@pidgeon-ai/cli 1.36.1 → 1.38.0

package/dist/{chunk-FA77SSPH.js → chunk-ZDJG3Z7B.js}

@@ -2,7 +2,7 @@
 import {
   COMMANDS,
   __export
-} from "./chunk-W5VS5RM7.js";
+} from "./chunk-UBA2RP6N.js";
 
 // ../sdk/dist/index.js
 var dist_exports = {};
@@ -67,6 +67,14 @@ __export(dist_exports, {
   eventsSocket: () => eventsSocket,
   eventsStream: () => eventsStream,
   exportMail: () => exportMail,
+  grantsCreate: () => grantsCreate,
+  grantsGet: () => grantsGet,
+  grantsList: () => grantsList,
+  grantsRevoke: () => grantsRevoke,
+  grantsStatus: () => grantsStatus,
+  grantsTemplatesCreate: () => grantsTemplatesCreate,
+  grantsTemplatesDelete: () => grantsTemplatesDelete,
+  grantsTemplatesList: () => grantsTemplatesList,
   identitiesAccessCreate: () => identitiesAccessCreate,
   identitiesAccessDelete: () => identitiesAccessDelete,
   identitiesAccessGet: () => identitiesAccessGet,
@@ -1025,6 +1033,10 @@ var logMonitorsDelete = (options) => (options.client ?? client).delete({
   url: "/log/monitors/{id}",
   ...options
 });
+var grantsStatus = (options) => (options.client ?? client).get({
+  url: "/grants/{id}/status",
+  ...options
+});
 var agentConnect = (options) => (options.client ?? client).post({
   url: "/agent/connect",
   ...options,
@@ -1201,6 +1213,49 @@ var labelsUpdate = (options) => (options.client ?? client).patch({
     ...options.headers
   }
 });
+var grantsTemplatesList = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/grant-templates",
+  ...options
+});
+var grantsTemplatesCreate = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/grant-templates",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var grantsTemplatesDelete = (options) => (options.client ?? client).delete({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/grant-templates/{id}",
+  ...options
+});
+var grantsList = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/grants",
+  ...options
+});
+var grantsCreate = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/grants",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var grantsRevoke = (options) => (options.client ?? client).delete({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/grants/{id}",
+  ...options
+});
+var grantsGet = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/grants/{id}",
+  ...options
+});
 var contactsList = (options) => (options?.client ?? client).get({
   security: [{ scheme: "bearer", type: "http" }],
   url: "/contacts",
@@ -1972,7 +2027,7 @@ function sleep(ms, signal) {
   });
 }
 
-// ../id/dist/chunk-PM3YNIMV.js
+// ../id/dist/chunk-C5J6V6N2.js
 import { createHash } from "crypto";
 import { chmod, mkdir, readFile, readdir, writeFile } from "fs/promises";
 import { homedir } from "os";
@@ -2414,7 +2469,8 @@ async function signRequest(identity, input) {
   }
   const added = {
     "signature-agent": quote(`https://post.${identity.domain}`),
-    ...agent ? { from: agent } : {}
+    ...agent ? { from: agent } : {},
+    ...input.grants?.length ? { "post-grant": input.grants.map((jws) => jws.replace(/\s+/g, "")).join(", ") } : {}
   };
   const body = input.body === void 0 || input.body === null ? null : bytesOf(input.body);
   if (body && body.length > 0) added["content-digest"] = contentDigest(body);
@@ -2425,6 +2481,7 @@ async function signRequest(identity, input) {
     ...url.search ? [["@query", url.search]] : [],
     ["signature-agent", added["signature-agent"]],
     ...added.from ? [["from", added.from]] : [],
+    ...added["post-grant"] ? [["post-grant", added["post-grant"]]] : [],
     ...added["content-digest"] ? [["content-digest", added["content-digest"]]] : []
   ];
   const params = `(${values.map(([name]) => quote(name)).join(" ")});created=${created};expires=${expires};keyid=${quote(identity.kid)};alg="ed25519";nonce=${quote(randomBytes(32).toString("base64"))};tag=${quote(input.tag ?? TAG)}`;
@@ -2468,15 +2525,15 @@ var IdClient = class {
       await signRequest(this.identity, { method, url, headers, body: text, tag: ISSUANCE_TAG })
     );
     const response = await this.fetcher(url, { method, headers, body: text ?? void 0 });
-    const json = await response.json().catch(() => null);
-    if (!response.ok || !json || json.data === void 0) {
+    const json2 = await response.json().catch(() => null);
+    if (!response.ok || !json2 || json2.data === void 0) {
       throw new IdApiError(
         response.status,
-        json?.error?.code,
-        json?.error?.message ?? `Pidgeon answered ${response.status}.`
+        json2?.error?.code,
+        json2?.error?.message ?? `Pidgeon answered ${response.status}.`
       );
     }
-    return json.data;
+    return json2.data;
   }
   /** Claim the domain with this key. Idempotent: a second call returns the same records. */
   claim() {
@@ -2498,6 +2555,20 @@ var IdClient = class {
   revoke(name) {
     return this.call("DELETE", `/agents/${encodeURIComponent(name)}`);
   }
+  /**
+   * The domain grants one of its own agents, at once: what it may do, for
+   * which customer, account or order, where, until when (at most 90 days).
+   */
+  grant(input) {
+    return this.call("POST", "/grants", input);
+  }
+  /** Every token Sign in with Pidgeon issued `name`, taken back; its card and grants stand. */
+  revokeSignIns(name) {
+    return this.call("DELETE", `/agents/${encodeURIComponent(name)}/sign-ins`);
+  }
+  revokeGrant(id) {
+    return this.call("DELETE", `/grants/${encodeURIComponent(id)}`);
+  }
   /**
    * Publish `next` as the domain's key, signed by the current one. `proof`
    * is `next`'s own signature over the rotation, so nobody can rotate a
@@ -2517,6 +2588,136 @@ ${domain}
 ${from}
 ${to}`;
 }
+var TOKEN_EXCHANGE = "urn:ietf:params:oauth:grant-type:token-exchange";
+var JWT_BEARER = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+var TOKEN_TYPE_JWT = "urn:ietf:params:oauth:token-type:jwt";
+var SignInError = class extends Error {
+  constructor(step, status, code, message) {
+    super(message);
+    this.step = step;
+    this.status = status;
+    this.code = code;
+  }
+  step;
+  status;
+  code;
+};
+async function json(response) {
+  return await response.json().catch(() => null) ?? {};
+}
+function form(values) {
+  return new URLSearchParams(values).toString();
+}
+async function siteMetadata(site, fetcher = fetch) {
+  const response = await fetcher(site, { headers: { accept: "application/json" } });
+  const body = await json(response);
+  if (!response.ok || typeof body.issuer !== "string" || typeof body.client_id !== "string") {
+    throw new SignInError(
+      "site",
+      response.status,
+      void 0,
+      `${site} does not offer Sign in with Pidgeon.`
+    );
+  }
+  return { issuer: body.issuer, client_id: body.client_id, token_endpoint: site };
+}
+async function fetchCard(agent, fetcher = fetch, postHost = (domain) => `https://post.${domain}`) {
+  const domain = agent.split("@")[1] ?? "";
+  const response = await fetcher(
+    `${postHost(domain)}/.well-known/post/card?address=${encodeURIComponent(agent)}`
+  );
+  const body = await json(response);
+  if (!response.ok || typeof body.jws !== "string") {
+    throw new SignInError(
+      "card",
+      response.status,
+      void 0,
+      `${agent} has no card to sign in with.`
+    );
+  }
+  return body.jws;
+}
+function signInWithPidgeon(identity, input) {
+  return signIn(
+    identity,
+    input,
+    async ({ tokenEndpoint, exchange, headers, agent }) => signRequest(identity, {
+      method: "POST",
+      url: tokenEndpoint,
+      headers,
+      body: exchange,
+      agent,
+      grants: input.grant ? [input.grant] : void 0
+    })
+  );
+}
+async function signIn(identity, input, authenticate) {
+  const fetcher = input.fetch ?? fetch;
+  const agent = input.agent.trim().toLowerCase();
+  const site = await siteMetadata(input.site, fetcher);
+  const card = input.card ?? await fetchCard(agent, fetcher, input.postHost);
+  const discovery = await json(
+    await fetcher(`${site.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`)
+  );
+  const tokenEndpoint = discovery.token_endpoint;
+  if (typeof tokenEndpoint !== "string") {
+    throw new SignInError("pidgeon", 0, void 0, `${site.issuer} has no token endpoint.`);
+  }
+  const exchange = form({
+    grant_type: TOKEN_EXCHANGE,
+    subject_token: card,
+    subject_token_type: TOKEN_TYPE_JWT,
+    audience: site.client_id,
+    ...input.delegation ? { requested_token_type: TOKEN_TYPE_JWT } : {}
+  });
+  const headers = { "content-type": "application/x-www-form-urlencoded" };
+  const issued = await fetcher(tokenEndpoint, {
+    method: "POST",
+    headers: {
+      ...headers,
+      ...await authenticate({ tokenEndpoint, exchange, headers, agent, site })
+    },
+    body: exchange
+  });
+  const tokens = await json(issued);
+  if (!issued.ok || typeof tokens.id_token !== "string") {
+    throw new SignInError(
+      "pidgeon",
+      issued.status,
+      tokens.error,
+      tokens.error_description ?? `Pidgeon answered ${issued.status}.`
+    );
+  }
+  const bearer = form({ grant_type: JWT_BEARER, assertion: tokens.id_token });
+  const answered = await fetcher(site.token_endpoint, {
+    method: "POST",
+    headers: {
+      ...headers,
+      ...await signRequest(identity, {
+        method: "POST",
+        url: site.token_endpoint,
+        headers,
+        body: bearer,
+        agent
+      })
+    },
+    body: bearer
+  });
+  const session = await json(answered);
+  if (!answered.ok) {
+    throw new SignInError(
+      "site",
+      answered.status,
+      session.error,
+      session.error_description ?? `The site answered ${answered.status}.`
+    );
+  }
+  return {
+    site: session,
+    idToken: tokens.id_token,
+    accessToken: tokens.access_token
+  };
+}
 var UsageError = class extends Error {
 };
 var HELP = `pidgeon id \u2014 a signed identity for your agents, on your own domain. No account.
@@ -2527,6 +2728,13 @@ var HELP = `pidgeon id \u2014 a signed identity for your agents, on your own dom
   list                   Agents on the domain
   revoke <name>          Withdraw an agent's card now
   rotate                 Replace the domain's key; the old one verifies for another day
+  grant <name>           Grant <name> what it may do, as the domain
+                           --scope bookings.change --label "manage bookings"
+                           --subject customer:42  --audience delta.com  --days 30
+                           --grantor maria@example.com   ask a person instead
+  revoke-grant <id>      Take a grant back now
+  revoke-sign-ins <name> End every token <name> signed in with; its card and grants stand
+  sign-in <site>         Sign in to a site as an agent   --as <name>  --grant <jws>
 
   --domain <domain>      Which domain, when this machine holds more than one
   --json                 Print the API's answer as JSON
@@ -2569,7 +2777,7 @@ async function runId(argv, env = process.env, options = {}) {
   const [command, ...rest] = positional;
   if (!command || flags.has("help") || command === "help") return HELP;
   const dir = identityDir(env);
-  const json = flags.has("json");
+  const json2 = flags.has("json");
   const say = options.stderr ?? (() => {
   });
   const sleep2 = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
@@ -2600,7 +2808,7 @@ async function runId(argv, env = process.env, options = {}) {
           made = true;
         }
         let state = await client2(identity).claim();
-        if (json && (state.status === "verified" || flags.has("no-wait")))
+        if (json2 && (state.status === "verified" || flags.has("no-wait")))
           return JSON.stringify(state, null, 2);
         const lines = [
           made ? `Made a signing key for ${domain} on this machine (${identity.kid}).` : `Using the key for ${domain} on this machine.`
@@ -2629,13 +2837,13 @@ Or add them by hand:` : "Add these records at your DNS provider:",
           }
           lines.length = 0;
         }
-        if (json) return JSON.stringify(state, null, 2);
+        if (json2) return JSON.stringify(state, null, 2);
         return [...lines, `${domain} is proved. Next: pidgeon id issue support-agent`].join("\n").trim();
       }
       case "check": {
         const identity = rest[0] ? await loadIdentity(rest[0], { dir, env }) : await which();
         const state = await client2(identity).check();
-        if (json) return JSON.stringify(state, null, 2);
+        if (json2) return JSON.stringify(state, null, 2);
         return [
           `${state.domain}: ${state.status === "verified" ? "proved" : state.status}`,
           ...describeRecords(state)
@@ -2655,7 +2863,7 @@ Or add them by hand:` : "Add these records at your DNS provider:",
           ...kind ? { kind } : {},
           ...typeof onBehalfOf === "string" ? { on_behalf_of: onBehalfOf } : {}
         });
-        if (json) return JSON.stringify(card, null, 2);
+        if (json2) return JSON.stringify(card, null, 2);
         return [
           `${card.card.address} has a card: ${card.url}`,
           `Found from the address at https://post.${identity.domain}/.well-known/post/card?address=${card.card.address}`,
@@ -2664,7 +2872,7 @@ Or add them by hand:` : "Add these records at your DNS provider:",
       }
       case "list": {
         const agents = await client2(await which()).list();
-        if (json) return JSON.stringify(agents, null, 2);
+        if (json2) return JSON.stringify(agents, null, 2);
         if (agents.length === 0)
           return "No agents yet. `pidgeon id issue <name>` gives one a card.";
         return agents.map((agent) => `${agent.address}  ${agent.kind}  ${agent.card_url}`).join("\n");
@@ -2673,7 +2881,7 @@ Or add them by hand:` : "Add these records at your DNS provider:",
         const name = rest[0]?.trim().toLowerCase();
         if (!name) throw new UsageError("Name the agent: `pidgeon id revoke support-agent`.");
         const revoked = await client2(await which()).revoke(name);
-        if (json) return JSON.stringify(revoked, null, 2);
+        if (json2) return JSON.stringify(revoked, null, 2);
         return `${revoked.address} has no card from now on. Copies already fetched lapse within a day.`;
       }
       case "rotate": {
@@ -2682,9 +2890,89 @@ Or add them by hand:` : "Add these records at your DNS provider:",
         const state = await client2(current).rotate(next);
         next.previous = { kid: current.kid, publicKey: current.publicKey };
         await saveIdentity(next, dir);
-        if (json) return JSON.stringify(state, null, 2);
+        if (json2) return JSON.stringify(state, null, 2);
         return `${current.domain} signs with ${next.kid} now. ${current.kid} still verifies for a day.`;
       }
+      case "grant": {
+        const name = rest[0]?.trim().toLowerCase();
+        const scope = flags.get("scope");
+        const label = flags.get("label");
+        const subject = flags.get("subject");
+        if (!name || typeof scope !== "string" || typeof label !== "string") {
+          throw new UsageError(
+            'Name the agent and the scope: `pidgeon id grant support-agent --scope bookings.change --label "manage bookings" --subject customer:42`.'
+          );
+        }
+        const [type, ...idParts] = typeof subject === "string" ? subject.split(":") : [];
+        if (!type || idParts.length === 0 || !["customer", "account", "order"].includes(type)) {
+          throw new UsageError("--subject is customer:<id>, account:<id> or order:<id>.");
+        }
+        const days = flags.get("days");
+        const audience = flags.get("audience");
+        const grantor = flags.get("grantor");
+        const grant = await client2(await which()).grant({
+          agent: name,
+          scope: { name: scope, label },
+          subject: { type, id: idParts.join(":") },
+          ...typeof audience === "string" ? { audience } : {},
+          ...typeof grantor === "string" ? { grantor: { email: grantor } } : {},
+          ...typeof days === "string" ? { expires_at: new Date(Date.now() + Number(days) * 864e5).toISOString() } : {}
+        });
+        if (json2) return JSON.stringify(grant, null, 2);
+        if (grant.consent_url) {
+          return [
+            `Asked ${typeof grantor === "string" ? grantor : "them"} to let ${grant.agent} ${grant.scope.label} for ${grant.subject.type} ${grant.subject.id}.`,
+            `Send them this link; nothing is allowed until they answer it: ${grant.consent_url}`,
+            `Grant ${grant.id}. \`pidgeon id revoke-grant ${grant.id}\` withdraws the request.`
+          ].join("\n");
+        }
+        return [
+          `${grant.agent} may ${grant.scope.label} for ${grant.subject.type} ${grant.subject.id}${grant.audience ? ` at ${grant.audience}` : ""}, until ${grant.expires_at}.`,
+          `Grant ${grant.id}. The agent carries it as Post-Grant; --json prints the JWS.`
+        ].join("\n");
+      }
+      case "revoke-grant": {
+        const grantId = rest[0]?.trim();
+        if (!grantId) throw new UsageError("Name the grant: `pidgeon id revoke-grant <id>`.");
+        const revoked = await client2(await which()).revokeGrant(grantId);
+        if (json2) return JSON.stringify(revoked, null, 2);
+        return `Grant ${revoked.id} is revoked. The next check of it fails.`;
+      }
+      case "revoke-sign-ins": {
+        const name = rest[0]?.trim().toLowerCase();
+        if (!name)
+          throw new UsageError("Name the agent: `pidgeon id revoke-sign-ins support-agent`.");
+        const done = await client2(await which()).revokeSignIns(name);
+        if (json2) return JSON.stringify(done, null, 2);
+        return `${done.address}: ${done.revoked} token${done.revoked === 1 ? "" : "s"} taken back. Its card and grants stand.`;
+      }
+      case "sign-in": {
+        const site = rest[0];
+        const name = flags.get("as");
+        if (!site || typeof name !== "string") {
+          throw new UsageError(
+            "Name the site and the agent: `pidgeon id sign-in https://site.example/api/auth/pidgeon/token --as support-agent`."
+          );
+        }
+        const identity = await which();
+        const card = await client2(identity).issue({ name: name.trim().toLowerCase() });
+        const grant = flags.get("grant");
+        try {
+          const signedIn = await signInWithPidgeon(identity, {
+            agent: card.card.address,
+            site,
+            card: card.jws,
+            ...typeof grant === "string" ? { grant } : {},
+            ...options.fetch ? { fetch: options.fetch } : {}
+          });
+          if (json2) return JSON.stringify(signedIn.site, null, 2);
+          return `Signed in to ${new URL(site).host} as ${card.card.address}.
+${JSON.stringify(signedIn.site, null, 2)}`;
+        } catch (error) {
+          if (error instanceof SignInError) throw new Error(`${error.step}: ${error.message}`);
+          throw error;
+        }
+      }
       default:
         throw new UsageError(`No such command "${command}".
 
@@ -2890,4 +3178,4 @@ export {
   find,
   run
 };
-//# sourceMappingURL=chunk-FA77SSPH.js.map
+//# sourceMappingURL=chunk-ZDJG3Z7B.js.map