@idpartners/client-attestation-sdk 1.0.1 → 1.4.0

package/dist/builders.js

@@ -35,9 +35,14 @@ export class ClientAttestationBuilder {
         this.#clientId = clientId;
         return this;
     }
-    /** Binds the client instance key as `cnf.jwk`. Must be a public JWK. */
+    /**
+     * Binds the client instance key as `cnf.jwk`: an EC (`crv` P-256, P-384 or P-521, `x`, `y`) or RSA
+     * (`n`, `e`) public key. Throws for one carrying private or secret members (`d`, `p`, `q`, `dp`, `dq`,
+     * `qi`, `oth`, `k`) or another `kty`. Only those members and an optional `kid` are copied into the
+     * attestation.
+     */
     confirmationJwk(publicInstanceJwk) {
-        this.#cnfJwk = publicInstanceJwk;
+        this.#cnfJwk = confirmationJwkMembers(publicInstanceJwk);
         return this;
     }
     /** Convenience: binds the public half of the given instance key as `cnf.jwk`. */
@@ -122,14 +127,61 @@ export class ClientAttestationBuilder {
         return signExternal(claims, this.#attesterKey, ATTESTATION_TYP);
     }
     #resolveExpiry(iat) {
+        let exp;
         if (this.#expiresAt !== null) {
-            return this.#expiresAt;
+            exp = this.#expiresAt;
+        }
+        else if (this.#ttl !== null) {
+            exp = iat + this.#ttl;
+        }
+        else {
+            throw new Error("expiry is required: call expiresAt(...) or expiresIn(...)");
+        }
+        if (!(exp > iat)) {
+            throw new Error(`attestation exp (${exp}) must be after iat (${iat})`);
+        }
+        return exp;
+    }
+}
+/** JWK members that carry private or secret key material (RFC 7518 section 6). */
+const PRIVATE_JWK_MEMBERS = ["d", "p", "q", "dp", "dq", "qi", "oth", "k"];
+/** The public members a `cnf.jwk` of each key type must carry. */
+const CONFIRMATION_JWK_MEMBERS = { EC: ["crv", "x", "y"], RSA: ["n", "e"] };
+/**
+ * The public key to bind as `cnf.jwk`: `kty`, the key type's public members and an optional `kid`, in the
+ * order the input has them. Refuses private or secret members, another `kty` or curve, or a missing member,
+ * so a private key is never signed into an attestation.
+ */
+function confirmationJwkMembers(jwk) {
+    if (jwk === null || typeof jwk !== "object" || Array.isArray(jwk)) {
+        throw new Error("cnf.jwk must be a JWK object");
+    }
+    const members = jwk;
+    for (const member of PRIVATE_JWK_MEMBERS) {
+        if (member in members) {
+            throw new Error(`cnf.jwk must be a public key: it carries the private member '${member}'`);
         }
-        if (this.#ttl !== null) {
-            return iat + this.#ttl;
+    }
+    const kty = members.kty;
+    const required = typeof kty === "string" && Object.hasOwn(CONFIRMATION_JWK_MEMBERS, kty)
+        ? CONFIRMATION_JWK_MEMBERS[kty]
+        : undefined;
+    if (!required) {
+        throw new Error(`cnf.jwk must be an EC or RSA public key, not kty ${JSON.stringify(kty)}`);
+    }
+    for (const member of required) {
+        if (typeof members[member] !== "string" || members[member] === "") {
+            throw new Error(`cnf.jwk (kty ${kty}) is missing '${member}'`);
         }
-        throw new Error("expiry is required: call expiresAt(...) or expiresIn(...)");
     }
+    if (kty === "EC" && !["P-256", "P-384", "P-521"].includes(members.crv)) {
+        throw new Error(`cnf.jwk curve must be P-256, P-384 or P-521, not ${JSON.stringify(members.crv)}`);
+    }
+    if ("kid" in members && (typeof members.kid !== "string" || members.kid === "")) {
+        throw new Error("cnf.jwk kid must be a non-empty string");
+    }
+    const keep = new Set(["kty", "kid", ...required]);
+    return Object.fromEntries(Object.entries(members).filter(([k]) => keep.has(k)));
 }
 /**
  * Builds a Client Attestation PoP JWT proving possession of the instance key. Client side of
@@ -208,8 +260,11 @@ export class DpopProofBuilder {
         return this;
     }
     /**
-     * The target URL (`htu`) — required. Normalised when built: query and fragment are dropped, and
-     * scheme and host lower-cased (RFC 9449 section 4.2).
+     * The target URL (`htu`) — required. Normalised when built (RFC 9449 section 4.2) by the rule in
+     * vectors/README.md: userinfo, query, fragment and a default port are dropped, and scheme and host
+     * lower-cased. `build` refuses a URL that is not an absolute http(s) URL with a valid ASCII host, port
+     * and path, or that has a backslash, ASCII whitespace or a control character before its query or
+     * fragment.
      */
     uri(htu) {
         this.#htu = htu;
@@ -265,20 +320,106 @@ export async function accessTokenHash(accessToken) {
     return base64url.encode(new Uint8Array(digest));
 }
 /**
- * The DPoP `htu` for a URL: scheme, host, port and path, with no query and no fragment. Scheme and host
- * are lower-cased and a default port dropped; a URL with no path keeps none (no slash is invented).
+ * Throws unless `url` is free of backslashes, ASCII whitespace and control characters before its query or
+ * fragment (the part that becomes `htu`). URL parsers disagree on where such a URL goes - WHATWG reads
+ * `https://evil.example\@as.example/t` as a request to evil.example, `urllib.parse` as one to
+ * as.example - so a proof's `htu` could name a different server from the one the request reaches.
  *
  * @internal
  */
-export function normalizeHtu(url) {
+export function checkHtu(url) {
+    const head = url.split(/[?#]/, 1)[0];
+    if (/[\x00-\x20\x7f\\]/.test(head)) {
+        throw new Error("uri (htu) must not contain a backslash, whitespace or control character");
+    }
+}
+/** The schemes an `htu` may have, with their default ports. */
+const HTU_DEFAULT_PORTS = { http: "80", https: "443" };
+const HTU_NOT_ABSOLUTE = "uri (htu) must be an absolute http or https URL with a host";
+const HTU_HOST = "uri (htu) has an invalid host";
+const HTU_PORT = "uri (htu) has an invalid port";
+const HTU_PATH = "uri (htu) has an invalid path";
+/**
+ * `[origin, path]` of a request URL's `htu`, by the rule in vectors/README.md that every port applies
+ * alike: an absolute http(s) URL with a host; scheme and host lower-cased (ASCII only, an IPv6 literal as
+ * written); no userinfo; the port as a plain number and dropped when it is the scheme's default; the path
+ * as written with non-ASCII characters percent-encoded (UTF-8); no query or fragment. It
+ * is read from the string itself, not through WHATWG `URL`, which would also resolve dot-segments,
+ * compress IPv6 and convert IDN hosts. Anything else throws.
+ *
+ * @internal
+ */
+export function htuParts(url) {
+    checkHtu(url);
     const bare = url.split(/[?#]/, 1)[0];
-    let parsed;
+    const sep = bare.indexOf("://");
+    const scheme = sep < 0 ? "" : bare.slice(0, sep).toLowerCase();
+    if (!Object.hasOwn(HTU_DEFAULT_PORTS, scheme)) {
+        throw new Error(HTU_NOT_ABSOLUTE);
+    }
+    const rest = bare.slice(sep + 3);
+    const slash = rest.indexOf("/");
+    const authority = slash < 0 ? rest : rest.slice(0, slash);
+    const path = slash < 0 ? "" : rest.slice(slash);
+    const hostport = authority.slice(authority.lastIndexOf("@") + 1);
+    let host;
+    let port = "";
+    if (hostport.startsWith("[")) {
+        const close = hostport.indexOf("]");
+        const literal = close < 0 ? "" : hostport.slice(1, close);
+        const after = close < 0 ? "" : hostport.slice(close + 1);
+        if (!literal.includes(":") || !/^[0-9A-Fa-f:.]*$/.test(literal) || (after !== "" && after[0] !== ":")) {
+            throw new Error(HTU_HOST);
+        }
+        host = `[${literal.toLowerCase()}]`;
+        port = after.slice(1);
+    }
+    else {
+        const colon = hostport.indexOf(":");
+        host = colon < 0 ? hostport : hostport.slice(0, colon);
+        port = colon < 0 ? "" : hostport.slice(colon + 1);
+        if (host === "") {
+            throw new Error(HTU_NOT_ABSOLUTE);
+        }
+        if (!/^[A-Za-z0-9\-._~]+$/.test(host)) {
+            throw new Error(HTU_HOST);
+        }
+        host = host.toLowerCase();
+    }
+    if (port !== "") {
+        const digits = port.replace(/^0+/, "");
+        if (!/^[0-9]+$/.test(port) || digits.length > 5 || Number(digits) > 65535) {
+            throw new Error(HTU_PORT);
+        }
+        const n = String(Number(digits));
+        if (n !== HTU_DEFAULT_PORTS[scheme]) {
+            host += `:${n}`;
+        }
+    }
+    return [`${scheme}://${host}`, encodeHtuPath(path)];
+}
+/**
+ * `path` with every non-ASCII character percent-encoded as UTF-8 (upper-case hex) and every ASCII
+ * character kept as written, `%XX` escapes, a lone `%` and characters outside RFC 3986 `pchar` included:
+ * those are what the HTTP client sends, and a server compares `htu` after RFC 3986 section 6.2.2
+ * normalisation, which decodes only unreserved characters. (`checkHtu` has already refused controls,
+ * whitespace and backslash.) A lone surrogate is refused.
+ */
+function encodeHtuPath(path) {
     try {
-        parsed = new URL(bare);
+        return path.replace(/[^\x00-\x7f]+/g, (run) => encodeURIComponent(run)); // throws on a lone surrogate
     }
     catch {
-        return bare;
+        throw new Error(HTU_PATH);
     }
-    const hasPath = /^[a-z][a-z0-9+.-]*:\/\/[^/]*\//i.test(bare);
-    return `${parsed.protocol}//${parsed.host}${hasPath ? parsed.pathname : ""}`;
+}
+/**
+ * The DPoP `htu` for a URL (RFC 9449 section 4.2): the origin and path {@link htuParts} gives. A URL
+ * with no path keeps none (no slash is invented).
+ *
+ * @internal
+ */
+export function normalizeHtu(url) {
+    const [origin, path] = htuParts(url);
+    return origin + path;
 }

package/dist/credential.d.ts

@@ -2,6 +2,8 @@ import { SigningKeyPair } from "./signing-key-pair.js";
 export declare const ATTESTATION_HEADER = "OAuth-Client-Attestation";
 export declare const POP_HEADER = "OAuth-Client-Attestation-PoP";
 export declare const DPOP_HEADER = "DPoP";
+/** The response header a `use_attestation_challenge` refusal carries a fresh challenge in (draft -11 section 6.1). */
+export declare const CHALLENGE_HEADER = "OAuth-Client-Attestation-Challenge";
 /**
  * The Attester-issued attestation JWT plus the instance key it is bound to. Produces the
  * token-request headers — PoP-JWT mode or DPoP combined mode — minting a fresh proof each call.

package/dist/credential.js

@@ -6,6 +6,8 @@ import { requireText } from "./signing-key-pair.js";
 export const ATTESTATION_HEADER = "OAuth-Client-Attestation";
 export const POP_HEADER = "OAuth-Client-Attestation-PoP";
 export const DPOP_HEADER = "DPoP";
+/** The response header a `use_attestation_challenge` refusal carries a fresh challenge in (draft -11 section 6.1). */
+export const CHALLENGE_HEADER = "OAuth-Client-Attestation-Challenge";
 /**
  * The Attester-issued attestation JWT plus the instance key it is bound to. Produces the
  * token-request headers — PoP-JWT mode or DPoP combined mode — minting a fresh proof each call.

package/dist/errors.d.ts

@@ -2,7 +2,11 @@
  * The SDK's error types. {@link ClientAttestationError} is the base for every failure of the
  * one-call flow; {@link TransportError} is the subclass for anything that went wrong on the wire.
  */
-/** A step in the flow failed. `status` and `body` are set for HTTP failures. */
+/**
+ * A step in the flow failed. `status` and `body` are set for HTTP failures: `body` is at most the first 512
+ * characters of a non-2xx response, and unset for a 2xx response that could not be used, since that body
+ * may hold a token, attestation or SVID.
+ */
 export declare class ClientAttestationError extends Error {
     readonly status?: number;
     readonly body?: string;
@@ -17,7 +21,7 @@ export type TransportFailure = "network" | "timeout" | "redirect" | "too_large"
 /**
  * An outbound HTTP call failed: unreachable, timed out, redirected, oversized, non-2xx, or malformed
  * JSON (see {@link kind}). `status` is set when a response was received; `body` holds at most the first
- * 512 characters of it.
+ * 512 characters of a non-2xx one.
  */
 export declare class TransportError extends ClientAttestationError {
     readonly kind: TransportFailure;

package/dist/errors.js

@@ -2,7 +2,11 @@
  * The SDK's error types. {@link ClientAttestationError} is the base for every failure of the
  * one-call flow; {@link TransportError} is the subclass for anything that went wrong on the wire.
  */
-/** A step in the flow failed. `status` and `body` are set for HTTP failures. */
+/**
+ * A step in the flow failed. `status` and `body` are set for HTTP failures: `body` is at most the first 512
+ * characters of a non-2xx response, and unset for a 2xx response that could not be used, since that body
+ * may hold a token, attestation or SVID.
+ */
 export class ClientAttestationError extends Error {
     status;
     body;
@@ -16,7 +20,7 @@ export class ClientAttestationError extends Error {
 /**
  * An outbound HTTP call failed: unreachable, timed out, redirected, oversized, non-2xx, or malformed
  * JSON (see {@link kind}). `status` is set when a response was received; `body` holds at most the first
- * 512 characters of it.
+ * 512 characters of a non-2xx one.
  */
 export class TransportError extends ClientAttestationError {
     kind;

package/dist/evidence.d.ts

@@ -19,6 +19,7 @@ export declare class EvidenceNotFound extends Error {
  * Kubernetes and GKE mount a short-lived, auto-rotated service-account token into the pod as a file
  * (a projected `serviceAccountToken` volume). Reading it fresh each time picks up the rotation. The
  * file's audience must already be the attester's evidence audience — set it when you declare the volume.
+ * The path must be a regular file of at most 64 KiB; anything else is an {@link EvidenceNotFound}.
  *
  * Needs a filesystem: `node:fs/promises` is loaded on the first `fetch`, which throws a
  * `ClientAttestationError` on a runtime without it.
@@ -33,7 +34,8 @@ export declare class FileTokenSvidSource implements SvidSource {
  *
  * Works on any Google runtime that exposes the metadata server (GCE, GKE, Cloud Run, Vertex AI Agent
  * Engine). The token's `aud` is the attester's evidence audience; `sub` is the service account. No
- * google-auth dependency — a plain metadata call.
+ * google-auth dependency — a plain metadata call. The answer must be HTTP 200 carrying the
+ * `Metadata-Flavor: Google` response header, as the real metadata server sends.
  */
 export declare class GoogleMetadataSvidSource implements SvidSource {
     private readonly timeoutMs;

package/dist/evidence.js

@@ -10,12 +10,12 @@
  * - the GCP metadata server (GCE, GKE, Cloud Run, Vertex AI Agent Engine).
  *
  * {@link autoDetectEvidence} tries these in order and returns the first that applies, so a developer
- * can write `new ClientAttestation(attesterUrl)` and have it work without naming the source. Override by
+ * can write `new ClientAttestation(attesterUrl, { evidenceAudience })` and have it work without naming the source. Override by
  * passing an explicit {@link SvidSource} to {@link ClientAttestation}.
  */
 import { TransportError } from "./errors.js";
 import { request, snippet } from "./http.js";
-import { envVar, importNodeBuiltin } from "./runtime.js";
+import { envVar, importNodeBuiltin, utf8Decode } from "./runtime.js";
 import { SpireWorkloadApiSvidSource, StaticSvidSource } from "./svid-source.js";
 /** Environment variable holding the evidence token itself (static). */
 export const ENV_SVID = "CLIENT_ATTESTATION_SVID";
@@ -39,6 +39,8 @@ export const GCP_METADATA_BASE = "http://metadata.google.internal";
  * @internal
  */
 export const GCP_METADATA_IDENTITY = GCP_METADATA_BASE + "/computeMetadata/v1/instance/service-accounts/default/identity";
+/** A token file larger than this (64 KiB) is refused: a projected token is a few KiB. */
+const MAX_TOKEN_FILE_BYTES = 64 * 1024;
 /** No platform identity could be detected and none was supplied. */
 export class EvidenceNotFound extends Error {
     constructor(message) {
@@ -52,6 +54,7 @@ export class EvidenceNotFound extends Error {
  * Kubernetes and GKE mount a short-lived, auto-rotated service-account token into the pod as a file
  * (a projected `serviceAccountToken` volume). Reading it fresh each time picks up the rotation. The
  * file's audience must already be the attester's evidence audience — set it when you declare the volume.
+ * The path must be a regular file of at most 64 KiB; anything else is an {@link EvidenceNotFound}.
  *
  * Needs a filesystem: `node:fs/promises` is loaded on the first `fetch`, which throws a
  * `ClientAttestationError` on a runtime without it.
@@ -62,9 +65,29 @@ export class FileTokenSvidSource {
         this.path = path;
     }
     async fetch(_audience) {
-        const { readFile } = await importNodeBuiltin("fs/promises", "FileTokenSvidSource");
-        const contents = await readFile(this.path, "utf8");
-        return contents.trim();
+        const { open, stat } = await importNodeBuiltin("fs/promises", "FileTokenSvidSource");
+        // Checked before opening: opening a FIFO blocks, and a device such as /dev/zero never ends.
+        if (!(await stat(this.path)).isFile()) {
+            throw new EvidenceNotFound(`token file ${this.path} is not a regular file`);
+        }
+        const handle = await open(this.path, "r");
+        try {
+            const buf = new Uint8Array(MAX_TOKEN_FILE_BYTES + 1);
+            let total = 0;
+            for (;;) {
+                const { bytesRead } = await handle.read(buf, total, buf.length - total, null);
+                if (bytesRead === 0)
+                    break;
+                total += bytesRead;
+                if (total > MAX_TOKEN_FILE_BYTES) {
+                    throw new EvidenceNotFound(`token file ${this.path} is larger than ${MAX_TOKEN_FILE_BYTES} bytes`);
+                }
+            }
+            return utf8Decode(buf.subarray(0, total)).trim();
+        }
+        finally {
+            await handle.close();
+        }
     }
 }
 /**
@@ -72,7 +95,8 @@ export class FileTokenSvidSource {
  *
  * Works on any Google runtime that exposes the metadata server (GCE, GKE, Cloud Run, Vertex AI Agent
  * Engine). The token's `aud` is the attester's evidence audience; `sub` is the service account. No
- * google-auth dependency — a plain metadata call.
+ * google-auth dependency — a plain metadata call. The answer must be HTTP 200 carrying the
+ * `Metadata-Flavor: Google` response header, as the real metadata server sends.
  */
 export class GoogleMetadataSvidSource {
     timeoutMs;
@@ -92,12 +116,17 @@ export class GoogleMetadataSvidSource {
             headers: { "Metadata-Flavor": "Google" },
             timeoutMs: this.timeoutMs,
         });
-        if (!res.ok) {
+        if (res.status !== 200) {
             throw new TransportError(`GCP metadata identity endpoint -> ${res.status}`, "status", {
                 status: res.status,
                 body: snippet(res.body),
             });
         }
+        if (!fromGoogleMetadata(res.headers)) {
+            throw new TransportError("GCP metadata identity endpoint answered without Metadata-Flavor: Google", "status", {
+                status: res.status,
+            });
+        }
         return res.body.trim();
     }
 }
@@ -114,6 +143,15 @@ async function pathProbe() {
         return () => false;
     }
 }
+/** Whether a response carries the header the GCP metadata server always sets. */
+function fromGoogleMetadata(headers) {
+    return headers.get("Metadata-Flavor") === "Google";
+}
+/**
+ * Whether the GCP metadata server answers: HTTP 200 with `Metadata-Flavor: Google`.
+ * `metadata.google.internal` is a DNS name, so whatever a search domain, LLMNR or a hostile resolver
+ * points it at could answer; the header is what google-auth checks too.
+ */
 async function gcpMetadataAvailable(base, timeoutMs = 300) {
     try {
         const res = await request(base + "/computeMetadata/v1/", {
@@ -121,7 +159,7 @@ async function gcpMetadataAvailable(base, timeoutMs = 300) {
             headers: { "Metadata-Flavor": "Google" },
             timeoutMs,
         });
-        return res.ok;
+        return res.status === 200 && fromGoogleMetadata(res.headers);
     }
     catch {
         return false;

package/dist/http.js

@@ -9,20 +9,50 @@
  * - redirects are never followed — a 3xx is a {@link TransportError}, and the target is never contacted;
  * - the response body is capped (default 1 MiB), by `content-length` and again while streaming;
  * - {@link request} returns non-2xx responses as data; {@link jsonOk} turns them, and malformed JSON,
- *   into a {@link TransportError}.
+ *   into a {@link TransportError};
+ * - a URL with userinfo (`user:password@`) is refused, and errors name a URL without its userinfo, query or
+ *   fragment.
+ *
+ * Proxies: `fetch` uses no proxy from the environment by default (Node, Deno, Bun without configuration,
+ * edge runtimes). Node started with `NODE_USE_ENV_PROXY=1` or `--use-env-proxy` sends every request,
+ * plain http included, to `HTTP_PROXY` / `HTTPS_PROXY`; the SDK can't pick a dispatcher per request
+ * without depending on undici, so the other ports' rule (a proxy only for https to a remote host) is
+ * then the operator's to keep, with `NO_PROXY`.
  */
-import { TransportError } from "./errors.js";
+import { ClientAttestationError, TransportError } from "./errors.js";
 import { utf8Decode, utf8Encode } from "./runtime.js";
 /** @internal */
 export const DEFAULT_MAX_BYTES = 1024 * 1024;
 /** @internal */
 export const DEFAULT_TIMEOUT_MS = 20_000;
 /**
- * At most this many characters of a response body are carried in an error.
+ * At most this many characters of a non-2xx response body are carried in an error. A 2xx body never is:
+ * that is where access tokens, attestations and SVIDs travel.
  *
  * @internal
  */
 export const ERROR_BODY_CHARS = 512;
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+/**
+ * Refuse a non-https URL unless it is loopback or the caller passed `allowInsecure`. Shared by every SDK
+ * client that sends credentials.
+ *
+ * @internal
+ */
+export function checkSecure(url, what, allowInsecure) {
+    if (allowInsecure)
+        return;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new ClientAttestationError(`${what} is not a valid URL: ${url}`);
+    }
+    if (parsed.protocol === "https:" || LOOPBACK_HOSTS.has(parsed.hostname.toLowerCase()))
+        return;
+    throw new ClientAttestationError(`${what} must use https: ${url} (loopback hosts are exempt; pass allowInsecure: true to override)`);
+}
 /**
  * The first {@link ERROR_BODY_CHARS} characters of a body, for an error message.
  *
@@ -31,6 +61,30 @@ export const ERROR_BODY_CHARS = 512;
 export function snippet(body) {
     return body.length > ERROR_BODY_CHARS ? body.slice(0, ERROR_BODY_CHARS) : body;
 }
+/**
+ * `url` without its userinfo, query or fragment, for error messages: a query can carry a secret, and
+ * userinfo is one.
+ *
+ * @internal
+ */
+export function displayUrl(url) {
+    const beforeQuery = url.split(/[?#]/, 1)[0] ?? "";
+    return beforeQuery.replace(/^([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)[^/\\]*@/, "$1");
+}
+/**
+ * Whether `url` carries userinfo, read as `fetch` would read it; an unparseable URL is checked by hand.
+ *
+ * @internal
+ */
+export function hasUserinfo(url) {
+    try {
+        const parsed = new URL(url);
+        return parsed.username !== "" || parsed.password !== "";
+    }
+    catch {
+        return /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^/?#\\]*@/.test(url);
+    }
+}
 function describe(err) {
     return err instanceof Error ? err.message : String(err);
 }
@@ -49,7 +103,11 @@ export async function request(url, opts = {}) {
     const method = opts.method ?? "GET";
     const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const maxBytes = opts.maxBytes ?? DEFAULT_MAX_BYTES;
-    const where = `${method} ${url}`;
+    const where = `${method} ${displayUrl(url)}`;
+    if (hasUserinfo(url)) {
+        // fetch refuses these too, but its error would come after `where` held the userinfo
+        throw new TransportError(`${where}: URLs with userinfo (user:password@) are not supported`, "network");
+    }
     const timedOut = (cause) => new TransportError(`${where} timed out after ${timeoutMs} ms`, "timeout", { cause });
     let res;
     try {
@@ -147,7 +205,7 @@ async function readCapped(res, maxBytes, tooLarge) {
 export function jsonOk(res, opts = {}) {
     if (!res.ok) {
         const body = snippet(res.body);
-        throw new TransportError(`${res.method} ${res.url} returned HTTP ${res.status}: ${body}`, "status", {
+        throw new TransportError(`${res.method} ${displayUrl(res.url)} returned HTTP ${res.status}: ${body}`, "status", {
             status: res.status,
             body,
         });
@@ -155,7 +213,9 @@ export function jsonOk(res, opts = {}) {
     return parseJsonObject(res, opts);
 }
 /**
- * Parse `res.body` as a JSON object regardless of status; a {@link TransportError} if it is not one.
+ * Parse `res.body` as a JSON object regardless of status; a {@link TransportError} if it is not one. The
+ * error carries no body, no cause and not the parser's message, which quotes part of the text: the body
+ * parsed here is a 2xx one, which carries tokens, attestations and SVIDs.
  *
  * @internal
  */
@@ -166,17 +226,12 @@ export function parseJsonObject(res, opts = {}) {
     try {
         parsed = JSON.parse(res.body);
     }
-    catch (err) {
-        throw new TransportError(`${res.method} ${res.url} returned malformed JSON: ${describe(err)}`, "json", {
-            status: res.status,
-            body: snippet(res.body),
-            cause: err,
-        });
+    catch {
+        throw new TransportError(`${res.method} ${displayUrl(res.url)} returned malformed JSON`, "json", { status: res.status });
     }
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-        throw new TransportError(`${res.method} ${res.url} did not return a JSON object`, "json", {
+        throw new TransportError(`${res.method} ${displayUrl(res.url)} did not return a JSON object`, "json", {
             status: res.status,
-            body: snippet(res.body),
         });
     }
     return parsed;

package/dist/index.d.ts

@@ -7,7 +7,7 @@
  */
 export { SigningKeyPair } from "./signing-key-pair.js";
 export { ClientAttestationBuilder, DpopProofBuilder, PopBuilder, ATTESTATION_TYP, POP_TYP, DPOP_TYP, } from "./builders.js";
-export { ClientAttestationCredential, ATTESTATION_HEADER, POP_HEADER, DPOP_HEADER, } from "./credential.js";
+export { ClientAttestationCredential, ATTESTATION_HEADER, POP_HEADER, DPOP_HEADER, CHALLENGE_HEADER, } from "./credential.js";
 export { OpenBaoTransitSigner } from "./signer.js";
 export type { JwsSigner } from "./signer.js";
 export { AttestationIssuanceClient, IssuedAttestation, IssuanceError, INSTANCE_PROOF_TYP, } from "./issuance.js";
@@ -21,6 +21,10 @@ export type { AttesterMetadata, AttesterProfile, AttesterTransport, MintResult }
 export type { TransportFailure } from "./errors.js";
 export { NOOP_LOGGER } from "./logging.js";
 export type { Logger, LogAttributes, LogLevel } from "./logging.js";
-export declare const VERSION = "1.0.1";
-/** draft-ietf-oauth-attestation-based-client-auth revision this SDK implements. */
-export declare const DRAFT_REVISION = "10";
+export declare const VERSION = "1.4.0";
+/**
+ * draft-ietf-oauth-attestation-based-client-auth revision this port implements. -11 (the Go, Java and
+ * Python ports are at -10): the authorization server's challenge endpoint and the
+ * `use_attestation_challenge` retry, with combined mode on RFC 9449 nonces alone.
+ */
+export declare const DRAFT_REVISION = "11";

package/dist/index.js

@@ -7,7 +7,7 @@
  */
 export { SigningKeyPair } from "./signing-key-pair.js";
 export { ClientAttestationBuilder, DpopProofBuilder, PopBuilder, ATTESTATION_TYP, POP_TYP, DPOP_TYP, } from "./builders.js";
-export { ClientAttestationCredential, ATTESTATION_HEADER, POP_HEADER, DPOP_HEADER, } from "./credential.js";
+export { ClientAttestationCredential, ATTESTATION_HEADER, POP_HEADER, DPOP_HEADER, CHALLENGE_HEADER, } from "./credential.js";
 export { OpenBaoTransitSigner } from "./signer.js";
 export { AttestationIssuanceClient, IssuedAttestation, IssuanceError, INSTANCE_PROOF_TYP, } from "./issuance.js";
 export { StaticSvidSource, HttpSvidSource, SpireWorkloadApiSvidSource, } from "./svid-source.js";
@@ -15,6 +15,10 @@ export { EvidenceNotFound, FileTokenSvidSource, GoogleMetadataSvidSource, autoDe
 export { ClientAttestation, ClientAttestationError, TransportError, DEFAULT_EXPIRY_SKEW_SECONDS, } from "./token-source.js";
 export { MintRequest, PingFederateProfile } from "./attester.js";
 export { NOOP_LOGGER } from "./logging.js";
-export const VERSION = "1.0.1";
-/** draft-ietf-oauth-attestation-based-client-auth revision this SDK implements. */
-export const DRAFT_REVISION = "10";
+export const VERSION = "1.4.0";
+/**
+ * draft-ietf-oauth-attestation-based-client-auth revision this port implements. -11 (the Go, Java and
+ * Python ports are at -10): the authorization server's challenge endpoint and the
+ * `use_attestation_challenge` retry, with combined mode on RFC 9449 nonces alone.
+ */
+export const DRAFT_REVISION = "11";

package/dist/issuance.d.ts

@@ -12,20 +12,26 @@ import type { SvidSource } from "./svid-source.js";
 /** The instance-key proof typ the PingFederate profile presents (server InstanceKeyProofValidator.TYP). */
 export { INSTANCE_PROOF_TYP } from "./attester.js";
 /**
- * Thrown when the issuance endpoint rejects the request (non-2xx). Transport failures — unreachable,
- * timeout, redirect, oversized or malformed response — are a {@link TransportError} instead.
+ * Thrown when the issuance endpoint rejects the request (non-2xx); `body` is at most the first 512
+ * characters of the response. Transport failures — unreachable, timeout, redirect, oversized or malformed
+ * response — are a {@link TransportError} instead.
  */
 export declare class IssuanceError extends Error {
     readonly status: number;
     readonly body: string;
     constructor(status: number, body: string);
 }
-/** A minted Client Attestation plus the instance key it is bound to. */
+/**
+ * A minted Client Attestation plus the instance key it is bound to. The attestation is a getter over a
+ * private field, so `JSON.stringify` and `console.log` of this object don't show it.
+ */
 export declare class IssuedAttestation {
-    readonly attestation: string;
+    #private;
     readonly expiresIn: number | undefined;
     readonly instanceKey: SigningKeyPair;
     constructor(attestation: string, expiresIn: number | undefined, instanceKey: SigningKeyPair);
+    /** The Client Attestation (a compact JWT). */
+    get attestation(): string;
     /** A fresh Client Attestation PoP for the token endpoint, signed by the bound instance key. */
     pop(audience: string, clientId?: string, challenge?: string): Promise<string>;
     /**
@@ -39,6 +45,9 @@ export declare class IssuedAttestation {
  *
  * `opts.profile` sets the mint protocol (default {@link PingFederateProfile}; see
  * docs/attester-profiles.md). The endpoint is given directly, so the profile's discovery is not used.
+ *
+ * The SVID is a bearer credential to the attester, so the endpoint, and every URL the profile calls, must be
+ * https unless its host is loopback (`localhost`, `127.0.0.1`, `::1`) or `opts.allowInsecure` is set.
   *
   * @experimental See docs/api.md: it calls a PingFederate demo issuance servlet (/federation/attestation)
   * whose protocol is not standardised.
@@ -50,11 +59,16 @@ export declare class AttestationIssuanceClient {
     private readonly source;
     readonly instanceKey: SigningKeyPair;
     readonly profile: AttesterProfile;
+    private readonly transport;
     private constructor();
-    /** Generate a fresh ES256 instance key and return a ready client. */
+    /**
+     * Generate a fresh ES256 instance key and return a ready client. `opts.allowInsecure` permits plain-http
+     * URLs on hosts that are not loopback (default `false`).
+     */
     static create(endpoint: string, clientId: string, attesterIssuer: string, source: SvidSource, opts?: {
         instanceKey?: SigningKeyPair;
         profile?: AttesterProfile;
+        allowInsecure?: boolean;
     }): Promise<AttestationIssuanceClient>;
     /** Fetch the SVID, prove possession of the instance key, and exchange them for a minted attestation. */
     bootstrap(authorizationDetails?: Array<Record<string, unknown>>, challenge?: string): Promise<IssuedAttestation>;