@pidgeon-ai/cli 1.42.2 → 1.43.0

package/dist/{chunk-M7BO7YR6.js → chunk-GUHWCV3V.js}

@@ -2043,7 +2043,7 @@ function sleep(ms, signal) {
   });
 }
 
-// ../id/dist/chunk-2NWPDKWJ.js
+// ../id/dist/chunk-QDQDZSU7.js
 import { createHash } from "crypto";
 import { chmod, mkdir, readFile, readdir, writeFile } from "fs/promises";
 import { homedir } from "os";
@@ -2663,7 +2663,23 @@ async function siteMetadata(site, fetcher = fetch) {
       `${site} does not offer Sign in with Pidgeon.`
     );
   }
-  return { issuer: body.issuer, client_id: body.client_id, token_endpoint: site };
+  const trim = (issuer) => issuer.replace(/\/$/, "");
+  const listed = Array.isArray(body.issuers) ? body.issuers.filter((issuer) => typeof issuer === "string").map(trim) : [];
+  return {
+    issuer: body.issuer,
+    issuers: [.../* @__PURE__ */ new Set([trim(body.issuer), ...listed])],
+    client_id: body.client_id,
+    token_endpoint: site
+  };
+}
+function issuerFor(site, card) {
+  try {
+    const payload = JSON.parse(Buffer.from(card.split(".")[1] ?? "", "base64url").toString("utf8"));
+    const iss = typeof payload?.iss === "string" ? payload.iss.replace(/\/$/, "") : null;
+    if (iss && site.issuers.includes(iss)) return iss;
+  } catch {
+  }
+  return site.issuer.replace(/\/$/, "");
 }
 async function fetchCard(agent, fetcher = fetch, postHost = (domain) => `https://post.${domain}`) {
   const domain = agent.split("@")[1] ?? "";
@@ -2695,17 +2711,17 @@ function signInWithPidgeon(identity, input) {
     })
   );
 }
-async function signIn(identity, input, authenticate) {
+async function signIn(identity, input, authenticate, admit) {
   const fetcher = input.fetch ?? fetch;
   const agent = input.agent.trim().toLowerCase();
   const site = await siteMetadata(input.site, fetcher);
+  admit?.(site);
   const card = input.card ?? await fetchCard(agent, fetcher, input.postHost);
-  const discovery = await json(
-    await fetcher(`${site.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`)
-  );
+  const issuer = admit ? site.issuer.replace(/\/$/, "") : issuerFor(site, card);
+  const discovery = await json(await fetcher(`${issuer}/.well-known/openid-configuration`));
   const tokenEndpoint = discovery.token_endpoint;
   if (typeof tokenEndpoint !== "string") {
-    throw new SignInError("pidgeon", 0, void 0, `${site.issuer} has no token endpoint.`);
+    throw new SignInError("pidgeon", 0, void 0, `${issuer} has no token endpoint.`);
   }
   const exchange = form({
     grant_type: TOKEN_EXCHANGE,
@@ -3320,4 +3336,4 @@ export {
   find,
   run
 };
-//# sourceMappingURL=chunk-M7BO7YR6.js.map
+//# sourceMappingURL=chunk-GUHWCV3V.js.map