@datalayer/personal-agent-protocol 0.0.0-stage → 0.2.0

package/README.md

@@ -1,3 +1,22 @@
-# Temporary Holding Version
+# @datalayer/personal-agent-protocol
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+TypeScript SDK for Personal Agent Protocol draft 0.1.
+
+```typescript
+import { discoverCompany } from "@datalayer/personal-agent-protocol";
+
+const company = await discoverCompany("example.com");
+```
+
+The current release provides forward-compatible discovery, OAuth, client
+metadata, conversation-event, and Operations v1 models; strict
+duplicate-member rejection; local Direct Sign-In primitives; signed-out
+session start and renewal; and safe company discovery built on Datalayer
+Reactor. It also provides ES256/RS256 JOSE signing and DPoP proof creation and
+verification through the maintained `jose` package. Use
+`buildPapReactor(options, plugins)` to install typed transport, URL-policy,
+protocol-profile, clock, randomness, signer, DPoP proof, protected-key,
+token-store, cache, browser-handoff, and extension-handler contributions, or
+pass an existing Reactor host to `discoverCompany`. Security-dependent
+services have no fallback and fail closed when missing or ambiguous. See the
+repository README for current limits and security guidance.

package/lib/auth.d.ts

@@ -0,0 +1,44 @@
+import { SecretValue, type RandomBytes } from "./sessions.js";
+export interface DirectSignInOptions {
+    readonly authorizationEndpoint: string;
+    readonly issuer: string;
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly scopes: readonly string[];
+    readonly randomBytes?: RandomBytes;
+}
+export interface DirectSignInRequest {
+    readonly authorizationUrl: SecretValue;
+    readonly issuer: string;
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly scopes: readonly string[];
+    readonly state: SecretValue;
+    readonly codeVerifier: SecretValue;
+}
+export declare function buildDirectSignInRequest(options: DirectSignInOptions): Promise<DirectSignInRequest>;
+export interface DirectSignInCallback {
+    readonly code: SecretValue;
+    readonly issuer: string;
+}
+export declare function validateDirectSignInCallback(request: DirectSignInRequest, callbackUrl: string): DirectSignInCallback;
+export interface AuthorizationCodeGrantOptions {
+    readonly code: string;
+    readonly redirectUri: string;
+    readonly codeVerifier: string;
+    readonly sessionId: string;
+    readonly clientId: string;
+    readonly clientAssertion: string;
+}
+export declare class AuthorizationCodeGrant {
+    readonly code: SecretValue;
+    readonly redirectUri: string;
+    readonly codeVerifier: SecretValue;
+    readonly sessionId: string;
+    readonly clientId: string;
+    readonly clientAssertion: SecretValue;
+    constructor(options: AuthorizationCodeGrantOptions);
+    toForm(): URLSearchParams;
+    toJSON(): Record<string, unknown>;
+}
+//# sourceMappingURL=auth.d.ts.map

package/lib/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AA6DpF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,gBAAgB,EAAE,WAAW,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC;CACpC;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,mBAAmB,CAAC,CA6B9B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAWD,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,mBAAmB,EAC5B,WAAW,EAAE,MAAM,GAClB,oBAAoB,CAuCtB;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,qBAAa,sBAAsB;IACjC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC;gBAE1B,OAAO,EAAE,6BAA6B;IAYlD,MAAM,IAAI,eAAe;IAazB,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAYlC"}

package/lib/auth.js

@@ -0,0 +1,168 @@
+import { AuthorizationError } from "./errors.js";
+import { JWT_CLIENT_ASSERTION, SecretValue } from "./sessions.js";
+function defaultRandomBytes(length) {
+    if (!globalThis.crypto) {
+        throw new AuthorizationError("crypto_unavailable", "Web Crypto is required");
+    }
+    return globalThis.crypto.getRandomValues(new Uint8Array(length));
+}
+function entropy(length, randomBytes) {
+    const value = randomBytes(length);
+    if (value.byteLength < length) {
+        throw new AuthorizationError("weak_entropy", `Authorization requires ${length * 8} random bits`);
+    }
+    return value;
+}
+function base64Url(bytes) {
+    const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+    let output = "";
+    for (let index = 0; index < bytes.length; index += 3) {
+        const first = bytes[index] ?? 0;
+        const second = bytes[index + 1];
+        const third = bytes[index + 2];
+        output += alphabet[first >>> 2];
+        output += alphabet[((first & 3) << 4) | ((second ?? 0) >>> 4)];
+        if (second !== undefined) {
+            output += alphabet[((second & 15) << 2) | ((third ?? 0) >>> 6)];
+        }
+        if (third !== undefined) {
+            output += alphabet[third & 63];
+        }
+    }
+    return output;
+}
+function httpsUrl(value, label) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch (cause) {
+        throw new AuthorizationError("invalid_url", `${label} must be an HTTPS URL`, { cause });
+    }
+    if (parsed.protocol !== "https:" || parsed.username || parsed.password) {
+        throw new AuthorizationError("invalid_url", `${label} must be an HTTPS URL`);
+    }
+    return parsed;
+}
+function validScopes(values) {
+    const scopes = [...new Set(values)];
+    const token = /^[\x21\x23-\x5b\x5d-\x7e]+$/;
+    if (scopes.length === 0 || scopes.some((scope) => !token.test(scope))) {
+        throw new AuthorizationError("invalid_scope", "At least one valid OAuth scope is required");
+    }
+    return scopes;
+}
+export async function buildDirectSignInRequest(options) {
+    const randomBytes = options.randomBytes ?? defaultRandomBytes;
+    const state = base64Url(entropy(16, randomBytes));
+    const verifier = base64Url(entropy(32, randomBytes));
+    const challenge = base64Url(new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))));
+    const endpoint = httpsUrl(options.authorizationEndpoint, "authorizationEndpoint");
+    const scopes = validScopes(options.scopes);
+    const clientId = httpsUrl(options.clientId, "clientId").toString();
+    const redirectUri = httpsUrl(options.redirectUri, "redirectUri").toString();
+    const issuer = httpsUrl(options.issuer, "issuer").toString().replace(/\/$/, "");
+    endpoint.searchParams.set("response_type", "code");
+    endpoint.searchParams.set("client_id", clientId);
+    endpoint.searchParams.set("redirect_uri", redirectUri);
+    endpoint.searchParams.set("scope", scopes.join(" "));
+    endpoint.searchParams.set("state", state);
+    endpoint.searchParams.set("code_challenge", challenge);
+    endpoint.searchParams.set("code_challenge_method", "S256");
+    endpoint.hash = "";
+    return {
+        authorizationUrl: new SecretValue(endpoint.toString()),
+        issuer,
+        clientId,
+        redirectUri,
+        scopes,
+        state: new SecretValue(state),
+        codeVerifier: new SecretValue(verifier),
+    };
+}
+function equalConstantTime(left, right) {
+    let difference = left.length ^ right.length;
+    const length = Math.max(left.length, right.length);
+    for (let index = 0; index < length; index += 1) {
+        difference |= (left.charCodeAt(index) || 0) ^ (right.charCodeAt(index) || 0);
+    }
+    return difference === 0;
+}
+export function validateDirectSignInCallback(request, callbackUrl) {
+    const expected = httpsUrl(request.redirectUri, "redirectUri");
+    const callback = httpsUrl(callbackUrl, "callbackUrl");
+    if (callback.hash) {
+        throw new AuthorizationError("invalid_callback", "Authorization callback has a fragment");
+    }
+    if (callback.origin !== expected.origin || callback.pathname !== expected.pathname) {
+        throw new AuthorizationError("redirect_mismatch", "Callback does not match redirect URI");
+    }
+    for (const [key, value] of expected.searchParams) {
+        if (callback.searchParams.get(key) !== value) {
+            throw new AuthorizationError("redirect_mismatch", "Callback changed redirect URI parameters");
+        }
+    }
+    for (const key of ["code", "state", "iss", "error"]) {
+        if (callback.searchParams.getAll(key).length > 1) {
+            throw new AuthorizationError("invalid_callback", "Authorization callback repeats a security parameter");
+        }
+    }
+    if (callback.searchParams.has("error")) {
+        throw new AuthorizationError("authorization_denied", "Company did not authorize the request");
+    }
+    if (!equalConstantTime(callback.searchParams.get("state") ?? "", request.state.reveal())) {
+        throw new AuthorizationError("state_mismatch", "Authorization state does not match");
+    }
+    if (callback.searchParams.get("iss") !== request.issuer) {
+        throw new AuthorizationError("issuer_mismatch", "Authorization issuer does not match");
+    }
+    const code = callback.searchParams.get("code");
+    if (!code) {
+        throw new AuthorizationError("invalid_callback", "Authorization callback has no code");
+    }
+    return { code: new SecretValue(code), issuer: request.issuer };
+}
+export class AuthorizationCodeGrant {
+    code;
+    redirectUri;
+    codeVerifier;
+    sessionId;
+    clientId;
+    clientAssertion;
+    constructor(options) {
+        this.code = new SecretValue(options.code);
+        this.redirectUri = httpsUrl(options.redirectUri, "redirectUri").toString();
+        this.codeVerifier = new SecretValue(options.codeVerifier);
+        if (!/^[A-Za-z0-9_-]{1,256}$/.test(options.sessionId)) {
+            throw new AuthorizationError("invalid_session_id", "Invalid PAP session ID");
+        }
+        this.sessionId = options.sessionId;
+        this.clientId = httpsUrl(options.clientId, "clientId").toString();
+        this.clientAssertion = new SecretValue(options.clientAssertion);
+    }
+    toForm() {
+        return new URLSearchParams({
+            grant_type: "authorization_code",
+            code: this.code.reveal(),
+            redirect_uri: this.redirectUri,
+            code_verifier: this.codeVerifier.reveal(),
+            session_id: this.sessionId,
+            client_id: this.clientId,
+            client_assertion_type: JWT_CLIENT_ASSERTION,
+            client_assertion: this.clientAssertion.reveal(),
+        });
+    }
+    toJSON() {
+        return {
+            grant_type: "authorization_code",
+            code: this.code,
+            redirect_uri: this.redirectUri,
+            code_verifier: this.codeVerifier,
+            session_id: this.sessionId,
+            client_id: this.clientId,
+            client_assertion_type: JWT_CLIENT_ASSERTION,
+            client_assertion: this.clientAssertion,
+        };
+    }
+}
+//# sourceMappingURL=auth.js.map

package/lib/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAoB,MAAM,eAAe,CAAC;AAEpF,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,wBAAwB,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,WAAwB;IACvD,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,UAAU,GAAG,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,CAC1B,cAAc,EACd,0BAA0B,MAAM,GAAG,CAAC,cAAc,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,MAAM,QAAQ,GAAG,kEAAkE,CAAC;IACpF,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC/B,MAAM,IAAI,QAAQ,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;QAChC,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,KAAa;IAC5C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,kBAAkB,CAAC,aAAa,EAAE,GAAG,KAAK,uBAAuB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvE,MAAM,IAAI,kBAAkB,CAAC,aAAa,EAAE,GAAG,KAAK,uBAAuB,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,MAAyB;IAC5C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,6BAA6B,CAAC;IAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,kBAAkB,CAAC,eAAe,EAAE,4CAA4C,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAqBD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAA4B;IAE5B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC9D,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,SAAS,CACzB,IAAI,UAAU,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CACrG,CAAC;IACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnE,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChF,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACnD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACjD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACvD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IACvD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAC3D,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC;IACnB,OAAO;QACL,gBAAgB,EAAE,IAAI,WAAW,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACtD,MAAM;QACN,QAAQ;QACR,WAAW;QACX,MAAM;QACN,KAAK,EAAE,IAAI,WAAW,CAAC,KAAK,CAAC;QAC7B,YAAY,EAAE,IAAI,WAAW,CAAC,QAAQ,CAAC;KACxC,CAAC;AACJ,CAAC;AAOD,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAa;IACpD,IAAI,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACnD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,UAAU,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,OAA4B,EAC5B,WAAmB;IAEnB,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,uCAAuC,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACnF,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,EAAE,sCAAsC,CAAC,CAAC;IAC5F,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACjD,IAAI,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;YAC7C,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,EACnB,0CAA0C,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,qDAAqD,CACtD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,kBAAkB,CAAC,sBAAsB,EAAE,uCAAuC,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,oCAAoC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACxD,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,oCAAoC,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AACjE,CAAC;AAWD,MAAM,OAAO,sBAAsB;IACxB,IAAI,CAAc;IAClB,WAAW,CAAS;IACpB,YAAY,CAAc;IAC1B,SAAS,CAAS;IAClB,QAAQ,CAAS;IACjB,eAAe,CAAc;IAEtC,YAAY,OAAsC;QAChD,IAAI,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3E,IAAI,CAAC,YAAY,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,wBAAwB,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClE,IAAI,CAAC,eAAe,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAClE,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,eAAe,CAAC;YACzB,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YACxB,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;YACzC,UAAU,EAAE,IAAI,CAAC,SAAS;YAC1B,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,qBAAqB,EAAE,oBAAoB;YAC3C,gBAAgB,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;IAED,MAAM;QACJ,OAAO;YACL,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,UAAU,EAAE,IAAI,CAAC,SAAS;YAC1B,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,qBAAqB,EAAE,oBAAoB;YAC3C,gBAAgB,EAAE,IAAI,CAAC,eAAe;SACvC,CAAC;IACJ,CAAC;CACF"}

package/lib/crypto.d.ts

@@ -0,0 +1,57 @@
+import { type JWK, type KeyInput } from "jose";
+import type { DpopProofProvider, DpopProofRequest, Signer } from "./reactor.js";
+import { SecretValue } from "./sessions.js";
+export type JoseAlgorithm = "ES256" | "RS256";
+export interface JoseSignerOptions {
+    readonly privateKey: KeyInput;
+    readonly algorithm?: JoseAlgorithm;
+    readonly keyId?: string;
+}
+/** Sign PAP assertions with an injected asymmetric private key or handle. */
+export declare class JoseSigner implements Signer {
+    #private;
+    constructor(options: JoseSignerOptions);
+    sign(claims: Readonly<Record<string, unknown>>, _options: {
+        readonly purpose: string;
+    }): Promise<SecretValue>;
+}
+export interface DpopKeyMaterial {
+    readonly privateKey: KeyInput;
+    readonly publicJwk: JWK;
+    readonly algorithm?: JoseAlgorithm;
+}
+export type DpopKeyResolver = (request: DpopProofRequest) => DpopKeyMaterial | Promise<DpopKeyMaterial>;
+export interface JoseDpopProofProviderOptions {
+    readonly resolveKey: DpopKeyResolver;
+    readonly now?: () => Date;
+    readonly randomBytes?: (length: number) => Uint8Array;
+}
+/** Create fresh RFC 9449 proofs using per-user/company key material. */
+export declare class JoseDpopProofProvider implements DpopProofProvider {
+    #private;
+    constructor(options: JoseDpopProofProviderOptions);
+    create(request: DpopProofRequest): Promise<SecretValue>;
+}
+export interface DpopReplayCache {
+    markOnce(key: string, options: {
+        readonly expiresAt: Date;
+    }): Promise<boolean>;
+}
+export interface VerifyDpopProofOptions {
+    readonly method: string;
+    readonly url: string;
+    readonly replayCache: DpopReplayCache;
+    readonly accessToken?: SecretValue;
+    readonly nonce?: string;
+    readonly now?: Date;
+    readonly acceptanceWindowSeconds?: number;
+}
+export interface VerifiedDpopProof {
+    readonly jti: string;
+    readonly issuedAt: Date;
+    readonly publicJwk: JWK;
+    readonly keyThumbprint: string;
+}
+/** Verify signature, binding, freshness, nonce, token hash, and replay state. */
+export declare function verifyDpopProof(proof: SecretValue | string, options: VerifyDpopProofOptions): Promise<VerifiedDpopProof>;
+//# sourceMappingURL=crypto.d.ts.map

package/lib/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,GAAG,EAER,KAAK,QAAQ,EACd,MAAM,MAAM,CAAC;AAGd,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,OAAO,CAAC;AAgE9C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,6EAA6E;AAC7E,qBAAa,UAAW,YAAW,MAAM;;gBAK3B,OAAO,EAAE,iBAAiB;IAMhC,IAAI,CACR,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,QAAQ,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GACrC,OAAO,CAAC,WAAW,CAAC;CAcxB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;CACpC;AAED,MAAM,MAAM,eAAe,GAAG,CAC5B,OAAO,EAAE,gBAAgB,KACtB,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;AAEhD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;CACvD;AAED,wEAAwE;AACxE,qBAAa,qBAAsB,YAAW,iBAAiB;;gBAKjD,OAAO,EAAE,4BAA4B;IAM3C,MAAM,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC;CA2B9D;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAChF;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAC3C;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,iFAAiF;AACjF,wBAAsB,eAAe,CACnC,KAAK,EAAE,WAAW,GAAG,MAAM,EAC3B,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CA6D5B"}

package/lib/crypto.js

@@ -0,0 +1,188 @@
+import { SignJWT, calculateJwkThumbprint, decodeProtectedHeader, importJWK, jwtVerify, } from "jose";
+import { ProofError } from "./errors.js";
+import { SecretValue } from "./sessions.js";
+const privateJwkMembers = new Set(["d", "p", "q", "dp", "dq", "qi", "oth", "k"]);
+function algorithm(value) {
+    if (value !== "ES256" && value !== "RS256") {
+        throw new TypeError("PAP JOSE algorithms must be ES256 or RS256");
+    }
+    return value;
+}
+function publicJwk(value, alg) {
+    for (const member of privateJwkMembers) {
+        if (member in value) {
+            throw new TypeError("DPoP public JWK must not contain private key material");
+        }
+    }
+    const expected = alg === "ES256" ? "EC" : "RSA";
+    if (value.kty !== expected)
+        throw new TypeError(`${alg} requires a ${expected} public JWK`);
+    if (alg === "ES256") {
+        if (value.crv !== "P-256" || !value.x || !value.y) {
+            throw new TypeError("ES256 requires a complete P-256 public JWK");
+        }
+    }
+    else if (!value.n || !value.e) {
+        throw new TypeError("RS256 requires a complete RSA public JWK");
+    }
+    return { ...value };
+}
+function normalizedHtu(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch (cause) {
+        throw new ProofError("invalid_htu", "DPoP target must be an HTTPS URL", { cause });
+    }
+    if (url.protocol !== "https:" || url.username || url.password) {
+        throw new ProofError("invalid_htu", "DPoP target must be an HTTPS URL");
+    }
+    url.search = "";
+    url.hash = "";
+    return url.href;
+}
+function base64Url(bytes) {
+    let binary = "";
+    for (const value of bytes)
+        binary += String.fromCharCode(value);
+    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+}
+function randomBytes(length) {
+    if (!globalThis.crypto)
+        throw new ProofError("crypto_unavailable", "Web Crypto is required");
+    return globalThis.crypto.getRandomValues(new Uint8Array(length));
+}
+async function accessTokenHash(token) {
+    if (!globalThis.crypto)
+        throw new ProofError("crypto_unavailable", "Web Crypto is required");
+    const digest = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(token.reveal()));
+    return base64Url(new Uint8Array(digest));
+}
+/** Sign PAP assertions with an injected asymmetric private key or handle. */
+export class JoseSigner {
+    #privateKey;
+    #algorithm;
+    #keyId;
+    constructor(options) {
+        this.#privateKey = options.privateKey;
+        this.#algorithm = algorithm(options.algorithm ?? "ES256");
+        this.#keyId = options.keyId;
+    }
+    async sign(claims, _options) {
+        try {
+            const token = await new SignJWT(claims)
+                .setProtectedHeader({
+                alg: this.#algorithm,
+                typ: "JWT",
+                ...(this.#keyId === undefined ? {} : { kid: this.#keyId }),
+            })
+                .sign(this.#privateKey);
+            return new SecretValue(token);
+        }
+        catch (cause) {
+            throw new ProofError("signing_failed", "Could not sign PAP assertion", { cause });
+        }
+    }
+}
+/** Create fresh RFC 9449 proofs using per-user/company key material. */
+export class JoseDpopProofProvider {
+    #resolveKey;
+    #now;
+    #randomBytes;
+    constructor(options) {
+        this.#resolveKey = options.resolveKey;
+        this.#now = options.now ?? (() => new Date());
+        this.#randomBytes = options.randomBytes ?? randomBytes;
+    }
+    async create(request) {
+        const material = await this.#resolveKey(request);
+        const alg = algorithm(material.algorithm ?? "ES256");
+        const jwk = publicJwk(material.publicJwk, alg);
+        const entropy = this.#randomBytes(16);
+        if (entropy.byteLength < 16) {
+            throw new ProofError("weak_randomness", "DPoP proof IDs require 128 random bits");
+        }
+        const claims = {
+            jti: base64Url(entropy),
+            htm: request.method.toUpperCase(),
+            htu: normalizedHtu(request.url),
+            iat: Math.floor(this.#now().getTime() / 1000),
+            ...(request.nonce === undefined ? {} : { nonce: request.nonce }),
+            ...(request.accessToken === undefined
+                ? {}
+                : { ath: await accessTokenHash(request.accessToken) }),
+        };
+        try {
+            const token = await new SignJWT(claims)
+                .setProtectedHeader({ typ: "dpop+jwt", alg, jwk })
+                .sign(material.privateKey);
+            return new SecretValue(token);
+        }
+        catch (cause) {
+            throw new ProofError("signing_failed", "Could not sign DPoP proof", { cause });
+        }
+    }
+}
+/** Verify signature, binding, freshness, nonce, token hash, and replay state. */
+export async function verifyDpopProof(proof, options) {
+    const compact = proof instanceof SecretValue ? proof.reveal() : proof;
+    const now = options.now ?? new Date();
+    const windowSeconds = options.acceptanceWindowSeconds ?? 60;
+    if (!Number.isInteger(windowSeconds) || windowSeconds <= 0) {
+        throw new RangeError("acceptanceWindowSeconds must be a positive integer");
+    }
+    let jwk;
+    let payload;
+    try {
+        const header = decodeProtectedHeader(compact);
+        const alg = algorithm(header.alg ?? "");
+        if (header.typ !== "dpop+jwt" || typeof header.jwk !== "object") {
+            throw new ProofError("invalid_dpop_proof", "DPoP protected header is invalid");
+        }
+        jwk = publicJwk(header.jwk, alg);
+        const key = await importJWK(jwk, alg);
+        ({ payload } = await jwtVerify(compact, key, {
+            algorithms: [alg],
+            typ: "dpop+jwt",
+            requiredClaims: ["jti", "htm", "htu", "iat"],
+        }));
+    }
+    catch (cause) {
+        if (cause instanceof ProofError)
+            throw cause;
+        throw new ProofError("invalid_dpop_proof", "DPoP signature or claims are invalid", {
+            cause,
+        });
+    }
+    if (typeof payload.jti !== "string" || !payload.jti || typeof payload.iat !== "number") {
+        throw new ProofError("invalid_dpop_proof", "DPoP proof identity is invalid");
+    }
+    const issuedAt = new Date(payload.iat * 1000);
+    const difference = Math.abs(now.getTime() - issuedAt.getTime());
+    if (difference > windowSeconds * 1000) {
+        throw new ProofError("invalid_dpop_proof", "DPoP proof is outside the acceptance window");
+    }
+    if (payload.htm !== options.method.toUpperCase() || payload.htu !== normalizedHtu(options.url)) {
+        throw new ProofError("invalid_dpop_proof", "DPoP proof does not match the request");
+    }
+    if (options.nonce !== undefined && payload.nonce !== options.nonce) {
+        throw new ProofError("use_dpop_nonce", "DPoP proof nonce is missing or invalid");
+    }
+    if (options.accessToken !== undefined) {
+        if (payload.ath !== (await accessTokenHash(options.accessToken))) {
+            throw new ProofError("invalid_dpop_proof", "DPoP access-token hash is invalid");
+        }
+    }
+    else if (payload.ath !== undefined) {
+        throw new ProofError("invalid_dpop_proof", "Token-endpoint DPoP proof must not contain ath");
+    }
+    const keyThumbprint = await calculateJwkThumbprint(jwk);
+    if (!(await options.replayCache.markOnce(`${keyThumbprint}:${payload.jti}`, {
+        expiresAt: new Date(now.getTime() + windowSeconds * 1000),
+    }))) {
+        throw new ProofError("invalid_dpop_proof", "DPoP proof has already been used");
+    }
+    return { jti: payload.jti, issuedAt, publicJwk: jwk, keyThumbprint };
+}
+//# sourceMappingURL=crypto.js.map

package/lib/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,sBAAsB,EACtB,qBAAqB,EACrB,SAAS,EACT,SAAS,GAIV,MAAM,MAAM,CAAC;AAEd,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAI5C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAEjF,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,KAAU,EAAE,GAAkB;IAC/C,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACvC,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;YACpB,MAAM,IAAI,SAAS,CAAC,uDAAuD,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IAChD,IAAI,KAAK,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,GAAG,eAAe,QAAQ,aAAa,CAAC,CAAC;IAC5F,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,UAAU,CAAC,aAAa,EAAE,kCAAkC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9D,MAAM,IAAI,UAAU,CAAC,aAAa,EAAE,kCAAkC,CAAC,CAAC;IAC1E,CAAC;IACD,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,wBAAwB,CAAC,CAAC;IAC7F,OAAO,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAAkB;IAC/C,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,wBAAwB,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAClD,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CACzC,CAAC;IACF,OAAO,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3C,CAAC;AAQD,6EAA6E;AAC7E,MAAM,OAAO,UAAU;IACZ,WAAW,CAAW;IACtB,UAAU,CAAgB;IAC1B,MAAM,CAAqB;IAEpC,YAAY,OAA0B;QACpC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,IAAI,CACR,MAAyC,EACzC,QAAsC;QAEtC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,MAAoB,CAAC;iBAClD,kBAAkB,CAAC;gBAClB,GAAG,EAAE,IAAI,CAAC,UAAU;gBACpB,GAAG,EAAE,KAAK;gBACV,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;aAC3D,CAAC;iBACD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1B,OAAO,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,8BAA8B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;CACF;AAkBD,wEAAwE;AACxE,MAAM,OAAO,qBAAqB;IACvB,WAAW,CAAkB;IAC7B,IAAI,CAAa;IACjB,YAAY,CAAiC;IAEtD,YAAY,OAAqC;QAC/C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,IAAI,WAAW,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAyB;QACpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,UAAU,GAAG,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,wCAAwC,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,MAAM,GAAe;YACzB,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC;YACvB,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YACjC,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;YAC/B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;YAC7C,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YAChE,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;SACzD,CAAC;QACF,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;iBACpC,kBAAkB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;iBACjD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC7B,OAAO,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,2BAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;CACF;AAuBD,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAA2B,EAC3B,OAA+B;IAE/B,MAAM,OAAO,GAAG,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACtE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACtC,MAAM,aAAa,GAAG,OAAO,CAAC,uBAAuB,IAAI,EAAE,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,UAAU,CAAC,oDAAoD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,GAAG,KAAK,UAAU,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAChE,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,kCAAkC,CAAC,CAAC;QACjF,CAAC;QACD,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE;YAC3C,UAAU,EAAE,CAAC,GAAG,CAAC;YACjB,GAAG,EAAE,UAAU;YACf,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;SAC7C,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,UAAU;YAAE,MAAM,KAAK,CAAC;QAC7C,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,sCAAsC,EAAE;YACjF,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACvF,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,gCAAgC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,IAAI,UAAU,GAAG,aAAa,GAAG,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,6CAA6C,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,uCAAuC,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QACnE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,wCAAwC,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,mCAAmC,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,UAAU,CAClB,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACxD,IACE,CAAC,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,aAAa,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE;QACtE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,GAAG,IAAI,CAAC;KAC1D,CAAC,CAAC,EACH,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,kCAAkC,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;AACvE,CAAC"}

package/lib/discovery.d.ts

@@ -0,0 +1,11 @@
+import { type DiscoveredCompany } from "./models.js";
+import type { ReactorPlatformView } from "@datalayer/reactor";
+export interface DiscoveryOptions {
+    readonly reactor?: ReactorPlatformView;
+    readonly fetch?: typeof globalThis.fetch;
+    readonly assertSafeUrl?: (url: URL) => void | Promise<void>;
+    readonly maxRedirects?: number;
+    readonly maxResponseBytes?: number;
+}
+export declare function discoverCompany(domain: string, options?: DiscoveryOptions): Promise<DiscoveredCompany>;
+//# sourceMappingURL=discovery.d.ts.map

package/lib/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,aAAa,CAAC;AASrB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AA8ED,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CA0D5B"}

package/lib/discovery.js

@@ -0,0 +1,100 @@
+import { DiscoveryError, ProtocolValidationError } from "./errors.js";
+import { parseJsonStrict } from "./json.js";
+import { parseDiscoveryDocument, parseOAuthServerMetadata, } from "./models.js";
+import { DiscoveryTransports, UrlSafetyPolicies, buildPapReactor, firstContribution, } from "./reactor.js";
+function normalizeDomain(domain) {
+    const value = domain.replace(/\.$/, "").toLowerCase();
+    if (!value || value.includes("://") || value.includes("/")) {
+        throw new DiscoveryError("invalid_domain", "Discovery requires a DNS domain name");
+    }
+    return value;
+}
+function metadataUrl(issuer) {
+    const parsed = new URL(issuer);
+    const path = parsed.pathname.replace(/\/$/, "");
+    parsed.pathname = `/.well-known/oauth-authorization-server${path}`;
+    parsed.search = "";
+    parsed.hash = "";
+    return parsed;
+}
+async function readJson(initialUrl, transport, urlPolicy, maxRedirects, maxResponseBytes) {
+    let current = initialUrl;
+    for (let redirects = 0; redirects <= maxRedirects; redirects += 1) {
+        await urlPolicy.assertSafe(current);
+        let response;
+        try {
+            response = await transport.fetch(current, {
+                headers: { Accept: "application/json" },
+                redirect: "manual",
+                credentials: "omit",
+            });
+        }
+        catch (cause) {
+            throw new DiscoveryError("request_failed", "Discovery request failed", { cause });
+        }
+        if (response.status >= 300 && response.status < 400) {
+            if (redirects === maxRedirects) {
+                throw new DiscoveryError("too_many_redirects", "Discovery exceeded redirect limit");
+            }
+            const location = response.headers.get("location");
+            if (!location) {
+                throw new DiscoveryError("invalid_redirect", "Discovery redirect has no location");
+            }
+            current = new URL(location, current);
+            continue;
+        }
+        if (!response.ok) {
+            throw new DiscoveryError("http_error", "Discovery endpoint returned an unsuccessful status", { statusCode: response.status });
+        }
+        const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim();
+        if (contentType !== "application/json" && contentType !== "application/poppy+json") {
+            throw new DiscoveryError("invalid_content_type", "Discovery response must be JSON");
+        }
+        const body = await response.text();
+        if (new TextEncoder().encode(body).byteLength > maxResponseBytes) {
+            throw new DiscoveryError("response_too_large", "Discovery response exceeds size limit");
+        }
+        try {
+            return { value: parseJsonStrict(body), finalUrl: current };
+        }
+        catch (cause) {
+            if (cause instanceof ProtocolValidationError)
+                throw cause;
+            throw new ProtocolValidationError("invalid_json", "Response is not valid JSON", {
+                cause,
+            });
+        }
+    }
+    throw new DiscoveryError("too_many_redirects", "Discovery exceeded redirect limit");
+}
+export async function discoverCompany(domain, options = {}) {
+    const requestedDomain = normalizeDomain(domain);
+    const reactor = options.reactor ?? buildPapReactor(options);
+    const transport = firstContribution(reactor, DiscoveryTransports, "discovery transport");
+    const urlPolicy = firstContribution(reactor, UrlSafetyPolicies, "URL safety policy");
+    const maxRedirects = options.maxRedirects ?? 3;
+    const maxBytes = options.maxResponseBytes ?? 100 * 1024;
+    const discovery = await readJson(new URL(`https://${requestedDomain}/.well-known/poppy.json`), transport, urlPolicy, maxRedirects, maxBytes);
+    const document = parseDiscoveryDocument(discovery.value);
+    if (document.organization.domain.replace(/^www\./, "") !==
+        requestedDomain.replace(/^www\./, "")) {
+        throw new DiscoveryError("organization_domain_mismatch", "Discovery organization domain does not match the requested domain");
+    }
+    if (!document.auth) {
+        return { discoveryUrl: discovery.finalUrl.toString(), document };
+    }
+    const metadataResponse = await readJson(metadataUrl(document.auth.issuer), transport, urlPolicy, maxRedirects, maxBytes);
+    const oauthMetadata = parseOAuthServerMetadata(metadataResponse.value);
+    if (oauthMetadata.issuer !== document.auth.issuer) {
+        throw new DiscoveryError("issuer_mismatch", "OAuth metadata issuer does not match auth.issuer");
+    }
+    if (!oauthMetadata.poppy_domains.includes(document.organization.domain)) {
+        throw new DiscoveryError("domain_not_authorized", "OAuth metadata does not authorize the discovered company domain");
+    }
+    return {
+        discoveryUrl: discovery.finalUrl.toString(),
+        document,
+        oauthMetadata,
+    };
+}
+//# sourceMappingURL=discovery.js.map