@pidgeon-ai/cli 1.38.0 → 1.40.0

package/README.md

@@ -40,6 +40,21 @@ one request open until mail arrives, and prints it with `extracted.codes` and
 describes one command, with its endpoint and its flags. Documentation:
 [pidgeon.ai/docs/cli](https://pidgeon.ai/docs/cli).
 
+## Check who sent something
+
+`pidgeon id` needs no key. It checks a message, or signs a request as one of
+your agents:
+
+```sh
+pidgeon id verify message.eml
+pidgeon id curl -I https://shop.example --as sunny
+```
+
+`verify` asks the public verifier and says whether the signature holds, which
+agent sent it, who it acts for and whether the body changed. `curl` signs the
+request the way Web Bot Auth asks and prints what it sent. `pidgeon id --help`
+lists the rest, including `init` for your own domain.
+
 ## Flags
 
 - Repeat a list flag: `--to one@example.com --to two@example.com`.

package/dist/{chunk-ZDJG3Z7B.js → chunk-D2BUTVIS.js}

@@ -2,7 +2,7 @@
 import {
   COMMANDS,
   __export
-} from "./chunk-UBA2RP6N.js";
+} from "./chunk-OETRER3H.js";
 
 // ../sdk/dist/index.js
 var dist_exports = {};
@@ -2027,7 +2027,7 @@ function sleep(ms, signal) {
   });
 }
 
-// ../id/dist/chunk-C5J6V6N2.js
+// ../id/dist/chunk-2NWPDKWJ.js
 import { createHash } from "crypto";
 import { chmod, mkdir, readFile, readdir, writeFile } from "fs/promises";
 import { homedir } from "os";
@@ -2496,6 +2496,34 @@ async function signRequest(identity, input) {
     signature: `${label}=:${Buffer.from(signature).toString("base64")}:`
   };
 }
+function signedFetch(identity, options) {
+  const base = options.fetch ?? globalThis.fetch;
+  return async (resource, init) => {
+    const request = new Request(resource, init);
+    const body = request.body ? new Uint8Array(await request.arrayBuffer()) : null;
+    const headers = {};
+    request.headers.forEach((value, name) => {
+      headers[name] = value;
+    });
+    const signature = await signRequest(identity, {
+      method: request.method,
+      url: request.url,
+      headers,
+      body,
+      agent: options.agent,
+      grants: options.grants
+    });
+    const signedHeaders = new Headers(request.headers);
+    for (const [name, value] of Object.entries(signature)) signedHeaders.set(name, value);
+    return base(request.url, {
+      method: request.method,
+      headers: signedHeaders,
+      body: body && body.length > 0 ? body : void 0,
+      redirect: request.redirect,
+      signal: request.signal
+    });
+  };
+}
 var ISSUANCE_TAG = "pidgeon-id";
 var DEFAULT_ID_URL = "https://pidgeon.ai/api/id";
 var IdApiError = class extends Error {
@@ -2735,6 +2763,8 @@ var HELP = `pidgeon id \u2014 a signed identity for your agents, on your own dom
   revoke-grant <id>      Take a grant back now
   revoke-sign-ins <name> End every token <name> signed in with; its card and grants stand
   sign-in <site>         Sign in to a site as an agent   --as <name>  --grant <jws>
+  verify [<file>]        Check a message's signatures (a file, or standard input). No key
+  curl [-I] <url>        Send a request signed as an agent   --as <name>
 
   --domain <domain>      Which domain, when this machine holds more than one
   --json                 Print the API's answer as JSON
@@ -2870,6 +2900,69 @@ Or add them by hand:` : "Add these records at your DNS provider:",
           'It renews itself. Sign with it: import { loadIdentity, signEmail, signedFetch } from "@pidgeon-ai/id".'
         ].join("\n");
       }
+      case "verify": {
+        const file = rest[0];
+        const message = file ? await (await import("fs/promises")).readFile(file, "utf8") : await (options.stdin ?? readStdin)();
+        if (!message.trim()) {
+          throw new UsageError("Give it a message: `pidgeon id verify < message.eml`.");
+        }
+        const response = await (options.fetch ?? fetch)(
+          `${new URL(baseUrl(env)).origin}/api/v1/verify`,
+          {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ message })
+          }
+        );
+        const answer = await response.json();
+        if (!response.ok || !answer.data) {
+          throw new UsageError(
+            answer.error?.message ?? `The verifier answered ${response.status}.`
+          );
+        }
+        if (json2) return JSON.stringify(answer.data, null, 2);
+        return describeVerification(answer.data);
+      }
+      case "curl": {
+        const head = rest[0] === "-I";
+        const target = (head ? rest[1] : rest[0])?.trim();
+        if (!target) throw new UsageError("Name a URL: `pidgeon id curl -I shop.example`.");
+        const url = /^https?:\/\//.test(target) ? target : `https://${target}`;
+        const identity = await which();
+        const named = flags.get("as");
+        let agent;
+        if (typeof named === "string") {
+          agent = named.includes("@") ? named : `${named}@${identity.domain}`;
+        } else {
+          const agents = await client2(identity).list();
+          if (agents.length !== 1) {
+            throw new UsageError("Say which agent signs, with --as <name>.");
+          }
+          agent = agents[0].address;
+        }
+        const sent = {};
+        const signed = signedFetch(identity, {
+          agent,
+          fetch: async (resource, init) => {
+            new Headers(init?.headers).forEach((value, name) => {
+              if (/^(signature|signature-input|signature-agent|from|content-digest)$/.test(name)) {
+                sent[name] = value;
+              }
+            });
+            return (options.fetch ?? fetch)(resource, init);
+          }
+        });
+        const response = await signed(url, { method: head ? "HEAD" : "GET" });
+        const lines = Object.entries(sent).map(
+          ([name, value]) => `> ${capitalise(name)}: ${value}`
+        );
+        lines.push(`< ${response.status} ${response.statusText}`.trimEnd());
+        if (head) {
+          response.headers.forEach((value, name) => lines.push(`< ${capitalise(name)}: ${value}`));
+          return lines.join("\n");
+        }
+        return [...lines, "", await response.text()].join("\n");
+      }
       case "list": {
         const agents = await client2(await which()).list();
         if (json2) return JSON.stringify(agents, null, 2);
@@ -2985,6 +3078,39 @@ ${HELP}`);
     throw error;
   }
 }
+function describeVerification(v) {
+  const signer = v.signatures.envelope.domain ?? v.signatures.declaration.domain;
+  const signed = v.signatures.envelope.result === "pass" || v.signatures.declaration.result === "pass";
+  const broken = v.signatures.envelope.result === "fail" || v.signatures.declaration.result === "fail";
+  const row = (ok, label, value) => `${ok === null ? "\xB7" : ok ? "\u2713" : "\u2717"} ${label.padEnd(10)} ${value}`;
+  return [
+    row(
+      signed && !broken,
+      "signature",
+      signed && !broken ? `valid, ${signer}` : broken ? `broken${signer ? `, ${signer}` : ""}` : "none"
+    ),
+    row(v.is_agent, "agent", v.sender?.address ?? "not declared"),
+    row(v.sender?.on_behalf_of ? true : null, "acts for", v.sender?.on_behalf_of ?? "not said"),
+    row(
+      v.body === "not_checked" ? null : v.body === "intact",
+      "body",
+      v.body === "intact" ? "as it was sent" : v.body === "changed" ? "changed since" : "not checked"
+    ),
+    "",
+    v.advice
+  ].join("\n");
+}
+function capitalise(name) {
+  return name.replace(
+    /(^|-)([a-z])/g,
+    (_, dash, letter) => dash + letter.toUpperCase()
+  );
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
 
 // src/index.ts
 var DEFAULT_BASE_URL = "https://pidgeon.ai/api/v1";
@@ -3178,4 +3304,4 @@ export {
   find,
   run
 };
-//# sourceMappingURL=chunk-ZDJG3Z7B.js.map
+//# sourceMappingURL=chunk-D2BUTVIS.js.map