@datalayer/personal-agent-protocol 0.3.2 → 0.3.3

package/lib/{chunk-TU6B5MQ7.js → chunk-JIMKKTDT.js}

@@ -1299,7 +1299,7 @@ function buildReactorFromPlugins(pluginsInput, options = {}) {
         // imperative `ctx.contribute` is not knowable before it runs, and the
         // graph reads those from the registry instead.
         contributesTo: [
-          ...new Set((plugin.contributes ?? []).map((record2) => record2.point.id))
+          ...new Set((plugin.contributes ?? []).map((record3) => record3.point.id))
         ]
       };
     },
@@ -1369,8 +1369,8 @@ function buildReactorFromPlugins(pluginsInput, options = {}) {
       return;
     }
     const ctx = buildPhaseContext(name, current);
-    for (const record2 of current.plugin.contributes ?? []) {
-      contributions.add(name, record2.point, record2.value, record2.options);
+    for (const record3 of current.plugin.contributes ?? []) {
+      contributions.add(name, record3.point, record3.value, record3.options);
     }
     for (const command of current.plugin.commands ?? []) {
       commands.add(name, command);
@@ -2057,7 +2057,7 @@ function createPapCorePlugin(options = {}) {
   }
   return definePlugin({
     name: "@datalayer/personal-agent-protocol-core",
-    version: "0.3.2",
+    version: "0.3.3",
     contributionPoints: [
       DiscoveryTransports,
       UrlSafetyPolicies,
@@ -2685,15 +2685,15 @@ function concat(...buffers) {
   return buf;
 }
 var NON_ASCII = /[^\x00-\x7f]/;
-function encode(string2) {
-  if (typeof string2 == "string" && string2.length >= 128) {
-    if (NON_ASCII.test(string2))
+function encode(string3) {
+  if (typeof string3 == "string" && string3.length >= 128) {
+    if (NON_ASCII.test(string3))
       throw new TypeError("non-ASCII string encountered in encode()");
-    return encoder.encode(string2);
+    return encoder.encode(string3);
   }
-  const bytes = new Uint8Array(string2.length);
-  for (let i = 0; i < string2.length; i++) {
-    const code = string2.charCodeAt(i);
+  const bytes = new Uint8Array(string3.length);
+  for (let i = 0; i < string3.length; i++) {
+    const code = string3.charCodeAt(i);
     if (code > 127)
       throw new TypeError("non-ASCII string encountered in encode()");
     bytes[i] = code;
@@ -4122,12 +4122,12 @@ function httpsUrl5(value, label) {
   return parsed;
 }
 function validScopes(values) {
-  const scopes2 = [...new Set(values)];
+  const scopes3 = [...new Set(values)];
   const token = /^[\x21\x23-\x5b\x5d-\x7e]+$/;
-  if (scopes2.length === 0 || scopes2.some((scope) => !token.test(scope))) {
+  if (scopes3.length === 0 || scopes3.some((scope) => !token.test(scope))) {
     throw new AuthorizationError("invalid_scope", "At least one valid OAuth scope is required");
   }
-  return scopes2;
+  return scopes3;
 }
 async function buildDirectSignInRequest(options) {
   const randomBytes2 = options.randomBytes ?? defaultRandomBytes3;
@@ -4141,14 +4141,14 @@ async function buildDirectSignInRequest(options) {
     new Uint8Array(await cryptoApi.subtle.digest("SHA-256", new TextEncoder().encode(verifier)))
   );
   const endpoint = httpsUrl5(options.authorizationEndpoint, "authorizationEndpoint");
-  const scopes2 = validScopes(options.scopes);
+  const scopes3 = validScopes(options.scopes);
   const clientId = httpsUrl5(options.clientId, "clientId").toString();
   const redirectUri = httpsUrl5(options.redirectUri, "redirectUri").toString();
   const issuer = httpsUrl5(options.issuer, "issuer").toString().replace(/\/$/, "");
   endpoint.searchParams.set("response_type", "code");
   endpoint.searchParams.set("client_id", clientId);
   endpoint.searchParams.set("redirect_uri", redirectUri);
-  endpoint.searchParams.set("scope", scopes2.join(" "));
+  endpoint.searchParams.set("scope", scopes3.join(" "));
   endpoint.searchParams.set("state", state);
   endpoint.searchParams.set("code_challenge", challenge);
   endpoint.searchParams.set("code_challenge_method", "S256");
@@ -4158,7 +4158,7 @@ async function buildDirectSignInRequest(options) {
     issuer,
     clientId,
     redirectUri,
-    scopes: scopes2,
+    scopes: scopes3,
     state: new SecretValue(state),
     codeVerifier: new SecretValue(verifier)
   };
@@ -4525,6 +4525,335 @@ var DirectSignInClient = class {
   }
 };
 
+// src/device.ts
+var DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+function httpsUrl6(value, label) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch (cause) {
+    throw new AuthorizationError("invalid_url", `${label} must be an HTTPS URL`, { cause });
+  }
+  if (parsed.protocol !== "https:" || parsed.username || parsed.password) {
+    throw new AuthorizationError("invalid_url", `${label} must be an HTTPS URL`);
+  }
+  return parsed.toString();
+}
+function scopes2(values) {
+  const result = [...new Set(values)];
+  const token = /^[\x21\x23-\x5b\x5d-\x7e]+$/;
+  if (result.length === 0 || result.some((scope) => !token.test(scope))) {
+    throw new AuthorizationError("invalid_scope", "At least one valid OAuth scope is required");
+  }
+  return result;
+}
+function base64Url6(bytes) {
+  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+  let output = "";
+  for (let index = 0; index < bytes.length; index += 3) {
+    const first = bytes[index] ?? 0;
+    const second = bytes[index + 1];
+    const third = bytes[index + 2];
+    output += alphabet[first >>> 2];
+    output += alphabet[(first & 3) << 4 | (second ?? 0) >>> 4];
+    if (second !== void 0) {
+      output += alphabet[(second & 15) << 2 | (third ?? 0) >>> 6];
+    }
+    if (third !== void 0) output += alphabet[third & 63];
+  }
+  return output;
+}
+function opaqueId2(prefix, bytes) {
+  if (bytes.byteLength < 16) {
+    throw new AuthorizationError("weak_entropy", "Device Sign-In requires 128 random bits");
+  }
+  return `${prefix}_${base64Url6(bytes)}`;
+}
+function record2(value, label) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new AuthorizationError("invalid_device_response", `${label} must be an object`);
+  }
+  return value;
+}
+function string2(value, label) {
+  if (typeof value !== "string" || !value) {
+    throw new AuthorizationError("invalid_device_response", `${label} must be a non-empty string`);
+  }
+  return value;
+}
+function parseDeviceAuthorization(value) {
+  const source = record2(value, "device authorization response");
+  const expiresIn = source.expires_in;
+  const interval = source.interval ?? 5;
+  if (!Number.isInteger(expiresIn) || expiresIn <= 0 || expiresIn > 3600) {
+    throw new AuthorizationError("invalid_device_response", "expires_in must be 1..3600");
+  }
+  if (!Number.isInteger(interval) || interval <= 0 || interval > 300) {
+    throw new AuthorizationError("invalid_device_response", "interval must be 1..300");
+  }
+  const complete = source.verification_uri_complete;
+  if (complete !== void 0 && typeof complete !== "string") {
+    throw new AuthorizationError(
+      "invalid_device_response",
+      "verification_uri_complete must be a string"
+    );
+  }
+  return {
+    deviceCode: new SecretValue(string2(source.device_code, "device_code")),
+    userCode: string2(source.user_code, "user_code"),
+    verificationUri: httpsUrl6(
+      string2(source.verification_uri, "verification_uri"),
+      "verification_uri"
+    ),
+    ...complete === void 0 ? {} : { verificationUriComplete: httpsUrl6(complete, "verification_uri_complete") },
+    expiresIn,
+    interval
+  };
+}
+function isPending(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const pending = value;
+  return pending.kind === "pap.device-sign-in.v1" && pending.deviceCode instanceof SecretValue && pending.expiresAt instanceof Date && pending.nextPollAt instanceof Date && typeof pending.tokenEndpoint === "string" && typeof pending.interval === "number";
+}
+var DeviceSignInClient = class {
+  #reactor;
+  #fetch;
+  #maxResponseBytes;
+  constructor(options) {
+    const fetcher = options.fetch ?? globalThis.fetch;
+    if (!fetcher) throw new AuthorizationError("fetch_unavailable", "A fetch implementation is required");
+    const limit = options.maxResponseBytes ?? 100 * 1024;
+    if (!Number.isInteger(limit) || limit <= 0) throw new RangeError("maxResponseBytes must be positive");
+    this.#reactor = options.reactor;
+    this.#fetch = fetcher;
+    this.#maxResponseBytes = limit;
+  }
+  async begin(options) {
+    this.#validateContext(options);
+    const clock = firstContribution(this.#reactor, Clocks, "clock");
+    const random = firstContribution(this.#reactor, RandomSources, "random source");
+    const signer = firstContribution(this.#reactor, Signers, "signer");
+    const endpoint = httpsUrl6(options.deviceAuthorizationEndpoint, "deviceAuthorizationEndpoint");
+    const tokenEndpoint = httpsUrl6(options.tokenEndpoint, "tokenEndpoint");
+    const issuer = httpsUrl6(options.issuer, "issuer").replace(/\/$/, "");
+    const clientId = httpsUrl6(options.clientId, "clientId");
+    const requestedScopes = scopes2(options.scopes);
+    const now = clock.now();
+    const clientAssertion = await signer.sign(
+      this.#claims(clientId, endpoint, now, random.bytes(16)),
+      { purpose: "client_assertion" }
+    );
+    const response = await this.#request(
+      endpoint,
+      new URLSearchParams({
+        scope: requestedScopes.join(" "),
+        client_id: clientId,
+        client_assertion_type: JWT_CLIENT_ASSERTION,
+        client_assertion: clientAssertion.reveal()
+      }),
+      void 0,
+      options.signal
+    );
+    const payload = await this.#decode(response, "Device authorization");
+    if (!response.ok) throw this.#remoteError(response, payload, "Company refused Device Sign-In");
+    const authorization = parseDeviceAuthorization(payload);
+    const expiresAt = new Date(now.getTime() + authorization.expiresIn * 1e3);
+    const reference = opaqueId2("device", random.bytes(16));
+    const pending = {
+      kind: "pap.device-sign-in.v1",
+      deviceCode: authorization.deviceCode,
+      tokenEndpoint,
+      issuer,
+      clientId,
+      tenantId: options.tenantId,
+      pairwiseUserId: options.pairwiseUserId,
+      sessionId: options.sessionId,
+      scopes: requestedScopes,
+      expiresAt,
+      nextPollAt: new Date(now.getTime() + authorization.interval * 1e3),
+      interval: authorization.interval
+    };
+    const store = firstContribution(this.#reactor, AuthorizationStateStores, "authorization state store");
+    await store.put(reference, pending, { expiresAt });
+    return {
+      reference,
+      userCode: authorization.userCode,
+      verificationUri: authorization.verificationUri,
+      ...authorization.verificationUriComplete === void 0 ? {} : { verificationUriComplete: authorization.verificationUriComplete },
+      expiresAt,
+      pollInterval: authorization.interval,
+      requestedScopes
+    };
+  }
+  async poll(reference, signal) {
+    const store = firstContribution(this.#reactor, AuthorizationStateStores, "authorization state store");
+    const pending = await store.take(reference);
+    if (!isPending(pending)) {
+      throw new AuthorizationError(
+        "invalid_or_expired_device_session",
+        "Device Sign-In is unknown, expired, complete, or already being polled"
+      );
+    }
+    const clock = firstContribution(this.#reactor, Clocks, "clock");
+    const now = clock.now();
+    if (now.getTime() >= pending.expiresAt.getTime()) {
+      throw new AuthorizationError("expired_token", "Device Sign-In has expired");
+    }
+    if (now.getTime() < pending.nextPollAt.getTime()) {
+      await store.put(reference, pending, { expiresAt: pending.expiresAt });
+      return { status: "pending", retryAt: pending.nextPollAt, grantedScopes: [], missingScopes: [] };
+    }
+    try {
+      const result = await this.#pollToken(pending, now, signal);
+      if (result.response.ok) return await this.#complete(result.response, result.payload, pending);
+      const source = typeof result.payload === "object" && result.payload !== null ? result.payload : {};
+      const remote = "error" in source ? source.error : void 0;
+      if (remote === "authorization_pending" || remote === "slow_down") {
+        const interval = pending.interval + (remote === "slow_down" ? 5 : 0);
+        const resumed = { ...pending, interval, nextPollAt: new Date(now.getTime() + interval * 1e3) };
+        await store.put(reference, resumed, { expiresAt: pending.expiresAt });
+        return { status: "pending", retryAt: resumed.nextPollAt, grantedScopes: [], missingScopes: [] };
+      }
+      if (remote === "access_denied" || remote === "expired_token") {
+        throw new AuthorizationError(remote, "Device Sign-In ended without authorization");
+      }
+      await store.put(reference, pending, { expiresAt: pending.expiresAt });
+      throw this.#remoteError(result.response, result.payload, "Company refused the device token request");
+    } catch (cause) {
+      if (cause instanceof AuthorizationError && ["access_denied", "expired_token"].includes(cause.code)) {
+        throw cause;
+      }
+      const existing = await store.take(reference);
+      if (existing === void 0) await store.put(reference, pending, { expiresAt: pending.expiresAt });
+      throw cause;
+    }
+  }
+  async #pollToken(pending, now, signal) {
+    const random = firstContribution(this.#reactor, RandomSources, "random source");
+    const signer = firstContribution(this.#reactor, Signers, "signer");
+    const dpop = firstContribution(this.#reactor, DpopProofProviders, "DPoP proof provider");
+    const assertion = await signer.sign(
+      this.#claims(pending.clientId, pending.tokenEndpoint, now, random.bytes(16)),
+      { purpose: "client_assertion" }
+    );
+    const proof = await dpop.create({
+      method: "POST",
+      url: pending.tokenEndpoint,
+      tenantId: pending.tenantId,
+      subject: pending.pairwiseUserId,
+      issuer: pending.issuer
+    });
+    const response = await this.#request(
+      pending.tokenEndpoint,
+      new URLSearchParams({
+        grant_type: DEVICE_CODE_GRANT,
+        device_code: pending.deviceCode.reveal(),
+        session_id: pending.sessionId,
+        client_id: pending.clientId,
+        client_assertion_type: JWT_CLIENT_ASSERTION,
+        client_assertion: assertion.reveal()
+      }),
+      proof.reveal(),
+      signal
+    );
+    return { response, payload: await this.#decode(response, "Device token") };
+  }
+  async #complete(response, payload, pending) {
+    let token;
+    try {
+      token = parseSessionToken(payload);
+    } catch (cause) {
+      throw new AuthorizationError("invalid_token_response", "Device token response is malformed", {
+        statusCode: response.status,
+        cause
+      });
+    }
+    if (token.tokenType !== "DPoP" || !token.signedIn || token.sessionId !== pending.sessionId) {
+      throw new AuthorizationError(
+        "invalid_token_response",
+        "Device Sign-In must return the signed-in proof-bound Session",
+        { statusCode: response.status }
+      );
+    }
+    if (token.scopes.some((scope) => !pending.scopes.includes(scope))) {
+      throw new AuthorizationError("scope_escalation", "Company returned an unrequested scope");
+    }
+    if (!token.accountToken) {
+      throw new AuthorizationError("missing_account_token", "Device Sign-In did not return an Account Token");
+    }
+    const random = firstContribution(this.#reactor, RandomSources, "random source");
+    const accountTokenReference = opaqueId2("account", random.bytes(16));
+    const tokens = firstContribution(this.#reactor, TokenStores, "token store");
+    await tokens.put(accountTokenReference, token.accountToken);
+    const { accountToken: _accountToken, ...publicToken } = token;
+    return {
+      status: "complete",
+      token: publicToken,
+      accountTokenReference,
+      grantedScopes: publicToken.scopes,
+      missingScopes: pending.scopes.filter((scope) => !publicToken.scopes.includes(scope))
+    };
+  }
+  #claims(clientId, audience, now, entropy2) {
+    const iat = Math.floor(now.getTime() / 1e3);
+    return { iss: clientId, sub: clientId, aud: audience, iat, exp: iat + 60, jti: opaqueId2("jti", entropy2) };
+  }
+  #validateContext(options) {
+    if (!options.tenantId || options.tenantId.length > 256) throw new RangeError("Invalid tenantId");
+    const identifiers = [
+      ["pairwiseUserId", options.pairwiseUserId],
+      ["sessionId", options.sessionId]
+    ];
+    for (const [label, value] of identifiers) {
+      if (!/^[A-Za-z0-9_-]{1,256}$/.test(value)) {
+        throw new AuthorizationError("invalid_context", `Invalid ${label}`);
+      }
+    }
+  }
+  async #request(url, body, dpop, signal) {
+    try {
+      return await this.#fetch(url, {
+        method: "POST",
+        headers: { Accept: "application/json", ...dpop === void 0 ? {} : { DPoP: dpop } },
+        body,
+        credentials: "omit",
+        redirect: "error",
+        ...signal === void 0 ? {} : { signal }
+      });
+    } catch (cause) {
+      throw new AuthorizationError("request_failed", "Device Sign-In request failed", { cause });
+    }
+  }
+  async #decode(response, label) {
+    if (response.headers.get("content-type")?.split(";", 1)[0]?.trim() !== "application/json") {
+      throw new AuthorizationError("invalid_content_type", `${label} endpoint must return JSON`, {
+        statusCode: response.status
+      });
+    }
+    const body = await response.text();
+    if (new TextEncoder().encode(body).byteLength > this.#maxResponseBytes) {
+      throw new AuthorizationError("response_too_large", `${label} response exceeds size limit`, {
+        statusCode: response.status
+      });
+    }
+    try {
+      return parseJsonStrict(body);
+    } catch (cause) {
+      throw new AuthorizationError("invalid_json", `${label} endpoint returned invalid JSON`, {
+        statusCode: response.status,
+        cause
+      });
+    }
+  }
+  #remoteError(response, payload, message2) {
+    const source = typeof payload === "object" && payload !== null ? payload : {};
+    const remote = "error" in source ? source.error : void 0;
+    return new AuthorizationError(typeof remote === "string" ? remote : "http_error", message2, {
+      statusCode: response.status
+    });
+  }
+};
+
 // src/discovery.ts
 function normalizeDomain(domain2) {
   const value = domain2.replace(/\.$/, "").toLowerCase();
@@ -4857,7 +5186,9 @@ export {
   validateDirectSignInCallback,
   AuthorizationCodeGrant,
   DirectSignInClient,
+  DEVICE_CODE_GRANT,
+  DeviceSignInClient,
   discoverCompany,
   AgentIdentityClient
 };
-//# sourceMappingURL=chunk-TU6B5MQ7.js.map
+//# sourceMappingURL=chunk-JIMKKTDT.js.map