@pidgeon-ai/issuer 0.1.1 → 0.4.0

package/dist/{chunk-CCOFMK5K.js → chunk-5GZMAASA.js}

@@ -1,6 +1,11 @@
 #!/usr/bin/env node
 
 // src/directory.ts
+function onePerAddress(agents) {
+  const count = /* @__PURE__ */ new Map();
+  for (const agent of agents) count.set(agent.address, (count.get(agent.address) ?? 0) + 1);
+  return agents.filter((agent) => count.get(agent.address) === 1);
+}
 function staticDirectory(agents) {
   const list = agents.map((agent) => ({ ...agent, address: agent.address.toLowerCase() }));
   return {
@@ -25,6 +30,86 @@ function cachedDirectory(inner, seconds = 60, now = () => Date.now()) {
   };
 }
 
+// src/auth0.ts
+var PER_PAGE = 100;
+function auth0Directory(options) {
+  const base = `https://${options.tenant.replace(/^https:\/\//, "").replace(/\/$/, "")}`;
+  const domain = options.domain.toLowerCase();
+  const fetcher = options.fetch ?? fetch;
+  const now = options.now ?? (() => Date.now());
+  let token = null;
+  async function accessToken() {
+    if (token && token.until > now()) return token.value;
+    const response = await fetcher(`${base}/oauth/token`, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "client_credentials",
+        client_id: options.clientId,
+        client_secret: options.clientSecret,
+        audience: `${base}/api/v2/`
+      })
+    });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok || !body.access_token) {
+      throw new Error(
+        `Auth0 refused the issuer's application ${options.clientId} (${response.status}).`
+      );
+    }
+    token = { value: body.access_token, until: now() + ((body.expires_in ?? 120) - 60) * 1e3 };
+    return token.value;
+  }
+  async function management(path) {
+    const response = await fetcher(`${base}/api/v2${path}`, {
+      headers: { authorization: `Bearer ${await accessToken()}`, accept: "application/json" }
+    });
+    if (response.status === 404) return null;
+    if (!response.ok) throw new Error(`Auth0 answered ${response.status} for ${path}.`);
+    return await response.json();
+  }
+  function agentOf(client) {
+    if (client.app_type !== "non_interactive") return null;
+    const metadata = client.client_metadata ?? {};
+    if (metadata.pidgeon_disabled?.trim().toLowerCase() === "true") return null;
+    const key = metadata.pidgeon_key?.trim();
+    if (!key || Buffer.from(key, "base64url").length !== 32) return null;
+    const address = metadata.pidgeon_address?.trim().toLowerCase();
+    if (!address?.endsWith(`@${domain}`)) return null;
+    return {
+      sub: client.client_id,
+      address,
+      kind: metadata.pidgeon_kind?.trim() === "service" ? "service" : "agent",
+      key,
+      groups: (metadata.pidgeon_groups ?? "").split(",").map((group) => group.trim()).filter(Boolean),
+      // An age Auth0 does not give is treated as new: the card says `new`, never older than it is.
+      createdAt: new Date(client.created_at ? Date.parse(client.created_at) : now()).toISOString()
+    };
+  }
+  async function all() {
+    const agents = [];
+    for (let page2 = 0; ; page2++) {
+      const body = await management(
+        `/clients?app_type=non_interactive&per_page=${PER_PAGE}&page=${page2}&include_totals=true`
+      );
+      const clients = body?.clients ?? [];
+      for (const client of clients) {
+        const agent = agentOf(client);
+        if (agent) agents.push(agent);
+      }
+      if (clients.length < PER_PAGE || (page2 + 1) * PER_PAGE >= (body?.total ?? 0)) break;
+    }
+    return agents;
+  }
+  return {
+    agents: async () => onePerAddress(await all()),
+    async agent(sub) {
+      const client = await management(`/clients/${encodeURIComponent(sub)}`);
+      const agent = client ? agentOf(client) : null;
+      return agent?.sub === sub ? agent : null;
+    }
+  };
+}
+
 // src/keycloak.ts
 var SERVICE_ACCOUNT_PREFIX = "service-account-";
 var ATTRIBUTES = { key: "pidgeon.key", address: "pidgeon.address", kind: "pidgeon.kind" };
@@ -106,7 +191,7 @@ function keycloakDirectory(options) {
       const clients = await admin("/clients?first=0&max=1000") ?? [];
       const candidates = clients.filter((client) => keyOf(client) !== null);
       const agents = await Promise.all(candidates.map(agentOf));
-      return agents.filter((agent) => agent !== null);
+      return onePerAddress(agents.filter((agent) => agent !== null));
     },
     /**
      * The user's record does not name its client (only a realm export
@@ -128,8 +213,121 @@ function keycloakDirectory(options) {
   };
 }
 
-// src/signer.ts
-import { readFile } from "fs/promises";
+// src/okta.ts
+import { createPrivateKey, randomUUID, sign } from "crypto";
+var OKTA_SCOPE = "okta.apps.read";
+function oktaDirectory(options) {
+  const org = options.org.replace(/\/$/, "");
+  const domain = options.domain.toLowerCase();
+  const fetcher = options.fetch ?? fetch;
+  const now = options.now ?? (() => Date.now());
+  const privateKey = typeof options.privateKey === "string" ? createPrivateKey(options.privateKey) : options.privateKey;
+  const alg = privateKey.asymmetricKeyType === "rsa" ? "RS256" : privateKey.asymmetricKeyType === "ec" && privateKey.asymmetricKeyDetails?.namedCurve === "prime256v1" ? "ES256" : null;
+  if (!alg) throw new Error("Okta's client assertion is signed with an RSA or P-256 key.");
+  let token = null;
+  function assertion(audience) {
+    const at = Math.floor(now() / 1e3);
+    const b64 = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+    const input = `${b64({ alg, typ: "JWT", ...options.keyId ? { kid: options.keyId } : {} })}.${b64(
+      {
+        iss: options.clientId,
+        sub: options.clientId,
+        aud: audience,
+        iat: at,
+        exp: at + 300,
+        jti: randomUUID()
+      }
+    )}`;
+    const signature = sign(
+      "sha256",
+      Buffer.from(input),
+      alg === "ES256" ? { key: privateKey, dsaEncoding: "ieee-p1363" } : privateKey
+    );
+    return `${input}.${signature.toString("base64url")}`;
+  }
+  async function accessToken() {
+    if (token && token.until > now()) return token.value;
+    const endpoint = `${org}/oauth2/v1/token`;
+    const response = await fetcher(endpoint, {
+      method: "POST",
+      headers: {
+        "content-type": "application/x-www-form-urlencoded",
+        accept: "application/json"
+      },
+      body: new URLSearchParams({
+        grant_type: "client_credentials",
+        scope: OKTA_SCOPE,
+        client_assertion_type: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+        client_assertion: assertion(endpoint)
+      })
+    });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok || !body.access_token) {
+      throw new Error(
+        `Okta refused the issuer's app ${options.clientId} (${response.status}${body.error_description ? `: ${body.error_description}` : ""}).`
+      );
+    }
+    token = { value: body.access_token, until: now() + ((body.expires_in ?? 120) - 60) * 1e3 };
+    return token.value;
+  }
+  async function api(url) {
+    const response = await fetcher(url, {
+      headers: { authorization: `Bearer ${await accessToken()}`, accept: "application/json" }
+    });
+    if (!response.ok && response.status !== 404) {
+      throw new Error(`Okta answered ${response.status} for ${new URL(url).pathname}.`);
+    }
+    return response;
+  }
+  function agentOf(app) {
+    if (app.status !== "ACTIVE") return null;
+    if (app.settings?.oauthClient?.application_type !== "service") return null;
+    const pidgeon = app.profile?.pidgeon;
+    const key = typeof pidgeon?.key === "string" ? pidgeon.key.trim() : "";
+    if (!key || Buffer.from(key, "base64url").length !== 32) return null;
+    const address = typeof pidgeon?.address === "string" ? pidgeon.address.trim().toLowerCase() : "";
+    if (!address.endsWith(`@${domain}`)) return null;
+    return {
+      sub: app.id,
+      address,
+      kind: pidgeon?.kind === "service" ? "service" : "agent",
+      key,
+      groups: Array.isArray(pidgeon?.groups) ? pidgeon.groups.filter((group) => typeof group === "string") : [],
+      createdAt: new Date(app.created ? Date.parse(app.created) : now()).toISOString()
+    };
+  }
+  function nextPage(response) {
+    for (const part of (response.headers.get("link") ?? "").split(",")) {
+      const match = /<([^>]+)>\s*;\s*rel="next"/.exec(part);
+      if (match && new URL(match[1]).origin === new URL(org).origin) return match[1];
+    }
+    return null;
+  }
+  return {
+    async agents() {
+      const agents = [];
+      let url = `${org}/api/v1/apps?filter=${encodeURIComponent('status eq "ACTIVE"')}&limit=200`;
+      for (let pages = 0; url && pages < 100; pages++) {
+        const response = await api(url);
+        for (const app of await response.json() ?? []) {
+          const agent = agentOf(app);
+          if (agent) agents.push(agent);
+        }
+        url = nextPage(response);
+      }
+      return onePerAddress(agents);
+    },
+    async agent(sub) {
+      const response = await api(`${org}/api/v1/apps/${encodeURIComponent(sub)}`);
+      if (response.status === 404) return null;
+      const agent = agentOf(await response.json());
+      return agent?.sub === sub ? agent : null;
+    }
+  };
+}
+
+// src/kms.ts
+import { createPublicKey, verify as verify2 } from "crypto";
 
 // ../id/dist/chunk-QDQDZSU7.js
 import { createHash } from "crypto";
@@ -148,7 +346,7 @@ __export(post_core_wasm_exports, {
   policyDecision: () => policyDecision,
   policyMaxAge: () => policyMaxAge,
   publicKey: () => publicKey,
-  sign: () => sign,
+  sign: () => sign2,
   verify: () => verify
 });
 function generateSeed() {
@@ -213,7 +411,7 @@ function publicKey(seed) {
     wasm.__wbindgen_add_to_stack_pointer(16);
   }
 }
-function sign(seed, message) {
+function sign2(seed, message) {
   try {
     const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
     const ptr0 = passArray8ToWasm0(seed, wasm.__wbindgen_export3);
@@ -624,7 +822,307 @@ function splitTopLevel(value) {
   return out;
 }
 
+// src/kms.ts
+var KMS_KEY_SPEC = "ECC_NIST_EDWARDS25519";
+var KMS_SIGNING_ALGORITHM = "ED25519_SHA_512";
+async function sdkClient(region) {
+  let sdk;
+  try {
+    sdk = await import("@aws-sdk/client-kms");
+  } catch {
+    throw new Error(
+      "A KMS key needs @aws-sdk/client-kms: `npm install @aws-sdk/client-kms` beside the issuer."
+    );
+  }
+  const client = new sdk.KMSClient(region ? { region } : {});
+  return {
+    getPublicKey: (input) => client.send(new sdk.GetPublicKeyCommand(input)),
+    sign: (input) => client.send(
+      new sdk.SignCommand({
+        ...input,
+        SigningAlgorithm: input.SigningAlgorithm
+      })
+    )
+  };
+}
+async function readKey(kms, keyId) {
+  let key;
+  try {
+    key = await kms.getPublicKey({ KeyId: keyId });
+  } catch (error) {
+    throw new Error(
+      `KMS would not give the issuer ${keyId}'s public key (${error instanceof Error ? error.message : error}). Its role needs kms:GetPublicKey and kms:Sign on that key.`
+    );
+  }
+  if (key.KeySpec !== KMS_KEY_SPEC) {
+    throw new Error(`${keyId} is a ${key.KeySpec} key. The issuer signs with ${KMS_KEY_SPEC}.`);
+  }
+  if (key.KeyUsage && key.KeyUsage !== "SIGN_VERIFY") {
+    throw new Error(`${keyId} is not a signing key.`);
+  }
+  if (!key.SigningAlgorithms?.includes(KMS_SIGNING_ALGORITHM)) {
+    throw new Error(`${keyId} does not sign with ${KMS_SIGNING_ALGORITHM}.`);
+  }
+  if (!key.KeyId || !key.PublicKey) throw new Error(`KMS gave no public key for ${keyId}.`);
+  const publicKey2 = createPublicKey({
+    key: Buffer.from(key.PublicKey),
+    format: "der",
+    type: "spki"
+  });
+  const x = publicKey2.export({ format: "jwk" }).x;
+  const raw = new Uint8Array(Buffer.from(x ?? "", "base64url"));
+  if (raw.length !== 32) throw new Error(`${keyId}'s public key is not an Ed25519 key.`);
+  return { arn: key.KeyId, publicKey: publicKey2, raw };
+}
+async function kmsSigner(options) {
+  const kms = options.kms ?? await sdkClient(options.region);
+  const { arn, publicKey: publicKey2, raw } = await readKey(kms, options.keyId);
+  return {
+    kid: jwkThumbprint(raw),
+    publicKey: raw,
+    keyArn: arn,
+    async sign(message) {
+      const signed = await kms.sign({
+        KeyId: arn,
+        Message: message,
+        MessageType: "RAW",
+        SigningAlgorithm: KMS_SIGNING_ALGORITHM
+      });
+      const signature = signed.Signature ? new Uint8Array(signed.Signature) : null;
+      if (!signature || !verify2(null, message, publicKey2, signature)) {
+        throw new Error(
+          `KMS answered for ${arn} with a signature its public key does not verify. Nothing was signed.`
+        );
+      }
+      return signature;
+    }
+  };
+}
+async function kmsRetiredKey(options) {
+  const kms = options.kms ?? await sdkClient(options.region);
+  const { raw } = await readKey(kms, options.keyId);
+  return { kid: jwkThumbprint(raw), publicKey: raw, notAfter: options.notAfter };
+}
+
+// src/person.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash as createHash3,
+  createPublicKey as createPublicKey2,
+  randomBytes as randomBytes2,
+  timingSafeEqual,
+  verify as verify3
+} from "crypto";
+var MIN_SECRET = 32;
+var FLOW_COOKIE = "pidgeon_issuer_flow";
+var CODE_SECONDS = 60;
+var FLOW_SECONDS = 600;
+var SKEW = 60;
+var UPSTREAM_ALGS = ["RS256", "ES256", "EdDSA"];
+function checkSecret(secret) {
+  if (!secret || secret.length < MIN_SECRET) {
+    throw new Error(
+      `A person's sign-in needs PIDGEON_ISSUER_SECRET, ${MIN_SECRET} characters or more. It seals the sign-in in progress and the code; there is no default.`
+    );
+  }
+  return secret;
+}
+var b64url2 = (bytes) => Buffer.from(bytes).toString("base64url");
+function sealKey(secret, purpose) {
+  return createHash3("sha256").update(`pidgeon issuer seal\0${purpose}\0${secret}`).digest();
+}
+function seal(secret, purpose, value) {
+  const iv = randomBytes2(12);
+  const cipher = createCipheriv("aes-256-gcm", sealKey(secret, purpose), iv);
+  cipher.setAAD(Buffer.from(purpose));
+  const body = Buffer.concat([cipher.update(JSON.stringify(value), "utf8"), cipher.final()]);
+  return b64url2(Buffer.concat([iv, body, cipher.getAuthTag()]));
+}
+function unseal(secret, purpose, token) {
+  if (!token) return null;
+  try {
+    const raw = Buffer.from(token, "base64url");
+    if (raw.length < 29) return null;
+    const decipher = createDecipheriv("aes-256-gcm", sealKey(secret, purpose), raw.subarray(0, 12));
+    decipher.setAAD(Buffer.from(purpose));
+    decipher.setAuthTag(raw.subarray(raw.length - 16));
+    const text2 = Buffer.concat([
+      decipher.update(raw.subarray(12, raw.length - 16)),
+      decipher.final()
+    ]).toString("utf8");
+    return JSON.parse(text2);
+  } catch {
+    return null;
+  }
+}
+function pkceChallenge(verifier) {
+  return b64url2(createHash3("sha256").update(verifier).digest());
+}
+function pkceHolds(verifier, challenge) {
+  const a = Buffer.from(pkceChallenge(verifier));
+  const b = Buffer.from(challenge);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+function cookieOf(request, name) {
+  for (const part of (request.headers.get("cookie") ?? "").split(";")) {
+    const eq = part.indexOf("=");
+    if (eq > 0 && part.slice(0, eq).trim() === name) {
+      return decodeURIComponent(part.slice(eq + 1).trim());
+    }
+  }
+  return null;
+}
+var ProviderRefused = class extends Error {
+};
+function provider(options, fetcher, now) {
+  const issuer = options.issuer.replace(/\/$/, "");
+  let configuration = null;
+  let keys = null;
+  function discover() {
+    if (!configuration || configuration.at <= now() - 36e5) {
+      const url = options.discoveryUrl ?? `${issuer}/.well-known/openid-configuration`;
+      const value = (async () => {
+        const response = await fetcher(url, { headers: { accept: "application/json" } });
+        if (!response.ok) throw new Error(`${url} answered ${response.status}.`);
+        const body = await response.json();
+        if (body.issuer?.replace(/\/$/, "") !== issuer) {
+          throw new Error(`${url} names the issuer ${body.issuer}, not ${issuer}.`);
+        }
+        return body;
+      })();
+      configuration = { at: now(), value };
+      value.catch(() => {
+        if (configuration?.value === value) configuration = null;
+      });
+    }
+    return configuration.value;
+  }
+  async function key(kid) {
+    const find = () => keys?.value.find((one) => (kid ? one.kid === kid : true) && one.use !== "enc") ?? null;
+    const fresh = keys && keys.at > now() - 3e5;
+    if (fresh && find()) return find();
+    if (keys && keys.at > now() - 1e4) return null;
+    const response = await fetcher((await discover()).jwks_uri);
+    const body = await response.json().catch(() => ({}));
+    keys = { at: now(), value: Array.isArray(body.keys) ? body.keys : [] };
+    return find();
+  }
+  async function authorizeUrl(input) {
+    const url = new URL((await discover()).authorization_endpoint);
+    url.search = new URLSearchParams({
+      response_type: "code",
+      client_id: options.clientId,
+      redirect_uri: input.redirectUri,
+      scope: "openid email",
+      state: input.state,
+      nonce: input.nonce,
+      code_challenge: pkceChallenge(input.verifier),
+      code_challenge_method: "S256"
+    }).toString();
+    return url.toString();
+  }
+  async function redeem(input) {
+    const form = new URLSearchParams({
+      grant_type: "authorization_code",
+      code: input.code,
+      redirect_uri: input.redirectUri,
+      code_verifier: input.verifier
+    });
+    const headers = {
+      "content-type": "application/x-www-form-urlencoded",
+      accept: "application/json"
+    };
+    if (options.tokenAuth === "client_secret_post") {
+      form.set("client_id", options.clientId);
+      form.set("client_secret", options.clientSecret);
+    } else {
+      const pair = `${encodeURIComponent(options.clientId)}:${encodeURIComponent(options.clientSecret)}`;
+      headers.authorization = `Basic ${Buffer.from(pair).toString("base64")}`;
+    }
+    const response = await fetcher((await discover()).token_endpoint, {
+      method: "POST",
+      headers,
+      body: form
+    });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok || typeof body.id_token !== "string") {
+      throw new ProviderRefused(
+        `The identity provider did not sign the person in (${body.error ?? response.status}).`
+      );
+    }
+    return check(body.id_token, input.nonce);
+  }
+  async function check(token, nonce) {
+    const parts = token.split(".");
+    if (parts.length !== 3) throw new ProviderRefused("The provider sent no ID token.");
+    let header;
+    let claims;
+    try {
+      header = JSON.parse(Buffer.from(parts[0], "base64url").toString("utf8"));
+      claims = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    } catch {
+      throw new ProviderRefused("The provider sent no ID token.");
+    }
+    if (!header.alg || !UPSTREAM_ALGS.includes(header.alg)) {
+      throw new ProviderRefused(`The provider's ID token is signed with ${header.alg}.`);
+    }
+    const jwk = await key(header.kid);
+    if (!jwk || !signatureHolds(header.alg, jwk, `${parts[0]}.${parts[1]}`, parts[2])) {
+      throw new ProviderRefused("The provider's ID token is not signed by its keys.");
+    }
+    const at = Math.floor(now() / 1e3);
+    if (typeof claims.iss !== "string" || claims.iss.replace(/\/$/, "") !== issuer) {
+      throw new ProviderRefused("The provider's ID token is from another issuer.");
+    }
+    const aud = claims.aud;
+    const audiences = Array.isArray(aud) ? aud : [aud];
+    if (!audiences.includes(options.clientId)) {
+      throw new ProviderRefused("The provider's ID token is for another client.");
+    }
+    if (audiences.length > 1 && claims.azp !== options.clientId) {
+      throw new ProviderRefused("The provider's ID token is for another client.");
+    }
+    if (typeof claims.exp !== "number" || claims.exp + SKEW <= at) {
+      throw new ProviderRefused("The provider's ID token has expired.");
+    }
+    if (typeof claims.iat === "number" && claims.iat > at + SKEW) {
+      throw new ProviderRefused("The provider's ID token is from the future.");
+    }
+    if (claims.nonce !== nonce) {
+      throw new ProviderRefused("The provider's ID token is for another sign-in.");
+    }
+    if (typeof claims.sub !== "string" || !claims.sub) {
+      throw new ProviderRefused("The provider's ID token names nobody.");
+    }
+    if (claims.email_verified !== true || typeof claims.email !== "string") {
+      throw new ProviderRefused("The identity provider has not verified this person\u2019s address.");
+    }
+    return {
+      sub: claims.sub,
+      email: claims.email.trim().toLowerCase(),
+      authTime: typeof claims.auth_time === "number" ? claims.auth_time : at
+    };
+  }
+  return { authorizeUrl, redeem };
+}
+function signatureHolds(alg, jwk, input, signature) {
+  try {
+    const key = createPublicKey2({ key: jwk, format: "jwk" });
+    const data = Buffer.from(input);
+    const sig = Buffer.from(signature, "base64url");
+    if (alg === "EdDSA") return jwk.kty === "OKP" && verify3(null, data, key, sig);
+    if (alg === "ES256") {
+      return jwk.kty === "EC" && jwk.crv === "P-256" && verify3("sha256", data, { key, dsaEncoding: "ieee-p1363" }, sig);
+    }
+    return jwk.kty === "RSA" && verify3("sha256", data, key, sig);
+  } catch {
+    return false;
+  }
+}
+
 // src/signer.ts
+import { readFile } from "fs/promises";
 async function fileSigner(path) {
   let file;
   try {
@@ -667,15 +1165,50 @@ async function loadConfig(path, env = process.env) {
     throw new Error(`${path}: \`domain\` is the domain whose agents this issues for.`);
   }
   const here = (relative) => resolve(dirname(path), relative);
-  const signer = env.PIDGEON_ISSUER_KEY ? seedSigner(env.PIDGEON_ISSUER_KEY, { domain: file.domain }) : file.key ? await fileSigner(here(file.key)) : null;
-  if (!signer) throw new Error(`${path}: name a \`key\` file, or set PIDGEON_ISSUER_KEY.`);
+  const signer = env.PIDGEON_ISSUER_KEY ? seedSigner(env.PIDGEON_ISSUER_KEY, { domain: file.domain }) : typeof file.key === "string" ? await fileSigner(here(file.key)) : file.key?.kms ? await kmsSigner({ keyId: file.key.kms, region: file.key.region }) : null;
+  if (!signer) {
+    throw new Error(`${path}: name a \`key\` file or a KMS key, or set PIDGEON_ISSUER_KEY.`);
+  }
   const retired = [];
   for (const entry of file.retired ?? []) {
-    const old = await fileSigner(here(entry.key));
-    retired.push({ kid: old.kid, publicKey: old.publicKey, notAfter: new Date(entry.not_after) });
+    const notAfter = new Date(entry.not_after);
+    if (typeof entry.key === "string") {
+      const old = await fileSigner(here(entry.key));
+      retired.push({ kid: old.kid, publicKey: old.publicKey, notAfter });
+    } else {
+      retired.push(
+        await kmsRetiredKey({ keyId: entry.key.kms, region: entry.key.region, notAfter })
+      );
+    }
+  }
+  let person;
+  if (file.person) {
+    const { oidc } = file.person;
+    const secretName = oidc?.client_secret_env ?? "PIDGEON_PERSON_CLIENT_SECRET";
+    if (!oidc?.issuer || !oidc.client_id) {
+      throw new Error(
+        `${path}: \`person.oidc\` names the provider's \`issuer\` and the \`client_id\`.`
+      );
+    }
+    const clientSecret = env[secretName];
+    if (!clientSecret) {
+      throw new Error(`${path}: set ${secretName}, the issuer's client secret at ${oidc.issuer}.`);
+    }
+    person = {
+      secret: checkSecret(env.PIDGEON_ISSUER_SECRET),
+      oidc: {
+        issuer: oidc.issuer,
+        discoveryUrl: oidc.discovery_url,
+        clientId: oidc.client_id,
+        clientSecret,
+        tokenAuth: oidc.token_auth
+      },
+      emailDomains: file.person.email_domains
+    };
   }
   return {
     domain: file.domain,
+    person,
     issuer: file.issuer,
     organisation: file.organisation,
     signer,
@@ -703,6 +1236,32 @@ function directoryFrom(file, path, env) {
       group: keycloak.group
     });
   }
+  if ("auth0" in directory) {
+    const { auth0 } = directory;
+    const secretName = auth0.client_secret_env ?? "AUTH0_CLIENT_SECRET";
+    const secret = env[secretName];
+    if (!secret) throw new Error(`${path}: set ${secretName}, the issuer's Auth0 client secret.`);
+    return auth0Directory({
+      tenant: auth0.tenant,
+      clientId: auth0.client_id,
+      clientSecret: secret,
+      domain: file.domain
+    });
+  }
+  if ("okta" in directory) {
+    const { okta } = directory;
+    const keyName = okta.private_key_env ?? "OKTA_PRIVATE_KEY";
+    const privateKey = env[keyName];
+    if (!privateKey)
+      throw new Error(`${path}: set ${keyName}, the issuer's Okta private key (PEM).`);
+    return oktaDirectory({
+      org: okta.org,
+      clientId: okta.client_id,
+      privateKey,
+      keyId: okta.key_id,
+      domain: file.domain
+    });
+  }
   if ("static" in directory && Array.isArray(directory.static)) {
     for (const agent of directory.static) {
       if (!agent.address?.toLowerCase().endsWith(`@${file.domain.toLowerCase()}`)) {
@@ -711,11 +1270,13 @@ function directoryFrom(file, path, env) {
     }
     return staticDirectory(directory.static);
   }
-  throw new Error(`${path}: \`directory\` is { "keycloak": {...} } or { "static": [...] }.`);
+  throw new Error(
+    `${path}: \`directory\` is { "keycloak": {...} }, { "auth0": {...} }, { "okta": {...} } or { "static": [...] }.`
+  );
 }
 
 // src/issuer.ts
-import { createHash as createHash3, createPublicKey, randomUUID, verify as verify2 } from "crypto";
+import { createHash as createHash4, createPublicKey as createPublicKey3, randomBytes as randomBytes3, randomUUID as randomUUID2, verify as verify4 } from "crypto";
 var TOKEN_EXCHANGE2 = "urn:ietf:params:oauth:grant-type:token-exchange";
 var TOKEN_TYPE_JWT = "urn:ietf:params:oauth:token-type:jwt";
 var TOKEN_TYPE_ID = "urn:ietf:params:oauth:token-type:id_token";
@@ -726,6 +1287,9 @@ var PATHS = {
   card: "/.well-known/post/card",
   directory: "/.well-known/http-message-signatures-directory",
   token: "/api/post/oidc/token",
+  authorize: "/api/post/oidc/authorize",
+  /** The issuer's own: where the company's identity provider sends a person back. Cloud has none. */
+  callback: "/api/post/oidc/callback",
   jwks: "/api/post/oidc/jwks",
   grants: "/api/post/grants"
 };
@@ -736,8 +1300,8 @@ var NEW_ADDRESS_DAYS = 30;
 var EXCHANGE_SIGNATURE_SECONDS = 600;
 var EXCHANGE_COMPONENTS = ["@method", "@authority", "@path", "from", "content-digest"];
 var GRANT_HEADER = "post-grant";
-var b64url2 = (bytes) => Buffer.from(bytes).toString("base64url");
-var encode = (value) => b64url2(JSON.stringify(value));
+var b64url3 = (bytes) => Buffer.from(bytes).toString("base64url");
+var encode = (value) => b64url3(JSON.stringify(value));
 var iso = (ms) => new Date(ms).toISOString().replace(/\.\d{3}Z$/, "Z");
 function memoryReplayStore(now = () => Date.now()) {
   const seen = /* @__PURE__ */ new Map();
@@ -768,10 +1332,12 @@ function createIssuer(options) {
   const replay = options.replay ?? memoryReplayStore(now);
   const organisation = options.organisation ?? domain;
   const nowSeconds = () => Math.floor(now() / 1e3);
+  const person = options.person ? { ...options.person, secret: checkSecret(options.person.secret) } : null;
+  const upstream = person ? provider(person.oidc, fetcher, now) : null;
   async function jws(header, payload) {
     const input = `${encode({ ...header, kid: options.signer.kid })}.${encode(payload)}`;
     const signature = await options.signer.sign(new TextEncoder().encode(input));
-    return `${input}.${b64url2(signature)}`;
+    return `${input}.${b64url3(signature)}`;
   }
   function readOurs(token, typ) {
     const parts = token.replace(/\s+/g, "").split(".");
@@ -781,11 +1347,11 @@ function createIssuer(options) {
       if (header?.alg !== "EdDSA" || header?.typ !== typ) return null;
       const key = publishedIssuerKeys().find((candidate) => candidate.kid === header.kid);
       if (!key) return null;
-      const signed = verify2(
+      const signed = verify4(
         null,
         Buffer.from(`${parts[0]}.${parts[1]}`),
-        createPublicKey({
-          key: { kty: "OKP", crv: "Ed25519", x: b64url2(key.publicKey) },
+        createPublicKey3({
+          key: { kty: "OKP", crv: "Ed25519", x: b64url3(key.publicKey) },
           format: "jwk"
         }),
         Buffer.from(parts[2], "base64url")
@@ -812,7 +1378,7 @@ function createIssuer(options) {
       ...publishedIssuerKeys().map((key) => ({
         kid: key.kid,
         alg: "Ed25519",
-        pub: b64url2(key.publicKey),
+        pub: b64url3(key.publicKey),
         not_after: iso(key.notAfter)
       })),
       ...unique(agents.map((agent) => agent.key)).map((x) => ({
@@ -852,7 +1418,7 @@ function createIssuer(options) {
       keys: publishedIssuerKeys().map((key) => ({
         kty: "OKP",
         crv: "Ed25519",
-        x: b64url2(key.publicKey),
+        x: b64url3(key.publicKey),
         kid: key.kid,
         alg: "EdDSA",
         use: "sig"
@@ -864,9 +1430,17 @@ function createIssuer(options) {
       issuer,
       token_endpoint: `${issuer}${PATHS.token}`,
       jwks_uri: `${issuer}${PATHS.jwks}`,
-      grant_types_supported: [TOKEN_EXCHANGE2],
-      // No person signs in here yet: there is no authorization endpoint.
-      response_types_supported: [],
+      ...person ? {
+        authorization_endpoint: `${issuer}${PATHS.authorize}`,
+        grant_types_supported: ["authorization_code", TOKEN_EXCHANGE2],
+        response_types_supported: ["code"],
+        code_challenge_methods_supported: ["S256"],
+        scopes_supported: ["openid", "email"]
+      } : {
+        grant_types_supported: [TOKEN_EXCHANGE2],
+        // No person signs in here: there is no authorization endpoint.
+        response_types_supported: []
+      },
       subject_types_supported: ["public"],
       id_token_signing_alg_values_supported: ["EdDSA"],
       token_endpoint_auth_methods_supported: ["none"],
@@ -886,6 +1460,8 @@ function createIssuer(options) {
         "standing",
         "card",
         "grant",
+        "grants",
+        "nonce",
         "cnf",
         "act",
         "sub_type"
@@ -894,7 +1470,7 @@ function createIssuer(options) {
     };
   }
   function record() {
-    const id = createHash3("sha256").update(`post policy id\0self-hosted\0${domain}`).digest("hex").slice(0, 16);
+    const id = createHash4("sha256").update(`post policy id\0self-hosted\0${domain}`).digest("hex").slice(0, 16);
     return `v=post0; id=${id}`;
   }
   const cardUrl = (address) => `${issuer}${PATHS.card}?address=${encodeURIComponent(address)}`;
@@ -931,7 +1507,7 @@ function createIssuer(options) {
     const claims = cardClaims(agent);
     return { jws: await jws({ alg: "EdDSA", typ: "agent-card+jwt" }, claims), card: claims };
   }
-  const grantId = (agent, rule) => `grt_${createHash3("sha256").update(
+  const grantId = (agent, rule) => `grt_${createHash4("sha256").update(
     `${agent.sub}\0${rule.group}\0${rule.scope.name}\0${rule.subject.type}:${rule.subject.id}`
   ).digest("base64url").slice(0, 22)}`;
   const rulesFor = (agent) => (options.grants ?? []).filter((rule) => agent.groups.includes(rule.group));
@@ -977,20 +1553,25 @@ function createIssuer(options) {
   const clientCache = /* @__PURE__ */ new Map();
   async function clientHost(clientId) {
     if (!clientId) throw new Refused("invalid_target", "audience is the site's client_id.");
+    return (await site(clientId)).host;
+  }
+  async function site(clientId) {
     const listed = options.clients?.find((client) => client.client_id === clientId);
-    if (listed) return listed.host.toLowerCase();
+    if (listed) {
+      return { host: listed.host.toLowerCase(), redirectUris: listed.redirect_uris ?? [] };
+    }
     let url;
     try {
       url = new URL(clientId);
     } catch {
       throw new Refused("invalid_target", `${clientId} is not a site this issuer knows.`);
     }
-    const allowed = (options.clientMetadataHosts ?? []).map((host2) => host2.toLowerCase());
+    const allowed = (options.clientMetadataHosts ?? []).map((host) => host.toLowerCase());
     if (url.protocol !== "https:" || !allowed.includes(url.hostname.toLowerCase())) {
       throw new Refused("invalid_target", `${clientId} is not a site this issuer knows.`);
     }
     const held = clientCache.get(clientId);
-    if (held && held.at > now() - 3e5) return held.host;
+    if (held && held.at > now() - 3e5) return held.site;
     const response = await fetcher(clientId, {
       redirect: "error",
       headers: { accept: "application/json" },
@@ -1002,16 +1583,20 @@ function createIssuer(options) {
       if (text2.length <= 64 * 1024) document = JSON.parse(text2);
     } catch {
     }
-    const redirect = Array.isArray(document.redirect_uris) ? document.redirect_uris[0] : null;
-    if (document.client_id !== clientId || typeof redirect !== "string") {
+    const redirects = Array.isArray(document.redirect_uris) ? document.redirect_uris.filter((uri) => typeof uri === "string") : [];
+    if (document.client_id !== clientId || redirects.length === 0) {
+      throw new Refused("invalid_target", `${clientId} does not describe a site.`);
+    }
+    let found;
+    try {
+      found = { host: new URL(redirects[0]).hostname.toLowerCase(), redirectUris: redirects };
+    } catch {
       throw new Refused("invalid_target", `${clientId} does not describe a site.`);
     }
-    const host = new URL(redirect).hostname.toLowerCase();
-    clientCache.set(clientId, { at: now(), host });
-    return host;
+    clientCache.set(clientId, { at: now(), site: found });
+    return found;
   }
-  async function exchange(request) {
-    const body = await request.text();
+  async function exchange(request, body) {
     const form = new URLSearchParams(body);
     if (form.get("grant_type") !== TOKEN_EXCHANGE2) {
       throw new Refused("unsupported_grant_type", `Use ${TOKEN_EXCHANGE2}.`);
@@ -1113,7 +1698,7 @@ function createIssuer(options) {
     }
     const audience = form.get("audience");
     const iat = nowSeconds();
-    const jti = randomUUID();
+    const jti = randomUUID2();
     const cnf = { jwk: { kty: "OKP", crv: "Ed25519", x: live.key } };
     const fresh = now() - Date.parse(live.createdAt) < NEW_ADDRESS_DAYS * 864e5;
     const idToken = await jws(
@@ -1211,6 +1796,170 @@ function createIssuer(options) {
     const grants = await grantsFor(agent);
     return json({ object: "list", data: grants.map((grant) => ({ object: "grant", ...grant })) });
   }
+  const callbackUrl = `${issuer}${PATHS.callback}`;
+  const random = () => b64url3(randomBytes3(32));
+  function flowCookie(value, maxAge) {
+    const secure = issuer.startsWith("https:") ? "; Secure" : "";
+    return `${FLOW_COOKIE}=${value}; Path=${PATHS.callback}; Max-Age=${maxAge}; HttpOnly; SameSite=Lax${secure}`;
+  }
+  function backToSite(redirectUri, state, values, headers = {}) {
+    const url = new URL(redirectUri);
+    for (const [name, value] of Object.entries(values)) url.searchParams.set(name, value);
+    if (state) url.searchParams.set("state", state);
+    url.searchParams.set("iss", issuer);
+    return new Response(null, {
+      status: 302,
+      headers: { location: url.toString(), "cache-control": "no-store", ...headers }
+    });
+  }
+  async function authorize(url) {
+    const params = url.searchParams;
+    for (const name of ["client_id", "redirect_uri", "state", "nonce", "code_challenge"]) {
+      if (params.getAll(name).length > 1) return page(`${name} is given more than once`);
+    }
+    const clientId = params.get("client_id");
+    const redirectUri = params.get("redirect_uri");
+    if (!clientId || !redirectUri) return page("client_id and redirect_uri are required");
+    const known = await site(clientId).catch((error) => {
+      if (error instanceof Refused) return null;
+      throw error;
+    });
+    if (!known) return page(`${clientId} is not a site this issuer knows`);
+    if (!known.redirectUris.includes(redirectUri)) {
+      return page(`${redirectUri} is not where ${clientId} receives sign-ins`);
+    }
+    const state = params.get("state");
+    const fail = (error, description) => backToSite(redirectUri, state, { error, error_description: description });
+    if (params.get("response_type") !== "code") {
+      return fail("unsupported_response_type", "response_type is code.");
+    }
+    const scope = params.get("scope") ?? "";
+    if (!scope.split(" ").includes("openid")) {
+      return fail("invalid_scope", "scope includes openid.");
+    }
+    const challenge = params.get("code_challenge");
+    if (!challenge || !/^[A-Za-z0-9_-]{43}$/.test(challenge) || params.get("code_challenge_method") !== "S256") {
+      return fail("invalid_request", "PKCE is required: code_challenge with S256.");
+    }
+    const flow = {
+      site: { clientId, redirectUri, state, nonce: params.get("nonce"), challenge, scope },
+      upstream: { state: random(), nonce: random(), verifier: random() },
+      exp: nowSeconds() + FLOW_SECONDS
+    };
+    const location = await upstream.authorizeUrl({
+      redirectUri: callbackUrl,
+      state: flow.upstream.state,
+      nonce: flow.upstream.nonce,
+      verifier: flow.upstream.verifier
+    });
+    return new Response(null, {
+      status: 302,
+      headers: {
+        location,
+        "cache-control": "no-store",
+        "set-cookie": flowCookie(seal(person.secret, "flow", flow), FLOW_SECONDS)
+      }
+    });
+  }
+  async function callback(request, url) {
+    const flow = unseal(person.secret, "flow", cookieOf(request, FLOW_COOKIE));
+    const clear = { "set-cookie": flowCookie("", 0) };
+    if (!flow || flow.exp <= nowSeconds() || url.searchParams.get("state") !== flow.upstream.state) {
+      return page("this sign-in was not started in this browser. Start again from the site", clear);
+    }
+    const back = (values) => backToSite(flow.site.redirectUri, flow.site.state, values, clear);
+    const code = url.searchParams.get("code");
+    if (url.searchParams.get("error") || !code) {
+      return back({ error: "access_denied", error_description: "The person did not sign in." });
+    }
+    let who;
+    try {
+      who = await upstream.redeem({
+        code,
+        redirectUri: callbackUrl,
+        verifier: flow.upstream.verifier,
+        nonce: flow.upstream.nonce
+      });
+    } catch (error) {
+      if (!(error instanceof ProviderRefused)) throw error;
+      return back({ error: "access_denied", error_description: error.message });
+    }
+    const domains = (person.emailDomains ?? [domain]).map((one) => one.toLowerCase());
+    if (!domains.includes(who.email.slice(who.email.lastIndexOf("@") + 1))) {
+      return back({
+        error: "access_denied",
+        error_description: `${who.email} is not an address this issuer signs people in with.`
+      });
+    }
+    if ((await options.directory.agents()).some((agent) => agent.address === who.email)) {
+      return back({
+        error: "access_denied",
+        error_description: `${who.email} is an agent's address, not a person's.`
+      });
+    }
+    const sealed = {
+      jti: randomUUID2(),
+      clientId: flow.site.clientId,
+      redirectUri: flow.site.redirectUri,
+      challenge: flow.site.challenge,
+      nonce: flow.site.nonce,
+      scope: flow.site.scope,
+      sub: who.sub,
+      email: who.email,
+      authTime: who.authTime,
+      exp: nowSeconds() + CODE_SECONDS
+    };
+    return back({ code: seal(person.secret, "code", sealed) });
+  }
+  async function redeemCode(form) {
+    const verifier = form.get("code_verifier");
+    const clientId = form.get("client_id");
+    if (!verifier || !clientId) {
+      throw new Refused("invalid_request", "code, code_verifier and client_id are required.");
+    }
+    const code = unseal(person.secret, "code", form.get("code"));
+    if (!code) throw new Refused("invalid_grant", "That code is not valid.");
+    if (code.clientId !== clientId) {
+      throw new Refused("invalid_grant", "That code was issued to a different client.");
+    }
+    if (!await replay.use(`code ${code.jti}`, code.exp + 60)) {
+      throw new Refused("invalid_grant", "That code has already been used.");
+    }
+    if (code.exp <= nowSeconds()) throw new Refused("invalid_grant", "That code has expired.");
+    const redirectUri = form.get("redirect_uri");
+    if (redirectUri !== null && redirectUri !== code.redirectUri) {
+      throw new Refused("invalid_grant", "redirect_uri does not match the authorization request.");
+    }
+    if (!pkceHolds(verifier, code.challenge)) {
+      throw new Refused("invalid_grant", "code_verifier does not match the code_challenge.");
+    }
+    const iat = nowSeconds();
+    const idToken = await jws(
+      { alg: "EdDSA", typ: "JWT" },
+      {
+        iss: issuer,
+        aud: clientId,
+        iat,
+        exp: iat + ID_TOKEN_SECONDS,
+        auth_time: code.authTime,
+        ...code.nonce ? { nonce: code.nonce } : {},
+        jti: randomUUID2(),
+        sub: code.sub,
+        kind: "person",
+        email: code.email,
+        email_verified: true,
+        // Grants here are the organisation's, to its agents; a person gives none at this issuer.
+        grants: []
+      }
+    );
+    return json({
+      access_token: idToken,
+      token_type: "Bearer",
+      expires_in: ID_TOKEN_SECONDS,
+      id_token: idToken,
+      scope: code.scope
+    });
+  }
   async function handle(request) {
     const url = new URL(request.url);
     const path = url.pathname;
@@ -1237,7 +1986,16 @@ function createIssuer(options) {
           300
         );
       }
-      if (request.method === "POST" && path === PATHS.token) return await exchange(request);
+      if (request.method === "POST" && path === PATHS.token) {
+        const body = await request.text();
+        const form = new URLSearchParams(body);
+        if (person && form.get("grant_type") === "authorization_code") {
+          return await redeemCode(form);
+        }
+        return await exchange(request, body);
+      }
+      if (person && get && path === PATHS.authorize) return await authorize(url);
+      if (person && get && path === PATHS.callback) return await callback(request, url);
       if (get && path === PATHS.grants) return await listGrants(request);
       const status = /^\/api\/post\/grants\/(grt_[A-Za-z0-9_-]+)\/status$/.exec(path);
       if (get && status) {
@@ -1266,6 +2024,17 @@ function createIssuer(options) {
 function unique(values) {
   return [...new Set(values)];
 }
+function page(reason, headers = {}) {
+  return new Response(`This sign-in can\u2019t go on: ${reason}.
+`, {
+    status: 400,
+    headers: {
+      "content-type": "text/plain; charset=utf-8",
+      "cache-control": "no-store",
+      ...headers
+    }
+  });
+}
 function json(value, maxAge = 0, status = 200) {
   return text(JSON.stringify(value), "application/json", maxAge, status);
 }
@@ -1414,7 +2183,11 @@ ${HELP}`);
 export {
   staticDirectory,
   cachedDirectory,
+  auth0Directory,
   keycloakDirectory,
+  oktaDirectory,
+  kmsSigner,
+  kmsRetiredKey,
   fileSigner,
   seedSigner,
   loadConfig,
@@ -1426,4 +2199,4 @@ export {
   UsageError2 as UsageError,
   runIssuer
 };
-//# sourceMappingURL=chunk-CCOFMK5K.js.map
+//# sourceMappingURL=chunk-5GZMAASA.js.map