@introspection-sdk/aauth-resource 0.0.0 → 0.37.0

package/LICENSE

@@ -0,0 +1,191 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to the Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by the Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding any notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 Introspection AI Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,65 @@
+# @introspection-sdk/aauth-resource
+
+Make an HTTP API a native AAuth resource ([draft-hardt-oauth-aauth-protocol](https://github.com/dickhardt/AAuth) `-11`, three-party): the resource side of what [`@introspection-sdk/person-server`](../introspection-person-server) is to the person's side. Handlers take a Web `Request` and return a `Response`.
+
+- **Discovery:** `/.well-known/aauth-resource.json` and its JWKS.
+- **Signed facts:** `sign()` a quote or an offer, `verifySigned()` it when it comes back, so the price a Person Server weighs is the resource's, not the agent's.
+- **One call to admit an operation:** `authorize()` verifies the request's RFC 9421 signature and the token it presents, asks for a person token, then answers `401` with a resource token for exactly this call (an R3 proposal of its parameters, readable only by the person's Person Server, and its price as a budget), and admits it once an auth token for that proposal comes back.
+- **R3:** serves each proposal to the Person Server it was published for and no one else.
+
+Policy is not the resource's job: who approves, and within what budget, is the Person Server's.
+
+## Use
+
+```ts
+import {
+  createAAuthResource,
+  respond,
+} from "@introspection-sdk/aauth-resource";
+
+const resource = await createAAuthResource({
+  issuer: "https://works.example", // https://host
+  name: "Works API",
+  scopes: { "works.order": "Issue a work order on a quote" },
+  budgetUnits: [{ unit: "AUD", decimals: 2 }],
+  personServers: ["https://ps.example"], // closed list: verifying fetches their keys
+  agentProviders: ["https://api.introspection.dev"],
+  signingKey: process.env.WORKS_SIGNING_KEY, // PKCS#8 Ed25519 PEM; a fresh key otherwise
+});
+
+export async function handle(request: Request): Promise<Response> {
+  const served = await resource.handle(request); // well-known documents and R3 proposals
+  if (served) return served;
+  return respond(async () => {
+    const body = await request.text();
+    const { quote_id, quote } = JSON.parse(body);
+    const facts = await resource.verifySigned(quote); // 400 unless this resource signed it
+    const authz = await resource.authorize(request, body, {
+      scope: "works.order",
+      operation: { action: "order" },
+      parameters: { quote_id }, // exactly what the approval binds
+      summary: `Order ${quote_id} for $${Number(facts.total_cents) / 100}`,
+      budget: { amount: Number(facts.total_cents), unit: "AUD", decimals: 2 },
+    });
+    if (!authz.ok) return authz.response; // the 401 challenge, or a problem
+    return Response.json({
+      ordered: quote_id,
+      for: authz.sub,
+      mission: authz.mission_s256,
+    });
+  });
+}
+```
+
+`authz.jti` is the auth token's id: keep it with what the call created to answer a retried call with the same result.
+
+Two resources are built on it:
+
+- [`examples/aauth-travel`](../../examples/aauth-travel)'s booking provider (`lib/booking.ts`), served by Next.js under a rewritten path, so it passes `authorize(…, { url })` and lets its router hand `serveProposal` the key.
+- The strata works API in [introspection-org/recipe-strata-vendor](https://github.com/introspection-org/recipe-strata-vendor) (`aauth-strata/`).
+
+## Options worth knowing
+
+- `authorize(request, body, ask, { url })`: `ask` may be a function, run only once the presented token verifies, so a resource challenges before it validates the call. `url` is the public URL the request was addressed to, when the app serves it under another path.
+- `onPropose`: called as each call is put to a Person Server, e.g. to log or narrate it.
+- `r3Store`: where proposals live until their Person Server reads them; in memory by default, so a multi-process deployment supplies a shared one.

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { createAAuthResource, type AAuthResource, type AAuthResourceOptions, type Authorization, type AuthorizeRequest, type Budget, type Identification, respond, } from "./resource.js";
+export { AAuthError, problem } from "@introspection-sdk/person-server";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,MAAM,EACX,KAAK,cAAc,EACnB,OAAO,GACR,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { createAAuthResource, respond, } from "./resource.js";
+export { AAuthError, problem } from "@introspection-sdk/person-server";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EAOnB,OAAO,GACR,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/resource.d.ts

@@ -0,0 +1,128 @@
+/**
+ * An HTTP API as a native AAuth resource. Policy is not the resource's job: an
+ * operation that needs a person's say asks for a person token from their Person
+ * Server, then for an auth token for exactly this call, which the resource
+ * describes in a per-call R3 proposal only that Person Server may read, with
+ * its price as a budget any Person Server can weigh without reading R3.
+ */
+import { type R3Store, type VerifiedToken } from "@aauth/resource";
+import { type JWK, type JWTPayload } from "jose";
+/** draft-hardt-aauth-budgets: an amount in a unit's smallest denomination. */
+export interface Budget {
+    amount: number;
+    unit: string;
+    decimals: number;
+}
+export interface AAuthResourceOptions {
+    /** This resource's identifier: `https://host`, the origin agents call. */
+    issuer: string;
+    name: string;
+    description?: string;
+    /** Each scope this resource asks Person Servers to approve, described for people. */
+    scopes: Record<string, string>;
+    /** The R3 vocabulary its proposals are written in; `{issuer}/r3/vocabulary` by default. */
+    vocabulary?: string;
+    /** The budget units its resource tokens carry, advertised in its metadata. */
+    budgetUnits?: {
+        unit: string;
+        decimals: number;
+    }[];
+    /**
+     * Person Servers whose people it serves. Verifying a token fetches its
+     * issuer's keys, which is egress, so the list is closed.
+     */
+    personServers: readonly string[];
+    /** Agent Providers whose agent tokens it accepts. */
+    agentProviders: readonly string[];
+    /** A PKCS#8 PEM to keep the key across restarts; a fresh key otherwise. */
+    signingKey?: string;
+    kid?: string;
+    /** Where proposals live until their Person Server reads them; in memory by default. */
+    r3Store?: R3Store;
+    /** Called as each call is put to a Person Server, e.g. to log or narrate it. */
+    onPropose?: (proposal: {
+        ps: string;
+        scope: string;
+        parameters: Record<string, string>;
+        mission_s256?: string;
+    }) => void;
+}
+/** What one call asks the person's Person Server to approve. */
+export interface AuthorizeRequest {
+    scope: string;
+    /** The operation, as the vocabulary names it, e.g. `{ action: "order" }`. */
+    operation: Record<string, string>;
+    /** Exactly the parameters an approval binds: a retry must present the same. */
+    parameters: Record<string, string>;
+    /** One line for whoever approves it. */
+    summary: string;
+    /** The call's price, so a Person Server can weigh it against a mission's budget. */
+    budget?: Budget;
+}
+export type Authorization = {
+    ok: true;
+    token: VerifiedToken;
+    /** The person the call is for, as their Person Server names them. */
+    sub: string;
+    /** The Person Server that approved it. */
+    ps: string;
+    mission_s256?: string;
+    /** The auth token's `jti`, to make a retried call idempotent. */
+    jti: string;
+} | {
+    ok: false;
+    response: Response;
+};
+export type Identification = {
+    ok: true;
+    token: VerifiedToken;
+    /** The person the call is for, as their Person Server names them. */
+    sub: string;
+    /** The person's Person Server. */
+    ps: string;
+    mission_s256?: string;
+} | {
+    ok: false;
+    response: Response;
+};
+export interface AAuthResource {
+    readonly issuer: string;
+    /** `/.well-known/aauth-resource.json`. */
+    metadata(): Record<string, unknown>;
+    /** `/.well-known/jwks.json`. */
+    jwks(): {
+        keys: JWK[];
+    };
+    /** Sign facts this resource vouches for, such as a quote; `iss` is this resource. */
+    sign(claims: Record<string, unknown>): Promise<string>;
+    /** Verify a token this resource signed; a 400 problem otherwise. */
+    verifySigned(token: string): Promise<JWTPayload>;
+    /**
+     * Admit a call on an auth token whose R3 proposal is exactly `ask`, or answer
+     * with the challenge for what it lacks. `body` is the raw request body the
+     * signature covers. `ask` may be a function, run once the presented token
+     * verifies, so a resource challenges before it validates the call; an error
+     * it throws propagates. `url` is the public URL the request was addressed to,
+     * when the app serves it under another path; `{issuer}{path}` by default.
+     */
+    authorize(request: Request, body: string, ask: AuthorizeRequest | ((token: VerifiedToken) => AuthorizeRequest | Promise<AuthorizeRequest>), options?: {
+        url?: string;
+    }): Promise<Authorization>;
+    /**
+     * Admit a call on a person token alone, for an operation that spends nothing
+     * and needs no one's approval, such as undoing the person's own earlier call:
+     * it says who the agent acts for and under which mission, and the resource
+     * checks the call against that. Answers the person-token challenge otherwise.
+     */
+    authenticate(request: Request, body: string, options?: {
+        url?: string;
+    }): Promise<Identification>;
+    /** An R3 proposal, to the Person Server it was published for and no one else. */
+    serveProposal(request: Request, key: string): Promise<Response>;
+    /** Serve this resource's discovery documents and R3 proposals; undefined for other paths. */
+    handle(request: Request): Promise<Response | undefined>;
+}
+/** Run a handler, answering any AAuthError as a problem response. */
+export declare function respond(run: () => Promise<Response>): Promise<Response>;
+export declare function createAAuthResource(options: AAuthResourceOptions): Promise<AAuthResource>;
+//# sourceMappingURL=resource.d.ts.map

package/dist/resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAGL,KAAK,OAAO,EAEZ,KAAK,aAAa,EAOnB,MAAM,iBAAiB,CAAC;AAOzB,OAAO,EAEL,KAAK,GAAG,EACR,KAAK,UAAU,EAQhB,MAAM,MAAM,CAAC;AAOd,8EAA8E;AAC9E,MAAM,WAAW,MAAM;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,2FAA2F;IAC3F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,WAAW,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACnD;;;OAGG;IACH,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,qDAAqD;IACrD,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gFAAgF;IAChF,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE;QACrB,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,KAAK,IAAI,CAAC;CACZ;AAED,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,aAAa,GACrB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,KAAK,EAAE,aAAa,CAAC;IACrB,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,0CAA0C;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;CACb,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEtC,MAAM,MAAM,cAAc,GACtB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,KAAK,EAAE,aAAa,CAAC;IACrB,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,kCAAkC;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEtC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0CAA0C;IAC1C,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,gCAAgC;IAChC,IAAI,IAAI;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC;IACxB,qFAAqF;IACrF,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,oEAAoE;IACpE,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD;;;;;;;OAOG;IACH,SAAS,CACP,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,EACZ,GAAG,EACC,gBAAgB,GAChB,CAAC,CACC,KAAK,EAAE,aAAa,KACjB,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,EACtD,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GACzB,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,CACV,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GACzB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3B,iFAAiF;IACjF,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,6FAA6F;IAC7F,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;CACzD;AAED,qEAAqE;AACrE,wBAAsB,OAAO,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAQ7E;AAkED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,aAAa,CAAC,CA4SxB"}

package/dist/resource.js

@@ -0,0 +1,281 @@
+/**
+ * An HTTP API as a native AAuth resource. Policy is not the resource's job: an
+ * operation that needs a person's say asks for a person token from their Person
+ * Server, then for an auth token for exactly this call, which the resource
+ * describes in a per-call R3 proposal only that Person Server may read, with
+ * its price as a budget any Person Server can weigh without reading R3.
+ */
+import { AAuthTokenError, MemoryR3Store, buildRequirementHeader, createResourceToken, publishProposal, serveR3Document, verifyProposalParameters, verifyToken, } from "@aauth/resource";
+import { generateAcceptSignatureSchemeHeader, generateSignatureErrorHeader, verify, } from "@hellocoop/httpsig";
+import { SignJWT, createLocalJWKSet, decodeJwt, exportJWK, generateKeyPair, importPKCS8, jwtVerify, } from "jose";
+import { AAuthError, problem } from "@introspection-sdk/person-server";
+/** RFC 9864's fully-specified identifier; the polymorphic `EdDSA` is not used. */
+const ALG = "Ed25519";
+/** Run a handler, answering any AAuthError as a problem response. */
+export async function respond(run) {
+    try {
+        return await run();
+    }
+    catch (err) {
+        if (err instanceof AAuthError)
+            return problem(err.status, err.error, err.message, err.headers);
+        throw err;
+    }
+}
+function signatureError(code, detail) {
+    const headers = {
+        "Signature-Error": generateSignatureErrorHeader({ error: code }),
+    };
+    if (code === "unsupported_scheme")
+        headers["Accept-Signature-Scheme"] = generateAcceptSignatureSchemeHeader([
+            "jwt",
+        ]);
+    return new AAuthError(401, code, detail, headers);
+}
+const challenge = (requirement, detail) => Response.json({ error: "unauthorized", detail }, {
+    status: 401,
+    headers: {
+        "AAuth-Requirement": buildRequirementHeader(requirement),
+        "Content-Type": "application/problem+json",
+    },
+});
+// #region verify-signature
+/** Verify the RFC 9421 signature on a request as addressed to `url`; a body must be covered by `content-digest`. */
+async function verifySignature(request, body, url) {
+    const { host, pathname } = new URL(url);
+    const result = await verify({
+        method: request.method,
+        authority: host,
+        path: pathname,
+        headers: request.headers,
+        ...(body ? { body } : {}),
+    }, { requireContentDigest: true, supportedAlgorithms: ["Ed25519", "ES256"] });
+    if (!result.verified) {
+        const code = result.signatureError?.error ?? "invalid_signature";
+        throw signatureError(code, result.error ?? "signature does not verify");
+    }
+    return {
+        keyType: result.keyType,
+        thumbprint: result.thumbprint,
+        ...(result.jwt ? { jwt: result.jwt.raw } : {}),
+        ...(result.jwks_uri ? { server: result.jwks_uri.id } : {}),
+    };
+}
+// #endregion
+export async function createAAuthResource(options) {
+    const issuer = options.issuer.replace(/\/+$/, "");
+    if (!issuer.startsWith("https://"))
+        throw new Error("issuer must be an https origin");
+    const vocabulary = options.vocabulary ?? `${issuer}/r3/vocabulary`;
+    const r3 = options.r3Store ?? new MemoryR3Store();
+    const kid = options.kid ?? `${new URL(issuer).hostname}-1`;
+    const privateKey = options.signingKey
+        ? await importPKCS8(options.signingKey, ALG, { extractable: true })
+        : (await generateKeyPair(ALG, { extractable: true })).privateKey;
+    const publicJwk = { ...(await exportJWK(privateKey)), kid, alg: ALG };
+    delete publicJwk.d;
+    const keys = { keys: [{ ...publicJwk, use: "sig" }] };
+    const signWithHeader = (claims, header) => new SignJWT(claims)
+        .setProtectedHeader({ ...header, alg: ALG, kid })
+        .sign(privateKey);
+    const issuers = {
+        agent: options.agentProviders,
+        person: options.personServers,
+        auth: options.personServers,
+    };
+    /** The token a signed request presented: a kind it accepts, from an issuer it trusts, binding the signing key. */
+    async function verifyPresented(signed, accept) {
+        if (signed.keyType !== "jwt" || !signed.jwt)
+            throw signatureError("unsupported_scheme", "sign with sig=jwt");
+        let claims;
+        try {
+            claims = decodeJwt(signed.jwt);
+        }
+        catch {
+            throw signatureError("invalid_jwt", "not a JWT");
+        }
+        // Checked before verifying, since verifying fetches the issuer's keys.
+        if (!accept.some((kind) => issuers[kind]?.includes(String(claims.iss))))
+            throw signatureError("invalid_jwt", `${String(claims.iss)} is not trusted here`);
+        return verifyToken({
+            jwt: signed.jwt,
+            httpSignatureThumbprint: signed.thumbprint,
+            resource: issuer,
+            accept,
+        }).catch((err) => {
+            const code = err instanceof AAuthTokenError ? err.code : "invalid_jwt";
+            throw signatureError(code === "token_expired" ? "expired_jwt" : "invalid_jwt", err.message);
+        });
+    }
+    // #region propose
+    /** `401 requirement=auth-token`: a resource token for this one call, its proposal readable by the person's Person Server alone. */
+    async function propose(token, agentJkt, ask) {
+        const ps = token.type === "auth" ? token.ps : token.iss;
+        const proposal = await publishProposal({
+            vocabulary,
+            operation: ask.operation,
+            parameters: ask.parameters,
+            display: { summary: ask.summary },
+            store: r3,
+            baseUri: `${issuer}/r3`,
+            authorized: [ps],
+        });
+        const resourceToken = await createResourceToken({
+            resource: issuer,
+            audience: ps,
+            presentedToken: token,
+            agentJkt,
+            scope: ask.scope,
+            kid,
+            r3: { uri: proposal.r3_uri, s256: proposal.r3_s256 },
+        }, (claims, header) => signWithHeader({ ...claims, ...(ask.budget ? { budget: ask.budget } : {}) }, header));
+        options.onPropose?.({
+            ps,
+            scope: ask.scope,
+            parameters: ask.parameters,
+            ...("mission_s256" in token && token.mission_s256
+                ? { mission_s256: token.mission_s256 }
+                : {}),
+        });
+        return challenge({ requirement: "auth-token", resourceToken }, `take the resource token to ${ps}`);
+    }
+    // #endregion
+    /**
+     * The person or auth token a signed call presents, with the signed request,
+     * or the challenge for a person token when it presents none.
+     */
+    async function presented(request, body, url) {
+        if (!request.headers.get("signature-key"))
+            return {
+                challenge: challenge({ requirement: "person-token" }, "sign the request"),
+            };
+        const signed = await verifySignature(request, body, url ?? `${issuer}${new URL(request.url).pathname}`);
+        const token = await verifyPresented(signed, ["agent", "person", "auth"]);
+        if (token.type === "agent")
+            return {
+                challenge: challenge({ requirement: "person-token" }, "present a person token from the person's Person Server"),
+            };
+        return { signed, token };
+    }
+    /** Who a verified token is for, and under which mission. */
+    const caller = (token) => ({
+        token,
+        sub: token.sub,
+        ps: token.type === "auth" ? token.ps : token.iss,
+        ...("mission_s256" in token && token.mission_s256
+            ? { mission_s256: token.mission_s256 }
+            : {}),
+    });
+    /** Run `admit`, answering an AAuthError as its problem response. */
+    async function admitting(admit) {
+        try {
+            return await admit();
+        }
+        catch (err) {
+            if (err instanceof AAuthError)
+                return {
+                    ok: false,
+                    response: problem(err.status, err.error, err.message, err.headers),
+                };
+            throw err;
+        }
+    }
+    async function authorize(request, body, asked, { url } = {}) {
+        return admitting(async () => {
+            const call = await presented(request, body, url);
+            if ("challenge" in call)
+                return { ok: false, response: call.challenge };
+            const { signed, token } = call;
+            const ask = typeof asked === "function" ? await asked(token) : asked;
+            if (token.type === "auth" && token.r3_s256) {
+                const approved = await verifyProposalParameters({
+                    store: r3,
+                    r3_s256: token.r3_s256,
+                    presented: ask.parameters,
+                    operation: ask.operation,
+                }).then(() => true, () => false);
+                if (approved)
+                    return {
+                        ok: true,
+                        ...caller(token),
+                        jti: String(token.claims.jti),
+                    };
+            }
+            return {
+                ok: false,
+                response: await propose(token, signed.thumbprint, ask),
+            };
+        });
+    }
+    async function authenticate(request, body, { url } = {}) {
+        return admitting(async () => {
+            const call = await presented(request, body, url);
+            if ("challenge" in call)
+                return { ok: false, response: call.challenge };
+            return { ok: true, ...caller(call.token) };
+        });
+    }
+    // #region serve-r3
+    /** An R3 proposal, to the Person Server it was published for and no one else. */
+    async function serveProposal(request, key) {
+        const id = /jwks_uri;(?:[^,]*;)?id="([^"]+)"/.exec(request.headers.get("signature-key") ?? "")?.[1];
+        if (!id || !options.personServers.includes(id))
+            throw signatureError("invalid_signature", "only the person's Person Server reads a proposal");
+        const signed = await verifySignature(request, undefined, `${issuer}/r3/${key}`);
+        const served = await serveR3Document({
+            store: r3,
+            key,
+            signer: signed.server,
+        });
+        return new Response(served.body, {
+            status: served.status,
+            headers: served.headers,
+        });
+    }
+    // #endregion
+    const metadata = () => ({
+        issuer,
+        jwks_uri: `${issuer}/.well-known/jwks.json`,
+        access_mode: "auth-token",
+        name: options.name,
+        ...(options.description ? { description: options.description } : {}),
+        scope_descriptions: options.scopes,
+        r3_vocabularies: [vocabulary],
+        ...(options.budgetUnits ? { budget_units: options.budgetUnits } : {}),
+        additional_signature_components: ["content-type", "content-digest"],
+    });
+    return {
+        issuer,
+        metadata,
+        jwks: () => keys,
+        sign: (claims) => signWithHeader({ ...claims, iss: issuer }, { typ: "JWT" }),
+        async verifySigned(token) {
+            try {
+                return (await jwtVerify(token, createLocalJWKSet(keys), {
+                    issuer,
+                    algorithms: [ALG],
+                })).payload;
+            }
+            catch {
+                throw new AAuthError(400, "invalid_request", "not signed by this resource");
+            }
+        },
+        authorize,
+        authenticate,
+        serveProposal,
+        async handle(request) {
+            const { pathname } = new URL(request.url);
+            if (request.method !== "GET")
+                return undefined;
+            if (pathname === "/.well-known/aauth-resource.json")
+                return Response.json(metadata());
+            if (pathname === "/.well-known/jwks.json")
+                return Response.json(keys);
+            const key = /^\/r3\/([^/]+)$/.exec(pathname)?.[1];
+            if (key && key !== "vocabulary")
+                return respond(() => serveProposal(request, key));
+            return undefined;
+        },
+    };
+}
+//# sourceMappingURL=resource.js.map

package/dist/resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.js","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,eAAe,EACf,aAAa,EAIb,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,wBAAwB,EACxB,WAAW,GACZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAE5B,MAAM,GACP,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIL,OAAO,EACP,iBAAiB,EACjB,SAAS,EACT,SAAS,EACT,eAAe,EACf,WAAW,EACX,SAAS,GACV,MAAM,MAAM,CAAC;AAEd,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAEvE,kFAAkF;AAClF,MAAM,GAAG,GAAG,SAAS,CAAC;AA6HtB,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAA4B;IACxD,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,UAAU;YAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAwB,EAAE,MAAc;IAC9D,MAAM,OAAO,GAA2B;QACtC,iBAAiB,EAAE,4BAA4B,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KACjE,CAAC;IACF,IAAI,IAAI,KAAK,oBAAoB;QAC/B,OAAO,CAAC,yBAAyB,CAAC,GAAG,mCAAmC,CAAC;YACvE,KAAK;SACN,CAAC,CAAC;IACL,OAAO,IAAI,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,SAAS,GAAG,CAChB,WAAyD,EACzD,MAAc,EACd,EAAE,CACF,QAAQ,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,EACjC;IACE,MAAM,EAAE,GAAG;IACX,OAAO,EAAE;QACP,mBAAmB,EAAE,sBAAsB,CAAC,WAAW,CAAC;QACxD,cAAc,EAAE,0BAA0B;KAC3C;CACF,CACF,CAAC;AASJ,2BAA2B;AAC3B,oHAAoH;AACpH,KAAK,UAAU,eAAe,CAC5B,OAAgB,EAChB,IAAwB,EACxB,GAAW;IAEX,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CACzB;QACE,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,IAAI;QACf,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1B,EACD,EAAE,oBAAoB,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAC1E,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,EAAE,KAAK,IAAI,mBAAmB,CAAC;QACjE,MAAM,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,IAAI,2BAA2B,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC;AACJ,CAAC;AACD,aAAa;AAEb,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAA6B;IAE7B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,MAAM,gBAAgB,CAAC;IACnE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,aAAa,EAAE,CAAC;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,IAAI,CAAC;IAC3D,MAAM,UAAU,GAAc,OAAO,CAAC,UAAU;QAC9C,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACnE,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;IACnE,MAAM,SAAS,GAAQ,EAAE,GAAG,CAAC,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAC3E,OAAO,SAAS,CAAC,CAAC,CAAC;IACnB,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACtD,MAAM,cAAc,GAAG,CACrB,MAA+B,EAC/B,MAA+B,EAC/B,EAAE,CACF,IAAI,OAAO,CAAC,MAAM,CAAC;SAChB,kBAAkB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAqB,CAAC;SACnE,IAAI,CAAC,UAAU,CAAC,CAAC;IACtB,MAAM,OAAO,GAAkD;QAC7D,KAAK,EAAE,OAAO,CAAC,cAAc;QAC7B,MAAM,EAAE,OAAO,CAAC,aAAa;QAC7B,IAAI,EAAE,OAAO,CAAC,aAAa;KAC5B,CAAC;IAEF,kHAAkH;IAClH,KAAK,UAAU,eAAe,CAC5B,MAAqB,EACrB,MAAmB;QAEnB,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG;YACzC,MAAM,cAAc,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;QAClE,IAAI,MAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,cAAc,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;QACD,uEAAuE;QACvE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACrE,MAAM,cAAc,CAClB,aAAa,EACb,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAC5C,CAAC;QACJ,OAAO,WAAW,CAAC;YACjB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,uBAAuB,EAAE,MAAM,CAAC,UAAU;YAC1C,QAAQ,EAAE,MAAM;YAChB,MAAM;SACP,CAAC,CAAC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;YACtB,MAAM,IAAI,GAAG,GAAG,YAAY,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;YACvE,MAAM,cAAc,CAClB,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,EACxD,GAAG,CAAC,OAAO,CACZ,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kBAAkB;IAClB,mIAAmI;IACnI,KAAK,UAAU,OAAO,CACpB,KAAoB,EACpB,QAAgB,EAChB,GAAqB;QAErB,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;QACxD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC;YACrC,UAAU;YACV,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;YACjC,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,GAAG,MAAM,KAAK;YACvB,UAAU,EAAE,CAAC,EAAE,CAAC;SACjB,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAC7C;YACE,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,EAAE;YACZ,cAAc,EAAE,KAEM;YACtB,QAAQ;YACR,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,GAAG;YACH,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE;SACrD,EACD,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CACjB,cAAc,CACZ,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAC5D,MAAM,CACP,CACJ,CAAC;QACF,OAAO,CAAC,SAAS,EAAE,CAAC;YAClB,EAAE;YACF,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,GAAG,CAAC,cAAc,IAAI,KAAK,IAAI,KAAK,CAAC,YAAY;gBAC/C,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE;gBACtC,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,OAAO,SAAS,CACd,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,EAC5C,8BAA8B,EAAE,EAAE,CACnC,CAAC;IACJ,CAAC;IACD,aAAa;IAEb;;;OAGG;IACH,KAAK,UAAU,SAAS,CACtB,OAAgB,EAChB,IAAY,EACZ,GAAuB;QAIvB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YACvC,OAAO;gBACL,SAAS,EAAE,SAAS,CAClB,EAAE,WAAW,EAAE,cAAc,EAAE,EAC/B,kBAAkB,CACnB;aACF,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,OAAO,EACP,IAAI,EACJ,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CACnD,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACzE,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YACxB,OAAO;gBACL,SAAS,EAAE,SAAS,CAClB,EAAE,WAAW,EAAE,cAAc,EAAE,EAC/B,wDAAwD,CACzD;aACF,CAAC;QACJ,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,4DAA4D;IAC5D,MAAM,MAAM,GAAG,CAAC,KAAoB,EAAE,EAAE,CAAC,CAAC;QACxC,KAAK;QACL,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,EAAE,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG;QAChD,GAAG,CAAC,cAAc,IAAI,KAAK,IAAI,KAAK,CAAC,YAAY;YAC/C,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE;YACtC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,oEAAoE;IACpE,KAAK,UAAU,SAAS,CACtB,KAAuB;QAEvB,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,EAAE,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,UAAU;gBAC3B,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC;iBACnE,CAAC;YACJ,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,UAAU,SAAS,CACtB,OAAgB,EAChB,IAAY,EACZ,KAIsD,EACtD,EAAE,GAAG,KAAuB,EAAE;QAE9B,OAAO,SAAS,CAAC,KAAK,IAA4B,EAAE;YAClD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACjD,IAAI,WAAW,IAAI,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YACxE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;YAC/B,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACrE,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC3C,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;oBAC9C,KAAK,EAAE,EAAE;oBACT,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,SAAS,EAAE,GAAG,CAAC,UAAU;oBACzB,SAAS,EAAE,GAAG,CAAC,SAAS;iBACzB,CAAC,CAAC,IAAI,CACL,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;gBACF,IAAI,QAAQ;oBACV,OAAO;wBACL,EAAE,EAAE,IAAI;wBACR,GAAG,MAAM,CAAC,KAAK,CAAC;wBAChB,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;qBAC9B,CAAC;YACN,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,QAAQ,EAAE,MAAM,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC;aACvD,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,IAAY,EACZ,EAAE,GAAG,KAAuB,EAAE;QAE9B,OAAO,SAAS,CAAC,KAAK,IAA6B,EAAE;YACnD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACjD,IAAI,WAAW,IAAI,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YACxE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,mBAAmB;IACnB,iFAAiF;IACjF,KAAK,UAAU,aAAa,CAC1B,OAAgB,EAChB,GAAW;QAEX,MAAM,EAAE,GAAG,kCAAkC,CAAC,IAAI,CAChD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAC3C,EAAE,CAAC,CAAC,CAAC,CAAC;QACP,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,MAAM,cAAc,CAClB,mBAAmB,EACnB,kDAAkD,CACnD,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,OAAO,EACP,SAAS,EACT,GAAG,MAAM,OAAO,GAAG,EAAE,CACtB,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,KAAK,EAAE,EAAE;YACT,GAAG;YACH,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QACH,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;IACL,CAAC;IACD,aAAa;IAEb,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,CAAC;QACtB,MAAM;QACN,QAAQ,EAAE,GAAG,MAAM,wBAAwB;QAC3C,WAAW,EAAE,YAAY;QACzB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,kBAAkB,EAAE,OAAO,CAAC,MAAM;QAClC,eAAe,EAAE,CAAC,UAAU,CAAC;QAC7B,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,+BAA+B,EAAE,CAAC,cAAc,EAAE,gBAAgB,CAAC;KACpE,CAAC,CAAC;IAEH,OAAO;QACL,MAAM;QACN,QAAQ;QACR,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI;QAChB,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CACf,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QAC5D,KAAK,CAAC,YAAY,CAAC,KAAK;YACtB,IAAI,CAAC;gBACH,OAAO,CACL,MAAM,SAAS,CAAC,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE;oBAC9C,MAAM;oBACN,UAAU,EAAE,CAAC,GAAG,CAAC;iBAClB,CAAC,CACH,CAAC,OAAO,CAAC;YACZ,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,UAAU,CAClB,GAAG,EACH,iBAAiB,EACjB,6BAA6B,CAC9B,CAAC;YACJ,CAAC;QACH,CAAC;QACD,SAAS;QACT,YAAY;QACZ,aAAa;QACb,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC/C,IAAI,QAAQ,KAAK,kCAAkC;gBACjD,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnC,IAAI,QAAQ,KAAK,wBAAwB;gBAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtE,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAClD,IAAI,GAAG,IAAI,GAAG,KAAK,YAAY;gBAC7B,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YACpD,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1 +1,46 @@
-{"name":"@introspection-sdk/aauth-resource","version":"0.0.0"}
+{
+  "name": "@introspection-sdk/aauth-resource",
+  "version": "0.37.0",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/introspection-org/introspection-js-sdk.git",
+    "directory": "packages/introspection-aauth-resource"
+  },
+  "description": "Make an HTTP API an AAuth resource (draft-hardt-oauth-aauth-protocol -11): signed quotes, the person-token and auth-token challenges with an R3 proposal and a budget, and serving that proposal to its Person Server, as Request → Response helpers",
+  "engines": {
+    "node": ">=22"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist/"
+  ],
+  "dependencies": {
+    "@aauth/resource": "^3.0.0",
+    "@hellocoop/httpsig": "^2.6.0",
+    "jose": "^6.2.12",
+    "@introspection-sdk/person-server": "0.37.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.5",
+    "eslint": "^9.39.5",
+    "typescript": "5.9.3",
+    "@repo/eslint-config": "0.0.0",
+    "@repo/typescript-config": "0.0.0"
+  },
+  "scripts": {
+    "lint": "eslint . --max-warnings 0",
+    "check-types": "tsc --noEmit",
+    "build": "rm -rf dist && tsc",
+    "clean": "rm -rf dist",
+    "check:package": "publint --strict && attw --pack . --profile esm-only"
+  }
+}