@grantex/sdk 0.3.13 → 0.4.0

package/README.md

@@ -72,6 +72,105 @@ const grantex = new Grantex({
 | `jwksUri` | `string` | `${baseUrl}/.well-known/jwks.json` | URL from which the verifier retrieves signing keys |
 | `timeout` | `number` | `30000` | Request timeout in milliseconds |
 
+## OAuth Agent Profile Client
+
+`OAuthAgentClient` implements the client role in the prepared
+`draft-mishra-oauth-agent-grants-03` profile. It discovers and validates RFC
+8414 metadata, creates an ES256 DPoP key by default, uses PAR and PKCE S256,
+validates `state` and the RFC 9207 `iss` response parameter, rotates refresh
+tokens, performs same-resource RFC 8693 attenuation, and creates DPoP proofs
+for protected-resource requests.
+
+```typescript
+import { OAuthAgentClient } from '@grantex/sdk';
+
+const client = await OAuthAgentClient.create({
+  issuer: 'https://grantex.dev',
+  clientId: 'ag_01J...',
+  redirectUri: 'https://agent.example/callback',
+  resource: 'https://api.example/resource',
+});
+
+const pending = await client.beginAuthorization({
+  scopes: ['grantex.resource.read'],
+  principalHint: 'principal@example.com',
+});
+
+// Redirect the Principal to pending.authorizationUrl. In the callback:
+const tokens = await client.completeAuthorization(callbackUrl);
+
+const response = await client.fetch(
+  'https://api.example/resource',
+  tokens.access_token,
+);
+
+const narrower = await client.attenuate(tokens.access_token, [
+  'grantex.resource.read',
+]);
+const rotated = await client.refresh(tokens.refresh_token!);
+await client.revoke(rotated.refresh_token!, 'refresh_token');
+```
+
+Persist the generated key securely if an instance must survive process
+restarts. Supply the matching `privateKey` and `publicJwk` to `create`; both are
+required together. `principalHint` is optional account-discovery input and is
+not proof of the Principal's identity; live approval still requires the
+authorization server's passkey authentication. Plain HTTP endpoints are rejected unless
+`allowInsecureLoopback` is enabled for local loopback testing. Revision `-02`
+of the draft family is published as an active individual Internet-Draft;
+revision `-03` is the working candidate implemented here. Neither is an
+IETF-endorsed or independently certified standard.
+
+## Agent prepaid wallets (0.4.0 repository source)
+
+`PrepaidWalletAgentClient` uses an `OAuthAgentClient` and DPoP access token to
+list assigned wallets, reserve payments, and request threshold reloads.
+`PrincipalPrepaidWalletClient` uses a short-lived principal-session token to
+create and fund wallets, assign policy, approve reloads, inspect activity, and
+block an assignment, wallet, or all wallets for one agent.
+
+The access token must include `wallet:spend` and each action scope used in a
+payment (for example `weather:read`). Agent wallet listings intentionally omit
+custody-provider IDs, wallet addresses, principal IDs, and wallet metadata.
+
+```typescript
+import {
+  PrepaidWalletAgentClient,
+  PrincipalPrepaidWalletClient,
+} from '@grantex/sdk';
+
+const agentWallets = new PrepaidWalletAgentClient({
+  oauthClient,
+  accessToken,
+});
+
+const principalWallets = new PrincipalPrepaidWalletClient({
+  baseUrl: 'https://grantex.dev',
+  sessionToken,
+});
+
+const authorization = await agentWallets.authorizePayment({
+  amount: '1000',
+  asset: 'USDC',
+  network: 'grantex:prepaid',
+  recipient: 'merchant:weather-api',
+  resource: 'https://merchant.example/weather',
+  scope: 'weather:read',
+  maxTimeoutSeconds: 120,
+  idempotencyKey: crypto.randomUUID(),
+});
+```
+
+Amounts are atomic-unit integer strings. Managed prepaid-wallet APIs are
+available in `@grantex/sdk` 0.4.0 and later.
+
+Self-hosted wallet deployments must also provide correct public resource
+routing, migration `091`, durable notification delivery, merchant-side
+idempotency, and any external custody/provider integration. See [Prepaid Wallet
+Production
+Readiness](https://docs.grantex.dev/guides/prepaid-wallet-production);
+installing the SDK alone does not provide those dependencies.
+
 ## Commerce V1 / OACP
 
 The SDK includes a `commerce` resource for the Grantex Commerce V1 control
@@ -342,8 +441,10 @@ console.log(token.refreshToken); // for token refresh
 | `grantToken` | `string` | Signed RS256 JWT — the agent's bearer credential |
 | `grantId` | `string` | Grant record ID |
 | `scopes` | `string[]` | Scopes the user approved |
-| `expiresAt` | `string` | Token expiry (ISO 8601) |
-| `refreshToken` | `string` | Refresh token for obtaining new grant tokens |
+| `expiresAt` | `string` | Underlying grant expiry (ISO 8601) |
+| `refreshToken` | `string` | Refresh token for rotating credentials while the grant remains active |
+
+Refresh tokens are single-use and rotate on every accepted refresh. If a refresh response is lost after the server commits rotation, retry the same previous refresh token immediately; Grantex can return the already-rotated token pair for five minutes (300 seconds) while the grant remains active. Refresh does not extend `expiresAt`; after the grant expires, re-authorize.
 
 ---
 
@@ -443,7 +544,7 @@ const { entries } = await grantex.audit.list({
 #### `grantex.audit.get(entryId)`
 
 ```typescript
-const entry = await grantex.audit.get('aud_01J...');
+const entry = await grantex.audit.get('alog_01J...');
 console.log(entry.hash);      // SHA-256 hash for tamper evidence
 console.log(entry.prevHash);   // previous entry hash (chain integrity)
 ```
@@ -801,3 +902,7 @@ const result = await grantex.enforce({ grantToken: token, connector: 'my-crm', t
 ## License
 
 [Apache 2.0](https://github.com/mishrasanjeev/grantex/blob/main/LICENSE)
+
+## Ownership
+
+Grantex is owned by Orchestrum Technologies LLP. Inventor and owner: Sanjeev Kumar. Ownership contact: [sanjeev@orchestrum.in](mailto:sanjeev@orchestrum.in) or [mishra.sanjeev@gmail.com](mailto:mishra.sanjeev@gmail.com).

package/dist/index.d.ts

@@ -1,12 +1,14 @@
 export { Grantex } from './client.js';
 export { verifyGrantToken } from './verify.js';
-export { verifyWebhookSignature } from './webhook.js';
+export { verifyWebhookSignature, verifyWebhook, type VerifyWebhookOptions } from './webhook.js';
 export { generatePkce, type PkceChallenge } from './pkce.js';
+export { OAuthAgentClient, generateOAuthAgentKey, type OAuthAuthorizationServerMetadata, type OAuthAgentClientOptions, type OAuthAgentKeyPair, type BeginAgentAuthorizationOptions, type PendingAgentAuthorization, type OAuthAgentTokenResponse, } from './oauth-agent.js';
+export { PrepaidWalletAgentClient, PrincipalPrepaidWalletClient, type PrepaidCustodyMode, type PrepaidWalletStatus, type WalletAssignmentStatus, type PrepaidWallet, type AssignedPrepaidWallet, type WalletAssignment, type CreatePrepaidWalletParams, type AssignPrepaidWalletParams, type PrepaidAuthorizationRequest, type PrepaidAuthorizationResponse, type WalletReloadRequest, type PrepaidWalletActivity, } from './prepaid-wallets.js';
 export { GrantexError, GrantexApiError, GrantexAuthError, GrantexTokenError, GrantexNetworkError, } from './errors.js';
 export { EventsClient, type GrantexEvent as GrantexStreamEvent, type StreamOptions, type EventHandler } from './resources/events.js';
 export { PassportsClient, type IssuePassportParams, type IssuedPassportResponse, type GetPassportResponse, type RevokePassportResponse, type ListPassportsParams, } from './resources/passports.js';
 export { ToolManifest, Permission, permissionCovers, type EnforceOptions, type EnforceResult, type ToolManifestOptions, type WrapToolOptions, type EnforceMiddlewareOptions } from './manifest.js';
 export { DpdpClient } from './resources/dpdp.js';
 export { CommerceClient, type CommerceEnvironment, type CommerceProviderKey, type CommercePassportType, type CommercePaymentStatus, type CommerceRecord, type CommerceDataResponse, type CommerceListResponse, type CommerceProfile, type CommerceIdempotentRequest, type CommerceTenantCreateParams, type CommerceTenantUpdateParams, type CommerceDeveloperTenantBindParams, type CommerceMerchantCreateParams, type CommerceMerchantUpdateParams, type CommerceAgentCreateParams, type CommerceAgentUpdateParams, type CommerceCatalogVariantInput, type CommerceCatalogProductCreateParams, type CommerceCatalogProductUpdateParams, type CommerceCatalogProductListParams, type CommerceCatalogSearchParams, type CommerceCartCreateParams, type CommerceConsentRequestCreateParams, type CommerceConsentExchangeParams, type CommercePassportVerifyParams, type CommercePassportRevokeParams, type CommercePolicyCreateParams, type CommercePolicyEvaluateParams, type CommercePaymentIntentCreateParams, type CommercePaymentIntentListParams, type CommerceCheckoutLinkCreateParams, type CommerceProviderCredentialCreateParams, type CommerceProviderCredentialPatchParams, type CommerceProviderCredentialListParams, type CommerceWebhookSourceCreateParams, type CommerceWebhookSourceListParams, type CommerceOpsHealthParams, type CommerceProviderWebhookEventListParams, type CommerceProviderWebhookReplayParams, type CommerceMcpJsonRpcRequest, } from './resources/commerce.js';
-export type { RateLimit, GrantexClientOptions, SignupParams, SignupResponse, RotateKeyResponse, Agent, RegisterAgentParams, UpdateAgentParams, ListAgentsResponse, AuthorizeParams, AuthorizationRequest, Grant, ListGrantsParams, ListGrantsResponse, VerifiedGrant, DelegateParams, ExchangeTokenParams, ExchangeTokenResponse, RefreshTokenParams, VerifyTokenResponse, CreatePrincipalSessionParams, PrincipalSessionResponse, LogAuditParams, AuditEntry, ListAuditParams, ListAuditResponse, VerifyGrantTokenOptions, WebhookEventType, CreateWebhookParams, WebhookEndpoint, WebhookEndpointWithSecret, ListWebhooksResponse, SubscriptionStatus, CreateCheckoutParams, CheckoutResponse, CreatePortalParams, PortalResponse, Policy, CreatePolicyParams, UpdatePolicyParams, ListPoliciesResponse, AnomalyType, AnomalySeverity, Anomaly, DetectAnomaliesResponse, ListAnomaliesResponse, ScimEmail, ScimUserMeta, ScimUser, ScimListResponse, CreateScimUserParams, UpdateScimUserParams, ScimToken, ScimTokenWithSecret, CreateScimTokenParams, ListScimTokensResponse, SsoConfig, CreateSsoConfigParams, SsoLoginResponse, SsoCallbackResponse, StoreCredentialParams, StoreCredentialResponse, VaultCredential, ListVaultCredentialsParams, ListVaultCredentialsResponse, ExchangeCredentialParams, ExchangeCredentialResponse, AllocateBudgetParams, BudgetAllocation, DebitBudgetParams, DebitBudgetResponse, BudgetTransaction, BudgetTransactionsResponse, ComplianceSummary, ComplianceExportGrantsParams, ComplianceExportAuditParams, ComplianceGrantsExport, ComplianceAuditExport, EvidencePackParams, EvidencePack, ChainIntegrity, UsageResponse, UsageHistoryEntry, UsageHistoryResponse, CreateDomainParams, CreateDomainResponse, DomainEntry, ListDomainsResponse, VerifyDomainResponse, WebAuthnRegistrationOptions, WebAuthnRegistrationVerifyParams, WebAuthnCredential, ListWebAuthnCredentialsResponse, VerifiableCredentialRecord, ListCredentialsParams, ListCredentialsResponse, VCVerificationResult, SDJWTPresentParams, SDJWTPresentResult, UpdateDeveloperSettingsParams, UpdateDeveloperSettingsResponse, DpdpPurpose, CreateConsentRecordParams, ConsentRecord, ListConsentRecordsResponse, WithdrawConsentParams, WithdrawConsentResponse, PrincipalRecordsResponse, ErasureResponse, CreateConsentNoticeParams, ConsentNotice, FileGrievanceParams, Grievance, DpdpExportType, CreateDpdpExportParams, DpdpExport, } from './types.js';
+export type { RateLimit, GrantexClientOptions, SignupParams, SignupResponse, RotateKeyResponse, Agent, RegisterAgentParams, UpdateAgentParams, ListAgentsResponse, AuthorizeParams, AuthorizationRequest, Grant, ListGrantsParams, ListGrantsResponse, VerifiedGrant, DelegateParams, ExchangeTokenParams, ExchangeTokenResponse, RefreshTokenParams, VerifyTokenResponse, CreatePrincipalSessionParams, PrincipalSessionResponse, LogAuditParams, AuditEntry, AuditCheckpoint, ListAuditParams, ListAuditResponse, VerifyGrantTokenOptions, WebhookEventType, CreateWebhookParams, WebhookEndpoint, WebhookEndpointWithSecret, ListWebhooksResponse, SubscriptionStatus, CreateCheckoutParams, CheckoutResponse, CreatePortalParams, PortalResponse, Policy, CreatePolicyParams, UpdatePolicyParams, ListPoliciesResponse, AnomalyType, AnomalySeverity, Anomaly, DetectAnomaliesResponse, ListAnomaliesResponse, ScimEmail, ScimUserMeta, ScimUser, ScimListResponse, CreateScimUserParams, UpdateScimUserParams, ScimToken, ScimTokenWithSecret, CreateScimTokenParams, ListScimTokensResponse, SsoConfig, CreateSsoConfigParams, SsoLoginResponse, SsoCallbackResponse, StoreCredentialParams, StoreCredentialResponse, VaultCredential, ListVaultCredentialsParams, ListVaultCredentialsResponse, ExchangeCredentialParams, ExchangeCredentialResponse, AllocateBudgetParams, BudgetAllocation, DebitBudgetParams, DebitBudgetResponse, BudgetTransaction, BudgetTransactionsResponse, ComplianceSummary, ComplianceExportGrantsParams, ComplianceExportAuditParams, ComplianceGrantsExport, ComplianceAuditExport, EvidencePackParams, EvidencePack, ChainIntegrity, UsageResponse, UsageHistoryEntry, UsageHistoryResponse, CreateDomainParams, CreateDomainResponse, DomainEntry, ListDomainsResponse, VerifyDomainResponse, WebAuthnRegistrationOptions, WebAuthnRegistrationVerifyParams, WebAuthnCredential, ListWebAuthnCredentialsResponse, VerifiableCredentialRecord, ListCredentialsParams, ListCredentialsResponse, VCVerificationResult, SDJWTPresentParams, SDJWTPresentResult, UpdateDeveloperSettingsParams, UpdateDeveloperSettingsResponse, DpdpPurpose, CreateConsentRecordParams, ConsentRecord, ListConsentRecordsResponse, WithdrawConsentParams, WithdrawConsentResponse, PrincipalRecordsResponse, ErasureResponse, CreateConsentNoticeParams, ConsentNotice, FileGrievanceParams, Grievance, DpdpExportType, CreateDpdpExportParams, DpdpExport, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAGtD,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAG7D,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,YAAY,EAAE,KAAK,YAAY,IAAI,kBAAkB,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGrI,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,GACzB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,eAAe,EAAE,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAGnM,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGjD,OAAO,EACL,cAAc,EACd,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,4BAA4B,EACjC,KAAK,4BAA4B,EACjC,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,kCAAkC,EACvC,KAAK,kCAAkC,EACvC,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,kCAAkC,EACvC,KAAK,6BAA6B,EAClC,KAAK,4BAA4B,EACjC,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,iCAAiC,EACtC,KAAK,+BAA+B,EACpC,KAAK,gCAAgC,EACrC,KAAK,sCAAsC,EAC3C,KAAK,qCAAqC,EAC1C,KAAK,oCAAoC,EACzC,KAAK,iCAAiC,EACtC,KAAK,+BAA+B,EACpC,KAAK,uBAAuB,EAC5B,KAAK,sCAAsC,EAC3C,KAAK,mCAAmC,EACxC,KAAK,yBAAyB,GAC/B,MAAM,yBAAyB,CAAC;AAGjC,YAAY,EACV,SAAS,EACT,oBAAoB,EAEpB,YAAY,EACZ,cAAc,EACd,iBAAiB,EAEjB,KAAK,EACL,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAElB,eAAe,EACf,oBAAoB,EAEpB,KAAK,EACL,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,cAAc,EAEd,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EAEnB,4BAA4B,EAC5B,wBAAwB,EAExB,cAAc,EACd,UAAU,EACV,eAAe,EACf,iBAAiB,EAEjB,uBAAuB,EAEvB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,yBAAyB,EACzB,oBAAoB,EAEpB,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EAEd,MAAM,EACN,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EAEpB,WAAW,EACX,eAAe,EACf,OAAO,EACP,uBAAuB,EACvB,qBAAqB,EAErB,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,SAAS,EACT,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EAEtB,SAAS,EACT,qBAAqB,EACrB,gBAAgB,EAChB,mBAAmB,EAEnB,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,EAE1B,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,0BAA0B,EAE1B,iBAAiB,EACjB,4BAA4B,EAC5B,2BAA2B,EAC3B,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,cAAc,EAEd,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EAEpB,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,mBAAmB,EACnB,oBAAoB,EAEpB,2BAA2B,EAC3B,gCAAgC,EAChC,kBAAkB,EAClB,+BAA+B,EAE/B,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EAEpB,kBAAkB,EAClB,kBAAkB,EAElB,6BAA6B,EAC7B,+BAA+B,EAE/B,WAAW,EACX,yBAAyB,EACzB,aAAa,EACb,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,yBAAyB,EACzB,aAAa,EACb,mBAAmB,EACnB,SAAS,EACT,cAAc,EACd,sBAAsB,EACtB,UAAU,GACX,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGhG,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAG7D,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,gCAAgC,EACrC,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,GAC7B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC3B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,YAAY,EAAE,KAAK,YAAY,IAAI,kBAAkB,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGrI,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,GACzB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,eAAe,EAAE,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAGnM,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGjD,OAAO,EACL,cAAc,EACd,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,4BAA4B,EACjC,KAAK,4BAA4B,EACjC,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,kCAAkC,EACvC,KAAK,kCAAkC,EACvC,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,kCAAkC,EACvC,KAAK,6BAA6B,EAClC,KAAK,4BAA4B,EACjC,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,iCAAiC,EACtC,KAAK,+BAA+B,EACpC,KAAK,gCAAgC,EACrC,KAAK,sCAAsC,EAC3C,KAAK,qCAAqC,EAC1C,KAAK,oCAAoC,EACzC,KAAK,iCAAiC,EACtC,KAAK,+BAA+B,EACpC,KAAK,uBAAuB,EAC5B,KAAK,sCAAsC,EAC3C,KAAK,mCAAmC,EACxC,KAAK,yBAAyB,GAC/B,MAAM,yBAAyB,CAAC;AAGjC,YAAY,EACV,SAAS,EACT,oBAAoB,EAEpB,YAAY,EACZ,cAAc,EACd,iBAAiB,EAEjB,KAAK,EACL,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAElB,eAAe,EACf,oBAAoB,EAEpB,KAAK,EACL,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,cAAc,EAEd,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EAEnB,4BAA4B,EAC5B,wBAAwB,EAExB,cAAc,EACd,UAAU,EACV,eAAe,EACf,eAAe,EACf,iBAAiB,EAEjB,uBAAuB,EAEvB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,yBAAyB,EACzB,oBAAoB,EAEpB,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EAEd,MAAM,EACN,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EAEpB,WAAW,EACX,eAAe,EACf,OAAO,EACP,uBAAuB,EACvB,qBAAqB,EAErB,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,SAAS,EACT,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EAEtB,SAAS,EACT,qBAAqB,EACrB,gBAAgB,EAChB,mBAAmB,EAEnB,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,EAE1B,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,0BAA0B,EAE1B,iBAAiB,EACjB,4BAA4B,EAC5B,2BAA2B,EAC3B,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,cAAc,EAEd,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EAEpB,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,mBAAmB,EACnB,oBAAoB,EAEpB,2BAA2B,EAC3B,gCAAgC,EAChC,kBAAkB,EAClB,+BAA+B,EAE/B,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EAEpB,kBAAkB,EAClB,kBAAkB,EAElB,6BAA6B,EAC7B,+BAA+B,EAE/B,WAAW,EACX,yBAAyB,EACzB,aAAa,EACb,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,yBAAyB,EACzB,aAAa,EACb,mBAAmB,EACnB,SAAS,EACT,cAAc,EACd,sBAAsB,EACtB,UAAU,GACX,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -3,9 +3,13 @@ export { Grantex } from './client.js';
 // Standalone token verification (no Grantex account needed)
 export { verifyGrantToken } from './verify.js';
 // Webhook signature verification
-export { verifyWebhookSignature } from './webhook.js';
+export { verifyWebhookSignature, verifyWebhook } from './webhook.js';
 // PKCE helper
 export { generatePkce } from './pkce.js';
+// OAuth agent-grants profile client (PAR + PKCE + RFC 9207 + DPoP)
+export { OAuthAgentClient, generateOAuthAgentKey, } from './oauth-agent.js';
+// Agent prepaid wallets and x402 authorization bridge
+export { PrepaidWalletAgentClient, PrincipalPrepaidWalletClient, } from './prepaid-wallets.js';
 // Error classes
 export { GrantexError, GrantexApiError, GrantexAuthError, GrantexTokenError, GrantexNetworkError, } from './errors.js';
 // Event streaming

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc;AACd,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,4DAA4D;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,iCAAiC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD,cAAc;AACd,OAAO,EAAE,YAAY,EAAsB,MAAM,WAAW,CAAC;AAE7D,gBAAgB;AAChB,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,kBAAkB;AAClB,OAAO,EAAE,YAAY,EAAkF,MAAM,uBAAuB,CAAC;AAErI,iCAAiC;AACjC,OAAO,EACL,eAAe,GAMhB,MAAM,0BAA0B,CAAC;AAElC,oBAAoB;AACpB,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAA0H,MAAM,eAAe,CAAC;AAEnM,kBAAkB;AAClB,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,mCAAmC;AACnC,OAAO,EACL,cAAc,GAyCf,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc;AACd,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,4DAA4D;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,iCAAiC;AACjC,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAA6B,MAAM,cAAc,CAAC;AAEhG,cAAc;AACd,OAAO,EAAE,YAAY,EAAsB,MAAM,WAAW,CAAC;AAE7D,mEAAmE;AACnE,OAAO,EACL,gBAAgB,EAChB,qBAAqB,GAOtB,MAAM,kBAAkB,CAAC;AAE1B,sDAAsD;AACtD,OAAO,EACL,wBAAwB,EACxB,4BAA4B,GAa7B,MAAM,sBAAsB,CAAC;AAE9B,gBAAgB;AAChB,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,kBAAkB;AAClB,OAAO,EAAE,YAAY,EAAkF,MAAM,uBAAuB,CAAC;AAErI,iCAAiC;AACjC,OAAO,EACL,eAAe,GAMhB,MAAM,0BAA0B,CAAC;AAElC,oBAAoB;AACpB,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAA0H,MAAM,eAAe,CAAC;AAEnM,kBAAkB;AAClB,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,mCAAmC;AACnC,OAAO,EACL,cAAc,GAyCf,MAAM,yBAAyB,CAAC"}

package/dist/oauth-agent.d.ts

@@ -0,0 +1,71 @@
+import { type CryptoKey, type JWK } from 'jose';
+export interface OAuthAuthorizationServerMetadata {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    jwks_uri: string;
+    revocation_endpoint: string;
+    pushed_authorization_request_endpoint: string;
+    require_pushed_authorization_requests: true;
+    response_types_supported: string[];
+    grant_types_supported: string[];
+    code_challenge_methods_supported: string[];
+    authorization_response_iss_parameter_supported: true;
+    dpop_signing_alg_values_supported: string[];
+    token_endpoint_auth_methods_supported: string[];
+    revocation_endpoint_auth_methods_supported: string[];
+}
+export interface OAuthAgentClientOptions {
+    issuer: string;
+    clientId: string;
+    redirectUri: string;
+    resource: string;
+    privateKey?: CryptoKey;
+    publicJwk?: JWK;
+    allowInsecureLoopback?: boolean;
+}
+export interface OAuthAgentKeyPair {
+    privateKey: CryptoKey;
+    publicJwk: JWK;
+    thumbprint: string;
+}
+export declare function generateOAuthAgentKey(): Promise<OAuthAgentKeyPair>;
+export interface BeginAgentAuthorizationOptions {
+    scopes: string[];
+    principalHint?: string;
+    authorizationDetails?: Array<Record<string, unknown>>;
+}
+export interface PendingAgentAuthorization {
+    authorizationUrl: string;
+    requestUri: string;
+    state: string;
+    expiresIn: number;
+}
+export interface OAuthAgentTokenResponse {
+    access_token: string;
+    token_type: 'DPoP';
+    expires_in: number;
+    refresh_token?: string;
+    scope: string;
+    issued_token_type?: string;
+}
+export declare class OAuthAgentClient {
+    #private;
+    readonly metadata: OAuthAuthorizationServerMetadata;
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly resource: string;
+    readonly publicJwk: JWK;
+    readonly keyThumbprint: string;
+    private constructor();
+    static create(options: OAuthAgentClientOptions): Promise<OAuthAgentClient>;
+    beginAuthorization(options: BeginAgentAuthorizationOptions): Promise<PendingAgentAuthorization>;
+    completeAuthorization(callbackUrl: string): Promise<OAuthAgentTokenResponse>;
+    refresh(refreshToken: string): Promise<OAuthAgentTokenResponse>;
+    attenuate(accessToken: string, scopes: string[]): Promise<OAuthAgentTokenResponse>;
+    revoke(token: string, tokenTypeHint?: 'access_token' | 'refresh_token'): Promise<void>;
+    fetch(input: string | URL, accessToken: string, init?: RequestInit): Promise<Response>;
+    createDpopProof(method: string, targetUri: string, accessToken?: string): Promise<string>;
+    tokenRequest(params: URLSearchParams): Promise<OAuthAgentTokenResponse>;
+}
+//# sourceMappingURL=oauth-agent.d.ts.map

package/dist/oauth-agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-agent.d.ts","sourceRoot":"","sources":["../src/oauth-agent.ts"],"names":[],"mappings":"AACA,OAAO,EAOL,KAAK,SAAS,EACd,KAAK,GAAG,EACT,MAAM,MAAM,CAAC;AAMd,MAAM,WAAW,gCAAgC;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qCAAqC,EAAE,MAAM,CAAC;IAC9C,qCAAqC,EAAE,IAAI,CAAC;IAC5C,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gCAAgC,EAAE,MAAM,EAAE,CAAC;IAC3C,8CAA8C,EAAE,IAAI,CAAC;IACrD,iCAAiC,EAAE,MAAM,EAAE,CAAC;IAC5C,qCAAqC,EAAE,MAAM,EAAE,CAAC;IAChD,0CAA0C,EAAE,MAAM,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,SAAS,CAAC;IACvB,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,GAAG,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAQxE;AAED,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,yBAAyB;IACxC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AASD,qBAAa,gBAAgB;;IAC3B,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;IACpD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAM/B,OAAO,eAkBN;IAED,OAAa,MAAM,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA0C/E;IAEK,kBAAkB,CAAC,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAsDpG;IAEK,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAwBjF;IAED,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAM9D;IAED,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAUjF;IAEK,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAa3F;IAEK,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAa/F;IAEK,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAe9F;IAEK,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAa5E;CACF"}

package/dist/oauth-agent.js

@@ -0,0 +1,359 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { calculateJwkThumbprint, exportJWK, generateKeyPair, importJWK, jwtVerify, SignJWT, } from 'jose';
+import { generatePkce } from './pkce.js';
+const TOKEN_EXCHANGE_GRANT = 'urn:ietf:params:oauth:grant-type:token-exchange';
+const ACCESS_TOKEN_TYPE = 'urn:ietf:params:oauth:token-type:access_token';
+export async function generateOAuthAgentKey() {
+    const generated = await generateKeyPair('ES256', { extractable: true });
+    const publicJwk = await exportJWK(generated.publicKey);
+    return {
+        privateKey: generated.privateKey,
+        publicJwk,
+        thumbprint: await calculateJwkThumbprint(publicJwk, 'sha256'),
+    };
+}
+export class OAuthAgentClient {
+    metadata;
+    clientId;
+    redirectUri;
+    resource;
+    publicJwk;
+    keyThumbprint;
+    #privateKey;
+    #allowInsecureLoopback;
+    #pending = new Map();
+    constructor(options) {
+        this.metadata = options.metadata;
+        this.clientId = options.clientId;
+        this.redirectUri = options.redirectUri;
+        this.resource = options.resource;
+        this.#privateKey = options.privateKey;
+        this.#allowInsecureLoopback = options.allowInsecureLoopback;
+        this.publicJwk = options.publicJwk;
+        this.keyThumbprint = options.keyThumbprint;
+    }
+    static async create(options) {
+        const expectedIssuer = options.issuer;
+        const allowInsecureLoopback = options.allowInsecureLoopback === true;
+        assertSecureEndpoint(expectedIssuer, allowInsecureLoopback);
+        const issuerUrl = new URL(expectedIssuer);
+        if (issuerUrl.search || issuerUrl.hash) {
+            throw new Error('issuer must not contain a query or fragment');
+        }
+        assertSecureEndpoint(options.redirectUri, allowInsecureLoopback);
+        assertSecureEndpoint(options.resource, allowInsecureLoopback);
+        if (new URL(options.redirectUri).hash || new URL(options.resource).hash) {
+            throw new Error('redirectUri and resource must not contain fragments');
+        }
+        const metadataUrl = authorizationServerMetadataUrl(expectedIssuer);
+        assertSecureEndpoint(metadataUrl, options.allowInsecureLoopback === true);
+        const response = await fetch(metadataUrl, { headers: { Accept: 'application/json' } });
+        if (!response.ok)
+            throw new Error(`Authorization-server metadata request failed with HTTP ${response.status}`);
+        const metadata = response.json();
+        const validatedMetadata = validateMetadata(await metadata, expectedIssuer, allowInsecureLoopback);
+        let privateKey = options.privateKey;
+        let publicJwk = options.publicJwk;
+        if ((privateKey === undefined) !== (publicJwk === undefined)) {
+            throw new Error('privateKey and publicJwk must be provided together');
+        }
+        if (!privateKey || !publicJwk) {
+            const generated = await generateOAuthAgentKey();
+            privateKey = generated.privateKey;
+            publicJwk = generated.publicJwk;
+        }
+        await validateAgentKeyPair(privateKey, publicJwk);
+        const keyThumbprint = await calculateJwkThumbprint(publicJwk, 'sha256');
+        return new OAuthAgentClient({
+            metadata: validatedMetadata,
+            clientId: options.clientId,
+            redirectUri: options.redirectUri,
+            resource: options.resource,
+            privateKey,
+            publicJwk,
+            keyThumbprint,
+            allowInsecureLoopback,
+        });
+    }
+    async beginAuthorization(options) {
+        if (options.scopes.length === 0 || options.scopes.length > 100
+            || new Set(options.scopes).size !== options.scopes.length
+            || options.scopes.some((scope) => scope.length === 0 || scope.length > 256
+                || !/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(scope))) {
+            throw new Error('scopes must be a non-empty set of valid OAuth scope tokens');
+        }
+        if (options.principalHint !== undefined
+            && (options.principalHint.length === 0 || options.principalHint.length > 256)) {
+            throw new Error('principalHint must contain 1 to 256 characters');
+        }
+        const state = randomBytes(32).toString('base64url');
+        const pkce = generatePkce();
+        const params = new URLSearchParams({
+            client_id: this.clientId,
+            response_type: 'code',
+            redirect_uri: this.redirectUri,
+            scope: options.scopes.join(' '),
+            state,
+            code_challenge: pkce.codeChallenge,
+            code_challenge_method: pkce.codeChallengeMethod,
+            resource: this.resource,
+            dpop_jkt: this.keyThumbprint,
+        });
+        if (options.principalHint !== undefined)
+            params.set('login_hint', options.principalHint);
+        if (options.authorizationDetails) {
+            params.set('authorization_details', JSON.stringify(options.authorizationDetails));
+        }
+        const proof = await this.createDpopProof('POST', this.metadata.pushed_authorization_request_endpoint);
+        const response = await fetch(this.metadata.pushed_authorization_request_endpoint, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                Accept: 'application/json',
+                DPoP: proof,
+            },
+            body: params,
+        });
+        const result = await oauthJson(response);
+        this.#pending.set(state, {
+            codeVerifier: pkce.codeVerifier,
+            redirectUri: this.redirectUri,
+            issuer: this.metadata.issuer,
+            consumed: false,
+        });
+        const authorizationUrl = new URL(this.metadata.authorization_endpoint);
+        authorizationUrl.searchParams.set('client_id', this.clientId);
+        authorizationUrl.searchParams.set('request_uri', result.request_uri);
+        return {
+            authorizationUrl: authorizationUrl.toString(),
+            requestUri: result.request_uri,
+            state,
+            expiresIn: result.expires_in,
+        };
+    }
+    async completeAuthorization(callbackUrl) {
+        const callback = new URL(callbackUrl);
+        const state = callback.searchParams.get('state');
+        if (!state)
+            throw new Error('Authorization response is missing state');
+        const pending = this.#pending.get(state);
+        if (!pending || pending.consumed)
+            throw new Error('Authorization response state is unknown or already consumed');
+        assertRedirectResponse(callback, pending.redirectUri);
+        pending.consumed = true;
+        this.#pending.delete(state);
+        const responseIssuer = callback.searchParams.get('iss');
+        if (responseIssuer !== pending.issuer)
+            throw new Error('Authorization response issuer does not match the initiating session');
+        const error = callback.searchParams.get('error');
+        if (error)
+            throw new Error(`Authorization failed: ${error}`);
+        const code = callback.searchParams.get('code');
+        if (!code)
+            throw new Error('Authorization response is missing code');
+        return this.tokenRequest(new URLSearchParams({
+            grant_type: 'authorization_code',
+            code,
+            client_id: this.clientId,
+            redirect_uri: pending.redirectUri,
+            code_verifier: pending.codeVerifier,
+        }));
+    }
+    refresh(refreshToken) {
+        return this.tokenRequest(new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+            client_id: this.clientId,
+        }));
+    }
+    attenuate(accessToken, scopes) {
+        return this.tokenRequest(new URLSearchParams({
+            grant_type: TOKEN_EXCHANGE_GRANT,
+            client_id: this.clientId,
+            subject_token: accessToken,
+            subject_token_type: ACCESS_TOKEN_TYPE,
+            requested_token_type: ACCESS_TOKEN_TYPE,
+            scope: scopes.join(' '),
+            resource: this.resource,
+        }));
+    }
+    async revoke(token, tokenTypeHint) {
+        const proof = await this.createDpopProof('POST', this.metadata.revocation_endpoint);
+        const params = new URLSearchParams({ client_id: this.clientId, token });
+        if (tokenTypeHint)
+            params.set('token_type_hint', tokenTypeHint);
+        const response = await fetch(this.metadata.revocation_endpoint, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                DPoP: proof,
+            },
+            body: params,
+        });
+        if (!response.ok)
+            await oauthJson(response);
+    }
+    async fetch(input, accessToken, init = {}) {
+        const target = new URL(input);
+        const resource = new URL(this.resource);
+        if (target.origin !== resource.origin) {
+            throw new Error('Protected-resource request origin does not match the configured resource');
+        }
+        assertSecureEndpoint(target.toString(), this.#allowInsecureLoopback);
+        const method = (init.method ?? 'GET').toUpperCase();
+        const proof = await this.createDpopProof(method, target.toString(), accessToken);
+        const headers = new Headers(init.headers);
+        headers.set('Authorization', `DPoP ${accessToken}`);
+        headers.set('DPoP', proof);
+        return fetch(target, { ...init, method, headers });
+    }
+    async createDpopProof(method, targetUri, accessToken) {
+        const target = new URL(targetUri);
+        target.search = '';
+        target.hash = '';
+        return new SignJWT({
+            htm: method.toUpperCase(),
+            htu: target.toString(),
+            jti: randomUUID(),
+            iat: Math.floor(Date.now() / 1000),
+            ...(accessToken
+                ? { ath: createHash('sha256').update(accessToken, 'ascii').digest('base64url') }
+                : {}),
+        })
+            .setProtectedHeader({ typ: 'dpop+jwt', alg: 'ES256', jwk: this.publicJwk })
+            .sign(this.#privateKey);
+    }
+    async tokenRequest(params) {
+        const proof = await this.createDpopProof('POST', this.metadata.token_endpoint);
+        const response = await fetch(this.metadata.token_endpoint, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                Accept: 'application/json',
+                DPoP: proof,
+            },
+            body: params,
+        });
+        const result = await oauthJson(response);
+        return validateTokenResponse(result);
+    }
+}
+function validateMetadata(value, expectedIssuer, allowInsecureLoopback) {
+    if (!value || typeof value !== 'object' || value.issuer !== expectedIssuer) {
+        throw new Error('Authorization-server metadata issuer does not match the configured issuer');
+    }
+    const endpoints = [
+        value.authorization_endpoint,
+        value.token_endpoint,
+        value.jwks_uri,
+        value.revocation_endpoint,
+        value.pushed_authorization_request_endpoint,
+    ];
+    if (endpoints.some((endpoint) => typeof endpoint !== 'string')) {
+        throw new Error('Authorization-server metadata is missing a required endpoint');
+    }
+    for (const endpoint of endpoints)
+        assertSecureEndpoint(endpoint, allowInsecureLoopback);
+    if (value.require_pushed_authorization_requests !== true
+        || value.authorization_response_iss_parameter_supported !== true
+        || !value.response_types_supported?.includes('code')
+        || !value.grant_types_supported?.includes('authorization_code')
+        || !value.grant_types_supported?.includes(TOKEN_EXCHANGE_GRANT)
+        || !value.grant_types_supported?.includes('refresh_token')
+        || !value.code_challenge_methods_supported?.includes('S256')
+        || !value.dpop_signing_alg_values_supported?.includes('ES256')
+        || !value.token_endpoint_auth_methods_supported?.includes('none')
+        || !value.revocation_endpoint_auth_methods_supported?.includes('none')) {
+        throw new Error('Authorization server does not advertise the capabilities required by the agent-grants profile');
+    }
+    return value;
+}
+function assertSecureEndpoint(value, allowInsecureLoopback) {
+    const parsed = new URL(value);
+    const loopback = parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1' || parsed.hostname === '[::1]';
+    if (parsed.protocol !== 'https:' && !(allowInsecureLoopback && loopback && parsed.protocol === 'http:')) {
+        throw new Error(`OAuth endpoint must use HTTPS: ${value}`);
+    }
+    if (parsed.username || parsed.password || parsed.hash)
+        throw new Error(`OAuth endpoint is malformed: ${value}`);
+}
+async function validateAgentKeyPair(privateKey, publicJwk) {
+    const privateFields = ['d', 'p', 'q', 'dp', 'dq', 'qi', 'oth', 'k'];
+    if (privateFields.some((field) => publicJwk[field] !== undefined)) {
+        throw new Error('publicJwk must not contain private key material');
+    }
+    if (publicJwk.kty !== 'EC' || publicJwk.crv !== 'P-256'
+        || typeof publicJwk.x !== 'string' || typeof publicJwk.y !== 'string') {
+        throw new Error('OAuthAgentClient requires an ES256 P-256 public JWK');
+    }
+    try {
+        const probe = await new SignJWT({ probe: true })
+            .setProtectedHeader({ alg: 'ES256' })
+            .setIssuedAt()
+            .sign(privateKey);
+        const publicKey = await importJWK(publicJwk, 'ES256');
+        await jwtVerify(probe, publicKey, { algorithms: ['ES256'] });
+    }
+    catch {
+        throw new Error('privateKey does not match publicJwk or cannot sign ES256 proofs');
+    }
+}
+function assertRedirectResponse(callback, registeredRedirectUri) {
+    const registered = new URL(registeredRedirectUri);
+    if (registered.hash || callback.hash || callback.origin !== registered.origin
+        || callback.pathname !== registered.pathname
+        || callback.username || callback.password) {
+        throw new Error('Authorization response URL does not match the registered redirect URI');
+    }
+    for (const [name, value] of registered.searchParams) {
+        if (callback.searchParams.get(name) !== value) {
+            throw new Error('Authorization response URL does not match the registered redirect URI');
+        }
+    }
+    const responseParameters = new Set([
+        'code', 'state', 'iss', 'error', 'error_description', 'error_uri',
+    ]);
+    for (const name of responseParameters) {
+        if (callback.searchParams.getAll(name).length > 1) {
+            throw new Error(`Authorization response parameter ${name} must occur at most once`);
+        }
+    }
+    for (const name of callback.searchParams.keys()) {
+        if (!registered.searchParams.has(name) && !responseParameters.has(name)) {
+            throw new Error('Authorization response contains an unexpected redirect parameter');
+        }
+    }
+}
+function authorizationServerMetadataUrl(issuer) {
+    const parsed = new URL(issuer);
+    const issuerPath = parsed.pathname === '/' ? '' : parsed.pathname.replace(/\/$/, '');
+    parsed.pathname = `/.well-known/oauth-authorization-server${issuerPath}`;
+    parsed.search = '';
+    parsed.hash = '';
+    return parsed.toString();
+}
+function validateTokenResponse(value) {
+    if (!value || typeof value !== 'object'
+        || typeof value.access_token !== 'string' || value.access_token.length === 0
+        || value.token_type !== 'DPoP'
+        || typeof value.expires_in !== 'number' || !Number.isSafeInteger(value.expires_in)
+        || value.expires_in <= 0
+        || typeof value.scope !== 'string' || value.scope.length === 0
+        || (value.refresh_token !== undefined
+            && (typeof value.refresh_token !== 'string' || value.refresh_token.length === 0))
+        || (value.issued_token_type !== undefined
+            && value.issued_token_type !== ACCESS_TOKEN_TYPE)) {
+        throw new Error('Authorization server returned an invalid DPoP token response');
+    }
+    return value;
+}
+async function oauthJson(response) {
+    const body = await response.json().catch(() => null);
+    if (!response.ok) {
+        const error = typeof body?.['error'] === 'string' ? body['error'] : `HTTP ${response.status}`;
+        const description = typeof body?.['error_description'] === 'string' ? body['error_description'] : '';
+        throw new Error(description ? `${error}: ${description}` : error);
+    }
+    return body;
+}
+//# sourceMappingURL=oauth-agent.js.map