    throw new ConfigurationError("`clientName` is required.");
+  }
+  if (options.grantTypes.length === 0) {
+    throw new ConfigurationError("`grantTypes` must name at least one grant.");
+  }
+  const metadata = await resolveMetadata(options);
+  const endpoint = requireEndpoint(metadata, "registration_endpoint", "dynamic client registration");
+  const method = options.tokenEndpointAuthMethod ?? "private_key_jwt";
+  const keyPair = method === "private_key_jwt" ? options.keyPair ?? await generateClientKeyPair(options.alg ?? "ES256") : null;
+  const document = {
+    ...options.extraMetadata,
+    client_name: options.clientName,
+    grant_types: options.grantTypes,
+    token_endpoint_auth_method: method,
+    // Neither CIBA nor the device grant has a redirect; say so rather than let the server
+    // assume an authorization-code client.
+    redirect_uris: [],
+    response_types: []
+  };
+  if (options.scope !== void 0) {
+    document["scope"] = scopeString(options.scope);
+  }
+  if (keyPair !== null) {
+    document["jwks"] = { keys: [keyPair.publicJwk] };
+  }
+  const headers = { "content-type": "application/json", accept: "application/json" };
+  if (options.initialAccessToken) {
+    headers["authorization"] = `Bearer ${options.initialAccessToken}`;
+  }
+  const response = await send(endpoint, { method: "POST", headers, body: JSON.stringify(document) }, options);
+  if (!response.ok) {
+    throw grantError(await readOAuthFailure(response), "Client registration failed");
+  }
+  const raw = await response.json().catch(() => null);
+  const clientId = raw?.["client_id"];
+  if (raw === null || typeof clientId !== "string" || clientId === "") {
+    throw new AuthenticationError("The registration response carried no client_id.");
+  }
+  const clientSecret = typeof raw["client_secret"] === "string" ? raw["client_secret"] : null;
+  const registeredMethod = typeof raw["token_endpoint_auth_method"] === "string" ? raw["token_endpoint_auth_method"] : method;
+  let auth;
+  if (keyPair !== null) {
+    auth = { method: "private_key_jwt", clientId, privateKey: keyPair.privateKey, alg: keyPair.alg, kid: keyPair.kid };
+  } else if (clientSecret !== null) {
+    auth = { method: "client_secret_basic", clientId, clientSecret };
+  } else {
+    auth = { method: "none", clientId };
+  }
+  return {
+    clientId,
+    clientSecret,
+    registrationAccessToken: typeof raw["registration_access_token"] === "string" ? raw["registration_access_token"] : null,
+    registrationClientUri: typeof raw["registration_client_uri"] === "string" ? raw["registration_client_uri"] : null,
+    tokenEndpointAuthMethod: registeredMethod,
+    grantTypes: Array.isArray(raw["grant_types"]) ? raw["grant_types"].filter((g) => typeof g === "string") : options.grantTypes,
+    scope: typeof raw["scope"] === "string" ? raw["scope"] : null,
+    keyPair,
+    auth,
+    raw
+  };
+}
+function scopeString(scope) {
+  return (typeof scope === "string" ? scope.split(/\s+/) : scope).filter((s) => s !== "").join(" ");
+}
+
+// src/agent/grants.ts
+async function startBackchannel(options) {
+  const now = Date.now();
+  const metadata = await resolveMetadata(options);
+  const endpoint = requireEndpoint(metadata, "backchannel_authentication_endpoint", "CIBA");
+  if (!options.loginHint) {
+    throw new ConfigurationError("`loginHint` is required.");
+  }
+  const resource = resourceList(options.resource);
+  const body = new URLSearchParams({ login_hint: options.loginHint, scope: scopeString(options.scope) });
+  if (options.bindingMessage !== "") {
+    body.set("binding_message", options.bindingMessage);
+  }
+  for (const r of resource) {
+    body.append("resource", r);
+  }
+  if (options.requestedExpiry !== void 0) {
+    body.set("requested_expiry", String(options.requestedExpiry));
+  }
+  if (options.nonce !== void 0 && options.nonce !== "") {
+    body.set("nonce", options.nonce);
+  }
+  const payload = await postForm(endpoint, body, options, metadata, "Backchannel authentication request failed");
+  const authReqId = payload["auth_req_id"];
+  if (typeof authReqId !== "string" || authReqId === "") {
+    throw new AuthenticationError("The backchannel authentication response carried no auth_req_id.");
+  }
+  const expiresIn = positiveNumber(payload["expires_in"]) ?? 120;
+  return {
+    authReqId,
+    expiresIn,
+    // CIBA Core §7.3: absent means 5 seconds.
+    interval: positiveNumber(payload["interval"]) ?? 5,
+    expiresAt: now + expiresIn * 1e3,
+    resource
+  };
+}
+async function pollBackchannel(options) {
+  const body = new URLSearchParams({ grant_type: CIBA_GRANT_TYPE, auth_req_id: options.authorization.authReqId });
+  return pollToken(body, options.authorization.resource, options, "Backchannel token request failed");
+}
+async function waitForBackchannelToken(options) {
+  const metadata = await resolveMetadata(options);
+  const authorization = options.authorization;
+  return waitLoop(authorization, options, () => pollBackchannel({ ...options, metadata }), "backchannel request");
+}
+async function startDeviceAuthorization(options) {
+  const now = Date.now();
+  const metadata = await resolveMetadata(options);
+  const endpoint = requireEndpoint(metadata, "device_authorization_endpoint", "the device grant");
+  const resource = resourceList(options.resource);
+  const body = new URLSearchParams();
+  if (options.scope !== void 0) {
+    body.set("scope", scopeString(options.scope));
+  }
+  for (const r of resource) {
+    body.append("resource", r);
+  }
+  const payload = await postForm(endpoint, body, options, metadata, "Device authorization request failed");
+  const deviceCode = payload["device_code"];
+  const userCode = payload["user_code"];
+  const verificationUri = payload["verification_uri"];
+  if (typeof deviceCode !== "string" || typeof userCode !== "string" || typeof verificationUri !== "string") {
+    throw new AuthenticationError("The device authorization response was incomplete.");
+  }
+  const expiresIn = positiveNumber(payload["expires_in"]) ?? 600;
+  return {
+    deviceCode,
+    userCode,
+    verificationUri,
+    verificationUriComplete: typeof payload["verification_uri_complete"] === "string" ? payload["verification_uri_complete"] : null,
+    expiresIn,
+    // RFC 8628 §3.2: absent means 5 seconds.
+    interval: positiveNumber(payload["interval"]) ?? 5,
+    expiresAt: now + expiresIn * 1e3,
+    resource
+  };
+}
+async function pollDeviceAuthorization(options) {
+  const body = new URLSearchParams({ grant_type: DEVICE_CODE_GRANT_TYPE, device_code: options.authorization.deviceCode });
+  return pollToken(body, options.authorization.resource, options, "Device token request failed");
+}
+async function waitForDeviceToken(options) {
+  const metadata = await resolveMetadata(options);
+  return waitLoop(options.authorization, options, () => pollDeviceAuthorization({ ...options, metadata }), "device code");
+}
+async function refreshAgentTokens(options) {
+  if (!options.refreshToken) {
+    throw new ConfigurationError("`refreshToken` is required.");
+  }
+  const body = new URLSearchParams({ grant_type: "refresh_token", refresh_token: options.refreshToken });
+  if (options.scope !== void 0) {
+    body.set("scope", scopeString(options.scope));
+  }
+  const result = await pollToken(body, resourceList(options.resource), options, "Token refresh failed", false);
+  return result.tokens;
+}
+async function waitLoop(authorization, options, poll, what) {
+  const sleep = options.sleep ?? defaultSleep;
+  const now = options.now ?? Date.now;
+  let intervalMs = Math.max(authorization.interval, 0) * 1e3;
+  let nextWaitMs = intervalMs;
+  for (; ; ) {
+    throwIfAborted(options.signal);
+    if (now() >= authorization.expiresAt) {
+      throw new ExpiredTokenError(`The ${what} expired before it was approved. Start again.`, "expired_token");
+    }
+    await sleep(nextWaitMs, options.signal);
+    throwIfAborted(options.signal);
+    if (now() >= authorization.expiresAt) {
+      throw new ExpiredTokenError(`The ${what} expired before it was approved. Start again.`, "expired_token");
+    }
+    const result = await poll();
+    if (result.status === "complete") {
+      return result.tokens;
+    }
+    if (result.status === "slow_down") {
+      intervalMs += 5e3;
+      nextWaitMs = Math.max(intervalMs, (result.retryAfter ?? 0) * 1e3);
+      continue;
+    }
+    nextWaitMs = intervalMs;
+  }
+}
+async function pollToken(body, resource, options, fallback, polling = true) {
+  const metadata = await resolveMetadata(options);
+  const endpoint = requireEndpoint(metadata, "token_endpoint", "token requests");
+  for (const r of resource) {
+    body.append("resource", r);
+  }
+  const headers = { "content-type": "application/x-www-form-urlencoded", accept: "application/json" };
+  await applyClientAuth(options.client, body, headers, metadata.token_endpoint);
+  const response = await send(endpoint, { method: "POST", headers, body }, options);
+  if (response.ok) {
+    return { status: "complete", tokens: await tokensFrom(response) };
+  }
+  const failure = await readOAuthFailure(response);
+  if (polling && failure.error === "authorization_pending") {
+    return { status: "pending" };
+  }
+  if (polling && failure.error === "slow_down") {
+    return { status: "slow_down", retryAfter: failure.retryAfter ?? null };
+  }
+  throw grantError(failure, fallback);
+}
+async function postForm(endpoint, body, options, metadata, fallback) {
+  const headers = { "content-type": "application/x-www-form-urlencoded", accept: "application/json" };
+  await applyClientAuth(options.client, body, headers, metadata.token_endpoint);
+  const response = await send(endpoint, { method: "POST", headers, body }, options);
+  if (!response.ok) {
+    throw grantError(await readOAuthFailure(response), fallback);
+  }
+  const payload = await response.json().catch(() => null);
+  if (typeof payload !== "object" || payload === null) {
+    throw new AuthenticationError(`${fallback}: the response was not a JSON object.`);
+  }
+  return payload;
+}
+async function tokensFrom(response) {
+  const raw = await response.json().catch(() => null);
+  const accessToken = raw?.["access_token"];
+  if (raw === null || typeof accessToken !== "string" || accessToken === "") {
+    throw new AuthenticationError("The token response carried no access_token.");
+  }
+  return {
+    accessToken,
+    tokenType: typeof raw["token_type"] === "string" ? raw["token_type"] : "Bearer",
+    expiresIn: typeof raw["expires_in"] === "number" ? raw["expires_in"] : null,
+    refreshToken: typeof raw["refresh_token"] === "string" ? raw["refresh_token"] : null,
+    idToken: typeof raw["id_token"] === "string" ? raw["id_token"] : null,
+    scope: typeof raw["scope"] === "string" ? raw["scope"] : null,
+    raw
+  };
+}
+function resourceList(resource) {
+  if (resource === void 0) {
+    return [];
+  }
+  const list = typeof resource === "string" ? [resource] : [...resource];
+  for (const r of list) {
+    let url;
+    try {
+      url = new URL(r);
+    } catch {
+      throw new ConfigurationError(`\`resource\` must be an absolute URI (got ${r}).`);
+    }
+    if (url.hash !== "") {
+      throw new ConfigurationError("`resource` must not contain a fragment.");
+    }
+  }
+  return list;
+}
+function positiveNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : null;
+}
+function throwIfAborted(signal) {
+  if (signal?.aborted === true) {
+    throw new GrantCancelledError("The wait for approval was cancelled.");
+  }
+}
+function defaultSleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted === true) {
+      reject(new GrantCancelledError("The wait for approval was cancelled."));
+      return;
+    }
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(new GrantCancelledError("The wait for approval was cancelled."));
+    };
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
+// src/agent/binding.ts
+var BINDING_CODE_ALPHABET = "ACDEFGHJKMNPQRTUVWXY34679";
+function createBindingCode(length = 4) {
+  if (!Number.isInteger(length) || length < 1 || length > 32) {
+    throw new ConfigurationError("A binding code length must be an integer from 1 to 32.");
+  }
+  const size = BINDING_CODE_ALPHABET.length;
+  const limit = 256 - 256 % size;
+  let code = "";
+  while (code.length < length) {
+    for (const byte of crypto.getRandomValues(new Uint8Array(length * 2))) {
+      if (byte < limit && code.length < length) {
+        code += BINDING_CODE_ALPHABET[byte % size];
+      }
+    }
+  }
+  return code;
+}
+
+exports.AccessDeniedError = AccessDeniedError;
+exports.AgentGrantError = AgentGrantError;
+exports.AuthenticationError = AuthenticationError;
+exports.BINDING_CODE_ALPHABET = BINDING_CODE_ALPHABET;
+exports.CIBA_GRANT_TYPE = CIBA_GRANT_TYPE;
+exports.CboxIdError = CboxIdError;
+exports.ConfigurationError = ConfigurationError;
+exports.DEVICE_CODE_GRANT_TYPE = DEVICE_CODE_GRANT_TYPE;
+exports.ExpiredTokenError = ExpiredTokenError;
+exports.GrantCancelledError = GrantCancelledError;
+exports.InvalidBindingMessageError = InvalidBindingMessageError;
+exports.InvalidClientError = InvalidClientError;
+exports.InvalidGrantError = InvalidGrantError;
+exports.InvalidTargetError = InvalidTargetError;
+exports.SlowDownError = SlowDownError;
+exports.UnknownUserIdError = UnknownUserIdError;
+exports.createBindingCode = createBindingCode;
+exports.createClientAssertion = createClientAssertion;
+exports.discoverAuthorizationServer = discoverAuthorizationServer;
+exports.generateClientKeyPair = generateClientKeyPair;
+exports.pollBackchannel = pollBackchannel;
+exports.pollDeviceAuthorization = pollDeviceAuthorization;
+exports.refreshAgentTokens = refreshAgentTokens;
+exports.registerAgentClient = registerAgentClient;
+exports.startBackchannel = startBackchannel;
+exports.startDeviceAuthorization = startDeviceAuthorization;
+exports.waitForBackchannelToken = waitForBackchannelToken;
+exports.waitForDeviceToken = waitForDeviceToken;
+//# sourceMappingURL=agent.cjs.map
+//# sourceMappingURL=agent.cjs.map